Commit | Line | Data |
---|---|---|
16e3887f MH |
1 | /* |
2 | * | |
3 | * Bluetooth HCI UART driver for Intel devices | |
4 | * | |
5 | * Copyright (C) 2015 Intel Corporation | |
6 | * | |
7 | * | |
8 | * This program is free software; you can redistribute it and/or modify | |
9 | * it under the terms of the GNU General Public License as published by | |
10 | * the Free Software Foundation; either version 2 of the License, or | |
11 | * (at your option) any later version. | |
12 | * | |
13 | * This program is distributed in the hope that it will be useful, | |
14 | * but WITHOUT ANY WARRANTY; without even the implied warranty of | |
15 | * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the | |
16 | * GNU General Public License for more details. | |
17 | * | |
18 | * You should have received a copy of the GNU General Public License | |
19 | * along with this program; if not, write to the Free Software | |
20 | * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA | |
21 | * | |
22 | */ | |
23 | ||
24 | #include <linux/kernel.h> | |
25 | #include <linux/errno.h> | |
26 | #include <linux/skbuff.h> | |
ca93cee5 | 27 | #include <linux/firmware.h> |
1ab1f239 | 28 | #include <linux/module.h> |
ca93cee5 | 29 | #include <linux/wait.h> |
1ab1f239 LP |
30 | #include <linux/tty.h> |
31 | #include <linux/platform_device.h> | |
32 | #include <linux/gpio/consumer.h> | |
33 | #include <linux/acpi.h> | |
765ea3ab | 34 | #include <linux/interrupt.h> |
16e3887f MH |
35 | |
36 | #include <net/bluetooth/bluetooth.h> | |
37 | #include <net/bluetooth/hci_core.h> | |
38 | ||
39 | #include "hci_uart.h" | |
ca93cee5 LP |
40 | #include "btintel.h" |
41 | ||
42 | #define STATE_BOOTLOADER 0 | |
43 | #define STATE_DOWNLOADING 1 | |
44 | #define STATE_FIRMWARE_LOADED 2 | |
45 | #define STATE_FIRMWARE_FAILED 3 | |
46 | #define STATE_BOOTING 4 | |
b98469f4 LP |
47 | #define STATE_LPM_ENABLED 5 |
48 | #define STATE_TX_ACTIVE 6 | |
49 | ||
50 | #define HCI_LPM_PKT 0xf1 | |
51 | #define HCI_LPM_MAX_SIZE 10 | |
52 | #define HCI_LPM_HDR_SIZE HCI_EVENT_HDR_SIZE | |
53 | ||
54 | #define LPM_OP_TX_NOTIFY 0x00 | |
55 | ||
56 | struct hci_lpm_pkt { | |
57 | __u8 opcode; | |
58 | __u8 dlen; | |
59 | __u8 data[0]; | |
60 | } __packed; | |
ca93cee5 | 61 | |
1ab1f239 LP |
62 | struct intel_device { |
63 | struct list_head list; | |
64 | struct platform_device *pdev; | |
65 | struct gpio_desc *reset; | |
765ea3ab | 66 | int irq; |
1ab1f239 LP |
67 | }; |
68 | ||
69 | static LIST_HEAD(intel_device_list); | |
70 | static DEFINE_SPINLOCK(intel_device_list_lock); | |
71 | ||
ca93cee5 LP |
72 | struct intel_data { |
73 | struct sk_buff *rx_skb; | |
74 | struct sk_buff_head txq; | |
75 | unsigned long flags; | |
76 | }; | |
77 | ||
ff289559 LP |
78 | static u8 intel_convert_speed(unsigned int speed) |
79 | { | |
80 | switch (speed) { | |
81 | case 9600: | |
82 | return 0x00; | |
83 | case 19200: | |
84 | return 0x01; | |
85 | case 38400: | |
86 | return 0x02; | |
87 | case 57600: | |
88 | return 0x03; | |
89 | case 115200: | |
90 | return 0x04; | |
91 | case 230400: | |
92 | return 0x05; | |
93 | case 460800: | |
94 | return 0x06; | |
95 | case 921600: | |
96 | return 0x07; | |
97 | case 1843200: | |
98 | return 0x08; | |
99 | case 3250000: | |
100 | return 0x09; | |
101 | case 2000000: | |
102 | return 0x0a; | |
103 | case 3000000: | |
104 | return 0x0b; | |
105 | default: | |
106 | return 0xff; | |
107 | } | |
108 | } | |
109 | ||
1ab1f239 LP |
110 | static int intel_wait_booting(struct hci_uart *hu) |
111 | { | |
112 | struct intel_data *intel = hu->priv; | |
113 | int err; | |
114 | ||
115 | err = wait_on_bit_timeout(&intel->flags, STATE_BOOTING, | |
116 | TASK_INTERRUPTIBLE, | |
117 | msecs_to_jiffies(1000)); | |
118 | ||
119 | if (err == 1) { | |
120 | BT_ERR("%s: Device boot interrupted", hu->hdev->name); | |
121 | return -EINTR; | |
122 | } | |
123 | ||
124 | if (err) { | |
125 | BT_ERR("%s: Device boot timeout", hu->hdev->name); | |
126 | return -ETIMEDOUT; | |
127 | } | |
128 | ||
129 | return err; | |
130 | } | |
131 | ||
765ea3ab LP |
132 | static irqreturn_t intel_irq(int irq, void *dev_id) |
133 | { | |
134 | struct intel_device *idev = dev_id; | |
135 | ||
136 | dev_info(&idev->pdev->dev, "hci_intel irq\n"); | |
137 | ||
138 | return IRQ_HANDLED; | |
139 | } | |
140 | ||
1ab1f239 LP |
