// SPDX-License-Identifier: GPL-2.0-only /* * Qualcomm Bluetooth USB transport-specific support * * Abbreviations: * BTC - BT controller * PERI - Peripheral subsystem of a multi-subsys BTC * TME-L - Trust Management Engine Lite subsystem of a multi-subsys BTC * DFU - Device Firmware Update * EDL - Embedded Downloader * TLV - Type-Length-Value, a firmware file format * VSC - Vendor-Specific Command * VSE - Vendor-Specific Event * CCE - Command Complete Event * CSE - Command Status Event * * Copyright (c) Qualcomm Technologies, Inc. and/or its subsidiaries. */ #include #include #include #include #include #include #include #include #include #include #include #include #include "btusb_qcom.h" /* * ============================================================================ * Supported BTCs and their configuration * ============================================================================ */ /* * enum qbtc_category - driver-perspective BTC category * @QBTC_CAT_LEGACY: legacy * @QBTC_CAT_UNIFIED: unified HCI, VSC gets CCE as response * @QBTC_CAT_MSUBSYS: multi-subsys, always has PERI * @QBTC_CAT_MAX: number of categories */ enum qbtc_category { QBTC_CAT_LEGACY, QBTC_CAT_UNIFIED, QBTC_CAT_MSUBSYS, QBTC_CAT_MAX, }; static const char *qbtc_category_name(int category) { const char *category_name = "unknown"; switch (category) { case QBTC_CAT_LEGACY: category_name = "legacy"; break; case QBTC_CAT_UNIFIED: category_name = "unified"; break; case QBTC_CAT_MSUBSYS: category_name = "multi-subsys"; break; default: break; } return category_name; } /* flags for BTC info and default configuration */ /* BTC has PERI / TME-L subsystem */ #define QBT_FLAG_HAS_PERI BIT(0) #define QBT_FLAG_HAS_TMEL BIT(1) /* BTC supports AOSP / MSFT vendor extension */ #define QBT_FLAG_AOSP_EXT BIT(4) #define QBT_FLAG_MSFT_EXT BIT(5) /* BTC supports software reset */ #define QBT_FLAG_SW_RESET BIT(6) /* BTC supports memdump */ #define QBT_FLAG_MEMDUMP BIT(7) /* take foundry as a factor to select NVM */ #define QBT_FLAG_FOUNDRY_NVM BIT(8) /* select NVM based on board ID to download */ #define QBT_FLAG_BID_NVM BIT(9) /* fall back to the default NVM if no board-ID-specific NVM exists */ #define QBT_FLAG_NVM_FALLBACK BIT(10) /* reset PERI HCI by QHCI instead of QDFU */ #define QBT_FLAG_RESET_PERI_HCI BIT(11) /* trigger memdump on command timeout */ #define QBT_FLAG_CMD_TIMEOUT_MEMDUMP BIT(12) /* reserve bits [31:24] for board-level flags */ #define QBT_FLAG_BTC_CFG_MASK GENMASK(23, 0) /* rare board ID to custom firmware directroy map */ struct qbtc_bid_fwdir { u16 board_id; const char *fw_dir; }; /* * struct qbtc_info - BTC information and default configuration * @category: driver-perspective BTC category (legacy/unified/multi-subsys) * @flags: QBT_FLAG_* — BTC attributes and default configuration * @fw_dir: firmware folder, "qca" if NULL * @custom_fw_table: {}-terminated array or NULL */ struct qbtc_info { enum qbtc_category category; unsigned long flags; const char *fw_dir; const struct qbtc_bid_fwdir *custom_fw_table; }; /* * struct qbtc_id - BTC ID entry in qbtc_id_table[] below * @rom_version: ID to match against rom_version read from BTC * @name: human-readable BTC name * @btc_info: BTC information and default configuration, != NULL */ struct qbtc_id { u32 rom_version; const char *name; const struct qbtc_info *btc_info; }; /* multi-subsys BTC here */ #define QBTC_INFO_FLAGS_MSUBSYS (QBT_FLAG_HAS_PERI | QBT_FLAG_AOSP_EXT | \ QBT_FLAG_MSFT_EXT | QBT_FLAG_SW_RESET | \ QBT_FLAG_MEMDUMP | QBT_FLAG_BID_NVM | \ QBT_FLAG_NVM_FALLBACK | QBT_FLAG_CMD_TIMEOUT_MEMDUMP) static const struct qbtc_info qbtc_msubsys_qcc2072 = { .category = QBTC_CAT_MSUBSYS, .flags = QBTC_INFO_FLAGS_MSUBSYS, .fw_dir = "qca/QCC2072", }; static const struct qbtc_id qbtc_id_table[] = { { 0x00220100, "QCC2072 1.x", &qbtc_msubsys_qcc2072 }, { } }; /* * ============================================================================ * Qualcomm DFU for rampatch/NVM download * ============================================================================ */ /* QDFU USB vendor command codes (bRequest) */ #define QDFU_BT_CMD_VSC_REQ_DOWNLOAD_LOCAL 0x01 #define QDFU_BT_CMD_CHECK_TARGET_STATE 0x05 #define QDFU_BT_CMD_GET_TARGET_VERSION 0x09 #define QDFU_BT_CMD_VSC_REQ_DOWNLOAD_REMOTE 0x10 #define QDFU_BT_CMD_RESET_PERI_HCI 0x11 #define QDFU_BT_CMD_ACTIVATE_REMOTE_BTSS 0x12 #define QDFU_BT_CMD_BT_ENABLE_RESET 0x13 /* QDFU target status bits (u8 bitmask from QDFU_BT_CMD_CHECK_TARGET_STATE) */ #define QDFU_BT_STATE_LOADING_LOCAL BIT(3) #define QDFU_BT_STATE_PATCHED_REMOTE BIT(4) #define QDFU_BT_STATE_NVMED_REMOTE BIT(5) #define QDFU_BT_STATE_NVMED_LOCAL BIT(6) #define QDFU_BT_STATE_PATCHED_LOCAL BIT(7) /* QDFU_BT_CMD_GET_TARGET_VERSION response */ struct qdfu_bt_version { __le32 rom_version; __le32 patch_version; __le32 soc_ver; __be16 board_id; __le16 flag; u8 reserved[4]; } __packed; struct qdfu_bt_id { u32 rom_version; u32 patch_version; u32 soc_id; u16 board_id; }; static inline int qdfu_recv_vendor_req(struct hci_dev *hdev, u8 request, u16 value, void *buf, u16 size) { struct btusb_qcom *xport_data = btusb_qcom_xport_data(hdev); return usb_control_msg_recv(xport_data->udev, 0, request, USB_DIR_IN | USB_TYPE_VENDOR | USB_RECIP_ENDPOINT, value, 0, buf, size, USB_CTRL_GET_TIMEOUT, GFP_KERNEL); } static inline int qdfu_send_vendor_req(struct hci_dev *hdev, u8 request, u16 value, const void *buf, u16 size) { struct btusb_qcom *xport_data = btusb_qcom_xport_data(hdev); return usb_control_msg_send(xport_data->udev, 0, request, USB_DIR_OUT | USB_TYPE_VENDOR | USB_RECIP_ENDPOINT, value, 0, buf, size, USB_CTRL_SET_TIMEOUT, GFP_KERNEL); } static int qdfu_vsc_req_download(struct hci_dev *hdev, u8 request, const void *buf, u16 size) { int ret; if (request != QDFU_BT_CMD_VSC_REQ_DOWNLOAD_LOCAL && request != QDFU_BT_CMD_VSC_REQ_DOWNLOAD_REMOTE) { bt_dev_err(hdev, "QDFU download invalid request code 0x%02x", request); return -EINVAL; } ret = qdfu_send_vendor_req(hdev, request, 0, buf, size); if (ret) bt_dev_err(hdev, "QDFU download request 0x%02x failed: %pe", request, ERR_PTR(ret)); return ret; } static int qdfu_get_target_state(struct hci_dev *hdev, u8 *state_ptr) { u8 state; int ret; ret = qdfu_recv_vendor_req(hdev, QDFU_BT_CMD_CHECK_TARGET_STATE, 0, &state, sizeof(state)); if (!ret) *state_ptr = state; else bt_dev_err(hdev, "QDFU get target state failed: %pe", ERR_PTR(ret)); return ret; } static int qdfu_get_target_version(struct hci_dev *hdev, struct qdfu_bt_id *id_info) { struct qdfu_bt_version dfu_ver; u16 board_id = 0; int ret; ret = qdfu_recv_vendor_req(hdev, QDFU_BT_CMD_GET_TARGET_VERSION, 0, &dfu_ver, sizeof(dfu_ver)); if (ret) { bt_dev_err(hdev, "QDFU get target version failed: %pe", ERR_PTR(ret)); return ret; } id_info->rom_version = le32_to_cpu(dfu_ver.rom_version); id_info->patch_version = le32_to_cpu(dfu_ver.patch_version); id_info->soc_id = le32_to_cpu(dfu_ver.soc_ver); if ((le16_to_cpu(dfu_ver.flag) >> 8) == 0x80) board_id = be16_to_cpu(dfu_ver.board_id); /* Take 0xffff as invalid board ID */ if (board_id == 0xffff) board_id = 0; id_info->board_id = board_id; return 0; } static int qdfu_activate_remote_btss(struct hci_dev *hdev, bool on, unsigned int wait_us) { u8 status = 0; int ret; ret = qdfu_recv_vendor_req(hdev, QDFU_BT_CMD_ACTIVATE_REMOTE_BTSS, on, &status, sizeof(status)); if (ret) { bt_dev_err(hdev, "QDFU turn %s remote BTSS failed: %pe", str_on_off(on), ERR_PTR(ret)); return ret; } switch (status) { case 0: bt_dev_dbg(hdev, "QDFU Remote BTSS turned %s", str_on_off(on)); fsleep(wait_us); break; case 0x17: bt_dev_dbg(hdev, "QDFU Remote BTSS already %s", str_on_off(on)); break; default: bt_dev_err(hdev, "QDFU turn remote BTSS %s failed, unexpected status 0x%02x", str_on_off(on), status); ret = -ENODEV; } return ret; } static int qdfu_reset_peri_hci(struct hci_dev *hdev) { int ret; ret = qdfu_send_vendor_req(hdev, QDFU_BT_CMD_RESET_PERI_HCI, 0, NULL, 0); if (ret) { bt_dev_err(hdev, "PERI HCI reset via QDFU failed: %pe", ERR_PTR(ret)); return ret; } bt_dev_info(hdev, "PERI HCI reset via QDFU succeeded"); fsleep(20 * 1000); return 0; } static int qdfu_sw_reset(struct hci_dev *hdev) { int ret; ret = qdfu_send_vendor_req(hdev, QDFU_BT_CMD_BT_ENABLE_RESET, 0, NULL, 0); /* SW reset succeeds even if the request returns an error code */ if (ret) bt_dev_dbg(hdev, "QDFU SW reset failed: %pe", ERR_PTR(ret)); bt_dev_info(hdev, "QDFU SW reset succeeded"); return 0; } /* * qdfu_poll_state - wait for DFU target status flags to reach a wanted state * @hdev: the HCI device to poll * @state_ptr: optional storage for the last status read; may be NULL * @set: true to wait until @flags are all set, false until all cleared * @flags: the status flag bits to wait on * * Repeatedly reads the DFU target status until @flags reach the requested * state, a status read fails, or the overall timeout expires. * * Return: 0 on success, -ETIMEDOUT on timeout, or a negative errno on read * failure. */ static int qdfu_poll_state(struct hci_dev *hdev, u8 *state_ptr, bool set, u8 flags) { int err, ret; u8 dfu_state; if (!state_ptr) state_ptr = &dfu_state; ret = read_poll_timeout(qdfu_get_target_state, err, err || (set ? (*state_ptr & flags) == flags : !