3 * Bluetooth HCI UART driver for Intel/AG6xx devices
5 * Copyright (C) 2016 Intel Corporation
8 * This program is free software; you can redistribute it and/or modify
9 * it under the terms of the GNU General Public License as published by
10 * the Free Software Foundation; either version 2 of the License, or
11 * (at your option) any later version.
13 * This program is distributed in the hope that it will be useful,
14 * but WITHOUT ANY WARRANTY; without even the implied warranty of
15 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
16 * GNU General Public License for more details.
18 * You should have received a copy of the GNU General Public License
19 * along with this program; if not, write to the Free Software
20 * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
24 #include <linux/kernel.h>
25 #include <linux/errno.h>
26 #include <linux/skbuff.h>
27 #include <linux/firmware.h>
28 #include <linux/module.h>
29 #include <linux/tty.h>
31 #include <net/bluetooth/bluetooth.h>
32 #include <net/bluetooth/hci_core.h>
38 struct sk_buff
*rx_skb
;
39 struct sk_buff_head txq
;
48 static int ag6xx_open(struct hci_uart
*hu
)
50 struct ag6xx_data
*ag6xx
;
54 ag6xx
= kzalloc(sizeof(*ag6xx
), GFP_KERNEL
);
58 skb_queue_head_init(&ag6xx
->txq
);
64 static int ag6xx_close(struct hci_uart
*hu
)
66 struct ag6xx_data
*ag6xx
= hu
->priv
;
70 skb_queue_purge(&ag6xx
->txq
);
71 kfree_skb(ag6xx
->rx_skb
);
78 static int ag6xx_flush(struct hci_uart
*hu
)
80 struct ag6xx_data
*ag6xx
= hu
->priv
;
84 skb_queue_purge(&ag6xx
->txq
);
88 static struct sk_buff
*ag6xx_dequeue(struct hci_uart
*hu
)
90 struct ag6xx_data
*ag6xx
= hu
->priv
;
93 skb
= skb_dequeue(&ag6xx
->txq
);
97 /* Prepend skb with frame type */
98 memcpy(skb_push(skb
, 1), &bt_cb(skb
)->pkt_type
, 1);
102 static int ag6xx_enqueue(struct hci_uart
*hu
, struct sk_buff
*skb
)
104 struct ag6xx_data
*ag6xx
= hu
->priv
;
106 skb_queue_tail(&ag6xx
->txq
, skb
);
110 static const struct h4_recv_pkt ag6xx_recv_pkts
[] = {
111 { H4_RECV_ACL
, .recv
= hci_recv_frame
},
112 { H4_RECV_SCO
, .recv
= hci_recv_frame
},
113 { H4_RECV_EVENT
, .recv
= hci_recv_frame
},
116 static int ag6xx_recv(struct hci_uart
*hu
, const void *data
, int count
)
118 struct ag6xx_data
*ag6xx
= hu
->priv
;
120 if (!test_bit(HCI_UART_REGISTERED
, &hu
->flags
))
123 ag6xx
->rx_skb
= h4_recv_buf(hu
->hdev
, ag6xx
->rx_skb
, data
, count
,
125 ARRAY_SIZE(ag6xx_recv_pkts
));
126 if (IS_ERR(ag6xx
->rx_skb
)) {
127 int err
= PTR_ERR(ag6xx
->rx_skb
);
128 bt_dev_err(hu
->hdev
, "Frame reassembly failed (%d)", err
);
129 ag6xx
->rx_skb
= NULL
;
136 static int intel_mem_write(struct hci_dev
*hdev
, u32 addr
, u32 plen
,
139 /* Can write a maximum of 247 bytes per HCI command.
140 * HCI cmd Header (3), Intel mem write header (6), data (247).
144 u8 cmd_param
[253], fragment_len
= (plen
> 247) ? 247 : plen
;
145 __le32 leaddr
= cpu_to_le32(addr
);
147 memcpy(cmd_param
, &leaddr
, 4);
149 cmd_param
[5] = fragment_len
;
150 memcpy(cmd_param
+ 6, data
, fragment_len
);
152 skb
= __hci_cmd_sync(hdev
, 0xfc8e, fragment_len
+ 6, cmd_param
,
158 plen
-= fragment_len
;
159 data
+= fragment_len
;
160 addr
+= fragment_len
;
166 static int ag6xx_setup(struct hci_uart
*hu
)
168 struct hci_dev
*hdev
= hu
->hdev
;
170 struct intel_version ver
;
171 const struct firmware
*fw
;
174 bool patched
= false;
177 err
= btintel_enter_mfg(hdev
);
181 err
= btintel_read_version(hdev
, &ver
);
185 btintel_version_info(hdev
, &ver
);
187 /* The hardware platform number has a fixed value of 0x37 and
188 * for now only accept this single value.