141 | static int intel_set_power(struct hci_uart *hu, bool powered) |
142 | { | |
143 | struct list_head *p; | |
144 | int err = -ENODEV; | |
145 | ||
146 | spin_lock(&intel_device_list_lock); | |
147 | ||
148 | list_for_each(p, &intel_device_list) { | |
149 | struct intel_device *idev = list_entry(p, struct intel_device, | |
150 | list); | |
151 | ||
152 | /* tty device and pdev device should share the same parent | |
153 | * which is the UART port. | |
154 | */ | |
155 | if (hu->tty->dev->parent != idev->pdev->dev.parent) | |
156 | continue; | |
157 | ||
158 | if (!idev->reset) { | |
159 | err = -ENOTSUPP; | |
160 | break; | |
161 | } | |
162 | ||
163 | BT_INFO("hu %p, Switching compatible pm device (%s) to %u", | |
164 | hu, dev_name(&idev->pdev->dev), powered); | |
165 | ||
166 | gpiod_set_value(idev->reset, powered); | |
765ea3ab LP |
167 | |
168 | if (idev->irq < 0) | |
169 | break; | |
170 | ||
171 | if (powered && device_can_wakeup(&idev->pdev->dev)) { | |
172 | err = devm_request_threaded_irq(&idev->pdev->dev, | |
173 | idev->irq, NULL, | |
174 | intel_irq, | |
175 | IRQF_ONESHOT, | |
176 | "bt-host-wake", idev); | |
177 | if (err) { | |
178 | BT_ERR("hu %p, unable to allocate irq-%d", | |
179 | hu, idev->irq); | |
180 | break; | |
181 | } | |
182 | ||
183 | device_wakeup_enable(&idev->pdev->dev); | |
184 | } else if (!powered && device_may_wakeup(&idev->pdev->dev)) { | |
185 | devm_free_irq(&idev->pdev->dev, idev->irq, idev); | |
186 | device_wakeup_disable(&idev->pdev->dev); | |
187 | } | |
1ab1f239 LP |
188 | } |
189 | ||
190 | spin_unlock(&intel_device_list_lock); | |
191 | ||
192 | return err; | |
193 | } | |
194 | ||
ca93cee5 LP |
195 | static int intel_open(struct hci_uart *hu) |
196 | { | |
197 | struct intel_data *intel; | |
198 | ||
199 | BT_DBG("hu %p", hu); | |
200 | ||
201 | intel = kzalloc(sizeof(*intel), GFP_KERNEL); | |
202 | if (!intel) | |
203 | return -ENOMEM; | |
204 | ||
205 | skb_queue_head_init(&intel->txq); | |
206 | ||
207 | hu->priv = intel; | |
1ab1f239 LP |
208 | |
209 | if (!intel_set_power(hu, true)) | |
210 | set_bit(STATE_BOOTING, &intel->flags); | |
211 | ||
ca93cee5 LP |
212 | return 0; |
213 | } | |
214 | ||
215 | static int intel_close(struct hci_uart *hu) | |
216 | { | |
217 | struct intel_data *intel = hu->priv; | |
218 | ||
219 | BT_DBG("hu %p", hu); | |
220 | ||
1ab1f239 LP |
221 | intel_set_power(hu, false); |
222 | ||
ca93cee5 LP |
223 | skb_queue_purge(&intel->txq); |
224 | kfree_skb(intel->rx_skb); | |
225 | kfree(intel); | |
226 | ||
227 | hu->priv = NULL; | |
228 | return 0; | |
229 | } | |
230 | ||
231 | static int intel_flush(struct hci_uart *hu) | |
232 | { | |
233 | struct intel_data *intel = hu->priv; | |
234 | ||
235 | BT_DBG("hu %p", hu); | |
236 | ||
237 | skb_queue_purge(&intel->txq); | |
238 | ||
239 | return 0; | |
240 | } | |
241 | ||
242 | static int inject_cmd_complete(struct hci_dev *hdev, __u16 opcode) | |
243 | { | |
244 | struct sk_buff *skb; | |
245 | struct hci_event_hdr *hdr; | |
246 | struct hci_ev_cmd_complete *evt; | |
247 | ||
248 | skb = bt_skb_alloc(sizeof(*hdr) + sizeof(*evt) + 1, GFP_ATOMIC); | |
249 | if (!skb) | |
250 | return -ENOMEM; | |
251 | ||
252 | hdr = (struct hci_event_hdr *)skb_put(skb, sizeof(*hdr)); | |
253 | hdr->evt = HCI_EV_CMD_COMPLETE; | |
254 | hdr->plen = sizeof(*evt) + 1; | |
255 | ||
256 | evt = (struct hci_ev_cmd_complete *)skb_put(skb, sizeof(*evt)); | |
257 | evt->ncmd = 0x01; | |
258 | evt->opcode = cpu_to_le16(opcode); | |
259 | ||
260 | *skb_put(skb, 1) = 0x00; | |
261 | ||
262 | bt_cb(skb)->pkt_type = HCI_EVENT_PKT; | |
263 | ||
264 | return hci_recv_frame(hdev, skb); | |
265 | } | |
266 | ||
ff289559 LP |
267 | static int intel_set_baudrate(struct hci_uart *hu, unsigned int speed) |
268 | { | |
269 | struct intel_data *intel = hu->priv; | |
270 | struct hci_dev *hdev = hu->hdev; | |
271 | u8 speed_cmd[] = { 0x06, 0xfc, 0x01, 0x00 }; | |
272 | struct sk_buff *skb; | |
1ab1f239 LP |
273 | int err; |
274 | ||
275 | /* This can be the first command sent to the chip, check | |
276 | * that the controller is ready. | |
277 | */ | |
278 | err = intel_wait_booting(hu); | |
279 | ||
280 | clear_bit(STATE_BOOTING, &intel->flags); | |
281 | ||
282 | /* In case of timeout, try to continue anyway */ | |
283 | if (err && err != ETIMEDOUT) | |
284 | return err; | |
ff289559 LP |
285 | |
