1 // SPDX-License-Identifier: GPL-2.0-or-later 2 /* 3 * 4 * Bluetooth support for Intel devices 5 * 6 * Copyright (C) 2015 Intel Corporation 7 */ 8 9 #include <linux/module.h> 10 #include <linux/firmware.h> 11 #include <linux/regmap.h> 12 #include <linux/string_choices.h> 13 #include <linux/acpi.h> 14 #include <acpi/acpi_bus.h> 15 #include <linux/unaligned.h> 16 #include <linux/efi.h> 17 18 #include <net/bluetooth/bluetooth.h> 19 #include <net/bluetooth/hci_core.h> 20 21 #include "btintel.h" 22 23 #define VERSION "0.1" 24 25 #define BDADDR_INTEL (&(bdaddr_t){{0x00, 0x8b, 0x9e, 0x19, 0x03, 0x00}}) 26 #define RSA_HEADER_LEN 644 27 #define CSS_HEADER_OFFSET 8 28 #define ECDSA_OFFSET 644 29 #define ECDSA_HEADER_LEN 320 30 31 #define BTINTEL_EFI_DSBR L"UefiCnvCommonDSBR" 32 33 enum { 34 DSM_SET_WDISABLE2_DELAY = 1, 35 DSM_SET_RESET_METHOD = 3, 36 }; 37 38 /* Hybrid ECDSA + LMS */ 39 #define BTINTEL_RSA_HEADER_VER 0x00010000 40 #define BTINTEL_ECDSA_HEADER_VER 0x00020000 41 #define BTINTEL_HYBRID_HEADER_VER 0x00069700 42 #define BTINTEL_ECDSA_OFFSET 128 43 #define BTINTEL_CSS_HEADER_SIZE 128 44 #define BTINTEL_ECDSA_PUB_KEY_SIZE 96 45 #define BTINTEL_ECDSA_SIG_SIZE 96 46 #define BTINTEL_LMS_OFFSET 320 47 #define BTINTEL_LMS_PUB_KEY_SIZE 52 48 #define BTINTEL_LMS_SIG_SIZE 1744 49 #define BTINTEL_CMD_BUFFER_OFFSET 2116 50 51 #define BTINTEL_BT_DOMAIN 0x12 52 #define BTINTEL_SAR_LEGACY 0 53 #define BTINTEL_SAR_INC_PWR 1 54 #define BTINTEL_SAR_INC_PWR_SUPPORTED 0 55 56 #define CMD_WRITE_BOOT_PARAMS 0xfc0e 57 struct cmd_write_boot_params { 58 __le32 boot_addr; 59 u8 fw_build_num; 60 u8 fw_build_ww; 61 u8 fw_build_yy; 62 } __packed; 63 64 static struct { 65 const char *driver_name; 66 u8 hw_variant; 67 u32 fw_build_num; 68 } coredump_info; 69 70 const guid_t btintel_guid_dsm = 71 GUID_INIT(0xaa10f4e0, 0x81ac, 0x4233, 72 0xab, 0xf6, 0x3b, 0x2a, 0xc5, 0x0e, 0x28, 0xd9); 73 EXPORT_SYMBOL_GPL(btintel_guid_dsm); 74 75 int btintel_check_bdaddr(struct hci_dev *hdev) 76 { 77 struct hci_rp_read_bd_addr *bda; 78 struct sk_buff *skb; 79 80 skb = __hci_cmd_sync(hdev, HCI_OP_READ_BD_ADDR, 0, NULL, 81 HCI_INIT_TIMEOUT); 82 if (IS_ERR(skb)) { 83 int err = PTR_ERR(skb); 84 bt_dev_err(hdev, "Reading Intel device address failed (%d)", 85 err); 86 return err; 87 } 88 89 if (skb->len != sizeof(*bda)) { 90 bt_dev_err(hdev, "Intel device address length mismatch"); 91 kfree_skb(skb); 92 return -EIO; 93 } 94 95 bda = (struct hci_rp_read_bd_addr *)skb->data; 96 97 /* For some Intel based controllers, the default Bluetooth device 98 * address 00:03:19:9E:8B:00 can be found. These controllers are 99 * fully operational, but have the danger of duplicate addresses 100 * and that in turn can cause problems with Bluetooth operation. 101 */ 102 if (!bacmp(&bda->bdaddr, BDADDR_INTEL)) { 103 bt_dev_err(hdev, "Found Intel default device address (%pMR)", 104 &bda->bdaddr); 105 hci_set_quirk(hdev, HCI_QUIRK_INVALID_BDADDR); 106 } 107 108 kfree_skb(skb); 109 110 return 0; 111 } 112 EXPORT_SYMBOL_GPL(btintel_check_bdaddr); 113 114 int btintel_enter_mfg(struct hci_dev *hdev) 115 { 116 static const u8 param[] = { 0x01, 0x00 }; 117 struct sk_buff *skb; 118 119 skb = __hci_cmd_sync(hdev, 0xfc11, 2, param, HCI_CMD_TIMEOUT); 120 if (IS_ERR(skb)) { 121 bt_dev_err(hdev, "Entering manufacturer mode failed (%ld)", 122 PTR_ERR(skb)); 123 return PTR_ERR(skb); 124 } 125 kfree_skb(skb); 126 127 return 0; 128 } 129 EXPORT_SYMBOL_GPL(btintel_enter_mfg); 130 131 int btintel_exit_mfg(struct hci_dev *hdev, bool reset, bool patched) 132 { 133 u8 param[] = { 0x00, 0x00 }; 134 struct sk_buff *skb; 135 136 /* The 2nd command parameter specifies the manufacturing exit method: 137 * 0x00: Just disable the manufacturing mode (0x00). 138 * 0x01: Disable manufacturing mode and reset with patches deactivated. 139 * 0x02: Disable manufacturing mode and reset with patches activated. 140 */ 141 if (reset) 142 param[1] |= patched ? 0x02 : 0x01; 143 144 skb = __hci_cmd_sync(hdev, 0xfc11, 2, param, HCI_CMD_TIMEOUT); 145 if (IS_ERR(skb)) { 146 bt_dev_err(hdev, "Exiting manufacturer mode failed (%ld)", 147 PTR_ERR(skb)); 148 return PTR_ERR(skb); 149 } 150 kfree_skb(skb); 151 152 return 0; 153 } 154 EXPORT_SYMBOL_GPL(btintel_exit_mfg); 155 156 int btintel_set_bdaddr(struct hci_dev *hdev, const bdaddr_t *bdaddr) 157 { 158 struct sk_buff *skb; 159 int err; 160 161 skb = __hci_cmd_sync(hdev, 0xfc31, 6, bdaddr, HCI_INIT_TIMEOUT); 162 if (IS_ERR(skb)) { 163 err = PTR_ERR(skb); 164 bt_dev_err(hdev, "Changing Intel device address failed (%d)", 165 err); 166 return err; 167 } 168 kfree_skb(skb); 169 170 return 0; 171 } 172 EXPORT_SYMBOL_GPL(btintel_set_bdaddr); 173 174 static int btintel_set_event_mask(struct hci_dev *hdev, bool debug) 175 { 176 u8 mask[8] = { 0x87, 0x0c, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 }; 177 struct sk_buff *skb; 178 int err; 179 180 if (debug) 181 mask[1] |= 0x62; 182 183 skb = __hci_cmd_sync(hdev, 0xfc52, 8, mask, HCI_INIT_TIMEOUT); 184 if (IS_ERR(skb)) { 185 err = PTR_ERR(skb); 186 bt_dev_err(hdev, "Setting Intel event mask failed (%d)", err); 187 return err; 188 } 189 kfree_skb(skb); 190 191 return 0; 192 } 193 194 int btintel_set_diag(struct hci_dev *hdev, bool enable) 195 { 196 struct sk_buff *skb; 197 u8 param[3]; 198 int err; 199 200 if (enable) { 201 param[0] = 0x03; 202 param[1] = 0x03; 203 param[2] = 0x03; 204 } else { 205 param[0] = 0x00; 206 param[1] = 0x00; 207 param[2] = 0x00; 208 } 209 210 skb = __hci_cmd_sync(hdev, 0xfc43, 3, param, HCI_INIT_TIMEOUT); 211 if (IS_ERR(skb)) { 212 err = PTR_ERR(skb); 213 if (err == -ENODATA) 214 goto done; 215 bt_dev_err(hdev, "Changing Intel diagnostic mode failed (%d)", 216 err); 217 return err; 218 } 219 kfree_skb(skb); 220 221 done: 222 btintel_set_event_mask(hdev, enable); 223 return 0; 224 } 225 EXPORT_SYMBOL_GPL(btintel_set_diag); 226 227 static int btintel_set_diag_mfg(struct hci_dev *hdev, bool enable) 228 { 229 int err, ret; 230 231 err = btintel_enter_mfg(hdev); 232 if (err) 233 return err; 234 235 ret = btintel_set_diag(hdev, enable); 236 237 err = btintel_exit_mfg(hdev, false, false); 238 if (err) 239 return err; 240 241 return ret; 242 } 243 244 static int btintel_set_diag_combined(struct hci_dev *hdev, bool enable) 245 { 246 int ret; 247 248 /* Legacy ROM device needs to be in the manufacturer mode to apply 249 * diagnostic setting 250 * 251 * This flag is set after reading the Intel version. 252 */ 253 if (btintel_test_flag(hdev, INTEL_ROM_LEGACY)) 254 ret = btintel_set_diag_mfg(hdev, enable); 255 else 256 ret = btintel_set_diag(hdev, enable); 257 258 return ret; 259 } 260 261 void btintel_hw_error(struct hci_dev *hdev, u8 code) 262 { 263 struct sk_buff *skb; 264 u8 type = 0x00; 265 266 bt_dev_err(hdev, "Hardware error 0x%2.2x", code); 267 268 hci_req_sync_lock(hdev); 269 270 skb = __hci_cmd_sync(hdev, HCI_OP_RESET, 0, NULL, HCI_INIT_TIMEOUT); 271 if (IS_ERR(skb)) { 272 bt_dev_err(hdev, "Reset after hardware error failed (%ld)", 273 PTR_ERR(skb)); 274 goto unlock; 275 } 276 kfree_skb(skb); 277 278 skb = __hci_cmd_sync(hdev, 0xfc22, 1, &type, HCI_INIT_TIMEOUT); 279 if (IS_ERR(skb)) { 280 bt_dev_err(hdev, "Retrieving Intel exception info failed (%ld)", 281 PTR_ERR(skb)); 282 goto unlock; 283 } 284 285 if (skb->len != 13) { 286 bt_dev_err(hdev, "Exception info size mismatch"); 287 kfree_skb(skb); 288 goto unlock; 289 } 290 291 bt_dev_err(hdev, "Exception info %s", (char *)(skb->data + 1)); 292 293 kfree_skb(skb); 294 295 unlock: 296 hci_req_sync_unlock(hdev); 297 } 298 EXPORT_SYMBOL_GPL(btintel_hw_error); 299 300 int btintel_version_info(struct hci_dev *hdev, struct intel_version *ver) 301 { 302 const char *variant; 303 304 /* The hardware platform number has a fixed value of 0x37 and 305 * for now only accept this single value. 306 */ 307 if (ver->hw_platform != 0x37) { 308 bt_dev_err(hdev, "Unsupported Intel hardware platform (%u)", 309 ver->hw_platform); 310 return -EINVAL; 311 } 312 313 /* Check for supported iBT hardware variants of this firmware 314 * loading method. 315 * 316 * This check has been put in place to ensure correct forward 317 * compatibility options when newer hardware variants come along. 318 */ 319 switch (ver->hw_variant) { 320 case 0x07: /* WP - Legacy ROM */ 321 case 0x08: /* StP - Legacy ROM */ 322 case 0x0b: /* SfP */ 323 case 0x0c: /* WsP */ 324 case 0x11: /* JfP */ 325 case 0x12: /* ThP */ 326 case 0x13: /* HrP */ 327 case 0x14: /* CcP */ 328 break; 329 default: 330 bt_dev_err(hdev, "Unsupported Intel hardware variant (%u)", 331 ver->hw_variant); 332 return -EINVAL; 333 } 334 335 switch (ver->fw_variant) { 336 case 0x01: 337 variant = "Legacy ROM 2.5"; 338 break; 339 case 0x06: 340 variant = "Bootloader"; 341 break; 342 case 0x22: 343 variant = "Legacy ROM 2.x"; 344 break; 345 case 0x23: 346 variant = "Firmware"; 347 break; 348 default: 349 bt_dev_err(hdev, "Unsupported firmware variant(%02x)", ver->fw_variant); 350 return -EINVAL; 351 } 352 353 coredump_info.hw_variant = ver->hw_variant; 354 coredump_info.fw_build_num = ver->fw_build_num; 355 356 bt_dev_info(hdev, "%s revision %u.%u build %u week %u %u", 357 variant, ver->fw_revision >> 4, ver->fw_revision & 0x0f, 358 ver->fw_build_num, ver->fw_build_ww, 359 2000 + ver->fw_build_yy); 360 361 return 0; 362 } 363 EXPORT_SYMBOL_GPL(btintel_version_info); 364 365 static int btintel_secure_send(struct hci_dev *hdev, u8 fragment_type, u32 plen, 366 const void *param) 367 { 368 while (plen > 0) { 369 struct sk_buff *skb; 370 u8 cmd_param[253], fragment_len = (plen > 252) ? 252 : plen; 371 372 cmd_param[0] = fragment_type; 373 memcpy(cmd_param + 1, param, fragment_len); 374 375 skb = __hci_cmd_sync(hdev, 0xfc09, fragment_len + 1, 376 cmd_param, HCI_INIT_TIMEOUT); 377 if (IS_ERR(skb)) 378 return PTR_ERR(skb); 379 380 kfree_skb(skb); 381 382 plen -= fragment_len; 383 param += fragment_len; 384 } 385 386 return 0; 387 } 388 389 int btintel_load_ddc_config(struct hci_dev *hdev, const char *ddc_name) 390 { 391 const struct firmware *fw; 392 struct sk_buff *skb; 393 const u8 *fw_ptr; 394 int err; 395 396 err = request_firmware_direct(&fw, ddc_name, &hdev->dev); 397 if (err < 0) { 398 bt_dev_err(hdev, "Failed to load Intel DDC file %s (%d)", 399 ddc_name, err); 400 return err; 401 } 402 403 bt_dev_info(hdev, "Found Intel DDC parameters: %s", ddc_name); 404 405 fw_ptr = fw->data; 406 407 /* DDC file contains one or more DDC structure which has 408 * Length (1 byte), DDC ID (2 bytes), and DDC value (Length - 2). 409 */ 410 while (fw->size > fw_ptr - fw->data) { 411 u8 cmd_plen = fw_ptr[0] + sizeof(u8); 412 413 skb = __hci_cmd_sync(hdev, 0xfc8b, cmd_plen, fw_ptr, 414 HCI_INIT_TIMEOUT); 415 if (IS_ERR(skb)) { 416 bt_dev_err(hdev, "Failed to send Intel_Write_DDC (%ld)", 417 PTR_ERR(skb)); 418 release_firmware(fw); 419 return PTR_ERR(skb); 420 } 421 422 fw_ptr += cmd_plen; 423 kfree_skb(skb); 424 } 425 426 release_firmware(fw); 427 428 bt_dev_info(hdev, "Applying Intel DDC parameters completed"); 429 430 return 0; 431 } 432 EXPORT_SYMBOL_GPL(btintel_load_ddc_config); 433 434 int btintel_set_event_mask_mfg(struct hci_dev *hdev, bool debug) 435 { 436 int err, ret; 437 438 err = btintel_enter_mfg(hdev); 439 if (err) 440 return err; 441 442 ret = btintel_set_event_mask(hdev, debug); 443 444 err = btintel_exit_mfg(hdev, false, false); 445 if (err) 446 return err; 447 448 return ret; 449 } 450 EXPORT_SYMBOL_GPL(btintel_set_event_mask_mfg); 451 452 int btintel_read_version(struct hci_dev *hdev, struct intel_version *ver) 453 { 454 struct sk_buff *skb; 455 456 skb = __hci_cmd_sync(hdev, 0xfc05, 0, NULL, HCI_CMD_TIMEOUT); 457 if (IS_ERR(skb)) { 458 bt_dev_err(hdev, "Reading Intel version information failed (%ld)", 459 PTR_ERR(skb)); 460 return PTR_ERR(skb); 461 } 462 463 if (!skb || skb->len != sizeof(*ver)) { 464 bt_dev_err(hdev, "Intel version event size mismatch"); 465 kfree_skb(skb); 466 return -EILSEQ; 467 } 468 469 memcpy(ver, skb->data, sizeof(*ver)); 470 471 kfree_skb(skb); 472 473 return 0; 474 } 475 EXPORT_SYMBOL_GPL(btintel_read_version); 476 477 int btintel_version_info_tlv(struct hci_dev *hdev, 478 struct intel_version_tlv *version) 479 { 480 const char *variant; 481 482 /* The hardware platform number has a fixed value of 0x37 and 483 * for now only accept this single value. 484 */ 485 if (INTEL_HW_PLATFORM(version->cnvi_bt) != 0x37) { 486 bt_dev_err(hdev, "Unsupported Intel hardware platform (0x%2x)", 487 INTEL_HW_PLATFORM(version->cnvi_bt)); 488 return -EINVAL; 489 } 490 491 /* Check for supported iBT hardware variants of this firmware 492 * loading method. 493 * 494 * This check has been put in place to ensure correct forward 495 * compatibility options when newer hardware variants come along. 496 */ 497 switch (INTEL_HW_VARIANT(version->cnvi_bt)) { 498 case 0x17: /* TyP */ 499 case 0x18: /* Slr */ 500 case 0x19: /* Slr-F */ 501 case 0x1b: /* Mgr */ 502 case 0x1c: /* Gale Peak (GaP) */ 503 case 0x1d: /* BlazarU (BzrU) */ 504 case 0x1e: /* BlazarI (Bzr) */ 505 case 0x1f: /* Scorpious Peak */ 506 case 0x20: /* Scorpious Peak2 */ 507 case 0x21: /* Scorpious Peak2 F */ 508 case 0x22: /* BlazarIW (BzrIW) */ 509 break; 510 default: 511 bt_dev_err(hdev, "Unsupported Intel hardware variant (0x%x)", 512 INTEL_HW_VARIANT(version->cnvi_bt)); 513 return -EINVAL; 514 } 515 516 switch (version->img_type) { 517 case BTINTEL_IMG_BOOTLOADER: 518 variant = "Bootloader"; 519 /* It is required that every single firmware fragment is acknowledged 520 * with a command complete event. If the boot parameters indicate 521 * that this bootloader does not send them, then abort the setup. 