1 // SPDX-License-Identifier: GPL-2.0-or-later 2 /* 3 * 4 * Bluetooth support for Intel devices 5 * 6 * Copyright (C) 2015 Intel Corporation 7 */ 8 9 #include <linux/module.h> 10 #include <linux/firmware.h> 11 #include <linux/regmap.h> 12 #include <linux/acpi.h> 13 #include <acpi/acpi_bus.h> 14 #include <linux/unaligned.h> 15 #include <linux/efi.h> 16 17 #include <net/bluetooth/bluetooth.h> 18 #include <net/bluetooth/hci_core.h> 19 20 #include "btintel.h" 21 22 #define VERSION "0.1" 23 24 #define BDADDR_INTEL (&(bdaddr_t){{0x00, 0x8b, 0x9e, 0x19, 0x03, 0x00}}) 25 #define RSA_HEADER_LEN 644 26 #define CSS_HEADER_OFFSET 8 27 #define ECDSA_OFFSET 644 28 #define ECDSA_HEADER_LEN 320 29 30 #define BTINTEL_EFI_DSBR L"UefiCnvCommonDSBR" 31 32 enum { 33 DSM_SET_WDISABLE2_DELAY = 1, 34 DSM_SET_RESET_METHOD = 3, 35 }; 36 37 #define CMD_WRITE_BOOT_PARAMS 0xfc0e 38 struct cmd_write_boot_params { 39 __le32 boot_addr; 40 u8 fw_build_num; 41 u8 fw_build_ww; 42 u8 fw_build_yy; 43 } __packed; 44 45 static struct { 46 const char *driver_name; 47 u8 hw_variant; 48 u32 fw_build_num; 49 } coredump_info; 50 51 static const guid_t btintel_guid_dsm = 52 GUID_INIT(0xaa10f4e0, 0x81ac, 0x4233, 53 0xab, 0xf6, 0x3b, 0x2a, 0xc5, 0x0e, 0x28, 0xd9); 54 55 int btintel_check_bdaddr(struct hci_dev *hdev) 56 { 57 struct hci_rp_read_bd_addr *bda; 58 struct sk_buff *skb; 59 60 skb = __hci_cmd_sync(hdev, HCI_OP_READ_BD_ADDR, 0, NULL, 61 HCI_INIT_TIMEOUT); 62 if (IS_ERR(skb)) { 63 int err = PTR_ERR(skb); 64 bt_dev_err(hdev, "Reading Intel device address failed (%d)", 65 err); 66 return err; 67 } 68 69 if (skb->len != sizeof(*bda)) { 70 bt_dev_err(hdev, "Intel device address length mismatch"); 71 kfree_skb(skb); 72 return -EIO; 73 } 74 75 bda = (struct hci_rp_read_bd_addr *)skb->data; 76 77 /* For some Intel based controllers, the default Bluetooth device 78 * address 00:03:19:9E:8B:00 can be found. These controllers are 79 * fully operational, but have the danger of duplicate addresses 80 * and that in turn can cause problems with Bluetooth operation. 81 */ 82 if (!bacmp(&bda->bdaddr, BDADDR_INTEL)) { 83 bt_dev_err(hdev, "Found Intel default device address (%pMR)", 84 &bda->bdaddr); 85 set_bit(HCI_QUIRK_INVALID_BDADDR, &hdev->quirks); 86 } 87 88 kfree_skb(skb); 89 90 return 0; 91 } 92 EXPORT_SYMBOL_GPL(btintel_check_bdaddr); 93 94 int btintel_enter_mfg(struct hci_dev *hdev) 95 { 96 static const u8 param[] = { 0x01, 0x00 }; 97 struct sk_buff *skb; 98 99 skb = __hci_cmd_sync(hdev, 0xfc11, 2, param, HCI_CMD_TIMEOUT); 100 if (IS_ERR(skb)) { 101 bt_dev_err(hdev, "Entering manufacturer mode failed (%ld)", 102 PTR_ERR(skb)); 103 return PTR_ERR(skb); 104 } 105 kfree_skb(skb); 106 107 return 0; 108 } 109 EXPORT_SYMBOL_GPL(btintel_enter_mfg); 110 111 int btintel_exit_mfg(struct hci_dev *hdev, bool reset, bool patched) 112 { 113 u8 param[] = { 0x00, 0x00 }; 114 struct sk_buff *skb; 115 116 /* The 2nd command parameter specifies the manufacturing exit method: 117 * 0x00: Just disable the manufacturing mode (0x00). 118 * 0x01: Disable manufacturing mode and reset with patches deactivated. 119 * 0x02: Disable manufacturing mode and reset with patches activated. 120 */ 121 if (reset) 122 param[1] |= patched ? 0x02 : 0x01; 123 124 skb = __hci_cmd_sync(hdev, 0xfc11, 2, param, HCI_CMD_TIMEOUT); 125 if (IS_ERR(skb)) { 126 bt_dev_err(hdev, "Exiting manufacturer mode failed (%ld)", 127 PTR_ERR(skb)); 128 return PTR_ERR(skb); 129 } 130 kfree_skb(skb); 131 132 return 0; 133 } 134 EXPORT_SYMBOL_GPL(btintel_exit_mfg); 135 136 int btintel_set_bdaddr(struct hci_dev *hdev, const bdaddr_t *bdaddr) 137 { 138 struct sk_buff *skb; 139 int err; 140 141 skb = __hci_cmd_sync(hdev, 0xfc31, 6, bdaddr, HCI_INIT_TIMEOUT); 142 if (IS_ERR(skb)) { 143 err = PTR_ERR(skb); 144 bt_dev_err(hdev, "Changing Intel device address failed (%d)", 145 err); 146 return err; 147 } 148 kfree_skb(skb); 149 150 return 0; 151 } 152 EXPORT_SYMBOL_GPL(btintel_set_bdaddr); 153 154 static int btintel_set_event_mask(struct hci_dev *hdev, bool debug) 155 { 156 u8 mask[8] = { 0x87, 0x0c, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 }; 157 struct sk_buff *skb; 158 int err; 159 160 if (debug) 161 mask[1] |= 0x62; 162 163 skb = __hci_cmd_sync(hdev, 0xfc52, 8, mask, HCI_INIT_TIMEOUT); 164 if (IS_ERR(skb)) { 165 err = PTR_ERR(skb); 166 bt_dev_err(hdev, "Setting Intel event mask failed (%d)", err); 167 return err; 168 } 169 kfree_skb(skb); 170 171 return 0; 172 } 173 174 int btintel_set_diag(struct hci_dev *hdev, bool enable) 175 { 176 struct sk_buff *skb; 177 u8 param[3]; 178 int err; 179 180 if (enable) { 181 param[0] = 0x03; 182 param[1] = 0x03; 183 param[2] = 0x03; 184 } else { 185 param[0] = 0x00; 186 param[1] = 0x00; 187 param[2] = 0x00; 188 } 189 190 skb = __hci_cmd_sync(hdev, 0xfc43, 3, param, HCI_INIT_TIMEOUT); 191 if (IS_ERR(skb)) { 192 err = PTR_ERR(skb); 193 if (err == -ENODATA) 194 goto done; 195 bt_dev_err(hdev, "Changing Intel diagnostic mode failed (%d)", 196 err); 197 return err; 198 } 199 kfree_skb(skb); 200 201 done: 202 btintel_set_event_mask(hdev, enable); 203 return 0; 204 } 205 EXPORT_SYMBOL_GPL(btintel_set_diag); 206 207 static int btintel_set_diag_mfg(struct hci_dev *hdev, bool enable) 208 { 209 int err, ret; 210 211 err = btintel_enter_mfg(hdev); 212 if (err) 213 return err; 214 215 ret = btintel_set_diag(hdev, enable); 216 217 err = btintel_exit_mfg(hdev, false, false); 218 if (err) 219 return err; 220 221 return ret; 222 } 223 224 static int btintel_set_diag_combined(struct hci_dev *hdev, bool enable) 225 { 226 int ret; 227 228 /* Legacy ROM device needs to be in the manufacturer mode to apply 229 * diagnostic setting 230 * 231 * This flag is set after reading the Intel version. 232 */ 233 if (btintel_test_flag(hdev, INTEL_ROM_LEGACY)) 234 ret = btintel_set_diag_mfg(hdev, enable); 235 else 236 ret = btintel_set_diag(hdev, enable); 237 238 return ret; 239 } 240 241 void btintel_hw_error(struct hci_dev *hdev, u8 code) 242 { 243 struct sk_buff *skb; 244 u8 type = 0x00; 245 246 bt_dev_err(hdev, "Hardware error 0x%2.2x", code); 247 248 skb = __hci_cmd_sync(hdev, HCI_OP_RESET, 0, NULL, HCI_INIT_TIMEOUT); 249 if (IS_ERR(skb)) { 250 bt_dev_err(hdev, "Reset after hardware error failed (%ld)", 251 PTR_ERR(skb)); 252 return; 253 } 254 kfree_skb(skb); 255 256 skb = __hci_cmd_sync(hdev, 0xfc22, 1, &type, HCI_INIT_TIMEOUT); 257 if (IS_ERR(skb)) { 258 bt_dev_err(hdev, "Retrieving Intel exception info failed (%ld)", 259 PTR_ERR(skb)); 260 return; 261 } 262 263 if (skb->len != 13) { 264 bt_dev_err(hdev, "Exception info size mismatch"); 265 kfree_skb(skb); 266 return; 267 } 268 269 bt_dev_err(hdev, "Exception info %s", (char *)(skb->data + 1)); 270 271 kfree_skb(skb); 272 } 273 EXPORT_SYMBOL_GPL(btintel_hw_error); 274 275 int btintel_version_info(struct hci_dev *hdev, struct intel_version *ver) 276 { 277 const char *variant; 278 279 /* The hardware platform number has a fixed value of 0x37 and 280 * for now only accept this single value. 281 */ 282 if (ver->hw_platform != 0x37) { 283 bt_dev_err(hdev, "Unsupported Intel hardware platform (%u)", 284 ver->hw_platform); 285 return -EINVAL; 286 } 287 288 /* Check for supported iBT hardware variants of this firmware 289 * loading method. 290 * 291 * This check has been put in place to ensure correct forward 292 * compatibility options when newer hardware variants come along. 293 */ 294 switch (ver->hw_variant) { 295 case 0x07: /* WP - Legacy ROM */ 296 case 0x08: /* StP - Legacy ROM */ 297 case 0x0b: /* SfP */ 298 case 0x0c: /* WsP */ 299 case 0x11: /* JfP */ 300 case 0x12: /* ThP */ 301 case 0x13: /* HrP */ 302 case 0x14: /* CcP */ 303 break; 304 default: 305 bt_dev_err(hdev, "Unsupported Intel hardware variant (%u)", 306 ver->hw_variant); 307 return -EINVAL; 308 } 309 310 switch (ver->fw_variant) { 311 case 0x01: 312 variant = "Legacy ROM 2.5"; 313 break; 314 case 0x06: 315 variant = "Bootloader"; 316 break; 317 case 0x22: 318 variant = "Legacy ROM 2.x"; 319 break; 320 case 0x23: 321 variant = "Firmware"; 322 break; 323 default: 324 bt_dev_err(hdev, "Unsupported firmware variant(%02x)", ver->fw_variant); 325 return -EINVAL; 326 } 327 328 coredump_info.hw_variant = ver->hw_variant; 329 coredump_info.fw_build_num = ver->fw_build_num; 330 331 bt_dev_info(hdev, "%s revision %u.%u build %u week %u %u", 332 variant, ver->fw_revision >> 4, ver->fw_revision & 0x0f, 333 ver->fw_build_num, ver->fw_build_ww, 334 2000 + ver->fw_build_yy); 335 336 return 0; 337 } 338 EXPORT_SYMBOL_GPL(btintel_version_info); 339 340 static int btintel_secure_send(struct hci_dev *hdev, u8 fragment_type, u32 plen, 341 const void *param) 342 { 343 while (plen > 0) { 344 struct sk_buff *skb; 345 u8 cmd_param[253], fragment_len = (plen > 252) ? 252 : plen; 346 347 cmd_param[0] = fragment_type; 348 memcpy(cmd_param + 1, param, fragment_len); 349 350 skb = __hci_cmd_sync(hdev, 0xfc09, fragment_len + 1, 351 cmd_param, HCI_INIT_TIMEOUT); 352 if (IS_ERR(skb)) 353 return PTR_ERR(skb); 354 355 kfree_skb(skb); 356 357 plen -= fragment_len; 358 param += fragment_len; 359 } 360 361 return 0; 362 } 363 364 int btintel_load_ddc_config(struct hci_dev *hdev, const char *ddc_name) 365 { 366 const struct firmware *fw; 367 struct sk_buff *skb; 368 const u8 *fw_ptr; 369 int err; 370 371 err = request_firmware_direct(&fw, ddc_name, &hdev->dev); 372 if (err < 0) { 373 bt_dev_err(hdev, "Failed to load Intel DDC file %s (%d)", 374 ddc_name, err); 375 return err; 376 } 377 378 bt_dev_info(hdev, "Found Intel DDC parameters: %s", ddc_name); 379 380 fw_ptr = fw->data; 381 382 /* DDC file contains one or more DDC structure which has 383 * Length (1 byte), DDC ID (2 bytes), and DDC value (Length - 2). 384 */ 385 while (fw->size > fw_ptr - fw->data) { 386 u8 cmd_plen = fw_ptr[0] + sizeof(u8); 387 388 skb = __hci_cmd_sync(hdev, 0xfc8b, cmd_plen, fw_ptr, 389 HCI_INIT_TIMEOUT); 390 if (IS_ERR(skb)) { 391 bt_dev_err(hdev, "Failed to send Intel_Write_DDC (%ld)", 392 PTR_ERR(skb)); 393 release_firmware(fw); 394 return PTR_ERR(skb); 395 } 396 397 fw_ptr += cmd_plen; 398 kfree_skb(skb); 399 } 400 401 release_firmware(fw); 402 403 bt_dev_info(hdev, "Applying Intel DDC parameters completed"); 404 405 return 0; 406 } 407 EXPORT_SYMBOL_GPL(btintel_load_ddc_config); 408 409 int btintel_set_event_mask_mfg(struct hci_dev *hdev, bool debug) 410 { 411 int err, ret; 412 413 err = btintel_enter_mfg(hdev); 414 if (err) 415 return err; 416 417 ret = btintel_set_event_mask(hdev, debug); 418 419 err = btintel_exit_mfg(hdev, false, false); 420 if (err) 421 return err; 422 423 return ret; 424 } 425 EXPORT_SYMBOL_GPL(btintel_set_event_mask_mfg); 426 427 int btintel_read_version(struct hci_dev *hdev, struct intel_version *ver) 428 { 429 struct sk_buff *skb; 430 431 skb = __hci_cmd_sync(hdev, 0xfc05, 0, NULL, HCI_CMD_TIMEOUT); 432 if (IS_ERR(skb)) { 433 bt_dev_err(hdev, "Reading Intel version information failed (%ld)", 434 PTR_ERR(skb)); 435 return PTR_ERR(skb); 436 } 437 438 if (!skb || skb->len != sizeof(*ver)) { 439 bt_dev_err(hdev, "Intel version event size mismatch"); 440 kfree_skb(skb); 441 return -EILSEQ; 442 } 443 444 memcpy(ver, skb->data, sizeof(*ver)); 445 446 kfree_skb(skb); 447 448 return 0; 449 } 450 EXPORT_SYMBOL_GPL(btintel_read_version); 451 452 int btintel_version_info_tlv(struct hci_dev *hdev, 453 struct intel_version_tlv *version) 454 { 455 const char *variant; 456 457 /* The hardware platform number has a fixed value of 0x37 and 458 * for now only accept this single value. 459 */ 460 if (INTEL_HW_PLATFORM(version->cnvi_bt) != 0x37) { 461 bt_dev_err(hdev, "Unsupported Intel hardware platform (0x%2x)", 462 INTEL_HW_PLATFORM(version->cnvi_bt)); 463 return -EINVAL; 464 } 465 466 /* Check for supported iBT hardware variants of this firmware 467 * loading method. 468 * 469 * This check has been put in place to ensure correct forward 470 * compatibility options when newer hardware variants come along. 471 */ 472 switch (INTEL_HW_VARIANT(version->cnvi_bt)) { 473 case 0x17: /* TyP */ 474 case 0x18: /* Slr */ 475 case 0x19: /* Slr-F */ 476 case 0x1b: /* Mgr */ 477 case 0x1c: /* Gale Peak (GaP) */ 478 case 0x1d: /* BlazarU (BzrU) */ 479 case 0x1e: /* BlazarI (Bzr) */ 480 break; 481 default: 482 bt_dev_err(hdev, "Unsupported Intel hardware variant (0x%x)", 483 INTEL_HW_VARIANT(version->cnvi_bt)); 484 return -EINVAL; 485 } 486 487 switch (version->img_type) { 488 case BTINTEL_IMG_BOOTLOADER: 489 variant = "Bootloader"; 490 /* It is required that every single firmware fragment is acknowledged 491 * with a command complete event. If the boot parameters indicate 492 * that this bootloader does not send them, then abort the setup. 