(*state_ptr & flags)), 5 * 1000, 3000 * 1000, true, hdev, state_ptr); if (ret) { bt_dev_err(hdev, "Timed out waiting for QDFU state flags 0x%02x to be %s: %pe", flags, set ? "set" : "cleared", ERR_PTR(ret)); return ret; } return err; } static inline int qdfu_reset_msubsys_bt(struct hci_dev *hdev) { int ret; ret = qdfu_activate_remote_btss(hdev, false, 100 * 1000); if (!ret) ret = qdfu_activate_remote_btss(hdev, true, 100 * 1000); if (!ret) bt_dev_info(hdev, "QDFU reset msubsys BT succeeded"); return ret; } /* * ============================================================================ * Common definitions, per-device struct btqcom_data, and PERI frame format * ============================================================================ */ /* BTC version, read out via an HCI command */ struct qhci_btc_ver { u32 product_id; u32 soc_ver; u16 rom_ver; u16 patch_ver; u8 sec_ver; }; /* Subsystem field appears in a PERI command/response/event */ enum qhci_subsys { QHCI_SUBSYS_PERI, QHCI_SUBSYS_BT, QHCI_SUBSYS_UWB, QHCI_SUBSYS_TMEL, QHCI_SUBSYS_MAX, }; /* * The pseudo QHCI subsys: for BT-only BTC, or when the memdump comes * from the BT channel (HCI_EVENT_PKT or HCI_ACLDATA_PKT) on a msubsys * BTC, there is no real subsys — it stands in for these cases. */ #define QHCI_SUBSYS_INVALID QHCI_SUBSYS_MAX static const char *qhci_subsys_name(int subsys) { const char *subsys_name = "unknown"; switch (subsys) { case QHCI_SUBSYS_PERI: subsys_name = "PERI"; break; case QHCI_SUBSYS_BT: subsys_name = "PERI_BT"; break; case QHCI_SUBSYS_UWB: subsys_name = "UWB"; break; case QHCI_SUBSYS_TMEL: subsys_name = "TME-L"; break; case QHCI_SUBSYS_INVALID: subsys_name = "BT"; break; default: break; } return subsys_name; } /* BTC subsystems we care about that support the BT function unit */ enum qbtc_subsys { QBTC_SUBSYS_PERI, QBTC_SUBSYS_TMEL, QBTC_SUBSYS_MAX, }; /* * The pseudo BTC subsys stands in for the BT function unit, not a * real subsys, when building a firmware file path. */ #define QBTC_SUBSYS_INVALID QBTC_SUBSYS_MAX static const char *qbtc_subsys_name(int subsys) { const char *subsys_name = "unknown"; switch (subsys) { case QBTC_SUBSYS_PERI: subsys_name = "PERI"; break; case QBTC_SUBSYS_TMEL: subsys_name = "TME-L"; break; case QBTC_SUBSYS_INVALID: subsys_name = "BT"; break; default: break; } return subsys_name; } /* * struct qbtc_subsys_data - per-subsys data * @ver: subsys version * @board_id: subsys board ID * @build_info: the subsys firmware's build info string */ struct qbtc_subsys_data { struct qhci_btc_ver ver; u16 board_id; char build_info[160]; }; /* simple command payload */ struct qhci_cp_simple { u8 sub_opcode; } __packed; /* simple CCE(response) payload */ struct qhci_rp_simple { u8 status; } __packed; /* generic CCE(response) payload */ struct qhci_rp_generic { u8 status; u8 sub_opcode; } __packed; /* common VSE payload */ struct qhci_vse_comm { u8 ev_class; u8 ev_type; } __packed; #define QHCI_VSE_COMM_SIZE (sizeof(struct qhci_vse_comm)) #define QHCI_MEMDUMP_SEQ_LAST 0xFFFF #define QBT_EV_CLASS_DATALOG 0x01 #define QBT_EV_TYPE_MEMDUMP 0x08 /* * struct qhci_vse_memdump - one memdump segment * @seqno: segment sequence number; 0 = first, QHCI_MEMDUMP_SEQ_LAST = last * @subsys: subsystem this segment belongs to (see enum qhci_subsys) * @segdata: payload of a middle or last segment * @dump_size: total dump size, valid only in the first segment (@seqno == 0) * @first_segdata: payload of the first segment, following @dump_size */ struct qhci_vse_memdump { __le16 seqno; u8 subsys; union { u8 segdata[0]; struct { __le32 dump_size; u8 first_segdata[]; } __packed; }; } __packed; #define QHCI_MEMDUMP_SEGDATA_GAP \ (offsetof(struct qhci_vse_memdump, first_segdata) - \ offsetof(struct qhci_vse_memdump, segdata)) enum qhci_req_state { QHCI_REQ_DONE, QHCI_REQ_PEND, QHCI_REQ_CANCELED, /* unused for now */ QHCI_REQ_STOP, }; #define QHCI_OPCODE_INVALID HCI_OP_NOP #define QHCI_SUB_OPCODE_INVALID 0xff #define QHCI_REQ_EVENT_MAX 2 /* * struct qhci_req_spec - request/response specification * @opcode: command opcode, ignored if invalid * @sub_opcode: command sub-opcode, ignored if invalid * @event: a sequence of events, ending with an invalid marker */ struct qhci_req_spec { u16 opcode; u8 sub_opcode; u8 event[QHCI_REQ_EVENT_MAX + 1]; }; /* * struct qhci_req - per-request data, often stack allocated by the requester * @pkt_type: the packet type to sync * @spec: the request spec to sync * @req_rsp: response skb on success, NULL on no data, or ERR_PTR() on failure * @req_result: >= 0 an HCI status code, or a negative errno on failure * @event_idx: cursor into @spec->event */ struct qhci_req { u8 pkt_type; const struct qhci_req_spec *spec; struct sk_buff *req_rsp; int req_result; u8 event_idx; }; /* board has a BT_EN pin to reset BTC */ #define QBT_FLAG_HW_RESET BIT(24) /* * enum qbt_work_bit - bits in btqcom_data.work_flags * @QBT_WORK_RESET_HDEV: request to reset hdev */ enum qbt_work_bit { QBT_WORK_RESET_HDEV, }; /* * enum qbt_misc_bit - bits in btqcom_data.misc_flags * @QBT_MISC_MEMDUMP_PERI: PERI memdump * @QBT_MISC_MEMDUMP_BT: BT memdump * @QBT_MISC_MEMDUMP_UWB: UWB memdump, never happens here * @QBT_MISC_MEMDUMP_TMEL: TME-L memdump * @QBT_MISC_MEMDUMP_INCOMING: memdump is arriving from the BTC * @QBT_MISC_RESET_ACTIVE: a reset is in progress * @QBT_MISC_HWERR_PERI: PERI hardware error event happens * @QBT_MISC_HWERR_BT: BT hardware error event happens * @QBT_MISC_CMD_TIMEOUT: command timeout happens * * The memdump bits are indexed by enum qhci_subsys, so a subsystem's bit can * be derived from its QHCI subsys value. */ enum qbt_misc_bit { QBT_MISC_MEMDUMP_PERI = QHCI_SUBSYS_PERI, QBT_MISC_MEMDUMP_BT = QHCI_SUBSYS_BT, QBT_MISC_MEMDUMP_UWB = QHCI_SUBSYS_UWB, QBT_MISC_MEMDUMP_TMEL = QHCI_SUBSYS_TMEL, QBT_MISC_MEMDUMP_INCOMING, QBT_MISC_RESET_ACTIVE, QBT_MISC_HWERR_PERI, QBT_MISC_HWERR_BT, QBT_MISC_CMD_TIMEOUT, }; /* each subsys's memdump pending flag in btqcom_data.md_pending_flags */ #define QMD_FLAG_PENDING_PERI BIT(QBT_MISC_MEMDUMP_PERI) #define QMD_FLAG_PENDING_BT BIT(QBT_MISC_MEMDUMP_BT) #define QMD_FLAG_PENDING_TMEL BIT(QBT_MISC_MEMDUMP_TMEL) #define QMD_FLAG_PENDING_MASK (QMD_FLAG_PENDING_PERI | \ QMD_FLAG_PENDING_BT | \ QMD_FLAG_PENDING_TMEL) static inline int qmd_subsys_to_bit(int qhci_subsys) { return qhci_subsys == QHCI_SUBSYS_INVALID ? QBT_MISC_MEMDUMP_BT : qhci_subsys; } static inline unsigned long qmd_subsys_to_flag(int qhci_subsys) { return BIT(qmd_subsys_to_bit(qhci_subsys)); } /* * struct btqcom_memdump - collect memdump from a QHCI subsys * @size: total memdump size to collect * @subsys: QHCI subsys this memdump belongs to * @seqno: next expected sequence number * @from: which channel this memdump comes from, marked by hci_skb_pkt_type() * @submit_size: bytes submitted to HCI devcoredump for the subsys */ struct btqcom_memdump { u32 size; int subsys; u16 seqno; u8 from; u32 submit_size; }; /* * struct btqcom_data - transport-independent per-device common data, allocated as hci priv * @drv_name: driver name * @btc_name: human-readable BTC name * @category: driver-perspective BTC category (legacy/unified/multi-subsys) * @flags: QBT_FLAG_* flags for BTC/board and default config * @hdev: the owning HCI device * @xport_data: opaque transport-specific data (e.g. struct btusb_qcom for USB) * @inited: whether the hdev-lifetime fields are initialized * @board_id: BT board ID * @ver: BT version * @build_info: BT firmware build info string * @fw_dir: firmware directory configured by user via sysfs * @fw_logging: firmware logging configured by user via sysfs * @misc_flags: flags made from QBT_MISC_* bits defined above * @work_flags: flags made from QBT_WORK_* bits defined above * @dwork: delayed work to handle @work_flags * @md_ready: memdump functionality is ready * @md_state: devcoredump state as notified by the HCI devcoredump core * @md_submit_err: first error submitting