1 // SPDX-License-Identifier: GPL-2.0-or-later 2 /* 3 * 4 * Bluetooth support for Intel devices 5 * 6 * Copyright (C) 2015 Intel Corporation 7 */ 8 9 #include <linux/module.h> 10 #include <linux/firmware.h> 11 #include <linux/regmap.h> 12 #include <linux/acpi.h> 13 #include <acpi/acpi_bus.h> 14 #include <asm/unaligned.h> 15 16 #include <net/bluetooth/bluetooth.h> 17 #include <net/bluetooth/hci_core.h> 18 19 #include "btintel.h" 20 21 #define VERSION "0.1" 22 23 #define BDADDR_INTEL (&(bdaddr_t){{0x00, 0x8b, 0x9e, 0x19, 0x03, 0x00}}) 24 #define RSA_HEADER_LEN 644 25 #define CSS_HEADER_OFFSET 8 26 #define ECDSA_OFFSET 644 27 #define ECDSA_HEADER_LEN 320 28 29 enum { 30 DSM_SET_WDISABLE2_DELAY = 1, 31 DSM_SET_RESET_METHOD = 3, 32 }; 33 34 #define CMD_WRITE_BOOT_PARAMS 0xfc0e 35 struct cmd_write_boot_params { 36 __le32 boot_addr; 37 u8 fw_build_num; 38 u8 fw_build_ww; 39 u8 fw_build_yy; 40 } __packed; 41 42 static struct { 43 const char *driver_name; 44 u8 hw_variant; 45 u32 fw_build_num; 46 } coredump_info; 47 48 static const guid_t btintel_guid_dsm = 49 GUID_INIT(0xaa10f4e0, 0x81ac, 0x4233, 50 0xab, 0xf6, 0x3b, 0x2a, 0xc5, 0x0e, 0x28, 0xd9); 51 52 int btintel_check_bdaddr(struct hci_dev *hdev) 53 { 54 struct hci_rp_read_bd_addr *bda; 55 struct sk_buff *skb; 56 57 skb = __hci_cmd_sync(hdev, HCI_OP_READ_BD_ADDR, 0, NULL, 58 HCI_INIT_TIMEOUT); 59 if (IS_ERR(skb)) { 60 int err = PTR_ERR(skb); 61 bt_dev_err(hdev, "Reading Intel device address failed (%d)", 62 err); 63 return err; 64 } 65 66 if (skb->len != sizeof(*bda)) { 67 bt_dev_err(hdev, "Intel device address length mismatch"); 68 kfree_skb(skb); 69 return -EIO; 70 } 71 72 bda = (struct hci_rp_read_bd_addr *)skb->data; 73 74 /* For some Intel based controllers, the default Bluetooth device 75 * address 00:03:19:9E:8B:00 can be found. These controllers are 76 * fully operational, but have the danger of duplicate addresses 77 * and that in turn can cause problems with Bluetooth operation. 78 */ 79 if (!bacmp(&bda->bdaddr, BDADDR_INTEL)) { 80 bt_dev_err(hdev, "Found Intel default device address (%pMR)", 81 &bda->bdaddr); 82 set_bit(HCI_QUIRK_INVALID_BDADDR, &hdev->quirks); 83 } 84 85 kfree_skb(skb); 86 87 return 0; 88 } 89 EXPORT_SYMBOL_GPL(btintel_check_bdaddr); 90 91 int btintel_enter_mfg(struct hci_dev *hdev) 92 { 93 static const u8 param[] = { 0x01, 0x00 }; 94 struct sk_buff *skb; 95 96 skb = __hci_cmd_sync(hdev, 0xfc11, 2, param, HCI_CMD_TIMEOUT); 97 if (IS_ERR(skb)) { 98 bt_dev_err(hdev, "Entering manufacturer mode failed (%ld)", 99 PTR_ERR(skb)); 100 return PTR_ERR(skb); 101 } 102 kfree_skb(skb); 103 104 return 0; 105 } 106 EXPORT_SYMBOL_GPL(btintel_enter_mfg); 107 108 int btintel_exit_mfg(struct hci_dev *hdev, bool reset, bool patched) 109 { 110 u8 param[] = { 0x00, 0x00 }; 111 struct sk_buff *skb; 112 113 /* The 2nd command parameter specifies the manufacturing exit method: 114 * 0x00: Just disable the manufacturing mode (0x00). 115 * 0x01: Disable manufacturing mode and reset with patches deactivated. 116 * 0x02: Disable manufacturing mode and reset with patches activated. 117 */ 118 if (reset) 119 param[1] |= patched ? 0x02 : 0x01; 120 121 skb = __hci_cmd_sync(hdev, 0xfc11, 2, param, HCI_CMD_TIMEOUT); 122 if (IS_ERR(skb)) { 123 bt_dev_err(hdev, "Exiting manufacturer mode failed (%ld)", 124 PTR_ERR(skb)); 125 return PTR_ERR(skb); 126 } 127 kfree_skb(skb); 128 129 return 0; 130 } 131 EXPORT_SYMBOL_GPL(btintel_exit_mfg); 132 133 int btintel_set_bdaddr(struct hci_dev *hdev, const bdaddr_t *bdaddr) 134 { 135 struct sk_buff *skb; 136 int err; 137 138 skb = __hci_cmd_sync(hdev, 0xfc31, 6, bdaddr, HCI_INIT_TIMEOUT); 139 if (IS_ERR(skb)) { 140 err = PTR_ERR(skb); 141 bt_dev_err(hdev, "Changing Intel device address failed (%d)", 142 err); 143 return err; 144 } 145 kfree_skb(skb); 146 147 return 0; 148 } 149 EXPORT_SYMBOL_GPL(btintel_set_bdaddr); 150 151 static int btintel_set_event_mask(struct hci_dev *hdev, bool debug) 152 { 153 u8 mask[8] = { 0x87, 0x0c, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 }; 154 struct sk_buff *skb; 155 int err; 156 157 if (debug) 158 mask[1] |= 0x62; 159 160 skb = __hci_cmd_sync(hdev, 0xfc52, 8, mask, HCI_INIT_TIMEOUT); 161 if (IS_ERR(skb)) { 162 err = PTR_ERR(skb); 163 bt_dev_err(hdev, "Setting Intel event mask failed (%d)", err); 164 return err; 165 } 166 kfree_skb(skb); 167 168 return 0; 169 } 170 171 int btintel_set_diag(struct hci_dev *hdev, bool enable) 172 { 173 struct sk_buff *skb; 174 u8 param[3]; 175 int err; 176 177 if (enable) { 178 param[0] = 0x03; 179 param[1] = 0x03; 180 param[2] = 0x03; 181 } else { 182 param[0] = 0x00; 183 param[1] = 0x00; 184 param[2] = 0x00; 185 } 186 187 skb = __hci_cmd_sync(hdev, 0xfc43, 3, param, HCI_INIT_TIMEOUT); 188 if (IS_ERR(skb)) { 189 err = PTR_ERR(skb); 190 if (err == -ENODATA) 191 goto done; 192 bt_dev_err(hdev, "Changing Intel diagnostic mode failed (%d)", 193 err); 194 return err; 195 } 196 kfree_skb(skb); 197 198 done: 199 btintel_set_event_mask(hdev, enable); 200 return 0; 201 } 202 EXPORT_SYMBOL_GPL(btintel_set_diag); 203 204 static int btintel_set_diag_mfg(struct hci_dev *hdev, bool enable) 205 { 206 int err, ret; 207 208 err = btintel_enter_mfg(hdev); 209 if (err) 210 return err; 211 212 ret = btintel_set_diag(hdev, enable); 213 214 err = btintel_exit_mfg(hdev, false, false); 215 if (err) 216 return err; 217 218 return ret; 219 } 220 221 static int btintel_set_diag_combined(struct hci_dev *hdev, bool enable) 222 { 223 int ret; 224 225 /* Legacy ROM device needs to be in the manufacturer mode to apply 226 * diagnostic setting 227 * 228 * This flag is set after reading the Intel version. 229 */ 230 if (btintel_test_flag(hdev, INTEL_ROM_LEGACY)) 231 ret = btintel_set_diag_mfg(hdev, enable); 232 else 233 ret = btintel_set_diag(hdev, enable); 234 235 return ret; 236 } 237 238 void btintel_hw_error(struct hci_dev *hdev, u8 code) 239 { 240 struct sk_buff *skb; 241 u8 type = 0x00; 242 243 bt_dev_err(hdev, "Hardware error 0x%2.2x", code); 244 245 skb = __hci_cmd_sync(hdev, HCI_OP_RESET, 0, NULL, HCI_INIT_TIMEOUT); 246 if (IS_ERR(skb)) { 247 bt_dev_err(hdev, "Reset after hardware error failed (%ld)", 248 PTR_ERR(skb)); 249 return; 250 } 251 kfree_skb(skb); 252 253 skb = __hci_cmd_sync(hdev, 0xfc22, 1, &type, HCI_INIT_TIMEOUT); 254 if (IS_ERR(skb)) { 255 bt_dev_err(hdev, "Retrieving Intel exception info failed (%ld)", 256 PTR_ERR(skb)); 257 return; 258 } 259 260 if (skb->len != 13) { 261 bt_dev_err(hdev, "Exception info size mismatch"); 262 kfree_skb(skb); 263 return; 264 } 265 266 bt_dev_err(hdev, "Exception info %s", (char *)(skb->data + 1)); 267 268 kfree_skb(skb); 269 } 270 EXPORT_SYMBOL_GPL(btintel_hw_error); 271 272 int btintel_version_info(struct hci_dev *hdev, struct intel_version *ver) 273 { 274 const char *variant; 275 276 /* The hardware platform number has a fixed value of 0x37 and 277 * for now only accept this single value. 278 */ 279 if (ver->hw_platform != 0x37) { 280 bt_dev_err(hdev, "Unsupported Intel hardware platform (%u)", 281 ver->hw_platform); 282 return -EINVAL; 283 } 284 285 /* Check for supported iBT hardware variants of this firmware 286 * loading method. 287 * 288 * This check has been put in place to ensure correct forward 289 * compatibility options when newer hardware variants come along. 290 */ 291 switch (ver->hw_variant) { 292 case 0x07: /* WP - Legacy ROM */ 293 case 0x08: /* StP - Legacy ROM */ 294 case 0x0b: /* SfP */ 295 case 0x0c: /* WsP */ 296 case 0x11: /* JfP */ 297 case 0x12: /* ThP */ 298 case 0x13: /* HrP */ 299 case 0x14: /* CcP */ 300 break; 301 default: 302 bt_dev_err(hdev, "Unsupported Intel hardware variant (%u)", 303 ver->hw_variant); 304 return -EINVAL; 305 } 306 307 switch (ver->fw_variant) { 308 case 0x01: 309 variant = "Legacy ROM 2.5"; 310 break; 311 case 0x06: 312 variant = "Bootloader"; 313 break; 314 case 0x22: 315 variant = "Legacy ROM 2.x"; 316 break; 317 case 0x23: 318 variant = "Firmware"; 319 break; 320 default: 321 bt_dev_err(hdev, "Unsupported firmware variant(%02x)", ver->fw_variant); 322 return -EINVAL; 323 } 324 325 coredump_info.hw_variant = ver->hw_variant; 326 coredump_info.fw_build_num = ver->fw_build_num; 327 328 bt_dev_info(hdev, "%s revision %u.%u build %u week %u %u", 329 variant, ver->fw_revision >> 4, ver->fw_revision & 0x0f, 330 ver->fw_build_num, ver->fw_build_ww, 331 2000 + ver->fw_build_yy); 332 333 return 0; 334 } 335 EXPORT_SYMBOL_GPL(btintel_version_info); 336 337 static int btintel_secure_send(struct hci_dev *hdev, u8 fragment_type, u32 plen, 338 const void *param) 339 { 340 while (plen > 0) { 341 struct sk_buff *skb; 342 u8 cmd_param[253], fragment_len = (plen > 252) ? 252 : plen; 343 344 cmd_param[0] = fragment_type; 345 memcpy(cmd_param + 1, param, fragment_len); 346 347 skb = __hci_cmd_sync(hdev, 0xfc09, fragment_len + 1, 348 cmd_param, HCI_INIT_TIMEOUT); 349 if (IS_ERR(skb)) 350 return PTR_ERR(skb); 351 352 kfree_skb(skb); 353 354 plen -= fragment_len; 355 param += fragment_len; 356 } 357 358 return 0; 359 } 360 361 int btintel_load_ddc_config(struct hci_dev *hdev, const char *ddc_name) 362 { 363 const struct firmware *fw; 364 struct sk_buff *skb; 365 const u8 *fw_ptr; 366 int err; 367 368 err = request_firmware_direct(&fw, ddc_name, &hdev->dev); 369 if (err < 0) { 370 bt_dev_err(hdev, "Failed to load Intel DDC file %s (%d)", 371 ddc_name, err); 372 return err; 373 } 374 375 bt_dev_info(hdev, "Found Intel DDC parameters: %s", ddc_name); 376 377 fw_ptr = fw->data; 378 379 /* DDC file contains one or more DDC structure which has 380 * Length (1 byte), DDC ID (2 bytes), and DDC value (Length - 2). 381 */ 382 while (fw->size > fw_ptr - fw->data) { 383 u8 cmd_plen = fw_ptr[0] + sizeof(u8); 384 385 skb = __hci_cmd_sync(hdev, 0xfc8b, cmd_plen, fw_ptr, 386 HCI_INIT_TIMEOUT); 387 if (IS_ERR(skb)) { 388 bt_dev_err(hdev, "Failed to send Intel_Write_DDC (%ld)", 389 PTR_ERR(skb)); 390 release_firmware(fw); 391 return PTR_ERR(skb); 392 } 393 394 fw_ptr += cmd_plen; 395 kfree_skb(skb); 396 } 397 398 release_firmware(fw); 399 400 bt_dev_info(hdev, "Applying Intel DDC parameters completed"); 401 402 return 0; 403 } 404 EXPORT_SYMBOL_GPL(btintel_load_ddc_config); 405 406 int btintel_set_event_mask_mfg(struct hci_dev *hdev, bool debug) 407 { 408 int err, ret; 409 410 err = btintel_enter_mfg(hdev); 411 if (err) 412 return err; 413 414 ret = btintel_set_event_mask(hdev, debug); 415 416 err = btintel_exit_mfg(hdev, false, false); 417 if (err) 418 return err; 419 420 return ret; 421 } 422 EXPORT_SYMBOL_GPL(btintel_set_event_mask_mfg); 423 424 int btintel_read_version(struct hci_dev *hdev, struct intel_version *ver) 425 { 426 struct sk_buff *skb; 427 428 skb = __hci_cmd_sync(hdev, 0xfc05, 0, NULL, HCI_CMD_TIMEOUT); 429 if (IS_ERR(skb)) { 430 bt_dev_err(hdev, "Reading Intel version information failed (%ld)", 431 PTR_ERR(skb)); 432 return PTR_ERR(skb); 433 } 434 435 if (!skb || skb->len != sizeof(*ver)) { 436 bt_dev_err(hdev, "Intel version event size mismatch"); 437 kfree_skb(skb); 438 return -EILSEQ; 439 } 440 441 memcpy(ver, skb->data, sizeof(*ver)); 442 443 kfree_skb(skb); 444 445 return 0; 446 } 447 EXPORT_SYMBOL_GPL(btintel_read_version); 448 449 int btintel_version_info_tlv(struct hci_dev *hdev, 450 struct intel_version_tlv *version) 451 { 452 const char *variant; 453 454 /* The hardware platform number has a fixed value of 0x37 and 455 * for now only accept this single value. 456 */ 457 if (INTEL_HW_PLATFORM(version->cnvi_bt) != 0x37) { 458 bt_dev_err(hdev, "Unsupported Intel hardware platform (0x%2x)", 459 INTEL_HW_PLATFORM(version->cnvi_bt)); 460 return -EINVAL; 461 } 462 463 /* Check for supported iBT hardware variants of this firmware 464 * loading method. 465 * 466 * This check has been put in place to ensure correct forward 467 * compatibility options when newer hardware variants come along. 