]>
Commit | Line | Data |
---|---|---|
16e3887f MH |
1 | /* |
2 | * | |
3 | * Bluetooth HCI UART driver for Intel devices | |
4 | * | |
5 | * Copyright (C) 2015 Intel Corporation | |
6 | * | |
7 | * | |
8 | * This program is free software; you can redistribute it and/or modify | |
9 | * it under the terms of the GNU General Public License as published by | |
10 | * the Free Software Foundation; either version 2 of the License, or | |
11 | * (at your option) any later version. | |
12 | * | |
13 | * This program is distributed in the hope that it will be useful, | |
14 | * but WITHOUT ANY WARRANTY; without even the implied warranty of | |
15 | * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the | |
16 | * GNU General Public License for more details. | |
17 | * | |
18 | * You should have received a copy of the GNU General Public License | |
19 | * along with this program; if not, write to the Free Software | |
20 | * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA | |
21 | * | |
22 | */ | |
23 | ||
24 | #include <linux/kernel.h> | |
25 | #include <linux/errno.h> | |
26 | #include <linux/skbuff.h> | |
ca93cee5 | 27 | #include <linux/firmware.h> |
1ab1f239 | 28 | #include <linux/module.h> |
ca93cee5 | 29 | #include <linux/wait.h> |
1ab1f239 LP |
30 | #include <linux/tty.h> |
31 | #include <linux/platform_device.h> | |
32 | #include <linux/gpio/consumer.h> | |
33 | #include <linux/acpi.h> | |
765ea3ab | 34 | #include <linux/interrupt.h> |
16e3887f MH |
35 | |
36 | #include <net/bluetooth/bluetooth.h> | |
37 | #include <net/bluetooth/hci_core.h> | |
38 | ||
39 | #include "hci_uart.h" | |
ca93cee5 LP |
40 | #include "btintel.h" |
41 | ||
42 | #define STATE_BOOTLOADER 0 | |
43 | #define STATE_DOWNLOADING 1 | |
44 | #define STATE_FIRMWARE_LOADED 2 | |
45 | #define STATE_FIRMWARE_FAILED 3 | |
46 | #define STATE_BOOTING 4 | |
b98469f4 LP |
47 | #define STATE_LPM_ENABLED 5 |
48 | #define STATE_TX_ACTIVE 6 | |
49 | ||
50 | #define HCI_LPM_PKT 0xf1 | |
51 | #define HCI_LPM_MAX_SIZE 10 | |
52 | #define HCI_LPM_HDR_SIZE HCI_EVENT_HDR_SIZE | |
53 | ||
54 | #define LPM_OP_TX_NOTIFY 0x00 | |
55 | ||
56 | struct hci_lpm_pkt { | |
57 | __u8 opcode; | |
58 | __u8 dlen; | |
59 | __u8 data[0]; | |
60 | } __packed; | |
ca93cee5 | 61 | |
1ab1f239 LP |
62 | struct intel_device { |
63 | struct list_head list; | |
64 | struct platform_device *pdev; | |
65 | struct gpio_desc *reset; | |
765ea3ab | 66 | int irq; |
1ab1f239 LP |
67 | }; |
68 | ||
69 | static LIST_HEAD(intel_device_list); | |
70 | static DEFINE_SPINLOCK(intel_device_list_lock); | |
71 | ||
ca93cee5 LP |
72 | struct intel_data { |
73 | struct sk_buff *rx_skb; | |
74 | struct sk_buff_head txq; | |
75 | unsigned long flags; | |
76 | }; | |
77 | ||
ff289559 LP |
78 | static u8 intel_convert_speed(unsigned int speed) |
79 | { | |
80 | switch (speed) { | |
81 | case 9600: | |
82 | return 0x00; | |
83 | case 19200: | |
84 | return 0x01; | |
85 | case 38400: | |
86 | return 0x02; | |
87 | case 57600: | |
88 | return 0x03; | |
89 | case 115200: | |
90 | return 0x04; | |
91 | case 230400: | |
92 | return 0x05; | |
93 | case 460800: | |
94 | return 0x06; | |
95 | case 921600: | |
96 | return 0x07; | |
97 | case 1843200: | |
98 | return 0x08; | |
99 | case 3250000: | |
100 | return 0x09; | |
101 | case 2000000: | |
102 | return 0x0a; | |
103 | case 3000000: | |
104 | return 0x0b; | |
105 | default: | |
106 | return 0xff; | |
107 | } | |
108 | } | |
109 | ||
1ab1f239 LP |
110 | static int intel_wait_booting(struct hci_uart *hu) |
111 | { | |
112 | struct intel_data *intel = hu->priv; | |
113 | int err; | |
114 | ||
115 | err = wait_on_bit_timeout(&intel->flags, STATE_BOOTING, | |
116 | TASK_INTERRUPTIBLE, | |
117 | msecs_to_jiffies(1000)); | |
118 | ||
119 | if (err == 1) { | |
f44e78a5 | 120 | bt_dev_err(hu->hdev, "Device boot interrupted"); |
1ab1f239 LP |
121 | return -EINTR; |
122 | } | |
123 | ||
124 | if (err) { | |
f44e78a5 | 125 | bt_dev_err(hu->hdev, "Device boot timeout"); |
1ab1f239 LP |
126 | return -ETIMEDOUT; |
127 | } | |
128 | ||
129 | return err; | |
130 | } | |
131 | ||
765ea3ab LP |
132 | static irqreturn_t intel_irq(int irq, void *dev_id) |
133 | { | |
134 | struct intel_device *idev = dev_id; | |
135 | ||
136 | dev_info(&idev->pdev->dev, "hci_intel irq\n"); | |
137 | ||
138 | return IRQ_HANDLED; | |
139 | } | |
140 | ||
1ab1f239 LP |
141 | static int intel_set_power(struct hci_uart *hu, bool powered) |