to HCI devcoredump, 0 if none * @md_submit_size: total bytes submitted to HCI devcoredump, headers included * @md_pending_flags: QMD_FLAG_PENDING_* flags tracking per-subsystem memdump * @md: per-subsystem memdump collection track * @req_mutex: serializes sync requesters * @req_wait_q: wait queue for the requester * @req_spinlock: protects @req_state, @req, and @*req * @req_state: request state, see enum qhci_req_state * @req: the in-flight request, valid while @req_state is QHCI_REQ_PEND * @subsys: per-subsystem info for MSUBSYS chips */ struct btqcom_data { const char *drv_name; const char *btc_name; enum qbtc_category category; unsigned long flags; struct hci_dev *hdev; void *xport_data; bool inited; u16 board_id; struct qhci_btc_ver ver; char build_info[160]; const char *fw_dir; u8 fw_logging; unsigned long misc_flags; unsigned long work_flags; struct delayed_work dwork; bool md_ready; enum devcoredump_state md_state; int md_submit_err; u32 md_submit_size; unsigned long md_pending_flags; struct btqcom_memdump md; struct mutex req_mutex; wait_queue_head_t req_wait_q; spinlock_t req_spinlock; int req_state; struct qhci_req *req; struct qbtc_subsys_data subsys[QBTC_SUBSYS_MAX]; }; /* BT host ID in PERI command/event/ACL */ #define QHCI_HOST_ID_BT 0 struct qperi_command_hdr { u8 host_id; __le16 opcode; u8 plen; } __packed; #define QPERI_COMMAND_HDR_SIZE (sizeof(struct qperi_command_hdr)) struct qperi_acl_hdr { u8 host_id; __le16 handle; __le16 dlen; } __packed; #define QPERI_ACL_HDR_SIZE (sizeof(struct qperi_acl_hdr)) #define QPERI_MAX_FRAME_SIZE (HCI_MAX_FRAME_SIZE + 1) struct qperi_event_hdr { u8 host_id; u8 evt; u8 plen; } __packed; #define QPERI_EVENT_HDR_SIZE (sizeof(struct qperi_event_hdr)) #define QPERI_MAX_EVENT_SIZE (HCI_MAX_EVENT_SIZE + 1) static inline struct qperi_event_hdr *qperi_event_header(const struct sk_buff *skb) { return (struct qperi_event_hdr *)skb->data; } static inline struct qperi_acl_hdr *qperi_acl_header(const struct sk_buff *skb) { return (struct qperi_acl_hdr *)skb->data; } static inline __u16 qperi_acl_handle(const struct sk_buff *skb) { struct qperi_acl_hdr *hdr = qperi_acl_header(skb); return hci_handle(__le16_to_cpu(hdr->handle)); } static inline __u16 qperi_acl_dlen(const struct sk_buff *skb) { return __le16_to_cpu(qperi_acl_header(skb)->dlen); } static const char *qhci_pkt_type_name(u8 pkt_type) { const char *pkt_type_name = "Unknown"; switch (pkt_type) { case HCI_EVENT_PKT: pkt_type_name = "BT EVT"; break; case QPERI_EVENT_PKT: pkt_type_name = "PERI EVT"; break; case HCI_ACLDATA_PKT: pkt_type_name = "BT ACL"; break; case QPERI_ACLDATA_PKT: pkt_type_name = "PERI ACL"; break; default: break; } return pkt_type_name; } static void btusb_qcom_reset_sync(struct hci_dev *hdev); /* * ============================================================================ * Multi-subsys memdump design * ============================================================================ */ /* * Design compatible with BT-only BTC as well: * * Abbreviations: SS - Subsystem, MD - Memdump, HDR - Header * * +--------------+-------------+---------+ +-------------+---------+ * | file HDR | SS_A MD HDR | SS_A | ... | SS_N MD HDR | SS_N | * | 512B | 512B | MD data | | 512B | MD data | * | by dmp_hdr() | appended as | | | appended as | | * | | MD data | | | MD data | | * +--------------+-------------+---------+ +-------------+---------+ * * 1) All SS MDs are collected into a SINGLE file. * 2) Each SS_X MD HDR records the size of its own MD data. * 3) On the 1st segment of the 1st SS: call hci_devcd_init() with * dump_size — for a BT-only BTC, a 512B MD HDR plus the size carried * in the segment itself; for a multi-subsys BTC, the sum of (a 512B * MD HDR plus the max MD data size) over every SS. The file HDR is * not counted, since the HCI devcoredump adds it on top of dump_size. * 4) On the 1st segment of every SS: call hci_devcd_append() to append * its 512B MD HDR as ordinary MD data. * 5) On the last segment of a SS: call hci_devcd_complete() only if * no other SS's MD is still pending. * 6) On the hardware error event (either PERI or BT), which always * comes after all MDs have been reported by the BTC: call * hci_devcd_complete() there if it has not been called yet, since a * SS's MD is optional. */ static const u32 btqcom_memdump_maxsize[] = { [QHCI_SUBSYS_PERI] = SZ_256K, [QHCI_SUBSYS_BT] = SZ_1M, [QHCI_SUBSYS_UWB] = 0, [QHCI_SUBSYS_TMEL] = SZ_256K, [QHCI_SUBSYS_INVALID] = SZ_1M, }; /* * btqcom_memdump_hdr_room - helper to fill a memdump header up to 512 bytes * @skb: the devcoredump header skb to fill * * Return: bytes safe to write into @skb. */ static int btqcom_memdump_hdr_room(struct sk_buff *skb) { int end_marker_len = sizeof(HCI_DEVCD_HDR_END_MARKER) - 1; /* * don't use skb_tailroom(): observed to differ from requested * alloc_size - skb->len */ int avail_room = HCI_DEVCD_HDR_SIZE_MAX - skb->len; u8 *ptr; /* 1 char + '\n' at least */ if (avail_room >= end_marker_len + 2) return avail_room - end_marker_len; if (avail_room == end_marker_len) return 0; /* Avoid a blank line ('\n\n') in the header */ skb_trim(skb, HCI_DEVCD_HDR_SIZE_MAX - end_marker_len - 1); ptr = skb_tail_pointer(skb) - 1; if (*ptr == '\n') *ptr = ' '; skb_put_u8(skb, '\n'); return 0; } /* * btqcom_memdump_hdr - build the 512B memdump header * @hdev: the HCI device * @skb: the skb to build the header into * * Its 'Memdump Size' field is the size of the following payload. */ static void btqcom_memdump_hdr(struct hci_dev *hdev, struct sk_buff *skb) { struct btqcom_data *qbt_data = hci_get_priv(hdev); int avail_room = btqcom_memdump_hdr_room(skb); struct btqcom_memdump *md = &qbt_data->md; struct qbtc_subsys_data *subsys_data; char buf[HCI_DEVCD_HDR_SIZE_MAX]; struct qhci_btc_ver *btc_ver; const char *build_info; u16 board_id; int len = 0; if (!avail_room) return; len += scnprintf(buf + len, sizeof(buf) - len, "Header Type: memdump\n"); len += scnprintf(buf + len, sizeof(buf) - len, "Header Size: %d\n", HCI_DEVCD_HDR_SIZE_MAX); len += scnprintf(buf + len, sizeof(buf) - len, "Memdump Size: %u\n", md->size); len += scnprintf(buf + len, sizeof(buf) - len, "Channel: %s\n", qhci_pkt_type_name(md->from)); len += scnprintf(buf + len, sizeof(buf) - len, "Owner: %s\n", qhci_subsys_name(md->subsys)); switch (md->subsys) { case QHCI_SUBSYS_PERI: subsys_data = &qbt_data->subsys[QBTC_SUBSYS_PERI]; btc_ver = &subsys_data->ver; board_id = subsys_data->board_id; build_info = subsys_data->build_info; break; case QHCI_SUBSYS_TMEL: subsys_data = &qbt_data->subsys[QBTC_SUBSYS_TMEL]; btc_ver = &subsys_data->ver; board_id = subsys_data->board_id; build_info = subsys_data->build_info; break; default: btc_ver = &qbt_data->ver; board_id = qbt_data->board_id; build_info = qbt_data->build_info; break; } len += scnprintf(buf + len, sizeof(buf) - len, "SoC Version: 0x%08x\n", btc_ver->soc_ver); len += scnprintf(buf + len, sizeof(buf) - len, "ROM Version: 0x%04x\n", btc_ver->rom_ver); len += scnprintf(buf + len, sizeof(buf) - len, "Patch Version: 0x%04x\n", btc_ver->patch_ver); len += scnprintf(buf + len, sizeof(buf) - len, "Board ID: 0x%04x\n", board_id); len += scnprintf(buf + len, sizeof(buf) - len, "Firmware Version: %s\n", build_info); if (len > avail_room) { bt_dev_warn(hdev, "memdump header truncated (%d -> %d bytes)", len, avail_room); len = avail_room; if (buf[len - 2] == '\n') buf[len - 2] = ' '; buf[len - 1] = '\n'; } skb_put_data(skb, buf, len); } /* * btusb_qcom_memdump_hdr - build the 512B file header * @hdev: the HCI device * @skb: the skb to build the header into * * Implements the dmp_hdr_t for hci_devcd_register(). */ static void btusb_qcom_memdump_hdr(struct hci_dev *hdev, struct sk_buff *skb) { struct btusb_qcom *xport_data = btusb_qcom_xport_data(hdev); struct btqcom_data *qbt_data = hci_get_priv(hdev); char buf[HCI_DEVCD_HDR_SIZE_MAX]; const char *vendor = "Qualcomm"; int avail_room; int len = 0; avail_room = btqcom_memdump_hdr_room(skb); if (!avail_room) return; len += scnprintf(buf + len, sizeof(buf) - len, "Header Type: file\n"); len += scnprintf(buf + len, sizeof(buf) - len, "Header Size: %d\n", HCI_DEVCD_HDR_SIZE_MAX); len += scnprintf(buf + len, sizeof(buf) - len, "Driver: %s\n", qbt_data->drv_name); len += scnprintf(buf + len, sizeof(buf) - len, "Vendor: %s\n", vendor); len += scnprintf(buf + len, sizeof(buf) - len, "Controller Name: %s\n", qbt_data->btc_name); len += scnprintf(buf + len, sizeof(buf) - len, "Controller Category: %s\n", qbtc_category_name(qbt_data->category)); if (qbt_data->category == QBTC_CAT_MSUBSYS) { if (qbt_data->flags & QBT_FLAG_HAS_TMEL) len += scnprintf(buf + len, sizeof(buf) - len, "Controller Subsys: PERI, TME-L\n"); else len += scnprintf(buf + len, sizeof(buf) - len, "Controller Subsys: PERI\n"); } len += scnprintf(buf + len, sizeof(buf) - len, "VID: 0x%04x\n", xport_data->idVendor); len += scnprintf(buf + len, sizeof(buf) - len, "PID: 0x%04x\n", xport_data->idProduct); if (len > avail_room) bt_dev_warn(hdev, "dump header truncated (%d -> %d bytes)", len, avail_room); memset(buf + len, 'P', sizeof(buf) - len); /* * Deliberately overfill to skb's full 512 bytes, then leverage * btqcom_memdump_hdr_room() to trim it back to the expected boundary. */ skb_put_data(skb, buf, HCI_DEVCD_HDR_SIZE_MAX - skb->len); btqcom_memdump_hdr_room(skb); } /* Used as the notify_change_t callback for hci_devcd_register(). */ static void btusb_qcom_notify_memdump(struct hci_dev *hdev, int state) { struct btusb_qcom *xport_data = btusb_qcom_xport_data(hdev); struct btqcom_data *qbt_data = hci_get_priv(hdev); enum devcoredump_state old_state; old_state = qbt_data->md_state; bt_dev_dbg(hdev, "memdump notify state: %s -> %s", hci_devcd_state_name(old_state), hci_devcd_state_name(state)); bt_dev_dbg(hdev, "misc_flags: 0x%lx", READ_ONCE(qbt_data->misc_flags)); bt_dev_dbg(hdev, "md_pending_flags: 0x%lx, md_submit_err: %d", READ_ONCE(qbt_data->md_pending_flags), READ_ONCE(qbt_data->md_submit_err)); switch (state) { case HCI_DEVCOREDUMP_IDLE: break; case HCI_DEVCOREDUMP_ACTIVE: usb_autopm_get_interface_no_resume(xport_data->intf); bt_dev_dbg(hdev, "memdump notify: get autopm refcount"); break; case HCI_DEVCOREDUMP_TIMEOUT: bt_dev_err(hdev, "memdump notify: %s", hci_devcd_state_name(state)); qbt_data->md_submit_err = -ETIMEDOUT; qbt_data->md_pending_flags = 0; test_and_clear_bit(QBT_MISC_MEMDUMP_INCOMING, &qbt_data->misc_flags); fallthrough; case HCI_DEVCOREDUMP_DONE: case HCI_DEVCOREDUMP_ABORT: usb_autopm_put_interface_no_suspend(xport_data->intf); bt_dev_dbg(hdev, "memdump notify: put autopm refcount"); break; } qbt_data->md_state = state; if (state == HCI_DEVCOREDUMP_TIMEOUT) btusb_qcom_reset_sync(hdev); } /* handle received memdump frame here */ static inline void btqcom_reset_memdump(struct btqcom_memdump *md) { memset(md, 0x00, sizeof(*md)); md->subsys = QHCI_SUBSYS_INVALID; } /* * btqcom_submit_memdump - submit one memdump segment to HCI devcoredump * @hdev: the HCI device the memdump comes from * @skb: the memdump segment payload * * See the "Multi-subsys memdump design" block above for the overall scheme * this implements. * * Return: 0 on success, * 1 if the memdump ended normally, * a negative errno on failure. */ static int btqcom_submit_memdump(struct hci_dev *hdev, struct sk_buff *skb) { struct btqcom_data *qbt_data = hci_get_priv(hdev); struct btqcom_memdump *md = &qbt_data->md; unsigned int dump_size, seg_len; bool is_first_subsys = false; int ret = 0; dump_size = 0; seg_len = skb->len; if (md->seqno == 0) { if (!test_and_set_bit(QBT_MISC_MEMDUMP_INCOMING, &qbt_data->misc_flags)) { /* wake the waiter in btusb_do_cmd_timeout_work() */ wake_up_var(&qbt_data->misc_flags); is_first_subsys = true; qbt_data->md_submit_err = 0; qbt_data->md_submit_size = 0; if (qbt_data->category == QBTC_CAT_MSUBSYS) { qbt_data->md_pending_flags = QMD_FLAG_PENDING_BT | QMD_FLAG_PENDING_PERI; dump_size = HCI_DEVCD_HDR_SIZE_MAX + btqcom_memdump_maxsize[QHCI_SUBSYS_BT] + HCI_DEVCD_HDR_SIZE_MAX + btqcom_memdump_maxsize[QHCI_SUBSYS_PERI]; if (qbt_data->flags & QBT_FLAG_HAS_TMEL) { qbt_data->md_pending_flags |= QMD_FLAG_PENDING_TMEL; dump_size += HCI_DEVCD_HDR_SIZE_MAX + btqcom_memdump_maxsize[QHCI_SUBSYS_TMEL]; } } else { qbt_data->md_pending_flags = QMD_FLAG_PENDING_BT; dump_size = HCI_DEVCD_HDR_SIZE_MAX + md->size; } } bt_dev_info(hdev, "%s memdump incoming: %u bytes", qhci_subsys_name(md->subsys), md->size); bt_dev_dbg(hdev, "md_pending_flags: 0x%lx", qbt_data->md_pending_flags); if (is_first_subsys) { ret = hci_devcd_init(hdev, dump_size); if (ret) { kfree_skb(skb); bt_dev_err(hdev, "init memdump failed: %pe", ERR_PTR(ret)); return ret; } qbt_data->md_submit_size += HCI_DEVCD_HDR_SIZE_MAX; bt_dev_info(hdev, "file header: %u bytes", HCI_DEVCD_HDR_SIZE_MAX); } if (!qbt_data->md_submit_err) { struct sk_buff *hdr_skb; hdr_skb = alloc_skb(HCI_DEVCD_HDR_SIZE_MAX, GFP_KERNEL); if (hdr_skb) { btqcom_memdump_hdr(hdev, hdr_skb); if (hdr_skb->len < HCI_DEVCD_HDR_SIZE_MAX) skb_put_zero(hdr_skb, HCI_DEVCD_HDR_SIZE_MAX - hdr_skb->len); ret = hci_devcd_append(hdev, hdr_skb); } else { ret = -ENOMEM; } if (ret) { hci_devcd_abort(hdev); kfree_skb(skb); bt_dev_err(hdev, "append memdump header failed: %pe", ERR_PTR(ret)); return ret; } qbt_data->md_submit_size += HCI_DEVCD_HDR_SIZE_MAX; bt_dev_info(hdev, "%s memdump header appended: %u bytes", qhci_subsys_name(md->subsys), HCI_DEVCD_HDR_SIZE_MAX); } } ret = qbt_data->md_submit_err; if (ret) { kfree_skb(skb); } else { ret = hci_devcd_append(hdev, skb); if (unlikely(ret)) { hci_devcd_abort(hdev); bt_dev_err(hdev, "append memdump failed: %pe", ERR_PTR(ret)); } else { md->submit_size += seg_len; qbt_data->md_submit_size += seg_len; } } if (md->seqno != QHCI_MEMDUMP_SEQ_LAST) return ret; if (md->submit_size == md->size) bt_dev_info(hdev, "%s memdump fully collected", qhci_subsys_name(md->subsys)); else bt_dev_err(hdev, "%s memdump partially collected %u/%u bytes", qhci_subsys_name(md->subsys), md->submit_size, md->size); qbt_data->md_pending_flags &= ~qmd_subsys_to_flag(md->subsys); if (qbt_data->md_pending_flags) { bt_dev_dbg(hdev, "md_pending_flags: 0x%lx", qbt_data->md_pending_flags); return ret; } if (test_and_clear_bit(QBT_MISC_MEMDUMP_INCOMING, &qbt_data->misc_flags)) bt_dev_dbg(hdev, "clear MEMDUMP_INCOMING on memdump completion"); if (ret) { bt_dev_err(hdev, "memdump complete failed: %pe", ERR_PTR(ret)); return ret; } ret = hci_devcd_complete(hdev); if (ret) { hci_devcd_abort(hdev); bt_dev_err(hdev, "memdump complete failed: %pe", ERR_PTR(ret)); } else { ret = 1; bt_dev_info(hdev, "memdump completed: %u bytes", qbt_data->md_submit_size); } return ret; } /* * btqcom_handle_memdump - handle one memdump segment * @hdev: the HCI device the @skb comes from * @skb: the memdump segment to handle * * Return: 0 on success, * 1 if the memdump ended normally, * a negative errno on failure. */ static int btqcom_handle_memdump(struct hci_dev *hdev, struct sk_buff *skb) { struct btqcom_data *qbt_data = hci_get_priv(hdev); struct btqcom_memdump *md = &qbt_data->md; const struct qhci_vse_memdump *md_vse; u8 pkt_type = hci_skb_pkt_type(skb); int subsys = QHCI_SUBSYS_INVALID; u16 seq_no = 0; u32 dump_size; int ret = 0; md_vse = skb_pull_data(skb, offsetof(struct qhci_vse_memdump, segdata)); if (!md_vse) { ret = -EMSGSIZE; bt_dev_err(hdev, "bad memdump segment: too short (%u bytes)", skb->len); goto out_abort_md; } if (pkt_type == QPERI_EVENT_PKT || pkt_type == QPERI_ACLDATA_PKT) { subsys = md_vse->subsys; if (subsys >= QHCI_SUBSYS_MAX || !btqcom_memdump_maxsize[subsys] || (subsys == QHCI_SUBSYS_TMEL && !(qbt_data->flags & QBT_FLAG_HAS_TMEL))) { kfree_skb(skb); bt_dev_warn_ratelimited(hdev, "drop memdump of unsupported subsys %d", subsys); return 0; } } seq_no = le16_to_cpu(md_vse->seqno); if (seq_no == 0) { set_bit(qmd_subsys_to_bit(subsys), &qbt_data->misc_flags); if (!skb_pull(skb, QHCI_MEMDUMP_SEGDATA_GAP)) { ret = -EMSGSIZE; bt_dev_err(hdev, "bad first %s memdump segment: too short for dump_size", qhci_subsys_name(subsys)); goto out_abort_md; } dump_size = le32_to_cpu(md_vse->dump_size); if (!dump_size || dump_size > btqcom_memdump_maxsize[subsys]) { ret = -EILSEQ; bt_dev_err(hdev, "wrong %s memdump dump_size: %u", qhci_subsys_name(subsys), dump_size); goto out_abort_md; } btqcom_reset_memdump(md); md->from = pkt_type; md->subsys = subsys; md->size = dump_size; } else { if (md->subsys != subsys) { ret = -EILSEQ; bt_dev_err_ratelimited(hdev, "wrong memdump subsys: expected(%d), coming(%d)", md->subsys, subsys); goto out_abort_md; } if (seq_no == QHCI_MEMDUMP_SEQ_LAST) { md->seqno = QHCI_MEMDUMP_SEQ_LAST; } else if (seq_no != md->seqno) { ret = -EILSEQ; bt_dev_err_ratelimited(hdev, "wrong memdump seqno: expected(%u), coming(%u)", md->seqno, seq_no); goto out_abort_md; } } /* @skb is consumed here */ ret = btqcom_submit_memdump(hdev, skb); if (seq_no != QHCI_MEMDUMP_SEQ_LAST) md->seqno = seq_no + 1; goto out_reset_md; out_abort_md: kfree_skb(skb); if (qbt_data->md_pending_flags && !qbt_data->md_submit_err) { hci_devcd_abort(hdev); bt_dev_err(hdev, "abort memdump"); } out_reset_md: if (ret < 0 && !qbt_data->md_submit_err) qbt_data->md_submit_err = ret; if (seq_no == QHCI_MEMDUMP_SEQ_LAST) btqcom_reset_memdump(md); return ret; } /* * ============================================================================ * BT-HCI vendor-specific command/response * ============================================================================ */ /* reserved BT ACL handle for enhanced logging */ #define QBT_HANDLE_ENHANCED_LOGGING 0xEDC /* reserved BT ACL handle for memdump */ #define QBT_HANDLE_MEMDUMP 0xEDD /* * Unless otherwise noted, for the VSCs below: * - command payload: struct qhci_cp_simple * - response payload: struct qhci_rp_generic * * Grouped by { opcode, sub_opcode, cp, rp }. */ /* BT EDL opcode and its sub-opcodes */ #define QBT_OP_EDL 0xFC00 #define BEDL_PATCH_GETVER 0x19 struct qbt_rp_patch_getver { u8 status; u8 sub_opcode; u8 dlen; __le32 product_id; __le16 patch_ver; __le16 rom_ver; __le32 soc_ver; } __packed; #define BEDL_GET_BUILD_INFO 0x20 struct qbt_rp_get_build_info { u8 status; u8 sub_opcode; u8 dlen; u8 data[]; } __packed; #define BEDL_GET_BOARD_ID 0x23 struct qbt_rp_get_board_id { u8 status; u8 sub_opcode; u8 dlen; __be16 board_id; } __packed; /* BT DEBUG opcode and its sub-opcodes */ #define QBT_OP_DEBUG 0xFC0C #define BDBG_ERROR_FATAL_CMD 0x26 /* no response */ /* BT write BD_ADDR opcode, no sub-opcode */ #define QBT_OP_WRITE_BD_ADDR 0xFC14 struct qbt_cp_write_bd_addr { bdaddr_t bdaddr; } __packed; /* BT firmware logging opcode and its sub-opcodes */ #define QBT_OP_HOST_LOG 0xFC17 #define BHL_ENH_ENABLE_LOG 0x14 struct qbt_cp_config_fw_logging { u8 sub_opcode; u8 flags; } __packed; /* * QBT_CHECK_RP_GENERIC - sanity check rp @_skb against type @_rp_type * @_skb: the rp to check * @_rp_type: the type to interpret @_skb as * @_sub_opcode: sub_opcode to check @_skb against * * It is safe to evaluate @_skb and @_sub_opcode more than once for its * usages. * * To simplify logic, @_skb's length is checked first to keep later field * accesses safe. * * Returns a negative errno on failure, 0 on success, or error status code * otherwise. */ #define QBT_CHECK_RP_GENERIC(_skb, _rp_type, _sub_opcode) \ ({ \ _rp_type *_rp_ptr; \ int _err = 0; \ do { \ if ((_skb)->len < sizeof(_rp_type)) { \ _err = -EBADMSG; \ break; \ } \ _rp_ptr = (void *)(_skb)->data; \ if (_rp_ptr->sub_opcode != (_sub_opcode)) { \ _err = -EILSEQ; \ break; \ } \ if (_rp_ptr->status) { \ _err = _rp_ptr->status; \ break; \ } \ } while (0); \ _err; \ }) /* check the @dlen field on top of QBT_CHECK_RP_GENERIC() */ #define QBT_CHECK_RP_DLEN(_skb, _rp_type, _sub_opcode) \ ({ \ _rp_type *_rp_ptr; \ int _err = 0; \ do { \ _err = QBT_CHECK_RP_GENERIC(_skb, _rp_type, _sub_opcode);\ if (_err) \ break; \ _rp_ptr = (void *)(_skb)->data; \ if ((_skb)->len != offsetofend(_rp_type, dlen) + \ _rp_ptr->dlen) { \ _err = -EMSGSIZE; \ break; \ } \ } while (0); \ _err; \ }) /* * qbt_edl_patch_getver - read BTC version info * @hdev: the HCI device to query * @ver: output version info, filled on success * * Return: 0 on success, or a negative errno on failure. */ static int qbt_edl_patch_getver(struct hci_dev *hdev, struct qhci_btc_ver *ver) { const struct qhci_cp_simple cp = { .sub_opcode = BEDL_PATCH_GETVER }; struct qbt_rp_patch_getver *rp; struct sk_buff *skb; int err; skb = __hci_cmd_sync_ev(hdev, QBT_OP_EDL, sizeof(cp), &cp, 0, HCI_INIT_TIMEOUT); if (IS_ERR(skb)) { err = PTR_ERR(skb); goto out; } err = QBT_CHECK_RP_DLEN(skb, struct qbt_rp_patch_getver, cp.sub_opcode); if (err) goto out_free_skb; rp = (void *)skb->data; ver->product_id = le32_to_cpu(rp->product_id); ver->soc_ver = le32_to_cpu(rp->soc_ver); ver->rom_ver = le16_to_cpu(rp->rom_ver); ver->patch_ver = le16_to_cpu(rp->patch_ver); bt_dev_dbg(hdev, "Product ID :0x%08x", ver->product_id); bt_dev_dbg(hdev, "SOC Version :0x%08x", ver->soc_ver); bt_dev_dbg(hdev, "ROM Version :0x%04x", ver->rom_ver); bt_dev_dbg(hdev, "Patch Version:0x%04x", ver->patch_ver); if (ver->soc_ver == 0 || ver->rom_ver == 0) err = -EILSEQ; out_free_skb: kfree_skb(skb); if (err > 0) { bt_dev_dbg(hdev, "get BT version status error: 0x%02x", err); err = -bt_to_errno(err); } out: if (err) bt_dev_err(hdev, "get BT version failed: %pe", ERR_PTR(err)); return err; } /* * qbt_edl_get_build_info - get BTC build info string * @hdev: the HCI device to query * @build_info: output build info string, allocated on success; caller frees * * Return: 0 on success, or a negative errno on failure. */ static int qbt_edl_get_build_info(struct hci_dev *hdev, char **build_info) { const struct qhci_cp_simple cp = { .sub_opcode = BEDL_GET_BUILD_INFO }; struct qbt_rp_get_build_info *rp; struct sk_buff *skb; int err; skb = __hci_cmd_sync_ev(hdev, QBT_OP_EDL, sizeof(cp), &cp, 0, HCI_INIT_TIMEOUT); if (IS_ERR(skb)) { err = PTR_ERR(skb); goto out; } err = QBT_CHECK_RP_DLEN(skb, struct qbt_rp_get_build_info, cp.sub_opcode); if (err) goto out_free_skb; rp = (void *)skb->data; *build_info = kmemdup_nul(rp->data, rp->dlen, GFP_KERNEL); if (!*build_info) { err = -ENOMEM; goto out_free_skb; } bt_dev_dbg(hdev, "BT build info: %s", *build_info); out_free_skb: kfree_skb(skb); if (err > 0) { bt_dev_err(hdev, "get BT build info status error: 0x%02x", err); err = -bt_to_errno(err); } out: if (err) bt_dev_err(hdev, "get BT build info failed: %pe", ERR_PTR(err)); return err; } /* * qbt_edl_get_board_id - get BTC board ID * @hdev: the HCI device to query * @board_id: output board ID, filled on success * * Return: 0 on success, or a negative errno on failure. */ static int qbt_edl_get_board_id(struct hci_dev *hdev, u16 *board_id) { const struct qhci_cp_simple cp = { .sub_opcode = BEDL_GET_BOARD_ID }; struct qbt_rp_get_board_id *rp; struct sk_buff *skb; int err; skb = __hci_cmd_sync_ev(hdev, QBT_OP_EDL, sizeof(cp), &cp, 0, HCI_INIT_TIMEOUT); if (IS_ERR(skb)) { err = PTR_ERR(skb); goto out; } err = QBT_CHECK_RP_DLEN(skb, struct qbt_rp_get_board_id, cp.sub_opcode); if (err) goto out_free_skb; rp = (void *)skb->data; *board_id = be16_to_cpu(rp->board_id); /* Take 0xffff as invalid board ID */ if (*board_id == 0xffff) *board_id = 0; bt_dev_dbg(hdev, "BT Board ID: 0x%04x", *board_id); out_free_skb: kfree_skb(skb); if (err > 0) { bt_dev_dbg(hdev, "get BT board ID status error: 0x%02x", err); err = -bt_to_errno(err); } out: if (err) bt_dev_err(hdev, "get BT board ID failed: %pe", ERR_PTR(err)); return err; } /* * qbt_error_fatal_cmd - trigger a controller-side fatal error for debugging * @hdev: the HCI device to command * * Return: 0 on success, or a negative errno on failure. */ static int qbt_error_fatal_cmd(struct hci_dev *hdev) { const struct qhci_cp_simple cp = { .sub_opcode = BDBG_ERROR_FATAL_CMD }; int err; err = __hci_cmd_send(hdev, QBT_OP_DEBUG, sizeof(cp), &cp); if (err < 0) bt_dev_err(hdev, "send error fatal cmd failed: %d", err); else bt_dev_info(hdev, "send error fatal cmd succeeded"); return err; } /* * qbt_write_bda - set the controller's BD address * @hdev: the HCI device to configure * @bdaddr: the address to set * * Return: 0 on success, or a negative errno on failure. */ static int qbt_write_bda(struct hci_dev *hdev, const bdaddr_t *bdaddr) { struct qbt_cp_write_bd_addr cp; int err; /* The controller expects the address in reversed byte order. */ baswap(&cp.bdaddr, bdaddr); err = __hci_cmd_sync_status(hdev, QBT_OP_WRITE_BD_ADDR, sizeof(cp), &cp, HCI_INIT_TIMEOUT); if (err < 0) { bt_dev_err(hdev, "set BT address failed: %pe", ERR_PTR(err)); return err; } if (err > 0) { bt_dev_err(hdev, "set BT address status error: 0x%02x", err); return -bt_to_errno(err); } bt_dev_info(hdev, "BT address set to %pMR", bdaddr); return 0; } /* * qbt_config_fw_logging - configure enhanced firmware logging * @hdev: the HCI device to configure * @flags: logging configuration flags, normally 1 (enable) or 0 (disable) * * Return: 0 on success, or a negative errno on failure. */ static int qbt_config_fw_logging(struct hci_dev *hdev, u8 flags) { const struct qbt_cp_config_fw_logging cp = { .sub_opcode = BHL_ENH_ENABLE_LOG, .flags = flags, }; struct sk_buff *skb; int err; skb = __hci_cmd_sync_ev(hdev, QBT_OP_HOST_LOG, sizeof(cp), &cp, 0, HCI_INIT_TIMEOUT); if (IS_ERR(skb)) { err = PTR_ERR(skb); goto out; } err = QBT_CHECK_RP_GENERIC(skb, struct qhci_rp_generic, cp.sub_opcode); if (err) goto out_free_skb; bt_dev_dbg(hdev, "firmware logging configured (flags=0x%02x)", flags); out_free_skb: kfree_skb(skb); if (err > 0) { bt_dev_dbg(hdev, "firmware logging config status error: 0x%02x", err); err = -bt_to_errno(err); } out: if (err) bt_dev_err(hdev, "firmware logging config failed: %pe", ERR_PTR(err)); return err; } /* * ============================================================================ * qperi_handle_evt(): per-event handler and TX sync event sequence * ============================================================================ */ #define QPERI_EV_CLASS_PERI 0xF0 #define QPERI_EV_TYPE_INVALID 0xff /* Pass QPERI_EV_TYPE_INVALID as event if no events to sync */ #define DEFINE_QPERI_REQ_SPEC(specname, _opcode, _sub_opcode, _events...) \ const struct qhci_req_spec specname = { \ .opcode = (_opcode), \ .sub_opcode = (_sub_opcode), \ .event = { _events, QPERI_EV_TYPE_INVALID }, \ } /* * struct qperi_evt - per-event helper for qperi_handle_evt() * * @handler: event handler, executed before the TX sync event check. * Return: true if @skb was consumed, false otherwise. * * @verify_wakeup: extra verify if @skb belongs to the event sequence being synced. * * Pull @skb empty if all its own checks pass and nothing is left for the * requester to verify, and the requester will get NULL as response, e.g. a * CSE, or a CCE whose payload has only status, or only status and * sub_opcode. * * Return: 0 if @skb doesn't belong, 1 if it does, or a negative errno if * @skb is malformed. */ struct qperi_evt { bool (*handler)(struct hci_dev *hdev, struct sk_buff *skb); int (*verify_wakeup)(struct hci_dev *hdev, struct qhci_req *req, struct sk_buff *skb); }; #define PERI_EV_CMD_STATUS 0x00 struct peri_ev_cmd_status { u8 status; u8 ncmd; __le16 opcode; } __packed; #define PERI_EV_CMD_COMPLETE 0x01 struct peri_ev_cmd_complete { u8 ncmd; __le16 opcode; } __packed; #define PERI_EV_SUBSYS_ACTIVATE_COMPLETE 0x02 struct peri_ev_subsys_activate_complete { u8 subsys; u8 action; } __packed; #define PERI_EV_SUBSYS_PATCH_NOTIFICATION 0x03 struct peri_ev_subsys_patch_notification { u8 status; u8 subsys; } __packed; #define PERI_EV_CRASH_DUMP_MEMDUMP 0x04 /* struct qhci_vse_memdump */ #define PERI_EV_HARDWARE_ERROR 0x06 struct peri_ev_hardware_error { u8 code; } __packed; /* As qperi_evt::verify_wakeup() for PERI_EV_CMD_STATUS */ static int peri_verify_cmd_status(struct hci_dev *hdev __maybe_unused, struct qhci_req *req, struct sk_buff *skb) { const struct peri_ev_cmd_status *ev; if (skb->len != sizeof(*ev)) return -EMSGSIZE; ev = (const void *)skb->data; if (le16_to_cpu(ev->opcode) != req->spec->opcode) return 0; req->req_result = ev->status; if (!req->req_result) skb_pull(skb, sizeof(*ev)); return 1; } /* CCE rp payload: [0] status, [1] sub_opcode if present, then rp-specific data if any */ static int peri_verify_rp_payload(struct hci_dev *hdev __maybe_unused, struct qhci_req *req, struct sk_buff *skb) { if (!skb->len) return -EMSGSIZE; if (req->spec->sub_opcode != QHCI_SUB_OPCODE_INVALID) { if (skb->len < 2) return -EMSGSIZE; if (skb->data[1] != req->spec->sub_opcode) return 0; } req->req_result = skb->data[0]; if (!req->req_result && skb->len <= 2) skb_pull(skb, skb->len); return 1; } /* As qperi_evt::verify_wakeup() for PERI_EV_CMD_COMPLETE */ static int peri_verify_cmd_complete(struct hci_dev *hdev, struct qhci_req *req, struct sk_buff *skb) { const struct peri_ev_cmd_complete *ev; u16 opcode; ev = skb_pull_data(skb, sizeof(*ev)); if (!ev) return -EMSGSIZE; opcode = le16_to_cpu(ev->opcode); if (opcode != req->spec->opcode) return 0; hci_skb_opcode(skb) = opcode; return peri_verify_rp_payload(hdev, req, skb); } /* As qperi_evt::verify_wakeup() for PERI_EV_SUBSYS_ACTIVATE_COMPLETE */ static int peri_verify_subsys_activate_complete(struct hci_dev *hdev __maybe_unused, struct qhci_req *req __maybe_unused, struct sk_buff *skb) { if (skb->len != sizeof(struct peri_ev_subsys_activate_complete)) return -EMSGSIZE; return 1; } /* As qperi_evt::verify_wakeup() for PERI_EV_SUBSYS_PATCH_NOTIFICATION */ static int peri_verify_subsys_patch_notification(struct hci_dev *hdev __maybe_unused, struct qhci_req *req, struct sk_buff *skb) { const struct peri_ev_subsys_patch_notification *ev; if (skb->len != sizeof(*ev)) return -EMSGSIZE; ev = (const void *)skb->data; req->req_result = ev->status; return 1; } /* As qperi_evt::handler() for PERI_EV_CRASH_DUMP_MEMDUMP */ static bool peri_crash_dump_memdump(struct hci_dev *hdev, struct sk_buff *skb) { btqcom_handle_memdump(hdev, skb); return true; } /* As qperi_evt::handler() for PERI_EV_HARDWARE_ERROR */ static bool peri_hardware_error(struct hci_dev *hdev, struct sk_buff *skb) { struct btqcom_data *qbt_data = hci_get_priv(hdev); const struct peri_ev_hardware_error *ev; u8 code = HCI_ERROR_UNSPECIFIED; ev = skb_pull_data(skb, sizeof(*ev)); if (ev) code = ev->code; else bt_dev_err(hdev, "malformed PERI hardware error event"); set_bit(QBT_MISC_HWERR_PERI, &qbt_data->misc_flags); __hci_reset_dev(hdev, code); return false; } static const struct qperi_evt qperi_evt_table[] = { /* [0x00 = PERI_EV_CMD_STATUS] */ [PERI_EV_CMD_STATUS] = { .verify_wakeup = peri_verify_cmd_status, }, /* [0x01 = PERI_EV_CMD_COMPLETE] */ [PERI_EV_CMD_COMPLETE] = { .verify_wakeup = peri_verify_cmd_complete, }, /* [0x02 = PERI_EV_SUBSYS_ACTIVATE_COMPLETE] */ [PERI_EV_SUBSYS_ACTIVATE_COMPLETE] = { .verify_wakeup = peri_verify_subsys_activate_complete, }, /* [0x03 = PERI_EV_SUBSYS_PATCH_NOTIFICATION] */ [PERI_EV_SUBSYS_PATCH_NOTIFICATION] = { .verify_wakeup = peri_verify_subsys_patch_notification, }, /* [0x04 = PERI_EV_CRASH_DUMP_MEMDUMP] */ [PERI_EV_CRASH_DUMP_MEMDUMP] = { .handler = peri_crash_dump_memdump, }, /* [0x06 = PERI_EV_HARDWARE_ERROR] */ [PERI_EV_HARDWARE_ERROR] = { .handler = peri_hardware_error, }, }; /* * qperi_try_wakeup - check if event @skb with type @ev_type can wake up the requester * @hdev: the HCI device the event comes from * @ev_type: the event type * @skb: the event payload, or NULL on skb clone failure * * Note: the caller only cares about the return value rather than the wakeup result. * * Return: true if @skb was consumed, false otherwise. */ static bool qperi_try_wakeup(struct hci_dev *hdev, u8 ev_type, struct sk_buff *skb) { const struct qperi_evt *evt = &qperi_evt_table[ev_type]; struct btqcom_data *qbt_data = hci_get_priv(hdev); struct sk_buff *req_rsp = skb; struct qhci_req *req; int res; /* fast path */ if (READ_ONCE(qbt_data->req_state) != QHCI_REQ_PEND) return false; guard(spinlock)(&qbt_data->req_spinlock); if (qbt_data->req_state != QHCI_REQ_PEND) return false; req = qbt_data->req; if (WARN_ON_ONCE(!req) || WARN_ON_ONCE(!req->spec)) return false; if (req->spec->event[req->event_idx] != ev_type) return false; /* skb clone failure */ if (!skb) { req->req_result = -ENOMEM; goto out_wakeup; } /* malformed frame */ if (!skb->len) { req->req_result = -EMSGSIZE; goto out_wakeup; } req->req_result = 0; if (evt->verify_wakeup) { res = evt->verify_wakeup(hdev, req, skb); if (!res) return false; if (res < 0) { req->req_result = res; goto out_wakeup; } /* HCI status error */ if (req->req_result) goto out_wakeup; /* nothing left for the requester to verify */ if (!req_rsp->len) req_rsp = NULL; } if (req->spec->event[req->event_idx + 1] != QPERI_EV_TYPE_INVALID) { req->event_idx++; return false; } out_wakeup: if (req->req_result < 0) req_rsp = NULL; req->req_rsp = req_rsp; if (req->req_result) bt_dev_err(hdev, "PERI cmd opcode(0x%04x) sub_opcode(0x%02x) failed on ev_type(0x%02x): %d", req->spec->opcode, req->spec->sub_opcode, ev_type, req->req_result); qbt_data->req_state = QHCI_REQ_DONE; wake_up_interruptible(&qbt_data->req_wait_q); /* test if the requester now owns @skb */ return req_rsp == skb; } /* * __qperi_tx_sync_evt - send a frame and sync its event sequence * @hdev: the HCI device * @iter: the frame to send, NULL to sync only * @spec: the request spec to sync, NULL to send only * @timeout: timeout in jiffies for the sync * @evt_idx: index of the waking event * @status: HCI status code if it has one, 0 otherwise * * Requires the caller holds qbt_data->req_mutex. * * Return: ERR_PTR() on failure, * NULL on success for send-only or nothing left for the caller to verify, * the waking event otherwise. */ static struct sk_buff *__qperi_tx_sync_evt(struct hci_dev *hdev, struct iov_iter *iter, const struct qhci_req_spec *spec, unsigned int timeout, u8 *evt_idx, u8 *status) { struct qhci_req req = { .pkt_type = QPERI_EVENT_PKT, .spec = spec }; struct btqcom_data *qbt_data = hci_get_priv(hdev); struct sk_buff *ret = NULL; int res = 0, wait_res = 0; int req_state; if (!iter && !spec) return ERR_PTR(-EINVAL); /* send only, no event to sync */ if (!spec) { res = hci_send_vendor_frame(hdev, iter); if (res < 0) { bt_dev_err(hdev, "send-only PERI frame failed: %pe", ERR_PTR(res)); return