468 */ 469 switch (INTEL_HW_VARIANT(version->cnvi_bt)) { 470 case 0x17: /* TyP */ 471 case 0x18: /* Slr */ 472 case 0x19: /* Slr-F */ 473 case 0x1b: /* Mgr */ 474 case 0x1c: /* Gale Peak (GaP) */ 475 case 0x1d: /* BlazarU (BzrU) */ 476 case 0x1e: /* BlazarI (Bzr) */ 477 break; 478 default: 479 bt_dev_err(hdev, "Unsupported Intel hardware variant (0x%x)", 480 INTEL_HW_VARIANT(version->cnvi_bt)); 481 return -EINVAL; 482 } 483 484 switch (version->img_type) { 485 case BTINTEL_IMG_BOOTLOADER: 486 variant = "Bootloader"; 487 /* It is required that every single firmware fragment is acknowledged 488 * with a command complete event. If the boot parameters indicate 489 * that this bootloader does not send them, then abort the setup. 490 */ 491 if (version->limited_cce != 0x00) { 492 bt_dev_err(hdev, "Unsupported Intel firmware loading method (0x%x)", 493 version->limited_cce); 494 return -EINVAL; 495 } 496 497 /* Secure boot engine type should be either 1 (ECDSA) or 0 (RSA) */ 498 if (version->sbe_type > 0x01) { 499 bt_dev_err(hdev, "Unsupported Intel secure boot engine type (0x%x)", 500 version->sbe_type); 501 return -EINVAL; 502 } 503 504 bt_dev_info(hdev, "Device revision is %u", version->dev_rev_id); 505 bt_dev_info(hdev, "Secure boot is %s", 506 version->secure_boot ? "enabled" : "disabled"); 507 bt_dev_info(hdev, "OTP lock is %s", 508 version->otp_lock ? "enabled" : "disabled"); 509 bt_dev_info(hdev, "API lock is %s", 510 version->api_lock ? "enabled" : "disabled"); 511 bt_dev_info(hdev, "Debug lock is %s", 512 version->debug_lock ? "enabled" : "disabled"); 513 bt_dev_info(hdev, "Minimum firmware build %u week %u %u", 514 version->min_fw_build_nn, version->min_fw_build_cw, 515 2000 + version->min_fw_build_yy); 516 break; 517 case BTINTEL_IMG_IML: 518 variant = "Intermediate loader"; 519 break; 520 case BTINTEL_IMG_OP: 521 variant = "Firmware"; 522 break; 523 default: 524 bt_dev_err(hdev, "Unsupported image type(%02x)", version->img_type); 525 return -EINVAL; 526 } 527 528 coredump_info.hw_variant = INTEL_HW_VARIANT(version->cnvi_bt); 529 coredump_info.fw_build_num = version->build_num; 530 531 bt_dev_info(hdev, "%s timestamp %u.%u buildtype %u build %u", variant, 532 2000 + (version->timestamp >> 8), version->timestamp & 0xff, 533 version->build_type, version->build_num); 534 if (version->img_type == BTINTEL_IMG_OP) 535 bt_dev_info(hdev, "Firmware SHA1: 0x%8.8x", version->git_sha1); 536 537 return 0; 538 } 539 EXPORT_SYMBOL_GPL(btintel_version_info_tlv); 540 541 int btintel_parse_version_tlv(struct hci_dev *hdev, 542 struct intel_version_tlv *version, 543 struct sk_buff *skb) 544 { 545 /* Consume Command Complete Status field */ 546 skb_pull(skb, 1); 547 548 /* Event parameters contatin multiple TLVs. Read each of them 549 * and only keep the required data. Also, it use existing legacy 550 * version field like hw_platform, hw_variant, and fw_variant 551 * to keep the existing setup flow 552 */ 553 while (skb->len) { 554 struct intel_tlv *tlv; 555 556 /* Make sure skb has a minimum length of the header */ 557 if (skb->len < sizeof(*tlv)) 558 return -EINVAL; 559 560 tlv = (struct intel_tlv *)skb->data; 561 562 /* Make sure skb has a enough data */ 563 if (skb->len < tlv->len + sizeof(*tlv)) 564 return -EINVAL; 565 566 switch (tlv->type) { 567 case INTEL_TLV_CNVI_TOP: 568 version->cnvi_top = get_unaligned_le32(tlv->val); 569 break; 570 case INTEL_TLV_CNVR_TOP: 571 version->cnvr_top = get_unaligned_le32(tlv->val); 572 break; 573 case INTEL_TLV_CNVI_BT: 574 version->cnvi_bt = get_unaligned_le32(tlv->val); 575 break; 576 case INTEL_TLV_CNVR_BT: 577 version->cnvr_bt = get_unaligned_le32(tlv->val); 578 break; 579 case INTEL_TLV_DEV_REV_ID: 580 version->dev_rev_id = get_unaligned_le16(tlv->val); 581 break; 582 case INTEL_TLV_IMAGE_TYPE: 583 version->img_type = tlv->val[0]; 584 break; 585 case INTEL_TLV_TIME_STAMP: 586 /* If image type is Operational firmware (0x03), then 587 * running FW Calendar Week and Year information can 588 * be extracted from Timestamp information 589 */ 590 version->min_fw_build_cw = tlv->val[0]; 591 version->min_fw_build_yy = tlv->val[1]; 592 version->timestamp = get_unaligned_le16(tlv->val); 593 break; 594 case INTEL_TLV_BUILD_TYPE: 595 version->build_type = tlv->val[0]; 596 break; 597 case INTEL_TLV_BUILD_NUM: 598 /* If image type is Operational firmware (0x03), then 599 * running FW build number can be extracted from the 600 * Build information 601 */ 602 version->min_fw_build_nn = tlv->val[0]; 603 version->build_num = get_unaligned_le32(tlv->val); 604 break; 605 case INTEL_TLV_SECURE_BOOT: 606 version->secure_boot = tlv->val[0]; 607 break; 608 case INTEL_TLV_OTP_LOCK: 609 version->otp_lock = tlv->val[0]; 610 break; 611 case INTEL_TLV_API_LOCK: 612 version->api_lock = tlv->val[0]; 613 break; 614 case INTEL_TLV_DEBUG_LOCK: 615 version->debug_lock = tlv->val[0]; 616 break; 617 case INTEL_TLV_MIN_FW: 618 version->min_fw_build_nn = tlv->val[0]; 619 version->min_fw_build_cw = tlv->val[1]; 620 version->min_fw_build_yy = tlv->val[2]; 621 break; 622 case INTEL_TLV_LIMITED_CCE: 623 version->limited_cce = tlv->val[0]; 624 break; 625 case INTEL_TLV_SBE_TYPE: 626 version->sbe_type = tlv->val[0]; 627 break; 628 case INTEL_TLV_OTP_BDADDR: 629 memcpy(&version->otp_bd_addr, tlv->val, 630 sizeof(bdaddr_t)); 631 break; 632 case INTEL_TLV_GIT_SHA1: 633 version->git_sha1 = get_unaligned_le32(tlv->val); 634 break; 635 case INTEL_TLV_FW_ID: 636 snprintf(version->fw_id, sizeof(version->fw_id), 637 "%s", tlv->val); 638 break; 639 default: 640 /* Ignore rest of information */ 641 break; 642 } 643 /* consume the current tlv and move to next*/ 644 skb_pull(skb, tlv->len + sizeof(*tlv)); 645 } 646 647 return 0; 648 } 649 EXPORT_SYMBOL_GPL(btintel_parse_version_tlv); 650 651 static int btintel_read_version_tlv(struct hci_dev *hdev, 652 struct intel_version_tlv *version) 653 { 654 struct sk_buff *skb; 655 const u8 param[1] = { 0xFF }; 656 657 if (!version) 658 return -EINVAL; 659 660 skb = __hci_cmd_sync(hdev, 0xfc05, 1, param, HCI_CMD_TIMEOUT); 661 if (IS_ERR(skb)) { 662 bt_dev_err(hdev, "Reading Intel version information failed (%ld)", 663 PTR_ERR(skb)); 664 return PTR_ERR(skb); 665 } 666 667 if (skb->data[0]) { 668 bt_dev_err(hdev, "Intel Read Version command failed (%02x)", 669 skb->data[0]); 670 kfree_skb(skb); 671 return -EIO; 672 } 673 674 btintel_parse_version_tlv(hdev, version, skb); 675 676 kfree_skb(skb); 677 return 0; 678 } 679 680 /* ------- REGMAP IBT SUPPORT ------- */ 681 682 #define IBT_REG_MODE_8BIT 0x00 683 #define IBT_REG_MODE_16BIT 0x01 684 #define IBT_REG_MODE_32BIT 0x02 685 686 struct regmap_ibt_context { 687 struct hci_dev *hdev; 688 __u16 op_write; 689 __u16 op_read; 690 }; 691 692 struct ibt_cp_reg_access { 693 __le32 addr; 694 __u8 mode; 695 __u8 len; 696 __u8 data[]; 697 } __packed; 698 699 struct ibt_rp_reg_access { 700 __u8 status; 701 __le32 addr; 702 __u8 data[]; 703 } __packed; 704 705 static int regmap_ibt_read(void *context, const void *addr, size_t reg_size, 706 void *val, size_t val_size) 707 { 708 struct regmap_ibt_context *ctx = context; 709 struct ibt_cp_reg_access cp; 710 struct ibt_rp_reg_access *rp; 711 struct sk_buff *skb; 712 int err = 0; 713 714 if (reg_size != sizeof(__le32)) 715 return -EINVAL; 716 717 switch (val_size) { 718 case 1: 719 cp.mode = IBT_REG_MODE_8BIT; 720 break; 721 case 2: 722 cp.mode = IBT_REG_MODE_16BIT; 723 break; 724 case 4: 725 cp.mode = IBT_REG_MODE_32BIT; 726 break; 727 default: 728 return -EINVAL; 729 } 730 731 /* regmap provides a little-endian formatted addr */ 732 cp.addr = *(__le32 *)addr; 733 cp.len = val_size; 734 735 bt_dev_dbg(ctx->hdev, "Register (0x%x) read", le32_to_cpu(cp.addr)); 736 737 skb = hci_cmd_sync(ctx->hdev, ctx->op_read, sizeof(cp), &cp, 738 HCI_CMD_TIMEOUT); 739 if (IS_ERR(skb)) { 740 err = PTR_ERR(skb); 741 bt_dev_err(ctx->hdev, "regmap: Register (0x%x) read error (%d)", 742 le32_to_cpu(cp.addr), err); 743 return err; 744 } 745 746 if (skb->len != sizeof(*rp) + val_size) { 747 bt_dev_err(ctx->hdev, "regmap: Register (0x%x) read error, bad len", 748 le32_to_cpu(cp.addr)); 749 err = -EINVAL; 750 goto done; 751 } 752 753 rp = (struct ibt_rp_reg_access *)skb->data; 754 755 if (rp->addr != cp.addr) { 756 bt_dev_err(ctx->hdev, "regmap: Register (0x%x) read error, bad addr", 757 le32_to_cpu(rp->addr)); 758 err = -EINVAL; 759 goto done; 760 } 761 762 memcpy(val, rp->data, val_size); 763 764 done: 765 kfree_skb(skb); 766 return err; 767 } 768 769 static int regmap_ibt_gather_write(void *context, 770 const void *addr, size_t reg_size, 771 const void *val, size_t val_size) 772 { 773 struct regmap_ibt_context *ctx = context; 774 struct ibt_cp_reg_access *cp; 775 struct sk_buff *skb; 776 int plen = sizeof(*cp) + val_size; 777 u8 mode; 778 int err = 0; 779 780 if (reg_size != sizeof(__le32)) 781 return -EINVAL; 782 783 switch (val_size) { 784 case 1: 785 mode = IBT_REG_MODE_8BIT; 786 break; 787 case 2: 788 mode = IBT_REG_MODE_16BIT; 789 break; 790 case 4: 791 mode = IBT_REG_MODE_32BIT; 792 break; 793 default: 794 return -EINVAL; 795 } 796 797 cp = kmalloc(plen, GFP_KERNEL); 798 if (!cp) 799 return -ENOMEM; 800 801 /* regmap provides a little-endian formatted addr/value */ 802 cp->addr = *(__le32 *)addr; 803 cp->mode = mode; 804 cp->len = val_size; 805 memcpy(&cp->data, val, val_size); 806 807 bt_dev_dbg(ctx->hdev, "Register (0x%x) write", le32_to_cpu(cp->addr)); 808 809 skb = hci_cmd_sync(ctx->hdev, ctx->op_write, plen, cp, HCI_CMD_TIMEOUT); 810 if (IS_ERR(skb)) { 811 err = PTR_ERR(skb); 812 bt_dev_err(ctx->hdev, "regmap: Register (0x%x) write error (%d)", 813 le32_to_cpu(cp->addr), err); 814 goto done; 815 } 816 kfree_skb(skb); 817 818 done: 819 kfree(cp); 820 return err; 821 } 822 823 static int regmap_ibt_write(void *context, const void *data, size_t count) 824 { 825 /* data contains register+value, since we only support 32bit addr, 826 * minimum data size is 4 bytes. 827 */ 828 if (WARN_ONCE(count < 4, "Invalid register access")) 829 return -EINVAL; 830 831 return regmap_ibt_gather_write(context, data, 4, data + 4, count - 4); 832 } 833 834 static void regmap_ibt_free_context(void *context) 835 { 836 kfree(context); 837 } 838 839 static const struct regmap_bus regmap_ibt = { 840 .read = regmap_ibt_read, 841 .write = regmap_ibt_write, 842 .gather_write = regmap_ibt_gather_write, 843 .free_context = regmap_ibt_free_context, 844 .reg_format_endian_default = REGMAP_ENDIAN_LITTLE, 845 .val_format_endian_default = REGMAP_ENDIAN_LITTLE, 846 }; 847 848 /* Config is the same for all register regions */ 849 static const struct regmap_config regmap_ibt_cfg = { 850 .name = "btintel_regmap", 851 .reg_bits = 32, 852 .val_bits = 32, 853 }; 854 855 struct regmap *btintel_regmap_init(struct hci_dev *hdev, u16 opcode_read, 856 u16 opcode_write) 857 { 858 struct regmap_ibt_context *ctx; 859 860 bt_dev_info(hdev, "regmap: Init R%x-W%x region", opcode_read, 861 opcode_write); 862 863 ctx = kzalloc(sizeof(*ctx), GFP_KERNEL); 864 if (!ctx) 865 return ERR_PTR(-ENOMEM); 866 867 ctx->op_read = opcode_read; 868 ctx->op_write = opcode_write; 869 ctx->hdev = hdev; 870 871 return regmap_init(&hdev->dev, ®map_ibt, ctx, ®map_ibt_cfg); 872 } 873 EXPORT_SYMBOL_GPL(btintel_regmap_init); 874 875 int btintel_send_intel_reset(struct hci_dev *hdev, u32 boot_param) 876 { 877 struct intel_reset params = { 0x00, 0x01, 0x00, 0x01, 0x00000000 }; 878 struct sk_buff *skb; 879 880 params.boot_param = cpu_to_le32(boot_param); 881 882 skb = __hci_cmd_sync(hdev, 0xfc01, sizeof(params), ¶ms, 883 HCI_INIT_TIMEOUT); 884 if (IS_ERR(skb)) { 885 bt_dev_err(hdev, "Failed to send Intel Reset command"); 886 return PTR_ERR(skb); 887 } 888 889 kfree_skb(skb); 890 891 return 0; 892 } 893 EXPORT_SYMBOL_GPL(btintel_send_intel_reset); 894 895 int btintel_read_boot_params(struct hci_dev *hdev, 896 struct intel_boot_params *params) 897 { 898 struct sk_buff *skb; 899 900 skb = __hci_cmd_sync(hdev, 0xfc0d, 0, NULL, HCI_INIT_TIMEOUT); 901 if (IS_ERR(skb)) { 902 bt_dev_err(hdev, "Reading Intel boot parameters failed (%ld)", 903 PTR_ERR(skb)); 904 return PTR_ERR(skb); 905 } 906 907 if (skb->len != sizeof(*params)) { 908 bt_dev_err(hdev, "Intel boot parameters size mismatch"); 909 kfree_skb(skb); 910 return -EILSEQ; 911 } 912 913 memcpy(params, skb->data, sizeof(*params)); 914 915 kfree_skb(skb); 916 917 if (params->status) { 918 bt_dev_err(hdev, "Intel boot parameters command failed (%02x)", 919 params->status); 920 return -bt_to_errno(params->status); 921 } 922 923 bt_dev_info(hdev, "Device revision is %u", 924 le16_to_cpu(params->dev_revid)); 925 926 bt_dev_info(hdev, "Secure boot is %s", 927 params->secure_boot ? "enabled" : "disabled"); 928 929 bt_dev_info(hdev, "OTP lock is %s", 930 params->otp_lock ? "enabled" : "disabled"); 931 932 bt_dev_info(hdev, "API lock is %s", 933 params->api_lock ? "enabled" : "disabled"); 934 935 bt_dev_info(hdev, "Debug lock is %s", 936 params->debug_lock ? "enabled" : "disabled"); 937 938 bt_dev_info(hdev, "Minimum firmware build %u week %u %u", 939 params->min_fw_build_nn, params->min_fw_build_cw, 940 2000 + params->min_fw_build_yy); 941 942 return 0; 943 } 944 EXPORT_SYMBOL_GPL(btintel_read_boot_params); 945 946 static int btintel_sfi_rsa_header_secure_send(struct hci_dev *hdev, 947 const struct firmware *fw) 948 { 949 int err; 950 951 /* Start the firmware download transaction with the Init fragment 952 * represented by the 128 bytes of CSS header. 