142 | { | |
143 | struct list_head *p; | |
144 | int err = -ENODEV; | |
145 | ||
146 | spin_lock(&intel_device_list_lock); | |
147 | ||
148 | list_for_each(p, &intel_device_list) { | |
149 | struct intel_device *idev = list_entry(p, struct intel_device, | |
150 | list); | |
151 | ||
152 | /* tty device and pdev device should share the same parent | |
153 | * which is the UART port. | |
154 | */ | |
155 | if (hu->tty->dev->parent != idev->pdev->dev.parent) | |
156 | continue; | |
157 | ||
158 | if (!idev->reset) { | |
159 | err = -ENOTSUPP; | |
160 | break; | |
161 | } | |
162 | ||
163 | BT_INFO("hu %p, Switching compatible pm device (%s) to %u", | |
164 | hu, dev_name(&idev->pdev->dev), powered); | |
165 | ||
166 | gpiod_set_value(idev->reset, powered); | |
765ea3ab LP |
167 | |
168 | if (idev->irq < 0) | |
169 | break; | |
170 | ||
171 | if (powered && device_can_wakeup(&idev->pdev->dev)) { | |
172 | err = devm_request_threaded_irq(&idev->pdev->dev, | |
173 | idev->irq, NULL, | |
174 | intel_irq, | |
175 | IRQF_ONESHOT, | |
176 | "bt-host-wake", idev); | |
177 | if (err) { | |
178 | BT_ERR("hu %p, unable to allocate irq-%d", | |
179 | hu, idev->irq); | |
180 | break; | |
181 | } | |
182 | ||
183 | device_wakeup_enable(&idev->pdev->dev); | |
184 | } else if (!powered && device_may_wakeup(&idev->pdev->dev)) { | |
185 | devm_free_irq(&idev->pdev->dev, idev->irq, idev); | |
186 | device_wakeup_disable(&idev->pdev->dev); | |
187 | } | |
1ab1f239 LP |
188 | } |
189 | ||
190 | spin_unlock(&intel_device_list_lock); | |
191 | ||
192 | return err; | |
193 | } | |
194 | ||
ca93cee5 LP |
195 | static int intel_open(struct hci_uart *hu) |
196 | { | |
197 | struct intel_data *intel; | |
198 | ||
199 | BT_DBG("hu %p", hu); | |
200 | ||
201 | intel = kzalloc(sizeof(*intel), GFP_KERNEL); | |
202 | if (!intel) | |
203 | return -ENOMEM; | |
204 | ||
205 | skb_queue_head_init(&intel->txq); | |
206 | ||
207 | hu->priv = intel; | |
1ab1f239 LP |
208 | |
209 | if (!intel_set_power(hu, true)) | |
210 | set_bit(STATE_BOOTING, &intel->flags); | |
211 | ||
ca93cee5 LP |
212 | return 0; |
213 | } | |
214 | ||
215 | static int intel_close(struct hci_uart *hu) | |
216 | { | |
217 | struct intel_data *intel = hu->priv; | |
218 | ||
219 | BT_DBG("hu %p", hu); | |
220 | ||
1ab1f239 LP |
221 | intel_set_power(hu, false); |
222 | ||
ca93cee5 LP |
223 | skb_queue_purge(&intel->txq); |
224 | kfree_skb(intel->rx_skb); | |
225 | kfree(intel); | |
226 | ||
227 | hu->priv = NULL; | |
228 | return 0; | |
229 | } | |
230 | ||
231 | static int intel_flush(struct hci_uart *hu) | |
232 | { | |
233 | struct intel_data *intel = hu->priv; | |
234 | ||
235 | BT_DBG("hu %p", hu); | |
236 | ||
237 | skb_queue_purge(&intel->txq); | |
238 | ||
239 | return 0; | |
240 | } | |
241 | ||
242 | static int inject_cmd_complete(struct hci_dev *hdev, __u16 opcode) | |
243 | { | |
244 | struct sk_buff *skb; | |
245 | struct hci_event_hdr *hdr; | |
246 | struct hci_ev_cmd_complete *evt; | |
247 | ||
248 | skb = bt_skb_alloc(sizeof(*hdr) + sizeof(*evt) + 1, GFP_ATOMIC); | |
249 | if (!skb) | |
250 | return -ENOMEM; | |
251 | ||
252 | hdr = (struct hci_event_hdr *)skb_put(skb, sizeof(*hdr)); | |
253 | hdr->evt = HCI_EV_CMD_COMPLETE; | |
254 | hdr->plen = sizeof(*evt) + 1; | |
255 | ||
256 | evt = (struct hci_ev_cmd_complete *)skb_put(skb, sizeof(*evt)); | |
257 | evt->ncmd = 0x01; | |
258 | evt->opcode = cpu_to_le16(opcode); | |
259 | ||
260 | *skb_put(skb, 1) = 0x00; | |
261 | ||
262 | bt_cb(skb)->pkt_type = HCI_EVENT_PKT; | |
263 | ||
264 | return hci_recv_frame(hdev, skb); | |
265 | } | |
266 | ||
ff289559 LP |
267 | static int intel_set_baudrate(struct hci_uart *hu, unsigned int speed) |
268 | { | |
269 | struct intel_data *intel = hu->priv; | |
270 | struct hci_dev *hdev = hu->hdev; | |
271 | u8 speed_cmd[] = { 0x06, 0xfc, 0x01, 0x00 }; | |
272 | struct sk_buff *skb; | |
1ab1f239 LP |
273 | int err; |
274 | ||
275 | /* This can be the first command sent to the chip, check | |
276 | * that the controller is ready. | |
277 | */ | |
278 | err = intel_wait_booting(hu); | |
279 | ||
280 | clear_bit(STATE_BOOTING, &intel->flags); | |
281 | ||
282 | /* In case of timeout, try to continue anyway */ | |
283 | if (err && err != ETIMEDOUT) | |
284 | return err; | |
ff289559 | 285 | |
f44e78a5 | 286 | bt_dev_info(hdev, "Change controller speed to %d", speed); |
ff289559 LP |
287 | |
288 | speed_cmd[3] = intel_convert_speed(speed); | |