522 */ 523 if (version->limited_cce != 0x00) { 524 bt_dev_err(hdev, "Unsupported Intel firmware loading method (0x%x)", 525 version->limited_cce); 526 return -EINVAL; 527 } 528 529 /* Secure boot engine type can be 0 (RSA), 1 (ECDSA), 2 (LMS), 3 (ECDSA + LMS) */ 530 if (version->sbe_type > 0x03) { 531 bt_dev_err(hdev, "Unsupported Intel secure boot engine type (0x%x)", 532 version->sbe_type); 533 return -EINVAL; 534 } 535 536 bt_dev_info(hdev, "Device revision is %u", version->dev_rev_id); 537 bt_dev_info(hdev, "Secure boot is %s", 538 str_enabled_disabled(version->secure_boot)); 539 bt_dev_info(hdev, "OTP lock is %s", 540 str_enabled_disabled(version->otp_lock)); 541 bt_dev_info(hdev, "API lock is %s", 542 str_enabled_disabled(version->api_lock)); 543 bt_dev_info(hdev, "Debug lock is %s", 544 str_enabled_disabled(version->debug_lock)); 545 bt_dev_info(hdev, "Minimum firmware build %u week %u %u", 546 version->min_fw_build_nn, version->min_fw_build_cw, 547 2000 + version->min_fw_build_yy); 548 break; 549 case BTINTEL_IMG_IML: 550 variant = "Intermediate loader"; 551 break; 552 case BTINTEL_IMG_OP: 553 variant = "Firmware"; 554 break; 555 default: 556 bt_dev_err(hdev, "Unsupported image type(%02x)", version->img_type); 557 return -EINVAL; 558 } 559 560 coredump_info.hw_variant = INTEL_HW_VARIANT(version->cnvi_bt); 561 coredump_info.fw_build_num = version->build_num; 562 563 bt_dev_info(hdev, "%s timestamp %u.%u buildtype %u build %u", variant, 564 2000 + (version->timestamp >> 8), version->timestamp & 0xff, 565 version->build_type, version->build_num); 566 if (version->img_type == BTINTEL_IMG_OP) 567 bt_dev_info(hdev, "Firmware SHA1: 0x%8.8x", version->git_sha1); 568 569 return 0; 570 } 571 EXPORT_SYMBOL_GPL(btintel_version_info_tlv); 572 573 int btintel_parse_version_tlv(struct hci_dev *hdev, 574 struct intel_version_tlv *version, 575 struct sk_buff *skb) 576 { 577 /* Consume Command Complete Status field */ 578 skb_pull(skb, 1); 579 580 /* Event parameters contain multiple TLVs. Read each of them 581 * and only keep the required data. Also, it use existing legacy 582 * version field like hw_platform, hw_variant, and fw_variant 583 * to keep the existing setup flow 584 */ 585 while (skb->len) { 586 struct intel_tlv *tlv; 587 588 /* Make sure skb has a minimum length of the header */ 589 if (skb->len < sizeof(*tlv)) 590 return -EINVAL; 591 592 tlv = (struct intel_tlv *)skb->data; 593 594 /* Make sure skb has a enough data */ 595 if (skb->len < tlv->len + sizeof(*tlv)) 596 return -EINVAL; 597 598 switch (tlv->type) { 599 case INTEL_TLV_CNVI_TOP: 600 version->cnvi_top = get_unaligned_le32(tlv->val); 601 break; 602 case INTEL_TLV_CNVR_TOP: 603 version->cnvr_top = get_unaligned_le32(tlv->val); 604 break; 605 case INTEL_TLV_CNVI_BT: 606 version->cnvi_bt = get_unaligned_le32(tlv->val); 607 break; 608 case INTEL_TLV_CNVR_BT: 609 version->cnvr_bt = get_unaligned_le32(tlv->val); 610 break; 611 case INTEL_TLV_DEV_REV_ID: 612 version->dev_rev_id = get_unaligned_le16(tlv->val); 613 break; 614 case INTEL_TLV_IMAGE_TYPE: 615 version->img_type = tlv->val[0]; 616 break; 617 case INTEL_TLV_TIME_STAMP: 618 /* If image type is Operational firmware (0x03), then 619 * running FW Calendar Week and Year information can 620 * be extracted from Timestamp information 621 */ 622 version->min_fw_build_cw = tlv->val[0]; 623 version->min_fw_build_yy = tlv->val[1]; 624 version->timestamp = get_unaligned_le16(tlv->val); 625 break; 626 case INTEL_TLV_BUILD_TYPE: 627 version->build_type = tlv->val[0]; 628 break; 629 case INTEL_TLV_BUILD_NUM: 630 /* If image type is Operational firmware (0x03), then 631 * running FW build number can be extracted from the 632 * Build information 633 */ 634 version->min_fw_build_nn = tlv->val[0]; 635 version->build_num = get_unaligned_le32(tlv->val); 636 break; 637 case INTEL_TLV_SECURE_BOOT: 638 version->secure_boot = tlv->val[0]; 639 break; 640 case INTEL_TLV_OTP_LOCK: 641 version->otp_lock = tlv->val[0]; 642 break; 643 case INTEL_TLV_API_LOCK: 644 version->api_lock = tlv->val[0]; 645 break; 646 case INTEL_TLV_DEBUG_LOCK: 647 version->debug_lock = tlv->val[0]; 648 break; 649 case INTEL_TLV_MIN_FW: 650 version->min_fw_build_nn = tlv->val[0]; 651 version->min_fw_build_cw = tlv->val[1]; 652 version->min_fw_build_yy = tlv->val[2]; 653 break; 654 case INTEL_TLV_LIMITED_CCE: 655 version->limited_cce = tlv->val[0]; 656 break; 657 case INTEL_TLV_SBE_TYPE: 658 version->sbe_type = tlv->val[0]; 659 break; 660 case INTEL_TLV_OTP_BDADDR: 661 memcpy(&version->otp_bd_addr, tlv->val, 662 sizeof(bdaddr_t)); 663 break; 664 case INTEL_TLV_GIT_SHA1: 665 version->git_sha1 = get_unaligned_le32(tlv->val); 666 break; 667 case INTEL_TLV_FW_ID: 668 snprintf(version->fw_id, sizeof(version->fw_id), 669 "%s", tlv->val); 670 break; 671 default: 672 /* Ignore rest of information */ 673 break; 674 } 675 /* consume the current tlv and move to next*/ 676 skb_pull(skb, tlv->len + sizeof(*tlv)); 677 } 678 679 return 0; 680 } 681 EXPORT_SYMBOL_GPL(btintel_parse_version_tlv); 682 683 static int btintel_read_version_tlv(struct hci_dev *hdev, 684 struct intel_version_tlv *version) 685 { 686 struct sk_buff *skb; 687 const u8 param[1] = { 0xFF }; 688 689 if (!version) 690 return -EINVAL; 691 692 skb = __hci_cmd_sync(hdev, 0xfc05, 1, param, HCI_CMD_TIMEOUT); 693 if (IS_ERR(skb)) { 694 bt_dev_err(hdev, "Reading Intel version information failed (%ld)", 695 PTR_ERR(skb)); 696 return PTR_ERR(skb); 697 } 698 699 if (skb->data[0]) { 700 bt_dev_err(hdev, "Intel Read Version command failed (%02x)", 701 skb->data[0]); 702 kfree_skb(skb); 703 return -EIO; 704 } 705 706 btintel_parse_version_tlv(hdev, version, skb); 707 708 kfree_skb(skb); 709 return 0; 710 } 711 712 /* ------- REGMAP IBT SUPPORT ------- */ 713 714 #define IBT_REG_MODE_8BIT 0x00 715 #define IBT_REG_MODE_16BIT 0x01 716 #define IBT_REG_MODE_32BIT 0x02 717 718 struct regmap_ibt_context { 719 struct hci_dev *hdev; 720 __u16 op_write; 721 __u16 op_read; 722 }; 723 724 struct ibt_cp_reg_access { 725 __le32 addr; 726 __u8 mode; 727 __u8 len; 728 __u8 data[]; 729 } __packed; 730 731 struct ibt_rp_reg_access { 732 __u8 status; 733 __le32 addr; 734 __u8 data[]; 735 } __packed; 736 737 static int regmap_ibt_read(void *context, const void *addr, size_t reg_size, 738 void *val, size_t val_size) 739 { 740 struct regmap_ibt_context *ctx = context; 741 struct ibt_cp_reg_access cp; 742 struct ibt_rp_reg_access *rp; 743 struct sk_buff *skb; 744 int err = 0; 745 746 if (reg_size != sizeof(__le32)) 747 return -EINVAL; 748 749 switch (val_size) { 750 case 1: 751 cp.mode = IBT_REG_MODE_8BIT; 752 break; 753 case 2: 754 cp.mode = IBT_REG_MODE_16BIT; 755 break; 756 case 4: 757 cp.mode = IBT_REG_MODE_32BIT; 758 break; 759 default: 760 return -EINVAL; 761 } 762 763 /* regmap provides a little-endian formatted addr */ 764 cp.addr = *(__le32 *)addr; 765 cp.len = val_size; 766 767 bt_dev_dbg(ctx->hdev, "Register (0x%x) read", le32_to_cpu(cp.addr)); 768 769 skb = hci_cmd_sync(ctx->hdev, ctx->op_read, sizeof(cp), &cp, 770 HCI_CMD_TIMEOUT); 771 if (IS_ERR(skb)) { 772 err = PTR_ERR(skb); 773 bt_dev_err(ctx->hdev, "regmap: Register (0x%x) read error (%d)", 774 le32_to_cpu(cp.addr), err); 775 return err; 776 } 777 778 if (skb->len != sizeof(*rp) + val_size) { 779 bt_dev_err(ctx->hdev, "regmap: Register (0x%x) read error, bad len", 780 le32_to_cpu(cp.addr)); 781 err = -EINVAL; 782 goto done; 783 } 784 785 rp = (struct ibt_rp_reg_access *)skb->data; 786 787 if (rp->addr != cp.addr) { 788 bt_dev_err(ctx->hdev, "regmap: Register (0x%x) read error, bad addr", 789 le32_to_cpu(rp->addr)); 790 err = -EINVAL; 791 goto done; 792 } 793 794 memcpy(val, rp->data, val_size); 795 796 done: 797 kfree_skb(skb); 798 return err; 799 } 800 801 static int regmap_ibt_gather_write(void *context, 802 const void *addr, size_t reg_size, 803 const void *val, size_t val_size) 804 { 805 struct regmap_ibt_context *ctx = context; 806 struct ibt_cp_reg_access *cp; 807 struct sk_buff *skb; 808 int plen = sizeof(*cp) + val_size; 809 u8 mode; 810 int err = 0; 811 812 if (reg_size != sizeof(__le32)) 813 return -EINVAL; 814 815 switch (val_size) { 816 case 1: 817 mode = IBT_REG_MODE_8BIT; 818 break; 819 case 2: 820 mode = IBT_REG_MODE_16BIT; 821 break; 822 case 4: 823 mode = IBT_REG_MODE_32BIT; 824 break; 825 default: 826 return -EINVAL; 827 } 828 829 cp = kmalloc(plen, GFP_KERNEL); 830 if (!cp) 831 return -ENOMEM; 832 833 /* regmap provides a little-endian formatted addr/value */ 834 cp->addr = *(__le32 *)addr; 835 cp->mode = mode; 836 cp->len = val_size; 837 memcpy(&cp->data, val, val_size); 838 839 bt_dev_dbg(ctx->hdev, "Register (0x%x) write", le32_to_cpu(cp->addr)); 840 841 skb = hci_cmd_sync(ctx->hdev, ctx->op_write, plen, cp, HCI_CMD_TIMEOUT); 842 if (IS_ERR(skb)) { 843 err = PTR_ERR(skb); 844 bt_dev_err(ctx->hdev, "regmap: Register (0x%x) write error (%d)", 845 le32_to_cpu(cp->addr), err); 846 goto done; 847 } 848 kfree_skb(skb); 849 850 done: 851 kfree(cp); 852 return err; 853 } 854 855 static int regmap_ibt_write(void *context, const void *data, size_t count) 856 { 857 /* data contains register+value, since we only support 32bit addr, 858 * minimum data size is 4 bytes. 859 */ 860 if (WARN_ONCE(count < 4, "Invalid register access")) 861 return -EINVAL; 862 863 return regmap_ibt_gather_write(context, data, 4, data + 4, count - 4); 864 } 865 866 static void regmap_ibt_free_context(void *context) 867 { 868 kfree(context); 869 } 870 871 static const struct regmap_bus regmap_ibt = { 872 .read = regmap_ibt_read, 873 .write = regmap_ibt_write, 874 .gather_write = regmap_ibt_gather_write, 875 .free_context = regmap_ibt_free_context, 876 .reg_format_endian_default = REGMAP_ENDIAN_LITTLE, 877 .val_format_endian_default = REGMAP_ENDIAN_LITTLE, 878 }; 879 880 /* Config is the same for all register regions */ 881 static const struct regmap_config regmap_ibt_cfg = { 882 .name = "btintel_regmap", 883 .reg_bits = 32, 884 .val_bits = 32, 885 }; 886 887 struct regmap *btintel_regmap_init(struct hci_dev *hdev, u16 opcode_read, 888 u16 opcode_write) 889 { 890 struct regmap_ibt_context *ctx; 891 892 bt_dev_info(hdev, "regmap: Init R%x-W%x region", opcode_read, 893 opcode_write); 894 895 ctx = kzalloc_obj(*ctx); 896 if (!ctx) 897 return ERR_PTR(-ENOMEM); 898 899 ctx->op_read = opcode_read; 900 ctx->op_write = opcode_write; 901 ctx->hdev = hdev; 902 903 return regmap_init(&hdev->dev, ®map_ibt, ctx, ®map_ibt_cfg); 904 } 905 EXPORT_SYMBOL_GPL(btintel_regmap_init); 906 907 int btintel_send_intel_reset(struct hci_dev *hdev, u32 boot_param) 908 { 909 struct intel_reset params = { 0x00, 0x01, 0x00, 0x01, 0x00000000 }; 910 struct sk_buff *skb; 911 912 params.boot_param = cpu_to_le32(boot_param); 913 914 skb = __hci_cmd_sync(hdev, BTINTEL_HCI_OP_RESET, sizeof(params), ¶ms, 915 HCI_INIT_TIMEOUT); 916 if (IS_ERR(skb)) { 917 bt_dev_err(hdev, "Failed to send Intel Reset command"); 918 return PTR_ERR(skb); 919 } 920 921 kfree_skb(skb); 922 923 return 0; 924 } 925 EXPORT_SYMBOL_GPL(btintel_send_intel_reset); 926 927 int btintel_read_boot_params(struct hci_dev *hdev, 928 struct intel_boot_params *params) 929 { 930 struct sk_buff *skb; 931 932 skb = __hci_cmd_sync(hdev, 0xfc0d, 0, NULL, HCI_INIT_TIMEOUT); 933 if (IS_ERR(skb)) { 934 bt_dev_err(hdev, "Reading Intel boot parameters failed (%ld)", 935 PTR_ERR(skb)); 936 return PTR_ERR(skb); 937 } 938 939 if (skb->len != sizeof(*params)) { 940 bt_dev_err(hdev, "Intel boot parameters size mismatch"); 941 kfree_skb(skb); 942 return -EILSEQ; 943 } 944 945 memcpy(params, skb->data, sizeof(*params)); 946 947 kfree_skb(skb); 948 949 if (params->status) { 950 bt_dev_err(hdev, "Intel boot parameters command failed (%02x)", 951 params->status); 952 return -bt_to_errno(params->status); 953 } 954 955 bt_dev_info(hdev, "Device revision is %u", 956 le16_to_cpu(params->dev_revid)); 957 958 bt_dev_info(hdev, "Secure boot is %s", 959 str_enabled_disabled(params->secure_boot)); 960 961 bt_dev_info(hdev, "OTP lock is %s", 962 str_enabled_disabled(params->otp_lock)); 963 964 bt_dev_info(hdev, "API lock is %s", 965 str_enabled_disabled(params->api_lock)); 966 967 bt_dev_info(hdev, "Debug lock is %s", 968 str_enabled_disabled(params->debug_lock)); 969 970 bt_dev_info(hdev, "Minimum firmware build %u week %u %u", 971 params->min_fw_build_nn, params->min_fw_build_cw, 972 2000 + params->min_fw_build_yy); 973 974 return 0; 975 } 976 EXPORT_SYMBOL_GPL(btintel_read_boot_params); 977 978 static int btintel_sfi_rsa_header_secure_send(struct hci_dev *hdev, 979 const struct firmware *fw) 980 { 981 int err; 982 983 /* Start the firmware download transaction with the Init fragment 984 * represented by the 128 bytes of CSS header. 985 */ 986 err = btintel_secure_send(hdev, 0x00, 128, fw->data); 987 if (err < 0) { 988 bt_dev_err(hdev, "Failed to send firmware header (%d)", err); 989 goto done; 990 } 991 992 /* Send the 256 bytes of public key information from the firmware 993 * as the PKey fragment. 994 */ 995 err = btintel_secure_send(hdev, 0x03, 256, fw->data + 128); 996 if (err < 0) { 997 bt_dev_err(hdev, "Failed to send firmware pkey (%d)", err); 998 goto done; 999 } 1000 1001 /* Send the 256 bytes of signature information from the firmware 1002 * as the Sign fragment. 1003 */ 1004 err = btintel_secure_send(hdev, 0x02, 256, fw->data + 388); 1005 if (err < 0) { 1006 bt_dev_err(hdev, "Failed to send firmware signature (%d)", err); 1007 goto done; 1008 } 1009 1010 done: 1011 return err; 1012 } 1013 1014 static int btintel_sfi_ecdsa_header_secure_send(struct hci_dev *hdev, 1015 const struct firmware *fw) 1016 { 1017 int err; 1018 1019 /* Start the firmware download transaction with the Init fragment 1020 * represented by the 128 bytes of CSS header. 1021 */ 1022 err = btintel_secure_send(hdev, 0x00, 128, fw->data + 644); 1023 if (err < 0) { 1024 bt_dev_err(hdev, "Failed to send firmware header (%d)", err); 1025 return err; 1026 } 1027 1028 /* Send the 96 bytes of public key information from the firmware 1029 * as the PKey fragment. 