953 */ 954 err = btintel_secure_send(hdev, 0x00, 128, fw->data); 955 if (err < 0) { 956 bt_dev_err(hdev, "Failed to send firmware header (%d)", err); 957 goto done; 958 } 959 960 /* Send the 256 bytes of public key information from the firmware 961 * as the PKey fragment. 962 */ 963 err = btintel_secure_send(hdev, 0x03, 256, fw->data + 128); 964 if (err < 0) { 965 bt_dev_err(hdev, "Failed to send firmware pkey (%d)", err); 966 goto done; 967 } 968 969 /* Send the 256 bytes of signature information from the firmware 970 * as the Sign fragment. 971 */ 972 err = btintel_secure_send(hdev, 0x02, 256, fw->data + 388); 973 if (err < 0) { 974 bt_dev_err(hdev, "Failed to send firmware signature (%d)", err); 975 goto done; 976 } 977 978 done: 979 return err; 980 } 981 982 static int btintel_sfi_ecdsa_header_secure_send(struct hci_dev *hdev, 983 const struct firmware *fw) 984 { 985 int err; 986 987 /* Start the firmware download transaction with the Init fragment 988 * represented by the 128 bytes of CSS header. 989 */ 990 err = btintel_secure_send(hdev, 0x00, 128, fw->data + 644); 991 if (err < 0) { 992 bt_dev_err(hdev, "Failed to send firmware header (%d)", err); 993 return err; 994 } 995 996 /* Send the 96 bytes of public key information from the firmware 997 * as the PKey fragment. 998 */ 999 err = btintel_secure_send(hdev, 0x03, 96, fw->data + 644 + 128); 1000 if (err < 0) { 1001 bt_dev_err(hdev, "Failed to send firmware pkey (%d)", err); 1002 return err; 1003 } 1004 1005 /* Send the 96 bytes of signature information from the firmware 1006 * as the Sign fragment 1007 */ 1008 err = btintel_secure_send(hdev, 0x02, 96, fw->data + 644 + 224); 1009 if (err < 0) { 1010 bt_dev_err(hdev, "Failed to send firmware signature (%d)", 1011 err); 1012 return err; 1013 } 1014 return 0; 1015 } 1016 1017 static int btintel_download_firmware_payload(struct hci_dev *hdev, 1018 const struct firmware *fw, 1019 size_t offset) 1020 { 1021 int err; 1022 const u8 *fw_ptr; 1023 u32 frag_len; 1024 1025 fw_ptr = fw->data + offset; 1026 frag_len = 0; 1027 err = -EINVAL; 1028 1029 while (fw_ptr - fw->data < fw->size) { 1030 struct hci_command_hdr *cmd = (void *)(fw_ptr + frag_len); 1031 1032 frag_len += sizeof(*cmd) + cmd->plen; 1033 1034 /* The parameter length of the secure send command requires 1035 * a 4 byte alignment. It happens so that the firmware file 1036 * contains proper Intel_NOP commands to align the fragments 1037 * as needed. 1038 * 1039 * Send set of commands with 4 byte alignment from the 1040 * firmware data buffer as a single Data fragement. 1041 */ 1042 if (!(frag_len % 4)) { 1043 err = btintel_secure_send(hdev, 0x01, frag_len, fw_ptr); 1044 if (err < 0) { 1045 bt_dev_err(hdev, 1046 "Failed to send firmware data (%d)", 1047 err); 1048 goto done; 1049 } 1050 1051 fw_ptr += frag_len; 1052 frag_len = 0; 1053 } 1054 } 1055 1056 done: 1057 return err; 1058 } 1059 1060 static bool btintel_firmware_version(struct hci_dev *hdev, 1061 u8 num, u8 ww, u8 yy, 1062 const struct firmware *fw, 1063 u32 *boot_addr) 1064 { 1065 const u8 *fw_ptr; 1066 1067 fw_ptr = fw->data; 1068 1069 while (fw_ptr - fw->data < fw->size) { 1070 struct hci_command_hdr *cmd = (void *)(fw_ptr); 1071 1072 /* Each SKU has a different reset parameter to use in the 1073 * HCI_Intel_Reset command and it is embedded in the firmware 1074 * data. So, instead of using static value per SKU, check 1075 * the firmware data and save it for later use. 1076 */ 1077 if (le16_to_cpu(cmd->opcode) == CMD_WRITE_BOOT_PARAMS) { 1078 struct cmd_write_boot_params *params; 1079 1080 params = (void *)(fw_ptr + sizeof(*cmd)); 1081 1082 *boot_addr = le32_to_cpu(params->boot_addr); 1083 1084 bt_dev_info(hdev, "Boot Address: 0x%x", *boot_addr); 1085 1086 bt_dev_info(hdev, "Firmware Version: %u-%u.%u", 1087 params->fw_build_num, params->fw_build_ww, 1088 params->fw_build_yy); 1089 1090 return (num == params->fw_build_num && 1091 ww == params->fw_build_ww && 1092 yy == params->fw_build_yy); 1093 } 1094 1095 fw_ptr += sizeof(*cmd) + cmd->plen; 1096 } 1097 1098 return false; 1099 } 1100 1101 int btintel_download_firmware(struct hci_dev *hdev, 1102 struct intel_version *ver, 1103 const struct firmware *fw, 1104 u32 *boot_param) 1105 { 1106 int err; 1107 1108 /* SfP and WsP don't seem to update the firmware version on file 1109 * so version checking is currently not possible. 1110 */ 1111 switch (ver->hw_variant) { 1112 case 0x0b: /* SfP */ 1113 case 0x0c: /* WsP */ 1114 /* Skip version checking */ 1115 break; 1116 default: 1117 1118 /* Skip download if firmware has the same version */ 1119 if (btintel_firmware_version(hdev, ver->fw_build_num, 1120 ver->fw_build_ww, ver->fw_build_yy, 1121 fw, boot_param)) { 1122 bt_dev_info(hdev, "Firmware already loaded"); 1123 /* Return -EALREADY to indicate that the firmware has 1124 * already been loaded. 1125 */ 1126 return -EALREADY; 1127 } 1128 } 1129 1130 /* The firmware variant determines if the device is in bootloader 1131 * mode or is running operational firmware. The value 0x06 identifies 1132 * the bootloader and the value 0x23 identifies the operational 1133 * firmware. 1134 * 1135 * If the firmware version has changed that means it needs to be reset 1136 * to bootloader when operational so the new firmware can be loaded. 1137 */ 1138 if (ver->fw_variant == 0x23) 1139 return -EINVAL; 1140 1141 err = btintel_sfi_rsa_header_secure_send(hdev, fw); 1142 if (err) 1143 return err; 1144 1145 return btintel_download_firmware_payload(hdev, fw, RSA_HEADER_LEN); 1146 } 1147 EXPORT_SYMBOL_GPL(btintel_download_firmware); 1148 1149 static int btintel_download_fw_tlv(struct hci_dev *hdev, 1150 struct intel_version_tlv *ver, 1151 const struct firmware *fw, u32 *boot_param, 1152 u8 hw_variant, u8 sbe_type) 1153 { 1154 int err; 1155 u32 css_header_ver; 1156 1157 /* Skip download if firmware has the same version */ 1158 if (btintel_firmware_version(hdev, ver->min_fw_build_nn, 1159 ver->min_fw_build_cw, 1160 ver->min_fw_build_yy, 1161 fw, boot_param)) { 1162 bt_dev_info(hdev, "Firmware already loaded"); 1163 /* Return -EALREADY to indicate that firmware has 1164 * already been loaded. 1165 */ 1166 return -EALREADY; 1167 } 1168 1169 /* The firmware variant determines if the device is in bootloader 1170 * mode or is running operational firmware. The value 0x01 identifies 1171 * the bootloader and the value 0x03 identifies the operational 1172 * firmware. 1173 * 1174 * If the firmware version has changed that means it needs to be reset 1175 * to bootloader when operational so the new firmware can be loaded. 1176 */ 1177 if (ver->img_type == BTINTEL_IMG_OP) 1178 return -EINVAL; 1179 1180 /* iBT hardware variants 0x0b, 0x0c, 0x11, 0x12, 0x13, 0x14 support 1181 * only RSA secure boot engine. Hence, the corresponding sfi file will 1182 * have RSA header of 644 bytes followed by Command Buffer. 1183 * 1184 * iBT hardware variants 0x17, 0x18 onwards support both RSA and ECDSA 1185 * secure boot engine. As a result, the corresponding sfi file will 1186 * have RSA header of 644, ECDSA header of 320 bytes followed by 1187 * Command Buffer. 1188 * 1189 * CSS Header byte positions 0x08 to 0x0B represent the CSS Header 1190 * version: RSA(0x00010000) , ECDSA (0x00020000) 1191 */ 1192 css_header_ver = get_unaligned_le32(fw->data + CSS_HEADER_OFFSET); 1193 if (css_header_ver != 0x00010000) { 1194 bt_dev_err(hdev, "Invalid CSS Header version"); 1195 return -EINVAL; 1196 } 1197 1198 if (hw_variant <= 0x14) { 1199 if (sbe_type != 0x00) { 1200 bt_dev_err(hdev, "Invalid SBE type for hardware variant (%d)", 1201 hw_variant); 1202 return -EINVAL; 1203 } 1204 1205 err = btintel_sfi_rsa_header_secure_send(hdev, fw); 1206 if (err) 1207 return err; 1208 1209 err = btintel_download_firmware_payload(hdev, fw, RSA_HEADER_LEN); 1210 if (err) 1211 return err; 1212 } else if (hw_variant >= 0x17) { 1213 /* Check if CSS header for ECDSA follows the RSA header */ 1214 if (fw->data[ECDSA_OFFSET] != 0x06) 1215 return -EINVAL; 1216 1217 /* Check if the CSS Header version is ECDSA(0x00020000) */ 1218 css_header_ver = get_unaligned_le32(fw->data + ECDSA_OFFSET + CSS_HEADER_OFFSET); 1219 if (css_header_ver != 0x00020000) { 1220 bt_dev_err(hdev, "Invalid CSS Header version"); 1221 return -EINVAL; 1222 } 1223 1224 if (sbe_type == 0x00) { 1225 err = btintel_sfi_rsa_header_secure_send(hdev, fw); 1226 if (err) 1227 return err; 1228 1229 err = btintel_download_firmware_payload(hdev, fw, 1230 RSA_HEADER_LEN + ECDSA_HEADER_LEN); 1231 if (err) 1232 return err; 1233 } else if (sbe_type == 0x01) { 1234 err = btintel_sfi_ecdsa_header_secure_send(hdev, fw); 1235 if (err) 1236 return err; 1237 1238 err = btintel_download_firmware_payload(hdev, fw, 1239 RSA_HEADER_LEN + ECDSA_HEADER_LEN); 1240 if (err) 1241 return err; 1242 } 1243 } 1244 return 0; 1245 } 1246 1247 static void btintel_reset_to_bootloader(struct hci_dev *hdev) 1248 { 1249 struct intel_reset params; 1250 struct sk_buff *skb; 1251 1252 /* Send Intel Reset command. This will result in 1253 * re-enumeration of BT controller. 1254 * 1255 * Intel Reset parameter description: 1256 * reset_type : 0x00 (Soft reset), 1257 * 0x01 (Hard reset) 1258 * patch_enable : 0x00 (Do not enable), 1259 * 0x01 (Enable) 1260 * ddc_reload : 0x00 (Do not reload), 1261 * 0x01 (Reload) 1262 * boot_option: 0x00 (Current image), 1263 * 0x01 (Specified boot address) 1264 * boot_param: Boot address 1265 * 1266 */ 1267 params.reset_type = 0x01; 1268 params.patch_enable = 0x01; 1269 params.ddc_reload = 0x01; 1270 params.boot_option = 0x00; 1271 params.boot_param = cpu_to_le32(0x00000000); 1272 1273 skb = __hci_cmd_sync(hdev, 0xfc01, sizeof(params), 1274 ¶ms, HCI_INIT_TIMEOUT); 1275 if (IS_ERR(skb)) { 1276 bt_dev_err(hdev, "FW download error recovery failed (%ld)", 1277 PTR_ERR(skb)); 1278 return; 1279 } 1280 bt_dev_info(hdev, "Intel reset sent to retry FW download"); 1281 kfree_skb(skb); 1282 1283 /* Current Intel BT controllers(ThP/JfP) hold the USB reset 1284 * lines for 2ms when it receives Intel Reset in bootloader mode. 1285 * Whereas, the upcoming Intel BT controllers will hold USB reset 1286 * for 150ms. To keep the delay generic, 150ms is chosen here. 1287 */ 1288 msleep(150); 1289 } 1290 1291 static int btintel_read_debug_features(struct hci_dev *hdev, 1292 struct intel_debug_features *features) 1293 { 1294 struct sk_buff *skb; 1295 u8 page_no = 1; 1296 1297 /* Intel controller supports two pages, each page is of 128-bit 1298 * feature bit mask. And each bit defines specific feature support 1299 */ 1300 skb = __hci_cmd_sync(hdev, 0xfca6, sizeof(page_no), &page_no, 1301 HCI_INIT_TIMEOUT); 1302 if (IS_ERR(skb)) { 1303 bt_dev_err(hdev, "Reading supported features failed (%ld)", 1304 PTR_ERR(skb)); 1305 return PTR_ERR(skb); 1306 } 1307 1308 if (skb->len != (sizeof(features->page1) + 3)) { 1309 bt_dev_err(hdev, "Supported features event size mismatch"); 1310 kfree_skb(skb); 1311 return -EILSEQ; 1312 } 1313 1314 memcpy(features->page1, skb->data + 3, sizeof(features->page1)); 1315 1316 /* Read the supported features page2 if required in future. 