286 | BT_INFO("%s: Change controller speed to %d", hdev->name, speed); | |
287 | ||
288 | speed_cmd[3] = intel_convert_speed(speed); | |
289 | if (speed_cmd[3] == 0xff) { | |
290 | BT_ERR("%s: Unsupported speed", hdev->name); | |
291 | return -EINVAL; | |
292 | } | |
293 | ||
294 | /* Device will not accept speed change if Intel version has not been | |
295 | * previously requested. | |
296 | */ | |
297 | skb = __hci_cmd_sync(hdev, 0xfc05, 0, NULL, HCI_INIT_TIMEOUT); | |
298 | if (IS_ERR(skb)) { | |
299 | BT_ERR("%s: Reading Intel version information failed (%ld)", | |
300 | hdev->name, PTR_ERR(skb)); | |
301 | return PTR_ERR(skb); | |
302 | } | |
303 | kfree_skb(skb); | |
304 | ||
305 | skb = bt_skb_alloc(sizeof(speed_cmd), GFP_KERNEL); | |
306 | if (!skb) { | |
307 | BT_ERR("%s: Failed to allocate memory for baudrate packet", | |
308 | hdev->name); | |
309 | return -ENOMEM; | |
310 | } | |
311 | ||
312 | memcpy(skb_put(skb, sizeof(speed_cmd)), speed_cmd, sizeof(speed_cmd)); | |
313 | bt_cb(skb)->pkt_type = HCI_COMMAND_PKT; | |
314 | ||
315 | hci_uart_set_flow_control(hu, true); | |
316 | ||
317 | skb_queue_tail(&intel->txq, skb); | |
318 | hci_uart_tx_wakeup(hu); | |
319 | ||
320 | /* wait 100ms to change baudrate on controller side */ | |
321 | msleep(100); | |
322 | ||
323 | hci_uart_set_baudrate(hu, speed); | |
324 | hci_uart_set_flow_control(hu, false); | |
325 | ||
326 | return 0; | |
327 | } | |
328 | ||
ca93cee5 LP |
329 | static int intel_setup(struct hci_uart *hu) |
330 | { | |
331 | static const u8 reset_param[] = { 0x00, 0x01, 0x00, 0x01, | |
332 | 0x00, 0x08, 0x04, 0x00 }; | |
b98469f4 | 333 | static const u8 lpm_param[] = { 0x03, 0x07, 0x01, 0x0b }; |
ca93cee5 | 334 | struct intel_data *intel = hu->priv; |
b98469f4 | 335 | struct intel_device *idev = NULL; |
ca93cee5 LP |
336 | struct hci_dev *hdev = hu->hdev; |
337 | struct sk_buff *skb; | |
338 | struct intel_version *ver; | |
339 | struct intel_boot_params *params; | |
b98469f4 | 340 | struct list_head *p; |
ca93cee5 LP |
341 | const struct firmware *fw; |
342 | const u8 *fw_ptr; | |
343 | char fwname[64]; | |
344 | u32 frag_len; | |
345 | ktime_t calltime, delta, rettime; | |
346 | unsigned long long duration; | |
ff289559 LP |
347 | unsigned int init_speed, oper_speed; |
348 | int speed_change = 0; | |
ca93cee5 LP |
349 | int err; |
350 | ||
351 | BT_DBG("%s", hdev->name); | |
352 | ||
35ab8150 MH |
353 | hu->hdev->set_bdaddr = btintel_set_bdaddr; |
354 | ||
ca93cee5 LP |
355 | calltime = ktime_get(); |
356 | ||
ff289559 LP |
357 | if (hu->init_speed) |
358 | init_speed = hu->init_speed; | |
359 | else | |
360 | init_speed = hu->proto->init_speed; | |
361 | ||
362 | if (hu->oper_speed) | |
363 | oper_speed = hu->oper_speed; | |
364 | else | |
365 | oper_speed = hu->proto->oper_speed; | |
366 | ||
367 | if (oper_speed && init_speed && oper_speed != init_speed) | |
368 | speed_change = 1; | |
369 | ||
1ab1f239 LP |
370 | /* Check that the controller is ready */ |
371 | err = intel_wait_booting(hu); | |
372 | ||
373 | clear_bit(STATE_BOOTING, &intel->flags); | |
374 | ||
375 | /* In case of timeout, try to continue anyway */ | |
376 | if (err && err != ETIMEDOUT) | |
377 | return err; | |
378 | ||
ca93cee5 LP |
379 | set_bit(STATE_BOOTLOADER, &intel->flags); |
380 | ||
381 | /* Read the Intel version information to determine if the device | |
382 | * is in bootloader mode or if it already has operational firmware | |
383 | * loaded. | |
384 | */ | |
385 | skb = __hci_cmd_sync(hdev, 0xfc05, 0, NULL, HCI_INIT_TIMEOUT); | |
386 | if (IS_ERR(skb)) { | |
387 | BT_ERR("%s: Reading Intel version information failed (%ld)", | |
388 | hdev->name, PTR_ERR(skb)); | |
389 | return PTR_ERR(skb); | |
390 | } | |
391 | ||
392 | if (skb->len != sizeof(*ver)) { | |
393 | BT_ERR("%s: Intel version event size mismatch", hdev->name); | |
394 | kfree_skb(skb); | |
395 | return -EILSEQ; | |
396 | } | |
397 | ||
398 | ver = (struct intel_version *)skb->data; | |
399 | if (ver->status) { | |
400 | BT_ERR("%s: Intel version command failure (%02x)", | |
401 | hdev->name, ver->status); | |
402 | err = -bt_to_errno(ver->status); | |
403 | kfree_skb(skb); | |
404 | return err; | |
405 | } | |
406 | ||
407 | /* The hardware platform number has a fixed value of 0x37 and | |
408 | * for now only accept this single value. | |
409 | */ | |