493 */ 494 if (version->limited_cce != 0x00) { 495 bt_dev_err(hdev, "Unsupported Intel firmware loading method (0x%x)", 496 version->limited_cce); 497 return -EINVAL; 498 } 499 500 /* Secure boot engine type should be either 1 (ECDSA) or 0 (RSA) */ 501 if (version->sbe_type > 0x01) { 502 bt_dev_err(hdev, "Unsupported Intel secure boot engine type (0x%x)", 503 version->sbe_type); 504 return -EINVAL; 505 } 506 507 bt_dev_info(hdev, "Device revision is %u", version->dev_rev_id); 508 bt_dev_info(hdev, "Secure boot is %s", 509 version->secure_boot ? "enabled" : "disabled"); 510 bt_dev_info(hdev, "OTP lock is %s", 511 version->otp_lock ? "enabled" : "disabled"); 512 bt_dev_info(hdev, "API lock is %s", 513 version->api_lock ? "enabled" : "disabled"); 514 bt_dev_info(hdev, "Debug lock is %s", 515 version->debug_lock ? "enabled" : "disabled"); 516 bt_dev_info(hdev, "Minimum firmware build %u week %u %u", 517 version->min_fw_build_nn, version->min_fw_build_cw, 518 2000 + version->min_fw_build_yy); 519 break; 520 case BTINTEL_IMG_IML: 521 variant = "Intermediate loader"; 522 break; 523 case BTINTEL_IMG_OP: 524 variant = "Firmware"; 525 break; 526 default: 527 bt_dev_err(hdev, "Unsupported image type(%02x)", version->img_type); 528 return -EINVAL; 529 } 530 531 coredump_info.hw_variant = INTEL_HW_VARIANT(version->cnvi_bt); 532 coredump_info.fw_build_num = version->build_num; 533 534 bt_dev_info(hdev, "%s timestamp %u.%u buildtype %u build %u", variant, 535 2000 + (version->timestamp >> 8), version->timestamp & 0xff, 536 version->build_type, version->build_num); 537 if (version->img_type == BTINTEL_IMG_OP) 538 bt_dev_info(hdev, "Firmware SHA1: 0x%8.8x", version->git_sha1); 539 540 return 0; 541 } 542 EXPORT_SYMBOL_GPL(btintel_version_info_tlv); 543 544 int btintel_parse_version_tlv(struct hci_dev *hdev, 545 struct intel_version_tlv *version, 546 struct sk_buff *skb) 547 { 548 /* Consume Command Complete Status field */ 549 skb_pull(skb, 1); 550 551 /* Event parameters contatin multiple TLVs. Read each of them 552 * and only keep the required data. Also, it use existing legacy 553 * version field like hw_platform, hw_variant, and fw_variant 554 * to keep the existing setup flow 555 */ 556 while (skb->len) { 557 struct intel_tlv *tlv; 558 559 /* Make sure skb has a minimum length of the header */ 560 if (skb->len < sizeof(*tlv)) 561 return -EINVAL; 562 563 tlv = (struct intel_tlv *)skb->data; 564 565 /* Make sure skb has a enough data */ 566 if (skb->len < tlv->len + sizeof(*tlv)) 567 return -EINVAL; 568 569 switch (tlv->type) { 570 case INTEL_TLV_CNVI_TOP: 571 version->cnvi_top = get_unaligned_le32(tlv->val); 572 break; 573 case INTEL_TLV_CNVR_TOP: 574 version->cnvr_top = get_unaligned_le32(tlv->val); 575 break; 576 case INTEL_TLV_CNVI_BT: 577 version->cnvi_bt = get_unaligned_le32(tlv->val); 578 break; 579 case INTEL_TLV_CNVR_BT: 580 version->cnvr_bt = get_unaligned_le32(tlv->val); 581 break; 582 case INTEL_TLV_DEV_REV_ID: 583 version->dev_rev_id = get_unaligned_le16(tlv->val); 584 break; 585 case INTEL_TLV_IMAGE_TYPE: 586 version->img_type = tlv->val[0]; 587 break; 588 case INTEL_TLV_TIME_STAMP: 589 /* If image type is Operational firmware (0x03), then 590 * running FW Calendar Week and Year information can 591 * be extracted from Timestamp information 592 */ 593 version->min_fw_build_cw = tlv->val[0]; 594 version->min_fw_build_yy = tlv->val[1]; 595 version->timestamp = get_unaligned_le16(tlv->val); 596 break; 597 case INTEL_TLV_BUILD_TYPE: 598 version->build_type = tlv->val[0]; 599 break; 600 case INTEL_TLV_BUILD_NUM: 601 /* If image type is Operational firmware (0x03), then 602 * running FW build number can be extracted from the 603 * Build information 604 */ 605 version->min_fw_build_nn = tlv->val[0]; 606 version->build_num = get_unaligned_le32(tlv->val); 607 break; 608 case INTEL_TLV_SECURE_BOOT: 609 version->secure_boot = tlv->val[0]; 610 break; 611 case INTEL_TLV_OTP_LOCK: 612 version->otp_lock = tlv->val[0]; 613 break; 614 case INTEL_TLV_API_LOCK: 615 version->api_lock = tlv->val[0]; 616 break; 617 case INTEL_TLV_DEBUG_LOCK: 618 version->debug_lock = tlv->val[0]; 619 break; 620 case INTEL_TLV_MIN_FW: 621 version->min_fw_build_nn = tlv->val[0]; 622 version->min_fw_build_cw = tlv->val[1]; 623 version->min_fw_build_yy = tlv->val[2]; 624 break; 625 case INTEL_TLV_LIMITED_CCE: 626 version->limited_cce = tlv->val[0]; 627 break; 628 case INTEL_TLV_SBE_TYPE: 629 version->sbe_type = tlv->val[0]; 630 break; 631 case INTEL_TLV_OTP_BDADDR: 632 memcpy(&version->otp_bd_addr, tlv->val, 633 sizeof(bdaddr_t)); 634 break; 635 case INTEL_TLV_GIT_SHA1: 636 version->git_sha1 = get_unaligned_le32(tlv->val); 637 break; 638 case INTEL_TLV_FW_ID: 639 snprintf(version->fw_id, sizeof(version->fw_id), 640 "%s", tlv->val); 641 break; 642 default: 643 /* Ignore rest of information */ 644 break; 645 } 646 /* consume the current tlv and move to next*/ 647 skb_pull(skb, tlv->len + sizeof(*tlv)); 648 } 649 650 return 0; 651 } 652 EXPORT_SYMBOL_GPL(btintel_parse_version_tlv); 653 654 static int btintel_read_version_tlv(struct hci_dev *hdev, 655 struct intel_version_tlv *version) 656 { 657 struct sk_buff *skb; 658 const u8 param[1] = { 0xFF }; 659 660 if (!version) 661 return -EINVAL; 662 663 skb = __hci_cmd_sync(hdev, 0xfc05, 1, param, HCI_CMD_TIMEOUT); 664 if (IS_ERR(skb)) { 665 bt_dev_err(hdev, "Reading Intel version information failed (%ld)", 666 PTR_ERR(skb)); 667 return PTR_ERR(skb); 668 } 669 670 if (skb->data[0]) { 671 bt_dev_err(hdev, "Intel Read Version command failed (%02x)", 672 skb->data[0]); 673 kfree_skb(skb); 674 return -EIO; 675 } 676 677 btintel_parse_version_tlv(hdev, version, skb); 678 679 kfree_skb(skb); 680 return 0; 681 } 682 683 /* ------- REGMAP IBT SUPPORT ------- */ 684 685 #define IBT_REG_MODE_8BIT 0x00 686 #define IBT_REG_MODE_16BIT 0x01 687 #define IBT_REG_MODE_32BIT 0x02 688 689 struct regmap_ibt_context { 690 struct hci_dev *hdev; 691 __u16 op_write; 692 __u16 op_read; 693 }; 694 695 struct ibt_cp_reg_access { 696 __le32 addr; 697 __u8 mode; 698 __u8 len; 699 __u8 data[]; 700 } __packed; 701 702 struct ibt_rp_reg_access { 703 __u8 status; 704 __le32 addr; 705 __u8 data[]; 706 } __packed; 707 708 static int regmap_ibt_read(void *context, const void *addr, size_t reg_size, 709 void *val, size_t val_size) 710 { 711 struct regmap_ibt_context *ctx = context; 712 struct ibt_cp_reg_access cp; 713 struct ibt_rp_reg_access *rp; 714 struct sk_buff *skb; 715 int err = 0; 716 717 if (reg_size != sizeof(__le32)) 718 return -EINVAL; 719 720 switch (val_size) { 721 case 1: 722 cp.mode = IBT_REG_MODE_8BIT; 723 break; 724 case 2: 725 cp.mode = IBT_REG_MODE_16BIT; 726 break; 727 case 4: 728 cp.mode = IBT_REG_MODE_32BIT; 729 break; 730 default: 731 return -EINVAL; 732 } 733 734 /* regmap provides a little-endian formatted addr */ 735 cp.addr = *(__le32 *)addr; 736 cp.len = val_size; 737 738 bt_dev_dbg(ctx->hdev, "Register (0x%x) read", le32_to_cpu(cp.addr)); 739 740 skb = hci_cmd_sync(ctx->hdev, ctx->op_read, sizeof(cp), &cp, 741 HCI_CMD_TIMEOUT); 742 if (IS_ERR(skb)) { 743 err = PTR_ERR(skb); 744 bt_dev_err(ctx->hdev, "regmap: Register (0x%x) read error (%d)", 745 le32_to_cpu(cp.addr), err); 746 return err; 747 } 748 749 if (skb->len != sizeof(*rp) + val_size) { 750 bt_dev_err(ctx->hdev, "regmap: Register (0x%x) read error, bad len", 751 le32_to_cpu(cp.addr)); 752 err = -EINVAL; 753 goto done; 754 } 755 756 rp = (struct ibt_rp_reg_access *)skb->data; 757 758 if (rp->addr != cp.addr) { 759 bt_dev_err(ctx->hdev, "regmap: Register (0x%x) read error, bad addr", 760 le32_to_cpu(rp->addr)); 761 err = -EINVAL; 762 goto done; 763 } 764 765 memcpy(val, rp->data, val_size); 766 767 done: 768 kfree_skb(skb); 769 return err; 770 } 771 772 static int regmap_ibt_gather_write(void *context, 773 const void *addr, size_t reg_size, 774 const void *val, size_t val_size) 775 { 776 struct regmap_ibt_context *ctx = context; 777 struct ibt_cp_reg_access *cp; 778 struct sk_buff *skb; 779 int plen = sizeof(*cp) + val_size; 780 u8 mode; 781 int err = 0; 782 783 if (reg_size != sizeof(__le32)) 784 return -EINVAL; 785 786 switch (val_size) { 787 case 1: 788 mode = IBT_REG_MODE_8BIT; 789 break; 790 case 2: 791 mode = IBT_REG_MODE_16BIT; 792 break; 793 case 4: 794 mode = IBT_REG_MODE_32BIT; 795 break; 796 default: 797 return -EINVAL; 798 } 799 800 cp = kmalloc(plen, GFP_KERNEL); 801 if (!cp) 802 return -ENOMEM; 803 804 /* regmap provides a little-endian formatted addr/value */ 805 cp->addr = *(__le32 *)addr; 806 cp->mode = mode; 807 cp->len = val_size; 808 memcpy(&cp->data, val, val_size); 809 810 bt_dev_dbg(ctx->hdev, "Register (0x%x) write", le32_to_cpu(cp->addr)); 811 812 skb = hci_cmd_sync(ctx->hdev, ctx->op_write, plen, cp, HCI_CMD_TIMEOUT); 813 if (IS_ERR(skb)) { 814 err = PTR_ERR(skb); 815 bt_dev_err(ctx->hdev, "regmap: Register (0x%x) write error (%d)", 816 le32_to_cpu(cp->addr), err); 817 goto done; 818 } 819 kfree_skb(skb); 820 821 done: 822 kfree(cp); 823 return err; 824 } 825 826 static int regmap_ibt_write(void *context, const void *data, size_t count) 827 { 828 /* data contains register+value, since we only support 32bit addr, 829 * minimum data size is 4 bytes. 830 */ 831 if (WARN_ONCE(count < 4, "Invalid register access")) 832 return -EINVAL; 833 834 return regmap_ibt_gather_write(context, data, 4, data + 4, count - 4); 835 } 836 837 static void regmap_ibt_free_context(void *context) 838 { 839 kfree(context); 840 } 841 842 static const struct regmap_bus regmap_ibt = { 843 .read = regmap_ibt_read, 844 .write = regmap_ibt_write, 845 .gather_write = regmap_ibt_gather_write, 846 .free_context = regmap_ibt_free_context, 847 .reg_format_endian_default = REGMAP_ENDIAN_LITTLE, 848 .val_format_endian_default = REGMAP_ENDIAN_LITTLE, 849 }; 850 851 /* Config is the same for all register regions */ 852 static const struct regmap_config regmap_ibt_cfg = { 853 .name = "btintel_regmap", 854 .reg_bits = 32, 855 .val_bits = 32, 856 }; 857 858 struct regmap *btintel_regmap_init(struct hci_dev *hdev, u16 opcode_read, 859 u16 opcode_write) 860 { 861 struct regmap_ibt_context *ctx; 862 863 bt_dev_info(hdev, "regmap: Init R%x-W%x region", opcode_read, 864 opcode_write); 865 866 ctx = kzalloc(sizeof(*ctx), GFP_KERNEL); 867 if (!ctx) 868 return ERR_PTR(-ENOMEM); 869 870 ctx->op_read = opcode_read; 871 ctx->op_write = opcode_write; 872 ctx->hdev = hdev; 873 874 return regmap_init(&hdev->dev, ®map_ibt, ctx, ®map_ibt_cfg); 875 } 876 EXPORT_SYMBOL_GPL(btintel_regmap_init); 877 878 int btintel_send_intel_reset(struct hci_dev *hdev, u32 boot_param) 879 { 880 struct intel_reset params = { 0x00, 0x01, 0x00, 0x01, 0x00000000 }; 881 struct sk_buff *skb; 882 883 params.boot_param = cpu_to_le32(boot_param); 884 885 skb = __hci_cmd_sync(hdev, 0xfc01, sizeof(params), ¶ms, 886 HCI_INIT_TIMEOUT); 887 if (IS_ERR(skb)) { 888 bt_dev_err(hdev, "Failed to send Intel Reset command"); 889 return PTR_ERR(skb); 890 } 891 892 kfree_skb(skb); 893 894 return 0; 895 } 896 EXPORT_SYMBOL_GPL(btintel_send_intel_reset); 897 898 int btintel_read_boot_params(struct hci_dev *hdev, 899 struct intel_boot_params *params) 900 { 901 struct sk_buff *skb; 902 903 skb = __hci_cmd_sync(hdev, 0xfc0d, 0, NULL, HCI_INIT_TIMEOUT); 904 if (IS_ERR(skb)) { 905 bt_dev_err(hdev, "Reading Intel boot parameters failed (%ld)", 906 PTR_ERR(skb)); 907 return PTR_ERR(skb); 908 } 909 910 if (skb->len != sizeof(*params)) { 911 bt_dev_err(hdev, "Intel boot parameters size mismatch"); 912 kfree_skb(skb); 913 return -EILSEQ; 914 } 915 916 memcpy(params, skb->data, sizeof(*params)); 917 918 kfree_skb(skb); 919 920 if (params->status) { 921 bt_dev_err(hdev, "Intel boot parameters command failed (%02x)", 922 params->status); 923 return -bt_to_errno(params->status); 924 } 925 926 bt_dev_info(hdev, "Device revision is %u", 927 le16_to_cpu(params->dev_revid)); 928 929 bt_dev_info(hdev, "Secure boot is %s", 930 params->secure_boot ? "enabled" : "disabled"); 931 932 bt_dev_info(hdev, "OTP lock is %s", 933 params->otp_lock ? "enabled" : "disabled"); 934 935 bt_dev_info(hdev, "API lock is %s", 936 params->api_lock ? "enabled" : "disabled"); 937 938 bt_dev_info(hdev, "Debug lock is %s", 939 params->debug_lock ? "enabled" : "disabled"); 940 941 bt_dev_info(hdev, "Minimum firmware build %u week %u %u", 942 params->min_fw_build_nn, params->min_fw_build_cw, 943 2000 + params->min_fw_build_yy); 944 945 return 0; 946 } 947 EXPORT_SYMBOL_GPL(btintel_read_boot_params); 948 949 static int btintel_sfi_rsa_header_secure_send(struct hci_dev *hdev, 950 const struct firmware *fw) 951 { 952 int err; 953 954 /* Start the firmware download transaction with the Init fragment 955 * represented by the 128 bytes of CSS header. 