ERR_PTR(res); } return NULL; } scoped_guard(spinlock, &qbt_data->req_spinlock) { qbt_data->req = &req; qbt_data->req_state = QHCI_REQ_PEND; } if (iter) res = hci_send_vendor_frame(hdev, iter); if (!res) wait_res = wait_event_interruptible_timeout(qbt_data->req_wait_q, READ_ONCE(qbt_data->req_state) != QHCI_REQ_PEND, timeout); scoped_guard(spinlock, &qbt_data->req_spinlock) { req_state = qbt_data->req_state; qbt_data->req = NULL; qbt_data->req_state = QHCI_REQ_DONE; } if (res >= 0) { switch (req_state) { case QHCI_REQ_DONE: res = req.req_result; break; case QHCI_REQ_CANCELED: if (req.req_result < 0) bt_dev_info(hdev, "PERI cmd opcode(0x%04x) sub_opcode(0x%02x) canceled: %pe", spec->opcode, spec->sub_opcode, ERR_PTR(req.req_result)); else bt_dev_info(hdev, "PERI cmd opcode(0x%04x) sub_opcode(0x%02x) canceled", spec->opcode, spec->sub_opcode); res = req.req_result < 0 ? req.req_result : -ECANCELED; break; case QHCI_REQ_PEND: default: res = wait_res < 0 ? -EINTR : -ETIMEDOUT; break; } } ret = req.req_rsp; if (res < 0) { /* log unless qperi_try_wakeup() already did */ if (res != req.req_result) bt_dev_err(hdev, "PERI cmd opcode(0x%04x) sub_opcode(0x%02x) failed: %pe", spec->opcode, spec->sub_opcode, ERR_PTR(res)); if (WARN_ON_ONCE(req.req_rsp)) kfree_skb(req.req_rsp); ret = ERR_PTR(res); } if (evt_idx) *evt_idx = req.event_idx; if (status) *status = (u8)req.req_result; return ret; } /* synchronously cancel pending request with error code @err */ static void qperi_tx_sync_cancel_sync(struct hci_dev *hdev, int err) { struct btqcom_data *qbt_data = hci_get_priv(hdev); struct qhci_req *req; guard(spinlock)(&qbt_data->req_spinlock); if (qbt_data->req_state != QHCI_REQ_PEND) return; req = qbt_data->req; if (WARN_ON_ONCE(!req)) return; req->req_result = err; qbt_data->req = NULL; qbt_data->req_state = QHCI_REQ_CANCELED; wake_up_interruptible(&qbt_data->req_wait_q); } /* * __qperi_cmd_sync_evt - send a command and sync its event sequence * @hdev: the HCI device * @opcode: command opcode, QHCI_OPCODE_INVALID to sync only * @plen: length of @cp * @cp: the command payload * @spec: the request spec to sync, NULL to send only * @evt_idx: index of the waking event * @status: HCI status code if it has one, 0 otherwise * * Requires the caller holds qbt_data->req_mutex. * * Return: ERR_PTR() on failure, * NULL on success for send-only or nothing left for the caller to verify, * the waking event otherwise. */ static struct sk_buff *__qperi_cmd_sync_evt(struct hci_dev *hdev, u16 opcode, u32 plen, const void *cp, const struct qhci_req_spec *spec, u8 *evt_idx, u8 *status) { u8 pkt_type = QPERI_COMMAND_PKT; struct qperi_command_hdr cmd_hdr = { .host_id = QHCI_HOST_ID_BT, .opcode = cpu_to_le16(opcode), .plen = (u8)plen, }; struct kvec cmd_kv[] = { { .iov_base = &pkt_type, .iov_len = 1 }, { .iov_base = &cmd_hdr, .iov_len = sizeof(cmd_hdr) }, { .iov_base = (void *)cp, .iov_len = plen }, }; struct iov_iter iter; /* no command to send, sync only */ if (opcode == QHCI_OPCODE_INVALID) return __qperi_tx_sync_evt(hdev, NULL, spec, HCI_INIT_TIMEOUT, evt_idx, status); iov_iter_kvec(&iter, ITER_SOURCE, cmd_kv, plen ? 3 : 2, 1 + sizeof(cmd_hdr) + plen); return __qperi_tx_sync_evt(hdev, &iter, spec, HCI_INIT_TIMEOUT, evt_idx, status); } static inline struct sk_buff *qperi_cmd_sync_evt(struct hci_dev *hdev, u16 opcode, u32 plen, const void *cp, const struct qhci_req_spec *spec, u8 *evt_idx, u8 *status) { struct btqcom_data *qbt_data = hci_get_priv(hdev); guard(mutex)(&qbt_data->req_mutex); return __qperi_cmd_sync_evt(hdev, opcode, plen, cp, spec, evt_idx, status); } /* * send a command and sync an event with type @ev_type; * @cp's first byte is sub_opcode for all commands so far * * Requires the caller holds qbt_data->req_mutex. */ static struct sk_buff *__qperi_cmd_sync_one_evt(struct hci_dev *hdev, u16 opcode, u32 plen, const void *cp, u8 ev_type, u8 *status) { u8 sub_opcode = plen ? *(const u8 *)cp : QHCI_SUB_OPCODE_INVALID; DEFINE_QPERI_REQ_SPEC(spec, opcode, sub_opcode, ev_type); return __qperi_cmd_sync_evt(hdev, opcode, plen, cp, &spec, NULL, status); } static inline struct sk_buff *qperi_cmd_sync_one_evt(struct hci_dev *hdev, u16 opcode, u32 plen, const void *cp, u8 ev_type, u8 *status) { struct btqcom_data *qbt_data = hci_get_priv(hdev); guard(mutex)(&qbt_data->req_mutex); return __qperi_cmd_sync_one_evt(hdev, opcode, plen, cp, ev_type, status); } /* * only wait for an unsolicited event with type @ev_type * * Requires the caller holds qbt_data->req_mutex. */ static struct sk_buff __maybe_unused *__qperi_wait_one_evt(struct hci_dev *hdev, u8 ev_type, u8 *status) { DEFINE_QPERI_REQ_SPEC(spec, QHCI_OPCODE_INVALID, QHCI_SUB_OPCODE_INVALID, ev_type); return __qperi_tx_sync_evt(hdev, NULL, &spec, HCI_INIT_TIMEOUT, NULL, status); } /* * handle a received PERI event @skb, called from hdev->recv_vendor_pkt(); * generic processing first, then the TX sync event, without interfering */ static void qperi_handle_evt(struct hci_dev *hdev, struct sk_buff *skb) { struct btqcom_data *qbt_data = hci_get_priv(hdev); const struct qhci_vse_comm *vse_comm; const struct qperi_event_hdr *hdr; const struct qperi_evt *evt_entry; /* for qperi_try_wakeup() call below */ struct sk_buff *orig_skb = NULL; u8 ev_type; int res; ev_type = QPERI_EV_TYPE_INVALID; res = -EBADMSG; hdr = skb_pull_data(skb, QPERI_EVENT_HDR_SIZE); if (!hdr || hdr->evt != HCI_EV_VENDOR) goto out_free_skb; res = -EILSEQ; vse_comm = skb_pull_data(skb, QHCI_VSE_COMM_SIZE); if (!vse_comm || vse_comm->ev_class != QPERI_EV_CLASS_PERI) goto out_free_skb; ev_type = vse_comm->ev_type; res = -ENOENT; if (ev_type >= ARRAY_SIZE(qperi_evt_table)) goto out_free_skb; res = 0; hci_skb_event(skb) = ev_type; evt_entry = &qperi_evt_table[ev_type]; if (evt_entry->handler) { const struct qhci_req *req; bool may_wakeup; spin_lock(&qbt_data->req_spinlock); req = qbt_data->req; may_wakeup = qbt_data->req_state == QHCI_REQ_PEND && req && req->spec && req->spec->event[req->event_idx] == ev_type; spin_unlock(&qbt_data->req_spinlock); if (may_wakeup) { orig_skb = skb_clone(skb, GFP_KERNEL); if (!orig_skb) res = -ENOMEM; } if (evt_entry->handler(hdev, skb)) skb = NULL; } else { orig_skb = skb; skb = NULL; } if (qperi_try_wakeup(hdev, ev_type, orig_skb)) orig_skb = NULL; out_free_skb: kfree_skb(orig_skb); kfree_skb(skb); if (res < 0) bt_dev_err(hdev, "fails to handle PERI event with type 0x%02x: %pe", ev_type, ERR_PTR(res)); } /* * ============================================================================ * PERI-HCI vendor-specific command/response * ============================================================================ */ /* reserved PERI ACL handle for enhanced logging */ #define QPERI_HANDLE_ENHANCED_LOGGING 0xEC0 /* reserved PERI ACL handle for memdump */ #define QPERI_HANDLE_MEMDUMP 0xEC1 /* * Unless otherwise noted, for the VSCs below: * - command payload: struct qhci_cp_simple * - response payload: struct qhci_rp_generic * * Grouped by { opcode, sub_opcode, cp, rp }. */ /* PERI EDL opcode and its sub-opcodes */ #define QPERI_OP_EDL 0xFFF0 #define PEDL_GET_BUILD_INFO 0x09 struct qperi_cp_generic { u8 sub_opcode; u8 subsys; } __packed; struct qperi_rp_get_build_info { u8 status; u8 sub_opcode; u8 subsys; u8 dlen; u8 data[]; } __packed; /* PERI Generic opcode and its sub-opcodes */ #define QPERI_OP_GENERIC 0xFFF1 #define PGEN_PERI_RESET 0x03 /* struct qhci_rp_generic */ /* struct peri_ev_subsys_patch_notification */ #define PGEN_INITIATE_BT_CRASH 0x05 /* struct peri_ev_cmd_status */ #define __QPERI_CP_INIT_SUBSYS_0(...) #define __QPERI_CP_INIT_SUBSYS_1(_subsys, ...) .subsys = (_subsys), #define QPERI_CP_INITIALIZER(_sub_opcode, _subsys...) { \ .sub_opcode = (_sub_opcode), \ CONCATENATE(__QPERI_CP_INIT_SUBSYS_, COUNT_ARGS(_subsys))(_subsys) \ } /* * QPERI_CHECK_RP_LEN - check rp @_skb's length and its @dlen * @_skb: the rp to check * @_rp_type: the type to interpret @_skb as * * It is safe to evaluate @_skb more than once for its usages. * * Returns a negative errno on failure, or 0 on success. */ #define QPERI_CHECK_RP_LEN(_skb, _rp_type) \ ({ \ _rp_type *_rp_ptr; \ int _err = 0; \ do { \ if (!