410 | if (ver->hw_platform != 0x37) { | |
411 | BT_ERR("%s: Unsupported Intel hardware platform (%u)", | |
412 | hdev->name, ver->hw_platform); | |
413 | kfree_skb(skb); | |
414 | return -EINVAL; | |
415 | } | |
416 | ||
417 | /* At the moment only the hardware variant iBT 3.0 (LnP/SfP) is | |
418 | * supported by this firmware loading method. This check has been | |
419 | * put in place to ensure correct forward compatibility options | |
420 | * when newer hardware variants come along. | |
421 | */ | |
422 | if (ver->hw_variant != 0x0b) { | |
423 | BT_ERR("%s: Unsupported Intel hardware variant (%u)", | |
424 | hdev->name, ver->hw_variant); | |
425 | kfree_skb(skb); | |
426 | return -EINVAL; | |
427 | } | |
428 | ||
7feb99e1 | 429 | btintel_version_info(hdev, ver); |
ca93cee5 LP |
430 | |
431 | /* The firmware variant determines if the device is in bootloader | |
432 | * mode or is running operational firmware. The value 0x06 identifies | |
433 | * the bootloader and the value 0x23 identifies the operational | |
434 | * firmware. | |
435 | * | |
436 | * When the operational firmware is already present, then only | |
437 | * the check for valid Bluetooth device address is needed. This | |
438 | * determines if the device will be added as configured or | |
439 | * unconfigured controller. | |
440 | * | |
441 | * It is not possible to use the Secure Boot Parameters in this | |
442 | * case since that command is only available in bootloader mode. | |
443 | */ | |
444 | if (ver->fw_variant == 0x23) { | |
445 | kfree_skb(skb); | |
446 | clear_bit(STATE_BOOTLOADER, &intel->flags); | |
447 | btintel_check_bdaddr(hdev); | |
448 | return 0; | |
449 | } | |
450 | ||
451 | /* If the device is not in bootloader mode, then the only possible | |
452 | * choice is to return an error and abort the device initialization. | |
453 | */ | |
454 | if (ver->fw_variant != 0x06) { | |
455 | BT_ERR("%s: Unsupported Intel firmware variant (%u)", | |
456 | hdev->name, ver->fw_variant); | |
457 | kfree_skb(skb); | |
458 | return -ENODEV; | |
459 | } | |
460 | ||
461 | kfree_skb(skb); | |
462 | ||
463 | /* Read the secure boot parameters to identify the operating | |
464 | * details of the bootloader. | |
465 | */ | |
466 | skb = __hci_cmd_sync(hdev, 0xfc0d, 0, NULL, HCI_INIT_TIMEOUT); | |
467 | if (IS_ERR(skb)) { | |
468 | BT_ERR("%s: Reading Intel boot parameters failed (%ld)", | |
469 | hdev->name, PTR_ERR(skb)); | |
470 | return PTR_ERR(skb); | |
471 | } | |
472 | ||
473 | if (skb->len != sizeof(*params)) { | |
474 | BT_ERR("%s: Intel boot parameters size mismatch", hdev->name); | |
475 | kfree_skb(skb); | |
476 | return -EILSEQ; | |
477 | } | |
478 | ||
479 | params = (struct intel_boot_params *)skb->data; | |
480 | if (params->status) { | |
481 | BT_ERR("%s: Intel boot parameters command failure (%02x)", | |
482 | hdev->name, params->status); | |
483 | err = -bt_to_errno(params->status); | |
484 | kfree_skb(skb); | |
485 | return err; | |
486 | } | |
487 | ||
488 | BT_INFO("%s: Device revision is %u", hdev->name, | |
489 | le16_to_cpu(params->dev_revid)); | |
490 | ||
491 | BT_INFO("%s: Secure boot is %s", hdev->name, | |
492 | params->secure_boot ? "enabled" : "disabled"); | |
493 | ||
494 | BT_INFO("%s: Minimum firmware build %u week %u %u", hdev->name, | |
495 | params->min_fw_build_nn, params->min_fw_build_cw, | |
496 | 2000 + params->min_fw_build_yy); | |
497 | ||
498 | /* It is required that every single firmware fragment is acknowledged | |
499 | * with a command complete event. If the boot parameters indicate | |
500 | * that this bootloader does not send them, then abort the setup. | |
501 | */ | |
502 | if (params->limited_cce != 0x00) { | |
503 | BT_ERR("%s: Unsupported Intel firmware loading method (%u)", | |
504 | hdev->name, params->limited_cce); | |
505 | kfree_skb(skb); | |
506 | return -EINVAL; | |
507 | } | |
508 | ||
509 | /* If the OTP has no valid Bluetooth device address, then there will | |
510 | * also be no valid address for the operational firmware. | |
511 | */ | |
512 | if (!bacmp(¶ms->otp_bdaddr, BDADDR_ANY)) { | |
513 | BT_INFO("%s: No device address configured", hdev->name); | |
514 | set_bit(HCI_QUIRK_INVALID_BDADDR, &hdev->quirks); | |
515 | } | |
516 | ||
517 | /* With this Intel bootloader only the hardware variant and device | |
