drivers/bluetooth/btintel.c

   1 /*
   2  *
   3  *  Bluetooth support for Intel devices
   4  *
   5  *  Copyright (C) 2015  Intel Corporation
   6  *
   7  *
   8  *  This program is free software; you can redistribute it and/or modify
   9  *  it under the terms of the GNU General Public License as published by
  10  *  the Free Software Foundation; either version 2 of the License, or
  11  *  (at your option) any later version.
  12  *
  13  *  This program is distributed in the hope that it will be useful,
  14  *  but WITHOUT ANY WARRANTY; without even the implied warranty of
  15  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  16  *  GNU General Public License for more details.
  17  *
  18  *  You should have received a copy of the GNU General Public License
  19  *  along with this program; if not, write to the Free Software
  20  *  Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
  21  *
  22  */
  23
  24 #include <linux/module.h>
  25 #include <linux/firmware.h>
  26 #include <linux/regmap.h>
  27
  28 #include <net/bluetooth/bluetooth.h>
  29 #include <net/bluetooth/hci_core.h>
  30
  31 #include "btintel.h"
  32
  33 #define VERSION "0.1"
  34
  35 #define BDADDR_INTEL (&(bdaddr_t) {{0x00, 0x8b, 0x9e, 0x19, 0x03, 0x00}})
  36
  37 int btintel_check_bdaddr(struct hci_dev *hdev)
  38 {
  39         struct hci_rp_read_bd_addr *bda;
  40         struct sk_buff *skb;
  41
  42         skb = __hci_cmd_sync(hdev, HCI_OP_READ_BD_ADDR, 0, NULL,
  43                              HCI_INIT_TIMEOUT);
  44         if (IS_ERR(skb)) {
  45                 int err = PTR_ERR(skb);
  46                 bt_dev_err(hdev, "Reading Intel device address failed (%d)",
  47                            err);
  48                 return err;
  49         }
  50
  51         if (skb->len != sizeof(*bda)) {
  52                 bt_dev_err(hdev, "Intel device address length mismatch");
  53                 kfree_skb(skb);
  54                 return -EIO;
  55         }
  56
  57         bda = (struct hci_rp_read_bd_addr *)skb->data;
  58
  59         /* For some Intel based controllers, the default Bluetooth device
  60          * address 00:03:19:9E:8B:00 can be found. These controllers are
  61          * fully operational, but have the danger of duplicate addresses
  62          * and that in turn can cause problems with Bluetooth operation.
  63          */
  64         if (!bacmp(&bda->bdaddr, BDADDR_INTEL)) {
  65                 bt_dev_err(hdev, "Found Intel default device address (%pMR)",
  66                            &bda->bdaddr);
  67                 set_bit(HCI_QUIRK_INVALID_BDADDR, &hdev->quirks);
  68         }
  69
  70         kfree_skb(skb);
  71
  72         return 0;
  73 }
  74 EXPORT_SYMBOL_GPL(btintel_check_bdaddr);
  75
  76 int btintel_enter_mfg(struct hci_dev *hdev)
  77 {
  78         const u8 param[] = { 0x01, 0x00 };
  79         struct sk_buff *skb;
  80
  81         skb = __hci_cmd_sync(hdev, 0xfc11, 2, param, HCI_CMD_TIMEOUT);
  82         if (IS_ERR(skb)) {
  83                 bt_dev_err(hdev, "Entering manufacturer mode failed (%ld)",
  84                            PTR_ERR(skb));
  85                 return PTR_ERR(skb);
  86         }
  87         kfree_skb(skb);
  88
  89         return 0;
  90 }
  91 EXPORT_SYMBOL_GPL(btintel_enter_mfg);
  92
  93 int btintel_exit_mfg(struct hci_dev *hdev, bool reset, bool patched)
  94 {
  95         u8 param[] = { 0x00, 0x00 };
  96         struct sk_buff *skb;
  97
  98         /* The 2nd command parameter specifies the manufacturing exit method:
  99          * 0x00: Just disable the manufacturing mode (0x00).
 100          * 0x01: Disable manufacturing mode and reset with patches deactivated.
 101          * 0x02: Disable manufacturing mode and reset with patches activated.