1030 */ 1031 err = btintel_secure_send(hdev, 0x03, 96, fw->data + 644 + 128); 1032 if (err < 0) { 1033 bt_dev_err(hdev, "Failed to send firmware pkey (%d)", err); 1034 return err; 1035 } 1036 1037 /* Send the 96 bytes of signature information from the firmware 1038 * as the Sign fragment 1039 */ 1040 err = btintel_secure_send(hdev, 0x02, 96, fw->data + 644 + 224); 1041 if (err < 0) { 1042 bt_dev_err(hdev, "Failed to send firmware signature (%d)", 1043 err); 1044 return err; 1045 } 1046 return 0; 1047 } 1048 1049 static int btintel_sfi_hybrid_header_secure_send(struct hci_dev *hdev, 1050 const struct firmware *fw) 1051 { 1052 int err; 1053 1054 err = btintel_secure_send(hdev, 0x00, BTINTEL_CSS_HEADER_SIZE, fw->data); 1055 if (err < 0) { 1056 bt_dev_err(hdev, "Failed to send firmware CSS header (%d)", err); 1057 return err; 1058 } 1059 1060 err = btintel_secure_send(hdev, 0x03, BTINTEL_ECDSA_PUB_KEY_SIZE, 1061 fw->data + BTINTEL_ECDSA_OFFSET); 1062 if (err < 0) { 1063 bt_dev_err(hdev, "Failed to send firmware ECDSA pkey (%d)", err); 1064 return err; 1065 } 1066 1067 err = btintel_secure_send(hdev, 0x02, BTINTEL_ECDSA_SIG_SIZE, 1068 fw->data + BTINTEL_ECDSA_OFFSET + BTINTEL_ECDSA_PUB_KEY_SIZE); 1069 if (err < 0) { 1070 bt_dev_err(hdev, "Failed to send firmware ECDSA signature (%d)", err); 1071 return err; 1072 } 1073 1074 err = btintel_secure_send(hdev, 0x05, BTINTEL_LMS_PUB_KEY_SIZE, 1075 fw->data + BTINTEL_LMS_OFFSET); 1076 if (err < 0) { 1077 bt_dev_err(hdev, "Failed to send firmware LMS pkey (%d)", err); 1078 return err; 1079 } 1080 1081 err = btintel_secure_send(hdev, 0x04, BTINTEL_LMS_SIG_SIZE, 1082 fw->data + BTINTEL_LMS_OFFSET + BTINTEL_LMS_PUB_KEY_SIZE); 1083 if (err < 0) { 1084 bt_dev_err(hdev, "Failed to send firmware LMS signature (%d)", err); 1085 return err; 1086 } 1087 1088 return 0; 1089 } 1090 1091 static int btintel_download_firmware_payload(struct hci_dev *hdev, 1092 const struct firmware *fw, 1093 size_t offset) 1094 { 1095 int err; 1096 const u8 *fw_ptr; 1097 u32 frag_len; 1098 1099 fw_ptr = fw->data + offset; 1100 frag_len = 0; 1101 err = -EINVAL; 1102 1103 while (fw_ptr - fw->data < fw->size) { 1104 struct hci_command_hdr *cmd = (void *)(fw_ptr + frag_len); 1105 1106 frag_len += sizeof(*cmd) + cmd->plen; 1107 1108 /* The parameter length of the secure send command requires 1109 * a 4 byte alignment. It happens so that the firmware file 1110 * contains proper Intel_NOP commands to align the fragments 1111 * as needed. 1112 * 1113 * Send set of commands with 4 byte alignment from the 1114 * firmware data buffer as a single Data fragment. 1115 */ 1116 if (!(frag_len % 4)) { 1117 err = btintel_secure_send(hdev, 0x01, frag_len, fw_ptr); 1118 if (err < 0) { 1119 bt_dev_err(hdev, 1120 "Failed to send firmware data (%d)", 1121 err); 1122 goto done; 1123 } 1124 1125 fw_ptr += frag_len; 1126 frag_len = 0; 1127 } 1128 } 1129 1130 done: 1131 return err; 1132 } 1133 1134 static bool btintel_firmware_version(struct hci_dev *hdev, 1135 u8 num, u8 ww, u8 yy, 1136 const struct firmware *fw, 1137 u32 *boot_addr) 1138 { 1139 const u8 *fw_ptr; 1140 1141 fw_ptr = fw->data; 1142 1143 while (fw_ptr - fw->data < fw->size) { 1144 struct hci_command_hdr *cmd = (void *)(fw_ptr); 1145 1146 /* Each SKU has a different reset parameter to use in the 1147 * HCI_Intel_Reset command and it is embedded in the firmware 1148 * data. So, instead of using static value per SKU, check 1149 * the firmware data and save it for later use. 1150 */ 1151 if (le16_to_cpu(cmd->opcode) == CMD_WRITE_BOOT_PARAMS) { 1152 struct cmd_write_boot_params *params; 1153 1154 params = (void *)(fw_ptr + sizeof(*cmd)); 1155 1156 *boot_addr = le32_to_cpu(params->boot_addr); 1157 1158 bt_dev_info(hdev, "Boot Address: 0x%x", *boot_addr); 1159 1160 bt_dev_info(hdev, "Firmware Version: %u-%u.%u", 1161 params->fw_build_num, params->fw_build_ww, 1162 params->fw_build_yy); 1163 1164 return (num == params->fw_build_num && 1165 ww == params->fw_build_ww && 1166 yy == params->fw_build_yy); 1167 } 1168 1169 fw_ptr += sizeof(*cmd) + cmd->plen; 1170 } 1171 1172 return false; 1173 } 1174 1175 int btintel_download_firmware(struct hci_dev *hdev, 1176 struct intel_version *ver, 1177 const struct firmware *fw, 1178 u32 *boot_param) 1179 { 1180 int err; 1181 1182 /* SfP and WsP don't seem to update the firmware version on file 1183 * so version checking is currently not possible. 1184 */ 1185 switch (ver->hw_variant) { 1186 case 0x0b: /* SfP */ 1187 case 0x0c: /* WsP */ 1188 /* Skip version checking */ 1189 break; 1190 default: 1191 1192 /* Skip download if firmware has the same version */ 1193 if (btintel_firmware_version(hdev, ver->fw_build_num, 1194 ver->fw_build_ww, ver->fw_build_yy, 1195 fw, boot_param)) { 1196 bt_dev_info(hdev, "Firmware already loaded"); 1197 /* Return -EALREADY to indicate that the firmware has 1198 * already been loaded. 1199 */ 1200 return -EALREADY; 1201 } 1202 } 1203 1204 /* The firmware variant determines if the device is in bootloader 1205 * mode or is running operational firmware. The value 0x06 identifies 1206 * the bootloader and the value 0x23 identifies the operational 1207 * firmware. 1208 * 1209 * If the firmware version has changed that means it needs to be reset 1210 * to bootloader when operational so the new firmware can be loaded. 1211 */ 1212 if (ver->fw_variant == 0x23) 1213 return -EINVAL; 1214 1215 err = btintel_sfi_rsa_header_secure_send(hdev, fw); 1216 if (err) 1217 return err; 1218 1219 return btintel_download_firmware_payload(hdev, fw, RSA_HEADER_LEN); 1220 } 1221 EXPORT_SYMBOL_GPL(btintel_download_firmware); 1222 1223 static int btintel_download_fw_tlv(struct hci_dev *hdev, 1224 struct intel_version_tlv *ver, 1225 const struct firmware *fw, u32 *boot_param, 1226 u8 hw_variant, u8 sbe_type) 1227 { 1228 int err; 1229 u32 css_header_ver; 1230 1231 /* Skip download if firmware has the same version */ 1232 if (btintel_firmware_version(hdev, ver->min_fw_build_nn, 1233 ver->min_fw_build_cw, 1234 ver->min_fw_build_yy, 1235 fw, boot_param)) { 1236 bt_dev_info(hdev, "Firmware already loaded"); 1237 /* Return -EALREADY to indicate that firmware has 1238 * already been loaded. 1239 */ 1240 return -EALREADY; 1241 } 1242 1243 /* The firmware variant determines if the device is in bootloader 1244 * mode or is running operational firmware. The value 0x01 identifies 1245 * the bootloader and the value 0x03 identifies the operational 1246 * firmware. 1247 * 1248 * If the firmware version has changed that means it needs to be reset 1249 * to bootloader when operational so the new firmware can be loaded. 1250 */ 1251 if (ver->img_type == BTINTEL_IMG_OP) 1252 return -EINVAL; 1253 1254 /* iBT hardware variants 0x0b, 0x0c, 0x11, 0x12, 0x13, 0x14 support 1255 * only RSA secure boot engine. Hence, the corresponding sfi file will 1256 * have RSA header of 644 bytes followed by Command Buffer. 1257 * 1258 * iBT hardware variants 0x17, 0x18 onwards support both RSA and ECDSA 1259 * secure boot engine. As a result, the corresponding sfi file will 1260 * have RSA header of 644, ECDSA header of 320 bytes followed by 1261 * Command Buffer. 1262 * 1263 * CSS Header byte positions 0x08 to 0x0B represent the CSS Header 1264 * version: RSA(0x00010000) , ECDSA (0x00020000) , HYBRID (0x00069700) 1265 */ 1266 css_header_ver = get_unaligned_le32(fw->data + CSS_HEADER_OFFSET); 1267 if (css_header_ver != BTINTEL_RSA_HEADER_VER && 1268 css_header_ver != BTINTEL_HYBRID_HEADER_VER) { 1269 bt_dev_err(hdev, "Invalid CSS Header version: 0x%8.8x", css_header_ver); 1270 return -EINVAL; 1271 } 1272 1273 if (hw_variant <= 0x14) { 1274 if (sbe_type != 0x00) { 1275 bt_dev_err(hdev, "Invalid SBE type for hardware variant (%d)", 1276 hw_variant); 1277 return -EINVAL; 1278 } 1279 1280 err = btintel_sfi_rsa_header_secure_send(hdev, fw); 1281 if (err) 1282 return err; 1283 1284 err = btintel_download_firmware_payload(hdev, fw, RSA_HEADER_LEN); 1285 if (err) 1286 return err; 1287 } else if (hw_variant >= 0x17 && css_header_ver == BTINTEL_RSA_HEADER_VER) { 1288 /* Check if CSS header for ECDSA follows the RSA header */ 1289 if (fw->data[ECDSA_OFFSET] != 0x06) 1290 return -EINVAL; 1291 1292 /* Check if the CSS Header version is ECDSA(0x00020000) */ 1293 css_header_ver = get_unaligned_le32(fw->data + ECDSA_OFFSET + CSS_HEADER_OFFSET); 1294 if (css_header_ver != BTINTEL_ECDSA_HEADER_VER) { 1295 bt_dev_err(hdev, "Invalid CSS Header version: 0x%8.8x", css_header_ver); 1296 return -EINVAL; 1297 } 1298 1299 if (sbe_type == 0x00) { 1300 err = btintel_sfi_rsa_header_secure_send(hdev, fw); 1301 if (err) 1302 return err; 1303 1304 err = btintel_download_firmware_payload(hdev, fw, 1305 RSA_HEADER_LEN + ECDSA_HEADER_LEN); 1306 if (err) 1307 return err; 1308 } else if (sbe_type == 0x01) { 1309 err = btintel_sfi_ecdsa_header_secure_send(hdev, fw); 1310 if (err) 1311 return err; 1312 1313 err = btintel_download_firmware_payload(hdev, fw, 1314 RSA_HEADER_LEN + ECDSA_HEADER_LEN); 1315 if (err) 1316 return err; 1317 } 1318 } else if (hw_variant >= 0x20 && css_header_ver == BTINTEL_HYBRID_HEADER_VER) { 1319 err = btintel_sfi_hybrid_header_secure_send(hdev, fw); 1320 if (err) 1321 return err; 1322 1323 err = btintel_download_firmware_payload(hdev, fw, BTINTEL_CMD_BUFFER_OFFSET); 1324 if (err) 1325 return err; 1326 } 1327 return 0; 1328 } 1329 1330 static void btintel_reset_to_bootloader(struct hci_dev *hdev) 1331 { 1332 struct intel_reset params; 1333 struct sk_buff *skb; 1334 1335 /* PCIe transport uses shared hardware reset mechanism for recovery 1336 * which gets triggered in pcie *setup* function on error. 1337 */ 1338 if (hdev->bus == HCI_PCI) 1339 return; 1340 1341 /* Send Intel Reset command. This will result in 1342 * re-enumeration of BT controller. 1343 * 1344 * Intel Reset parameter description: 1345 * reset_type : 0x00 (Soft reset), 1346 * 0x01 (Hard reset) 1347 * patch_enable : 0x00 (Do not enable), 1348 * 0x01 (Enable) 1349 * ddc_reload : 0x00 (Do not reload), 1350 * 0x01 (Reload) 1351 * boot_option: 0x00 (Current image), 1352 * 0x01 (Specified boot address) 1353 * boot_param: Boot address 1354 * 1355 */ 1356 1357 params.reset_type = 0x01; 1358 params.patch_enable = 0x01; 1359 params.ddc_reload = 0x01; 1360 params.boot_option = 0x00; 1361 params.boot_param = cpu_to_le32(0x00000000); 1362 1363 skb = __hci_cmd_sync(hdev, BTINTEL_HCI_OP_RESET, sizeof(params), 1364 ¶ms, HCI_INIT_TIMEOUT); 1365 if (IS_ERR(skb)) { 1366 bt_dev_err(hdev, "FW download error recovery failed (%ld)", 1367 PTR_ERR(skb)); 1368 return; 1369 } 1370 bt_dev_info(hdev, "Intel reset sent to retry FW download"); 1371 kfree_skb(skb); 1372 1373 /* Current Intel BT controllers(ThP/JfP) hold the USB reset 1374 * lines for 2ms when it receives Intel Reset in bootloader mode. 1375 * Whereas, the upcoming Intel BT controllers will hold USB reset 1376 * for 150ms. To keep the delay generic, 150ms is chosen here. 1377 */ 1378 msleep(150); 1379 } 1380 1381 static int btintel_read_debug_features(struct hci_dev *hdev, 1382 struct intel_debug_features *features) 1383 { 1384 struct sk_buff *skb; 1385 u8 page_no = 1; 1386 1387 /* Intel controller supports two pages, each page is of 128-bit 1388 * feature bit mask. And each bit defines specific feature support 1389 */ 1390 skb = __hci_cmd_sync(hdev, 0xfca6, sizeof(page_no), &page_no, 1391 HCI_INIT_TIMEOUT); 1392 if (IS_ERR(skb)) { 1393 bt_dev_err(hdev, "Reading supported features failed (%ld)", 1394 PTR_ERR(skb)); 1395 return PTR_ERR(skb); 1396 } 1397 1398 if (skb->len != (sizeof(features->page1) + 3)) { 1399 bt_dev_err(hdev, "Supported features event size mismatch"); 1400 kfree_skb(skb); 1401 return -EILSEQ; 1402 } 1403 1404 memcpy(features->page1, skb->data + 3, sizeof(features->page1)); 1405 1406 /* Read the supported features page2 if required in future. 1407 */ 1408 kfree_skb(skb); 1409 return 0; 1410 } 1411 1412 static int btintel_set_debug_features(struct hci_dev *hdev, 1413 const struct intel_debug_features *features) 1414 { 1415 u8 mask[11] = { 0x0a, 0x92, 0x02, 0x7f, 0x00, 0x00, 0x00, 0x00, 1416 0x00, 0x00, 0x00 }; 1417 u8 period[5] = { 0x04, 0x91, 0x02, 0x05, 0x00 }; 1418 u8 trace_enable = 0x02; 1419 struct sk_buff *skb; 1420 1421 if (!features) { 1422 bt_dev_warn(hdev, "Debug features not read"); 1423 return -EINVAL; 1424 } 1425 1426 if (!(features->page1[0] & 0x3f)) { 1427 bt_dev_info(hdev, "Telemetry exception format not supported"); 1428 return 0; 1429 } 1430 1431 skb = __hci_cmd_sync(hdev, 0xfc8b, 11, mask, HCI_INIT_TIMEOUT); 1432 if (IS_ERR(skb)) { 1433 bt_dev_err(hdev, "Setting Intel telemetry ddc write event mask failed (%ld)", 1434 PTR_ERR(skb)); 1435 return PTR_ERR(skb); 1436 } 1437 kfree_skb(skb); 1438 1439 skb = __hci_cmd_sync(hdev, 0xfc8b, 5, period, HCI_INIT_TIMEOUT); 1440 if (IS_ERR(skb)) { 1441 bt_dev_err(hdev, "Setting periodicity for link statistics traces failed (%ld)", 1442 PTR_ERR(skb)); 1443 return PTR_ERR(skb); 1444 } 1445 kfree_skb(skb); 1446 1447 skb = __hci_cmd_sync(hdev, 0xfca1, 1, &trace_enable, HCI_INIT_TIMEOUT); 1448 if (IS_ERR(skb)) { 1449 bt_dev_err(hdev, "Enable tracing of link statistics events failed (%ld)", 1450 PTR_ERR(skb)); 1451 return PTR_ERR(skb); 1452 } 1453 kfree_skb(skb); 1454 1455 bt_dev_info(hdev, "set debug features: trace_enable 0x%02x mask 0x%02x", 1456 trace_enable, mask[3]); 1457 1458 return 0; 1459 } 1460 1461 static int btintel_reset_debug_features(struct hci_dev *hdev, 1462 const struct intel_debug_features *features) 1463 { 1464 u8 mask[11] = { 0x0a, 0x92, 0x02, 0x00, 0x00, 0x00, 0x00, 0x00, 1465 0x00, 0x00, 0x00 }; 1466 u8 trace_enable = 0x00; 1467 struct sk_buff *skb; 1468 1469 if (!features) { 1470 bt_dev_warn(hdev, "Debug features not read"); 1471 return -EINVAL; 1472 } 1473 1474 if (!(features->page1[0] & 0x3f)) { 1475 bt_dev_info(hdev, "Telemetry exception format not supported"); 1476 return 0; 1477 } 1478 1479 /* Should stop the trace before writing ddc event mask. */ 1480 skb = __hci_cmd_sync(hdev, 0xfca1, 1, &trace_enable, HCI_INIT_TIMEOUT); 1481 if (IS_ERR(skb)) { 1482 bt_dev_err(hdev, "Stop tracing of link statistics events failed (%ld)", 1483 PTR_ERR(skb)); 1484 return PTR_ERR(skb); 1485 } 1486 kfree_skb(skb); 1487 1488 skb = __hci_cmd_sync(hdev, 0xfc8b, 11, mask, HCI_INIT_TIMEOUT); 1489 if (IS_ERR(skb)) { 1490 bt_dev_err(hdev, "Setting Intel telemetry ddc write event mask failed (%ld)", 1491 PTR_ERR(skb)); 1492 return PTR_ERR(skb); 1493 } 1494 kfree_skb(skb); 1495 1496 bt_dev_info(hdev, "reset debug features: trace_enable 0x%02x mask 0x%02x", 1497 trace_enable, mask[3]); 1498 1499 return 0; 1500 } 1501 1502 int btintel_set_quality_report(struct hci_dev *hdev, bool enable) 1503 { 1504 struct intel_debug_features features; 1505 int err; 1506 1507 bt_dev_dbg(hdev, "enable %d", enable); 1508 1509 /* Read the Intel supported features and if new exception formats 1510 * supported, need to load the additional DDC config to enable. 