1317 */ 1318 kfree_skb(skb); 1319 return 0; 1320 } 1321 1322 static int btintel_set_debug_features(struct hci_dev *hdev, 1323 const struct intel_debug_features *features) 1324 { 1325 u8 mask[11] = { 0x0a, 0x92, 0x02, 0x7f, 0x00, 0x00, 0x00, 0x00, 1326 0x00, 0x00, 0x00 }; 1327 u8 period[5] = { 0x04, 0x91, 0x02, 0x05, 0x00 }; 1328 u8 trace_enable = 0x02; 1329 struct sk_buff *skb; 1330 1331 if (!features) { 1332 bt_dev_warn(hdev, "Debug features not read"); 1333 return -EINVAL; 1334 } 1335 1336 if (!(features->page1[0] & 0x3f)) { 1337 bt_dev_info(hdev, "Telemetry exception format not supported"); 1338 return 0; 1339 } 1340 1341 skb = __hci_cmd_sync(hdev, 0xfc8b, 11, mask, HCI_INIT_TIMEOUT); 1342 if (IS_ERR(skb)) { 1343 bt_dev_err(hdev, "Setting Intel telemetry ddc write event mask failed (%ld)", 1344 PTR_ERR(skb)); 1345 return PTR_ERR(skb); 1346 } 1347 kfree_skb(skb); 1348 1349 skb = __hci_cmd_sync(hdev, 0xfc8b, 5, period, HCI_INIT_TIMEOUT); 1350 if (IS_ERR(skb)) { 1351 bt_dev_err(hdev, "Setting periodicity for link statistics traces failed (%ld)", 1352 PTR_ERR(skb)); 1353 return PTR_ERR(skb); 1354 } 1355 kfree_skb(skb); 1356 1357 skb = __hci_cmd_sync(hdev, 0xfca1, 1, &trace_enable, HCI_INIT_TIMEOUT); 1358 if (IS_ERR(skb)) { 1359 bt_dev_err(hdev, "Enable tracing of link statistics events failed (%ld)", 1360 PTR_ERR(skb)); 1361 return PTR_ERR(skb); 1362 } 1363 kfree_skb(skb); 1364 1365 bt_dev_info(hdev, "set debug features: trace_enable 0x%02x mask 0x%02x", 1366 trace_enable, mask[3]); 1367 1368 return 0; 1369 } 1370 1371 static int btintel_reset_debug_features(struct hci_dev *hdev, 1372 const struct intel_debug_features *features) 1373 { 1374 u8 mask[11] = { 0x0a, 0x92, 0x02, 0x00, 0x00, 0x00, 0x00, 0x00, 1375 0x00, 0x00, 0x00 }; 1376 u8 trace_enable = 0x00; 1377 struct sk_buff *skb; 1378 1379 if (!features) { 1380 bt_dev_warn(hdev, "Debug features not read"); 1381 return -EINVAL; 1382 } 1383 1384 if (!(features->page1[0] & 0x3f)) { 1385 bt_dev_info(hdev, "Telemetry exception format not supported"); 1386 return 0; 1387 } 1388 1389 /* Should stop the trace before writing ddc event mask. */ 1390 skb = __hci_cmd_sync(hdev, 0xfca1, 1, &trace_enable, HCI_INIT_TIMEOUT); 1391 if (IS_ERR(skb)) { 1392 bt_dev_err(hdev, "Stop tracing of link statistics events failed (%ld)", 1393 PTR_ERR(skb)); 1394 return PTR_ERR(skb); 1395 } 1396 kfree_skb(skb); 1397 1398 skb = __hci_cmd_sync(hdev, 0xfc8b, 11, mask, HCI_INIT_TIMEOUT); 1399 if (IS_ERR(skb)) { 1400 bt_dev_err(hdev, "Setting Intel telemetry ddc write event mask failed (%ld)", 1401 PTR_ERR(skb)); 1402 return PTR_ERR(skb); 1403 } 1404 kfree_skb(skb); 1405 1406 bt_dev_info(hdev, "reset debug features: trace_enable 0x%02x mask 0x%02x", 1407 trace_enable, mask[3]); 1408 1409 return 0; 1410 } 1411 1412 int btintel_set_quality_report(struct hci_dev *hdev, bool enable) 1413 { 1414 struct intel_debug_features features; 1415 int err; 1416 1417 bt_dev_dbg(hdev, "enable %d", enable); 1418 1419 /* Read the Intel supported features and if new exception formats 1420 * supported, need to load the additional DDC config to enable. 1421 */ 1422 err = btintel_read_debug_features(hdev, &features); 1423 if (err) 1424 return err; 1425 1426 /* Set or reset the debug features. */ 1427 if (enable) 1428 err = btintel_set_debug_features(hdev, &features); 1429 else 1430 err = btintel_reset_debug_features(hdev, &features); 1431 1432 return err; 1433 } 1434 EXPORT_SYMBOL_GPL(btintel_set_quality_report); 1435 1436 static void btintel_coredump(struct hci_dev *hdev) 1437 { 1438 struct sk_buff *skb; 1439 1440 skb = __hci_cmd_sync(hdev, 0xfc4e, 0, NULL, HCI_CMD_TIMEOUT); 1441 if (IS_ERR(skb)) { 1442 bt_dev_err(hdev, "Coredump failed (%ld)", PTR_ERR(skb)); 1443 return; 1444 } 1445 1446 kfree_skb(skb); 1447 } 1448 1449 static void btintel_dmp_hdr(struct hci_dev *hdev, struct sk_buff *skb) 1450 { 1451 char buf[80]; 1452 1453 snprintf(buf, sizeof(buf), "Controller Name: 0x%X\n", 1454 coredump_info.hw_variant); 1455 skb_put_data(skb, buf, strlen(buf)); 1456 1457 snprintf(buf, sizeof(buf), "Firmware Version: 0x%X\n", 1458 coredump_info.fw_build_num); 1459 skb_put_data(skb, buf, strlen(buf)); 1460 1461 snprintf(buf, sizeof(buf), "Driver: %s\n", coredump_info.driver_name); 1462 skb_put_data(skb, buf, strlen(buf)); 1463 1464 snprintf(buf, sizeof(buf), "Vendor: Intel\n"); 1465 skb_put_data(skb, buf, strlen(buf)); 1466 } 1467 1468 static int btintel_register_devcoredump_support(struct hci_dev *hdev) 1469 { 1470 struct intel_debug_features features; 1471 int err; 1472 1473 err = btintel_read_debug_features(hdev, &features); 1474 if (err) { 1475 bt_dev_info(hdev, "Error reading debug features"); 1476 return err; 1477 } 1478 1479 if (!(features.page1[0] & 0x3f)) { 1480 bt_dev_dbg(hdev, "Telemetry exception format not supported"); 1481 return -EOPNOTSUPP; 1482 } 1483 1484 hci_devcd_register(hdev, btintel_coredump, btintel_dmp_hdr, NULL); 1485 1486 return err; 1487 } 1488 1489 static const struct firmware *btintel_legacy_rom_get_fw(struct hci_dev *hdev, 1490 struct intel_version *ver) 1491 { 1492 const struct firmware *fw; 1493 char fwname[64]; 1494 int ret; 1495 1496 snprintf(fwname, sizeof(fwname), 1497 "intel/ibt-hw-%x.%x.%x-fw-%x.%x.%x.%x.%x.bseq", 1498 ver->hw_platform, ver->hw_variant, ver->hw_revision, 1499 ver->fw_variant, ver->fw_revision, ver->fw_build_num, 1500 ver->fw_build_ww, ver->fw_build_yy); 1501 1502 ret = request_firmware(&fw, fwname, &hdev->dev); 1503 if (ret < 0) { 1504 if (ret == -EINVAL) { 1505 bt_dev_err(hdev, "Intel firmware file request failed (%d)", 1506 ret); 1507 return NULL; 1508 } 1509 1510 bt_dev_err(hdev, "failed to open Intel firmware file: %s (%d)", 1511 fwname, ret); 1512 1513 /* If the correct firmware patch file is not found, use the 1514 * default firmware patch file instead 1515 */ 1516 snprintf(fwname, sizeof(fwname), "intel/ibt-hw-%x.%x.bseq", 1517 ver->hw_platform, ver->hw_variant); 1518 if (request_firmware(&fw, fwname, &hdev->dev) < 0) { 1519 bt_dev_err(hdev, "failed to open default fw file: %s", 1520 fwname); 1521 return NULL; 1522 } 1523 } 1524 1525 bt_dev_info(hdev, "Intel Bluetooth firmware file: %s", fwname); 1526 1527 return fw; 1528 } 1529 1530 static int btintel_legacy_rom_patching(struct hci_dev *hdev, 1531 const struct firmware *fw, 1532 const u8 **fw_ptr, int *disable_patch) 1533 { 1534 struct sk_buff *skb; 1535 struct hci_command_hdr *cmd; 1536 const u8 *cmd_param; 1537 struct hci_event_hdr *evt = NULL; 1538 const u8 *evt_param = NULL; 1539 int remain = fw->size - (*fw_ptr - fw->data); 1540 1541 /* The first byte indicates the types of the patch command or event. 1542 * 0x01 means HCI command and 0x02 is HCI event. If the first bytes 1543 * in the current firmware buffer doesn't start with 0x01 or 1544 * the size of remain buffer is smaller than HCI command header, 1545 * the firmware file is corrupted and it should stop the patching 1546 * process. 1547 */ 1548 if (remain > HCI_COMMAND_HDR_SIZE && *fw_ptr[0] != 0x01) { 1549 bt_dev_err(hdev, "Intel fw corrupted: invalid cmd read"); 1550 return -EINVAL; 1551 } 1552 (*fw_ptr)++; 1553 remain--; 1554 1555 cmd = (struct hci_command_hdr *)(*fw_ptr); 1556 *fw_ptr += sizeof(*cmd); 1557 remain -= sizeof(*cmd); 1558 1559 /* Ensure that the remain firmware data is long enough than the length 1560 * of command parameter. If not, the firmware file is corrupted. 1561 */ 1562 if (remain < cmd->plen) { 1563 bt_dev_err(hdev, "Intel fw corrupted: invalid cmd len"); 1564 return -EFAULT; 1565 } 1566 1567 /* If there is a command that loads a patch in the firmware 1568 * file, then enable the patch upon success, otherwise just 1569 * disable the manufacturer mode, for example patch activation 1570 * is not required when the default firmware patch file is used 1571 * because there are no patch data to load. 1572 */ 1573 if (*disable_patch && le16_to_cpu(cmd->opcode) == 0xfc8e) 1574 *disable_patch = 0; 1575 1576 cmd_param = *fw_ptr; 1577 *fw_ptr += cmd->plen; 1578 remain -= cmd->plen; 1579 1580 /* This reads the expected events when the above command is sent to the 1581 * device. Some vendor commands expects more than one events, for 1582 * example command status event followed by vendor specific event. 1583 * For this case, it only keeps the last expected event. so the command 1584 * can be sent with __hci_cmd_sync_ev() which returns the sk_buff of 1585 * last expected event. 1586 */ 1587 while (remain > HCI_EVENT_HDR_SIZE && *fw_ptr[0] == 0x02) { 1588 (*fw_ptr)++; 1589 remain--; 1590 1591 evt = (struct hci_event_hdr *)(*fw_ptr); 1592 *fw_ptr += sizeof(*evt); 1593 remain -= sizeof(*evt); 1594 1595 if (remain < evt->plen) { 1596 bt_dev_err(hdev, "Intel fw corrupted: invalid evt len"); 1597 return -EFAULT; 1598 } 1599 1600 evt_param = *fw_ptr; 1601 *fw_ptr += evt->plen; 1602 remain -= evt->plen; 1603 } 1604 1605 /* Every HCI commands in the firmware file has its correspond event. 1606 * If event is not found or remain is smaller than zero, the firmware 1607 * file is corrupted. 1608 */ 1609 if (!evt || !evt_param || remain < 0) { 1610 bt_dev_err(hdev, "Intel fw corrupted: invalid evt read"); 1611 return -EFAULT; 1612 } 1613 1614 skb = __hci_cmd_sync_ev(hdev, le16_to_cpu(cmd->opcode), cmd->plen, 1615 cmd_param, evt->evt, HCI_INIT_TIMEOUT); 1616 if (IS_ERR(skb)) { 1617 bt_dev_err(hdev, "sending Intel patch command (0x%4.4x) failed (%ld)", 1618 cmd->opcode, PTR_ERR(skb)); 1619 return PTR_ERR(skb); 1620 } 1621 1622 /* It ensures that the returned event matches the event data read from 1623 * the firmware file. At fist, it checks the length and then 1624 * the contents of the event. 1625 */ 1626 if (skb->len != evt->plen) { 1627 bt_dev_err(hdev, "mismatch event length (opcode 0x%4.4x)", 1628 le16_to_cpu(cmd->opcode)); 1629 kfree_skb(skb); 1630 return -EFAULT; 1631 } 1632 1633 if (memcmp(skb->data, evt_param, evt->plen)) { 1634 bt_dev_err(hdev, "mismatch event parameter (opcode 0x%4.4x)", 1635 le16_to_cpu(cmd->opcode)); 1636 kfree_skb(skb); 1637 return -EFAULT; 1638 } 1639 kfree_skb(skb); 1640 1641 return 0; 1642 } 1643 1644 static int btintel_legacy_rom_setup(struct hci_dev *hdev, 1645 struct intel_version *ver) 1646 { 1647 const struct firmware *fw; 1648 const u8 *fw_ptr; 1649 int disable_patch, err; 1650 struct intel_version new_ver; 1651 1652 BT_DBG("%s", hdev->name); 1653 1654 /* fw_patch_num indicates the version of patch the device currently 1655 * have. If there is no patch data in the device, it is always 0x00. 1656 * So, if it is other than 0x00, no need to patch the device again. 1657 */ 1658 if (ver->fw_patch_num) { 1659 bt_dev_info(hdev, 1660 "Intel device is already patched. patch num: %02x", 1661 ver->fw_patch_num); 1662 goto complete; 1663 } 1664 1665 /* Opens the firmware patch file based on the firmware version read 1666 * from the controller. If it fails to open the matching firmware 1667 * patch file, it tries to open the default firmware patch file. 1668 * If no patch file is found, allow the device to operate without 1669 * a patch. 1670 */ 1671 fw = btintel_legacy_rom_get_fw(hdev, ver); 1672 if (!fw) 1673 goto complete; 1674 fw_ptr = fw->data; 1675 1676 /* Enable the manufacturer mode of the controller. 1677 * Only while this mode is enabled, the driver can download the 1678 * firmware patch data and configuration parameters. 1679 */ 1680 err = btintel_enter_mfg(hdev); 1681 if (err) { 1682 release_firmware(fw); 1683 return err; 1684 } 1685 1686 disable_patch = 1; 1687 1688 /* The firmware data file consists of list of Intel specific HCI 1689 * commands and its expected events. The first byte indicates the 1690 * type of the message, either HCI command or HCI event. 