 102          */
 103         if (reset)
 104                 param[1] |= patched ? 0x02 : 0x01;
 105
 106         skb = __hci_cmd_sync(hdev, 0xfc11, 2, param, HCI_CMD_TIMEOUT);
 107         if (IS_ERR(skb)) {
 108                 bt_dev_err(hdev, "Exiting manufacturer mode failed (%ld)",
 109                            PTR_ERR(skb));
 110                 return PTR_ERR(skb);
 111         }
 112         kfree_skb(skb);
 113
 114         return 0;
 115 }
 116 EXPORT_SYMBOL_GPL(btintel_exit_mfg);
 117
 118 int btintel_set_bdaddr(struct hci_dev *hdev, const bdaddr_t *bdaddr)
 119 {
 120         struct sk_buff *skb;
 121         int err;
 122
 123         skb = __hci_cmd_sync(hdev, 0xfc31, 6, bdaddr, HCI_INIT_TIMEOUT);
 124         if (IS_ERR(skb)) {
 125                 err = PTR_ERR(skb);
 126                 bt_dev_err(hdev, "Changing Intel device address failed (%d)",
 127                            err);
 128                 return err;
 129         }
 130         kfree_skb(skb);
 131
 132         return 0;
 133 }
 134 EXPORT_SYMBOL_GPL(btintel_set_bdaddr);
 135
 136 int btintel_set_diag(struct hci_dev *hdev, bool enable)
 137 {
 138         struct sk_buff *skb;
 139         u8 param[3];
 140         int err;
 141
 142         if (enable) {
 143                 param[0] = 0x03;
 144                 param[1] = 0x03;
 145                 param[2] = 0x03;
 146         } else {
 147                 param[0] = 0x00;
 148                 param[1] = 0x00;
 149                 param[2] = 0x00;
 150         }
 151
 152         skb = __hci_cmd_sync(hdev, 0xfc43, 3, param, HCI_INIT_TIMEOUT);
 153         if (IS_ERR(skb)) {
 154                 err = PTR_ERR(skb);
 155                 if (err == -ENODATA)
 156                         goto done;
 157                 bt_dev_err(hdev, "Changing Intel diagnostic mode failed (%d)",
 158                            err);
 159                 return err;
 160         }
 161         kfree_skb(skb);
 162
 163 done:
 164         btintel_set_event_mask(hdev, enable);
 165         return 0;
 166 }
 167 EXPORT_SYMBOL_GPL(btintel_set_diag);
 168
 169 int btintel_set_diag_mfg(struct hci_dev *hdev, bool enable)
 170 {
 171         int err, ret;
 172
 173         err = btintel_enter_mfg(hdev);
 174         if (err)
 175                 return err;
 176
 177         ret = btintel_set_diag(hdev, enable);
 178
 179         err = btintel_exit_mfg(hdev, false, false);
 180         if (err)
 181                 return err;
 182
 183         return ret;
 184 }
 185 EXPORT_SYMBOL_GPL(btintel_set_diag_mfg);
 186
 187 void btintel_hw_error(struct hci_dev *hdev, u8 code)
 188 {
 189         struct sk_buff *skb;
 190         u8 type = 0x00;
 191
 192         bt_dev_err(hdev, "Hardware error 0x%2.2x", code);
 193
 194         skb = __hci_cmd_sync(hdev, HCI_OP_RESET, 0, NULL, HCI_INIT_TIMEOUT);
 195         if (IS_ERR(skb)) {
 196                 bt_dev_err(hdev, "Reset after hardware error failed (%ld)",
 197                            PTR_ERR(skb));
 198                 return;
 199         }
 200         kfree_skb(skb);
 201
 202         skb = __hci_cmd_sync(hdev, 0xfc22, 1, &type, HCI_INIT_TIMEOUT);
 203         if (IS_ERR(skb)) {
 204                 bt_dev_err(hdev, "Retrieving Intel exception info failed (%ld)",
 205                            PTR_ERR(skb));
 206                 return;
 207         }
 208
 209         if (skb->len != 13) {
 210                 bt_dev_err(hdev, "Exception info size mismatch");
 211                 kfree_skb(skb);
 212                 return;
 213         }
 214
 215         bt_dev_err(hdev, "Exception info %s", (char *)(skb->data + 1));
 216
 217         kfree_skb(skb);
 218 }
 219 EXPORT_SYMBOL_GPL(btintel_hw_error);
 220
 221 void btintel_version_info(struct hci_dev *hdev, struct intel_version *ver)
 222 {
 223         const char *variant;
 224
 225         switch (ver->fw_variant) {
 226         case 0x06:
 227                 variant = "Bootloader";