518 | * revision information are used to select the right firmware. | |
519 | * | |
520 | * Currently this bootloader support is limited to hardware variant | |
521 | * iBT 3.0 (LnP/SfP) which is identified by the value 11 (0x0b). | |
522 | */ | |
523 | snprintf(fwname, sizeof(fwname), "intel/ibt-11-%u.sfi", | |
524 | le16_to_cpu(params->dev_revid)); | |
525 | ||
526 | err = request_firmware(&fw, fwname, &hdev->dev); | |
527 | if (err < 0) { | |
528 | BT_ERR("%s: Failed to load Intel firmware file (%d)", | |
529 | hdev->name, err); | |
530 | kfree_skb(skb); | |
531 | return err; | |
532 | } | |
533 | ||
534 | BT_INFO("%s: Found device firmware: %s", hdev->name, fwname); | |
535 | ||
536 | kfree_skb(skb); | |
537 | ||
538 | if (fw->size < 644) { | |
539 | BT_ERR("%s: Invalid size of firmware file (%zu)", | |
540 | hdev->name, fw->size); | |
541 | err = -EBADF; | |
542 | goto done; | |
543 | } | |
544 | ||
545 | set_bit(STATE_DOWNLOADING, &intel->flags); | |
546 | ||
547 | /* Start the firmware download transaction with the Init fragment | |
548 | * represented by the 128 bytes of CSS header. | |
549 | */ | |
09df123d | 550 | err = btintel_secure_send(hdev, 0x00, 128, fw->data); |
ca93cee5 LP |
551 | if (err < 0) { |
552 | BT_ERR("%s: Failed to send firmware header (%d)", | |
553 | hdev->name, err); | |
554 | goto done; | |
555 | } | |
556 | ||
557 | /* Send the 256 bytes of public key information from the firmware | |
558 | * as the PKey fragment. | |
559 | */ | |
09df123d | 560 | err = btintel_secure_send(hdev, 0x03, 256, fw->data + 128); |
ca93cee5 LP |
561 | if (err < 0) { |
562 | BT_ERR("%s: Failed to send firmware public key (%d)", | |
563 | hdev->name, err); | |
564 | goto done; | |
565 | } | |
566 | ||
567 | /* Send the 256 bytes of signature information from the firmware | |
568 | * as the Sign fragment. | |
569 | */ | |
09df123d | 570 | err = btintel_secure_send(hdev, 0x02, 256, fw->data + 388); |
ca93cee5 LP |
571 | if (err < 0) { |
572 | BT_ERR("%s: Failed to send firmware signature (%d)", | |
573 | hdev->name, err); | |
574 | goto done; | |
575 | } | |
576 | ||
577 | fw_ptr = fw->data + 644; | |
578 | frag_len = 0; | |
579 | ||
580 | while (fw_ptr - fw->data < fw->size) { | |
581 | struct hci_command_hdr *cmd = (void *)(fw_ptr + frag_len); | |
582 | ||
583 | frag_len += sizeof(*cmd) + cmd->plen; | |
584 | ||
585 | BT_DBG("%s: patching %td/%zu", hdev->name, | |
586 | (fw_ptr - fw->data), fw->size); | |
587 | ||
588 | /* The parameter length of the secure send command requires | |
589 | * a 4 byte alignment. It happens so that the firmware file | |
590 | * contains proper Intel_NOP commands to align the fragments | |
591 | * as needed. | |
592 | * | |
593 | * Send set of commands with 4 byte alignment from the | |
594 | * firmware data buffer as a single Data fragement. | |
595 | */ | |
596 | if (frag_len % 4) | |
597 | continue; | |
598 | ||
599 | /* Send each command from the firmware data buffer as | |
600 | * a single Data fragment. | |
601 | */ | |
09df123d | 602 | err = btintel_secure_send(hdev, 0x01, frag_len, fw_ptr); |
ca93cee5 LP |
603 | if (err < 0) { |
604 | BT_ERR("%s: Failed to send firmware data (%d)", | |
605 | hdev->name, err); | |
606 | goto done; | |
607 | } | |
608 | ||
609 | fw_ptr += frag_len; | |
610 | frag_len = 0; | |
611 | } | |
612 | ||
613 | set_bit(STATE_FIRMWARE_LOADED, &intel->flags); | |
614 | ||
615 | BT_INFO("%s: Waiting for firmware download to complete", hdev->name); | |
616 | ||
617 | /* Before switching the device into operational mode and with that | |
618 | * booting the loaded firmware, wait for the bootloader notification | |
619 | * that all fragments have been successfully received. | |
620 | * | |
621 | * When the event processing receives the notification, then the | |
622 | * STATE_DOWNLOADING flag will be cleared. | |
623 | * | |
624 | * The firmware loading should not take longer than 5 seconds | |
625 | * and thus just timeout if that happens and fail the setup | |
626 | * of this device. | |
627 | */ | |
628 | err = wait_on_bit_timeout(&intel->flags, STATE_DOWNLOADING, | |
629 | TASK_INTERRUPTIBLE, | |
630 | msecs_to_jiffies(5000)); | |
631 | if (err == 1) { | |
632 | BT_ERR("%s: Firmware loading interrupted", hdev->name); | |
633 | err = -EINTR; | |
634 | goto done; | |
635 | } | |
636 | ||
637 | if (err) { | |