289 | if (speed_cmd[3] == 0xff) { | |
f44e78a5 | 290 | bt_dev_err(hdev, "Unsupported speed"); |
ff289559 LP |
291 | return -EINVAL; |
292 | } | |
293 | ||
294 | /* Device will not accept speed change if Intel version has not been | |
295 | * previously requested. | |
296 | */ | |
297 | skb = __hci_cmd_sync(hdev, 0xfc05, 0, NULL, HCI_INIT_TIMEOUT); | |
298 | if (IS_ERR(skb)) { | |
f44e78a5 LP |
299 | bt_dev_err(hdev, "Reading Intel version information failed (%ld)", |
300 | PTR_ERR(skb)); | |
ff289559 LP |
301 | return PTR_ERR(skb); |
302 | } | |
303 | kfree_skb(skb); | |
304 | ||
305 | skb = bt_skb_alloc(sizeof(speed_cmd), GFP_KERNEL); | |
306 | if (!skb) { | |
f44e78a5 | 307 | bt_dev_err(hdev, "Failed to alloc memory for baudrate packet"); |
ff289559 LP |
308 | return -ENOMEM; |
309 | } | |
310 | ||
311 | memcpy(skb_put(skb, sizeof(speed_cmd)), speed_cmd, sizeof(speed_cmd)); | |
312 | bt_cb(skb)->pkt_type = HCI_COMMAND_PKT; | |
313 | ||
314 | hci_uart_set_flow_control(hu, true); | |
315 | ||
316 | skb_queue_tail(&intel->txq, skb); | |
317 | hci_uart_tx_wakeup(hu); | |
318 | ||
319 | /* wait 100ms to change baudrate on controller side */ | |
320 | msleep(100); | |
321 | ||
322 | hci_uart_set_baudrate(hu, speed); | |
323 | hci_uart_set_flow_control(hu, false); | |
324 | ||
325 | return 0; | |
326 | } | |
327 | ||
ca93cee5 LP |
328 | static int intel_setup(struct hci_uart *hu) |
329 | { | |
330 | static const u8 reset_param[] = { 0x00, 0x01, 0x00, 0x01, | |
331 | 0x00, 0x08, 0x04, 0x00 }; | |
b98469f4 | 332 | static const u8 lpm_param[] = { 0x03, 0x07, 0x01, 0x0b }; |
ca93cee5 | 333 | struct intel_data *intel = hu->priv; |
b98469f4 | 334 | struct intel_device *idev = NULL; |
ca93cee5 LP |
335 | struct hci_dev *hdev = hu->hdev; |
336 | struct sk_buff *skb; | |
337 | struct intel_version *ver; | |
338 | struct intel_boot_params *params; | |
b98469f4 | 339 | struct list_head *p; |
ca93cee5 LP |
340 | const struct firmware *fw; |
341 | const u8 *fw_ptr; | |
342 | char fwname[64]; | |
343 | u32 frag_len; | |
344 | ktime_t calltime, delta, rettime; | |
345 | unsigned long long duration; | |
ff289559 LP |
346 | unsigned int init_speed, oper_speed; |
347 | int speed_change = 0; | |
ca93cee5 LP |
348 | int err; |
349 | ||
f44e78a5 | 350 | bt_dev_dbg(hdev, "start intel_setup"); |
ca93cee5 | 351 | |
35ab8150 MH |
352 | hu->hdev->set_bdaddr = btintel_set_bdaddr; |
353 | ||
ca93cee5 LP |
354 | calltime = ktime_get(); |
355 | ||
ff289559 LP |
356 | if (hu->init_speed) |
357 | init_speed = hu->init_speed; | |
358 | else | |
359 | init_speed = hu->proto->init_speed; | |
360 | ||
361 | if (hu->oper_speed) | |
362 | oper_speed = hu->oper_speed; | |
363 | else | |
364 | oper_speed = hu->proto->oper_speed; | |
365 | ||
366 | if (oper_speed && init_speed && oper_speed != init_speed) | |
367 | speed_change = 1; | |
368 | ||
1ab1f239 LP |
369 | /* Check that the controller is ready */ |
370 | err = intel_wait_booting(hu); | |
371 | ||
372 | clear_bit(STATE_BOOTING, &intel->flags); | |
373 | ||
374 | /* In case of timeout, try to continue anyway */ | |
375 | if (err && err != ETIMEDOUT) | |
376 | return err; | |
377 | ||
ca93cee5 LP |
378 | set_bit(STATE_BOOTLOADER, &intel->flags); |
379 | ||
380 | /* Read the Intel version information to determine if the device | |
381 | * is in bootloader mode or if it already has operational firmware | |
382 | * loaded. | |
383 | */ | |
384 | skb = __hci_cmd_sync(hdev, 0xfc05, 0, NULL, HCI_INIT_TIMEOUT); | |
385 | if (IS_ERR(skb)) { | |
f44e78a5 LP |
386 | bt_dev_err(hdev, "Reading Intel version information failed (%ld)", |
387 | PTR_ERR(skb)); | |
ca93cee5 LP |
388 | return PTR_ERR(skb); |
389 | } | |
390 | ||
391 | if (skb->len != sizeof(*ver)) { | |
f44e78a5 | 392 | bt_dev_err(hdev, "Intel version event size mismatch"); |
ca93cee5 LP |
393 | kfree_skb(skb); |
394 | return -EILSEQ; | |
395 | } | |
396 | ||
397 | ver = (struct intel_version *)skb->data; | |
398 | if (ver->status) { | |
f44e78a5 LP |
399 | bt_dev_err(hdev, "Intel version command failure (%02x)", |
400 | ver->status); | |
ca93cee5 LP |
401 | err = -bt_to_errno(ver->status); |
402 | kfree_skb(skb); | |
403 | return err; | |
404 | } | |
405 | ||
406 | /* The hardware platform number has a fixed value of 0x37 and | |
407 | * for now only accept this single value. | |
408 | */ | |
409 | if (ver->hw_platform != 0x37) { | |
f44e78a5 LP |