1691 * 1692 * It reads the command and its expected event from the firmware file, 1693 * and send to the controller. Once __hci_cmd_sync_ev() returns, 1694 * the returned event is compared with the event read from the firmware 1695 * file and it will continue until all the messages are downloaded to 1696 * the controller. 1697 * 1698 * Once the firmware patching is completed successfully, 1699 * the manufacturer mode is disabled with reset and activating the 1700 * downloaded patch. 1701 * 1702 * If the firmware patching fails, the manufacturer mode is 1703 * disabled with reset and deactivating the patch. 1704 * 1705 * If the default patch file is used, no reset is done when disabling 1706 * the manufacturer. 1707 */ 1708 while (fw->size > fw_ptr - fw->data) { 1709 int ret; 1710 1711 ret = btintel_legacy_rom_patching(hdev, fw, &fw_ptr, 1712 &disable_patch); 1713 if (ret < 0) 1714 goto exit_mfg_deactivate; 1715 } 1716 1717 release_firmware(fw); 1718 1719 if (disable_patch) 1720 goto exit_mfg_disable; 1721 1722 /* Patching completed successfully and disable the manufacturer mode 1723 * with reset and activate the downloaded firmware patches. 1724 */ 1725 err = btintel_exit_mfg(hdev, true, true); 1726 if (err) 1727 return err; 1728 1729 /* Need build number for downloaded fw patches in 1730 * every power-on boot 1731 */ 1732 err = btintel_read_version(hdev, &new_ver); 1733 if (err) 1734 return err; 1735 1736 bt_dev_info(hdev, "Intel BT fw patch 0x%02x completed & activated", 1737 new_ver.fw_patch_num); 1738 1739 goto complete; 1740 1741 exit_mfg_disable: 1742 /* Disable the manufacturer mode without reset */ 1743 err = btintel_exit_mfg(hdev, false, false); 1744 if (err) 1745 return err; 1746 1747 bt_dev_info(hdev, "Intel firmware patch completed"); 1748 1749 goto complete; 1750 1751 exit_mfg_deactivate: 1752 release_firmware(fw); 1753 1754 /* Patching failed. Disable the manufacturer mode with reset and 1755 * deactivate the downloaded firmware patches. 1756 */ 1757 err = btintel_exit_mfg(hdev, true, false); 1758 if (err) 1759 return err; 1760 1761 bt_dev_info(hdev, "Intel firmware patch completed and deactivated"); 1762 1763 complete: 1764 /* Set the event mask for Intel specific vendor events. This enables 1765 * a few extra events that are useful during general operation. 1766 */ 1767 btintel_set_event_mask_mfg(hdev, false); 1768 1769 btintel_check_bdaddr(hdev); 1770 1771 return 0; 1772 } 1773 1774 static int btintel_download_wait(struct hci_dev *hdev, ktime_t calltime, int msec) 1775 { 1776 ktime_t delta, rettime; 1777 unsigned long long duration; 1778 int err; 1779 1780 btintel_set_flag(hdev, INTEL_FIRMWARE_LOADED); 1781 1782 bt_dev_info(hdev, "Waiting for firmware download to complete"); 1783 1784 err = btintel_wait_on_flag_timeout(hdev, INTEL_DOWNLOADING, 1785 TASK_INTERRUPTIBLE, 1786 msecs_to_jiffies(msec)); 1787 if (err == -EINTR) { 1788 bt_dev_err(hdev, "Firmware loading interrupted"); 1789 return err; 1790 } 1791 1792 if (err) { 1793 bt_dev_err(hdev, "Firmware loading timeout"); 1794 return -ETIMEDOUT; 1795 } 1796 1797 if (btintel_test_flag(hdev, INTEL_FIRMWARE_FAILED)) { 1798 bt_dev_err(hdev, "Firmware loading failed"); 1799 return -ENOEXEC; 1800 } 1801 1802 rettime = ktime_get(); 1803 delta = ktime_sub(rettime, calltime); 1804 duration = (unsigned long long)ktime_to_ns(delta) >> 10; 1805 1806 bt_dev_info(hdev, "Firmware loaded in %llu usecs", duration); 1807 1808 return 0; 1809 } 1810 1811 static int btintel_boot_wait(struct hci_dev *hdev, ktime_t calltime, int msec) 1812 { 1813 ktime_t delta, rettime; 1814 unsigned long long duration; 1815 int err; 1816 1817 bt_dev_info(hdev, "Waiting for device to boot"); 1818 1819 err = btintel_wait_on_flag_timeout(hdev, INTEL_BOOTING, 1820 TASK_INTERRUPTIBLE, 1821 msecs_to_jiffies(msec)); 1822 if (err == -EINTR) { 1823 bt_dev_err(hdev, "Device boot interrupted"); 1824 return -EINTR; 1825 } 1826 1827 if (err) { 1828 bt_dev_err(hdev, "Device boot timeout"); 1829 return -ETIMEDOUT; 1830 } 1831 1832 rettime = ktime_get(); 1833 delta = ktime_sub(rettime, calltime); 1834 duration = (unsigned long long) ktime_to_ns(delta) >> 10; 1835 1836 bt_dev_info(hdev, "Device booted in %llu usecs", duration); 1837 1838 return 0; 1839 } 1840 1841 static int btintel_boot(struct hci_dev *hdev, u32 boot_addr) 1842 { 1843 ktime_t calltime; 1844 int err; 1845 1846 calltime = ktime_get(); 1847 1848 btintel_set_flag(hdev, INTEL_BOOTING); 1849 1850 err = btintel_send_intel_reset(hdev, boot_addr); 1851 if (err) { 1852 bt_dev_err(hdev, "Intel Soft Reset failed (%d)", err); 1853 btintel_reset_to_bootloader(hdev); 1854 return err; 1855 } 1856 1857 /* The bootloader will not indicate when the device is ready. This 1858 * is done by the operational firmware sending bootup notification. 1859 * 1860 * Booting into operational firmware should not take longer than 1861 * 1 second. However if that happens, then just fail the setup 1862 * since something went wrong. 1863 */ 1864 err = btintel_boot_wait(hdev, calltime, 1000); 1865 if (err == -ETIMEDOUT) 1866 btintel_reset_to_bootloader(hdev); 1867 1868 return err; 1869 } 1870 1871 static int btintel_get_fw_name(struct intel_version *ver, 1872 struct intel_boot_params *params, 1873 char *fw_name, size_t len, 1874 const char *suffix) 1875 { 1876 switch (ver->hw_variant) { 1877 case 0x0b: /* SfP */ 1878 case 0x0c: /* WsP */ 1879 snprintf(fw_name, len, "intel/ibt-%u-%u.%s", 1880 ver->hw_variant, 1881 le16_to_cpu(params->dev_revid), 1882 suffix); 1883 break; 1884 case 0x11: /* JfP */ 1885 case 0x12: /* ThP */ 1886 case 0x13: /* HrP */ 1887 case 0x14: /* CcP */ 1888 snprintf(fw_name, len, "intel/ibt-%u-%u-%u.%s", 1889 ver->hw_variant, 1890 ver->hw_revision, 1891 ver->fw_revision, 1892 suffix); 1893 break; 1894 default: 1895 return -EINVAL; 1896 } 1897 1898 return 0; 1899 } 1900 1901 static int btintel_download_fw(struct hci_dev *hdev, 1902 struct intel_version *ver, 1903 struct intel_boot_params *params, 1904 u32 *boot_param) 1905 { 1906 const struct firmware *fw; 1907 char fwname[64]; 1908 int err; 1909 ktime_t calltime; 1910 1911 if (!ver || !params) 1912 return -EINVAL; 1913 1914 /* The firmware variant determines if the device is in bootloader 1915 * mode or is running operational firmware. The value 0x06 identifies 1916 * the bootloader and the value 0x23 identifies the operational 1917 * firmware. 1918 * 1919 * When the operational firmware is already present, then only 1920 * the check for valid Bluetooth device address is needed. This 1921 * determines if the device will be added as configured or 1922 * unconfigured controller. 1923 * 1924 * It is not possible to use the Secure Boot Parameters in this 1925 * case since that command is only available in bootloader mode. 1926 */ 1927 if (ver->fw_variant == 0x23) { 1928 btintel_clear_flag(hdev, INTEL_BOOTLOADER); 1929 btintel_check_bdaddr(hdev); 1930 1931 /* SfP and WsP don't seem to update the firmware version on file 1932 * so version checking is currently possible. 1933 */ 1934 switch (ver->hw_variant) { 1935 case 0x0b: /* SfP */ 1936 case 0x0c: /* WsP */ 1937 return 0; 1938 } 1939 1940 /* Proceed to download to check if the version matches */ 1941 goto download; 1942 } 1943 1944 /* Read the secure boot parameters to identify the operating 1945 * details of the bootloader. 1946 */ 1947 err = btintel_read_boot_params(hdev, params); 1948 if (err) 1949 return err; 1950 1951 /* It is required that every single firmware fragment is acknowledged 1952 * with a command complete event. If the boot parameters indicate 1953 * that this bootloader does not send them, then abort the setup. 1954 */ 1955 if (params->limited_cce != 0x00) { 1956 bt_dev_err(hdev, "Unsupported Intel firmware loading method (%u)", 1957 params->limited_cce); 1958 return -EINVAL; 1959 } 1960 1961 /* If the OTP has no valid Bluetooth device address, then there will 1962 * also be no valid address for the operational firmware. 1963 */ 1964 if (!bacmp(¶ms->otp_bdaddr, BDADDR_ANY)) { 1965 bt_dev_info(hdev, "No device address configured"); 1966 set_bit(HCI_QUIRK_INVALID_BDADDR, &hdev->quirks); 1967 } 1968 1969 download: 1970 /* With this Intel bootloader only the hardware variant and device 1971 * revision information are used to select the right firmware for SfP 1972 * and WsP. 1973 * 1974 * The firmware filename is ibt-<hw_variant>-<dev_revid>.sfi. 1975 * 1976 * Currently the supported hardware variants are: 1977 * 11 (0x0b) for iBT3.0 (LnP/SfP) 1978 * 12 (0x0c) for iBT3.5 (WsP) 1979 * 1980 * For ThP/JfP and for future SKU's, the FW name varies based on HW 1981 * variant, HW revision and FW revision, as these are dependent on CNVi 1982 * and RF Combination. 1983 * 1984 * 17 (0x11) for iBT3.5 (JfP) 1985 * 18 (0x12) for iBT3.5 (ThP) 1986 * 1987 * The firmware file name for these will be 1988 * ibt-<hw_variant>-<hw_revision>-<fw_revision>.sfi. 1989 * 1990 */ 1991 err = btintel_get_fw_name(ver, params, fwname, sizeof(fwname), "sfi"); 1992 if (err < 0) { 1993 if (!btintel_test_flag(hdev, INTEL_BOOTLOADER)) { 1994 /* Firmware has already been loaded */ 1995 btintel_set_flag(hdev, INTEL_FIRMWARE_LOADED); 1996 return 0; 1997 } 1998 1999 bt_dev_err(hdev, "Unsupported Intel firmware naming"); 2000 return -EINVAL; 2001 } 2002 2003 err = firmware_request_nowarn(&fw, fwname, &hdev->dev); 2004 if (err < 0) { 2005 if (!btintel_test_flag(hdev, INTEL_BOOTLOADER)) { 2006 /* Firmware has already been loaded */ 2007 btintel_set_flag(hdev, INTEL_FIRMWARE_LOADED); 2008 return 0; 2009 } 2010 2011 bt_dev_err(hdev, "Failed to load Intel firmware file %s (%d)", 2012 fwname, err); 2013 return err; 2014 } 2015 2016 bt_dev_info(hdev, "Found device firmware: %s", fwname); 2017 2018 if (fw->size < 644) { 2019 bt_dev_err(hdev, "Invalid size of firmware file (%zu)", 2020 fw->size); 2021 err = -EBADF; 2022 goto done; 2023 } 2024 2025 calltime = ktime_get(); 2026 2027 btintel_set_flag(hdev, INTEL_DOWNLOADING); 2028 2029 /* Start firmware downloading and get boot parameter */ 2030 err = btintel_download_firmware(hdev, ver, fw, boot_param); 2031 if (err < 0) { 2032 if (err == -EALREADY) { 2033 /* Firmware has already been loaded */ 2034 btintel_set_flag(hdev, INTEL_FIRMWARE_LOADED); 2035 err = 0; 2036 goto done; 2037 } 2038 2039 /* When FW download fails, send Intel Reset to retry 2040 * FW download. 2041 */ 2042 btintel_reset_to_bootloader(hdev); 2043 goto done; 2044 } 2045 2046 /* Before switching the device into operational mode and with that 2047 * booting the loaded firmware, wait for the bootloader notification 2048 * that all fragments have been successfully received. 2049 * 2050 * When the event processing receives the notification, then the 2051 * INTEL_DOWNLOADING flag will be cleared. 2052 * 2053 * The firmware loading should not take longer than 5 seconds 2054 * and thus just timeout if that happens and fail the setup 2055 * of this device. 2056 */ 2057 err = btintel_download_wait(hdev, calltime, 5000); 2058 if (err == -ETIMEDOUT) 2059 btintel_reset_to_bootloader(hdev); 2060 2061 done: 2062 release_firmware(fw); 2063 return err; 2064 } 2065 2066 static int btintel_bootloader_setup(struct hci_dev *hdev, 2067 struct intel_version *ver) 2068 { 2069 struct intel_version new_ver; 2070 struct intel_boot_params params; 2071 u32 boot_param; 2072 char ddcname[64]; 2073 int err; 2074 2075 BT_DBG("%s", hdev->name); 2076 2077 /* Set the default boot parameter to 0x0 and it is updated to 2078 * SKU specific boot parameter after reading Intel_Write_Boot_Params 2079 * command while downloading the firmware. 2080 */ 2081 boot_param = 0x00000000; 2082 2083 btintel_set_flag(hdev, INTEL_BOOTLOADER); 2084 2085 err = btintel_download_fw(hdev, ver, ¶ms, &boot_param); 2086 if (err) 2087 return err; 2088 2089 /* controller is already having an operational firmware */ 2090 if (ver->fw_variant == 0x23) 2091 goto finish; 2092 2093 err = btintel_boot(hdev, boot_param); 2094 if (err) 2095 return err; 2096 2097 btintel_clear_flag(hdev, INTEL_BOOTLOADER); 2098 2099 err = btintel_get_fw_name(ver, ¶ms, ddcname, 2100 sizeof(ddcname), "ddc"); 2101 2102 if (err < 0) { 2103 bt_dev_err(hdev, "Unsupported Intel firmware naming"); 2104 } else { 2105 /* Once the device is running in operational mode, it needs to 2106 * apply the device configuration (DDC) parameters. 