638 | BT_ERR("%s: Firmware loading timeout", hdev->name); | |
639 | err = -ETIMEDOUT; | |
640 | goto done; | |
641 | } | |
642 | ||
643 | if (test_bit(STATE_FIRMWARE_FAILED, &intel->flags)) { | |
644 | BT_ERR("%s: Firmware loading failed", hdev->name); | |
645 | err = -ENOEXEC; | |
646 | goto done; | |
647 | } | |
648 | ||
649 | rettime = ktime_get(); | |
650 | delta = ktime_sub(rettime, calltime); | |
651 | duration = (unsigned long long) ktime_to_ns(delta) >> 10; | |
652 | ||
653 | BT_INFO("%s: Firmware loaded in %llu usecs", hdev->name, duration); | |
654 | ||
655 | done: | |
656 | release_firmware(fw); | |
657 | ||
658 | if (err < 0) | |
659 | return err; | |
660 | ||
ff289559 LP |
661 | /* We need to restore the default speed before Intel reset */ |
662 | if (speed_change) { | |
663 | err = intel_set_baudrate(hu, init_speed); | |
664 | if (err) | |
665 | return err; | |
666 | } | |
667 | ||
ca93cee5 LP |
668 | calltime = ktime_get(); |
669 | ||
670 | set_bit(STATE_BOOTING, &intel->flags); | |
671 | ||
672 | skb = __hci_cmd_sync(hdev, 0xfc01, sizeof(reset_param), reset_param, | |
673 | HCI_INIT_TIMEOUT); | |
674 | if (IS_ERR(skb)) | |
675 | return PTR_ERR(skb); | |
676 | ||
677 | kfree_skb(skb); | |
678 | ||
679 | /* The bootloader will not indicate when the device is ready. This | |
680 | * is done by the operational firmware sending bootup notification. | |
681 | * | |
682 | * Booting into operational firmware should not take longer than | |
683 | * 1 second. However if that happens, then just fail the setup | |
684 | * since something went wrong. | |
685 | */ | |
686 | BT_INFO("%s: Waiting for device to boot", hdev->name); | |
687 | ||
1ab1f239 LP |
688 | err = intel_wait_booting(hu); |
689 | if (err) | |
690 | return err; | |
ca93cee5 | 691 | |
1ab1f239 | 692 | clear_bit(STATE_BOOTING, &intel->flags); |
ca93cee5 LP |
693 | |
694 | rettime = ktime_get(); | |
695 | delta = ktime_sub(rettime, calltime); | |
696 | duration = (unsigned long long) ktime_to_ns(delta) >> 10; | |
697 | ||
698 | BT_INFO("%s: Device booted in %llu usecs", hdev->name, duration); | |
699 | ||
b98469f4 LP |
700 | /* Enable LPM if matching pdev with wakeup enabled */ |
701 | spin_lock(&intel_device_list_lock); | |
702 | list_for_each(p, &intel_device_list) { | |
703 | struct intel_device *dev = list_entry(p, struct intel_device, | |
704 | list); | |
705 | if (hu->tty->dev->parent == dev->pdev->dev.parent) { | |
706 | if (device_may_wakeup(&dev->pdev->dev)) | |
707 | idev = dev; | |
708 | break; | |
709 | } | |
710 | } | |
711 | spin_unlock(&intel_device_list_lock); | |
712 | ||
713 | if (!idev) | |
714 | goto no_lpm; | |
715 | ||
716 | BT_INFO("%s: Enabling LPM", hdev->name); | |
717 | ||
718 | skb = __hci_cmd_sync(hdev, 0xfc8b, sizeof(lpm_param), lpm_param, | |
719 | HCI_CMD_TIMEOUT); | |
720 | if (IS_ERR(skb)) { | |
721 | BT_ERR("%s: Failed to enable LPM", hdev->name); | |
722 | goto no_lpm; | |
723 | } | |
724 | kfree_skb(skb); | |
725 | ||
726 | set_bit(STATE_LPM_ENABLED, &intel->flags); | |
727 | ||
728 | no_lpm: | |
ff289559 LP |
729 | skb = __hci_cmd_sync(hdev, HCI_OP_RESET, 0, NULL, HCI_CMD_TIMEOUT); |
730 | if (IS_ERR(skb)) | |
731 | return PTR_ERR(skb); | |
732 | kfree_skb(skb); | |
733 | ||
734 | if (speed_change) { | |
735 | err = intel_set_baudrate(hu, oper_speed); | |
736 | if (err) | |
737 | return err; | |
738 | } | |
739 | ||
740 | BT_INFO("%s: Setup complete", hdev->name); | |
741 | ||
ca93cee5 LP |
742 | clear_bit(STATE_BOOTLOADER, &intel->flags); |
743 | ||
744 | return 0; | |
745 | } | |
746 | ||
747 | static int intel_recv_event(struct hci_dev *hdev, struct sk_buff *skb) | |
748 | { | |
749 | struct hci_uart *hu = hci_get_drvdata(hdev); | |
750 | struct intel_data *intel = hu->priv; | |
751 | struct hci_event_hdr *hdr; | |
752 | ||
1ab1f239 LP |
753 | if (!test_bit(STATE_BOOTLOADER, &intel->flags) && |
754 | !test_bit(STATE_BOOTING, &intel->flags)) | |
ca93cee5 LP |
755 | goto recv; |
756 | ||
757 | hdr = (void *)skb->data; | |
758 | ||
759 | /* When the firmware loading completes the device sends | |
760 | * out a vendor specific event indicating the result of | |
761 | * the firmware loading. | |
762 | */ | |
763 | if (skb->len == 7 && hdr->evt == 0xff && hdr->plen == 0x05 && | |
764 | skb->data[2] == 0x06) { | |
765 | if (skb->data[3] != 0x00) | |
766 | set_bit(STATE_FIRMWARE_FAILED, &intel->flags); | |