1511 */ 1512 err = btintel_read_debug_features(hdev, &features); 1513 if (err) 1514 return err; 1515 1516 /* Set or reset the debug features. */ 1517 if (enable) 1518 err = btintel_set_debug_features(hdev, &features); 1519 else 1520 err = btintel_reset_debug_features(hdev, &features); 1521 1522 return err; 1523 } 1524 EXPORT_SYMBOL_GPL(btintel_set_quality_report); 1525 1526 static void btintel_coredump(struct hci_dev *hdev) 1527 { 1528 struct sk_buff *skb; 1529 1530 skb = __hci_cmd_sync(hdev, 0xfc4e, 0, NULL, HCI_CMD_TIMEOUT); 1531 if (IS_ERR(skb)) { 1532 bt_dev_err(hdev, "Coredump failed (%ld)", PTR_ERR(skb)); 1533 return; 1534 } 1535 1536 kfree_skb(skb); 1537 } 1538 1539 static void btintel_dmp_hdr(struct hci_dev *hdev, struct sk_buff *skb) 1540 { 1541 char buf[80]; 1542 1543 snprintf(buf, sizeof(buf), "Controller Name: 0x%X\n", 1544 coredump_info.hw_variant); 1545 skb_put_data(skb, buf, strlen(buf)); 1546 1547 snprintf(buf, sizeof(buf), "Firmware Version: 0x%X\n", 1548 coredump_info.fw_build_num); 1549 skb_put_data(skb, buf, strlen(buf)); 1550 1551 snprintf(buf, sizeof(buf), "Driver: %s\n", coredump_info.driver_name); 1552 skb_put_data(skb, buf, strlen(buf)); 1553 1554 snprintf(buf, sizeof(buf), "Vendor: Intel\n"); 1555 skb_put_data(skb, buf, strlen(buf)); 1556 } 1557 1558 static int btintel_register_devcoredump_support(struct hci_dev *hdev) 1559 { 1560 struct intel_debug_features features; 1561 int err; 1562 1563 err = btintel_read_debug_features(hdev, &features); 1564 if (err) { 1565 bt_dev_info(hdev, "Error reading debug features"); 1566 return err; 1567 } 1568 1569 if (!(features.page1[0] & 0x3f)) { 1570 bt_dev_dbg(hdev, "Telemetry exception format not supported"); 1571 return -EOPNOTSUPP; 1572 } 1573 1574 hci_devcd_register(hdev, btintel_coredump, btintel_dmp_hdr, NULL); 1575 1576 return err; 1577 } 1578 1579 static const struct firmware *btintel_legacy_rom_get_fw(struct hci_dev *hdev, 1580 struct intel_version *ver) 1581 { 1582 const struct firmware *fw; 1583 char fwname[64]; 1584 int ret; 1585 1586 snprintf(fwname, sizeof(fwname), 1587 "intel/ibt-hw-%x.%x.%x-fw-%x.%x.%x.%x.%x.bseq", 1588 ver->hw_platform, ver->hw_variant, ver->hw_revision, 1589 ver->fw_variant, ver->fw_revision, ver->fw_build_num, 1590 ver->fw_build_ww, ver->fw_build_yy); 1591 1592 ret = request_firmware(&fw, fwname, &hdev->dev); 1593 if (ret < 0) { 1594 if (ret == -EINVAL) { 1595 bt_dev_err(hdev, "Intel firmware file request failed (%d)", 1596 ret); 1597 return NULL; 1598 } 1599 1600 bt_dev_err(hdev, "failed to open Intel firmware file: %s (%d)", 1601 fwname, ret); 1602 1603 /* If the correct firmware patch file is not found, use the 1604 * default firmware patch file instead 1605 */ 1606 snprintf(fwname, sizeof(fwname), "intel/ibt-hw-%x.%x.bseq", 1607 ver->hw_platform, ver->hw_variant); 1608 if (request_firmware(&fw, fwname, &hdev->dev) < 0) { 1609 bt_dev_err(hdev, "failed to open default fw file: %s", 1610 fwname); 1611 return NULL; 1612 } 1613 } 1614 1615 bt_dev_info(hdev, "Intel Bluetooth firmware file: %s", fwname); 1616 1617 return fw; 1618 } 1619 1620 static int btintel_legacy_rom_patching(struct hci_dev *hdev, 1621 const struct firmware *fw, 1622 const u8 **fw_ptr, int *disable_patch) 1623 { 1624 struct sk_buff *skb; 1625 struct hci_command_hdr *cmd; 1626 const u8 *cmd_param; 1627 struct hci_event_hdr *evt = NULL; 1628 const u8 *evt_param = NULL; 1629 int remain = fw->size - (*fw_ptr - fw->data); 1630 1631 /* The first byte indicates the types of the patch command or event. 1632 * 0x01 means HCI command and 0x02 is HCI event. If the first bytes 1633 * in the current firmware buffer doesn't start with 0x01 or 1634 * the size of remain buffer is smaller than HCI command header, 1635 * the firmware file is corrupted and it should stop the patching 1636 * process. 1637 */ 1638 if (remain > HCI_COMMAND_HDR_SIZE && *fw_ptr[0] != 0x01) { 1639 bt_dev_err(hdev, "Intel fw corrupted: invalid cmd read"); 1640 return -EINVAL; 1641 } 1642 (*fw_ptr)++; 1643 remain--; 1644 1645 cmd = (struct hci_command_hdr *)(*fw_ptr); 1646 *fw_ptr += sizeof(*cmd); 1647 remain -= sizeof(*cmd); 1648 1649 /* Ensure that the remain firmware data is long enough than the length 1650 * of command parameter. If not, the firmware file is corrupted. 1651 */ 1652 if (remain < cmd->plen) { 1653 bt_dev_err(hdev, "Intel fw corrupted: invalid cmd len"); 1654 return -EFAULT; 1655 } 1656 1657 /* If there is a command that loads a patch in the firmware 1658 * file, then enable the patch upon success, otherwise just 1659 * disable the manufacturer mode, for example patch activation 1660 * is not required when the default firmware patch file is used 1661 * because there are no patch data to load. 1662 */ 1663 if (*disable_patch && le16_to_cpu(cmd->opcode) == 0xfc8e) 1664 *disable_patch = 0; 1665 1666 cmd_param = *fw_ptr; 1667 *fw_ptr += cmd->plen; 1668 remain -= cmd->plen; 1669 1670 /* This reads the expected events when the above command is sent to the 1671 * device. Some vendor commands expects more than one events, for 1672 * example command status event followed by vendor specific event. 1673 * For this case, it only keeps the last expected event. so the command 1674 * can be sent with __hci_cmd_sync_ev() which returns the sk_buff of 1675 * last expected event. 1676 */ 1677 while (remain > HCI_EVENT_HDR_SIZE && *fw_ptr[0] == 0x02) { 1678 (*fw_ptr)++; 1679 remain--; 1680 1681 evt = (struct hci_event_hdr *)(*fw_ptr); 1682 *fw_ptr += sizeof(*evt); 1683 remain -= sizeof(*evt); 1684 1685 if (remain < evt->plen) { 1686 bt_dev_err(hdev, "Intel fw corrupted: invalid evt len"); 1687 return -EFAULT; 1688 } 1689 1690 evt_param = *fw_ptr; 1691 *fw_ptr += evt->plen; 1692 remain -= evt->plen; 1693 } 1694 1695 /* Every HCI commands in the firmware file has its correspond event. 1696 * If event is not found or remain is smaller than zero, the firmware 1697 * file is corrupted. 1698 */ 1699 if (!evt || !evt_param || remain < 0) { 1700 bt_dev_err(hdev, "Intel fw corrupted: invalid evt read"); 1701 return -EFAULT; 1702 } 1703 1704 skb = __hci_cmd_sync_ev(hdev, le16_to_cpu(cmd->opcode), cmd->plen, 1705 cmd_param, evt->evt, HCI_INIT_TIMEOUT); 1706 if (IS_ERR(skb)) { 1707 bt_dev_err(hdev, "sending Intel patch command (0x%4.4x) failed (%ld)", 1708 cmd->opcode, PTR_ERR(skb)); 1709 return PTR_ERR(skb); 1710 } 1711 1712 /* It ensures that the returned event matches the event data read from 1713 * the firmware file. At fist, it checks the length and then 1714 * the contents of the event. 1715 */ 1716 if (skb->len != evt->plen) { 1717 bt_dev_err(hdev, "mismatch event length (opcode 0x%4.4x)", 1718 le16_to_cpu(cmd->opcode)); 1719 kfree_skb(skb); 1720 return -EFAULT; 1721 } 1722 1723 if (memcmp(skb->data, evt_param, evt->plen)) { 1724 bt_dev_err(hdev, "mismatch event parameter (opcode 0x%4.4x)", 1725 le16_to_cpu(cmd->opcode)); 1726 kfree_skb(skb); 1727 return -EFAULT; 1728 } 1729 kfree_skb(skb); 1730 1731 return 0; 1732 } 1733 1734 static int btintel_legacy_rom_setup(struct hci_dev *hdev, 1735 struct intel_version *ver) 1736 { 1737 const struct firmware *fw; 1738 const u8 *fw_ptr; 1739 int disable_patch, err; 1740 struct intel_version new_ver; 1741 1742 BT_DBG("%s", hdev->name); 1743 1744 /* fw_patch_num indicates the version of patch the device currently 1745 * have. If there is no patch data in the device, it is always 0x00. 1746 * So, if it is other than 0x00, no need to patch the device again. 1747 */ 1748 if (ver->fw_patch_num) { 1749 bt_dev_info(hdev, 1750 "Intel device is already patched. patch num: %02x", 1751 ver->fw_patch_num); 1752 goto complete; 1753 } 1754 1755 /* Opens the firmware patch file based on the firmware version read 1756 * from the controller. If it fails to open the matching firmware 1757 * patch file, it tries to open the default firmware patch file. 1758 * If no patch file is found, allow the device to operate without 1759 * a patch. 1760 */ 1761 fw = btintel_legacy_rom_get_fw(hdev, ver); 1762 if (!fw) 1763 goto complete; 1764 fw_ptr = fw->data; 1765 1766 /* Enable the manufacturer mode of the controller. 1767 * Only while this mode is enabled, the driver can download the 1768 * firmware patch data and configuration parameters. 1769 */ 1770 err = btintel_enter_mfg(hdev); 1771 if (err) { 1772 release_firmware(fw); 1773 return err; 1774 } 1775 1776 disable_patch = 1; 1777 1778 /* The firmware data file consists of list of Intel specific HCI 1779 * commands and its expected events. The first byte indicates the 1780 * type of the message, either HCI command or HCI event. 1781 * 1782 * It reads the command and its expected event from the firmware file, 1783 * and send to the controller. Once __hci_cmd_sync_ev() returns, 1784 * the returned event is compared with the event read from the firmware 1785 * file and it will continue until all the messages are downloaded to 1786 * the controller. 1787 * 1788 * Once the firmware patching is completed successfully, 1789 * the manufacturer mode is disabled with reset and activating the 1790 * downloaded patch. 1791 * 1792 * If the firmware patching fails, the manufacturer mode is 1793 * disabled with reset and deactivating the patch. 1794 * 1795 * If the default patch file is used, no reset is done when disabling 1796 * the manufacturer. 1797 */ 1798 while (fw->size > fw_ptr - fw->data) { 1799 int ret; 1800 1801 ret = btintel_legacy_rom_patching(hdev, fw, &fw_ptr, 1802 &disable_patch); 1803 if (ret < 0) 1804 goto exit_mfg_deactivate; 1805 } 1806 1807 release_firmware(fw); 1808 1809 if (disable_patch) 1810 goto exit_mfg_disable; 1811 1812 /* Patching completed successfully and disable the manufacturer mode 1813 * with reset and activate the downloaded firmware patches. 1814 */ 1815 err = btintel_exit_mfg(hdev, true, true); 1816 if (err) 1817 return err; 1818 1819 /* Need build number for downloaded fw patches in 1820 * every power-on boot 1821 */ 1822 err = btintel_read_version(hdev, &new_ver); 1823 if (err) 1824 return err; 1825 1826 bt_dev_info(hdev, "Intel BT fw patch 0x%02x completed & activated", 1827 new_ver.fw_patch_num); 1828 1829 goto complete; 1830 1831 exit_mfg_disable: 1832 /* Disable the manufacturer mode without reset */ 1833 err = btintel_exit_mfg(hdev, false, false); 1834 if (err) 1835 return err; 1836 1837 bt_dev_info(hdev, "Intel firmware patch completed"); 1838 1839 goto complete; 1840 1841 exit_mfg_deactivate: 1842 release_firmware(fw); 1843 1844 /* Patching failed. Disable the manufacturer mode with reset and 1845 * deactivate the downloaded firmware patches. 1846 */ 1847 err = btintel_exit_mfg(hdev, true, false); 1848 if (err) 1849 return err; 1850 1851 bt_dev_info(hdev, "Intel firmware patch completed and deactivated"); 1852 1853 complete: 1854 /* Set the event mask for Intel specific vendor events. This enables 1855 * a few extra events that are useful during general operation. 1856 */ 1857 btintel_set_event_mask_mfg(hdev, false); 1858 1859 btintel_check_bdaddr(hdev); 1860 1861 return 0; 1862 } 1863 1864 static int btintel_download_wait(struct hci_dev *hdev, ktime_t calltime, int msec) 1865 { 1866 ktime_t delta, rettime; 1867 unsigned long long duration; 1868 int err; 1869 1870 btintel_set_flag(hdev, INTEL_FIRMWARE_LOADED); 1871 1872 bt_dev_info(hdev, "Waiting for firmware download to complete"); 1873 1874 err = btintel_wait_on_flag_timeout(hdev, INTEL_DOWNLOADING, 1875 TASK_INTERRUPTIBLE, 1876 msecs_to_jiffies(msec)); 1877 if (err == -EINTR) { 1878 bt_dev_err(hdev, "Firmware loading interrupted"); 1879 return err; 1880 } 1881 1882 if (err) { 1883 bt_dev_err(hdev, "Firmware loading timeout"); 1884 return -ETIMEDOUT; 1885 } 1886 1887 if (btintel_test_flag(hdev, INTEL_FIRMWARE_FAILED)) { 1888 bt_dev_err(hdev, "Firmware loading failed"); 1889 return -ENOEXEC; 1890 } 1891 1892 rettime = ktime_get(); 1893 delta = ktime_sub(rettime, calltime); 1894 duration = (unsigned long long)ktime_to_ns(delta) >> 10; 1895 1896 bt_dev_info(hdev, "Firmware loaded in %llu usecs", duration); 1897 1898 return 0; 1899 } 1900 1901 static int btintel_boot_wait(struct hci_dev *hdev, ktime_t calltime, int msec) 1902 { 1903 ktime_t delta, rettime; 1904 unsigned long long duration; 1905 int err; 1906 1907 bt_dev_info(hdev, "Waiting for device to boot"); 1908 1909 err = btintel_wait_on_flag_timeout(hdev, INTEL_BOOTING, 1910 TASK_INTERRUPTIBLE, 1911 msecs_to_jiffies(msec)); 1912 if (err == -EINTR) { 1913 bt_dev_err(hdev, "Device boot interrupted"); 1914 return -EINTR; 1915 } 1916 1917 if (err) { 1918 bt_dev_err(hdev, "Device boot timeout"); 1919 return -ETIMEDOUT; 1920 } 1921 1922 rettime = ktime_get(); 1923 delta = ktime_sub(rettime, calltime); 1924 duration = (unsigned long long) ktime_to_ns(delta) >> 10; 1925 1926 bt_dev_info(hdev, "Device booted in %llu usecs", duration); 1927 1928 return 0; 1929 } 1930 1931 static int btintel_boot_wait_d0(struct hci_dev *hdev, ktime_t calltime, 1932 int msec) 1933 { 1934 ktime_t delta, rettime; 1935 unsigned long long duration; 1936 int err; 1937 1938 bt_dev_info(hdev, "Waiting for device transition to d0"); 1939 1940 err = btintel_wait_on_flag_timeout(hdev, INTEL_WAIT_FOR_D0, 1941 TASK_INTERRUPTIBLE, 1942 msecs_to_jiffies(msec)); 1943 if (err == -EINTR) { 1944 bt_dev_err(hdev, "Device d0 move interrupted"); 1945 return -EINTR; 1946 } 1947 1948 if (err) { 1949 bt_dev_err(hdev, "Device d0 move timeout"); 1950 return -ETIMEDOUT; 1951 } 1952 1953 rettime = ktime_get(); 1954 delta = ktime_sub(rettime, calltime); 1955 duration = (unsigned long long)ktime_to_ns(delta) >> 10; 1956 1957 bt_dev_info(hdev, "Device moved to D0 in %llu usecs", duration); 1958 1959 return 0; 1960 } 1961 1962 static int btintel_boot(struct hci_dev *hdev, u32 boot_addr) 1963 { 1964 ktime_t calltime; 1965 int err; 1966 1967 calltime = ktime_get(); 1968 1969 btintel_set_flag(hdev, INTEL_BOOTING); 1970 btintel_set_flag(hdev, INTEL_WAIT_FOR_D0); 1971 1972 err = btintel_send_intel_reset(hdev, boot_addr); 1973 if (err) { 1974 bt_dev_err(hdev, "Intel Soft Reset failed (%d)", err); 1975 btintel_reset_to_bootloader(hdev); 1976 return err; 1977 } 1978 1979 /* The bootloader will not indicate when the device is ready. This 1980 * is done by the operational firmware sending bootup notification. 1981 * 1982 * Booting into operational firmware should not take longer than 1983 * 5 second. However if that happens, then just fail the setup 1984 * since something went wrong. 