410 | bt_dev_err(hdev, "Unsupported Intel hardware platform (%u)", |
411 | ver->hw_platform); | |
ca93cee5 LP |
412 | kfree_skb(skb); |
413 | return -EINVAL; | |
414 | } | |
415 | ||
416 | /* At the moment only the hardware variant iBT 3.0 (LnP/SfP) is | |
417 | * supported by this firmware loading method. This check has been | |
418 | * put in place to ensure correct forward compatibility options | |
419 | * when newer hardware variants come along. | |
420 | */ | |
421 | if (ver->hw_variant != 0x0b) { | |
f44e78a5 LP |
422 | bt_dev_err(hdev, "Unsupported Intel hardware variant (%u)", |
423 | ver->hw_variant); | |
ca93cee5 LP |
424 | kfree_skb(skb); |
425 | return -EINVAL; | |
426 | } | |
427 | ||
7feb99e1 | 428 | btintel_version_info(hdev, ver); |
ca93cee5 LP |
429 | |
430 | /* The firmware variant determines if the device is in bootloader | |
431 | * mode or is running operational firmware. The value 0x06 identifies | |
432 | * the bootloader and the value 0x23 identifies the operational | |
433 | * firmware. | |
434 | * | |
435 | * When the operational firmware is already present, then only | |
436 | * the check for valid Bluetooth device address is needed. This | |
437 | * determines if the device will be added as configured or | |
438 | * unconfigured controller. | |
439 | * | |
440 | * It is not possible to use the Secure Boot Parameters in this | |
441 | * case since that command is only available in bootloader mode. | |
442 | */ | |
443 | if (ver->fw_variant == 0x23) { | |
444 | kfree_skb(skb); | |
445 | clear_bit(STATE_BOOTLOADER, &intel->flags); | |
446 | btintel_check_bdaddr(hdev); | |
447 | return 0; | |
448 | } | |
449 | ||
450 | /* If the device is not in bootloader mode, then the only possible | |
451 | * choice is to return an error and abort the device initialization. | |
452 | */ | |
453 | if (ver->fw_variant != 0x06) { | |
f44e78a5 LP |
454 | bt_dev_err(hdev, "Unsupported Intel firmware variant (%u)", |
455 | ver->fw_variant); | |
ca93cee5 LP |
456 | kfree_skb(skb); |
457 | return -ENODEV; | |
458 | } | |
459 | ||
460 | kfree_skb(skb); | |
461 | ||
462 | /* Read the secure boot parameters to identify the operating | |
463 | * details of the bootloader. | |
464 | */ | |
465 | skb = __hci_cmd_sync(hdev, 0xfc0d, 0, NULL, HCI_INIT_TIMEOUT); | |
466 | if (IS_ERR(skb)) { | |
f44e78a5 LP |
467 | bt_dev_err(hdev, "Reading Intel boot parameters failed (%ld)", |
468 | PTR_ERR(skb)); | |
ca93cee5 LP |
469 | return PTR_ERR(skb); |
470 | } | |
471 | ||
472 | if (skb->len != sizeof(*params)) { | |
f44e78a5 | 473 | bt_dev_err(hdev, "Intel boot parameters size mismatch"); |
ca93cee5 LP |
474 | kfree_skb(skb); |
475 | return -EILSEQ; | |
476 | } | |
477 | ||
478 | params = (struct intel_boot_params *)skb->data; | |
479 | if (params->status) { | |
f44e78a5 LP |
480 | bt_dev_err(hdev, "Intel boot parameters command failure (%02x)", |
481 | params->status); | |
ca93cee5 LP |
482 | err = -bt_to_errno(params->status); |
483 | kfree_skb(skb); | |
484 | return err; | |
485 | } | |
486 | ||
f44e78a5 LP |
487 | bt_dev_info(hdev, "Device revision is %u", |
488 | le16_to_cpu(params->dev_revid)); | |
ca93cee5 | 489 | |
f44e78a5 LP |
490 | bt_dev_info(hdev, "Secure boot is %s", |
491 | params->secure_boot ? "enabled" : "disabled"); | |
ca93cee5 | 492 | |
f44e78a5 | 493 | bt_dev_info(hdev, "Minimum firmware build %u week %u %u", |
ca93cee5 LP |
494 | params->min_fw_build_nn, params->min_fw_build_cw, |
495 | 2000 + params->min_fw_build_yy); | |
496 | ||
497 | /* It is required that every single firmware fragment is acknowledged | |
498 | * with a command complete event. If the boot parameters indicate | |
499 | * that this bootloader does not send them, then abort the setup. | |
500 | */ | |
501 | if (params->limited_cce != 0x00) { | |
f44e78a5 LP |
502 | bt_dev_err(hdev, "Unsupported Intel firmware loading method (%u)", |
503 | params->limited_cce); | |
ca93cee5 LP |
504 | kfree_skb(skb); |
505 | return -EINVAL; | |
506 | } | |
507 | ||
508 | /* If the OTP has no valid Bluetooth device address, then there will | |
509 | * also be no valid address for the operational firmware. | |
510 | */ | |
511 | if (!bacmp(¶ms->otp_bdaddr, BDADDR_ANY)) { | |
f44e78a5 | 512 | bt_dev_info(hdev, "No device address configured"); |
ca93cee5 LP |
513 | set_bit(HCI_QUIRK_INVALID_BDADDR, &hdev->quirks); |
514 | } | |
515 | ||
516 | /* With this Intel bootloader only the hardware variant and device | |
