Commit 395174bb authored by Loic Poulain's avatar Loic Poulain Committed by Marcel Holtmann
Browse files

Bluetooth: hci_uart: Add Intel/AG6xx support 



This driver implements support for iBT2.1 Bluetooth controller embedded
in the AG620 communication combo. The controller needs to be configured
with bddata and can be patched with a binary patch file (pbn).
These operations are performed in manufacturing mode.

Signed-off-by: default avatarLoic Poulain <loic.poulain@intel.com>
Signed-off-by: default avatarMarcel Holtmann <marcel@holtmann.org>
parent 4c23d874

drivers/bluetooth/Kconfig

+11 −0
Original line number Diff line number Diff line
@@ -169,6 +169,17 @@ config BT_HCIUART_QCA 


	  Say Y here to compile support for QCA protocol.



config BT_HCIUART_AG6XX

	bool "Intel AG6XX protocol support"

	depends on BT_HCIUART

	select BT_HCIUART_H4

	select BT_INTEL

	help

	  The Intel/AG6XX protocol support enables Bluetooth HCI over serial

	  port interface for Intel ibt 2.1 Bluetooth controllers.



	  Say Y here to compile support for Intel AG6XX protocol.



config BT_HCIBCM203X

	tristate "HCI BCM203x USB driver"

	depends on USB

drivers/bluetooth/Makefile

+1 −0
Original line number Diff line number Diff line
@@ -36,6 +36,7 @@ hci_uart-$(CONFIG_BT_HCIUART_3WIRE) += hci_h5.o 
hci_uart-$(CONFIG_BT_HCIUART_INTEL)	+= hci_intel.o

hci_uart-$(CONFIG_BT_HCIUART_BCM)	+= hci_bcm.o

hci_uart-$(CONFIG_BT_HCIUART_QCA)	+= hci_qca.o

hci_uart-$(CONFIG_BT_HCIUART_AG6XX)	+= hci_ag6xx.o

hci_uart-objs				:= $(hci_uart-y)



ccflags-y += -D__CHECK_ENDIAN__

drivers/bluetooth/hci_ag6xx.c

0 → 100644
+326 −0
Original line number Diff line number Diff line 
/*

 *

 *  Bluetooth HCI UART driver for Intel/AG6xx devices

 *

 *  Copyright (C) 2016  Intel Corporation

 *

 *

 *  This program is free software; you can redistribute it and/or modify

 *  it under the terms of the GNU General Public License as published by

 *  the Free Software Foundation; either version 2 of the License, or

 *  (at your option) any later version.

 *

 *  This program is distributed in the hope that it will be useful,

 *  but WITHOUT ANY WARRANTY; without even the implied warranty of

 *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the

 *  GNU General Public License for more details.

 *

 *  You should have received a copy of the GNU General Public License

 *  along with this program; if not, write to the Free Software

 *  Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA

 *

 */



#include <linux/kernel.h>

#include <linux/errno.h>

#include <linux/skbuff.h>

#include <linux/firmware.h>

#include <linux/module.h>

#include <linux/tty.h>



#include <net/bluetooth/bluetooth.h>

#include <net/bluetooth/hci_core.h>



#include "hci_uart.h"

#include "btintel.h"



struct ag6xx_data {

	struct sk_buff *rx_skb;

	struct sk_buff_head txq;

};



struct pbn_entry {

	__le32 addr;

	__le32 plen;

	__u8 data[0];

} __packed;



static int ag6xx_open(struct hci_uart *hu)

{

	struct ag6xx_data *ag6xx;



	BT_DBG("hu %p", hu);



	ag6xx = kzalloc(sizeof(*ag6xx), GFP_KERNEL);

	if (!ag6xx)

		return -ENOMEM;



	skb_queue_head_init(&ag6xx->txq);



	hu->priv = ag6xx;

	return 0;

}



static int ag6xx_close(struct hci_uart *hu)

{

	struct ag6xx_data *ag6xx = hu->priv;



	BT_DBG("hu %p", hu);



	skb_queue_purge(&ag6xx->txq);

	kfree_skb(ag6xx->rx_skb);

	kfree(ag6xx);



	hu->priv = NULL;

	return 0;

}



static int ag6xx_flush(struct hci_uart *hu)

{

	struct ag6xx_data *ag6xx = hu->priv;



	BT_DBG("hu %p", hu);



	skb_queue_purge(&ag6xx->txq);

	return 0;

}



static struct sk_buff *ag6xx_dequeue(struct hci_uart *hu)

{

	struct ag6xx_data *ag6xx = hu->priv;

	struct sk_buff *skb;



	skb = skb_dequeue(&ag6xx->txq);

	if (!skb)

		return skb;