956 */ 957 err = btintel_secure_send(hdev, 0x00, 128, fw->data); 958 if (err < 0) { 959 bt_dev_err(hdev, "Failed to send firmware header (%d)", err); 960 goto done; 961 } 962 963 /* Send the 256 bytes of public key information from the firmware 964 * as the PKey fragment. 965 */ 966 err = btintel_secure_send(hdev, 0x03, 256, fw->data + 128); 967 if (err < 0) { 968 bt_dev_err(hdev, "Failed to send firmware pkey (%d)", err); 969 goto done; 970 } 971 972 /* Send the 256 bytes of signature information from the firmware 973 * as the Sign fragment. 974 */ 975 err = btintel_secure_send(hdev, 0x02, 256, fw->data + 388); 976 if (err < 0) { 977 bt_dev_err(hdev, "Failed to send firmware signature (%d)", err); 978 goto done; 979 } 980 981 done: 982 return err; 983 } 984 985 static int btintel_sfi_ecdsa_header_secure_send(struct hci_dev *hdev, 986 const struct firmware *fw) 987 { 988 int err; 989 990 /* Start the firmware download transaction with the Init fragment 991 * represented by the 128 bytes of CSS header. 992 */ 993 err = btintel_secure_send(hdev, 0x00, 128, fw->data + 644); 994 if (err < 0) { 995 bt_dev_err(hdev, "Failed to send firmware header (%d)", err); 996 return err; 997 } 998 999 /* Send the 96 bytes of public key information from the firmware 1000 * as the PKey fragment. 1001 */ 1002 err = btintel_secure_send(hdev, 0x03, 96, fw->data + 644 + 128); 1003 if (err < 0) { 1004 bt_dev_err(hdev, "Failed to send firmware pkey (%d)", err); 1005 return err; 1006 } 1007 1008 /* Send the 96 bytes of signature information from the firmware 1009 * as the Sign fragment 1010 */ 1011 err = btintel_secure_send(hdev, 0x02, 96, fw->data + 644 + 224); 1012 if (err < 0) { 1013 bt_dev_err(hdev, "Failed to send firmware signature (%d)", 1014 err); 1015 return err; 1016 } 1017 return 0; 1018 } 1019 1020 static int btintel_download_firmware_payload(struct hci_dev *hdev, 1021 const struct firmware *fw, 1022 size_t offset) 1023 { 1024 int err; 1025 const u8 *fw_ptr; 1026 u32 frag_len; 1027 1028 fw_ptr = fw->data + offset; 1029 frag_len = 0; 1030 err = -EINVAL; 1031 1032 while (fw_ptr - fw->data < fw->size) { 1033 struct hci_command_hdr *cmd = (void *)(fw_ptr + frag_len); 1034 1035 frag_len += sizeof(*cmd) + cmd->plen; 1036 1037 /* The parameter length of the secure send command requires 1038 * a 4 byte alignment. It happens so that the firmware file 1039 * contains proper Intel_NOP commands to align the fragments 1040 * as needed. 1041 * 1042 * Send set of commands with 4 byte alignment from the 1043 * firmware data buffer as a single Data fragement. 1044 */ 1045 if (!(frag_len % 4)) { 1046 err = btintel_secure_send(hdev, 0x01, frag_len, fw_ptr); 1047 if (err < 0) { 1048 bt_dev_err(hdev, 1049 "Failed to send firmware data (%d)", 1050 err); 1051 goto done; 1052 } 1053 1054 fw_ptr += frag_len; 1055 frag_len = 0; 1056 } 1057 } 1058 1059 done: 1060 return err; 1061 } 1062 1063 static bool btintel_firmware_version(struct hci_dev *hdev, 1064 u8 num, u8 ww, u8 yy, 1065 const struct firmware *fw, 1066 u32 *boot_addr) 1067 { 1068 const u8 *fw_ptr; 1069 1070 fw_ptr = fw->data; 1071 1072 while (fw_ptr - fw->data < fw->size) { 1073 struct hci_command_hdr *cmd = (void *)(fw_ptr); 1074 1075 /* Each SKU has a different reset parameter to use in the 1076 * HCI_Intel_Reset command and it is embedded in the firmware 1077 * data. So, instead of using static value per SKU, check 1078 * the firmware data and save it for later use. 1079 */ 1080 if (le16_to_cpu(cmd->opcode) == CMD_WRITE_BOOT_PARAMS) { 1081 struct cmd_write_boot_params *params; 1082 1083 params = (void *)(fw_ptr + sizeof(*cmd)); 1084 1085 *boot_addr = le32_to_cpu(params->boot_addr); 1086 1087 bt_dev_info(hdev, "Boot Address: 0x%x", *boot_addr); 1088 1089 bt_dev_info(hdev, "Firmware Version: %u-%u.%u", 1090 params->fw_build_num, params->fw_build_ww, 1091 params->fw_build_yy); 1092 1093 return (num == params->fw_build_num && 1094 ww == params->fw_build_ww && 1095 yy == params->fw_build_yy); 1096 } 1097 1098 fw_ptr += sizeof(*cmd) + cmd->plen; 1099 } 1100 1101 return false; 1102 } 1103 1104 int btintel_download_firmware(struct hci_dev *hdev, 1105 struct intel_version *ver, 1106 const struct firmware *fw, 1107 u32 *boot_param) 1108 { 1109 int err; 1110 1111 /* SfP and WsP don't seem to update the firmware version on file 1112 * so version checking is currently not possible. 1113 */ 1114 switch (ver->hw_variant) { 1115 case 0x0b: /* SfP */ 1116 case 0x0c: /* WsP */ 1117 /* Skip version checking */ 1118 break; 1119 default: 1120 1121 /* Skip download if firmware has the same version */ 1122 if (btintel_firmware_version(hdev, ver->fw_build_num, 1123 ver->fw_build_ww, ver->fw_build_yy, 1124 fw, boot_param)) { 1125 bt_dev_info(hdev, "Firmware already loaded"); 1126 /* Return -EALREADY to indicate that the firmware has 1127 * already been loaded. 1128 */ 1129 return -EALREADY; 1130 } 1131 } 1132 1133 /* The firmware variant determines if the device is in bootloader 1134 * mode or is running operational firmware. The value 0x06 identifies 1135 * the bootloader and the value 0x23 identifies the operational 1136 * firmware. 1137 * 1138 * If the firmware version has changed that means it needs to be reset 1139 * to bootloader when operational so the new firmware can be loaded. 1140 */ 1141 if (ver->fw_variant == 0x23) 1142 return -EINVAL; 1143 1144 err = btintel_sfi_rsa_header_secure_send(hdev, fw); 1145 if (err) 1146 return err; 1147 1148 return btintel_download_firmware_payload(hdev, fw, RSA_HEADER_LEN); 1149 } 1150 EXPORT_SYMBOL_GPL(btintel_download_firmware); 1151 1152 static int btintel_download_fw_tlv(struct hci_dev *hdev, 1153 struct intel_version_tlv *ver, 1154 const struct firmware *fw, u32 *boot_param, 1155 u8 hw_variant, u8 sbe_type) 1156 { 1157 int err; 1158 u32 css_header_ver; 1159 1160 /* Skip download if firmware has the same version */ 1161 if (btintel_firmware_version(hdev, ver->min_fw_build_nn, 1162 ver->min_fw_build_cw, 1163 ver->min_fw_build_yy, 1164 fw, boot_param)) { 1165 bt_dev_info(hdev, "Firmware already loaded"); 1166 /* Return -EALREADY to indicate that firmware has 1167 * already been loaded. 1168 */ 1169 return -EALREADY; 1170 } 1171 1172 /* The firmware variant determines if the device is in bootloader 1173 * mode or is running operational firmware. The value 0x01 identifies 1174 * the bootloader and the value 0x03 identifies the operational 1175 * firmware. 1176 * 1177 * If the firmware version has changed that means it needs to be reset 1178 * to bootloader when operational so the new firmware can be loaded. 1179 */ 1180 if (ver->img_type == BTINTEL_IMG_OP) 1181 return -EINVAL; 1182 1183 /* iBT hardware variants 0x0b, 0x0c, 0x11, 0x12, 0x13, 0x14 support 1184 * only RSA secure boot engine. Hence, the corresponding sfi file will 1185 * have RSA header of 644 bytes followed by Command Buffer. 1186 * 1187 * iBT hardware variants 0x17, 0x18 onwards support both RSA and ECDSA 1188 * secure boot engine. As a result, the corresponding sfi file will 1189 * have RSA header of 644, ECDSA header of 320 bytes followed by 1190 * Command Buffer. 1191 * 1192 * CSS Header byte positions 0x08 to 0x0B represent the CSS Header 1193 * version: RSA(0x00010000) , ECDSA (0x00020000) 1194 */ 1195 css_header_ver = get_unaligned_le32(fw->data + CSS_HEADER_OFFSET); 1196 if (css_header_ver != 0x00010000) { 1197 bt_dev_err(hdev, "Invalid CSS Header version"); 1198 return -EINVAL; 1199 } 1200 1201 if (hw_variant <= 0x14) { 1202 if (sbe_type != 0x00) { 1203 bt_dev_err(hdev, "Invalid SBE type for hardware variant (%d)", 1204 hw_variant); 1205 return -EINVAL; 1206 } 1207 1208 err = btintel_sfi_rsa_header_secure_send(hdev, fw); 1209 if (err) 1210 return err; 1211 1212 err = btintel_download_firmware_payload(hdev, fw, RSA_HEADER_LEN); 1213 if (err) 1214 return err; 1215 } else if (hw_variant >= 0x17) { 1216 /* Check if CSS header for ECDSA follows the RSA header */ 1217 if (fw->data[ECDSA_OFFSET] != 0x06) 1218 return -EINVAL; 1219 1220 /* Check if the CSS Header version is ECDSA(0x00020000) */ 1221 css_header_ver = get_unaligned_le32(fw->data + ECDSA_OFFSET + CSS_HEADER_OFFSET); 1222 if (css_header_ver != 0x00020000) { 1223 bt_dev_err(hdev, "Invalid CSS Header version"); 1224 return -EINVAL; 1225 } 1226 1227 if (sbe_type == 0x00) { 1228 err = btintel_sfi_rsa_header_secure_send(hdev, fw); 1229 if (err) 1230 return err; 1231 1232 err = btintel_download_firmware_payload(hdev, fw, 1233 RSA_HEADER_LEN + ECDSA_HEADER_LEN); 1234 if (err) 1235 return err; 1236 } else if (sbe_type == 0x01) { 1237 err = btintel_sfi_ecdsa_header_secure_send(hdev, fw); 1238 if (err) 1239 return err; 1240 1241 err = btintel_download_firmware_payload(hdev, fw, 1242 RSA_HEADER_LEN + ECDSA_HEADER_LEN); 1243 if (err) 1244 return err; 1245 } 1246 } 1247 return 0; 1248 } 1249 1250 static void btintel_reset_to_bootloader(struct hci_dev *hdev) 1251 { 1252 struct intel_reset params; 1253 struct sk_buff *skb; 1254 1255 /* Send Intel Reset command. This will result in 1256 * re-enumeration of BT controller. 1257 * 1258 * Intel Reset parameter description: 1259 * reset_type : 0x00 (Soft reset), 1260 * 0x01 (Hard reset) 1261 * patch_enable : 0x00 (Do not enable), 1262 * 0x01 (Enable) 1263 * ddc_reload : 0x00 (Do not reload), 1264 * 0x01 (Reload) 1265 * boot_option: 0x00 (Current image), 1266 * 0x01 (Specified boot address) 1267 * boot_param: Boot address 1268 * 1269 */ 1270 params.reset_type = 0x01; 1271 params.patch_enable = 0x01; 1272 params.ddc_reload = 0x01; 1273 params.boot_option = 0x00; 1274 params.boot_param = cpu_to_le32(0x00000000); 1275 1276 skb = __hci_cmd_sync(hdev, 0xfc01, sizeof(params), 1277 ¶ms, HCI_INIT_TIMEOUT); 1278 if (IS_ERR(skb)) { 1279 bt_dev_err(hdev, "FW download error recovery failed (%ld)", 1280 PTR_ERR(skb)); 1281 return; 1282 } 1283 bt_dev_info(hdev, "Intel reset sent to retry FW download"); 1284 kfree_skb(skb); 1285 1286 /* Current Intel BT controllers(ThP/JfP) hold the USB reset 1287 * lines for 2ms when it receives Intel Reset in bootloader mode. 1288 * Whereas, the upcoming Intel BT controllers will hold USB reset 1289 * for 150ms. To keep the delay generic, 150ms is chosen here. 1290 */ 1291 msleep(150); 1292 } 1293 1294 static int btintel_read_debug_features(struct hci_dev *hdev, 1295 struct intel_debug_features *features) 1296 { 1297 struct sk_buff *skb; 1298 u8 page_no = 1; 1299 1300 /* Intel controller supports two pages, each page is of 128-bit 1301 * feature bit mask. And each bit defines specific feature support 1302 */ 1303 skb = __hci_cmd_sync(hdev, 0xfca6, sizeof(page_no), &page_no, 1304 HCI_INIT_TIMEOUT); 1305 if (IS_ERR(skb)) { 1306 bt_dev_err(hdev, "Reading supported features failed (%ld)", 1307 PTR_ERR(skb)); 1308 return PTR_ERR(skb); 1309 } 1310 1311 if (skb->len != (sizeof(features->page1) + 3)) { 1312 bt_dev_err(hdev, "Supported features event size mismatch"); 1313 kfree_skb(skb); 1314 return -EILSEQ; 1315 } 1316 1317 memcpy(features->page1, skb->data + 3, sizeof(features->page1)); 1318 1319 /* Read the supported features page2 if required in future. 1320 */ 1321 kfree_skb(skb); 1322 return 0; 1323 } 1324 1325 static int btintel_set_debug_features(struct hci_dev *hdev, 1326 const struct intel_debug_features *features) 1327 { 1328 u8 mask[11] = { 0x0a, 0x92, 0x02, 0x7f, 0x00, 0x00, 0x00, 0x00, 1329 0x00, 0x00, 0x00 }; 1330 u8 period[5] = { 0x04, 0x91, 0x02, 0x05, 0x00 }; 1331 u8 trace_enable = 0x02; 1332 struct sk_buff *skb; 1333 1334 if (!features) { 1335 bt_dev_warn(hdev, "Debug features not read"); 1336 return -EINVAL; 1337 } 1338 1339 if (!