517 | * revision information are used to select the right firmware. | |
518 | * | |
519 | * Currently this bootloader support is limited to hardware variant | |
520 | * iBT 3.0 (LnP/SfP) which is identified by the value 11 (0x0b). | |
521 | */ | |
522 | snprintf(fwname, sizeof(fwname), "intel/ibt-11-%u.sfi", | |
523 | le16_to_cpu(params->dev_revid)); | |
524 | ||
525 | err = request_firmware(&fw, fwname, &hdev->dev); | |
526 | if (err < 0) { | |
f44e78a5 LP |
527 | bt_dev_err(hdev, "Failed to load Intel firmware file (%d)", |
528 | err); | |
ca93cee5 LP |
529 | kfree_skb(skb); |
530 | return err; | |
531 | } | |
532 | ||
f44e78a5 | 533 | bt_dev_info(hdev, "Found device firmware: %s", fwname); |
ca93cee5 LP |
534 | |
535 | kfree_skb(skb); | |
536 | ||
537 | if (fw->size < 644) { | |
f44e78a5 LP |
538 | bt_dev_err(hdev, "Invalid size of firmware file (%zu)", |
539 | fw->size); | |
ca93cee5 LP |
540 | err = -EBADF; |
541 | goto done; | |
542 | } | |
543 | ||
544 | set_bit(STATE_DOWNLOADING, &intel->flags); | |
545 | ||
546 | /* Start the firmware download transaction with the Init fragment | |
547 | * represented by the 128 bytes of CSS header. | |
548 | */ | |
09df123d | 549 | err = btintel_secure_send(hdev, 0x00, 128, fw->data); |
ca93cee5 | 550 | if (err < 0) { |
f44e78a5 | 551 | bt_dev_err(hdev, "Failed to send firmware header (%d)", err); |
ca93cee5 LP |
552 | goto done; |
553 | } | |
554 | ||
555 | /* Send the 256 bytes of public key information from the firmware | |
556 | * as the PKey fragment. | |
557 | */ | |
09df123d | 558 | err = btintel_secure_send(hdev, 0x03, 256, fw->data + 128); |
ca93cee5 | 559 | if (err < 0) { |
f44e78a5 LP |
560 | bt_dev_err(hdev, "Failed to send firmware public key (%d)", |
561 | err); | |
ca93cee5 LP |
562 | goto done; |
563 | } | |
564 | ||
565 | /* Send the 256 bytes of signature information from the firmware | |
566 | * as the Sign fragment. | |
567 | */ | |
09df123d | 568 | err = btintel_secure_send(hdev, 0x02, 256, fw->data + 388); |
ca93cee5 | 569 | if (err < 0) { |
f44e78a5 LP |
570 | bt_dev_err(hdev, "Failed to send firmware signature (%d)", |
571 | err); | |
ca93cee5 LP |
572 | goto done; |
573 | } | |
574 | ||
575 | fw_ptr = fw->data + 644; | |
576 | frag_len = 0; | |
577 | ||
578 | while (fw_ptr - fw->data < fw->size) { | |
579 | struct hci_command_hdr *cmd = (void *)(fw_ptr + frag_len); | |
580 | ||
581 | frag_len += sizeof(*cmd) + cmd->plen; | |
582 | ||
f44e78a5 LP |
583 | bt_dev_dbg(hdev, "Patching %td/%zu", (fw_ptr - fw->data), |
584 | fw->size); | |
ca93cee5 LP |
585 | |
586 | /* The parameter length of the secure send command requires | |
587 | * a 4 byte alignment. It happens so that the firmware file | |
588 | * contains proper Intel_NOP commands to align the fragments | |
589 | * as needed. | |
590 | * | |
591 | * Send set of commands with 4 byte alignment from the | |
592 | * firmware data buffer as a single Data fragement. | |
593 | */ | |
594 | if (frag_len % 4) | |
595 | continue; | |
596 | ||
597 | /* Send each command from the firmware data buffer as | |
598 | * a single Data fragment. | |
599 | */ | |
09df123d | 600 | err = btintel_secure_send(hdev, 0x01, frag_len, fw_ptr); |
ca93cee5 | 601 | if (err < 0) { |
f44e78a5 LP |
602 | bt_dev_err(hdev, "Failed to send firmware data (%d)", |
603 | err); | |
ca93cee5 LP |
604 | goto done; |
605 | } | |
606 | ||
607 | fw_ptr += frag_len; | |
608 | frag_len = 0; | |
609 | } | |
610 | ||
611 | set_bit(STATE_FIRMWARE_LOADED, &intel->flags); | |
612 | ||
f44e78a5 | 613 | bt_dev_info(hdev, "Waiting for firmware download to complete"); |
ca93cee5 LP |
614 | |
615 | /* Before switching the device into operational mode and with that | |
616 | * booting the loaded firmware, wait for the bootloader notification | |
617 | * that all fragments have been successfully received. | |
618 | * | |
619 | * When the event processing receives the notification, then the | |
620 | * STATE_DOWNLOADING flag will be cleared. | |
621 | * | |
622 | * The firmware loading should not take longer than 5 seconds | |
623 | * and thus just timeout if that happens and fail the setup | |
624 | * of this device. | |
625 | */ | |
626 | err = wait_on_bit_timeout(&intel->flags, STATE_DOWNLOADING, | |
627 | TASK_INTERRUPTIBLE, | |
628 | msecs_to_jiffies(5000)); | |
629 | if (err == 1) { | |
f44e78a5 | 630 | bt_dev_err(hdev, "Firmware loading interrupted"); |
ca93cee5 LP |
631 | err = -EINTR; |