190 if (ver
.hw_platform
!= 0x37) {
191 bt_dev_err(hdev
, "Unsupported Intel hardware platform: 0x%X",
196 /* Only the hardware variant iBT 2.1 (AG6XX) is supported by this
197 * firmware setup method.
199 if (ver
.hw_variant
!= 0x0a) {
200 bt_dev_err(hdev
, "Unsupported Intel hardware variant: 0x%x",
205 snprintf(fwname
, sizeof(fwname
), "intel/ibt-hw-%x.%x.bddata",
206 ver
.hw_platform
, ver
.hw_variant
);
208 err
= request_firmware(&fw
, fwname
, &hdev
->dev
);
210 bt_dev_err(hdev
, "Failed to open Intel bddata file: %s (%d)",
216 bt_dev_info(hdev
, "Applying bddata (%s)", fwname
);
218 skb
= __hci_cmd_sync_ev(hdev
, 0xfc2f, fw
->size
, fw
->data
,
219 HCI_EV_CMD_STATUS
, HCI_CMD_TIMEOUT
);
221 bt_dev_err(hdev
, "Applying bddata failed (%ld)", PTR_ERR(skb
));
222 release_firmware(fw
);
227 release_firmware(fw
);
230 /* If there is no applied patch, fw_patch_num is always 0x00. In other
231 * cases, current firmware is already patched. No need to patch it.
233 if (ver
.fw_patch_num
) {
234 bt_dev_info(hdev
, "Device is already patched. patch num: %02x",
240 snprintf(fwname
, sizeof(fwname
),
241 "intel/ibt-hw-%x.%x.%x-fw-%x.%x.%x.%x.%x.pbn",
242 ver
.hw_platform
, ver
.hw_variant
, ver
.hw_revision
,
243 ver
.fw_variant
, ver
.fw_revision
, ver
.fw_build_num
,
244 ver
.fw_build_ww
, ver
.fw_build_yy
);
246 err
= request_firmware(&fw
, fwname
, &hdev
->dev
);
248 bt_dev_err(hdev
, "Failed to open Intel patch file: %s(%d)",
254 bt_dev_info(hdev
, "Patching firmware file (%s)", fwname
);
256 /* PBN patch file contains a list of binary patches to be applied on top
257 * of the embedded firmware. Each patch entry header contains the target
258 * address and patch size.
261 * | addr(le) | patch_len(le) | patch_data |
262 * | 4 Bytes | 4 Bytes | n Bytes |
264 * PBN file is terminated by a patch entry whose address is 0xffffffff.
266 while (fw
->size
> fw_ptr
- fw
->data
) {
267 struct pbn_entry
*pbn
= (void *)fw_ptr
;
270 if (pbn
->addr
== 0xffffffff) {
271 bt_dev_info(hdev
, "Patching complete");
276 addr
= le32_to_cpu(pbn
->addr
);
277 plen
= le32_to_cpu(pbn
->plen
);
279 if (fw
->data
+ fw
->size
<= pbn
->data
+ plen
) {
280 bt_dev_info(hdev
, "Invalid patch len (%d)", plen
);
284 bt_dev_info(hdev
, "Patching %td/%zu", (fw_ptr
- fw
->data
),
287 err
= intel_mem_write(hdev
, addr
, plen
, pbn
->data
);
289 bt_dev_err(hdev
, "Patching failed");
293 fw_ptr
= pbn
->data
+ plen
;
296 release_firmware(fw
);
299 /* Exit manufacturing mode and reset */
300 err
= btintel_exit_mfg(hdev
, true, patched
);
305 static const struct hci_uart_proto ag6xx_proto
= {
306 .id
= HCI_UART_AG6XX
,
310 .close
= ag6xx_close
,
311 .flush
= ag6xx_flush
,
312 .setup
= ag6xx_setup
,
314 .enqueue
= ag6xx_enqueue
,
315 .dequeue
= ag6xx_dequeue
,
318 int __init
ag6xx_init(void)
320 return hci_uart_register_proto(&ag6xx_proto
);
323 int __exit
ag6xx_deinit(void)
325 return hci_uart_unregister_proto(&ag6xx_proto
);