2107 * 2108 * The device can work without DDC parameters, so even if it 2109 * fails to load the file, no need to fail the setup. 2110 */ 2111 btintel_load_ddc_config(hdev, ddcname); 2112 } 2113 2114 hci_dev_clear_flag(hdev, HCI_QUALITY_REPORT); 2115 2116 /* Read the Intel version information after loading the FW */ 2117 err = btintel_read_version(hdev, &new_ver); 2118 if (err) 2119 return err; 2120 2121 btintel_version_info(hdev, &new_ver); 2122 2123 finish: 2124 /* Set the event mask for Intel specific vendor events. This enables 2125 * a few extra events that are useful during general operation. It 2126 * does not enable any debugging related events. 2127 * 2128 * The device will function correctly without these events enabled 2129 * and thus no need to fail the setup. 2130 */ 2131 btintel_set_event_mask(hdev, false); 2132 2133 return 0; 2134 } 2135 2136 static void btintel_get_fw_name_tlv(const struct intel_version_tlv *ver, 2137 char *fw_name, size_t len, 2138 const char *suffix) 2139 { 2140 const char *format; 2141 u32 cnvi, cnvr; 2142 2143 cnvi = INTEL_CNVX_TOP_PACK_SWAB(INTEL_CNVX_TOP_TYPE(ver->cnvi_top), 2144 INTEL_CNVX_TOP_STEP(ver->cnvi_top)); 2145 2146 cnvr = INTEL_CNVX_TOP_PACK_SWAB(INTEL_CNVX_TOP_TYPE(ver->cnvr_top), 2147 INTEL_CNVX_TOP_STEP(ver->cnvr_top)); 2148 2149 /* Only Blazar product supports downloading of intermediate loader 2150 * image 2151 */ 2152 if (INTEL_HW_VARIANT(ver->cnvi_bt) >= 0x1e) { 2153 u8 zero[BTINTEL_FWID_MAXLEN]; 2154 2155 if (ver->img_type == BTINTEL_IMG_BOOTLOADER) { 2156 format = "intel/ibt-%04x-%04x-iml.%s"; 2157 snprintf(fw_name, len, format, cnvi, cnvr, suffix); 2158 return; 2159 } 2160 2161 memset(zero, 0, sizeof(zero)); 2162 2163 /* ibt-<cnvi_top type+cnvi_top step>-<cnvr_top type+cnvr_top step-fw_id> */ 2164 if (memcmp(ver->fw_id, zero, sizeof(zero))) { 2165 format = "intel/ibt-%04x-%04x-%s.%s"; 2166 snprintf(fw_name, len, format, cnvi, cnvr, 2167 ver->fw_id, suffix); 2168 return; 2169 } 2170 /* If firmware id is not present, fallback to legacy naming 2171 * convention 2172 */ 2173 } 2174 /* Fallback to legacy naming convention for other controllers 2175 * ibt-<cnvi_top type+cnvi_top step>-<cnvr_top type+cnvr_top step> 2176 */ 2177 format = "intel/ibt-%04x-%04x.%s"; 2178 snprintf(fw_name, len, format, cnvi, cnvr, suffix); 2179 } 2180 2181 static void btintel_get_iml_tlv(const struct intel_version_tlv *ver, 2182 char *fw_name, size_t len, 2183 const char *suffix) 2184 { 2185 const char *format; 2186 u32 cnvi, cnvr; 2187 2188 cnvi = INTEL_CNVX_TOP_PACK_SWAB(INTEL_CNVX_TOP_TYPE(ver->cnvi_top), 2189 INTEL_CNVX_TOP_STEP(ver->cnvi_top)); 2190 2191 cnvr = INTEL_CNVX_TOP_PACK_SWAB(INTEL_CNVX_TOP_TYPE(ver->cnvr_top), 2192 INTEL_CNVX_TOP_STEP(ver->cnvr_top)); 2193 2194 format = "intel/ibt-%04x-%04x-iml.%s"; 2195 snprintf(fw_name, len, format, cnvi, cnvr, suffix); 2196 } 2197 2198 static int btintel_prepare_fw_download_tlv(struct hci_dev *hdev, 2199 struct intel_version_tlv *ver, 2200 u32 *boot_param) 2201 { 2202 const struct firmware *fw; 2203 char fwname[128]; 2204 int err; 2205 ktime_t calltime; 2206 2207 if (!ver || !boot_param) 2208 return -EINVAL; 2209 2210 /* The firmware variant determines if the device is in bootloader 2211 * mode or is running operational firmware. The value 0x03 identifies 2212 * the bootloader and the value 0x23 identifies the operational 2213 * firmware. 2214 * 2215 * When the operational firmware is already present, then only 2216 * the check for valid Bluetooth device address is needed. This 2217 * determines if the device will be added as configured or 2218 * unconfigured controller. 2219 * 2220 * It is not possible to use the Secure Boot Parameters in this 2221 * case since that command is only available in bootloader mode. 2222 */ 2223 if (ver->img_type == BTINTEL_IMG_OP) { 2224 btintel_clear_flag(hdev, INTEL_BOOTLOADER); 2225 btintel_check_bdaddr(hdev); 2226 } else { 2227 /* 2228 * Check for valid bd address in boot loader mode. Device 2229 * will be marked as unconfigured if empty bd address is 2230 * found. 2231 */ 2232 if (!bacmp(&ver->otp_bd_addr, BDADDR_ANY)) { 2233 bt_dev_info(hdev, "No device address configured"); 2234 set_bit(HCI_QUIRK_INVALID_BDADDR, &hdev->quirks); 2235 } 2236 } 2237 2238 if (ver->img_type == BTINTEL_IMG_OP) { 2239 /* Controller running OP image. In case of FW downgrade, 2240 * FWID TLV may not be present and driver may attempt to load 2241 * firmware image which doesn't exist. Lets compare the version 2242 * of IML image 2243 */ 2244 if (INTEL_HW_VARIANT(ver->cnvi_bt) >= 0x1e) 2245 btintel_get_iml_tlv(ver, fwname, sizeof(fwname), "sfi"); 2246 else 2247 btintel_get_fw_name_tlv(ver, fwname, sizeof(fwname), "sfi"); 2248 } else { 2249 btintel_get_fw_name_tlv(ver, fwname, sizeof(fwname), "sfi"); 2250 } 2251 2252 err = firmware_request_nowarn(&fw, fwname, &hdev->dev); 2253 if (err < 0) { 2254 if (!btintel_test_flag(hdev, INTEL_BOOTLOADER)) { 2255 /* Firmware has already been loaded */ 2256 btintel_set_flag(hdev, INTEL_FIRMWARE_LOADED); 2257 return 0; 2258 } 2259 2260 bt_dev_err(hdev, "Failed to load Intel firmware file %s (%d)", 2261 fwname, err); 2262 2263 return err; 2264 } 2265 2266 bt_dev_info(hdev, "Found device firmware: %s", fwname); 2267 2268 if (fw->size < 644) { 2269 bt_dev_err(hdev, "Invalid size of firmware file (%zu)", 2270 fw->size); 2271 err = -EBADF; 2272 goto done; 2273 } 2274 2275 calltime = ktime_get(); 2276 2277 btintel_set_flag(hdev, INTEL_DOWNLOADING); 2278 2279 /* Start firmware downloading and get boot parameter */ 2280 err = btintel_download_fw_tlv(hdev, ver, fw, boot_param, 2281 INTEL_HW_VARIANT(ver->cnvi_bt), 2282 ver->sbe_type); 2283 if (err < 0) { 2284 if (err == -EALREADY) { 2285 /* Firmware has already been loaded */ 2286 btintel_set_flag(hdev, INTEL_FIRMWARE_LOADED); 2287 err = 0; 2288 goto done; 2289 } 2290 2291 /* When FW download fails, send Intel Reset to retry 2292 * FW download. 2293 */ 2294 btintel_reset_to_bootloader(hdev); 2295 goto done; 2296 } 2297 2298 /* Before switching the device into operational mode and with that 2299 * booting the loaded firmware, wait for the bootloader notification 2300 * that all fragments have been successfully received. 2301 * 2302 * When the event processing receives the notification, then the 2303 * BTUSB_DOWNLOADING flag will be cleared. 2304 * 2305 * The firmware loading should not take longer than 5 seconds 2306 * and thus just timeout if that happens and fail the setup 2307 * of this device. 2308 */ 2309 err = btintel_download_wait(hdev, calltime, 5000); 2310 if (err == -ETIMEDOUT) 2311 btintel_reset_to_bootloader(hdev); 2312 2313 done: 2314 release_firmware(fw); 2315 return err; 2316 } 2317 2318 static int btintel_get_codec_config_data(struct hci_dev *hdev, 2319 __u8 link, struct bt_codec *codec, 2320 __u8 *ven_len, __u8 **ven_data) 2321 { 2322 int err = 0; 2323 2324 if (!ven_data || !ven_len) 2325 return -EINVAL; 2326 2327 *ven_len = 0; 2328 *ven_data = NULL; 2329 2330 if (link != ESCO_LINK) { 2331 bt_dev_err(hdev, "Invalid link type(%u)", link); 2332 return -EINVAL; 2333 } 2334 2335 *ven_data = kmalloc(sizeof(__u8), GFP_KERNEL); 2336 if (!*ven_data) { 2337 err = -ENOMEM; 2338 goto error; 2339 } 2340 2341 /* supports only CVSD and mSBC offload codecs */ 2342 switch (codec->id) { 2343 case 0x02: 2344 **ven_data = 0x00; 2345 break; 2346 case 0x05: 2347 **ven_data = 0x01; 2348 break; 2349 default: 2350 err = -EINVAL; 2351 bt_dev_err(hdev, "Invalid codec id(%u)", codec->id); 2352 goto error; 2353 } 2354 /* codec and its capabilities are pre-defined to ids 2355 * preset id = 0x00 represents CVSD codec with sampling rate 8K 2356 * preset id = 0x01 represents mSBC codec with sampling rate 16K 2357 */ 2358 *ven_len = sizeof(__u8); 2359 return err; 2360 2361 error: 2362 kfree(*ven_data); 2363 *ven_data = NULL; 2364 return err; 2365 } 2366 2367 static int btintel_get_data_path_id(struct hci_dev *hdev, __u8 *data_path_id) 2368 { 2369 /* Intel uses 1 as data path id for all the usecases */ 2370 *data_path_id = 1; 2371 return 0; 2372 } 2373 2374 static int btintel_configure_offload(struct hci_dev *hdev) 2375 { 2376 struct sk_buff *skb; 2377 int err = 0; 2378 struct intel_offload_use_cases *use_cases; 2379 2380 skb = __hci_cmd_sync(hdev, 0xfc86, 0, NULL, HCI_INIT_TIMEOUT); 2381 if (IS_ERR(skb)) { 2382 bt_dev_err(hdev, "Reading offload use cases failed (%ld)", 2383 PTR_ERR(skb)); 2384 return PTR_ERR(skb); 2385 } 2386 2387 if (skb->len < sizeof(*use_cases)) { 2388 err = -EIO; 2389 goto error; 2390 } 2391 2392 use_cases = (void *)skb->data; 2393 2394 if (use_cases->status) { 2395 err = -bt_to_errno(skb->data[0]); 2396 goto error; 2397 } 2398 2399 if (use_cases->preset[0] & 0x03) { 2400 hdev->get_data_path_id = btintel_get_data_path_id; 2401 hdev->get_codec_config_data = btintel_get_codec_config_data; 2402 } 2403 error: 2404 kfree_skb(skb); 2405 return err; 2406 } 2407 2408 static void btintel_set_ppag(struct hci_dev *hdev, struct intel_version_tlv *ver) 2409 { 2410 struct sk_buff *skb; 2411 struct hci_ppag_enable_cmd ppag_cmd; 2412 acpi_handle handle; 2413 struct acpi_buffer buffer = {ACPI_ALLOCATE_BUFFER, NULL}; 2414 union acpi_object *p, *elements; 2415 u32 domain, mode; 2416 acpi_status status; 2417 2418 /* PPAG is not supported if CRF is HrP2, Jfp2, JfP1 */ 2419 switch (ver->cnvr_top & 0xFFF) { 2420 case 0x504: /* Hrp2 */ 2421 case 0x202: /* Jfp2 */ 2422 case 0x201: /* Jfp1 */ 2423 bt_dev_dbg(hdev, "PPAG not supported for Intel CNVr (0x%3x)", 2424 ver->cnvr_top & 0xFFF); 2425 return; 2426 } 2427 2428 handle = ACPI_HANDLE(GET_HCIDEV_DEV(hdev)); 2429 if (!handle) { 2430 bt_dev_info(hdev, "No support for BT device in ACPI firmware"); 2431 return; 2432 } 2433 2434 status = acpi_evaluate_object(handle, "PPAG", NULL, &buffer); 2435 if (ACPI_FAILURE(status)) { 2436 if (status == AE_NOT_FOUND) { 2437 bt_dev_dbg(hdev, "PPAG-BT: ACPI entry not found"); 2438 return; 2439 } 2440 bt_dev_warn(hdev, "PPAG-BT: ACPI Failure: %s", acpi_format_exception(status)); 2441 return; 2442 } 2443 2444 p = buffer.pointer; 2445 if (p->type != ACPI_TYPE_PACKAGE || p->package.count != 2) { 2446 bt_dev_warn(hdev, "PPAG-BT: Invalid object type: %d or package count: %d", 2447 p->type, p->package.count); 2448 kfree(buffer.pointer); 2449 return; 2450 } 2451 2452 elements = p->package.elements; 2453 2454 /* PPAG table is located at element[1] */ 2455 p = &elements[1]; 2456 2457 domain = (u32)p->package.elements[0].integer.value; 2458 mode = (u32)p->package.elements[1].integer.value; 2459 kfree(buffer.pointer); 2460 2461 if (domain != 0x12) { 2462 bt_dev_dbg(hdev, "PPAG-BT: Bluetooth domain is disabled in ACPI firmware"); 2463 return; 2464 } 2465 2466 /* PPAG mode 2467 * BIT 0 : 0 Disabled in EU 2468 * 1 Enabled in EU 2469 * BIT 1 : 0 Disabled in China 2470 * 1 Enabled in China 2471 */ 2472 mode &= 0x03; 2473 2474 if (!mode) { 2475 bt_dev_dbg(hdev, "PPAG-BT: EU, China mode are disabled in BIOS"); 2476 return; 2477 } 2478 2479 ppag_cmd.ppag_enable_flags = cpu_to_le32(mode); 2480 2481 skb = __hci_cmd_sync(hdev, INTEL_OP_PPAG_CMD, sizeof(ppag_cmd), 2482 &ppag_cmd, HCI_CMD_TIMEOUT); 2483 if (IS_ERR(skb)) { 2484 bt_dev_warn(hdev, "Failed to send PPAG Enable (%ld)", PTR_ERR(skb)); 2485 return; 2486 } 2487 bt_dev_info(hdev, "PPAG-BT: Enabled (Mode %d)", mode); 2488 kfree_skb(skb); 2489 } 2490 2491 static int btintel_acpi_reset_method(struct hci_dev *hdev) 2492 { 2493 int ret = 0; 2494 acpi_status status; 2495 union acpi_object *p, *ref; 2496 struct acpi_buffer buffer = { ACPI_ALLOCATE_BUFFER, NULL }; 2497 2498 status = acpi_evaluate_object(ACPI_HANDLE(GET_HCIDEV_DEV(hdev)), "_PRR", NULL, &buffer); 2499 if (ACPI_FAILURE(status)) { 2500 bt_dev_err(hdev, "Failed to run _PRR method"); 2501 ret = -ENODEV; 