632 | goto done; | |
633 | } | |
634 | ||
635 | if (err) { | |
f44e78a5 | 636 | bt_dev_err(hdev, "Firmware loading timeout"); |
ca93cee5 LP |
637 | err = -ETIMEDOUT; |
638 | goto done; | |
639 | } | |
640 | ||
641 | if (test_bit(STATE_FIRMWARE_FAILED, &intel->flags)) { | |
f44e78a5 | 642 | bt_dev_err(hdev, "Firmware loading failed"); |
ca93cee5 LP |
643 | err = -ENOEXEC; |
644 | goto done; | |
645 | } | |
646 | ||
647 | rettime = ktime_get(); | |
648 | delta = ktime_sub(rettime, calltime); | |
649 | duration = (unsigned long long) ktime_to_ns(delta) >> 10; | |
650 | ||
f44e78a5 | 651 | bt_dev_info(hdev, "Firmware loaded in %llu usecs", duration); |
ca93cee5 LP |
652 | |
653 | done: | |
654 | release_firmware(fw); | |
655 | ||
656 | if (err < 0) | |
657 | return err; | |
658 | ||
ff289559 LP |
659 | /* We need to restore the default speed before Intel reset */ |
660 | if (speed_change) { | |
661 | err = intel_set_baudrate(hu, init_speed); | |
662 | if (err) | |
663 | return err; | |
664 | } | |
665 | ||
ca93cee5 LP |
666 | calltime = ktime_get(); |
667 | ||
668 | set_bit(STATE_BOOTING, &intel->flags); | |
669 | ||
670 | skb = __hci_cmd_sync(hdev, 0xfc01, sizeof(reset_param), reset_param, | |
671 | HCI_INIT_TIMEOUT); | |
672 | if (IS_ERR(skb)) | |
673 | return PTR_ERR(skb); | |
674 | ||
675 | kfree_skb(skb); | |
676 | ||
677 | /* The bootloader will not indicate when the device is ready. This | |
678 | * is done by the operational firmware sending bootup notification. | |
679 | * | |
680 | * Booting into operational firmware should not take longer than | |
681 | * 1 second. However if that happens, then just fail the setup | |
682 | * since something went wrong. | |
683 | */ | |
f44e78a5 | 684 | bt_dev_info(hdev, "Waiting for device to boot"); |
ca93cee5 | 685 | |
1ab1f239 LP |
686 | err = intel_wait_booting(hu); |
687 | if (err) | |
688 | return err; | |
ca93cee5 | 689 | |
1ab1f239 | 690 | clear_bit(STATE_BOOTING, &intel->flags); |
ca93cee5 LP |
691 | |
692 | rettime = ktime_get(); | |
693 | delta = ktime_sub(rettime, calltime); | |
694 | duration = (unsigned long long) ktime_to_ns(delta) >> 10; | |
695 | ||
f44e78a5 | 696 | bt_dev_info(hdev, "Device booted in %llu usecs", duration); |
ca93cee5 | 697 | |
b98469f4 LP |
698 | /* Enable LPM if matching pdev with wakeup enabled */ |
699 | spin_lock(&intel_device_list_lock); | |
700 | list_for_each(p, &intel_device_list) { | |
701 | struct intel_device *dev = list_entry(p, struct intel_device, | |
702 | list); | |
703 | if (hu->tty->dev->parent == dev->pdev->dev.parent) { | |
704 | if (device_may_wakeup(&dev->pdev->dev)) | |
705 | idev = dev; | |
706 | break; | |
707 | } | |
708 | } | |
709 | spin_unlock(&intel_device_list_lock); | |
710 | ||
711 | if (!idev) | |
712 | goto no_lpm; | |
713 | ||
f44e78a5 | 714 | bt_dev_info(hdev, "Enabling LPM"); |
b98469f4 LP |
715 | |
716 | skb = __hci_cmd_sync(hdev, 0xfc8b, sizeof(lpm_param), lpm_param, | |
717 | HCI_CMD_TIMEOUT); | |
718 | if (IS_ERR(skb)) { | |
f44e78a5 | 719 | bt_dev_err(hdev, "Failed to enable LPM"); |
b98469f4 LP |
720 | goto no_lpm; |
721 | } | |
722 | kfree_skb(skb); | |
723 | ||
724 | set_bit(STATE_LPM_ENABLED, &intel->flags); | |
725 | ||
726 | no_lpm: | |
ff289559 LP |
727 | skb = __hci_cmd_sync(hdev, HCI_OP_RESET, 0, NULL, HCI_CMD_TIMEOUT); |
728 | if (IS_ERR(skb)) | |
729 | return PTR_ERR(skb); | |
730 | kfree_skb(skb); | |
731 | ||
732 | if (speed_change) { | |
733 | err = intel_set_baudrate(hu, oper_speed); | |
734 | if (err) | |
735 | return err; | |
736 | } | |
737 | ||
f44e78a5 | 738 | bt_dev_info(hdev, "Setup complete"); |
ff289559 | 739 | |
ca93cee5 LP |
740 | clear_bit(STATE_BOOTLOADER, &intel->flags); |
741 | ||
742 | return 0; | |
743 | } | |
744 | ||
745 | static int intel_recv_event(struct hci_dev *hdev, struct sk_buff *skb) | |
746 | { | |
747 | struct hci_uart *hu = hci_get_drvdata(hdev); | |
748 | struct intel_data *intel = hu->priv; | |
749 | struct hci_event_hdr *hdr; | |
750 | ||
1ab1f239 LP |
751 | if (!test_bit(STATE_BOOTLOADER, &intel->flags) && |
752 | !test_bit(STATE_BOOTING, &intel->flags)) | |
ca93cee5 LP |
753 | goto recv; |
754 | ||
755 | hdr = (void *)skb->data; | |
756 | ||
757 | /* When the firmware loading completes the device sends | |
758 | * out a vendor specific event indicating the result of | |
759 | * the firmware loading. | |
760 | */ | |
761 | if (skb->len == 7 && hdr->evt == 0xff && hdr->plen == 0x05 && | |