767 | ||
768 | if (test_and_clear_bit(STATE_DOWNLOADING, &intel->flags) && | |
769 | test_bit(STATE_FIRMWARE_LOADED, &intel->flags)) { | |
770 | smp_mb__after_atomic(); | |
771 | wake_up_bit(&intel->flags, STATE_DOWNLOADING); | |
772 | } | |
773 | ||
774 | /* When switching to the operational firmware the device | |
775 | * sends a vendor specific event indicating that the bootup | |
776 | * completed. | |
777 | */ | |
778 | } else if (skb->len == 9 && hdr->evt == 0xff && hdr->plen == 0x07 && | |
779 | skb->data[2] == 0x02) { | |
780 | if (test_and_clear_bit(STATE_BOOTING, &intel->flags)) { | |
781 | smp_mb__after_atomic(); | |
782 | wake_up_bit(&intel->flags, STATE_BOOTING); | |
783 | } | |
784 | } | |
785 | recv: | |
786 | return hci_recv_frame(hdev, skb); | |
787 | } | |
788 | ||
b98469f4 LP |
789 | static void intel_recv_lpm_notify(struct hci_dev *hdev, int value) |
790 | { | |
791 | struct hci_uart *hu = hci_get_drvdata(hdev); | |
792 | struct intel_data *intel = hu->priv; | |
793 | ||
794 | BT_DBG("%s: TX idle notification (%d)", hdev->name, value); | |
795 | ||
796 | if (value) | |
797 | set_bit(STATE_TX_ACTIVE, &intel->flags); | |
798 | else | |
799 | clear_bit(STATE_TX_ACTIVE, &intel->flags); | |
800 | } | |
801 | ||
802 | static int intel_recv_lpm(struct hci_dev *hdev, struct sk_buff *skb) | |
803 | { | |
804 | struct hci_lpm_pkt *lpm = (void *)skb->data; | |
805 | ||
806 | switch (lpm->opcode) { | |
807 | case LPM_OP_TX_NOTIFY: | |
808 | if (lpm->dlen) | |
809 | intel_recv_lpm_notify(hdev, lpm->data[0]); | |
810 | break; | |
811 | default: | |
812 | BT_ERR("%s: unknown LPM opcode (%02x)", hdev->name, | |
813 | lpm->opcode); | |
814 | break; | |
815 | } | |
816 | ||
817 | kfree_skb(skb); | |
818 | ||
819 | return 0; | |
820 | } | |
821 | ||
822 | #define INTEL_RECV_LPM \ | |
823 | .type = HCI_LPM_PKT, \ | |
824 | .hlen = HCI_LPM_HDR_SIZE, \ | |
825 | .loff = 1, \ | |
826 | .lsize = 1, \ | |
827 | .maxlen = HCI_LPM_MAX_SIZE | |
828 | ||
ca93cee5 | 829 | static const struct h4_recv_pkt intel_recv_pkts[] = { |
b98469f4 LP |
830 | { H4_RECV_ACL, .recv = hci_recv_frame }, |
831 | { H4_RECV_SCO, .recv = hci_recv_frame }, | |
832 | { H4_RECV_EVENT, .recv = intel_recv_event }, | |
833 | { INTEL_RECV_LPM, .recv = intel_recv_lpm }, | |
ca93cee5 LP |
834 | }; |
835 | ||
836 | static int intel_recv(struct hci_uart *hu, const void *data, int count) | |
837 | { | |
838 | struct intel_data *intel = hu->priv; | |
839 | ||
840 | if (!test_bit(HCI_UART_REGISTERED, &hu->flags)) | |
841 | return -EUNATCH; | |
842 | ||
843 | intel->rx_skb = h4_recv_buf(hu->hdev, intel->rx_skb, data, count, | |
844 | intel_recv_pkts, | |
845 | ARRAY_SIZE(intel_recv_pkts)); | |
846 | if (IS_ERR(intel->rx_skb)) { | |
847 | int err = PTR_ERR(intel->rx_skb); | |
848 | BT_ERR("%s: Frame reassembly failed (%d)", hu->hdev->name, err); | |
849 | intel->rx_skb = NULL; | |
850 | return err; | |
851 | } | |
852 | ||
853 | return count; | |
854 | } | |
855 | ||
856 | static int intel_enqueue(struct hci_uart *hu, struct sk_buff *skb) | |
857 | { | |
858 | struct intel_data *intel = hu->priv; | |
859 | ||
860 | BT_DBG("hu %p skb %p", hu, skb); | |
861 | ||
862 | skb_queue_tail(&intel->txq, skb); | |
863 | ||
864 | return 0; | |
865 | } | |
866 | ||
867 | static struct sk_buff *intel_dequeue(struct hci_uart *hu) | |
868 | { | |
869 | struct intel_data *intel = hu->priv; | |
870 | struct sk_buff *skb; | |
871 | ||
872 | skb = skb_dequeue(&intel->txq); | |
873 | if (!skb) | |
874 | return skb; | |
875 | ||
876 | if (test_bit(STATE_BOOTLOADER, &intel->flags) && | |
877 | (bt_cb(skb)->pkt_type == HCI_COMMAND_PKT)) { | |
878 | struct hci_command_hdr *cmd = (void *)skb->data; | |
879 | __u16 opcode = le16_to_cpu(cmd->opcode); | |
880 | ||
881 | /* When the 0xfc01 command is issued to boot into | |
882 | * the operational firmware, it will actually not | |
883 | * send a command complete event. To keep the flow | |
884 | * control working inject that event here. | |
885 | */ | |
886 | if (opcode == 0xfc01) | |
887 | inject_cmd_complete(hu->hdev, opcode); | |
888 | } | |
889 | ||
890 | /* Prepend skb with frame type */ | |
891 | memcpy(skb_push(skb, 1), &bt_cb(skb)->pkt_type, 1); | |
892 | ||
893 | return skb; | |
894 | } | |
895 | ||
896 | static const struct hci_uart_proto intel_proto = { | |
897 | .id = HCI_UART_INTEL, | |