1985 */ 1986 err = btintel_boot_wait(hdev, calltime, 5000); 1987 if (err == -ETIMEDOUT) { 1988 btintel_reset_to_bootloader(hdev); 1989 goto exit_error; 1990 } 1991 1992 if (hdev->bus == HCI_PCI) { 1993 /* In case of PCIe, after receiving bootup event, driver performs 1994 * D0 entry by writing 0 to sleep control register (check 1995 * btintel_pcie_recv_event()) 1996 * Firmware acks with alive interrupt indicating host is full ready to 1997 * perform BT operation. Lets wait here till INTEL_WAIT_FOR_D0 1998 * bit is cleared. 1999 */ 2000 calltime = ktime_get(); 2001 err = btintel_boot_wait_d0(hdev, calltime, 2000); 2002 } 2003 2004 exit_error: 2005 return err; 2006 } 2007 2008 static int btintel_get_fw_name(struct intel_version *ver, 2009 struct intel_boot_params *params, 2010 char *fw_name, size_t len, 2011 const char *suffix) 2012 { 2013 switch (ver->hw_variant) { 2014 case 0x0b: /* SfP */ 2015 case 0x0c: /* WsP */ 2016 snprintf(fw_name, len, "intel/ibt-%u-%u.%s", 2017 ver->hw_variant, 2018 le16_to_cpu(params->dev_revid), 2019 suffix); 2020 break; 2021 case 0x11: /* JfP */ 2022 case 0x12: /* ThP */ 2023 case 0x13: /* HrP */ 2024 case 0x14: /* CcP */ 2025 snprintf(fw_name, len, "intel/ibt-%u-%u-%u.%s", 2026 ver->hw_variant, 2027 ver->hw_revision, 2028 ver->fw_revision, 2029 suffix); 2030 break; 2031 default: 2032 return -EINVAL; 2033 } 2034 2035 return 0; 2036 } 2037 2038 static int btintel_download_fw(struct hci_dev *hdev, 2039 struct intel_version *ver, 2040 struct intel_boot_params *params, 2041 u32 *boot_param) 2042 { 2043 const struct firmware *fw; 2044 char fwname[64]; 2045 int err; 2046 ktime_t calltime; 2047 2048 if (!ver || !params) 2049 return -EINVAL; 2050 2051 /* The firmware variant determines if the device is in bootloader 2052 * mode or is running operational firmware. The value 0x06 identifies 2053 * the bootloader and the value 0x23 identifies the operational 2054 * firmware. 2055 * 2056 * When the operational firmware is already present, then only 2057 * the check for valid Bluetooth device address is needed. This 2058 * determines if the device will be added as configured or 2059 * unconfigured controller. 2060 * 2061 * It is not possible to use the Secure Boot Parameters in this 2062 * case since that command is only available in bootloader mode. 2063 */ 2064 if (ver->fw_variant == 0x23) { 2065 btintel_clear_flag(hdev, INTEL_BOOTLOADER); 2066 btintel_check_bdaddr(hdev); 2067 2068 /* SfP and WsP don't seem to update the firmware version on file 2069 * so version checking is currently possible. 2070 */ 2071 switch (ver->hw_variant) { 2072 case 0x0b: /* SfP */ 2073 case 0x0c: /* WsP */ 2074 return 0; 2075 } 2076 2077 /* Proceed to download to check if the version matches */ 2078 goto download; 2079 } 2080 2081 /* Read the secure boot parameters to identify the operating 2082 * details of the bootloader. 2083 */ 2084 err = btintel_read_boot_params(hdev, params); 2085 if (err) 2086 return err; 2087 2088 /* It is required that every single firmware fragment is acknowledged 2089 * with a command complete event. If the boot parameters indicate 2090 * that this bootloader does not send them, then abort the setup. 2091 */ 2092 if (params->limited_cce != 0x00) { 2093 bt_dev_err(hdev, "Unsupported Intel firmware loading method (%u)", 2094 params->limited_cce); 2095 return -EINVAL; 2096 } 2097 2098 /* If the OTP has no valid Bluetooth device address, then there will 2099 * also be no valid address for the operational firmware. 2100 */ 2101 if (!bacmp(¶ms->otp_bdaddr, BDADDR_ANY)) { 2102 bt_dev_info(hdev, "No device address configured"); 2103 hci_set_quirk(hdev, HCI_QUIRK_INVALID_BDADDR); 2104 } 2105 2106 download: 2107 /* With this Intel bootloader only the hardware variant and device 2108 * revision information are used to select the right firmware for SfP 2109 * and WsP. 2110 * 2111 * The firmware filename is ibt-<hw_variant>-<dev_revid>.sfi. 2112 * 2113 * Currently the supported hardware variants are: 2114 * 11 (0x0b) for iBT3.0 (LnP/SfP) 2115 * 12 (0x0c) for iBT3.5 (WsP) 2116 * 2117 * For ThP/JfP and for future SKU's, the FW name varies based on HW 2118 * variant, HW revision and FW revision, as these are dependent on CNVi 2119 * and RF Combination. 2120 * 2121 * 17 (0x11) for iBT3.5 (JfP) 2122 * 18 (0x12) for iBT3.5 (ThP) 2123 * 2124 * The firmware file name for these will be 2125 * ibt-<hw_variant>-<hw_revision>-<fw_revision>.sfi. 2126 * 2127 */ 2128 err = btintel_get_fw_name(ver, params, fwname, sizeof(fwname), "sfi"); 2129 if (err < 0) { 2130 if (!btintel_test_flag(hdev, INTEL_BOOTLOADER)) { 2131 /* Firmware has already been loaded */ 2132 btintel_set_flag(hdev, INTEL_FIRMWARE_LOADED); 2133 return 0; 2134 } 2135 2136 bt_dev_err(hdev, "Unsupported Intel firmware naming"); 2137 return -EINVAL; 2138 } 2139 2140 err = firmware_request_nowarn(&fw, fwname, &hdev->dev); 2141 if (err < 0) { 2142 if (!btintel_test_flag(hdev, INTEL_BOOTLOADER)) { 2143 /* Firmware has already been loaded */ 2144 btintel_set_flag(hdev, INTEL_FIRMWARE_LOADED); 2145 return 0; 2146 } 2147 2148 bt_dev_err(hdev, "Failed to load Intel firmware file %s (%d)", 2149 fwname, err); 2150 return err; 2151 } 2152 2153 bt_dev_info(hdev, "Found device firmware: %s", fwname); 2154 2155 if (fw->size < 644) { 2156 bt_dev_err(hdev, "Invalid size of firmware file (%zu)", 2157 fw->size); 2158 err = -EBADF; 2159 goto done; 2160 } 2161 2162 calltime = ktime_get(); 2163 2164 btintel_set_flag(hdev, INTEL_DOWNLOADING); 2165 2166 /* Start firmware downloading and get boot parameter */ 2167 err = btintel_download_firmware(hdev, ver, fw, boot_param); 2168 if (err < 0) { 2169 if (err == -EALREADY) { 2170 /* Firmware has already been loaded */ 2171 btintel_set_flag(hdev, INTEL_FIRMWARE_LOADED); 2172 err = 0; 2173 goto done; 2174 } 2175 2176 /* When FW download fails, send Intel Reset to retry 2177 * FW download. 2178 */ 2179 btintel_reset_to_bootloader(hdev); 2180 goto done; 2181 } 2182 2183 /* Before switching the device into operational mode and with that 2184 * booting the loaded firmware, wait for the bootloader notification 2185 * that all fragments have been successfully received. 2186 * 2187 * When the event processing receives the notification, then the 2188 * INTEL_DOWNLOADING flag will be cleared. 2189 * 2190 * The firmware loading should not take longer than 5 seconds 2191 * and thus just timeout if that happens and fail the setup 2192 * of this device. 2193 */ 2194 err = btintel_download_wait(hdev, calltime, 5000); 2195 if (err == -ETIMEDOUT) 2196 btintel_reset_to_bootloader(hdev); 2197 2198 done: 2199 release_firmware(fw); 2200 return err; 2201 } 2202 2203 static int btintel_bootloader_setup(struct hci_dev *hdev, 2204 struct intel_version *ver) 2205 { 2206 struct intel_version new_ver; 2207 struct intel_boot_params params; 2208 u32 boot_param; 2209 char ddcname[64]; 2210 int err; 2211 2212 BT_DBG("%s", hdev->name); 2213 2214 /* Set the default boot parameter to 0x0 and it is updated to 2215 * SKU specific boot parameter after reading Intel_Write_Boot_Params 2216 * command while downloading the firmware. 2217 */ 2218 boot_param = 0x00000000; 2219 2220 btintel_set_flag(hdev, INTEL_BOOTLOADER); 2221 2222 err = btintel_download_fw(hdev, ver, ¶ms, &boot_param); 2223 if (err) 2224 return err; 2225 2226 /* controller is already having an operational firmware */ 2227 if (ver->fw_variant == 0x23) 2228 goto finish; 2229 2230 err = btintel_boot(hdev, boot_param); 2231 if (err) 2232 return err; 2233 2234 btintel_clear_flag(hdev, INTEL_BOOTLOADER); 2235 2236 err = btintel_get_fw_name(ver, ¶ms, ddcname, 2237 sizeof(ddcname), "ddc"); 2238 2239 if (err < 0) { 2240 bt_dev_err(hdev, "Unsupported Intel firmware naming"); 2241 } else { 2242 /* Once the device is running in operational mode, it needs to 2243 * apply the device configuration (DDC) parameters. 2244 * 2245 * The device can work without DDC parameters, so even if it 2246 * fails to load the file, no need to fail the setup. 2247 */ 2248 btintel_load_ddc_config(hdev, ddcname); 2249 } 2250 2251 hci_dev_clear_flag(hdev, HCI_QUALITY_REPORT); 2252 2253 /* Read the Intel version information after loading the FW */ 2254 err = btintel_read_version(hdev, &new_ver); 2255 if (err) 2256 return err; 2257 2258 btintel_version_info(hdev, &new_ver); 2259 2260 finish: 2261 /* Set the event mask for Intel specific vendor events. This enables 2262 * a few extra events that are useful during general operation. It 2263 * does not enable any debugging related events. 2264 * 2265 * The device will function correctly without these events enabled 2266 * and thus no need to fail the setup. 2267 */ 2268 btintel_set_event_mask(hdev, false); 2269 2270 return 0; 2271 } 2272 2273 static void btintel_get_fw_name_tlv(const struct intel_version_tlv *ver, 2274 char *fw_name, size_t len, 2275 const char *suffix) 2276 { 2277 const char *format; 2278 u32 cnvi, cnvr; 2279 2280 cnvi = INTEL_CNVX_TOP_PACK_SWAB(INTEL_CNVX_TOP_TYPE(ver->cnvi_top), 2281 INTEL_CNVX_TOP_STEP(ver->cnvi_top)); 2282 2283 cnvr = INTEL_CNVX_TOP_PACK_SWAB(INTEL_CNVX_TOP_TYPE(ver->cnvr_top), 2284 INTEL_CNVX_TOP_STEP(ver->cnvr_top)); 2285 2286 /* Only Blazar product supports downloading of intermediate loader 2287 * image 2288 */ 2289 if (INTEL_HW_VARIANT(ver->cnvi_bt) >= 0x1e) { 2290 u8 zero[BTINTEL_FWID_MAXLEN]; 2291 2292 if (ver->img_type == BTINTEL_IMG_BOOTLOADER) { 2293 format = "intel/ibt-%04x-%04x-iml.%s"; 2294 snprintf(fw_name, len, format, cnvi, cnvr, suffix); 2295 return; 2296 } 2297 2298 memset(zero, 0, sizeof(zero)); 2299 2300 /* ibt-<cnvi_top type+cnvi_top step>-<cnvr_top type+cnvr_top step-fw_id> */ 2301 if (memcmp(ver->fw_id, zero, sizeof(zero))) { 2302 format = "intel/ibt-%04x-%04x-%s.%s"; 2303 snprintf(fw_name, len, format, cnvi, cnvr, 2304 ver->fw_id, suffix); 2305 return; 2306 } 2307 /* If firmware id is not present, fallback to legacy naming 2308 * convention 2309 */ 2310 } 2311 /* Fallback to legacy naming convention for other controllers 2312 * ibt-<cnvi_top type+cnvi_top step>-<cnvr_top type+cnvr_top step> 2313 */ 2314 format = "intel/ibt-%04x-%04x.%s"; 2315 snprintf(fw_name, len, format, cnvi, cnvr, suffix); 2316 } 2317 2318 static void btintel_get_iml_tlv(const struct intel_version_tlv *ver, 2319 char *fw_name, size_t len, 2320 const char *suffix) 2321 { 2322 const char *format; 2323 u32 cnvi, cnvr; 2324 2325 cnvi = INTEL_CNVX_TOP_PACK_SWAB(INTEL_CNVX_TOP_TYPE(ver->cnvi_top), 2326 INTEL_CNVX_TOP_STEP(ver->cnvi_top)); 2327 2328 cnvr = INTEL_CNVX_TOP_PACK_SWAB(INTEL_CNVX_TOP_TYPE(ver->cnvr_top), 2329 INTEL_CNVX_TOP_STEP(ver->cnvr_top)); 2330 2331 format = "intel/ibt-%04x-%04x-iml.%s"; 2332 snprintf(fw_name, len, format, cnvi, cnvr, suffix); 2333 } 2334 2335 static int btintel_prepare_fw_download_tlv(struct hci_dev *hdev, 2336 struct intel_version_tlv *ver, 2337 u32 *boot_param) 2338 { 2339 const struct firmware *fw; 2340 char fwname[128]; 2341 int err; 2342 ktime_t calltime; 2343 2344 if (!ver || !boot_param) 2345 return -EINVAL; 2346 2347 /* The firmware variant determines if the device is in bootloader 2348 * mode or is running operational firmware. The value 0x03 identifies 2349 * the bootloader and the value 0x23 identifies the operational 2350 * firmware. 2351 * 2352 * When the operational firmware is already present, then only 2353 * the check for valid Bluetooth device address is needed. This 2354 * determines if the device will be added as configured or 2355 * unconfigured controller. 2356 * 2357 * It is not possible to use the Secure Boot Parameters in this 2358 * case since that command is only available in bootloader mode. 2359 */ 2360 if (ver->img_type == BTINTEL_IMG_OP) { 2361 btintel_clear_flag(hdev, INTEL_BOOTLOADER); 2362 btintel_check_bdaddr(hdev); 2363 } else { 2364 /* 2365 * Check for valid bd address in boot loader mode. Device 2366 * will be marked as unconfigured if empty bd address is 2367 * found. 2368 */ 2369 if (!bacmp(&ver->otp_bd_addr, BDADDR_ANY)) { 2370 bt_dev_info(hdev, "No device address configured"); 2371 hci_set_quirk(hdev, HCI_QUIRK_INVALID_BDADDR); 2372 } 2373 } 2374 2375 if (ver->img_type == BTINTEL_IMG_OP) { 2376 /* Controller running OP image. In case of FW downgrade, 2377 * FWID TLV may not be present and driver may attempt to load 2378 * firmware image which doesn't exist. Lets compare the version 2379 * of IML image 2380 */ 2381 if (INTEL_HW_VARIANT(ver->cnvi_bt) >= 0x1e) 2382 btintel_get_iml_tlv(ver, fwname, sizeof(fwname), "sfi"); 2383 else 2384 btintel_get_fw_name_tlv(ver, fwname, sizeof(fwname), "sfi"); 2385 } else { 2386 btintel_get_fw_name_tlv(ver, fwname, sizeof(fwname), "sfi"); 2387 } 2388 2389 err = firmware_request_nowarn(&fw, fwname, &hdev->dev); 2390 if (err < 0) { 2391 if (!btintel_test_flag(hdev, INTEL_BOOTLOADER)) { 2392 /* Firmware has already been loaded */ 2393 btintel_set_flag(hdev, INTEL_FIRMWARE_LOADED); 2394 return 0; 2395 } 2396 2397 bt_dev_err(hdev, "Failed to load Intel firmware file %s (%d)", 2398 fwname, err); 2399 2400 return err; 2401 } 2402 2403 bt_dev_info(hdev, "Found device firmware: %s", fwname); 2404 2405 if (fw->size < 644) { 2406 bt_dev_err(hdev, "Invalid size of firmware file (%zu)", 2407 fw->size); 2408 err = -EBADF; 2409 goto done; 2410 } 2411 2412 calltime = ktime_get(); 2413 2414 btintel_set_flag(hdev, INTEL_DOWNLOADING); 2415 2416 /* Start firmware downloading and get boot parameter */ 2417 err = btintel_download_fw_tlv(hdev, ver, fw, boot_param, 2418 INTEL_HW_VARIANT(ver->cnvi_bt), 2419 ver->sbe_type); 2420 if (err < 0) { 2421 if (err == -EALREADY) { 2422 /* Firmware has already been loaded */ 2423 btintel_set_flag(hdev, INTEL_FIRMWARE_LOADED); 2424 err = 0; 2425 goto done; 2426 } 2427 2428 /* When FW download fails, send Intel Reset to retry 2429 * FW download. 2430 */ 2431 btintel_reset_to_bootloader(hdev); 2432 goto done; 2433 } 2434 2435 /* Before switching the device into operational mode and with that 2436 * booting the loaded firmware, wait for the bootloader notification 2437 * that all fragments have been successfully received. 2438 * 2439 * When the event processing receives the notification, then the 2440 * BTUSB_DOWNLOADING flag will be cleared. 2441 * 2442 * The firmware loading should not take longer than 5 seconds 2443 * and thus just timeout if that happens and fail the setup 2444 * of this device. 