762 | skb->data[2] == 0x06) { | |
763 | if (skb->data[3] != 0x00) | |
764 | set_bit(STATE_FIRMWARE_FAILED, &intel->flags); | |
765 | ||
766 | if (test_and_clear_bit(STATE_DOWNLOADING, &intel->flags) && | |
767 | test_bit(STATE_FIRMWARE_LOADED, &intel->flags)) { | |
768 | smp_mb__after_atomic(); | |
769 | wake_up_bit(&intel->flags, STATE_DOWNLOADING); | |
770 | } | |
771 | ||
772 | /* When switching to the operational firmware the device | |
773 | * sends a vendor specific event indicating that the bootup | |
774 | * completed. | |
775 | */ | |
776 | } else if (skb->len == 9 && hdr->evt == 0xff && hdr->plen == 0x07 && | |
777 | skb->data[2] == 0x02) { | |
778 | if (test_and_clear_bit(STATE_BOOTING, &intel->flags)) { | |
779 | smp_mb__after_atomic(); | |
780 | wake_up_bit(&intel->flags, STATE_BOOTING); | |
781 | } | |
782 | } | |
783 | recv: | |
784 | return hci_recv_frame(hdev, skb); | |
785 | } | |
786 | ||
b98469f4 LP |
787 | static void intel_recv_lpm_notify(struct hci_dev *hdev, int value) |
788 | { | |
789 | struct hci_uart *hu = hci_get_drvdata(hdev); | |
790 | struct intel_data *intel = hu->priv; | |
791 | ||
f44e78a5 | 792 | bt_dev_dbg(hdev, "TX idle notification (%d)", value); |
b98469f4 LP |
793 | |
794 | if (value) | |
795 | set_bit(STATE_TX_ACTIVE, &intel->flags); | |
796 | else | |
797 | clear_bit(STATE_TX_ACTIVE, &intel->flags); | |
798 | } | |
799 | ||
800 | static int intel_recv_lpm(struct hci_dev *hdev, struct sk_buff *skb) | |
801 | { | |
802 | struct hci_lpm_pkt *lpm = (void *)skb->data; | |
803 | ||
804 | switch (lpm->opcode) { | |
805 | case LPM_OP_TX_NOTIFY: | |
806 | if (lpm->dlen) | |
807 | intel_recv_lpm_notify(hdev, lpm->data[0]); | |
808 | break; | |
809 | default: | |
f44e78a5 | 810 | bt_dev_err(hdev, "Unknown LPM opcode (%02x)", lpm->opcode); |
b98469f4 LP |
811 | break; |
812 | } | |
813 | ||
814 | kfree_skb(skb); | |
815 | ||
816 | return 0; | |
817 | } | |
818 | ||
819 | #define INTEL_RECV_LPM \ | |
820 | .type = HCI_LPM_PKT, \ | |
821 | .hlen = HCI_LPM_HDR_SIZE, \ | |
822 | .loff = 1, \ | |
823 | .lsize = 1, \ | |
824 | .maxlen = HCI_LPM_MAX_SIZE | |
825 | ||
ca93cee5 | 826 | static const struct h4_recv_pkt intel_recv_pkts[] = { |
b98469f4 LP |
827 | { H4_RECV_ACL, .recv = hci_recv_frame }, |
828 | { H4_RECV_SCO, .recv = hci_recv_frame }, | |
829 | { H4_RECV_EVENT, .recv = intel_recv_event }, | |
830 | { INTEL_RECV_LPM, .recv = intel_recv_lpm }, | |
ca93cee5 LP |
831 | }; |
832 | ||
833 | static int intel_recv(struct hci_uart *hu, const void *data, int count) | |
834 | { | |
835 | struct intel_data *intel = hu->priv; | |
836 | ||
837 | if (!test_bit(HCI_UART_REGISTERED, &hu->flags)) | |
838 | return -EUNATCH; | |
839 | ||
840 | intel->rx_skb = h4_recv_buf(hu->hdev, intel->rx_skb, data, count, | |
841 | intel_recv_pkts, | |
842 | ARRAY_SIZE(intel_recv_pkts)); | |
843 | if (IS_ERR(intel->rx_skb)) { | |
844 | int err = PTR_ERR(intel->rx_skb); | |
f44e78a5 | 845 | bt_dev_err(hu->hdev, "Frame reassembly failed (%d)", err); |
ca93cee5 LP |
846 | intel->rx_skb = NULL; |
847 | return err; | |
848 | } | |
849 | ||
850 | return count; | |
851 | } | |
852 | ||
853 | static int intel_enqueue(struct hci_uart *hu, struct sk_buff *skb) | |
854 | { | |
855 | struct intel_data *intel = hu->priv; | |
856 | ||
857 | BT_DBG("hu %p skb %p", hu, skb); | |
858 | ||
859 | skb_queue_tail(&intel->txq, skb); | |
860 | ||
861 | return 0; | |
862 | } | |
863 | ||
864 | static struct sk_buff *intel_dequeue(struct hci_uart *hu) | |
865 | { | |
866 | struct intel_data *intel = hu->priv; | |
867 | struct sk_buff *skb; | |
868 | ||
869 | skb = skb_dequeue(&intel->txq); | |
870 | if (!skb) | |
871 | return skb; | |
872 | ||
873 | if (test_bit(STATE_BOOTLOADER, &intel->flags) && | |
874 | (bt_cb(skb)->pkt_type == HCI_COMMAND_PKT)) { | |
875 | struct hci_command_hdr *cmd = (void *)skb->data; | |
876 | __u16 opcode = le16_to_cpu(cmd->opcode); | |
877 | ||
878 | /* When the 0xfc01 command is issued to boot into | |
879 | * the operational firmware, it will actually not | |
880 | * send a command complete event. To keep the flow | |
881 | * control working inject that event here. | |
882 | */ | |
883 | if (opcode == 0xfc01) | |
884 | inject_cmd_complete(hu->hdev, opcode); | |
885 | } | |
886 | ||
887 | /* Prepend skb with frame type */ | |
888 | memcpy(skb_push(skb, 1), &bt_cb(skb)->pkt_type, 1); | |
889 | ||
890 | return skb; | |
891 | } | |
892 | ||