(features->page1[0] & 0x3f)) { 1340 bt_dev_info(hdev, "Telemetry exception format not supported"); 1341 return 0; 1342 } 1343 1344 skb = __hci_cmd_sync(hdev, 0xfc8b, 11, mask, HCI_INIT_TIMEOUT); 1345 if (IS_ERR(skb)) { 1346 bt_dev_err(hdev, "Setting Intel telemetry ddc write event mask failed (%ld)", 1347 PTR_ERR(skb)); 1348 return PTR_ERR(skb); 1349 } 1350 kfree_skb(skb); 1351 1352 skb = __hci_cmd_sync(hdev, 0xfc8b, 5, period, HCI_INIT_TIMEOUT); 1353 if (IS_ERR(skb)) { 1354 bt_dev_err(hdev, "Setting periodicity for link statistics traces failed (%ld)", 1355 PTR_ERR(skb)); 1356 return PTR_ERR(skb); 1357 } 1358 kfree_skb(skb); 1359 1360 skb = __hci_cmd_sync(hdev, 0xfca1, 1, &trace_enable, HCI_INIT_TIMEOUT); 1361 if (IS_ERR(skb)) { 1362 bt_dev_err(hdev, "Enable tracing of link statistics events failed (%ld)", 1363 PTR_ERR(skb)); 1364 return PTR_ERR(skb); 1365 } 1366 kfree_skb(skb); 1367 1368 bt_dev_info(hdev, "set debug features: trace_enable 0x%02x mask 0x%02x", 1369 trace_enable, mask[3]); 1370 1371 return 0; 1372 } 1373 1374 static int btintel_reset_debug_features(struct hci_dev *hdev, 1375 const struct intel_debug_features *features) 1376 { 1377 u8 mask[11] = { 0x0a, 0x92, 0x02, 0x00, 0x00, 0x00, 0x00, 0x00, 1378 0x00, 0x00, 0x00 }; 1379 u8 trace_enable = 0x00; 1380 struct sk_buff *skb; 1381 1382 if (!features) { 1383 bt_dev_warn(hdev, "Debug features not read"); 1384 return -EINVAL; 1385 } 1386 1387 if (!(features->page1[0] & 0x3f)) { 1388 bt_dev_info(hdev, "Telemetry exception format not supported"); 1389 return 0; 1390 } 1391 1392 /* Should stop the trace before writing ddc event mask. */ 1393 skb = __hci_cmd_sync(hdev, 0xfca1, 1, &trace_enable, HCI_INIT_TIMEOUT); 1394 if (IS_ERR(skb)) { 1395 bt_dev_err(hdev, "Stop tracing of link statistics events failed (%ld)", 1396 PTR_ERR(skb)); 1397 return PTR_ERR(skb); 1398 } 1399 kfree_skb(skb); 1400 1401 skb = __hci_cmd_sync(hdev, 0xfc8b, 11, mask, HCI_INIT_TIMEOUT); 1402 if (IS_ERR(skb)) { 1403 bt_dev_err(hdev, "Setting Intel telemetry ddc write event mask failed (%ld)", 1404 PTR_ERR(skb)); 1405 return PTR_ERR(skb); 1406 } 1407 kfree_skb(skb); 1408 1409 bt_dev_info(hdev, "reset debug features: trace_enable 0x%02x mask 0x%02x", 1410 trace_enable, mask[3]); 1411 1412 return 0; 1413 } 1414 1415 int btintel_set_quality_report(struct hci_dev *hdev, bool enable) 1416 { 1417 struct intel_debug_features features; 1418 int err; 1419 1420 bt_dev_dbg(hdev, "enable %d", enable); 1421 1422 /* Read the Intel supported features and if new exception formats 1423 * supported, need to load the additional DDC config to enable. 1424 */ 1425 err = btintel_read_debug_features(hdev, &features); 1426 if (err) 1427 return err; 1428 1429 /* Set or reset the debug features. */ 1430 if (enable) 1431 err = btintel_set_debug_features(hdev, &features); 1432 else 1433 err = btintel_reset_debug_features(hdev, &features); 1434 1435 return err; 1436 } 1437 EXPORT_SYMBOL_GPL(btintel_set_quality_report); 1438 1439 static void btintel_coredump(struct hci_dev *hdev) 1440 { 1441 struct sk_buff *skb; 1442 1443 skb = __hci_cmd_sync(hdev, 0xfc4e, 0, NULL, HCI_CMD_TIMEOUT); 1444 if (IS_ERR(skb)) { 1445 bt_dev_err(hdev, "Coredump failed (%ld)", PTR_ERR(skb)); 1446 return; 1447 } 1448 1449 kfree_skb(skb); 1450 } 1451 1452 static void btintel_dmp_hdr(struct hci_dev *hdev, struct sk_buff *skb) 1453 { 1454 char buf[80]; 1455 1456 snprintf(buf, sizeof(buf), "Controller Name: 0x%X\n", 1457 coredump_info.hw_variant); 1458 skb_put_data(skb, buf, strlen(buf)); 1459 1460 snprintf(buf, sizeof(buf), "Firmware Version: 0x%X\n", 1461 coredump_info.fw_build_num); 1462 skb_put_data(skb, buf, strlen(buf)); 1463 1464 snprintf(buf, sizeof(buf), "Driver: %s\n", coredump_info.driver_name); 1465 skb_put_data(skb, buf, strlen(buf)); 1466 1467 snprintf(buf, sizeof(buf), "Vendor: Intel\n"); 1468 skb_put_data(skb, buf, strlen(buf)); 1469 } 1470 1471 static int btintel_register_devcoredump_support(struct hci_dev *hdev) 1472 { 1473 struct intel_debug_features features; 1474 int err; 1475 1476 err = btintel_read_debug_features(hdev, &features); 1477 if (err) { 1478 bt_dev_info(hdev, "Error reading debug features"); 1479 return err; 1480 } 1481 1482 if (!(features.page1[0] & 0x3f)) { 1483 bt_dev_dbg(hdev, "Telemetry exception format not supported"); 1484 return -EOPNOTSUPP; 1485 } 1486 1487 hci_devcd_register(hdev, btintel_coredump, btintel_dmp_hdr, NULL); 1488 1489 return err; 1490 } 1491 1492 static const struct firmware *btintel_legacy_rom_get_fw(struct hci_dev *hdev, 1493 struct intel_version *ver) 1494 { 1495 const struct firmware *fw; 1496 char fwname[64]; 1497 int ret; 1498 1499 snprintf(fwname, sizeof(fwname), 1500 "intel/ibt-hw-%x.%x.%x-fw-%x.%x.%x.%x.%x.bseq", 1501 ver->hw_platform, ver->hw_variant, ver->hw_revision, 1502 ver->fw_variant, ver->fw_revision, ver->fw_build_num, 1503 ver->fw_build_ww, ver->fw_build_yy); 1504 1505 ret = request_firmware(&fw, fwname, &hdev->dev); 1506 if (ret < 0) { 1507 if (ret == -EINVAL) { 1508 bt_dev_err(hdev, "Intel firmware file request failed (%d)", 1509 ret); 1510 return NULL; 1511 } 1512 1513 bt_dev_err(hdev, "failed to open Intel firmware file: %s (%d)", 1514 fwname, ret); 1515 1516 /* If the correct firmware patch file is not found, use the 1517 * default firmware patch file instead 1518 */ 1519 snprintf(fwname, sizeof(fwname), "intel/ibt-hw-%x.%x.bseq", 1520 ver->hw_platform, ver->hw_variant); 1521 if (request_firmware(&fw, fwname, &hdev->dev) < 0) { 1522 bt_dev_err(hdev, "failed to open default fw file: %s", 1523 fwname); 1524 return NULL; 1525 } 1526 } 1527 1528 bt_dev_info(hdev, "Intel Bluetooth firmware file: %s", fwname); 1529 1530 return fw; 1531 } 1532 1533 static int btintel_legacy_rom_patching(struct hci_dev *hdev, 1534 const struct firmware *fw, 1535 const u8 **fw_ptr, int *disable_patch) 1536 { 1537 struct sk_buff *skb; 1538 struct hci_command_hdr *cmd; 1539 const u8 *cmd_param; 1540 struct hci_event_hdr *evt = NULL; 1541 const u8 *evt_param = NULL; 1542 int remain = fw->size - (*fw_ptr - fw->data); 1543 1544 /* The first byte indicates the types of the patch command or event. 1545 * 0x01 means HCI command and 0x02 is HCI event. If the first bytes 1546 * in the current firmware buffer doesn't start with 0x01 or 1547 * the size of remain buffer is smaller than HCI command header, 1548 * the firmware file is corrupted and it should stop the patching 1549 * process. 1550 */ 1551 if (remain > HCI_COMMAND_HDR_SIZE && *fw_ptr[0] != 0x01) { 1552 bt_dev_err(hdev, "Intel fw corrupted: invalid cmd read"); 1553 return -EINVAL; 1554 } 1555 (*fw_ptr)++; 1556 remain--; 1557 1558 cmd = (struct hci_command_hdr *)(*fw_ptr); 1559 *fw_ptr += sizeof(*cmd); 1560 remain -= sizeof(*cmd); 1561 1562 /* Ensure that the remain firmware data is long enough than the length 1563 * of command parameter. If not, the firmware file is corrupted. 1564 */ 1565 if (remain < cmd->plen) { 1566 bt_dev_err(hdev, "Intel fw corrupted: invalid cmd len"); 1567 return -EFAULT; 1568 } 1569 1570 /* If there is a command that loads a patch in the firmware 1571 * file, then enable the patch upon success, otherwise just 1572 * disable the manufacturer mode, for example patch activation 1573 * is not required when the default firmware patch file is used 1574 * because there are no patch data to load. 1575 */ 1576 if (*disable_patch && le16_to_cpu(cmd->opcode) == 0xfc8e) 1577 *disable_patch = 0; 1578 1579 cmd_param = *fw_ptr; 1580 *fw_ptr += cmd->plen; 1581 remain -= cmd->plen; 1582 1583 /* This reads the expected events when the above command is sent to the 1584 * device. Some vendor commands expects more than one events, for 1585 * example command status event followed by vendor specific event. 1586 * For this case, it only keeps the last expected event. so the command 1587 * can be sent with __hci_cmd_sync_ev() which returns the sk_buff of 1588 * last expected event. 1589 */ 1590 while (remain > HCI_EVENT_HDR_SIZE && *fw_ptr[0] == 0x02) { 1591 (*fw_ptr)++; 1592 remain--; 1593 1594 evt = (struct hci_event_hdr *)(*fw_ptr); 1595 *fw_ptr += sizeof(*evt); 1596 remain -= sizeof(*evt); 1597 1598 if (remain < evt->plen) { 1599 bt_dev_err(hdev, "Intel fw corrupted: invalid evt len"); 1600 return -EFAULT; 1601 } 1602 1603 evt_param = *fw_ptr; 1604 *fw_ptr += evt->plen; 1605 remain -= evt->plen; 1606 } 1607 1608 /* Every HCI commands in the firmware file has its correspond event. 1609 * If event is not found or remain is smaller than zero, the firmware 1610 * file is corrupted. 1611 */ 1612 if (!evt || !evt_param || remain < 0) { 1613 bt_dev_err(hdev, "Intel fw corrupted: invalid evt read"); 1614 return -EFAULT; 1615 } 1616 1617 skb = __hci_cmd_sync_ev(hdev, le16_to_cpu(cmd->opcode), cmd->plen, 1618 cmd_param, evt->evt, HCI_INIT_TIMEOUT); 1619 if (IS_ERR(skb)) { 1620 bt_dev_err(hdev, "sending Intel patch command (0x%4.4x) failed (%ld)", 1621 cmd->opcode, PTR_ERR(skb)); 1622 return PTR_ERR(skb); 1623 } 1624 1625 /* It ensures that the returned event matches the event data read from 1626 * the firmware file. At fist, it checks the length and then 1627 * the contents of the event. 1628 */ 1629 if (skb->len != evt->plen) { 1630 bt_dev_err(hdev, "mismatch event length (opcode 0x%4.4x)", 1631 le16_to_cpu(cmd->opcode)); 1632 kfree_skb(skb); 1633 return -EFAULT; 1634 } 1635 1636 if (memcmp(skb->data, evt_param, evt->plen)) { 1637 bt_dev_err(hdev, "mismatch event parameter (opcode 0x%4.4x)", 1638 le16_to_cpu(cmd->opcode)); 1639 kfree_skb(skb); 1640 return -EFAULT; 1641 } 1642 kfree_skb(skb); 1643 1644 return 0; 1645 } 1646 1647 static int btintel_legacy_rom_setup(struct hci_dev *hdev, 1648 struct intel_version *ver) 1649 { 1650 const struct firmware *fw; 1651 const u8 *fw_ptr; 1652 int disable_patch, err; 1653 struct intel_version new_ver; 1654 1655 BT_DBG("%s", hdev->name); 1656 1657 /* fw_patch_num indicates the version of patch the device currently 1658 * have. If there is no patch data in the device, it is always 0x00. 1659 * So, if it is other than 0x00, no need to patch the device again. 1660 */ 1661 if (ver->fw_patch_num) { 1662 bt_dev_info(hdev, 1663 "Intel device is already patched. patch num: %02x", 1664 ver->fw_patch_num); 1665 goto complete; 1666 } 1667 1668 /* Opens the firmware patch file based on the firmware version read 1669 * from the controller. If it fails to open the matching firmware 1670 * patch file, it tries to open the default firmware patch file. 1671 * If no patch file is found, allow the device to operate without 1672 * a patch. 1673 */ 1674 fw = btintel_legacy_rom_get_fw(hdev, ver); 1675 if (!fw) 1676 goto complete; 1677 fw_ptr = fw->data; 1678 1679 /* Enable the manufacturer mode of the controller. 1680 * Only while this mode is enabled, the driver can download the 1681 * firmware patch data and configuration parameters. 1682 */ 1683 err = btintel_enter_mfg(hdev); 1684 if (err) { 1685 release_firmware(fw); 1686 return err; 1687 } 1688 1689 disable_patch = 1; 1690 1691 /* The firmware data file consists of list of Intel specific HCI 1692 * commands and its expected events. The first byte indicates the 1693 * type of the message, either HCI command or HCI event. 1694 * 1695 * It reads the command and its expected event from the firmware file, 1696 * and send to the controller. Once __hci_cmd_sync_ev() returns, 1697 * the returned event is compared with the event read from the firmware 1698 * file and it will continue until all the messages are downloaded to 1699 * the controller. 1700 * 1701 * Once the firmware patching is completed successfully, 1702 * the manufacturer mode is disabled with reset and activating the 1703 * downloaded patch. 1704 * 1705 * If the firmware patching fails, the manufacturer mode is 1706 * disabled with reset and deactivating the patch. 1707 * 1708 * If the default patch file is used, no reset is done when disabling 1709 * the manufacturer. 1710 */ 1711 while (fw->size > fw_ptr - fw->data) { 1712 int ret; 1713 1714 ret = btintel_legacy_rom_patching(hdev, fw, &fw_ptr, 1715 &disable_patch); 1716 if (ret < 0) 1717 goto exit_mfg_deactivate; 1718 } 1719 1720 release_firmware(fw); 1721 1722 if (disable_patch) 1723 goto exit_mfg_disable; 1724 1725 /* Patching completed successfully and disable the manufacturer mode 1726 * with reset and activate the downloaded firmware patches. 1727 */ 1728 err = btintel_exit_mfg(hdev, true, true); 1729 if (err) 1730 return err; 1731 1732 /* Need build number for downloaded fw patches in 1733 * every power-on boot 1734 */ 1735 err = btintel_read_version(hdev, &new_ver); 1736 if (err) 1737 return err; 1738 1739 bt_dev_info(hdev, "Intel BT fw patch 0x%02x completed & activated", 1740 new_ver.fw_patch_num); 1741 1742 goto complete; 1743 1744 exit_mfg_disable: 1745 /* Disable the manufacturer mode without reset */ 1746 err = btintel_exit_mfg(hdev, false, false); 1747 if (err) 1748 return err; 1749 1750 bt_dev_info(hdev, "Intel firmware patch completed"); 1751 1752 goto complete; 1753 1754 exit_mfg_deactivate: 1755 release_firmware(fw); 1756 1757 /* Patching failed. Disable the manufacturer mode with reset and 1758 * deactivate the downloaded firmware patches. 