	/* Prepend skb with frame type */

	memcpy(skb_push(skb, 1), &bt_cb(skb)->pkt_type, 1);

	return skb;

}



static int ag6xx_enqueue(struct hci_uart *hu, struct sk_buff *skb)

{

	struct ag6xx_data *ag6xx = hu->priv;



	skb_queue_tail(&ag6xx->txq, skb);

	return 0;

}



static const struct h4_recv_pkt ag6xx_recv_pkts[] = {

	{ H4_RECV_ACL,    .recv = hci_recv_frame   },

	{ H4_RECV_SCO,    .recv = hci_recv_frame   },

	{ H4_RECV_EVENT,  .recv = hci_recv_frame   },

};



static int ag6xx_recv(struct hci_uart *hu, const void *data, int count)

{

	struct ag6xx_data *ag6xx = hu->priv;



	if (!test_bit(HCI_UART_REGISTERED, &hu->flags))

		return -EUNATCH;



	ag6xx->rx_skb = h4_recv_buf(hu->hdev, ag6xx->rx_skb, data, count,

				    ag6xx_recv_pkts,

				    ARRAY_SIZE(ag6xx_recv_pkts));

	if (IS_ERR(ag6xx->rx_skb)) {

		int err = PTR_ERR(ag6xx->rx_skb);

		bt_dev_err(hu->hdev, "Frame reassembly failed (%d)", err);

		ag6xx->rx_skb = NULL;

		return err;

	}



	return count;

}



static int intel_mem_write(struct hci_dev *hdev, u32 addr, u32 plen,

			   const void *data)

{

	/* Can write a maximum of 247 bytes per HCI command.

	 * HCI cmd Header (3), Intel mem write header (6), data (247).

	 */

	while (plen > 0) {

		struct sk_buff *skb;

		u8 cmd_param[253], fragment_len = (plen > 247) ? 247 : plen;

		__le32 leaddr = cpu_to_le32(addr);



		memcpy(cmd_param, &leaddr, 4);

		cmd_param[4] = 0;

		cmd_param[5] = fragment_len;

		memcpy(cmd_param + 6, data, fragment_len);



		skb = __hci_cmd_sync(hdev, 0xfc8e, fragment_len + 6, cmd_param,

				     HCI_INIT_TIMEOUT);

		if (IS_ERR(skb))

			return PTR_ERR(skb);

		kfree_skb(skb);



		plen -= fragment_len;

		data += fragment_len;

		addr += fragment_len;

	}



	return 0;

}



static int ag6xx_setup(struct hci_uart *hu)

{

	struct hci_dev *hdev = hu->hdev;

	struct sk_buff *skb;

	struct intel_version ver;

	const struct firmware *fw;

	const u8 *fw_ptr;

	char fwname[64];

	bool patched = false;

	int err;



	err = btintel_enter_mfg(hdev);

	if (err)

		return err;



	err = btintel_read_version(hdev, &ver);

	if (err)

		return err;



	btintel_version_info(hdev, &ver);



	/* The hardware platform number has a fixed value of 0x37 and

	 * for now only accept this single value.

	 */

	if (ver.hw_platform != 0x37) {

		bt_dev_err(hdev, "Unsupported Intel hardware platform: 0x%X",

			   ver.hw_platform);

		return -EINVAL;

	}



	/* Only the hardware variant iBT 2.1 (AG6XX) is supported by this

	 * firmware setup method.

	 */

	if (ver.hw_variant != 0x0a) {

		bt_dev_err(hdev, "Unsupported Intel hardware variant: 0x%x",

			   ver.hw_variant);

		return -EINVAL;

	}



	snprintf(fwname, sizeof(fwname), "intel/ibt-hw-%x.%x.bddata",

		 ver.hw_platform, ver.hw_variant);



	err = request_firmware(&fw, fwname, &hdev->dev);

	if (err < 0) {

		bt_dev_err(hdev, "Failed to open Intel bddata file: %s (%d)",

			   fwname, err);

		goto patch;

	}

	fw_ptr = fw->data;



	bt_dev_info(hdev, "Applying bddata (%s)", fwname);



	skb = __hci_cmd_sync_ev(hdev, 0xfc2f, fw->size, fw->data,

				HCI_EV_CMD_STATUS, HCI_CMD_TIMEOUT);

	if (IS_ERR(skb)) {

		bt_dev_err(hdev, "Applying bddata failed (%ld)", PTR_ERR(skb));

		release_firmware(fw);

		return PTR_ERR(skb);

	}

	kfree_skb(skb);



	release_firmware(fw);



patch:

	/* If there is no applied patch, fw_patch_num is always 0x00. In other

	 * cases, current firmware is already patched. No need to patch it.