893 | static const struct hci_uart_proto intel_proto = { | |
894 | .id = HCI_UART_INTEL, | |
895 | .name = "Intel", | |
896 | .init_speed = 115200, | |
ff289559 | 897 | .oper_speed = 3000000, |
ca93cee5 LP |
898 | .open = intel_open, |
899 | .close = intel_close, | |
900 | .flush = intel_flush, | |
901 | .setup = intel_setup, | |
ff289559 | 902 | .set_baudrate = intel_set_baudrate, |
ca93cee5 LP |
903 | .recv = intel_recv, |
904 | .enqueue = intel_enqueue, | |
905 | .dequeue = intel_dequeue, | |
906 | }; | |
907 | ||
1ab1f239 LP |
908 | #ifdef CONFIG_ACPI |
909 | static const struct acpi_device_id intel_acpi_match[] = { | |
910 | { "INT33E1", 0 }, | |
911 | { }, | |
912 | }; | |
913 | MODULE_DEVICE_TABLE(acpi, intel_acpi_match); | |
914 | ||
915 | static int intel_acpi_probe(struct intel_device *idev) | |
916 | { | |
917 | const struct acpi_device_id *id; | |
918 | ||
919 | id = acpi_match_device(intel_acpi_match, &idev->pdev->dev); | |
920 | if (!id) | |
921 | return -ENODEV; | |
922 | ||
923 | return 0; | |
924 | } | |
925 | #else | |
926 | static int intel_acpi_probe(struct intel_device *idev) | |
927 | { | |
928 | return -ENODEV; | |
929 | } | |
930 | #endif | |
931 | ||
932 | static int intel_probe(struct platform_device *pdev) | |
933 | { | |
934 | struct intel_device *idev; | |
935 | ||
936 | idev = devm_kzalloc(&pdev->dev, sizeof(*idev), GFP_KERNEL); | |
937 | if (!idev) | |
938 | return -ENOMEM; | |
939 | ||
940 | idev->pdev = pdev; | |
941 | ||
942 | if (ACPI_HANDLE(&pdev->dev)) { | |
943 | int err = intel_acpi_probe(idev); | |
944 | if (err) | |
945 | return err; | |
946 | } else { | |
947 | return -ENODEV; | |
948 | } | |
949 | ||
950 | idev->reset = devm_gpiod_get_optional(&pdev->dev, "reset", | |
951 | GPIOD_OUT_LOW); | |
952 | if (IS_ERR(idev->reset)) { | |
953 | dev_err(&pdev->dev, "Unable to retrieve gpio\n"); | |
954 | return PTR_ERR(idev->reset); | |
955 | } | |
956 | ||
765ea3ab LP |
957 | idev->irq = platform_get_irq(pdev, 0); |
958 | if (idev->irq < 0) { | |
959 | struct gpio_desc *host_wake; | |
960 | ||
961 | dev_err(&pdev->dev, "No IRQ, falling back to gpio-irq\n"); | |
962 | ||
963 | host_wake = devm_gpiod_get_optional(&pdev->dev, "host-wake", | |
964 | GPIOD_IN); | |
965 | if (IS_ERR(host_wake)) { | |
966 | dev_err(&pdev->dev, "Unable to retrieve IRQ\n"); | |
967 | goto no_irq; | |
968 | } | |
969 | ||
970 | idev->irq = gpiod_to_irq(host_wake); | |
971 | if (idev->irq < 0) { | |
972 | dev_err(&pdev->dev, "No corresponding irq for gpio\n"); | |
973 | goto no_irq; | |
974 | } | |
975 | } | |
976 | ||
977 | /* Only enable wake-up/irq when controller is powered */ | |
978 | device_set_wakeup_capable(&pdev->dev, true); | |
979 | device_wakeup_disable(&pdev->dev); | |
980 | ||
981 | no_irq: | |
1ab1f239 LP |
982 | platform_set_drvdata(pdev, idev); |
983 | ||
984 | /* Place this instance on the device list */ | |
985 | spin_lock(&intel_device_list_lock); | |
986 | list_add_tail(&idev->list, &intel_device_list); | |
987 | spin_unlock(&intel_device_list_lock); | |
988 | ||
765ea3ab LP |
989 | dev_info(&pdev->dev, "registered, gpio(%d)/irq(%d).\n", |
990 | desc_to_gpio(idev->reset), idev->irq); | |
1ab1f239 LP |
991 | |
992 | return 0; | |
993 | } | |
994 | ||
995 | static int intel_remove(struct platform_device *pdev) | |
996 | { | |
997 | struct intel_device *idev = platform_get_drvdata(pdev); | |
998 | ||
765ea3ab LP |
999 | device_wakeup_disable(&pdev->dev); |
1000 | ||
1ab1f239 LP |
1001 | spin_lock(&intel_device_list_lock); |
1002 | list_del(&idev->list); | |
1003 | spin_unlock(&intel_device_list_lock); | |
1004 | ||
1005 | dev_info(&pdev->dev, "unregistered.\n"); | |
1006 | ||
1007 | return 0; | |
1008 | } | |
1009 | ||
1010 | static struct platform_driver intel_driver = { | |
1011 | .probe = intel_probe, | |
1012 | .remove = intel_remove, | |
1013 | .driver = { | |
1014 | .name = "hci_intel", | |
1015 | .acpi_match_table = ACPI_PTR(intel_acpi_match), | |
1016 | }, | |
1017 | }; | |
1018 | ||
ca93cee5 LP |
1019 | int __init intel_init(void) |
1020 | { | |
1ab1f239 LP |
1021 | platform_driver_register(&intel_driver); |
1022 | ||
ca93cee5 LP |
1023 | return hci_uart_register_proto(&intel_proto); |
1024 | } | |
1025 | ||
1026 | int __exit intel_deinit(void) | |
1027 | { | |
1ab1f239 LP |
1028 | platform_driver_unregister(&intel_driver); |
1029 | ||
ca93cee5 LP |
1030 | return hci_uart_unregister_proto(&intel_proto); |
1031 | } |