 228                 break;
 229         case 0x23:
 230                 variant = "Firmware";
 231                 break;
 232         default:
 233                 return;
 234         }
 235
 236         bt_dev_info(hdev, "%s revision %u.%u build %u week %u %u",
 237                     variant, ver->fw_revision >> 4, ver->fw_revision & 0x0f,
 238                     ver->fw_build_num, ver->fw_build_ww,
 239                     2000 + ver->fw_build_yy);
 240 }
 241 EXPORT_SYMBOL_GPL(btintel_version_info);
 242
 243 int btintel_secure_send(struct hci_dev *hdev, u8 fragment_type, u32 plen,
 244                         const void *param)
 245 {
 246         while (plen > 0) {
 247                 struct sk_buff *skb;
 248                 u8 cmd_param[253], fragment_len = (plen > 252) ? 252 : plen;
 249
 250                 cmd_param[0] = fragment_type;
 251                 memcpy(cmd_param + 1, param, fragment_len);
 252
 253                 skb = __hci_cmd_sync(hdev, 0xfc09, fragment_len + 1,
 254                                      cmd_param, HCI_INIT_TIMEOUT);
 255                 if (IS_ERR(skb))
 256                         return PTR_ERR(skb);
 257
 258                 kfree_skb(skb);
 259
 260                 plen -= fragment_len;
 261                 param += fragment_len;
 262         }
 263
 264         return 0;
 265 }
 266 EXPORT_SYMBOL_GPL(btintel_secure_send);
 267
 268 int btintel_load_ddc_config(struct hci_dev *hdev, const char *ddc_name)
 269 {
 270         const struct firmware *fw;
 271         struct sk_buff *skb;
 272         const u8 *fw_ptr;
 273         int err;
 274
 275         err = request_firmware_direct(&fw, ddc_name, &hdev->dev);
 276         if (err < 0) {
 277                 bt_dev_err(hdev, "Failed to load Intel DDC file %s (%d)",
 278                            ddc_name, err);
 279                 return err;
 280         }
 281
 282         bt_dev_info(hdev, "Found Intel DDC parameters: %s", ddc_name);
 283
 284         fw_ptr = fw->data;
 285
 286         /* DDC file contains one or more DDC structure which has
 287          * Length (1 byte), DDC ID (2 bytes), and DDC value (Length - 2).
 288          */
 289         while (fw->size > fw_ptr - fw->data) {
 290                 u8 cmd_plen = fw_ptr[0] + sizeof(u8);
 291
 292                 skb = __hci_cmd_sync(hdev, 0xfc8b, cmd_plen, fw_ptr,
 293                                      HCI_INIT_TIMEOUT);
 294                 if (IS_ERR(skb)) {
 295                         bt_dev_err(hdev, "Failed to send Intel_Write_DDC (%ld)",
 296                                    PTR_ERR(skb));
 297                         release_firmware(fw);
 298                         return PTR_ERR(skb);
 299                 }
 300
 301                 fw_ptr += cmd_plen;
 302                 kfree_skb(skb);
 303         }
 304
 305         release_firmware(fw);
 306
 307         bt_dev_info(hdev, "Applying Intel DDC parameters completed");
 308
 309         return 0;
 310 }
 311 EXPORT_SYMBOL_GPL(btintel_load_ddc_config);
 312
 313 int btintel_set_event_mask(struct hci_dev *hdev, bool debug)
 314 {
 315         u8 mask[8] = { 0x87, 0x0c, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 };
 316         struct sk_buff *skb;
 317         int err;
 318
 319         if (debug)
 320                 mask[1] |= 0x62;
 321
 322         skb = __hci_cmd_sync(hdev, 0xfc52, 8, mask, HCI_INIT_TIMEOUT);
 323         if (IS_ERR(skb)) {
 324                 err = PTR_ERR(skb);
 325                 bt_dev_err(hdev, "Setting Intel event mask failed (%d)", err);
 326                 return err;
 327         }
 328         kfree_skb(skb);
 329
 330         return 0;
 331 }
 332 EXPORT_SYMBOL_GPL(btintel_set_event_mask);
 333
 334 int btintel_set_event_mask_mfg(struct hci_dev *hdev, bool debug)
 335 {
 336         int err, ret;
 337
 338         err = btintel_enter_mfg(hdev);
 339         if (err)
 340                 return err;
 341