1759 */ 1760 err = btintel_exit_mfg(hdev, true, false); 1761 if (err) 1762 return err; 1763 1764 bt_dev_info(hdev, "Intel firmware patch completed and deactivated"); 1765 1766 complete: 1767 /* Set the event mask for Intel specific vendor events. This enables 1768 * a few extra events that are useful during general operation. 1769 */ 1770 btintel_set_event_mask_mfg(hdev, false); 1771 1772 btintel_check_bdaddr(hdev); 1773 1774 return 0; 1775 } 1776 1777 static int btintel_download_wait(struct hci_dev *hdev, ktime_t calltime, int msec) 1778 { 1779 ktime_t delta, rettime; 1780 unsigned long long duration; 1781 int err; 1782 1783 btintel_set_flag(hdev, INTEL_FIRMWARE_LOADED); 1784 1785 bt_dev_info(hdev, "Waiting for firmware download to complete"); 1786 1787 err = btintel_wait_on_flag_timeout(hdev, INTEL_DOWNLOADING, 1788 TASK_INTERRUPTIBLE, 1789 msecs_to_jiffies(msec)); 1790 if (err == -EINTR) { 1791 bt_dev_err(hdev, "Firmware loading interrupted"); 1792 return err; 1793 } 1794 1795 if (err) { 1796 bt_dev_err(hdev, "Firmware loading timeout"); 1797 return -ETIMEDOUT; 1798 } 1799 1800 if (btintel_test_flag(hdev, INTEL_FIRMWARE_FAILED)) { 1801 bt_dev_err(hdev, "Firmware loading failed"); 1802 return -ENOEXEC; 1803 } 1804 1805 rettime = ktime_get(); 1806 delta = ktime_sub(rettime, calltime); 1807 duration = (unsigned long long)ktime_to_ns(delta) >> 10; 1808 1809 bt_dev_info(hdev, "Firmware loaded in %llu usecs", duration); 1810 1811 return 0; 1812 } 1813 1814 static int btintel_boot_wait(struct hci_dev *hdev, ktime_t calltime, int msec) 1815 { 1816 ktime_t delta, rettime; 1817 unsigned long long duration; 1818 int err; 1819 1820 bt_dev_info(hdev, "Waiting for device to boot"); 1821 1822 err = btintel_wait_on_flag_timeout(hdev, INTEL_BOOTING, 1823 TASK_INTERRUPTIBLE, 1824 msecs_to_jiffies(msec)); 1825 if (err == -EINTR) { 1826 bt_dev_err(hdev, "Device boot interrupted"); 1827 return -EINTR; 1828 } 1829 1830 if (err) { 1831 bt_dev_err(hdev, "Device boot timeout"); 1832 return -ETIMEDOUT; 1833 } 1834 1835 rettime = ktime_get(); 1836 delta = ktime_sub(rettime, calltime); 1837 duration = (unsigned long long) ktime_to_ns(delta) >> 10; 1838 1839 bt_dev_info(hdev, "Device booted in %llu usecs", duration); 1840 1841 return 0; 1842 } 1843 1844 static int btintel_boot(struct hci_dev *hdev, u32 boot_addr) 1845 { 1846 ktime_t calltime; 1847 int err; 1848 1849 calltime = ktime_get(); 1850 1851 btintel_set_flag(hdev, INTEL_BOOTING); 1852 1853 err = btintel_send_intel_reset(hdev, boot_addr); 1854 if (err) { 1855 bt_dev_err(hdev, "Intel Soft Reset failed (%d)", err); 1856 btintel_reset_to_bootloader(hdev); 1857 return err; 1858 } 1859 1860 /* The bootloader will not indicate when the device is ready. This 1861 * is done by the operational firmware sending bootup notification. 1862 * 1863 * Booting into operational firmware should not take longer than 1864 * 1 second. However if that happens, then just fail the setup 1865 * since something went wrong. 1866 */ 1867 err = btintel_boot_wait(hdev, calltime, 1000); 1868 if (err == -ETIMEDOUT) 1869 btintel_reset_to_bootloader(hdev); 1870 1871 return err; 1872 } 1873 1874 static int btintel_get_fw_name(struct intel_version *ver, 1875 struct intel_boot_params *params, 1876 char *fw_name, size_t len, 1877 const char *suffix) 1878 { 1879 switch (ver->hw_variant) { 1880 case 0x0b: /* SfP */ 1881 case 0x0c: /* WsP */ 1882 snprintf(fw_name, len, "intel/ibt-%u-%u.%s", 1883 ver->hw_variant, 1884 le16_to_cpu(params->dev_revid), 1885 suffix); 1886 break; 1887 case 0x11: /* JfP */ 1888 case 0x12: /* ThP */ 1889 case 0x13: /* HrP */ 1890 case 0x14: /* CcP */ 1891 snprintf(fw_name, len, "intel/ibt-%u-%u-%u.%s", 1892 ver->hw_variant, 1893 ver->hw_revision, 1894 ver->fw_revision, 1895 suffix); 1896 break; 1897 default: 1898 return -EINVAL; 1899 } 1900 1901 return 0; 1902 } 1903 1904 static int btintel_download_fw(struct hci_dev *hdev, 1905 struct intel_version *ver, 1906 struct intel_boot_params *params, 1907 u32 *boot_param) 1908 { 1909 const struct firmware *fw; 1910 char fwname[64]; 1911 int err; 1912 ktime_t calltime; 1913 1914 if (!ver || !params) 1915 return -EINVAL; 1916 1917 /* The firmware variant determines if the device is in bootloader 1918 * mode or is running operational firmware. The value 0x06 identifies 1919 * the bootloader and the value 0x23 identifies the operational 1920 * firmware. 1921 * 1922 * When the operational firmware is already present, then only 1923 * the check for valid Bluetooth device address is needed. This 1924 * determines if the device will be added as configured or 1925 * unconfigured controller. 1926 * 1927 * It is not possible to use the Secure Boot Parameters in this 1928 * case since that command is only available in bootloader mode. 1929 */ 1930 if (ver->fw_variant == 0x23) { 1931 btintel_clear_flag(hdev, INTEL_BOOTLOADER); 1932 btintel_check_bdaddr(hdev); 1933 1934 /* SfP and WsP don't seem to update the firmware version on file 1935 * so version checking is currently possible. 1936 */ 1937 switch (ver->hw_variant) { 1938 case 0x0b: /* SfP */ 1939 case 0x0c: /* WsP */ 1940 return 0; 1941 } 1942 1943 /* Proceed to download to check if the version matches */ 1944 goto download; 1945 } 1946 1947 /* Read the secure boot parameters to identify the operating 1948 * details of the bootloader. 1949 */ 1950 err = btintel_read_boot_params(hdev, params); 1951 if (err) 1952 return err; 1953 1954 /* It is required that every single firmware fragment is acknowledged 1955 * with a command complete event. If the boot parameters indicate 1956 * that this bootloader does not send them, then abort the setup. 1957 */ 1958 if (params->limited_cce != 0x00) { 1959 bt_dev_err(hdev, "Unsupported Intel firmware loading method (%u)", 1960 params->limited_cce); 1961 return -EINVAL; 1962 } 1963 1964 /* If the OTP has no valid Bluetooth device address, then there will 1965 * also be no valid address for the operational firmware. 1966 */ 1967 if (!bacmp(¶ms->otp_bdaddr, BDADDR_ANY)) { 1968 bt_dev_info(hdev, "No device address configured"); 1969 set_bit(HCI_QUIRK_INVALID_BDADDR, &hdev->quirks); 1970 } 1971 1972 download: 1973 /* With this Intel bootloader only the hardware variant and device 1974 * revision information are used to select the right firmware for SfP 1975 * and WsP. 1976 * 1977 * The firmware filename is ibt-<hw_variant>-<dev_revid>.sfi. 1978 * 1979 * Currently the supported hardware variants are: 1980 * 11 (0x0b) for iBT3.0 (LnP/SfP) 1981 * 12 (0x0c) for iBT3.5 (WsP) 1982 * 1983 * For ThP/JfP and for future SKU's, the FW name varies based on HW 1984 * variant, HW revision and FW revision, as these are dependent on CNVi 1985 * and RF Combination. 1986 * 1987 * 17 (0x11) for iBT3.5 (JfP) 1988 * 18 (0x12) for iBT3.5 (ThP) 1989 * 1990 * The firmware file name for these will be 1991 * ibt-<hw_variant>-<hw_revision>-<fw_revision>.sfi. 1992 * 1993 */ 1994 err = btintel_get_fw_name(ver, params, fwname, sizeof(fwname), "sfi"); 1995 if (err < 0) { 1996 if (!btintel_test_flag(hdev, INTEL_BOOTLOADER)) { 1997 /* Firmware has already been loaded */ 1998 btintel_set_flag(hdev, INTEL_FIRMWARE_LOADED); 1999 return 0; 2000 } 2001 2002 bt_dev_err(hdev, "Unsupported Intel firmware naming"); 2003 return -EINVAL; 2004 } 2005 2006 err = firmware_request_nowarn(&fw, fwname, &hdev->dev); 2007 if (err < 0) { 2008 if (!btintel_test_flag(hdev, INTEL_BOOTLOADER)) { 2009 /* Firmware has already been loaded */ 2010 btintel_set_flag(hdev, INTEL_FIRMWARE_LOADED); 2011 return 0; 2012 } 2013 2014 bt_dev_err(hdev, "Failed to load Intel firmware file %s (%d)", 2015 fwname, err); 2016 return err; 2017 } 2018 2019 bt_dev_info(hdev, "Found device firmware: %s", fwname); 2020 2021 if (fw->size < 644) { 2022 bt_dev_err(hdev, "Invalid size of firmware file (%zu)", 2023 fw->size); 2024 err = -EBADF; 2025 goto done; 2026 } 2027 2028 calltime = ktime_get(); 2029 2030 btintel_set_flag(hdev, INTEL_DOWNLOADING); 2031 2032 /* Start firmware downloading and get boot parameter */ 2033 err = btintel_download_firmware(hdev, ver, fw, boot_param); 2034 if (err < 0) { 2035 if (err == -EALREADY) { 2036 /* Firmware has already been loaded */ 2037 btintel_set_flag(hdev, INTEL_FIRMWARE_LOADED); 2038 err = 0; 2039 goto done; 2040 } 2041 2042 /* When FW download fails, send Intel Reset to retry 2043 * FW download. 2044 */ 2045 btintel_reset_to_bootloader(hdev); 2046 goto done; 2047 } 2048 2049 /* Before switching the device into operational mode and with that 2050 * booting the loaded firmware, wait for the bootloader notification 2051 * that all fragments have been successfully received. 2052 * 2053 * When the event processing receives the notification, then the 2054 * INTEL_DOWNLOADING flag will be cleared. 2055 * 2056 * The firmware loading should not take longer than 5 seconds 2057 * and thus just timeout if that happens and fail the setup 2058 * of this device. 2059 */ 2060 err = btintel_download_wait(hdev, calltime, 5000); 2061 if (err == -ETIMEDOUT) 2062 btintel_reset_to_bootloader(hdev); 2063 2064 done: 2065 release_firmware(fw); 2066 return err; 2067 } 2068 2069 static int btintel_bootloader_setup(struct hci_dev *hdev, 2070 struct intel_version *ver) 2071 { 2072 struct intel_version new_ver; 2073 struct intel_boot_params params; 2074 u32 boot_param; 2075 char ddcname[64]; 2076 int err; 2077 2078 BT_DBG("%s", hdev->name); 2079 2080 /* Set the default boot parameter to 0x0 and it is updated to 2081 * SKU specific boot parameter after reading Intel_Write_Boot_Params 2082 * command while downloading the firmware. 2083 */ 2084 boot_param = 0x00000000; 2085 2086 btintel_set_flag(hdev, INTEL_BOOTLOADER); 2087 2088 err = btintel_download_fw(hdev, ver, ¶ms, &boot_param); 2089 if (err) 2090 return err; 2091 2092 /* controller is already having an operational firmware */ 2093 if (ver->fw_variant == 0x23) 2094 goto finish; 2095 2096 err = btintel_boot(hdev, boot_param); 2097 if (err) 2098 return err; 2099 2100 btintel_clear_flag(hdev, INTEL_BOOTLOADER); 2101 2102 err = btintel_get_fw_name(ver, ¶ms, ddcname, 2103 sizeof(ddcname), "ddc"); 2104 2105 if (err < 0) { 2106 bt_dev_err(hdev, "Unsupported Intel firmware naming"); 2107 } else { 2108 /* Once the device is running in operational mode, it needs to 2109 * apply the device configuration (DDC) parameters. 2110 * 2111 * The device can work without DDC parameters, so even if it 2112 * fails to load the file, no need to fail the setup. 2113 */ 2114 btintel_load_ddc_config(hdev, ddcname); 2115 } 2116 2117 hci_dev_clear_flag(hdev, HCI_QUALITY_REPORT); 2118 2119 /* Read the Intel version information after loading the FW */ 2120 err = btintel_read_version(hdev, &new_ver); 2121 if (err) 2122 return err; 2123 2124 btintel_version_info(hdev, &new_ver); 2125 2126 finish: 2127 /* Set the event mask for Intel specific vendor events. This enables 2128 * a few extra events that are useful during general operation. It 2129 * does not enable any debugging related events. 2130 * 2131 * The device will function correctly without these events enabled 2132 * and thus no need to fail the setup. 2133 */ 2134 btintel_set_event_mask(hdev, false); 2135 2136 return 0; 2137 } 2138 2139 static void btintel_get_fw_name_tlv(const struct intel_version_tlv *ver, 2140 char *fw_name, size_t len, 2141 const char *suffix) 2142 { 2143 const char *format; 2144 u32 cnvi, cnvr; 2145 2146 cnvi = INTEL_CNVX_TOP_PACK_SWAB(INTEL_CNVX_TOP_TYPE(ver->cnvi_top), 2147 INTEL_CNVX_TOP_STEP(ver->cnvi_top)); 2148 2149 cnvr = INTEL_CNVX_TOP_PACK_SWAB(INTEL_CNVX_TOP_TYPE(ver->cnvr_top), 2150 INTEL_CNVX_TOP_STEP(ver->cnvr_top)); 2151 2152 /* Only Blazar product supports downloading of intermediate loader 2153 * image 2154 */ 2155 if (INTEL_HW_VARIANT(ver->cnvi_bt) >= 0x1e) { 2156 u8 zero[BTINTEL_FWID_MAXLEN]; 2157 2158 if (ver->img_type == BTINTEL_IMG_BOOTLOADER) { 2159 format = "intel/ibt-%04x-%04x-iml.