	 */

	if (ver.fw_patch_num) {

		bt_dev_info(hdev, "Device is already patched. patch num: %02x",

			    ver.fw_patch_num);

		patched = true;

		goto complete;

	}



	snprintf(fwname, sizeof(fwname),

		 "intel/ibt-hw-%x.%x.%x-fw-%x.%x.%x.%x.%x.pbn",

		 ver.hw_platform, ver.hw_variant, ver.hw_revision,

		 ver.fw_variant,  ver.fw_revision, ver.fw_build_num,

		 ver.fw_build_ww, ver.fw_build_yy);



	err = request_firmware(&fw, fwname, &hdev->dev);

	if (err < 0) {

		bt_dev_err(hdev, "Failed to open Intel patch file: %s(%d)",

			   fwname, err);

		goto complete;

	}

	fw_ptr = fw->data;



	bt_dev_info(hdev, "Patching firmware file (%s)", fwname);



	/* PBN patch file contains a list of binary patches to be applied on top

	 * of the embedded firmware. Each patch entry header contains the target

	 * address and patch size.

	 *

	 * Patch entry:

	 * | addr(le) | patch_len(le) | patch_data |

	 * | 4 Bytes  |    4 Bytes    |   n Bytes  |

	 *

	 * PBN file is terminated by a patch entry whose address is 0xffffffff.

	 */

	while (fw->size > fw_ptr - fw->data) {

		struct pbn_entry *pbn = (void *)fw_ptr;

		u32 addr, plen;



		if (pbn->addr == 0xffffffff) {

			bt_dev_info(hdev, "Patching complete");

			patched = true;

			break;

		}



		addr = le32_to_cpu(pbn->addr);

		plen = le32_to_cpu(pbn->plen);



		if (fw->data + fw->size <= pbn->data + plen) {

			bt_dev_info(hdev, "Invalid patch len (%d)", plen);

			break;

		}



		bt_dev_info(hdev, "Patching %td/%zu", (fw_ptr - fw->data),

			    fw->size);



		err = intel_mem_write(hdev, addr, plen, pbn->data);

		if (err) {

			bt_dev_err(hdev, "Patching failed");

			break;

		}



		fw_ptr = pbn->data + plen;

	}



	release_firmware(fw);



complete:

	/* Exit manufacturing mode and reset */

	err = btintel_exit_mfg(hdev, true, patched);



	return err;

}



static const struct hci_uart_proto ag6xx_proto = {

	.id		= HCI_UART_AG6XX,

	.name		= "AG6XX",

	.manufacturer	= 2,

	.open		= ag6xx_open,

	.close		= ag6xx_close,

	.flush		= ag6xx_flush,

	.setup		= ag6xx_setup,

	.recv		= ag6xx_recv,

	.enqueue	= ag6xx_enqueue,

	.dequeue	= ag6xx_dequeue,

};



int __init ag6xx_init(void)

{

	return hci_uart_register_proto(&ag6xx_proto);

}



int __exit ag6xx_deinit(void)

{

	return hci_uart_unregister_proto(&ag6xx_proto);

}

drivers/bluetooth/hci_ldisc.c

+6 −0
Original line number Diff line number Diff line
@@ -804,6 +804,9 @@ static int __init hci_uart_init(void) 
#ifdef CONFIG_BT_HCIUART_QCA

	qca_init();

#endif

#ifdef CONFIG_BT_HCIUART_AG6XX

	ag6xx_init();

#endif



	return 0;

}
@@ -836,6 +839,9 @@ static void __exit hci_uart_exit(void) 
#ifdef CONFIG_BT_HCIUART_QCA

	qca_deinit();

#endif

#ifdef CONFIG_BT_HCIUART_AG6XX

	ag6xx_deinit();

#endif



	/* Release tty registration of line discipline */

	err = tty_unregister_ldisc(N_HCI);

drivers/bluetooth/hci_uart.h

+7 −1
Original line number Diff line number Diff line
@@ -35,7 +35,7 @@ 
#define HCIUARTGETFLAGS		_IOR('U', 204, int)



/* UART protocols */

#define HCI_UART_MAX_PROTO	9

#define HCI_UART_MAX_PROTO	10



#define HCI_UART_H4	0

#define HCI_UART_BCSP	1
@@ -46,6 +46,7 @@ 
#define HCI_UART_INTEL	6

#define HCI_UART_BCM	7

#define HCI_UART_QCA	8

#define HCI_UART_AG6XX	9



#define HCI_UART_RAW_DEVICE	0

#define HCI_UART_RESET_ON_INIT	1
@@ -182,3 +183,8 @@ int bcm_deinit(void); 
int qca_init(void);

int qca_deinit(void);

#endif



#ifdef CONFIG_BT_HCIUART_AG6XX

int ag6xx_init(void);

int ag6xx_deinit(void);

#endif