 342         ret = btintel_set_event_mask(hdev, debug);
 343
 344         err = btintel_exit_mfg(hdev, false, false);
 345         if (err)
 346                 return err;
 347
 348         return ret;
 349 }
 350 EXPORT_SYMBOL_GPL(btintel_set_event_mask_mfg);
 351
 352 int btintel_read_version(struct hci_dev *hdev, struct intel_version *ver)
 353 {
 354         struct sk_buff *skb;
 355
 356         skb = __hci_cmd_sync(hdev, 0xfc05, 0, NULL, HCI_CMD_TIMEOUT);
 357         if (IS_ERR(skb)) {
 358                 bt_dev_err(hdev, "Reading Intel version information failed (%ld)",
 359                            PTR_ERR(skb));
 360                 return PTR_ERR(skb);
 361         }
 362
 363         if (skb->len != sizeof(*ver)) {
 364                 bt_dev_err(hdev, "Intel version event size mismatch");
 365                 kfree_skb(skb);
 366                 return -EILSEQ;
 367         }
 368
 369         memcpy(ver, skb->data, sizeof(*ver));
 370
 371         kfree_skb(skb);
 372
 373         return 0;
 374 }
 375 EXPORT_SYMBOL_GPL(btintel_read_version);
 376
 377 /* ------- REGMAP IBT SUPPORT ------- */
 378
 379 #define IBT_REG_MODE_8BIT  0x00
 380 #define IBT_REG_MODE_16BIT 0x01
 381 #define IBT_REG_MODE_32BIT 0x02
 382
 383 struct regmap_ibt_context {
 384         struct hci_dev *hdev;
 385         __u16 op_write;
 386         __u16 op_read;
 387 };
 388
 389 struct ibt_cp_reg_access {
 390         __le32  addr;
 391         __u8    mode;
 392         __u8    len;
 393         __u8    data[0];
 394 } __packed;
 395
 396 struct ibt_rp_reg_access {
 397         __u8    status;
 398         __le32  addr;
 399         __u8    data[0];
 400 } __packed;
 401
 402 static int regmap_ibt_read(void *context, const void *addr, size_t reg_size,
 403                            void *val, size_t val_size)
 404 {
 405         struct regmap_ibt_context *ctx = context;
 406         struct ibt_cp_reg_access cp;
 407         struct ibt_rp_reg_access *rp;
 408         struct sk_buff *skb;
 409         int err = 0;
 410
 411         if (reg_size != sizeof(__le32))
 412                 return -EINVAL;
 413
 414         switch (val_size) {
 415         case 1:
 416                 cp.mode = IBT_REG_MODE_8BIT;
 417                 break;
 418         case 2:
 419                 cp.mode = IBT_REG_MODE_16BIT;
 420                 break;
 421         case 4:
 422                 cp.mode = IBT_REG_MODE_32BIT;
 423                 break;
 424         default:
 425                 return -EINVAL;
 426         }
 427
 428         /* regmap provides a little-endian formatted addr */
 429         cp.addr = *(__le32 *)addr;
 430         cp.len = val_size;
 431
 432         bt_dev_dbg(ctx->hdev, "Register (0x%x) read", le32_to_cpu(cp.addr));
 433
 434         skb = hci_cmd_sync(ctx->hdev, ctx->op_read, sizeof(cp), &cp,
 435                            HCI_CMD_TIMEOUT);
 436         if (IS_ERR(skb)) {
 437                 err = PTR_ERR(skb);
 438                 bt_dev_err(ctx->hdev, "regmap: Register (0x%x) read error (%d)",
 439                            le32_to_cpu(cp.addr), err);
 440                 return err;
 441         }
 442
 443         if (skb->len != sizeof(*rp) + val_size) {
 444                 bt_dev_err(ctx->hdev, "regmap: Register (0x%x) read error, bad len",
 445                            le32_to_cpu(cp.addr));
 446                 err = -EINVAL;
 447                 goto done;
 448         }
 449
 450         rp = (struct ibt_rp_reg_access *)skb->data;
 451
 452         if (rp->addr != cp.addr) {
 453                 bt_dev_err(ctx->hdev, "regmap: Register (0x%x) read error, bad addr",
 454                            le32_to_cpu(rp->addr));
 455                 err = -EINVAL;
 456                 goto done;
 457         }
 458
 459         memcpy(val, rp->data, val_size);
 460
 461 done:
 462         kfree_skb(skb);
 463         return err;
 464 }
 465
 466 static int regmap_ibt_gather_write(void *context,