%s"; 2160 snprintf(fw_name, len, format, cnvi, cnvr, suffix); 2161 return; 2162 } 2163 2164 memset(zero, 0, sizeof(zero)); 2165 2166 /* ibt-<cnvi_top type+cnvi_top step>-<cnvr_top type+cnvr_top step-fw_id> */ 2167 if (memcmp(ver->fw_id, zero, sizeof(zero))) { 2168 format = "intel/ibt-%04x-%04x-%s.%s"; 2169 snprintf(fw_name, len, format, cnvi, cnvr, 2170 ver->fw_id, suffix); 2171 return; 2172 } 2173 /* If firmware id is not present, fallback to legacy naming 2174 * convention 2175 */ 2176 } 2177 /* Fallback to legacy naming convention for other controllers 2178 * ibt-<cnvi_top type+cnvi_top step>-<cnvr_top type+cnvr_top step> 2179 */ 2180 format = "intel/ibt-%04x-%04x.%s"; 2181 snprintf(fw_name, len, format, cnvi, cnvr, suffix); 2182 } 2183 2184 static void btintel_get_iml_tlv(const struct intel_version_tlv *ver, 2185 char *fw_name, size_t len, 2186 const char *suffix) 2187 { 2188 const char *format; 2189 u32 cnvi, cnvr; 2190 2191 cnvi = INTEL_CNVX_TOP_PACK_SWAB(INTEL_CNVX_TOP_TYPE(ver->cnvi_top), 2192 INTEL_CNVX_TOP_STEP(ver->cnvi_top)); 2193 2194 cnvr = INTEL_CNVX_TOP_PACK_SWAB(INTEL_CNVX_TOP_TYPE(ver->cnvr_top), 2195 INTEL_CNVX_TOP_STEP(ver->cnvr_top)); 2196 2197 format = "intel/ibt-%04x-%04x-iml.%s"; 2198 snprintf(fw_name, len, format, cnvi, cnvr, suffix); 2199 } 2200 2201 static int btintel_prepare_fw_download_tlv(struct hci_dev *hdev, 2202 struct intel_version_tlv *ver, 2203 u32 *boot_param) 2204 { 2205 const struct firmware *fw; 2206 char fwname[128]; 2207 int err; 2208 ktime_t calltime; 2209 2210 if (!ver || !boot_param) 2211 return -EINVAL; 2212 2213 /* The firmware variant determines if the device is in bootloader 2214 * mode or is running operational firmware. The value 0x03 identifies 2215 * the bootloader and the value 0x23 identifies the operational 2216 * firmware. 2217 * 2218 * When the operational firmware is already present, then only 2219 * the check for valid Bluetooth device address is needed. This 2220 * determines if the device will be added as configured or 2221 * unconfigured controller. 2222 * 2223 * It is not possible to use the Secure Boot Parameters in this 2224 * case since that command is only available in bootloader mode. 2225 */ 2226 if (ver->img_type == BTINTEL_IMG_OP) { 2227 btintel_clear_flag(hdev, INTEL_BOOTLOADER); 2228 btintel_check_bdaddr(hdev); 2229 } else { 2230 /* 2231 * Check for valid bd address in boot loader mode. Device 2232 * will be marked as unconfigured if empty bd address is 2233 * found. 2234 */ 2235 if (!bacmp(&ver->otp_bd_addr, BDADDR_ANY)) { 2236 bt_dev_info(hdev, "No device address configured"); 2237 set_bit(HCI_QUIRK_INVALID_BDADDR, &hdev->quirks); 2238 } 2239 } 2240 2241 if (ver->img_type == BTINTEL_IMG_OP) { 2242 /* Controller running OP image. In case of FW downgrade, 2243 * FWID TLV may not be present and driver may attempt to load 2244 * firmware image which doesn't exist. Lets compare the version 2245 * of IML image 2246 */ 2247 if (INTEL_HW_VARIANT(ver->cnvi_bt) >= 0x1e) 2248 btintel_get_iml_tlv(ver, fwname, sizeof(fwname), "sfi"); 2249 else 2250 btintel_get_fw_name_tlv(ver, fwname, sizeof(fwname), "sfi"); 2251 } else { 2252 btintel_get_fw_name_tlv(ver, fwname, sizeof(fwname), "sfi"); 2253 } 2254 2255 err = firmware_request_nowarn(&fw, fwname, &hdev->dev); 2256 if (err < 0) { 2257 if (!btintel_test_flag(hdev, INTEL_BOOTLOADER)) { 2258 /* Firmware has already been loaded */ 2259 btintel_set_flag(hdev, INTEL_FIRMWARE_LOADED); 2260 return 0; 2261 } 2262 2263 bt_dev_err(hdev, "Failed to load Intel firmware file %s (%d)", 2264 fwname, err); 2265 2266 return err; 2267 } 2268 2269 bt_dev_info(hdev, "Found device firmware: %s", fwname); 2270 2271 if (fw->size < 644) { 2272 bt_dev_err(hdev, "Invalid size of firmware file (%zu)", 2273 fw->size); 2274 err = -EBADF; 2275 goto done; 2276 } 2277 2278 calltime = ktime_get(); 2279 2280 btintel_set_flag(hdev, INTEL_DOWNLOADING); 2281 2282 /* Start firmware downloading and get boot parameter */ 2283 err = btintel_download_fw_tlv(hdev, ver, fw, boot_param, 2284 INTEL_HW_VARIANT(ver->cnvi_bt), 2285 ver->sbe_type); 2286 if (err < 0) { 2287 if (err == -EALREADY) { 2288 /* Firmware has already been loaded */ 2289 btintel_set_flag(hdev, INTEL_FIRMWARE_LOADED); 2290 err = 0; 2291 goto done; 2292 } 2293 2294 /* When FW download fails, send Intel Reset to retry 2295 * FW download. 2296 */ 2297 btintel_reset_to_bootloader(hdev); 2298 goto done; 2299 } 2300 2301 /* Before switching the device into operational mode and with that 2302 * booting the loaded firmware, wait for the bootloader notification 2303 * that all fragments have been successfully received. 2304 * 2305 * When the event processing receives the notification, then the 2306 * BTUSB_DOWNLOADING flag will be cleared. 2307 * 2308 * The firmware loading should not take longer than 5 seconds 2309 * and thus just timeout if that happens and fail the setup 2310 * of this device. 2311 */ 2312 err = btintel_download_wait(hdev, calltime, 5000); 2313 if (err == -ETIMEDOUT) 2314 btintel_reset_to_bootloader(hdev); 2315 2316 done: 2317 release_firmware(fw); 2318 return err; 2319 } 2320 2321 static int btintel_get_codec_config_data(struct hci_dev *hdev, 2322 __u8 link, struct bt_codec *codec, 2323 __u8 *ven_len, __u8 **ven_data) 2324 { 2325 int err = 0; 2326 2327 if (!ven_data || !ven_len) 2328 return -EINVAL; 2329 2330 *ven_len = 0; 2331 *ven_data = NULL; 2332 2333 if (link != ESCO_LINK) { 2334 bt_dev_err(hdev, "Invalid link type(%u)", link); 2335 return -EINVAL; 2336 } 2337 2338 *ven_data = kmalloc(sizeof(__u8), GFP_KERNEL); 2339 if (!*ven_data) { 2340 err = -ENOMEM; 2341 goto error; 2342 } 2343 2344 /* supports only CVSD and mSBC offload codecs */ 2345 switch (codec->id) { 2346 case 0x02: 2347 **ven_data = 0x00; 2348 break; 2349 case 0x05: 2350 **ven_data = 0x01; 2351 break; 2352 default: 2353 err = -EINVAL; 2354 bt_dev_err(hdev, "Invalid codec id(%u)", codec->id); 2355 goto error; 2356 } 2357 /* codec and its capabilities are pre-defined to ids 2358 * preset id = 0x00 represents CVSD codec with sampling rate 8K 2359 * preset id = 0x01 represents mSBC codec with sampling rate 16K 2360 */ 2361 *ven_len = sizeof(__u8); 2362 return err; 2363 2364 error: 2365 kfree(*ven_data); 2366 *ven_data = NULL; 2367 return err; 2368 } 2369 2370 static int btintel_get_data_path_id(struct hci_dev *hdev, __u8 *data_path_id) 2371 { 2372 /* Intel uses 1 as data path id for all the usecases */ 2373 *data_path_id = 1; 2374 return 0; 2375 } 2376 2377 static int btintel_configure_offload(struct hci_dev *hdev) 2378 { 2379 struct sk_buff *skb; 2380 int err = 0; 2381 struct intel_offload_use_cases *use_cases; 2382 2383 skb = __hci_cmd_sync(hdev, 0xfc86, 0, NULL, HCI_INIT_TIMEOUT); 2384 if (IS_ERR(skb)) { 2385 bt_dev_err(hdev, "Reading offload use cases failed (%ld)", 2386 PTR_ERR(skb)); 2387 return PTR_ERR(skb); 2388 } 2389 2390 if (skb->len < sizeof(*use_cases)) { 2391 err = -EIO; 2392 goto error; 2393 } 2394 2395 use_cases = (void *)skb->data; 2396 2397 if (use_cases->status) { 2398 err = -bt_to_errno(skb->data[0]); 2399 goto error; 2400 } 2401 2402 if (use_cases->preset[0] & 0x03) { 2403 hdev->get_data_path_id = btintel_get_data_path_id; 2404 hdev->get_codec_config_data = btintel_get_codec_config_data; 2405 } 2406 error: 2407 kfree_skb(skb); 2408 return err; 2409 } 2410 2411 static void btintel_set_ppag(struct hci_dev *hdev, struct intel_version_tlv *ver) 2412 { 2413 struct sk_buff *skb; 2414 struct hci_ppag_enable_cmd ppag_cmd; 2415 acpi_handle handle; 2416 struct acpi_buffer buffer = {ACPI_ALLOCATE_BUFFER, NULL}; 2417 union acpi_object *p, *elements; 2418 u32 domain, mode; 2419 acpi_status status; 2420 2421 /* PPAG is not supported if CRF is HrP2, Jfp2, JfP1 */ 2422 switch (ver->cnvr_top & 0xFFF) { 2423 case 0x504: /* Hrp2 */ 2424 case 0x202: /* Jfp2 */ 2425 case 0x201: /* Jfp1 */ 2426 bt_dev_dbg(hdev, "PPAG not supported for Intel CNVr (0x%3x)", 2427 ver->cnvr_top & 0xFFF); 2428 return; 2429 } 2430 2431 handle = ACPI_HANDLE(GET_HCIDEV_DEV(hdev)); 2432 if (!handle) { 2433 bt_dev_info(hdev, "No support for BT device in ACPI firmware"); 2434 return; 2435 } 2436 2437 status = acpi_evaluate_object(handle, "PPAG", NULL, &buffer); 2438 if (ACPI_FAILURE(status)) { 2439 if (status == AE_NOT_FOUND) { 2440 bt_dev_dbg(hdev, "PPAG-BT: ACPI entry not found"); 2441 return; 2442 } 2443 bt_dev_warn(hdev, "PPAG-BT: ACPI Failure: %s", acpi_format_exception(status)); 2444 return; 2445 } 2446 2447 p = buffer.pointer; 2448 if (p->type != ACPI_TYPE_PACKAGE || p->package.count != 2) { 2449 bt_dev_warn(hdev, "PPAG-BT: Invalid object type: %d or package count: %d", 2450 p->type, p->package.count); 2451 kfree(buffer.pointer); 2452 return; 2453 } 2454 2455 elements = p->package.elements; 2456 2457 /* PPAG table is located at element[1] */ 2458 p = &elements[1]; 2459 2460 domain = (u32)p->package.elements[0].integer.value; 2461 mode = (u32)p->package.elements[1].integer.value; 2462 kfree(buffer.pointer); 2463 2464 if (domain != 0x12) { 2465 bt_dev_dbg(hdev, "PPAG-BT: Bluetooth domain is disabled in ACPI firmware"); 2466 return; 2467 } 2468 2469 /* PPAG mode 2470 * BIT 0 : 0 Disabled in EU 2471 * 1 Enabled in EU 2472 * BIT 1 : 0 Disabled in China 2473 * 1 Enabled in China 2474 */ 2475 mode &= 0x03; 2476 2477 if (!mode) { 2478 bt_dev_dbg(hdev, "PPAG-BT: EU, China mode are disabled in BIOS"); 2479 return; 2480 } 2481 2482 ppag_cmd.ppag_enable_flags = cpu_to_le32(mode); 2483 2484 skb = __hci_cmd_sync(hdev, INTEL_OP_PPAG_CMD, sizeof(ppag_cmd), 2485 &ppag_cmd, HCI_CMD_TIMEOUT); 2486 if (IS_ERR(skb)) { 2487 bt_dev_warn(hdev, "Failed to send PPAG Enable (%ld)", PTR_ERR(skb)); 2488 return; 2489 } 2490 bt_dev_info(hdev, "PPAG-BT: Enabled (Mode %d)", mode); 2491 kfree_skb(skb); 2492 } 2493 2494 static int btintel_acpi_reset_method(struct hci_dev *hdev) 2495 { 2496 int ret = 0; 2497 acpi_status status; 2498 union acpi_object *p, *ref; 2499 struct acpi_buffer buffer = { ACPI_ALLOCATE_BUFFER, NULL }; 2500 2501 status = acpi_evaluate_object(ACPI_HANDLE(GET_HCIDEV_DEV(hdev)), "_PRR", NULL, &buffer); 2502 if (ACPI_FAILURE(status)) { 2503 bt_dev_err(hdev, "Failed to run _PRR method"); 2504 ret = -ENODEV; 2505 return ret; 2506 } 2507 p = buffer.pointer; 2508 2509 if (p->package.count != 1 || p->type != ACPI_TYPE_PACKAGE) { 2510 bt_dev_err(hdev, "Invalid arguments"); 2511 ret = -EINVAL; 2512 goto exit_on_error; 2513 } 2514 2515 ref = &p->package.elements[0]; 2516 if (ref->type != ACPI_TYPE_LOCAL_REFERENCE) { 2517 bt_dev_err(hdev, "Invalid object type: 0x%x", ref->type); 2518 ret = -EINVAL; 2519 goto exit_on_error; 2520 } 2521 2522 status = acpi_evaluate_object(ref->reference.handle, "_RST", NULL, NULL); 2523 if (ACPI_FAILURE(status)) { 2524 bt_dev_err(hdev, "Failed to run_RST method"); 2525 ret = -ENODEV; 2526 goto exit_on_error; 2527 } 2528 2529 exit_on_error: 2530 kfree(buffer.pointer); 2531 return ret; 2532 } 2533 2534 static void btintel_set_dsm_reset_method(struct hci_dev *hdev, 2535 struct intel_version_tlv *ver_tlv) 2536 { 2537 struct btintel_data *data = hci_get_priv(hdev); 2538 acpi_handle handle = ACPI_HANDLE(GET_HCIDEV_DEV(hdev)); 2539 u8 reset_payload[4] = {0x01, 0x00, 0x01, 0x00}; 2540 union acpi_object *obj, argv4; 2541 enum { 2542 RESET_TYPE_WDISABLE2, 2543 RESET_TYPE_VSEC 2544 }; 2545 2546 handle = ACPI_HANDLE(GET_HCIDEV_DEV(hdev)); 2547 2548 if (!handle) { 2549 bt_dev_dbg(hdev, "No support for bluetooth device in ACPI firmware"); 2550 return; 2551 } 2552 2553 if (!acpi_has_method(handle, "_PRR")) { 2554 bt_dev_err(hdev, "No support for _PRR ACPI method"); 2555 return; 2556 } 2557 2558 switch (ver_tlv->cnvi_top & 0xfff) { 2559 case 0x910: /* GalePeak2 */ 2560 reset_payload[2] = RESET_TYPE_VSEC; 2561 break; 2562 default: 2563 /* WDISABLE2 is the default reset method */ 2564 reset_payload[2] = RESET_TYPE_WDISABLE2; 2565 2566 if (!acpi_check_dsm(handle, &btintel_guid_dsm, 0, 2567 BIT(DSM_SET_WDISABLE2_DELAY))) { 2568 bt_dev_err(hdev, "No dsm support to set reset delay"); 2569 return; 2570 } 2571 argv4.integer.type = ACPI_TYPE_INTEGER; 2572 /* delay required to toggle BT power */ 2573 argv4.integer.value = 160; 2574 obj = acpi_evaluate_dsm(handle, &btintel_guid_dsm, 0, 2575 DSM_SET_WDISABLE2_DELAY, &argv4); 2576 if (!obj) { 2577 bt_dev_err(hdev, "Failed to call dsm to set reset delay"); 2578 return; 2579 } 2580 ACPI_FREE(obj); 2581 } 2582 2583 bt_dev_info(hdev, "DSM reset method type: 0x%02x", reset_payload[2]); 2584 2585 if (!acpi_check_dsm(handle, &btintel_guid_dsm, 0, 2586 DSM_SET_RESET_METHOD)) { 2587 bt_dev_warn(hdev, "No support for dsm to set reset method"); 2588 return; 2589 } 2590 argv4.buffer.type = ACPI_TYPE_BUFFER; 2591 argv4.buffer.length = sizeof(reset_payload); 2592 argv4.buffer.pointer = reset_payload; 2593 2594 obj = acpi_evaluate_dsm(handle, &btintel_guid_dsm, 0, 2595 DSM_SET_RESET_METHOD, &argv4); 2596 if (!obj) { 2597 bt_dev_err(hdev, "Failed to call dsm to set reset method"); 2598 return; 2599 } 2600 ACPI_FREE(obj); 2601 data->acpi_reset_method = btintel_acpi_reset_method; 2602 } 2603 2604 #define BTINTEL_ISODATA_HANDLE_BASE 0x900 2605 2606 static u8 btintel_classify_pkt_type(struct hci_dev *hdev, struct sk_buff *skb) 2607 { 2608 /* 2609 * Distinguish ISO data packets form ACL data packets 2610 * based on their connection handle value range. 