2445 */ 2446 err = btintel_download_wait(hdev, calltime, 5000); 2447 if (err == -ETIMEDOUT) 2448 btintel_reset_to_bootloader(hdev); 2449 2450 done: 2451 release_firmware(fw); 2452 return err; 2453 } 2454 2455 static int btintel_get_codec_config_data(struct hci_dev *hdev, 2456 __u8 link, struct bt_codec *codec, 2457 __u8 *ven_len, __u8 **ven_data) 2458 { 2459 int err = 0; 2460 2461 if (!ven_data || !ven_len) 2462 return -EINVAL; 2463 2464 *ven_len = 0; 2465 *ven_data = NULL; 2466 2467 if (link != ESCO_LINK) { 2468 bt_dev_err(hdev, "Invalid link type(%u)", link); 2469 return -EINVAL; 2470 } 2471 2472 *ven_data = kmalloc(sizeof(__u8), GFP_KERNEL); 2473 if (!*ven_data) { 2474 err = -ENOMEM; 2475 goto error; 2476 } 2477 2478 /* supports only CVSD and mSBC offload codecs */ 2479 switch (codec->id) { 2480 case 0x02: 2481 **ven_data = 0x00; 2482 break; 2483 case 0x05: 2484 **ven_data = 0x01; 2485 break; 2486 default: 2487 err = -EINVAL; 2488 bt_dev_err(hdev, "Invalid codec id(%u)", codec->id); 2489 goto error; 2490 } 2491 /* codec and its capabilities are pre-defined to ids 2492 * preset id = 0x00 represents CVSD codec with sampling rate 8K 2493 * preset id = 0x01 represents mSBC codec with sampling rate 16K 2494 */ 2495 *ven_len = sizeof(__u8); 2496 return err; 2497 2498 error: 2499 kfree(*ven_data); 2500 *ven_data = NULL; 2501 return err; 2502 } 2503 2504 static int btintel_get_data_path_id(struct hci_dev *hdev, __u8 *data_path_id) 2505 { 2506 /* Intel uses 1 as data path id for all the usecases */ 2507 *data_path_id = 1; 2508 return 0; 2509 } 2510 2511 static int btintel_configure_offload(struct hci_dev *hdev) 2512 { 2513 struct sk_buff *skb; 2514 int err = 0; 2515 struct intel_offload_use_cases *use_cases; 2516 2517 skb = __hci_cmd_sync(hdev, 0xfc86, 0, NULL, HCI_INIT_TIMEOUT); 2518 if (IS_ERR(skb)) { 2519 bt_dev_err(hdev, "Reading offload use cases failed (%ld)", 2520 PTR_ERR(skb)); 2521 return PTR_ERR(skb); 2522 } 2523 2524 if (skb->len < sizeof(*use_cases)) { 2525 err = -EIO; 2526 goto error; 2527 } 2528 2529 use_cases = (void *)skb->data; 2530 2531 if (use_cases->status) { 2532 err = -bt_to_errno(skb->data[0]); 2533 goto error; 2534 } 2535 2536 if (use_cases->preset[0] & 0x03) { 2537 hdev->get_data_path_id = btintel_get_data_path_id; 2538 hdev->get_codec_config_data = btintel_get_codec_config_data; 2539 } 2540 error: 2541 kfree_skb(skb); 2542 return err; 2543 } 2544 2545 static void btintel_set_ppag(struct hci_dev *hdev, struct intel_version_tlv *ver) 2546 { 2547 struct sk_buff *skb; 2548 struct hci_ppag_enable_cmd ppag_cmd; 2549 acpi_handle handle; 2550 struct acpi_buffer buffer = {ACPI_ALLOCATE_BUFFER, NULL}; 2551 union acpi_object *p, *elements; 2552 u32 domain, mode; 2553 acpi_status status; 2554 2555 /* PPAG is not supported if CRF is HrP2, Jfp2, JfP1 */ 2556 switch (ver->cnvr_top & 0xFFF) { 2557 case 0x504: /* Hrp2 */ 2558 case 0x202: /* Jfp2 */ 2559 case 0x201: /* Jfp1 */ 2560 bt_dev_dbg(hdev, "PPAG not supported for Intel CNVr (0x%3x)", 2561 ver->cnvr_top & 0xFFF); 2562 return; 2563 } 2564 2565 handle = ACPI_HANDLE(GET_HCIDEV_DEV(hdev)); 2566 if (!handle) { 2567 bt_dev_info(hdev, "No support for BT device in ACPI firmware"); 2568 return; 2569 } 2570 2571 status = acpi_evaluate_object(handle, "PPAG", NULL, &buffer); 2572 if (ACPI_FAILURE(status)) { 2573 if (status == AE_NOT_FOUND) { 2574 bt_dev_dbg(hdev, "PPAG-BT: ACPI entry not found"); 2575 return; 2576 } 2577 bt_dev_warn(hdev, "PPAG-BT: ACPI Failure: %s", acpi_format_exception(status)); 2578 return; 2579 } 2580 2581 p = buffer.pointer; 2582 if (p->type != ACPI_TYPE_PACKAGE || p->package.count != 2) { 2583 bt_dev_warn(hdev, "PPAG-BT: Invalid object type: %d or package count: %d", 2584 p->type, p->package.count); 2585 kfree(buffer.pointer); 2586 return; 2587 } 2588 2589 elements = p->package.elements; 2590 2591 /* PPAG table is located at element[1] */ 2592 p = &elements[1]; 2593 2594 domain = (u32)p->package.elements[0].integer.value; 2595 mode = (u32)p->package.elements[1].integer.value; 2596 kfree(buffer.pointer); 2597 2598 if (domain != 0x12) { 2599 bt_dev_dbg(hdev, "PPAG-BT: Bluetooth domain is disabled in ACPI firmware"); 2600 return; 2601 } 2602 2603 /* PPAG mode 2604 * BIT 0 : 0 Disabled in EU 2605 * 1 Enabled in EU 2606 * BIT 1 : 0 Disabled in China 2607 * 1 Enabled in China 2608 */ 2609 mode &= 0x03; 2610 2611 if (!mode) { 2612 bt_dev_dbg(hdev, "PPAG-BT: EU, China mode are disabled in BIOS"); 2613 return; 2614 } 2615 2616 ppag_cmd.ppag_enable_flags = cpu_to_le32(mode); 2617 2618 skb = __hci_cmd_sync(hdev, INTEL_OP_PPAG_CMD, sizeof(ppag_cmd), 2619 &ppag_cmd, HCI_CMD_TIMEOUT); 2620 if (IS_ERR(skb)) { 2621 bt_dev_warn(hdev, "Failed to send PPAG Enable (%ld)", PTR_ERR(skb)); 2622 return; 2623 } 2624 bt_dev_info(hdev, "PPAG-BT: Enabled (Mode %d)", mode); 2625 kfree_skb(skb); 2626 } 2627 2628 int btintel_acpi_reset_method(struct hci_dev *hdev) 2629 { 2630 int ret = 0; 2631 acpi_status status; 2632 union acpi_object *p, *ref; 2633 struct acpi_buffer buffer = { ACPI_ALLOCATE_BUFFER, NULL }; 2634 2635 status = acpi_evaluate_object(ACPI_HANDLE(GET_HCIDEV_DEV(hdev)), "_PRR", NULL, &buffer); 2636 if (ACPI_FAILURE(status) || !buffer.pointer) { 2637 bt_dev_err(hdev, "Failed to run _PRR method"); 2638 ret = -ENODEV; 2639 return ret; 2640 } 2641 p = buffer.pointer; 2642 2643 if (p->type != ACPI_TYPE_PACKAGE || p->package.count != 1) { 2644 bt_dev_err(hdev, "Invalid arguments"); 2645 ret = -EINVAL; 2646 goto exit_on_error; 2647 } 2648 2649 ref = &p->package.elements[0]; 2650 if (ref->type != ACPI_TYPE_LOCAL_REFERENCE) { 2651 bt_dev_err(hdev, "Invalid object type: 0x%x", ref->type); 2652 ret = -EINVAL; 2653 goto exit_on_error; 2654 } 2655 2656 status = acpi_evaluate_object(ref->reference.handle, "_RST", NULL, NULL); 2657 if (ACPI_FAILURE(status)) { 2658 bt_dev_err(hdev, "Failed to run_RST method"); 2659 ret = -ENODEV; 2660 goto exit_on_error; 2661 } 2662 2663 exit_on_error: 2664 kfree(buffer.pointer); 2665 return ret; 2666 } 2667 EXPORT_SYMBOL_GPL(btintel_acpi_reset_method); 2668 2669 static void btintel_set_dsm_reset_method(struct hci_dev *hdev, 2670 struct intel_version_tlv *ver_tlv) 2671 { 2672 struct btintel_data *data = hci_get_priv(hdev); 2673 acpi_handle handle = ACPI_HANDLE(GET_HCIDEV_DEV(hdev)); 2674 u8 reset_payload[4] = {0x01, 0x00, 0x01, 0x00}; 2675 union acpi_object *obj, argv4; 2676 enum { 2677 RESET_TYPE_WDISABLE2, 2678 RESET_TYPE_VSEC 2679 }; 2680 2681 handle = ACPI_HANDLE(GET_HCIDEV_DEV(hdev)); 2682 2683 if (!handle) { 2684 bt_dev_dbg(hdev, "No support for bluetooth device in ACPI firmware"); 2685 return; 2686 } 2687 2688 if (!acpi_has_method(handle, "_PRR")) { 2689 bt_dev_err(hdev, "No support for _PRR ACPI method"); 2690 return; 2691 } 2692 2693 switch (ver_tlv->cnvi_top & 0xfff) { 2694 case 0x910: /* GalePeak2 */ 2695 reset_payload[2] = RESET_TYPE_VSEC; 2696 break; 2697 default: 2698 /* WDISABLE2 is the default reset method */ 2699 reset_payload[2] = RESET_TYPE_WDISABLE2; 2700 2701 if (!acpi_check_dsm(handle, &btintel_guid_dsm, 0, 2702 BIT(DSM_SET_WDISABLE2_DELAY))) { 2703 bt_dev_err(hdev, "No dsm support to set reset delay"); 2704 return; 2705 } 2706 argv4.integer.type = ACPI_TYPE_INTEGER; 2707 /* delay required to toggle BT power */ 2708 argv4.integer.value = 160; 2709 obj = acpi_evaluate_dsm(handle, &btintel_guid_dsm, 0, 2710 DSM_SET_WDISABLE2_DELAY, &argv4); 2711 if (!obj) { 2712 bt_dev_err(hdev, "Failed to call dsm to set reset delay"); 2713 return; 2714 } 2715 ACPI_FREE(obj); 2716 } 2717 2718 bt_dev_info(hdev, "DSM reset method type: 0x%02x", reset_payload[2]); 2719 2720 if (!acpi_check_dsm(handle, &btintel_guid_dsm, 0, 2721 DSM_SET_RESET_METHOD)) { 2722 bt_dev_warn(hdev, "No support for dsm to set reset method"); 2723 return; 2724 } 2725 argv4.buffer.type = ACPI_TYPE_BUFFER; 2726 argv4.buffer.length = sizeof(reset_payload); 2727 argv4.buffer.pointer = reset_payload; 2728 2729 obj = acpi_evaluate_dsm(handle, &btintel_guid_dsm, 0, 2730 DSM_SET_RESET_METHOD, &argv4); 2731 if (!obj) { 2732 bt_dev_err(hdev, "Failed to call dsm to set reset method"); 2733 return; 2734 } 2735 ACPI_FREE(obj); 2736 data->acpi_reset_method = btintel_acpi_reset_method; 2737 } 2738 2739 #define BTINTEL_ISODATA_HANDLE_BASE 0x900 2740 2741 static u8 btintel_classify_pkt_type(struct hci_dev *hdev, struct sk_buff *skb) 2742 { 2743 /* 2744 * Distinguish ISO data packets form ACL data packets 2745 * based on their connection handle value range. 2746 */ 2747 if (iso_capable(hdev) && hci_skb_pkt_type(skb) == HCI_ACLDATA_PKT) { 2748 __u16 handle = __le16_to_cpu(hci_acl_hdr(skb)->handle); 2749 2750 if (hci_handle(handle) >= BTINTEL_ISODATA_HANDLE_BASE) 2751 return HCI_ISODATA_PKT; 2752 } 2753 2754 return hci_skb_pkt_type(skb); 2755 } 2756 2757 /* 2758 * UefiCnvCommonDSBR UEFI variable provides information from the OEM platforms 2759 * if they have replaced the BRI (Bluetooth Radio Interface) resistor to 2760 * overcome the potential STEP errors on their designs. Based on the 2761 * configauration, bluetooth firmware shall adjust the BRI response line drive 2762 * strength. The below structure represents DSBR data. 2763 * struct { 2764 * u8 header; 2765 * u32 dsbr; 2766 * } __packed; 2767 * 2768 * header - defines revision number of the structure 2769 * dsbr - defines drive strength BRI response 2770 * bit0 2771 * 0 - instructs bluetooth firmware to use default values 2772 * 1 - instructs bluetooth firmware to override default values 2773 * bit3:1 2774 * Reserved 2775 * bit7:4 2776 * DSBR override values (only if bit0 is set. Default value is 0xF 2777 * bit31:7 2778 * Reserved 2779 * Expected values for dsbr field: 2780 * 1. 0xF1 - indicates that the resistor on board is 33 Ohm 2781 * 2. 0x00 or 0xB1 - indicates that the resistor on board is 10 Ohm 2782 * 3. Non existing UEFI variable or invalid (none of the above) - indicates 2783 * that the resistor on board is 10 Ohm 2784 * Even if uefi variable is not present, driver shall send 0xfc0a command to 2785 * firmware to use default values. 2786 * 2787 */ 2788 static int btintel_uefi_get_dsbr(u32 *dsbr_var) 2789 { 2790 struct btintel_dsbr { 2791 u8 header; 2792 u32 dsbr; 2793 } __packed data; 2794 2795 efi_status_t status; 2796 unsigned long data_size = sizeof(data); 2797 efi_guid_t guid = EFI_GUID(0xe65d8884, 0xd4af, 0x4b20, 0x8d, 0x03, 2798 0x77, 0x2e, 0xcc, 0x3d, 0xa5, 0x31); 2799 2800 if (!IS_ENABLED(CONFIG_EFI)) 2801 return -EOPNOTSUPP; 2802 2803 if (!efi_rt_services_supported(EFI_RT_SUPPORTED_GET_VARIABLE)) 2804 return -EOPNOTSUPP; 2805 2806 status = efi.get_variable(BTINTEL_EFI_DSBR, &guid, NULL, &data_size, 2807 &data); 2808 2809 if (status != EFI_SUCCESS || data_size != sizeof(data)) 2810 return -ENXIO; 2811 2812 *dsbr_var = data.dsbr; 2813 return 0; 2814 } 2815 2816 static int btintel_set_dsbr(struct hci_dev *hdev, struct intel_version_tlv *ver) 2817 { 2818 struct btintel_dsbr_cmd { 2819 u8 enable; 2820 u8 dsbr; 2821 } __packed; 2822 2823 struct btintel_dsbr_cmd cmd; 2824 struct sk_buff *skb; 2825 u32 dsbr; 2826 u8 status, hw_variant; 2827 int err; 2828 2829 hw_variant = INTEL_HW_VARIANT(ver->cnvi_bt); 2830 /* DSBR command needs to be sent for, 2831 * 1. BlazarI or BlazarIW + B0 step product in IML image. 2832 * 2. Gale Peak2 or BlazarU in OP image. 2833 * 3. Scorpious Peak in IML image. 2834 * 4. Scorpious Peak2 onwards + PCIe transport in IML image. 2835 */ 2836 2837 switch (hw_variant) { 2838 case BTINTEL_HWID_BZRI: 2839 case BTINTEL_HWID_BZRIW: 2840 if (ver->img_type == BTINTEL_IMG_IML && 2841 INTEL_CNVX_TOP_STEP(ver->cnvi_top) == 0x01) 2842 break; 2843 return 0; 2844 case BTINTEL_HWID_GAP: 2845 case BTINTEL_HWID_BZRU: 2846 if (ver->img_type == BTINTEL_IMG_OP && 2847 hdev->bus == HCI_USB) 2848 break; 2849 return 0; 2850 case BTINTEL_HWID_SCP: 2851 if (ver->img_type == BTINTEL_IMG_IML) 2852 break; 2853 return 0; 2854 default: 2855 /* Scorpius Peak2 onwards */ 2856 if (hw_variant >= BTINTEL_HWID_SCP2 && hdev->bus == HCI_PCI 2857 && ver->img_type == BTINTEL_IMG_IML) 2858 break; 2859 return 0; 2860 } 2861 2862 dsbr = 0; 2863 err = btintel_uefi_get_dsbr(&dsbr); 2864 if (err < 0) 2865 bt_dev_dbg(hdev, "Error reading efi: %ls (%d)", 2866 BTINTEL_EFI_DSBR, err); 2867 2868 cmd.enable = dsbr & BIT(0); 2869 cmd.dsbr = dsbr >> 4 & 0xF; 2870 2871 bt_dev_info(hdev, "dsbr: enable: 0x%2.2x value: 0x%2.2x", cmd.enable, 2872 cmd.dsbr); 2873 2874 skb = __hci_cmd_sync(hdev, 0xfc0a, sizeof(cmd), &cmd, HCI_CMD_TIMEOUT); 2875 if (IS_ERR(skb)) 2876 return -bt_to_errno(PTR_ERR(skb)); 2877 2878 status = skb->data[0]; 2879 kfree_skb(skb); 2880 2881 if (status) 2882 return -bt_to_errno(status); 2883 2884 return 0; 2885 } 2886 2887 #ifdef CONFIG_ACPI 2888 static acpi_status btintel_evaluate_acpi_method(struct hci_dev *hdev, 2889 acpi_string method, 2890 union acpi_object **ptr, 2891 u8 pkg_size) 2892 { 2893 struct acpi_buffer buffer = { ACPI_ALLOCATE_BUFFER, NULL }; 2894 union acpi_object *p; 2895 acpi_status status; 2896 acpi_handle handle; 2897 2898 handle = ACPI_HANDLE(GET_HCIDEV_DEV(hdev)); 2899 if (!handle) { 2900 bt_dev_dbg(hdev, "ACPI-BT: No ACPI support for Bluetooth device"); 2901 return AE_NOT_EXIST; 2902 } 2903 2904 status = acpi_evaluate_object(handle, method, NULL, &buffer); 2905 2906 if (ACPI_FAILURE(status)) { 2907 bt_dev_dbg(hdev, "ACPI-BT: ACPI Failure: %s method: %s", 2908 acpi_format_exception(status), method); 2909 return status; 2910 } 2911 2912 p = buffer.pointer; 2913 2914 if (p->type != ACPI_TYPE_PACKAGE || p->package.count < pkg_size) { 2915 bt_dev_warn(hdev, "ACPI-BT: Invalid object type: %d or package count: %d", 2916 p->type, p->package.count); 2917 kfree(buffer.pointer); 2918 return AE_ERROR; 2919 } 2920 2921 *ptr = buffer.pointer; 2922 return 0; 2923 } 2924 2925 static union acpi_object *btintel_acpi_get_bt_pkg(union acpi_object *buffer) 2926 { 2927 union acpi_object *domain, *bt_pkg; 2928 int i; 2929 2930 for (i = 1; i < buffer->package.count; i++) { 2931 bt_pkg = &buffer->package.elements[i]; 2932 domain = &bt_pkg->package.elements[0]; 2933 if (domain->type == ACPI_TYPE_INTEGER && 2934 domain->integer.value == BTINTEL_BT_DOMAIN) 2935 return bt_pkg; 2936 } 2937 return ERR_PTR(-ENOENT); 2938 } 2939 2940 static int btintel_send_sar_ddc(struct hci_dev *hdev, struct btintel_cp_ddc_write *data, u8 len) 2941 { 2942 struct sk_buff *skb; 2943 2944 skb = __hci_cmd_sync(hdev, 0xfc8b, len, data, HCI_CMD_TIMEOUT); 2945 if (IS_ERR(skb)) { 2946 bt_dev_warn(hdev, "Failed to send sar ddc id:0x%4.4x (%ld)", 2947 le16_to_cpu(data->id), PTR_ERR(skb)); 2948 