hci_ag6xx.c 7.1 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322
  1. // SPDX-License-Identifier: GPL-2.0-or-later
  2. /*
  3. *
  4. * Bluetooth HCI UART driver for Intel/AG6xx devices
  5. *
  6. * Copyright (C) 2016 Intel Corporation
  7. */
  8. #include <linux/kernel.h>
  9. #include <linux/errno.h>
  10. #include <linux/skbuff.h>
  11. #include <linux/firmware.h>
  12. #include <linux/module.h>
  13. #include <linux/tty.h>
  14. #include <net/bluetooth/bluetooth.h>
  15. #include <net/bluetooth/hci_core.h>
  16. #include "hci_uart.h"
  17. #include "btintel.h"
  18. struct ag6xx_data {
  19. struct sk_buff *rx_skb;
  20. struct sk_buff_head txq;
  21. };
  22. struct pbn_entry {
  23. __le32 addr;
  24. __le32 plen;
  25. __u8 data[];
  26. } __packed;
  27. static int ag6xx_open(struct hci_uart *hu)
  28. {
  29. struct ag6xx_data *ag6xx;
  30. BT_DBG("hu %p", hu);
  31. ag6xx = kzalloc(sizeof(*ag6xx), GFP_KERNEL);
  32. if (!ag6xx)
  33. return -ENOMEM;
  34. skb_queue_head_init(&ag6xx->txq);
  35. hu->priv = ag6xx;
  36. return 0;
  37. }
  38. static int ag6xx_close(struct hci_uart *hu)
  39. {
  40. struct ag6xx_data *ag6xx = hu->priv;
  41. BT_DBG("hu %p", hu);
  42. skb_queue_purge(&ag6xx->txq);
  43. kfree_skb(ag6xx->rx_skb);
  44. kfree(ag6xx);
  45. hu->priv = NULL;
  46. return 0;
  47. }
  48. static int ag6xx_flush(struct hci_uart *hu)
  49. {
  50. struct ag6xx_data *ag6xx = hu->priv;
  51. BT_DBG("hu %p", hu);
  52. skb_queue_purge(&ag6xx->txq);
  53. return 0;
  54. }
  55. static struct sk_buff *ag6xx_dequeue(struct hci_uart *hu)
  56. {
  57. struct ag6xx_data *ag6xx = hu->priv;
  58. struct sk_buff *skb;
  59. skb = skb_dequeue(&ag6xx->txq);
  60. if (!skb)
  61. return skb;
  62. /* Prepend skb with frame type */
  63. memcpy(skb_push(skb, 1), &bt_cb(skb)->pkt_type, 1);
  64. return skb;
  65. }
  66. static int ag6xx_enqueue(struct hci_uart *hu, struct sk_buff *skb)
  67. {
  68. struct ag6xx_data *ag6xx = hu->priv;
  69. skb_queue_tail(&ag6xx->txq, skb);
  70. return 0;
  71. }
  72. static const struct h4_recv_pkt ag6xx_recv_pkts[] = {
  73. { H4_RECV_ACL, .recv = hci_recv_frame },
  74. { H4_RECV_SCO, .recv = hci_recv_frame },
  75. { H4_RECV_EVENT, .recv = hci_recv_frame },
  76. };
  77. static int ag6xx_recv(struct hci_uart *hu, const void *data, int count)
  78. {
  79. struct ag6xx_data *ag6xx = hu->priv;
  80. if (!test_bit(HCI_UART_REGISTERED, &hu->flags))
  81. return -EUNATCH;
  82. ag6xx->rx_skb = h4_recv_buf(hu->hdev, ag6xx->rx_skb, data, count,
  83. ag6xx_recv_pkts,
  84. ARRAY_SIZE(ag6xx_recv_pkts));
  85. if (IS_ERR(ag6xx->rx_skb)) {
  86. int err = PTR_ERR(ag6xx->rx_skb);
  87. bt_dev_err(hu->hdev, "Frame reassembly failed (%d)", err);
  88. ag6xx->rx_skb = NULL;
  89. return err;
  90. }
  91. return count;
  92. }
  93. static int intel_mem_write(struct hci_dev *hdev, u32 addr, u32 plen,
  94. const void *data)
  95. {
  96. /* Can write a maximum of 247 bytes per HCI command.
  97. * HCI cmd Header (3), Intel mem write header (6), data (247).
  98. */
  99. while (plen > 0) {
  100. struct sk_buff *skb;
  101. u8 cmd_param[253], fragment_len = (plen > 247) ? 247 : plen;
  102. __le32 leaddr = cpu_to_le32(addr);
  103. memcpy(cmd_param, &leaddr, 4);
  104. cmd_param[4] = 0;
  105. cmd_param[5] = fragment_len;
  106. memcpy(cmd_param + 6, data, fragment_len);
  107. skb = __hci_cmd_sync(hdev, 0xfc8e, fragment_len + 6, cmd_param,
  108. HCI_INIT_TIMEOUT);
  109. if (IS_ERR(skb))
  110. return PTR_ERR(skb);
  111. kfree_skb(skb);
  112. plen -= fragment_len;
  113. data += fragment_len;
  114. addr += fragment_len;
  115. }
  116. return 0;
  117. }
  118. static int ag6xx_setup(struct hci_uart *hu)
  119. {
  120. struct hci_dev *hdev = hu->hdev;
  121. struct sk_buff *skb;
  122. struct intel_version ver;
  123. const struct firmware *fw;
  124. const u8 *fw_ptr;
  125. char fwname[64];
  126. bool patched = false;
  127. int err;
  128. hu->hdev->set_diag = btintel_set_diag;
  129. hu->hdev->set_bdaddr = btintel_set_bdaddr;
  130. err = btintel_enter_mfg(hdev);
  131. if (err)
  132. return err;
  133. err = btintel_read_version(hdev, &ver);
  134. if (err)
  135. return err;
  136. btintel_version_info(hdev, &ver);
  137. /* The hardware platform number has a fixed value of 0x37 and
  138. * for now only accept this single value.