2502 return ret; 2503 } 2504 p = buffer.pointer; 2505 2506 if (p->package.count != 1 || p->type != ACPI_TYPE_PACKAGE) { 2507 bt_dev_err(hdev, "Invalid arguments"); 2508 ret = -EINVAL; 2509 goto exit_on_error; 2510 } 2511 2512 ref = &p->package.elements[0]; 2513 if (ref->type != ACPI_TYPE_LOCAL_REFERENCE) { 2514 bt_dev_err(hdev, "Invalid object type: 0x%x", ref->type); 2515 ret = -EINVAL; 2516 goto exit_on_error; 2517 } 2518 2519 status = acpi_evaluate_object(ref->reference.handle, "_RST", NULL, NULL); 2520 if (ACPI_FAILURE(status)) { 2521 bt_dev_err(hdev, "Failed to run_RST method"); 2522 ret = -ENODEV; 2523 goto exit_on_error; 2524 } 2525 2526 exit_on_error: 2527 kfree(buffer.pointer); 2528 return ret; 2529 } 2530 2531 static void btintel_set_dsm_reset_method(struct hci_dev *hdev, 2532 struct intel_version_tlv *ver_tlv) 2533 { 2534 struct btintel_data *data = hci_get_priv(hdev); 2535 acpi_handle handle = ACPI_HANDLE(GET_HCIDEV_DEV(hdev)); 2536 u8 reset_payload[4] = {0x01, 0x00, 0x01, 0x00}; 2537 union acpi_object *obj, argv4; 2538 enum { 2539 RESET_TYPE_WDISABLE2, 2540 RESET_TYPE_VSEC 2541 }; 2542 2543 handle = ACPI_HANDLE(GET_HCIDEV_DEV(hdev)); 2544 2545 if (!handle) { 2546 bt_dev_dbg(hdev, "No support for bluetooth device in ACPI firmware"); 2547 return; 2548 } 2549 2550 if (!acpi_has_method(handle, "_PRR")) { 2551 bt_dev_err(hdev, "No support for _PRR ACPI method"); 2552 return; 2553 } 2554 2555 switch (ver_tlv->cnvi_top & 0xfff) { 2556 case 0x910: /* GalePeak2 */ 2557 reset_payload[2] = RESET_TYPE_VSEC; 2558 break; 2559 default: 2560 /* WDISABLE2 is the default reset method */ 2561 reset_payload[2] = RESET_TYPE_WDISABLE2; 2562 2563 if (!acpi_check_dsm(handle, &btintel_guid_dsm, 0, 2564 BIT(DSM_SET_WDISABLE2_DELAY))) { 2565 bt_dev_err(hdev, "No dsm support to set reset delay"); 2566 return; 2567 } 2568 argv4.integer.type = ACPI_TYPE_INTEGER; 2569 /* delay required to toggle BT power */ 2570 argv4.integer.value = 160; 2571 obj = acpi_evaluate_dsm(handle, &btintel_guid_dsm, 0, 2572 DSM_SET_WDISABLE2_DELAY, &argv4); 2573 if (!obj) { 2574 bt_dev_err(hdev, "Failed to call dsm to set reset delay"); 2575 return; 2576 } 2577 ACPI_FREE(obj); 2578 } 2579 2580 bt_dev_info(hdev, "DSM reset method type: 0x%02x", reset_payload[2]); 2581 2582 if (!acpi_check_dsm(handle, &btintel_guid_dsm, 0, 2583 DSM_SET_RESET_METHOD)) { 2584 bt_dev_warn(hdev, "No support for dsm to set reset method"); 2585 return; 2586 } 2587 argv4.buffer.type = ACPI_TYPE_BUFFER; 2588 argv4.buffer.length = sizeof(reset_payload); 2589 argv4.buffer.pointer = reset_payload; 2590 2591 obj = acpi_evaluate_dsm(handle, &btintel_guid_dsm, 0, 2592 DSM_SET_RESET_METHOD, &argv4); 2593 if (!obj) { 2594 bt_dev_err(hdev, "Failed to call dsm to set reset method"); 2595 return; 2596 } 2597 ACPI_FREE(obj); 2598 data->acpi_reset_method = btintel_acpi_reset_method; 2599 } 2600 2601 #define BTINTEL_ISODATA_HANDLE_BASE 0x900 2602 2603 static u8 btintel_classify_pkt_type(struct hci_dev *hdev, struct sk_buff *skb) 2604 { 2605 /* 2606 * Distinguish ISO data packets form ACL data packets 2607 * based on their connection handle value range. 2608 */ 2609 if (hci_skb_pkt_type(skb) == HCI_ACLDATA_PKT) { 2610 __u16 handle = __le16_to_cpu(hci_acl_hdr(skb)->handle); 2611 2612 if (hci_handle(handle) >= BTINTEL_ISODATA_HANDLE_BASE) 2613 return HCI_ISODATA_PKT; 2614 } 2615 2616 return hci_skb_pkt_type(skb); 2617 } 2618 2619 int btintel_bootloader_setup_tlv(struct hci_dev *hdev, 2620 struct intel_version_tlv *ver) 2621 { 2622 u32 boot_param; 2623 char ddcname[64]; 2624 int err; 2625 struct intel_version_tlv new_ver; 2626 2627 bt_dev_dbg(hdev, ""); 2628 2629 /* Set the default boot parameter to 0x0 and it is updated to 2630 * SKU specific boot parameter after reading Intel_Write_Boot_Params 2631 * command while downloading the firmware. 2632 */ 2633 boot_param = 0x00000000; 2634 2635 btintel_set_flag(hdev, INTEL_BOOTLOADER); 2636 2637 err = btintel_prepare_fw_download_tlv(hdev, ver, &boot_param); 2638 if (err) 2639 return err; 2640 2641 /* check if controller is already having an operational firmware */ 2642 if (ver->img_type == BTINTEL_IMG_OP) 2643 goto finish; 2644 2645 err = btintel_boot(hdev, boot_param); 2646 if (err) 2647 return err; 2648 2649 err = btintel_read_version_tlv(hdev, ver); 2650 if (err) 2651 return err; 2652 2653 /* If image type returned is BTINTEL_IMG_IML, then controller supports 2654 * intermediate loader image 2655 */ 2656 if (ver->img_type == BTINTEL_IMG_IML) { 2657 err = btintel_prepare_fw_download_tlv(hdev, ver, &boot_param); 2658 if (err) 2659 return err; 2660 2661 err = btintel_boot(hdev, boot_param); 2662 if (err) 2663 return err; 2664 } 2665 2666 btintel_clear_flag(hdev, INTEL_BOOTLOADER); 2667 2668 btintel_get_fw_name_tlv(ver, ddcname, sizeof(ddcname), "ddc"); 2669 /* Once the device is running in operational mode, it needs to 2670 * apply the device configuration (DDC) parameters. 2671 * 2672 * The device can work without DDC parameters, so even if it 2673 * fails to load the file, no need to fail the setup. 2674 */ 2675 btintel_load_ddc_config(hdev, ddcname); 2676 2677 /* Read supported use cases and set callbacks to fetch datapath id */ 2678 btintel_configure_offload(hdev); 2679 2680 hci_dev_clear_flag(hdev, HCI_QUALITY_REPORT); 2681 2682 /* Set PPAG feature */ 2683 btintel_set_ppag(hdev, ver); 2684 2685 /* Read the Intel version information after loading the FW */ 2686 err = btintel_read_version_tlv(hdev, &new_ver); 2687 if (err) 2688 return err; 2689 2690 btintel_version_info_tlv(hdev, &new_ver); 2691 2692 finish: 2693 /* Set the event mask for Intel specific vendor events. This enables 2694 * a few extra events that are useful during general operation. It 2695 * does not enable any debugging related events. 2696 * 2697 * The device will function correctly without these events enabled 2698 * and thus no need to fail the setup. 2699 */ 2700 btintel_set_event_mask(hdev, false); 2701 2702 return 0; 2703 } 2704 EXPORT_SYMBOL_GPL(btintel_bootloader_setup_tlv); 2705 2706 void btintel_set_msft_opcode(struct hci_dev *hdev, u8 hw_variant) 2707 { 2708 switch (hw_variant) { 2709 /* Legacy bootloader devices that supports MSFT Extension */ 2710 case 0x11: /* JfP */ 2711 case 0x12: /* ThP */ 2712 case 0x13: /* HrP */ 2713 case 0x14: /* CcP */ 2714 /* All Intel new genration controllers support the Microsoft vendor 2715 * extension are using 0xFC1E for VsMsftOpCode. 2716 */ 2717 case 0x17: 2718 case 0x18: 2719 case 0x19: 2720 case 0x1b: 2721 case 0x1c: 2722 case 0x1d: 2723 case 0x1e: 2724 hci_set_msft_opcode(hdev, 0xFC1E); 2725 break; 2726 default: 2727 /* Not supported */ 2728 break; 2729 } 2730 } 2731 EXPORT_SYMBOL_GPL(btintel_set_msft_opcode); 2732 2733 void btintel_print_fseq_info(struct hci_dev *hdev) 2734 { 2735 struct sk_buff *skb; 2736 u8 *p; 2737 u32 val; 2738 const char *str; 2739 2740 skb = __hci_cmd_sync(hdev, 0xfcb3, 0, NULL, HCI_CMD_TIMEOUT); 2741 if (IS_ERR(skb)) { 2742 bt_dev_dbg(hdev, "Reading fseq status command failed (%ld)", 2743 PTR_ERR(skb)); 2744 return; 2745 } 2746 2747 if (skb->len < (sizeof(u32) * 16 + 2)) { 2748 bt_dev_dbg(hdev, "Malformed packet of length %u received", 2749 skb->len); 2750 kfree_skb(skb); 2751 return; 2752 } 2753 2754 p = skb_pull_data(skb, 1); 2755 if (*p) { 2756 bt_dev_dbg(hdev, "Failed to get fseq status (0x%2.2x)", *p); 2757 kfree_skb(skb); 2758 return; 2759 } 2760 2761 p = skb_pull_data(skb, 1); 2762 switch (*p) { 2763 case 0: 2764 str = "Success"; 2765 break; 2766 case 1: 2767 str = "Fatal error"; 2768 break; 2769 case 2: 2770 str = "Semaphore acquire error"; 2771 break; 2772 default: 2773 str = "Unknown error"; 2774 break; 2775 } 2776 2777 if (*p) { 2778 bt_dev_err(hdev, "Fseq status: %s (0x%2.2x)", str, *p); 2779 kfree_skb(skb); 2780 return; 2781 } 2782 2783 bt_dev_info(hdev, "Fseq status: %s (0x%2.2x)", str, *p); 2784 2785 val = get_unaligned_le32(skb_pull_data(skb, 4)); 2786 bt_dev_dbg(hdev, "Reason: 0x%8.8x", val); 2787 2788 val = get_unaligned_le32(skb_pull_data(skb, 4)); 2789 bt_dev_dbg(hdev, "Global version: 0x%8.8x", val); 2790 2791 val = get_unaligned_le32(skb_pull_data(skb, 4)); 2792 bt_dev_dbg(hdev, "Installed version: 0x%8.8x", val); 2793 2794 p = skb->data; 2795 skb_pull_data(skb, 4); 2796 bt_dev_info(hdev, "Fseq executed: %2.2u.%2.2u.%2.2u.%2.2u", p[0], p[1], 2797 p[2], p[3]); 2798 2799 p = skb->data; 2800 skb_pull_data(skb, 4); 2801 bt_dev_info(hdev, "Fseq BT Top: %2.2u.%2.2u.%2.2u.%2.2u", p[0], p[1], 2802 p[2], p[3]); 2803 2804 val = get_unaligned_le32(skb_pull_data(skb, 4)); 2805 bt_dev_dbg(hdev, "Fseq Top init version: 0x%8.8x", val); 2806 2807 val = get_unaligned_le32(skb_pull_data(skb, 4)); 2808 bt_dev_dbg(hdev, "Fseq Cnvio init version: 0x%8.8x", val); 2809 2810 val = get_unaligned_le32(skb_pull_data(skb, 4)); 2811 bt_dev_dbg(hdev, "Fseq MBX Wifi file version: 0x%8.8x", val); 2812 2813 val = get_unaligned_le32(skb_pull_data(skb, 4)); 2814 bt_dev_dbg(hdev, "Fseq BT version: 0x%8.8x", val); 2815 2816 val = get_unaligned_le32(skb_pull_data(skb, 4)); 2817 bt_dev_dbg(hdev, "Fseq Top reset address: 0x%8.8x", val); 2818 2819 val = get_unaligned_le32(skb_pull_data(skb, 4)); 2820 bt_dev_dbg(hdev, "Fseq MBX timeout: 0x%8.8x", val); 2821 2822 val = get_unaligned_le32(skb_pull_data(skb, 4)); 2823 bt_dev_dbg(hdev, "Fseq MBX ack: 0x%8.8x", val); 2824 2825 val = get_unaligned_le32(skb_pull_data(skb, 4)); 2826 bt_dev_dbg(hdev, "Fseq CNVi id: 0x%8.8x", val); 2827 2828 val = get_unaligned_le32(skb_pull_data(skb, 4)); 2829 bt_dev_dbg(hdev, "Fseq CNVr id: 0x%8.8x", val); 2830 2831 val = get_unaligned_le32(skb_pull_data(skb, 4)); 2832 bt_dev_dbg(hdev, "Fseq Error handle: 0x%8.8x", val); 2833 2834 val = get_unaligned_le32(skb_pull_data(skb, 4)); 2835 bt_dev_dbg(hdev, "Fseq Magic noalive indication: 0x%8.8x", val); 2836 2837 val = get_unaligned_le32(skb_pull_data(skb, 4)); 2838 bt_dev_dbg(hdev, "Fseq OTP version: 0x%8.8x", val); 2839 2840 val = get_unaligned_le32(skb_pull_data(skb, 4)); 2841 bt_dev_dbg(hdev, "Fseq MBX otp version: 0x%8.8x", val); 2842 2843 kfree_skb(skb); 2844 } 2845 EXPORT_SYMBOL_GPL(btintel_print_fseq_info); 2846 2847 static int btintel_setup_combined(struct hci_dev *hdev) 2848 { 2849 const u8 param[1] = { 0xFF }; 2850 struct intel_version ver; 2851 struct intel_version_tlv ver_tlv; 2852 struct sk_buff *skb; 2853 int err; 2854 2855 BT_DBG("%s", hdev->name); 2856 2857 /* The some controllers have a bug with the first HCI command sent to it 2858 * returning number of completed commands as zero. This would stall the 2859 * command processing in the Bluetooth core. 2860 * 2861 * As a workaround, send HCI Reset command first which will reset the 2862 * number of completed commands and allow normal command processing 2863 * from now on. 2864 * 2865 * Regarding the INTEL_BROKEN_SHUTDOWN_LED flag, these devices maybe 2866 * in the SW_RFKILL ON state as a workaround of fixing LED issue during 2867 * the shutdown() procedure, and once the device is in SW_RFKILL ON 2868 * state, the only way to exit out of it is sending the HCI_Reset 2869 * command. 2870 */ 2871 if (btintel_test_flag(hdev, INTEL_BROKEN_INITIAL_NCMD) || 2872 btintel_test_flag(hdev, INTEL_BROKEN_SHUTDOWN_LED)) { 2873 skb = __hci_cmd_sync(hdev, HCI_OP_RESET, 0, NULL, 2874 HCI_INIT_TIMEOUT); 2875 if (IS_ERR(skb)) { 2876 bt_dev_err(hdev, 2877 "sending initial HCI reset failed (%ld)", 2878 PTR_ERR(skb)); 2879 return PTR_ERR(skb); 2880 } 2881 kfree_skb(skb); 2882 } 2883 2884 /* Starting from TyP device, the command parameter and response are 2885 * changed even though the OCF for HCI_Intel_Read_Version command 2886 * remains same. The legacy devices can handle even if the 2887 * command has a parameter and returns a correct version information. 2888 * So, it uses new format to support both legacy and new format. 