return PTR_ERR(skb); 2949 } 2950 kfree_skb(skb); 2951 return 0; 2952 } 2953 2954 static int btintel_send_edr(struct hci_dev *hdev, struct btintel_cp_ddc_write *cmd, 2955 int id, struct btintel_sar_inc_pwr *sar) 2956 { 2957 cmd->len = 5; 2958 cmd->id = cpu_to_le16(id); 2959 cmd->data[0] = sar->br >> 3; 2960 cmd->data[1] = sar->edr2 >> 3; 2961 cmd->data[2] = sar->edr3 >> 3; 2962 return btintel_send_sar_ddc(hdev, cmd, 6); 2963 } 2964 2965 static int btintel_send_le(struct hci_dev *hdev, struct btintel_cp_ddc_write *cmd, 2966 int id, struct btintel_sar_inc_pwr *sar) 2967 { 2968 cmd->len = 3; 2969 cmd->id = cpu_to_le16(id); 2970 cmd->data[0] = min3(sar->le, sar->le_lr, sar->le_2mhz) >> 3; 2971 return btintel_send_sar_ddc(hdev, cmd, 4); 2972 } 2973 2974 static int btintel_send_br(struct hci_dev *hdev, struct btintel_cp_ddc_write *cmd, 2975 int id, struct btintel_sar_inc_pwr *sar) 2976 { 2977 cmd->len = 3; 2978 cmd->id = cpu_to_le16(id); 2979 cmd->data[0] = sar->br >> 3; 2980 return btintel_send_sar_ddc(hdev, cmd, 4); 2981 } 2982 2983 static int btintel_send_br_mutual(struct hci_dev *hdev, struct btintel_cp_ddc_write *cmd, 2984 int id, struct btintel_sar_inc_pwr *sar) 2985 { 2986 cmd->len = 3; 2987 cmd->id = cpu_to_le16(id); 2988 cmd->data[0] = sar->br; 2989 return btintel_send_sar_ddc(hdev, cmd, 4); 2990 } 2991 2992 static int btintel_send_edr2(struct hci_dev *hdev, struct btintel_cp_ddc_write *cmd, 2993 int id, struct btintel_sar_inc_pwr *sar) 2994 { 2995 cmd->len = 3; 2996 cmd->id = cpu_to_le16(id); 2997 cmd->data[0] = sar->edr2; 2998 return btintel_send_sar_ddc(hdev, cmd, 4); 2999 } 3000 3001 static int btintel_send_edr3(struct hci_dev *hdev, struct btintel_cp_ddc_write *cmd, 3002 int id, struct btintel_sar_inc_pwr *sar) 3003 { 3004 cmd->len = 3; 3005 cmd->id = cpu_to_le16(id); 3006 cmd->data[0] = sar->edr3; 3007 return btintel_send_sar_ddc(hdev, cmd, 4); 3008 } 3009 3010 static int btintel_set_legacy_sar(struct hci_dev *hdev, struct btintel_sar_inc_pwr *sar) 3011 { 3012 struct btintel_cp_ddc_write *cmd; 3013 u8 buffer[64]; 3014 int ret; 3015 3016 cmd = (void *)buffer; 3017 ret = btintel_send_br(hdev, cmd, 0x0131, sar); 3018 if (ret) 3019 return ret; 3020 3021 ret = btintel_send_br(hdev, cmd, 0x0132, sar); 3022 if (ret) 3023 return ret; 3024 3025 ret = btintel_send_le(hdev, cmd, 0x0133, sar); 3026 if (ret) 3027 return ret; 3028 3029 ret = btintel_send_edr(hdev, cmd, 0x0137, sar); 3030 if (ret) 3031 return ret; 3032 3033 ret = btintel_send_edr(hdev, cmd, 0x0138, sar); 3034 if (ret) 3035 return ret; 3036 3037 ret = btintel_send_edr(hdev, cmd, 0x013b, sar); 3038 if (ret) 3039 return ret; 3040 3041 ret = btintel_send_edr(hdev, cmd, 0x013c, sar); 3042 3043 return ret; 3044 } 3045 3046 static int btintel_set_mutual_sar(struct hci_dev *hdev, struct btintel_sar_inc_pwr *sar) 3047 { 3048 struct btintel_cp_ddc_write *cmd; 3049 struct sk_buff *skb; 3050 u8 buffer[64]; 3051 bool enable; 3052 int ret; 3053 3054 cmd = (void *)buffer; 3055 3056 cmd->len = 3; 3057 cmd->id = cpu_to_le16(0x019e); 3058 3059 if (sar->revision == BTINTEL_SAR_INC_PWR && 3060 sar->inc_power_mode == BTINTEL_SAR_INC_PWR_SUPPORTED) 3061 cmd->data[0] = 0x01; 3062 else 3063 cmd->data[0] = 0x00; 3064 3065 ret = btintel_send_sar_ddc(hdev, cmd, 4); 3066 if (ret) 3067 return ret; 3068 3069 if (sar->revision == BTINTEL_SAR_INC_PWR && 3070 sar->inc_power_mode == BTINTEL_SAR_INC_PWR_SUPPORTED) { 3071 cmd->len = 3; 3072 cmd->id = cpu_to_le16(0x019f); 3073 cmd->data[0] = sar->sar_2400_chain_a; 3074 3075 ret = btintel_send_sar_ddc(hdev, cmd, 4); 3076 if (ret) 3077 return ret; 3078 } 3079 3080 ret = btintel_send_br_mutual(hdev, cmd, 0x01a0, sar); 3081 if (ret) 3082 return ret; 3083 3084 ret = btintel_send_edr2(hdev, cmd, 0x01a1, sar); 3085 if (ret) 3086 return ret; 3087 3088 ret = btintel_send_edr3(hdev, cmd, 0x01a2, sar); 3089 if (ret) 3090 return ret; 3091 3092 ret = btintel_send_le(hdev, cmd, 0x01a3, sar); 3093 if (ret) 3094 return ret; 3095 3096 enable = true; 3097 skb = __hci_cmd_sync(hdev, 0xfe25, 1, &enable, HCI_CMD_TIMEOUT); 3098 if (IS_ERR(skb)) { 3099 bt_dev_warn(hdev, "Failed to send Intel SAR Enable (%ld)", PTR_ERR(skb)); 3100 return PTR_ERR(skb); 3101 } 3102 3103 kfree_skb(skb); 3104 return 0; 3105 } 3106 3107 static int btintel_sar_send_to_device(struct hci_dev *hdev, struct btintel_sar_inc_pwr *sar, 3108 struct intel_version_tlv *ver) 3109 { 3110 u16 cnvi, cnvr; 3111 int ret; 3112 3113 cnvi = ver->cnvi_top & 0xfff; 3114 cnvr = ver->cnvr_top & 0xfff; 3115 3116 if (cnvi < BTINTEL_CNVI_BLAZARI && cnvr < BTINTEL_CNVR_FMP2) { 3117 bt_dev_info(hdev, "Applying legacy Bluetooth SAR"); 3118 ret = btintel_set_legacy_sar(hdev, sar); 3119 } else if (cnvi == BTINTEL_CNVI_GAP || cnvr == BTINTEL_CNVR_FMP2) { 3120 bt_dev_info(hdev, "Applying mutual Bluetooth SAR"); 3121 ret = btintel_set_mutual_sar(hdev, sar); 3122 } else { 3123 ret = -EOPNOTSUPP; 3124 } 3125 3126 return ret; 3127 } 3128 3129 static int btintel_acpi_set_sar(struct hci_dev *hdev, struct intel_version_tlv *ver) 3130 { 3131 union acpi_object *bt_pkg, *buffer = NULL; 3132 struct btintel_sar_inc_pwr sar; 3133 acpi_status status; 3134 u8 revision; 3135 int ret; 3136 3137 status = btintel_evaluate_acpi_method(hdev, "BRDS", &buffer, 2); 3138 if (ACPI_FAILURE(status)) 3139 return -ENOENT; 3140 3141 bt_pkg = btintel_acpi_get_bt_pkg(buffer); 3142 3143 if (IS_ERR(bt_pkg)) { 3144 ret = PTR_ERR(bt_pkg); 3145 goto error; 3146 } 3147 3148 if (!bt_pkg->package.count) { 3149 ret = -EINVAL; 3150 goto error; 3151 } 3152 3153 revision = buffer->package.elements[0].integer.value; 3154 3155 if (revision > BTINTEL_SAR_INC_PWR) { 3156 bt_dev_dbg(hdev, "BT_SAR: revision: 0x%2.2x not supported", revision); 3157 ret = -EOPNOTSUPP; 3158 goto error; 3159 } 3160 3161 memset(&sar, 0, sizeof(sar)); 3162 3163 if (revision == BTINTEL_SAR_LEGACY && bt_pkg->package.count == 8) { 3164 sar.revision = revision; 3165 sar.bt_sar_bios = bt_pkg->package.elements[1].integer.value; 3166 sar.br = bt_pkg->package.elements[2].integer.value; 3167 sar.edr2 = bt_pkg->package.elements[3].integer.value; 3168 sar.edr3 = bt_pkg->package.elements[4].integer.value; 3169 sar.le = bt_pkg->package.elements[5].integer.value; 3170 sar.le_2mhz = bt_pkg->package.elements[6].integer.value; 3171 sar.le_lr = bt_pkg->package.elements[7].integer.value; 3172 3173 } else if (revision == BTINTEL_SAR_INC_PWR && bt_pkg->package.count == 10) { 3174 sar.revision = revision; 3175 sar.bt_sar_bios = bt_pkg->package.elements[1].integer.value; 3176 sar.inc_power_mode = bt_pkg->package.elements[2].integer.value; 3177 sar.sar_2400_chain_a = bt_pkg->package.elements[3].integer.value; 3178 sar.br = bt_pkg->package.elements[4].integer.value; 3179 sar.edr2 = bt_pkg->package.elements[5].integer.value; 3180 sar.edr3 = bt_pkg->package.elements[6].integer.value; 3181 sar.le = bt_pkg->package.elements[7].integer.value; 3182 sar.le_2mhz = bt_pkg->package.elements[8].integer.value; 3183 sar.le_lr = bt_pkg->package.elements[9].integer.value; 3184 } else { 3185 ret = -EINVAL; 3186 goto error; 3187 } 3188 3189 /* Apply only if it is enabled in BIOS */ 3190 if (sar.bt_sar_bios != 1) { 3191 bt_dev_dbg(hdev, "Bluetooth SAR is not enabled"); 3192 ret = -EOPNOTSUPP; 3193 goto error; 3194 } 3195 3196 ret = btintel_sar_send_to_device(hdev, &sar, ver); 3197 error: 3198 kfree(buffer); 3199 return ret; 3200 } 3201 #endif /* CONFIG_ACPI */ 3202 3203 static int btintel_set_specific_absorption_rate(struct hci_dev *hdev, 3204 struct intel_version_tlv *ver) 3205 { 3206 #ifdef CONFIG_ACPI 3207 return btintel_acpi_set_sar(hdev, ver); 3208 #endif 3209 return 0; 3210 } 3211 3212 int btintel_bootloader_setup_tlv(struct hci_dev *hdev, 3213 struct intel_version_tlv *ver) 3214 { 3215 u32 boot_param; 3216 char ddcname[64]; 3217 int err; 3218 struct intel_version_tlv new_ver; 3219 3220 bt_dev_dbg(hdev, ""); 3221 3222 /* Set the default boot parameter to 0x0 and it is updated to 3223 * SKU specific boot parameter after reading Intel_Write_Boot_Params 3224 * command while downloading the firmware. 3225 */ 3226 boot_param = 0x00000000; 3227 3228 /* In case of PCIe, this function might get called multiple times with 3229 * same hdev instance if there is any error on firmware download. 3230 * Need to clear stale bits of previous firmware download attempt. 3231 */ 3232 for (int i = 0; i < __INTEL_NUM_FLAGS; i++) 3233 btintel_clear_flag(hdev, i); 3234 3235 btintel_set_flag(hdev, INTEL_BOOTLOADER); 3236 3237 err = btintel_prepare_fw_download_tlv(hdev, ver, &boot_param); 3238 if (err) 3239 return err; 3240 3241 /* check if controller is already having an operational firmware */ 3242 if (ver->img_type == BTINTEL_IMG_OP) 3243 goto finish; 3244 3245 err = btintel_boot(hdev, boot_param); 3246 if (err) 3247 return err; 3248 3249 err = btintel_read_version_tlv(hdev, ver); 3250 if (err) 3251 return err; 3252 3253 /* set drive strength of BRI response */ 3254 err = btintel_set_dsbr(hdev, ver); 3255 if (err) { 3256 bt_dev_err(hdev, "Failed to send dsbr command (%d)", err); 3257 return err; 3258 } 3259 3260 /* If image type returned is BTINTEL_IMG_IML, then controller supports 3261 * intermediate loader image 3262 */ 3263 if (ver->img_type == BTINTEL_IMG_IML) { 3264 err = btintel_prepare_fw_download_tlv(hdev, ver, &boot_param); 3265 if (err) 3266 return err; 3267 3268 err = btintel_boot(hdev, boot_param); 3269 if (err) 3270 return err; 3271 } 3272 3273 btintel_clear_flag(hdev, INTEL_BOOTLOADER); 3274 3275 btintel_get_fw_name_tlv(ver, ddcname, sizeof(ddcname), "ddc"); 3276 /* Once the device is running in operational mode, it needs to 3277 * apply the device configuration (DDC) parameters. 3278 * 3279 * The device can work without DDC parameters, so even if it 3280 * fails to load the file, no need to fail the setup. 3281 */ 3282 btintel_load_ddc_config(hdev, ddcname); 3283 3284 /* Read supported use cases and set callbacks to fetch datapath id */ 3285 btintel_configure_offload(hdev); 3286 3287 hci_dev_clear_flag(hdev, HCI_QUALITY_REPORT); 3288 3289 /* Send sar values to controller */ 3290 btintel_set_specific_absorption_rate(hdev, ver); 3291 3292 /* Set PPAG feature */ 3293 btintel_set_ppag(hdev, ver); 3294 3295 /* Read the Intel version information after loading the FW */ 3296 err = btintel_read_version_tlv(hdev, &new_ver); 3297 if (err) 3298 return err; 3299 3300 btintel_version_info_tlv(hdev, &new_ver); 3301 3302 finish: 3303 /* Set the event mask for Intel specific vendor events. This enables 3304 * a few extra events that are useful during general operation. It 3305 * does not enable any debugging related events. 3306 * 3307 * The device will function correctly without these events enabled 3308 * and thus no need to fail the setup. 3309 */ 3310 btintel_set_event_mask(hdev, false); 3311 3312 return 0; 3313 } 3314 EXPORT_SYMBOL_GPL(btintel_bootloader_setup_tlv); 3315 3316 void btintel_set_msft_opcode(struct hci_dev *hdev, u8 hw_variant) 3317 { 3318 switch (hw_variant) { 3319 /* Legacy bootloader devices that supports MSFT Extension */ 3320 case 0x11: /* JfP */ 3321 case 0x12: /* ThP */ 3322 case 0x13: /* HrP */ 3323 case 0x14: /* CcP */ 3324 /* All Intel new generation controllers support the Microsoft vendor 3325 * extension are using 0xFC1E for VsMsftOpCode. 3326 */ 3327 case 0x17: 3328 case 0x18: 3329 case 0x19: 3330 case 0x1b: 3331 case 0x1c: 3332 case 0x1d: 3333 case 0x1e: 3334 case 0x1f: 3335 case 0x20: 3336 case 0x21: 3337 case 0x22: 3338 hci_set_msft_opcode(hdev, 0xFC1E); 3339 break; 3340 default: 3341 /* Not supported */ 3342 break; 3343 } 3344 } 3345 EXPORT_SYMBOL_GPL(btintel_set_msft_opcode); 3346 3347 void btintel_print_fseq_info(struct hci_dev *hdev) 3348 { 3349 struct sk_buff *skb; 3350 u8 *p; 3351 u32 val; 3352 const char *str; 3353 3354 skb = __hci_cmd_sync(hdev, 0xfcb3, 0, NULL, HCI_CMD_TIMEOUT); 3355 if (IS_ERR(skb)) { 3356 bt_dev_dbg(hdev, "Reading fseq status command failed (%ld)", 3357 PTR_ERR(skb)); 3358 return; 3359 } 3360 3361 if (skb->len < (sizeof(u32) * 16 + 2)) { 3362 bt_dev_dbg(hdev, "Malformed packet of length %u received", 3363 skb->len); 3364 kfree_skb(skb); 3365 return; 3366 } 3367 3368 p = skb_pull_data(skb, 1); 3369 if (*p) { 3370 bt_dev_dbg(hdev, "Failed to get fseq status (0x%2.2x)", *p); 3371 kfree_skb(skb); 3372 return; 3373 } 3374 3375 p = skb_pull_data(skb, 1); 3376 switch (*p) { 3377 case 0: 3378 str = "Success"; 3379 break; 3380 case 1: 3381 str = "Fatal error"; 3382 break; 3383 case 2: 3384 str = "Semaphore acquire error"; 3385 break; 3386 default: 3387 str = "Unknown error"; 3388 break; 3389 } 3390 3391 if (*p) { 3392 bt_dev_err(hdev, "Fseq status: %s (0x%2.2x)", str, *p); 3393 kfree_skb(skb); 3394 return; 3395 } 3396 3397 bt_dev_info(hdev, "Fseq status: %s (0x%2.2x)", str, *p); 3398 3399 val = get_unaligned_le32(skb_pull_data(skb, 4)); 3400 bt_dev_dbg(hdev, "Reason: 0x%8.8x", val); 3401 3402 val = get_unaligned_le32(skb_pull_data(skb, 4)); 3403 bt_dev_dbg(hdev, "Global version: 0x%8.8x", val); 3404 3405 val = get_unaligned_le32(skb_pull_data(skb, 4)); 3406 bt_dev_dbg(hdev, "Installed version: 0x%8.8x", val); 3407 3408 p = skb->data; 3409 skb_pull_data(skb, 4); 3410 bt_dev_info(hdev, "Fseq executed: %2.2u.%2.2u.%2.2u.%2.2u", p[0], p[1], 3411 p[2], p[3]); 3412 3413 p = skb->data; 3414 skb_pull_data(skb, 4); 3415 bt_dev_info(hdev, "Fseq BT Top: %2.2u.%2.2u.%2.2u.