  139. */
  140. if (ver.hw_platform != 0x37) {
  141. bt_dev_err(hdev, "Unsupported Intel hardware platform: 0x%X",
  142. ver.hw_platform);
  143. return -EINVAL;
  144. }
  145. /* Only the hardware variant iBT 2.1 (AG6XX) is supported by this
  146. * firmware setup method.
  147. */
  148. if (ver.hw_variant != 0x0a) {
  149. bt_dev_err(hdev, "Unsupported Intel hardware variant: 0x%x",
  150. ver.hw_variant);
  151. return -EINVAL;
  152. }
  153. snprintf(fwname, sizeof(fwname), "intel/ibt-hw-%x.%x.bddata",
  154. ver.hw_platform, ver.hw_variant);
  155. err = request_firmware(&fw, fwname, &hdev->dev);
  156. if (err < 0) {
  157. bt_dev_err(hdev, "Failed to open Intel bddata file: %s (%d)",
  158. fwname, err);
  159. goto patch;
  160. }
  161. fw_ptr = fw->data;
  162. bt_dev_info(hdev, "Applying bddata (%s)", fwname);
  163. skb = __hci_cmd_sync_ev(hdev, 0xfc2f, fw->size, fw->data,
  164. HCI_EV_CMD_STATUS, HCI_CMD_TIMEOUT);
  165. if (IS_ERR(skb)) {
  166. bt_dev_err(hdev, "Applying bddata failed (%ld)", PTR_ERR(skb));
  167. release_firmware(fw);
  168. return PTR_ERR(skb);
  169. }
  170. kfree_skb(skb);
  171. release_firmware(fw);
  172. patch:
  173. /* If there is no applied patch, fw_patch_num is always 0x00. In other
  174. * cases, current firmware is already patched. No need to patch it.
  175. */
  176. if (ver.fw_patch_num) {
  177. bt_dev_info(hdev, "Device is already patched. patch num: %02x",
  178. ver.fw_patch_num);
  179. patched = true;
  180. goto complete;
  181. }
  182. snprintf(fwname, sizeof(fwname),
  183. "intel/ibt-hw-%x.%x.%x-fw-%x.%x.%x.%x.%x.pbn",
  184. ver.hw_platform, ver.hw_variant, ver.hw_revision,
  185. ver.fw_variant, ver.fw_revision, ver.fw_build_num,
  186. ver.fw_build_ww, ver.fw_build_yy);
  187. err = request_firmware(&fw, fwname, &hdev->dev);
  188. if (err < 0) {
  189. bt_dev_err(hdev, "Failed to open Intel patch file: %s(%d)",
  190. fwname, err);
  191. goto complete;
  192. }
  193. fw_ptr = fw->data;
  194. bt_dev_info(hdev, "Patching firmware file (%s)", fwname);
  195. /* PBN patch file contains a list of binary patches to be applied on top
  196. * of the embedded firmware. Each patch entry header contains the target
  197. * address and patch size.
  198. *
  199. * Patch entry:
  200. * | addr(le) | patch_len(le) | patch_data |
  201. * | 4 Bytes | 4 Bytes | n Bytes |
  202. *
  203. * PBN file is terminated by a patch entry whose address is 0xffffffff.
  204. */
  205. while (fw->size > fw_ptr - fw->data) {
  206. struct pbn_entry *pbn = (void *)fw_ptr;
  207. u32 addr, plen;
  208. if (pbn->addr == 0xffffffff) {
  209. bt_dev_info(hdev, "Patching complete");
  210. patched = true;
  211. break;
  212. }
  213. addr = le32_to_cpu(pbn->addr);
  214. plen = le32_to_cpu(pbn->plen);
  215. if (fw->data + fw->size <= pbn->data + plen) {
  216. bt_dev_info(hdev, "Invalid patch len (%d)", plen);
  217. break;
  218. }
  219. bt_dev_info(hdev, "Patching %td/%zu", (fw_ptr - fw->data),
  220. fw->size);
  221. err = intel_mem_write(hdev, addr, plen, pbn->data);
  222. if (err) {
  223. bt_dev_err(hdev, "Patching failed");
  224. break;
  225. }
  226. fw_ptr = pbn->data + plen;
  227. }
  228. release_firmware(fw);
  229. complete:
  230. /* Exit manufacturing mode and reset */
  231. err = btintel_exit_mfg(hdev, true, patched);
  232. if (err)
  233. return err;
  234. /* Set the event mask for Intel specific vendor events. This enables
  235. * a few extra events that are useful during general operation.
  236. */
  237. btintel_set_event_mask_mfg(hdev, false);
  238. btintel_check_bdaddr(hdev);
  239. return 0;
  240. }
  241. static const struct hci_uart_proto ag6xx_proto = {
  242. .id = HCI_UART_AG6XX,
  243. .name = "AG6XX",
  244. .manufacturer = 2,
  245. .open = ag6xx_open,
  246. .close = ag6xx_close,
  247. .flush = ag6xx_flush,
  248. .setup = ag6xx_setup,
  249. .recv = ag6xx_recv,
  250. .enqueue = ag6xx_enqueue,
  251. .dequeue = ag6xx_dequeue,
  252. };
  253. int __init ag6xx_init(void)
  254. {
  255. return hci_uart_register_proto(&ag6xx_proto);
  256. }
  257. int __exit ag6xx_deinit(void)
  258. {
  259. return hci_uart_unregister_proto(&ag6xx_proto);
  260. }