2889 */ 2890 skb = __hci_cmd_sync(hdev, 0xfc05, 1, param, HCI_CMD_TIMEOUT); 2891 if (IS_ERR(skb)) { 2892 bt_dev_err(hdev, "Reading Intel version command failed (%ld)", 2893 PTR_ERR(skb)); 2894 return PTR_ERR(skb); 2895 } 2896 2897 /* Check the status */ 2898 if (skb->data[0]) { 2899 bt_dev_err(hdev, "Intel Read Version command failed (%02x)", 2900 skb->data[0]); 2901 err = -EIO; 2902 goto exit_error; 2903 } 2904 2905 /* Apply the common HCI quirks for Intel device */ 2906 set_bit(HCI_QUIRK_STRICT_DUPLICATE_FILTER, &hdev->quirks); 2907 set_bit(HCI_QUIRK_SIMULTANEOUS_DISCOVERY, &hdev->quirks); 2908 set_bit(HCI_QUIRK_NON_PERSISTENT_DIAG, &hdev->quirks); 2909 2910 /* Set up the quality report callback for Intel devices */ 2911 hdev->set_quality_report = btintel_set_quality_report; 2912 2913 /* For Legacy device, check the HW platform value and size */ 2914 if (skb->len == sizeof(ver) && skb->data[1] == 0x37) { 2915 bt_dev_dbg(hdev, "Read the legacy Intel version information"); 2916 2917 memcpy(&ver, skb->data, sizeof(ver)); 2918 2919 /* Display version information */ 2920 btintel_version_info(hdev, &ver); 2921 2922 /* Check for supported iBT hardware variants of this firmware 2923 * loading method. 2924 * 2925 * This check has been put in place to ensure correct forward 2926 * compatibility options when newer hardware variants come 2927 * along. 2928 */ 2929 switch (ver.hw_variant) { 2930 case 0x07: /* WP */ 2931 case 0x08: /* StP */ 2932 /* Legacy ROM product */ 2933 btintel_set_flag(hdev, INTEL_ROM_LEGACY); 2934 2935 /* Apply the device specific HCI quirks 2936 * 2937 * WBS for SdP - For the Legacy ROM products, only SdP 2938 * supports the WBS. But the version information is not 2939 * enough to use here because the StP2 and SdP have same 2940 * hw_variant and fw_variant. So, this flag is set by 2941 * the transport driver (btusb) based on the HW info 2942 * (idProduct) 2943 */ 2944 if (!btintel_test_flag(hdev, 2945 INTEL_ROM_LEGACY_NO_WBS_SUPPORT)) 2946 set_bit(HCI_QUIRK_WIDEBAND_SPEECH_SUPPORTED, 2947 &hdev->quirks); 2948 if (ver.hw_variant == 0x08 && ver.fw_variant == 0x22) 2949 set_bit(HCI_QUIRK_VALID_LE_STATES, 2950 &hdev->quirks); 2951 2952 err = btintel_legacy_rom_setup(hdev, &ver); 2953 break; 2954 case 0x0b: /* SfP */ 2955 case 0x11: /* JfP */ 2956 case 0x12: /* ThP */ 2957 case 0x13: /* HrP */ 2958 case 0x14: /* CcP */ 2959 set_bit(HCI_QUIRK_VALID_LE_STATES, &hdev->quirks); 2960 fallthrough; 2961 case 0x0c: /* WsP */ 2962 /* Apply the device specific HCI quirks 2963 * 2964 * All Legacy bootloader devices support WBS 2965 */ 2966 set_bit(HCI_QUIRK_WIDEBAND_SPEECH_SUPPORTED, 2967 &hdev->quirks); 2968 2969 /* These variants don't seem to support LE Coded PHY */ 2970 set_bit(HCI_QUIRK_BROKEN_LE_CODED, &hdev->quirks); 2971 2972 /* Setup MSFT Extension support */ 2973 btintel_set_msft_opcode(hdev, ver.hw_variant); 2974 2975 err = btintel_bootloader_setup(hdev, &ver); 2976 btintel_register_devcoredump_support(hdev); 2977 break; 2978 default: 2979 bt_dev_err(hdev, "Unsupported Intel hw variant (%u)", 2980 ver.hw_variant); 2981 err = -EINVAL; 2982 } 2983 2984 hci_set_hw_info(hdev, 2985 "INTEL platform=%u variant=%u revision=%u", 2986 ver.hw_platform, ver.hw_variant, 2987 ver.hw_revision); 2988 2989 goto exit_error; 2990 } 2991 2992 /* memset ver_tlv to start with clean state as few fields are exclusive 2993 * to bootloader mode and are not populated in operational mode 2994 */ 2995 memset(&ver_tlv, 0, sizeof(ver_tlv)); 2996 /* For TLV type device, parse the tlv data */ 2997 err = btintel_parse_version_tlv(hdev, &ver_tlv, skb); 2998 if (err) { 2999 bt_dev_err(hdev, "Failed to parse TLV version information"); 3000 goto exit_error; 3001 } 3002 3003 if (INTEL_HW_PLATFORM(ver_tlv.cnvi_bt) != 0x37) { 3004 bt_dev_err(hdev, "Unsupported Intel hardware platform (0x%2x)", 3005 INTEL_HW_PLATFORM(ver_tlv.cnvi_bt)); 3006 err = -EINVAL; 3007 goto exit_error; 3008 } 3009 3010 /* Check for supported iBT hardware variants of this firmware 3011 * loading method. 3012 * 3013 * This check has been put in place to ensure correct forward 3014 * compatibility options when newer hardware variants come 3015 * along. 3016 */ 3017 switch (INTEL_HW_VARIANT(ver_tlv.cnvi_bt)) { 3018 case 0x11: /* JfP */ 3019 case 0x12: /* ThP */ 3020 case 0x13: /* HrP */ 3021 case 0x14: /* CcP */ 3022 /* Some legacy bootloader devices starting from JfP, 3023 * the operational firmware supports both old and TLV based 3024 * HCI_Intel_Read_Version command based on the command 3025 * parameter. 3026 * 3027 * For upgrading firmware case, the TLV based version cannot 3028 * be used because the firmware filename for legacy bootloader 3029 * is based on the old format. 3030 * 3031 * Also, it is not easy to convert TLV based version from the 3032 * legacy version format. 3033 * 3034 * So, as a workaround for those devices, use the legacy 3035 * HCI_Intel_Read_Version to get the version information and 3036 * run the legacy bootloader setup. 3037 */ 3038 err = btintel_read_version(hdev, &ver); 3039 if (err) 3040 break; 3041 3042 /* Apply the device specific HCI quirks 3043 * 3044 * All Legacy bootloader devices support WBS 3045 */ 3046 set_bit(HCI_QUIRK_WIDEBAND_SPEECH_SUPPORTED, &hdev->quirks); 3047 3048 /* These variants don't seem to support LE Coded PHY */ 3049 set_bit(HCI_QUIRK_BROKEN_LE_CODED, &hdev->quirks); 3050 3051 /* Set Valid LE States quirk */ 3052 set_bit(HCI_QUIRK_VALID_LE_STATES, &hdev->quirks); 3053 3054 /* Setup MSFT Extension support */ 3055 btintel_set_msft_opcode(hdev, ver.hw_variant); 3056 3057 err = btintel_bootloader_setup(hdev, &ver); 3058 btintel_register_devcoredump_support(hdev); 3059 break; 3060 case 0x18: /* GfP2 */ 3061 case 0x1c: /* GaP */ 3062 /* Re-classify packet type for controllers with LE audio */ 3063 hdev->classify_pkt_type = btintel_classify_pkt_type; 3064 fallthrough; 3065 case 0x17: 3066 case 0x19: 3067 case 0x1b: 3068 case 0x1d: 3069 case 0x1e: 3070 /* Display version information of TLV type */ 3071 btintel_version_info_tlv(hdev, &ver_tlv); 3072 3073 /* Apply the device specific HCI quirks for TLV based devices 3074 * 3075 * All TLV based devices support WBS 3076 */ 3077 set_bit(HCI_QUIRK_WIDEBAND_SPEECH_SUPPORTED, &hdev->quirks); 3078 3079 /* Apply LE States quirk from solar onwards */ 3080 set_bit(HCI_QUIRK_VALID_LE_STATES, &hdev->quirks); 3081 3082 /* Setup MSFT Extension support */ 3083 btintel_set_msft_opcode(hdev, 3084 INTEL_HW_VARIANT(ver_tlv.cnvi_bt)); 3085 btintel_set_dsm_reset_method(hdev, &ver_tlv); 3086 3087 err = btintel_bootloader_setup_tlv(hdev, &ver_tlv); 3088 if (err) 3089 goto exit_error; 3090 3091 btintel_register_devcoredump_support(hdev); 3092 btintel_print_fseq_info(hdev); 3093 break; 3094 default: 3095 bt_dev_err(hdev, "Unsupported Intel hw variant (%u)", 3096 INTEL_HW_VARIANT(ver_tlv.cnvi_bt)); 3097 err = -EINVAL; 3098 break; 3099 } 3100 3101 hci_set_hw_info(hdev, "INTEL platform=%u variant=%u", 3102 INTEL_HW_PLATFORM(ver_tlv.cnvi_bt), 3103 INTEL_HW_VARIANT(ver_tlv.cnvi_bt)); 3104 3105 exit_error: 3106 kfree_skb(skb); 3107 3108 return err; 3109 } 3110 3111 int btintel_shutdown_combined(struct hci_dev *hdev) 3112 { 3113 struct sk_buff *skb; 3114 int ret; 3115 3116 /* Send HCI Reset to the controller to stop any BT activity which 3117 * were triggered. This will help to save power and maintain the 3118 * sync b/w Host and controller 3119 */ 3120 skb = __hci_cmd_sync(hdev, HCI_OP_RESET, 0, NULL, HCI_INIT_TIMEOUT); 3121 if (IS_ERR(skb)) { 3122 bt_dev_err(hdev, "HCI reset during shutdown failed"); 3123 return PTR_ERR(skb); 3124 } 3125 kfree_skb(skb); 3126 3127 3128 /* Some platforms have an issue with BT LED when the interface is 3129 * down or BT radio is turned off, which takes 5 seconds to BT LED 3130 * goes off. As a workaround, sends HCI_Intel_SW_RFKILL to put the 3131 * device in the RFKILL ON state which turns off the BT LED immediately. 3132 */ 3133 if (btintel_test_flag(hdev, INTEL_BROKEN_SHUTDOWN_LED)) { 3134 skb = __hci_cmd_sync(hdev, 0xfc3f, 0, NULL, HCI_INIT_TIMEOUT); 3135 if (IS_ERR(skb)) { 3136 ret = PTR_ERR(skb); 3137 bt_dev_err(hdev, "turning off Intel device LED failed"); 3138 return ret; 3139 } 3140 kfree_skb(skb); 3141 } 3142 3143 return 0; 3144 } 3145 EXPORT_SYMBOL_GPL(btintel_shutdown_combined); 3146 3147 int btintel_configure_setup(struct hci_dev *hdev, const char *driver_name) 3148 { 3149 hdev->manufacturer = 2; 3150 hdev->setup = btintel_setup_combined; 3151 hdev->shutdown = btintel_shutdown_combined; 3152 hdev->hw_error = btintel_hw_error; 3153 hdev->set_diag = btintel_set_diag_combined; 3154 hdev->set_bdaddr = btintel_set_bdaddr; 3155 3156 coredump_info.driver_name = driver_name; 3157 3158 return 0; 3159 } 3160 EXPORT_SYMBOL_GPL(btintel_configure_setup); 3161 3162 static int btintel_diagnostics(struct hci_dev *hdev, struct sk_buff *skb) 3163 { 3164 struct intel_tlv *tlv = (void *)&skb->data[5]; 3165 3166 /* The first event is always an event type TLV */ 3167 if (tlv->type != INTEL_TLV_TYPE_ID) 3168 goto recv_frame; 3169 3170 switch (tlv->val[0]) { 3171 case INTEL_TLV_SYSTEM_EXCEPTION: 3172 case INTEL_TLV_FATAL_EXCEPTION: 3173 case INTEL_TLV_DEBUG_EXCEPTION: 3174 case INTEL_TLV_TEST_EXCEPTION: 3175 /* Generate devcoredump from exception */ 3176 if (!hci_devcd_init(hdev, skb->len)) { 3177 hci_devcd_append(hdev, skb); 3178 hci_devcd_complete(hdev); 3179 } else { 3180 bt_dev_err(hdev, "Failed to generate devcoredump"); 3181 kfree_skb(skb); 3182 } 3183 return 0; 3184 default: 3185 bt_dev_err(hdev, "Invalid exception type %02X", tlv->val[0]); 3186 } 3187 3188 recv_frame: 3189 return hci_recv_frame(hdev, skb); 3190 } 3191 3192 int btintel_recv_event(struct hci_dev *hdev, struct sk_buff *skb) 3193 { 3194 struct hci_event_hdr *hdr = (void *)skb->data; 3195 const char diagnostics_hdr[] = { 0x87, 0x80, 0x03 }; 3196 3197 if (skb->len > HCI_EVENT_HDR_SIZE && hdr->evt == 0xff && 3198 hdr->plen > 0) { 3199 const void *ptr = skb->data + HCI_EVENT_HDR_SIZE + 1; 3200 unsigned int len = skb->len - HCI_EVENT_HDR_SIZE - 1; 3201 3202 if (btintel_test_flag(hdev, INTEL_BOOTLOADER)) { 3203 switch (skb->data[2]) { 3204 case 0x02: 3205 /* When switching to the operational firmware 3206 * the device sends a vendor specific event 3207 * indicating that the bootup completed. 3208 */ 3209 btintel_bootup(hdev, ptr, len); 3210 break; 3211 case 0x06: 3212 /* When the firmware loading completes the 3213 * device sends out a vendor specific event 3214 * indicating the result of the firmware 3215 * loading. 3216 */ 3217 btintel_secure_send_result(hdev, ptr, len); 3218 break; 3219 } 3220 } 3221 3222 /* Handle all diagnostics events separately. May still call 3223 * hci_recv_frame. 3224 */ 3225 if (len >= sizeof(diagnostics_hdr) && 3226 memcmp(&skb->data[2], diagnostics_hdr, 3227 sizeof(diagnostics_hdr)) == 0) { 3228 return btintel_diagnostics(hdev, skb); 3229 } 3230 } 3231 3232 return hci_recv_frame(hdev, skb); 3233 } 3234 EXPORT_SYMBOL_GPL(btintel_recv_event); 3235 3236 void btintel_bootup(struct hci_dev *hdev, const void *ptr, unsigned int len) 3237 { 3238 const struct intel_bootup *evt = ptr; 3239 3240 if (len != sizeof(*evt)) 3241 return; 3242 3243 if (btintel_test_and_clear_flag(hdev, INTEL_BOOTING)) 3244 btintel_wake_up_flag(hdev, INTEL_BOOTING); 3245 } 3246 EXPORT_SYMBOL_GPL(btintel_bootup); 3247 3248 void btintel_secure_send_result(struct hci_dev *hdev, 3249 const void *ptr, unsigned int len) 3250 { 3251 const struct intel_secure_send_result *evt = ptr; 3252 3253 if (len != sizeof(*evt)) 3254 return; 3255 3256 if (evt->result) 3257 btintel_set_flag(hdev, INTEL_FIRMWARE_FAILED); 3258 3259 if (btintel_test_and_clear_flag(hdev, INTEL_DOWNLOADING) && 3260 btintel_test_flag(hdev, INTEL_FIRMWARE_LOADED)) 3261 btintel_wake_up_flag(hdev, INTEL_DOWNLOADING); 3262 } 3263 EXPORT_SYMBOL_GPL(btintel_secure_send_result); 3264 3265 MODULE_AUTHOR("Marcel Holtmann <marcel@holtmann.org>"); 3266 MODULE_DESCRIPTION("Bluetooth support for Intel devices ver " VERSION); 3267 MODULE_VERSION(VERSION); 3268 MODULE_LICENSE("GPL"); 3269 MODULE_FIRMWARE("intel/ibt-11-5.sfi"); 3270 MODULE_FIRMWARE("intel/ibt-11-5.ddc"); 3271 MODULE_FIRMWARE("intel/ibt-12-16.sfi"); 3272 MODULE_FIRMWARE("intel/ibt-12-16.ddc"); 3273