2611 */ 2612 if (hci_skb_pkt_type(skb) == HCI_ACLDATA_PKT) { 2613 __u16 handle = __le16_to_cpu(hci_acl_hdr(skb)->handle); 2614 2615 if (hci_handle(handle) >= BTINTEL_ISODATA_HANDLE_BASE) 2616 return HCI_ISODATA_PKT; 2617 } 2618 2619 return hci_skb_pkt_type(skb); 2620 } 2621 2622 /* 2623 * UefiCnvCommonDSBR UEFI variable provides information from the OEM platforms 2624 * if they have replaced the BRI (Bluetooth Radio Interface) resistor to 2625 * overcome the potential STEP errors on their designs. Based on the 2626 * configauration, bluetooth firmware shall adjust the BRI response line drive 2627 * strength. The below structure represents DSBR data. 2628 * struct { 2629 * u8 header; 2630 * u32 dsbr; 2631 * } __packed; 2632 * 2633 * header - defines revision number of the structure 2634 * dsbr - defines drive strength BRI response 2635 * bit0 2636 * 0 - instructs bluetooth firmware to use default values 2637 * 1 - instructs bluetooth firmware to override default values 2638 * bit3:1 2639 * Reserved 2640 * bit7:4 2641 * DSBR override values (only if bit0 is set. Default value is 0xF 2642 * bit31:7 2643 * Reserved 2644 * Expected values for dsbr field: 2645 * 1. 0xF1 - indicates that the resistor on board is 33 Ohm 2646 * 2. 0x00 or 0xB1 - indicates that the resistor on board is 10 Ohm 2647 * 3. Non existing UEFI variable or invalid (none of the above) - indicates 2648 * that the resistor on board is 10 Ohm 2649 * Even if uefi variable is not present, driver shall send 0xfc0a command to 2650 * firmware to use default values. 2651 * 2652 */ 2653 static int btintel_uefi_get_dsbr(u32 *dsbr_var) 2654 { 2655 struct btintel_dsbr { 2656 u8 header; 2657 u32 dsbr; 2658 } __packed data; 2659 2660 efi_status_t status; 2661 unsigned long data_size = 0; 2662 efi_guid_t guid = EFI_GUID(0xe65d8884, 0xd4af, 0x4b20, 0x8d, 0x03, 2663 0x77, 0x2e, 0xcc, 0x3d, 0xa5, 0x31); 2664 2665 if (!IS_ENABLED(CONFIG_EFI)) 2666 return -EOPNOTSUPP; 2667 2668 if (!efi_rt_services_supported(EFI_RT_SUPPORTED_GET_VARIABLE)) 2669 return -EOPNOTSUPP; 2670 2671 status = efi.get_variable(BTINTEL_EFI_DSBR, &guid, NULL, &data_size, 2672 NULL); 2673 2674 if (status != EFI_BUFFER_TOO_SMALL || !data_size) 2675 return -EIO; 2676 2677 status = efi.get_variable(BTINTEL_EFI_DSBR, &guid, NULL, &data_size, 2678 &data); 2679 2680 if (status != EFI_SUCCESS) 2681 return -ENXIO; 2682 2683 *dsbr_var = data.dsbr; 2684 return 0; 2685 } 2686 2687 static int btintel_set_dsbr(struct hci_dev *hdev, struct intel_version_tlv *ver) 2688 { 2689 struct btintel_dsbr_cmd { 2690 u8 enable; 2691 u8 dsbr; 2692 } __packed; 2693 2694 struct btintel_dsbr_cmd cmd; 2695 struct sk_buff *skb; 2696 u8 status; 2697 u32 dsbr; 2698 bool apply_dsbr; 2699 int err; 2700 2701 /* DSBR command needs to be sent for BlazarI + B0 step product after 2702 * downloading IML image. 2703 */ 2704 apply_dsbr = (ver->img_type == BTINTEL_IMG_IML && 2705 ((ver->cnvi_top & 0xfff) == BTINTEL_CNVI_BLAZARI) && 2706 INTEL_CNVX_TOP_STEP(ver->cnvi_top) == 0x01); 2707 2708 if (!apply_dsbr) 2709 return 0; 2710 2711 dsbr = 0; 2712 err = btintel_uefi_get_dsbr(&dsbr); 2713 if (err < 0) 2714 bt_dev_dbg(hdev, "Error reading efi: %ls (%d)", 2715 BTINTEL_EFI_DSBR, err); 2716 2717 cmd.enable = dsbr & BIT(0); 2718 cmd.dsbr = dsbr >> 4 & 0xF; 2719 2720 bt_dev_info(hdev, "dsbr: enable: 0x%2.2x value: 0x%2.2x", cmd.enable, 2721 cmd.dsbr); 2722 2723 skb = __hci_cmd_sync(hdev, 0xfc0a, sizeof(cmd), &cmd, HCI_CMD_TIMEOUT); 2724 if (IS_ERR(skb)) 2725 return -bt_to_errno(PTR_ERR(skb)); 2726 2727 status = skb->data[0]; 2728 kfree_skb(skb); 2729 2730 if (status) 2731 return -bt_to_errno(status); 2732 2733 return 0; 2734 } 2735 2736 int btintel_bootloader_setup_tlv(struct hci_dev *hdev, 2737 struct intel_version_tlv *ver) 2738 { 2739 u32 boot_param; 2740 char ddcname[64]; 2741 int err; 2742 struct intel_version_tlv new_ver; 2743 2744 bt_dev_dbg(hdev, ""); 2745 2746 /* Set the default boot parameter to 0x0 and it is updated to 2747 * SKU specific boot parameter after reading Intel_Write_Boot_Params 2748 * command while downloading the firmware. 2749 */ 2750 boot_param = 0x00000000; 2751 2752 btintel_set_flag(hdev, INTEL_BOOTLOADER); 2753 2754 err = btintel_prepare_fw_download_tlv(hdev, ver, &boot_param); 2755 if (err) 2756 return err; 2757 2758 /* check if controller is already having an operational firmware */ 2759 if (ver->img_type == BTINTEL_IMG_OP) 2760 goto finish; 2761 2762 err = btintel_boot(hdev, boot_param); 2763 if (err) 2764 return err; 2765 2766 err = btintel_read_version_tlv(hdev, ver); 2767 if (err) 2768 return err; 2769 2770 /* set drive strength of BRI response */ 2771 err = btintel_set_dsbr(hdev, ver); 2772 if (err) { 2773 bt_dev_err(hdev, "Failed to send dsbr command (%d)", err); 2774 return err; 2775 } 2776 2777 /* If image type returned is BTINTEL_IMG_IML, then controller supports 2778 * intermediate loader image 2779 */ 2780 if (ver->img_type == BTINTEL_IMG_IML) { 2781 err = btintel_prepare_fw_download_tlv(hdev, ver, &boot_param); 2782 if (err) 2783 return err; 2784 2785 err = btintel_boot(hdev, boot_param); 2786 if (err) 2787 return err; 2788 } 2789 2790 btintel_clear_flag(hdev, INTEL_BOOTLOADER); 2791 2792 btintel_get_fw_name_tlv(ver, ddcname, sizeof(ddcname), "ddc"); 2793 /* Once the device is running in operational mode, it needs to 2794 * apply the device configuration (DDC) parameters. 2795 * 2796 * The device can work without DDC parameters, so even if it 2797 * fails to load the file, no need to fail the setup. 2798 */ 2799 btintel_load_ddc_config(hdev, ddcname); 2800 2801 /* Read supported use cases and set callbacks to fetch datapath id */ 2802 btintel_configure_offload(hdev); 2803 2804 hci_dev_clear_flag(hdev, HCI_QUALITY_REPORT); 2805 2806 /* Set PPAG feature */ 2807 btintel_set_ppag(hdev, ver); 2808 2809 /* Read the Intel version information after loading the FW */ 2810 err = btintel_read_version_tlv(hdev, &new_ver); 2811 if (err) 2812 return err; 2813 2814 btintel_version_info_tlv(hdev, &new_ver); 2815 2816 finish: 2817 /* Set the event mask for Intel specific vendor events. This enables 2818 * a few extra events that are useful during general operation. It 2819 * does not enable any debugging related events. 2820 * 2821 * The device will function correctly without these events enabled 2822 * and thus no need to fail the setup. 2823 */ 2824 btintel_set_event_mask(hdev, false); 2825 2826 return 0; 2827 } 2828 EXPORT_SYMBOL_GPL(btintel_bootloader_setup_tlv); 2829 2830 void btintel_set_msft_opcode(struct hci_dev *hdev, u8 hw_variant) 2831 { 2832 switch (hw_variant) { 2833 /* Legacy bootloader devices that supports MSFT Extension */ 2834 case 0x11: /* JfP */ 2835 case 0x12: /* ThP */ 2836 case 0x13: /* HrP */ 2837 case 0x14: /* CcP */ 2838 /* All Intel new genration controllers support the Microsoft vendor 2839 * extension are using 0xFC1E for VsMsftOpCode. 2840 */ 2841 case 0x17: 2842 case 0x18: 2843 case 0x19: 2844 case 0x1b: 2845 case 0x1c: 2846 case 0x1d: 2847 case 0x1e: 2848 hci_set_msft_opcode(hdev, 0xFC1E); 2849 break; 2850 default: 2851 /* Not supported */ 2852 break; 2853 } 2854 } 2855 EXPORT_SYMBOL_GPL(btintel_set_msft_opcode); 2856 2857 void btintel_print_fseq_info(struct hci_dev *hdev) 2858 { 2859 struct sk_buff *skb; 2860 u8 *p; 2861 u32 val; 2862 const char *str; 2863 2864 skb = __hci_cmd_sync(hdev, 0xfcb3, 0, NULL, HCI_CMD_TIMEOUT); 2865 if (IS_ERR(skb)) { 2866 bt_dev_dbg(hdev, "Reading fseq status command failed (%ld)", 2867 PTR_ERR(skb)); 2868 return; 2869 } 2870 2871 if (skb->len < (sizeof(u32) * 16 + 2)) { 2872 bt_dev_dbg(hdev, "Malformed packet of length %u received", 2873 skb->len); 2874 kfree_skb(skb); 2875 return; 2876 } 2877 2878 p = skb_pull_data(skb, 1); 2879 if (*p) { 2880 bt_dev_dbg(hdev, "Failed to get fseq status (0x%2.2x)", *p); 2881 kfree_skb(skb); 2882 return; 2883 } 2884 2885 p = skb_pull_data(skb, 1); 2886 switch (*p) { 2887 case 0: 2888 str = "Success"; 2889 break; 2890 case 1: 2891 str = "Fatal error"; 2892 break; 2893 case 2: 2894 str = "Semaphore acquire error"; 2895 break; 2896 default: 2897 str = "Unknown error"; 2898 break; 2899 } 2900 2901 if (*p) { 2902 bt_dev_err(hdev, "Fseq status: %s (0x%2.2x)", str, *p); 2903 kfree_skb(skb); 2904 return; 2905 } 2906 2907 bt_dev_info(hdev, "Fseq status: %s (0x%2.2x)", str, *p); 2908 2909 val = get_unaligned_le32(skb_pull_data(skb, 4)); 2910 bt_dev_dbg(hdev, "Reason: 0x%8.8x", val); 2911 2912 val = get_unaligned_le32(skb_pull_data(skb, 4)); 2913 bt_dev_dbg(hdev, "Global version: 0x%8.8x", val); 2914 2915 val = get_unaligned_le32(skb_pull_data(skb, 4)); 2916 bt_dev_dbg(hdev, "Installed version: 0x%8.8x", val); 2917 2918 p = skb->data; 2919 skb_pull_data(skb, 4); 2920 bt_dev_info(hdev, "Fseq executed: %2.2u.%2.2u.%2.2u.%2.2u", p[0], p[1], 2921 p[2], p[3]); 2922 2923 p = skb->data; 2924 skb_pull_data(skb, 4); 2925 bt_dev_info(hdev, "Fseq BT Top: %2.2u.%2.2u.%2.2u.%2.2u", p[0], p[1], 2926 p[2], p[3]); 2927 2928 val = get_unaligned_le32(skb_pull_data(skb, 4)); 2929 bt_dev_dbg(hdev, "Fseq Top init version: 0x%8.8x", val); 2930 2931 val = get_unaligned_le32(skb_pull_data(skb, 4)); 2932 bt_dev_dbg(hdev, "Fseq Cnvio init version: 0x%8.8x", val); 2933 2934 val = get_unaligned_le32(skb_pull_data(skb, 4)); 2935 bt_dev_dbg(hdev, "Fseq MBX Wifi file version: 0x%8.8x", val); 2936 2937 val = get_unaligned_le32(skb_pull_data(skb, 4)); 2938 bt_dev_dbg(hdev, "Fseq BT version: 0x%8.8x", val); 2939 2940 val = get_unaligned_le32(skb_pull_data(skb, 4)); 2941 bt_dev_dbg(hdev, "Fseq Top reset address: 0x%8.8x", val); 2942 2943 val = get_unaligned_le32(skb_pull_data(skb, 4)); 2944 bt_dev_dbg(hdev, "Fseq MBX timeout: 0x%8.8x", val); 2945 2946 val = get_unaligned_le32(skb_pull_data(skb, 4)); 2947 bt_dev_dbg(hdev, "Fseq MBX ack: 0x%8.8x", val); 2948 2949 val = get_unaligned_le32(skb_pull_data(skb, 4)); 2950 bt_dev_dbg(hdev, "Fseq CNVi id: 0x%8.8x", val); 2951 2952 val = get_unaligned_le32(skb_pull_data(skb, 4)); 2953 bt_dev_dbg(hdev, "Fseq CNVr id: 0x%8.8x", val); 2954 2955 val = get_unaligned_le32(skb_pull_data(skb, 4)); 2956 bt_dev_dbg(hdev, "Fseq Error handle: 0x%8.8x", val); 2957 2958 val = get_unaligned_le32(skb_pull_data(skb, 4)); 2959 bt_dev_dbg(hdev, "Fseq Magic noalive indication: 0x%8.8x", val); 2960 2961 val = get_unaligned_le32(skb_pull_data(skb, 4)); 2962 bt_dev_dbg(hdev, "Fseq OTP version: 0x%8.8x", val); 2963 2964 val = get_unaligned_le32(skb_pull_data(skb, 4)); 2965 bt_dev_dbg(hdev, "Fseq MBX otp version: 0x%8.8x", val); 2966 2967 kfree_skb(skb); 2968 } 2969 EXPORT_SYMBOL_GPL(btintel_print_fseq_info); 2970 2971 static int btintel_setup_combined(struct hci_dev *hdev) 2972 { 2973 const u8 param[1] = { 0xFF }; 2974 struct intel_version ver; 2975 struct intel_version_tlv ver_tlv; 2976 struct sk_buff *skb; 2977 int err; 2978 2979 BT_DBG("%s", hdev->name); 2980 2981 /* The some controllers have a bug with the first HCI command sent to it 2982 * returning number of completed commands as zero. This would stall the 2983 * command processing in the Bluetooth core. 2984 * 2985 * As a workaround, send HCI Reset command first which will reset the 2986 * number of completed commands and allow normal command processing 2987 * from now on. 2988 * 2989 * Regarding the INTEL_BROKEN_SHUTDOWN_LED flag, these devices maybe 2990 * in the SW_RFKILL ON state as a workaround of fixing LED issue during 2991 * the shutdown() procedure, and once the device is in SW_RFKILL ON 2992 * state, the only way to exit out of it is sending the HCI_Reset 2993 * command. 