898 | .name = "Intel", | |
899 | .init_speed = 115200, | |
ff289559 | 900 | .oper_speed = 3000000, |
ca93cee5 LP |
901 | .open = intel_open, |
902 | .close = intel_close, | |
903 | .flush = intel_flush, | |
904 | .setup = intel_setup, | |
ff289559 | 905 | .set_baudrate = intel_set_baudrate, |
ca93cee5 LP |
906 | .recv = intel_recv, |
907 | .enqueue = intel_enqueue, | |
908 | .dequeue = intel_dequeue, | |
909 | }; | |
910 | ||
1ab1f239 LP |
911 | #ifdef CONFIG_ACPI |
912 | static const struct acpi_device_id intel_acpi_match[] = { | |
913 | { "INT33E1", 0 }, | |
914 | { }, | |
915 | }; | |
916 | MODULE_DEVICE_TABLE(acpi, intel_acpi_match); | |
917 | ||
918 | static int intel_acpi_probe(struct intel_device *idev) | |
919 | { | |
920 | const struct acpi_device_id *id; | |
921 | ||
922 | id = acpi_match_device(intel_acpi_match, &idev->pdev->dev); | |
923 | if (!id) | |
924 | return -ENODEV; | |
925 | ||
926 | return 0; | |
927 | } | |
928 | #else | |
929 | static int intel_acpi_probe(struct intel_device *idev) | |
930 | { | |
931 | return -ENODEV; | |
932 | } | |
933 | #endif | |
934 | ||
935 | static int intel_probe(struct platform_device *pdev) | |
936 | { | |
937 | struct intel_device *idev; | |
938 | ||
939 | idev = devm_kzalloc(&pdev->dev, sizeof(*idev), GFP_KERNEL); | |
940 | if (!idev) | |
941 | return -ENOMEM; | |
942 | ||
943 | idev->pdev = pdev; | |
944 | ||
945 | if (ACPI_HANDLE(&pdev->dev)) { | |
946 | int err = intel_acpi_probe(idev); | |
947 | if (err) | |
948 | return err; | |
949 | } else { | |
950 | return -ENODEV; | |
951 | } | |
952 | ||
953 | idev->reset = devm_gpiod_get_optional(&pdev->dev, "reset", | |
954 | GPIOD_OUT_LOW); | |
955 | if (IS_ERR(idev->reset)) { | |
956 | dev_err(&pdev->dev, "Unable to retrieve gpio\n"); | |
957 | return PTR_ERR(idev->reset); | |
958 | } | |
959 | ||
765ea3ab LP |
960 | idev->irq = platform_get_irq(pdev, 0); |
961 | if (idev->irq < 0) { | |
962 | struct gpio_desc *host_wake; | |
963 | ||
964 | dev_err(&pdev->dev, "No IRQ, falling back to gpio-irq\n"); | |
965 | ||
966 | host_wake = devm_gpiod_get_optional(&pdev->dev, "host-wake", | |
967 | GPIOD_IN); | |
968 | if (IS_ERR(host_wake)) { | |
969 | dev_err(&pdev->dev, "Unable to retrieve IRQ\n"); | |
970 | goto no_irq; | |
971 | } | |
972 | ||
973 | idev->irq = gpiod_to_irq(host_wake); | |
974 | if (idev->irq < 0) { | |
975 | dev_err(&pdev->dev, "No corresponding irq for gpio\n"); | |
976 | goto no_irq; | |
977 | } | |
978 | } | |
979 | ||
980 | /* Only enable wake-up/irq when controller is powered */ | |
981 | device_set_wakeup_capable(&pdev->dev, true); | |
982 | device_wakeup_disable(&pdev->dev); | |
983 | ||
984 | no_irq: | |
1ab1f239 LP |
985 | platform_set_drvdata(pdev, idev); |
986 | ||
987 | /* Place this instance on the device list */ | |
988 | spin_lock(&intel_device_list_lock); | |
989 | list_add_tail(&idev->list, &intel_device_list); | |
990 | spin_unlock(&intel_device_list_lock); | |
991 | ||
765ea3ab LP |
992 | dev_info(&pdev->dev, "registered, gpio(%d)/irq(%d).\n", |
993 | desc_to_gpio(idev->reset), idev->irq); | |
1ab1f239 LP |
994 | |
995 | return 0; | |
996 | } | |
997 | ||
998 | static int intel_remove(struct platform_device *pdev) | |
999 | { | |
1000 | struct intel_device *idev = platform_get_drvdata(pdev); | |
1001 | ||
765ea3ab LP |
1002 | device_wakeup_disable(&pdev->dev); |
1003 | ||
1ab1f239 LP |
1004 | spin_lock(&intel_device_list_lock); |
1005 | list_del(&idev->list); | |
1006 | spin_unlock(&intel_device_list_lock); | |
1007 | ||
1008 | dev_info(&pdev->dev, "unregistered.\n"); | |
1009 | ||
1010 | return 0; | |
1011 | } | |
1012 | ||
1013 | static struct platform_driver intel_driver = { | |
1014 | .probe = intel_probe, | |
1015 | .remove = intel_remove, | |
1016 | .driver = { | |
1017 | .name = "hci_intel", | |
1018 | .acpi_match_table = ACPI_PTR(intel_acpi_match), | |
1019 | }, | |
1020 | }; | |
1021 | ||
ca93cee5 LP |
1022 | int __init intel_init(void) |
1023 | { | |
1ab1f239 LP |
1024 | platform_driver_register(&intel_driver); |
1025 | ||
ca93cee5 LP |
1026 | return hci_uart_register_proto(&intel_proto); |
1027 | } | |
1028 | ||
1029 | int __exit intel_deinit(void) | |
1030 | { | |
1ab1f239 LP |
1031 | platform_driver_unregister(&intel_driver); |
1032 | ||
ca93cee5 LP |
1033 | return hci_uart_unregister_proto(&intel_proto); |
1034 | } |