 467                                    const void *addr, size_t reg_size,
 468                                    const void *val, size_t val_size)
 469 {
 470         struct regmap_ibt_context *ctx = context;
 471         struct ibt_cp_reg_access *cp;
 472         struct sk_buff *skb;
 473         int plen = sizeof(*cp) + val_size;
 474         u8 mode;
 475         int err = 0;
 476
 477         if (reg_size != sizeof(__le32))
 478                 return -EINVAL;
 479
 480         switch (val_size) {
 481         case 1:
 482                 mode = IBT_REG_MODE_8BIT;
 483                 break;
 484         case 2:
 485                 mode = IBT_REG_MODE_16BIT;
 486                 break;
 487         case 4:
 488                 mode = IBT_REG_MODE_32BIT;
 489                 break;
 490         default:
 491                 return -EINVAL;
 492         }
 493
 494         cp = kmalloc(plen, GFP_KERNEL);
 495         if (!cp)
 496                 return -ENOMEM;
 497
 498         /* regmap provides a little-endian formatted addr/value */
 499         cp->addr = *(__le32 *)addr;
 500         cp->mode = mode;
 501         cp->len = val_size;
 502         memcpy(&cp->data, val, val_size);
 503
 504         bt_dev_dbg(ctx->hdev, "Register (0x%x) write", le32_to_cpu(cp->addr));
 505
 506         skb = hci_cmd_sync(ctx->hdev, ctx->op_write, plen, cp, HCI_CMD_TIMEOUT);
 507         if (IS_ERR(skb)) {
 508                 err = PTR_ERR(skb);
 509                 bt_dev_err(ctx->hdev, "regmap: Register (0x%x) write error (%d)",
 510                            le32_to_cpu(cp->addr), err);
 511                 goto done;
 512         }
 513         kfree_skb(skb);
 514
 515 done:
 516         kfree(cp);
 517         return err;
 518 }
 519
 520 static int regmap_ibt_write(void *context, const void *data, size_t count)
 521 {
 522         /* data contains register+value, since we only support 32bit addr,
 523          * minimum data size is 4 bytes.
 524          */
 525         if (WARN_ONCE(count < 4, "Invalid register access"))
 526                 return -EINVAL;
 527
 528         return regmap_ibt_gather_write(context, data, 4, data + 4, count - 4);
 529 }
 530
 531 static void regmap_ibt_free_context(void *context)
 532 {
 533         kfree(context);
 534 }
 535
 536 static struct regmap_bus regmap_ibt = {
 537         .read = regmap_ibt_read,
 538         .write = regmap_ibt_write,
 539         .gather_write = regmap_ibt_gather_write,
 540         .free_context = regmap_ibt_free_context,
 541         .reg_format_endian_default = REGMAP_ENDIAN_LITTLE,
 542         .val_format_endian_default = REGMAP_ENDIAN_LITTLE,
 543 };
 544
 545 /* Config is the same for all register regions */
 546 static const struct regmap_config regmap_ibt_cfg = {
 547         .name      = "btintel_regmap",
 548         .reg_bits  = 32,
 549         .val_bits  = 32,
 550 };
 551
 552 struct regmap *btintel_regmap_init(struct hci_dev *hdev, u16 opcode_read,
 553                                    u16 opcode_write)
 554 {
 555         struct regmap_ibt_context *ctx;
 556
 557         bt_dev_info(hdev, "regmap: Init R%x-W%x region", opcode_read,
 558                     opcode_write);
 559
 560         ctx = kzalloc(sizeof(*ctx), GFP_KERNEL);
 561         if (!ctx)
 562                 return ERR_PTR(-ENOMEM);
 563
 564         ctx->op_read = opcode_read;
 565         ctx->op_write = opcode_write;
 566         ctx->hdev = hdev;
 567
 568         return regmap_init(&hdev->dev, &regmap_ibt, ctx, &regmap_ibt_cfg);
 569 }
 570 EXPORT_SYMBOL_GPL(btintel_regmap_init);
 571
 572 MODULE_AUTHOR("Marcel Holtmann <marcel@holtmann.org>");
 573 MODULE_DESCRIPTION("Bluetooth support for Intel devices ver " VERSION);
 574 MODULE_VERSION(VERSION);
 575 MODULE_LICENSE("GPL");
 576 MODULE_FIRMWARE("intel/ibt-11-5.sfi");
 577 MODULE_FIRMWARE("intel/ibt-11-5.ddc");
 578 MODULE_FIRMWARE("intel/ibt-12-16.sfi");
 579 MODULE_FIRMWARE("intel/ibt-12-16.ddc");