%2.2u", p[0], p[1], 3416 p[2], p[3]); 3417 3418 val = get_unaligned_le32(skb_pull_data(skb, 4)); 3419 bt_dev_dbg(hdev, "Fseq Top init version: 0x%8.8x", val); 3420 3421 val = get_unaligned_le32(skb_pull_data(skb, 4)); 3422 bt_dev_dbg(hdev, "Fseq Cnvio init version: 0x%8.8x", val); 3423 3424 val = get_unaligned_le32(skb_pull_data(skb, 4)); 3425 bt_dev_dbg(hdev, "Fseq MBX Wifi file version: 0x%8.8x", val); 3426 3427 val = get_unaligned_le32(skb_pull_data(skb, 4)); 3428 bt_dev_dbg(hdev, "Fseq BT version: 0x%8.8x", val); 3429 3430 val = get_unaligned_le32(skb_pull_data(skb, 4)); 3431 bt_dev_dbg(hdev, "Fseq Top reset address: 0x%8.8x", val); 3432 3433 val = get_unaligned_le32(skb_pull_data(skb, 4)); 3434 bt_dev_dbg(hdev, "Fseq MBX timeout: 0x%8.8x", val); 3435 3436 val = get_unaligned_le32(skb_pull_data(skb, 4)); 3437 bt_dev_dbg(hdev, "Fseq MBX ack: 0x%8.8x", val); 3438 3439 val = get_unaligned_le32(skb_pull_data(skb, 4)); 3440 bt_dev_dbg(hdev, "Fseq CNVi id: 0x%8.8x", val); 3441 3442 val = get_unaligned_le32(skb_pull_data(skb, 4)); 3443 bt_dev_dbg(hdev, "Fseq CNVr id: 0x%8.8x", val); 3444 3445 val = get_unaligned_le32(skb_pull_data(skb, 4)); 3446 bt_dev_dbg(hdev, "Fseq Error handle: 0x%8.8x", val); 3447 3448 val = get_unaligned_le32(skb_pull_data(skb, 4)); 3449 bt_dev_dbg(hdev, "Fseq Magic noalive indication: 0x%8.8x", val); 3450 3451 val = get_unaligned_le32(skb_pull_data(skb, 4)); 3452 bt_dev_dbg(hdev, "Fseq OTP version: 0x%8.8x", val); 3453 3454 val = get_unaligned_le32(skb_pull_data(skb, 4)); 3455 bt_dev_dbg(hdev, "Fseq MBX otp version: 0x%8.8x", val); 3456 3457 kfree_skb(skb); 3458 } 3459 EXPORT_SYMBOL_GPL(btintel_print_fseq_info); 3460 3461 static int btintel_setup_combined(struct hci_dev *hdev) 3462 { 3463 const u8 param[1] = { 0xFF }; 3464 struct intel_version ver; 3465 struct intel_version_tlv ver_tlv; 3466 struct sk_buff *skb; 3467 int err; 3468 3469 BT_DBG("%s", hdev->name); 3470 3471 /* The some controllers have a bug with the first HCI command sent to it 3472 * returning number of completed commands as zero. This would stall the 3473 * command processing in the Bluetooth core. 3474 * 3475 * As a workaround, send HCI Reset command first which will reset the 3476 * number of completed commands and allow normal command processing 3477 * from now on. 3478 * 3479 * Regarding the INTEL_BROKEN_SHUTDOWN_LED flag, these devices maybe 3480 * in the SW_RFKILL ON state as a workaround of fixing LED issue during 3481 * the shutdown() procedure, and once the device is in SW_RFKILL ON 3482 * state, the only way to exit out of it is sending the HCI_Reset 3483 * command. 3484 */ 3485 if (btintel_test_flag(hdev, INTEL_BROKEN_INITIAL_NCMD) || 3486 btintel_test_flag(hdev, INTEL_BROKEN_SHUTDOWN_LED)) { 3487 skb = __hci_cmd_sync(hdev, HCI_OP_RESET, 0, NULL, 3488 HCI_INIT_TIMEOUT); 3489 if (IS_ERR(skb)) { 3490 bt_dev_err(hdev, 3491 "sending initial HCI reset failed (%ld)", 3492 PTR_ERR(skb)); 3493 return PTR_ERR(skb); 3494 } 3495 kfree_skb(skb); 3496 } 3497 3498 /* Starting from TyP device, the command parameter and response are 3499 * changed even though the OCF for HCI_Intel_Read_Version command 3500 * remains same. The legacy devices can handle even if the 3501 * command has a parameter and returns a correct version information. 3502 * So, it uses new format to support both legacy and new format. 3503 */ 3504 skb = __hci_cmd_sync(hdev, 0xfc05, 1, param, HCI_CMD_TIMEOUT); 3505 if (IS_ERR(skb)) { 3506 bt_dev_err(hdev, "Reading Intel version command failed (%ld)", 3507 PTR_ERR(skb)); 3508 return PTR_ERR(skb); 3509 } 3510 3511 /* Check the status */ 3512 if (skb->data[0]) { 3513 bt_dev_err(hdev, "Intel Read Version command failed (%02x)", 3514 skb->data[0]); 3515 err = -EIO; 3516 goto exit_error; 3517 } 3518 3519 /* Apply the common HCI quirks for Intel device */ 3520 hci_set_quirk(hdev, HCI_QUIRK_STRICT_DUPLICATE_FILTER); 3521 hci_set_quirk(hdev, HCI_QUIRK_SIMULTANEOUS_DISCOVERY); 3522 hci_set_quirk(hdev, HCI_QUIRK_NON_PERSISTENT_DIAG); 3523 3524 /* Set up the quality report callback for Intel devices */ 3525 hdev->set_quality_report = btintel_set_quality_report; 3526 3527 /* For Legacy device, check the HW platform value and size */ 3528 if (skb->len == sizeof(ver) && skb->data[1] == 0x37) { 3529 bt_dev_dbg(hdev, "Read the legacy Intel version information"); 3530 3531 memcpy(&ver, skb->data, sizeof(ver)); 3532 3533 /* Display version information */ 3534 btintel_version_info(hdev, &ver); 3535 3536 /* Check for supported iBT hardware variants of this firmware 3537 * loading method. 3538 * 3539 * This check has been put in place to ensure correct forward 3540 * compatibility options when newer hardware variants come 3541 * along. 3542 */ 3543 switch (ver.hw_variant) { 3544 case 0x07: /* WP */ 3545 case 0x08: /* StP */ 3546 /* Legacy ROM product */ 3547 btintel_set_flag(hdev, INTEL_ROM_LEGACY); 3548 3549 /* Apply the device specific HCI quirks 3550 * 3551 * WBS for SdP - For the Legacy ROM products, only SdP 3552 * supports the WBS. But the version information is not 3553 * enough to use here because the StP2 and SdP have same 3554 * hw_variant and fw_variant. So, this flag is set by 3555 * the transport driver (btusb) based on the HW info 3556 * (idProduct) 3557 */ 3558 if (!btintel_test_flag(hdev, 3559 INTEL_ROM_LEGACY_NO_WBS_SUPPORT)) 3560 hci_set_quirk(hdev, 3561 HCI_QUIRK_WIDEBAND_SPEECH_SUPPORTED); 3562 3563 err = btintel_legacy_rom_setup(hdev, &ver); 3564 break; 3565 case 0x0b: /* SfP */ 3566 case 0x11: /* JfP */ 3567 case 0x12: /* ThP */ 3568 case 0x13: /* HrP */ 3569 case 0x14: /* CcP */ 3570 fallthrough; 3571 case 0x0c: /* WsP */ 3572 /* Apply the device specific HCI quirks 3573 * 3574 * All Legacy bootloader devices support WBS 3575 */ 3576 hci_set_quirk(hdev, 3577 HCI_QUIRK_WIDEBAND_SPEECH_SUPPORTED); 3578 3579 /* These variants don't seem to support LE Coded PHY */ 3580 hci_set_quirk(hdev, HCI_QUIRK_BROKEN_LE_CODED); 3581 3582 /* Setup MSFT Extension support */ 3583 btintel_set_msft_opcode(hdev, ver.hw_variant); 3584 3585 err = btintel_bootloader_setup(hdev, &ver); 3586 btintel_register_devcoredump_support(hdev); 3587 break; 3588 default: 3589 bt_dev_err(hdev, "Unsupported Intel hw variant (%u)", 3590 ver.hw_variant); 3591 err = -EINVAL; 3592 } 3593 3594 hci_set_hw_info(hdev, 3595 "INTEL platform=%u variant=%u revision=%u", 3596 ver.hw_platform, ver.hw_variant, 3597 ver.hw_revision); 3598 3599 goto exit_error; 3600 } 3601 3602 /* memset ver_tlv to start with clean state as few fields are exclusive 3603 * to bootloader mode and are not populated in operational mode 3604 */ 3605 memset(&ver_tlv, 0, sizeof(ver_tlv)); 3606 /* For TLV type device, parse the tlv data */ 3607 err = btintel_parse_version_tlv(hdev, &ver_tlv, skb); 3608 if (err) { 3609 bt_dev_err(hdev, "Failed to parse TLV version information"); 3610 goto exit_error; 3611 } 3612 3613 if (INTEL_HW_PLATFORM(ver_tlv.cnvi_bt) != 0x37) { 3614 bt_dev_err(hdev, "Unsupported Intel hardware platform (0x%2x)", 3615 INTEL_HW_PLATFORM(ver_tlv.cnvi_bt)); 3616 err = -EINVAL; 3617 goto exit_error; 3618 } 3619 3620 /* Check for supported iBT hardware variants of this firmware 3621 * loading method. 3622 * 3623 * This check has been put in place to ensure correct forward 3624 * compatibility options when newer hardware variants come 3625 * along. 3626 */ 3627 switch (INTEL_HW_VARIANT(ver_tlv.cnvi_bt)) { 3628 case 0x11: /* JfP */ 3629 case 0x12: /* ThP */ 3630 case 0x13: /* HrP */ 3631 case 0x14: /* CcP */ 3632 /* Some legacy bootloader devices starting from JfP, 3633 * the operational firmware supports both old and TLV based 3634 * HCI_Intel_Read_Version command based on the command 3635 * parameter. 3636 * 3637 * For upgrading firmware case, the TLV based version cannot 3638 * be used because the firmware filename for legacy bootloader 3639 * is based on the old format. 3640 * 3641 * Also, it is not easy to convert TLV based version from the 3642 * legacy version format. 3643 * 3644 * So, as a workaround for those devices, use the legacy 3645 * HCI_Intel_Read_Version to get the version information and 3646 * run the legacy bootloader setup. 3647 */ 3648 err = btintel_read_version(hdev, &ver); 3649 if (err) 3650 break; 3651 3652 /* Apply the device specific HCI quirks 3653 * 3654 * All Legacy bootloader devices support WBS 3655 */ 3656 hci_set_quirk(hdev, HCI_QUIRK_WIDEBAND_SPEECH_SUPPORTED); 3657 3658 /* These variants don't seem to support LE Coded PHY */ 3659 hci_set_quirk(hdev, HCI_QUIRK_BROKEN_LE_CODED); 3660 3661 /* Setup MSFT Extension support */ 3662 btintel_set_msft_opcode(hdev, ver.hw_variant); 3663 3664 err = btintel_bootloader_setup(hdev, &ver); 3665 btintel_register_devcoredump_support(hdev); 3666 break; 3667 case 0x18: /* GfP2 */ 3668 case 0x1c: /* GaP */ 3669 /* Re-classify packet type for controllers with LE audio */ 3670 hdev->classify_pkt_type = btintel_classify_pkt_type; 3671 fallthrough; 3672 case 0x17: 3673 case 0x19: 3674 case 0x1b: 3675 case 0x1d: 3676 case 0x1e: 3677 case 0x1f: 3678 case 0x20: 3679 case 0x21: 3680 case 0x22: 3681 /* Display version information of TLV type */ 3682 btintel_version_info_tlv(hdev, &ver_tlv); 3683 3684 /* Apply the device specific HCI quirks for TLV based devices 3685 * 3686 * All TLV based devices support WBS 3687 */ 3688 hci_set_quirk(hdev, HCI_QUIRK_WIDEBAND_SPEECH_SUPPORTED); 3689 3690 /* Setup MSFT Extension support */ 3691 btintel_set_msft_opcode(hdev, 3692 INTEL_HW_VARIANT(ver_tlv.cnvi_bt)); 3693 btintel_set_dsm_reset_method(hdev, &ver_tlv); 3694 3695 err = btintel_bootloader_setup_tlv(hdev, &ver_tlv); 3696 if (err) 3697 goto exit_error; 3698 3699 btintel_register_devcoredump_support(hdev); 3700 btintel_print_fseq_info(hdev); 3701 break; 3702 default: 3703 bt_dev_err(hdev, "Unsupported Intel hw variant (%u)", 3704 INTEL_HW_VARIANT(ver_tlv.cnvi_bt)); 3705 err = -EINVAL; 3706 break; 3707 } 3708 3709 hci_set_hw_info(hdev, "INTEL platform=%u variant=%u", 3710 INTEL_HW_PLATFORM(ver_tlv.cnvi_bt), 3711 INTEL_HW_VARIANT(ver_tlv.cnvi_bt)); 3712 3713 exit_error: 3714 kfree_skb(skb); 3715 3716 return err; 3717 } 3718 3719 int btintel_shutdown_combined(struct hci_dev *hdev) 3720 { 3721 struct sk_buff *skb; 3722 int ret; 3723 3724 /* Send HCI Reset to the controller to stop any BT activity which 3725 * were triggered. This will help to save power and maintain the 3726 * sync b/w Host and controller 3727 */ 3728 skb = __hci_cmd_sync(hdev, HCI_OP_RESET, 0, NULL, HCI_INIT_TIMEOUT); 3729 if (IS_ERR(skb)) { 3730 bt_dev_err(hdev, "HCI reset during shutdown failed"); 3731 return PTR_ERR(skb); 3732 } 3733 kfree_skb(skb); 3734 3735 3736 /* Some platforms have an issue with BT LED when the interface is 3737 * down or BT radio is turned off, which takes 5 seconds to BT LED 3738 * goes off. As a workaround, sends HCI_Intel_SW_RFKILL to put the 3739 * device in the RFKILL ON state which turns off the BT LED immediately. 3740 */ 3741 if (btintel_test_flag(hdev, INTEL_BROKEN_SHUTDOWN_LED)) { 3742 skb = __hci_cmd_sync(hdev, 0xfc3f, 0, NULL, HCI_INIT_TIMEOUT); 3743 if (IS_ERR(skb)) { 3744 ret = PTR_ERR(skb); 3745 bt_dev_err(hdev, "turning off Intel device LED failed"); 3746 return ret; 3747 } 3748 kfree_skb(skb); 3749 } 3750 3751 return 0; 3752 } 3753 EXPORT_SYMBOL_GPL(btintel_shutdown_combined); 3754 3755 int btintel_configure_setup(struct hci_dev *hdev, const char *driver_name) 3756 { 3757 hdev->manufacturer = 2; 3758 hdev->setup = btintel_setup_combined; 3759 hdev->shutdown = btintel_shutdown_combined; 3760 hdev->hw_error = btintel_hw_error; 3761 hdev->set_diag = btintel_set_diag_combined; 3762 hdev->set_bdaddr = btintel_set_bdaddr; 3763 3764 coredump_info.driver_name = driver_name; 3765 3766 return 0; 3767 } 3768 EXPORT_SYMBOL_GPL(btintel_configure_setup); 3769 3770 static int btintel_diagnostics(struct hci_dev *hdev, struct sk_buff *skb) 3771 { 3772 struct intel_tlv *tlv = (void *)&skb->data[5]; 3773 3774 /* The first event is always an event type TLV */ 3775 if (tlv->type != INTEL_TLV_TYPE_ID) 3776 goto recv_frame; 3777 3778 switch (tlv->val[0]) { 3779 case INTEL_TLV_SYSTEM_EXCEPTION: 3780 case INTEL_TLV_FATAL_EXCEPTION: 3781 case INTEL_TLV_DEBUG_EXCEPTION: 3782 case INTEL_TLV_TEST_EXCEPTION: 3783 /* Generate devcoredump from exception */ 3784 if (!hci_devcd_init(hdev, skb->len)) { 3785 hci_devcd_append(hdev, skb_clone(skb, GFP_ATOMIC)); 3786 hci_devcd_complete(hdev); 3787 } else { 3788 bt_dev_err(hdev, "Failed to generate devcoredump"); 3789 } 3790 break; 3791 default: 3792 bt_dev_err(hdev, "Invalid exception type %02X", tlv->val[0]); 3793 } 3794 3795 recv_frame: 3796 return hci_recv_frame(hdev, skb); 3797 } 3798 3799 int btintel_recv_event(struct hci_dev *hdev, struct sk_buff *skb) 3800 { 3801 struct hci_event_hdr *hdr = (void *)skb->data; 3802 const char diagnostics_hdr[] = { 0x87, 0x80, 0x03 }; 3803 3804 if (skb->len > HCI_EVENT_HDR_SIZE && hdr->evt == 0xff && 3805 hdr->plen > 0) { 3806 const void *ptr = skb->data + HCI_EVENT_HDR_SIZE + 1; 3807 unsigned int len = skb->len - HCI_EVENT_HDR_SIZE - 1; 3808 3809 if (btintel_test_flag(hdev, INTEL_BOOTLOADER)) { 3810 switch (skb->data[2]) { 3811 case 0x02: 3812 /* When switching to the operational firmware 3813 * the device sends a vendor specific event 3814 * indicating that the bootup completed. 3815 */ 3816 btintel_bootup(hdev, ptr, len); 3817 kfree_skb(skb); 3818 return 0; 3819 case 0x06: 3820 /* When the firmware loading completes the 3821 * device sends out a vendor specific event 3822 * indicating the result of the firmware 3823 * loading. 3824 */ 3825 btintel_secure_send_result(hdev, ptr, len); 3826 kfree_skb(skb); 3827 return 0; 3828 } 3829 } 3830 3831 /* Handle all diagnostics events separately. May still call 3832 * hci_recv_frame. 3833 */ 3834 if (len >= sizeof(diagnostics_hdr) && 3835 memcmp(&skb->data[2], diagnostics_hdr, 3836 sizeof(diagnostics_hdr)) == 0) { 3837 return btintel_diagnostics(hdev, skb); 3838 } 3839 } 3840 3841 return hci_recv_frame(hdev, skb); 3842 } 3843 EXPORT_SYMBOL_GPL(btintel_recv_event); 3844 3845 void btintel_bootup(struct hci_dev *hdev, const void *ptr, unsigned int len) 3846 { 3847 const struct intel_bootup *evt = ptr; 3848 3849 if (len != sizeof(*evt)) 3850 return; 3851 3852 if (btintel_test_and_clear_flag(hdev, INTEL_BOOTING)) 3853 btintel_wake_up_flag(hdev, INTEL_BOOTING); 3854 } 3855 EXPORT_SYMBOL_GPL(btintel_bootup); 3856 3857 void btintel_secure_send_result(struct hci_dev *hdev, 3858 const void *ptr, unsigned int len) 3859 { 3860 const struct intel_secure_send_result *evt = ptr; 3861 3862 if (len != sizeof(*evt)) 3863 return; 3864 3865 if (evt->result) 3866 btintel_set_flag(hdev, INTEL_FIRMWARE_FAILED); 3867 3868 if (btintel_test_and_clear_flag(hdev, INTEL_DOWNLOADING) && 3869 btintel_test_flag(hdev, INTEL_FIRMWARE_LOADED)) 3870 btintel_wake_up_flag(hdev, INTEL_DOWNLOADING); 3871 } 3872 EXPORT_SYMBOL_GPL(btintel_secure_send_result); 3873 3874 MODULE_AUTHOR("Marcel Holtmann <marcel@holtmann.org>"); 3875 MODULE_DESCRIPTION("Bluetooth support for Intel devices ver " VERSION); 3876 MODULE_VERSION(VERSION); 3877 MODULE_LICENSE("GPL"); 3878 MODULE_FIRMWARE("intel/ibt-11-5.sfi"); 3879 MODULE_FIRMWARE("intel/ibt-11-5.ddc"); 3880 MODULE_FIRMWARE("intel/ibt-12-16.sfi"); 3881 MODULE_FIRMWARE("intel/ibt-12-16.ddc"); 3882