2994 */ 2995 if (btintel_test_flag(hdev, INTEL_BROKEN_INITIAL_NCMD) || 2996 btintel_test_flag(hdev, INTEL_BROKEN_SHUTDOWN_LED)) { 2997 skb = __hci_cmd_sync(hdev, HCI_OP_RESET, 0, NULL, 2998 HCI_INIT_TIMEOUT); 2999 if (IS_ERR(skb)) { 3000 bt_dev_err(hdev, 3001 "sending initial HCI reset failed (%ld)", 3002 PTR_ERR(skb)); 3003 return PTR_ERR(skb); 3004 } 3005 kfree_skb(skb); 3006 } 3007 3008 /* Starting from TyP device, the command parameter and response are 3009 * changed even though the OCF for HCI_Intel_Read_Version command 3010 * remains same. The legacy devices can handle even if the 3011 * command has a parameter and returns a correct version information. 3012 * So, it uses new format to support both legacy and new format. 3013 */ 3014 skb = __hci_cmd_sync(hdev, 0xfc05, 1, param, HCI_CMD_TIMEOUT); 3015 if (IS_ERR(skb)) { 3016 bt_dev_err(hdev, "Reading Intel version command failed (%ld)", 3017 PTR_ERR(skb)); 3018 return PTR_ERR(skb); 3019 } 3020 3021 /* Check the status */ 3022 if (skb->data[0]) { 3023 bt_dev_err(hdev, "Intel Read Version command failed (%02x)", 3024 skb->data[0]); 3025 err = -EIO; 3026 goto exit_error; 3027 } 3028 3029 /* Apply the common HCI quirks for Intel device */ 3030 set_bit(HCI_QUIRK_STRICT_DUPLICATE_FILTER, &hdev->quirks); 3031 set_bit(HCI_QUIRK_SIMULTANEOUS_DISCOVERY, &hdev->quirks); 3032 set_bit(HCI_QUIRK_NON_PERSISTENT_DIAG, &hdev->quirks); 3033 3034 /* Set up the quality report callback for Intel devices */ 3035 hdev->set_quality_report = btintel_set_quality_report; 3036 3037 /* For Legacy device, check the HW platform value and size */ 3038 if (skb->len == sizeof(ver) && skb->data[1] == 0x37) { 3039 bt_dev_dbg(hdev, "Read the legacy Intel version information"); 3040 3041 memcpy(&ver, skb->data, sizeof(ver)); 3042 3043 /* Display version information */ 3044 btintel_version_info(hdev, &ver); 3045 3046 /* Check for supported iBT hardware variants of this firmware 3047 * loading method. 3048 * 3049 * This check has been put in place to ensure correct forward 3050 * compatibility options when newer hardware variants come 3051 * along. 3052 */ 3053 switch (ver.hw_variant) { 3054 case 0x07: /* WP */ 3055 case 0x08: /* StP */ 3056 /* Legacy ROM product */ 3057 btintel_set_flag(hdev, INTEL_ROM_LEGACY); 3058 3059 /* Apply the device specific HCI quirks 3060 * 3061 * WBS for SdP - For the Legacy ROM products, only SdP 3062 * supports the WBS. But the version information is not 3063 * enough to use here because the StP2 and SdP have same 3064 * hw_variant and fw_variant. So, this flag is set by 3065 * the transport driver (btusb) based on the HW info 3066 * (idProduct) 3067 */ 3068 if (!btintel_test_flag(hdev, 3069 INTEL_ROM_LEGACY_NO_WBS_SUPPORT)) 3070 set_bit(HCI_QUIRK_WIDEBAND_SPEECH_SUPPORTED, 3071 &hdev->quirks); 3072 3073 err = btintel_legacy_rom_setup(hdev, &ver); 3074 break; 3075 case 0x0b: /* SfP */ 3076 case 0x11: /* JfP */ 3077 case 0x12: /* ThP */ 3078 case 0x13: /* HrP */ 3079 case 0x14: /* CcP */ 3080 fallthrough; 3081 case 0x0c: /* WsP */ 3082 /* Apply the device specific HCI quirks 3083 * 3084 * All Legacy bootloader devices support WBS 3085 */ 3086 set_bit(HCI_QUIRK_WIDEBAND_SPEECH_SUPPORTED, 3087 &hdev->quirks); 3088 3089 /* These variants don't seem to support LE Coded PHY */ 3090 set_bit(HCI_QUIRK_BROKEN_LE_CODED, &hdev->quirks); 3091 3092 /* Setup MSFT Extension support */ 3093 btintel_set_msft_opcode(hdev, ver.hw_variant); 3094 3095 err = btintel_bootloader_setup(hdev, &ver); 3096 btintel_register_devcoredump_support(hdev); 3097 break; 3098 default: 3099 bt_dev_err(hdev, "Unsupported Intel hw variant (%u)", 3100 ver.hw_variant); 3101 err = -EINVAL; 3102 } 3103 3104 hci_set_hw_info(hdev, 3105 "INTEL platform=%u variant=%u revision=%u", 3106 ver.hw_platform, ver.hw_variant, 3107 ver.hw_revision); 3108 3109 goto exit_error; 3110 } 3111 3112 /* memset ver_tlv to start with clean state as few fields are exclusive 3113 * to bootloader mode and are not populated in operational mode 3114 */ 3115 memset(&ver_tlv, 0, sizeof(ver_tlv)); 3116 /* For TLV type device, parse the tlv data */ 3117 err = btintel_parse_version_tlv(hdev, &ver_tlv, skb); 3118 if (err) { 3119 bt_dev_err(hdev, "Failed to parse TLV version information"); 3120 goto exit_error; 3121 } 3122 3123 if (INTEL_HW_PLATFORM(ver_tlv.cnvi_bt) != 0x37) { 3124 bt_dev_err(hdev, "Unsupported Intel hardware platform (0x%2x)", 3125 INTEL_HW_PLATFORM(ver_tlv.cnvi_bt)); 3126 err = -EINVAL; 3127 goto exit_error; 3128 } 3129 3130 /* Check for supported iBT hardware variants of this firmware 3131 * loading method. 3132 * 3133 * This check has been put in place to ensure correct forward 3134 * compatibility options when newer hardware variants come 3135 * along. 3136 */ 3137 switch (INTEL_HW_VARIANT(ver_tlv.cnvi_bt)) { 3138 case 0x11: /* JfP */ 3139 case 0x12: /* ThP */ 3140 case 0x13: /* HrP */ 3141 case 0x14: /* CcP */ 3142 /* Some legacy bootloader devices starting from JfP, 3143 * the operational firmware supports both old and TLV based 3144 * HCI_Intel_Read_Version command based on the command 3145 * parameter. 3146 * 3147 * For upgrading firmware case, the TLV based version cannot 3148 * be used because the firmware filename for legacy bootloader 3149 * is based on the old format. 3150 * 3151 * Also, it is not easy to convert TLV based version from the 3152 * legacy version format. 3153 * 3154 * So, as a workaround for those devices, use the legacy 3155 * HCI_Intel_Read_Version to get the version information and 3156 * run the legacy bootloader setup. 3157 */ 3158 err = btintel_read_version(hdev, &ver); 3159 if (err) 3160 break; 3161 3162 /* Apply the device specific HCI quirks 3163 * 3164 * All Legacy bootloader devices support WBS 3165 */ 3166 set_bit(HCI_QUIRK_WIDEBAND_SPEECH_SUPPORTED, &hdev->quirks); 3167 3168 /* These variants don't seem to support LE Coded PHY */ 3169 set_bit(HCI_QUIRK_BROKEN_LE_CODED, &hdev->quirks); 3170 3171 /* Setup MSFT Extension support */ 3172 btintel_set_msft_opcode(hdev, ver.hw_variant); 3173 3174 err = btintel_bootloader_setup(hdev, &ver); 3175 btintel_register_devcoredump_support(hdev); 3176 break; 3177 case 0x18: /* GfP2 */ 3178 case 0x1c: /* GaP */ 3179 /* Re-classify packet type for controllers with LE audio */ 3180 hdev->classify_pkt_type = btintel_classify_pkt_type; 3181 fallthrough; 3182 case 0x17: 3183 case 0x19: 3184 case 0x1b: 3185 case 0x1d: 3186 case 0x1e: 3187 /* Display version information of TLV type */ 3188 btintel_version_info_tlv(hdev, &ver_tlv); 3189 3190 /* Apply the device specific HCI quirks for TLV based devices 3191 * 3192 * All TLV based devices support WBS 3193 */ 3194 set_bit(HCI_QUIRK_WIDEBAND_SPEECH_SUPPORTED, &hdev->quirks); 3195 3196 /* Setup MSFT Extension support */ 3197 btintel_set_msft_opcode(hdev, 3198 INTEL_HW_VARIANT(ver_tlv.cnvi_bt)); 3199 btintel_set_dsm_reset_method(hdev, &ver_tlv); 3200 3201 err = btintel_bootloader_setup_tlv(hdev, &ver_tlv); 3202 if (err) 3203 goto exit_error; 3204 3205 btintel_register_devcoredump_support(hdev); 3206 btintel_print_fseq_info(hdev); 3207 break; 3208 default: 3209 bt_dev_err(hdev, "Unsupported Intel hw variant (%u)", 3210 INTEL_HW_VARIANT(ver_tlv.cnvi_bt)); 3211 err = -EINVAL; 3212 break; 3213 } 3214 3215 hci_set_hw_info(hdev, "INTEL platform=%u variant=%u", 3216 INTEL_HW_PLATFORM(ver_tlv.cnvi_bt), 3217 INTEL_HW_VARIANT(ver_tlv.cnvi_bt)); 3218 3219 exit_error: 3220 kfree_skb(skb); 3221 3222 return err; 3223 } 3224 3225 int btintel_shutdown_combined(struct hci_dev *hdev) 3226 { 3227 struct sk_buff *skb; 3228 int ret; 3229 3230 /* Send HCI Reset to the controller to stop any BT activity which 3231 * were triggered. This will help to save power and maintain the 3232 * sync b/w Host and controller 3233 */ 3234 skb = __hci_cmd_sync(hdev, HCI_OP_RESET, 0, NULL, HCI_INIT_TIMEOUT); 3235 if (IS_ERR(skb)) { 3236 bt_dev_err(hdev, "HCI reset during shutdown failed"); 3237 return PTR_ERR(skb); 3238 } 3239 kfree_skb(skb); 3240 3241 3242 /* Some platforms have an issue with BT LED when the interface is 3243 * down or BT radio is turned off, which takes 5 seconds to BT LED 3244 * goes off. As a workaround, sends HCI_Intel_SW_RFKILL to put the 3245 * device in the RFKILL ON state which turns off the BT LED immediately. 3246 */ 3247 if (btintel_test_flag(hdev, INTEL_BROKEN_SHUTDOWN_LED)) { 3248 skb = __hci_cmd_sync(hdev, 0xfc3f, 0, NULL, HCI_INIT_TIMEOUT); 3249 if (IS_ERR(skb)) { 3250 ret = PTR_ERR(skb); 3251 bt_dev_err(hdev, "turning off Intel device LED failed"); 3252 return ret; 3253 } 3254 kfree_skb(skb); 3255 } 3256 3257 return 0; 3258 } 3259 EXPORT_SYMBOL_GPL(btintel_shutdown_combined); 3260 3261 int btintel_configure_setup(struct hci_dev *hdev, const char *driver_name) 3262 { 3263 hdev->manufacturer = 2; 3264 hdev->setup = btintel_setup_combined; 3265 hdev->shutdown = btintel_shutdown_combined; 3266 hdev->hw_error = btintel_hw_error; 3267 hdev->set_diag = btintel_set_diag_combined; 3268 hdev->set_bdaddr = btintel_set_bdaddr; 3269 3270 coredump_info.driver_name = driver_name; 3271 3272 return 0; 3273 } 3274 EXPORT_SYMBOL_GPL(btintel_configure_setup); 3275 3276 static int btintel_diagnostics(struct hci_dev *hdev, struct sk_buff *skb) 3277 { 3278 struct intel_tlv *tlv = (void *)&skb->data[5]; 3279 3280 /* The first event is always an event type TLV */ 3281 if (tlv->type != INTEL_TLV_TYPE_ID) 3282 goto recv_frame; 3283 3284 switch (tlv->val[0]) { 3285 case INTEL_TLV_SYSTEM_EXCEPTION: 3286 case INTEL_TLV_FATAL_EXCEPTION: 3287 case INTEL_TLV_DEBUG_EXCEPTION: 3288 case INTEL_TLV_TEST_EXCEPTION: 3289 /* Generate devcoredump from exception */ 3290 if (!hci_devcd_init(hdev, skb->len)) { 3291 hci_devcd_append(hdev, skb_clone(skb, GFP_ATOMIC)); 3292 hci_devcd_complete(hdev); 3293 } else { 3294 bt_dev_err(hdev, "Failed to generate devcoredump"); 3295 } 3296 break; 3297 default: 3298 bt_dev_err(hdev, "Invalid exception type %02X", tlv->val[0]); 3299 } 3300 3301 recv_frame: 3302 return hci_recv_frame(hdev, skb); 3303 } 3304 3305 int btintel_recv_event(struct hci_dev *hdev, struct sk_buff *skb) 3306 { 3307 struct hci_event_hdr *hdr = (void *)skb->data; 3308 const char diagnostics_hdr[] = { 0x87, 0x80, 0x03 }; 3309 3310 if (skb->len > HCI_EVENT_HDR_SIZE && hdr->evt == 0xff && 3311 hdr->plen > 0) { 3312 const void *ptr = skb->data + HCI_EVENT_HDR_SIZE + 1; 3313 unsigned int len = skb->len - HCI_EVENT_HDR_SIZE - 1; 3314 3315 if (btintel_test_flag(hdev, INTEL_BOOTLOADER)) { 3316 switch (skb->data[2]) { 3317 case 0x02: 3318 /* When switching to the operational firmware 3319 * the device sends a vendor specific event 3320 * indicating that the bootup completed. 3321 */ 3322 btintel_bootup(hdev, ptr, len); 3323 break; 3324 case 0x06: 3325 /* When the firmware loading completes the 3326 * device sends out a vendor specific event 3327 * indicating the result of the firmware 3328 * loading. 3329 */ 3330 btintel_secure_send_result(hdev, ptr, len); 3331 break; 3332 } 3333 } 3334 3335 /* Handle all diagnostics events separately. May still call 3336 * hci_recv_frame. 3337 */ 3338 if (len >= sizeof(diagnostics_hdr) && 3339 memcmp(&skb->data[2], diagnostics_hdr, 3340 sizeof(diagnostics_hdr)) == 0) { 3341 return btintel_diagnostics(hdev, skb); 3342 } 3343 } 3344 3345 return hci_recv_frame(hdev, skb); 3346 } 3347 EXPORT_SYMBOL_GPL(btintel_recv_event); 3348 3349 void btintel_bootup(struct hci_dev *hdev, const void *ptr, unsigned int len) 3350 { 3351 const struct intel_bootup *evt = ptr; 3352 3353 if (len != sizeof(*evt)) 3354 return; 3355 3356 if (btintel_test_and_clear_flag(hdev, INTEL_BOOTING)) 3357 btintel_wake_up_flag(hdev, INTEL_BOOTING); 3358 } 3359 EXPORT_SYMBOL_GPL(btintel_bootup); 3360 3361 void btintel_secure_send_result(struct hci_dev *hdev, 3362 const void *ptr, unsigned int len) 3363 { 3364 const struct intel_secure_send_result *evt = ptr; 3365 3366 if (len != sizeof(*evt)) 3367 return; 3368 3369 if (evt->result) 3370 btintel_set_flag(hdev, INTEL_FIRMWARE_FAILED); 3371 3372 if (btintel_test_and_clear_flag(hdev, INTEL_DOWNLOADING) && 3373 btintel_test_flag(hdev, INTEL_FIRMWARE_LOADED)) 3374 btintel_wake_up_flag(hdev, INTEL_DOWNLOADING); 3375 } 3376 EXPORT_SYMBOL_GPL(btintel_secure_send_result); 3377 3378 MODULE_AUTHOR("Marcel Holtmann <marcel@holtmann.org>"); 3379 MODULE_DESCRIPTION("Bluetooth support for Intel devices ver " VERSION); 3380 MODULE_VERSION(VERSION); 3381 MODULE_LICENSE("GPL"); 3382 MODULE_FIRMWARE("intel/ibt-11-5.sfi"); 3383 MODULE_FIRMWARE("intel/ibt-11-5.ddc"); 3384 MODULE_FIRMWARE("intel/ibt-12-16.sfi"); 3385 MODULE_FIRMWARE("intel/ibt-12-16.ddc"); 3386