(_skb) || (_skb)->len < sizeof(_rp_type)) { \ _err = -EBADMSG; \ break; \ } \ _rp_ptr = (void *)(_skb)->data; \ if ((_skb)->len != offsetofend(_rp_type, dlen) + \ _rp_ptr->dlen) { \ _err = -EMSGSIZE; \ break; \ } \ } while (0); \ _err; \ }) /* * qperi_get_subsys_build_info - get subsystem build info string * @hdev: the HCI device to query * @subsys: the subsystem to query * @build_info: output build info string, allocated on success; caller frees * * Return: 0 on success, or a negative errno on failure. */ static int qperi_get_subsys_build_info(struct hci_dev *hdev, u8 subsys, char **build_info) { struct qperi_cp_generic cp = QPERI_CP_INITIALIZER(PEDL_GET_BUILD_INFO, subsys); struct qperi_rp_get_build_info *rp; struct sk_buff *skb; u8 status = 0; int ret; skb = qperi_cmd_sync_one_evt(hdev, QPERI_OP_EDL, sizeof(cp), &cp, PERI_EV_CMD_COMPLETE, &status); if (IS_ERR(skb)) return PTR_ERR(skb); if (status) { ret = -bt_to_errno(status); goto out_free_skb; } ret = QPERI_CHECK_RP_LEN(skb, struct qperi_rp_get_build_info); if (ret) goto out_free_skb; rp = (void *)skb->data; if (rp->subsys != subsys) { ret = -EILSEQ; goto out_free_skb; } *build_info = kmemdup_nul(rp->data, rp->dlen, GFP_KERNEL); ret = *build_info ? 0 : -ENOMEM; out_free_skb: kfree_skb(skb); if (ret) bt_dev_err(hdev, "get %s build info failed: %pe", qhci_subsys_name(subsys), ERR_PTR(ret)); else bt_dev_dbg(hdev, "%s build info: %s", qhci_subsys_name(subsys), *build_info); return ret; } /* * qperi_hci_reset - reset PERI HCI * @hdev: the HCI device to reset * * Return: 0 on success, or a negative errno on failure. */ static int qperi_hci_reset(struct hci_dev *hdev) { DEFINE_QPERI_REQ_SPEC(spec, QPERI_OP_GENERIC, PGEN_PERI_RESET, PERI_EV_CMD_COMPLETE, PERI_EV_SUBSYS_PATCH_NOTIFICATION); struct qhci_cp_simple cp = QPERI_CP_INITIALIZER(PGEN_PERI_RESET); struct sk_buff *skb; u8 evt_idx = 0; u8 status = 0; int ret = 0; skb = qperi_cmd_sync_evt(hdev, QPERI_OP_GENERIC, sizeof(cp), &cp, &spec, &evt_idx, &status); if (IS_ERR(skb)) return PTR_ERR(skb); if (status) { ret = -bt_to_errno(status); } else if (evt_idx == 1) { const struct peri_ev_subsys_patch_notification *ev; ev = skb_pull_data(skb, sizeof(*ev)); if (ev->subsys != QHCI_SUBSYS_PERI) { ret = -EILSEQ; bt_dev_err(hdev, "PERI HCI reset via QHCI failed: wrong subsys %d", ev->subsys); } } kfree_skb(skb); if (!ret) bt_dev_info(hdev, "PERI HCI reset via QHCI succeeded"); return ret; } /* * qperi_initiate_bt_crash - initiate a BT subsystem crash * @hdev: the HCI device * * Return: 0 on success, or a negative errno on failure. */ static int qperi_initiate_bt_crash(struct hci_dev *hdev) { struct qhci_cp_simple cp = QPERI_CP_INITIALIZER(PGEN_INITIATE_BT_CRASH); struct sk_buff *skb; u8 status = 0; int ret = 0; skb = qperi_cmd_sync_one_evt(hdev, QPERI_OP_GENERIC, sizeof(cp), &cp, PERI_EV_CMD_STATUS, &status); if (IS_ERR(skb)) return PTR_ERR(skb); if (skb) { ret = -bt_to_errno(status); kfree_skb(skb); } if (!ret) bt_dev_info(hdev, "PERI initiate BT crash succeeded"); return ret; } /* * ============================================================================ * hdev callbacks * ============================================================================ */ /* test if a HW or SW reset is available */ static inline bool btqcom_has_btc_reset(struct hci_dev *hdev) { struct btqcom_data *qbt_data = hci_get_priv(hdev); return qbt_data->flags & (QBT_FLAG_HW_RESET | QBT_FLAG_SW_RESET); } /* * btqcom_set_bdaddr - set BD_ADDR * @hdev: the HCI device * @bdaddr: the BD_ADDR to set * * Implements hdev->set_bdaddr(). * * Return: 0 on success, or a negative errno on failure. */ static int btqcom_set_bdaddr(struct hci_dev *hdev, const bdaddr_t *bdaddr) { int ret; ret = __hci_reset_sync(hdev); if (ret) { bt_dev_err(hdev, "HCI reset before setting BD_ADDR failed: %pe", ERR_PTR(ret)); return ret; } ret = qbt_write_bda(hdev, bdaddr); return ret; } /* * btqcom_handle_ev_vendor - handle @skb if interested * @hdev: the HCI device @skb comes from * @skb: the VSE payload * * Implements hdev->handle_ev_vendor(). * * Return: true if @skb was handled, false otherwise. */ static bool btqcom_handle_ev_vendor(struct hci_dev *hdev, struct sk_buff *skb) { const struct qhci_vse_comm *vse_comm; u16 vse_id; if (skb->len < QHCI_VSE_COMM_SIZE) return false; vse_comm = (const void *)skb->data; vse_id = vse_comm->ev_class << 8 | vse_comm->ev_type; switch (vse_id) { case (QBT_EV_CLASS_DATALOG << 8) | QBT_EV_TYPE_MEMDUMP: skb_pull_data(skb, QHCI_VSE_COMM_SIZE); btqcom_handle_memdump(hdev, skb_get(skb)); return true; default: return false; } } /* handle a received BT vendor ACL frame */ static void handle_acl_vendor(struct hci_dev *hdev, struct sk_buff *skb) { const struct qhci_vse_comm *vse_comm; const struct hci_event_hdr *evt_hdr; u16 vse_id; if (hci_acl_handle(skb) != QBT_HANDLE_MEMDUMP) goto out_free_skb; skb_pull(skb, HCI_ACL_HDR_SIZE); evt_hdr = skb_pull_data(skb, HCI_EVENT_HDR_SIZE); if (!evt_hdr || evt_hdr->evt != HCI_EV_VENDOR) goto out_free_skb; vse_comm = skb_pull_data(skb, QHCI_VSE_COMM_SIZE); if (!vse_comm) goto out_free_skb; vse_id = vse_comm->ev_class << 8 | vse_comm->ev_type; switch (vse_id) { case (QBT_EV_CLASS_DATALOG << 8) | QBT_EV_TYPE_MEMDUMP: btqcom_handle_memdump(hdev, skb); return; default: break; } out_free_skb: kfree_skb(skb); } /* handle a received PERI ACL frame */ static void qperi_handle_acl(struct hci_dev *hdev, struct sk_buff *skb) { const struct hci_event_hdr *bt_evt_hdr; const struct qhci_vse_comm *vse_comm; u8 ev_type; if (qperi_acl_handle(skb) != QPERI_HANDLE_MEMDUMP) goto out_free_skb; skb_pull(skb, QPERI_ACL_HDR_SIZE); bt_evt_hdr = skb_pull_data(skb, HCI_EVENT_HDR_SIZE); if (!bt_evt_hdr || bt_evt_hdr->evt != HCI_EV_VENDOR) goto out_free_skb; vse_comm = skb_pull_data(skb, sizeof(*vse_comm)); if (!vse_comm || vse_comm->ev_class != QPERI_EV_CLASS_PERI) goto out_free_skb; ev_type = vse_comm->ev_type; switch (ev_type) { case PERI_EV_CRASH_DUMP_MEMDUMP: btqcom_handle_memdump(hdev, skb); return; default: break; } out_free_skb: kfree_skb(skb); } /* Implements hdev->recv_vendor_pkt(). */ static void btqcom_recv_vendor_pkt(struct hci_dev *hdev, struct sk_buff *skb) { hci_skb_pkt_type(skb) = *(const u8 *)skb_pull_data(skb, 1); switch (hci_skb_pkt_type(skb)) { case QPERI_EVENT_PKT: qperi_handle_evt(hdev, skb); break; case QPERI_ACLDATA_PKT: qperi_handle_acl(hdev, skb); break; case HCI_ACLDATA_PKT: handle_acl_vendor(hdev, skb); break; default: bt_dev_err(hdev, "unexpected vendor HCI frame with pkt_type 0x%02x", hci_skb_pkt_type(skb)); kfree_skb(skb); break; } } /* Implements hdev->dump.coredump() for hci_devcd_register(). */ static void btusb_qcom_trigger_memdump(struct hci_dev *hdev) { struct btqcom_data *qbt_data = hci_get_priv(hdev); if (qbt_data->category == QBTC_CAT_MSUBSYS) qperi_initiate_bt_crash(hdev); else qbt_error_fatal_cmd(hdev); } /* return 0 on success, or a negative errno on failure */ static int btusb_qcom_deactivate_msubsys_bt(struct hci_dev *hdev) { struct btusb_qcom *xport_data = btusb_qcom_xport_data(hdev); int ret; ret = usb_autopm_get_interface(xport_data->intf); if (ret) { bt_dev_err(hdev, "get autopm for deactivate BT failed: %pe", ERR_PTR(ret)); return ret; } ret = qdfu_activate_remote_btss(hdev, false, 100 * 1000); usb_autopm_put_interface(xport_data->intf); if (!ret) bt_dev_info(hdev, "deactivate BT succeeded"); return ret; } /* return 0 on success, or a negative errno on failure */ static int btusb_qcom_sw_reset(struct hci_dev *hdev) { struct btusb_qcom *xport_data = btusb_qcom_xport_data(hdev); struct btqcom_data *qbt_data = hci_get_priv(hdev); int ret = -EOPNOTSUPP; if (!(qbt_data->flags & QBT_FLAG_SW_RESET)) return ret; ret = usb_autopm_get_interface(xport_data->intf); if (ret) { bt_dev_err(hdev, "get autopm for SW reset failed: %pe", ERR_PTR(ret)); return ret; } ret = qdfu_sw_reset(hdev); usb_autopm_put_interface(xport_data->intf); return ret; } #define QBT_RESET_TYPE_SYNC "sync" #define QBT_RESET_TYPE_ASYNC "async" #define QBT_RESET_TYPE_DIRECT "direct" /* * btusb_do_reset_work - reset the BTC * @hdev: the HCI device * @type: QBT_RESET_TYPE_* above, for logging * * Return: 0 on success, or a negative errno on failure. */ static int btusb_do_reset_work(struct hci_dev *hdev, void *type) { struct btusb_qcom *xport_data = btusb_qcom_xport_data(hdev); struct gpio_desc *reset_gpio = xport_data->reset_gpio; struct btqcom_data *qbt_data = hci_get_priv(hdev); int ret; bt_dev_dbg(hdev, "%s reset: misc_flags(0x%lx)", (char *)type, READ_ONCE(qbt_data->misc_flags)); bt_dev_dbg(hdev, "md_state: %s, md_submit_err: %d", hci_devcd_state_name(READ_ONCE(qbt_data->md_state)), READ_ONCE(qbt_data->md_submit_err)); if (test_and_set_bit(QBT_MISC_RESET_ACTIVE, &qbt_data->misc_flags)) { bt_dev_info(hdev, "reset already in progress"); return 0; } if (xport_data->prepare_reset) xport_data->prepare_reset(hdev); if (reset_gpio) { bt_dev_info(hdev, "hardware reset"); gpiod_set_value_cansleep(reset_gpio, 0); fsleep(200 * 1000); gpiod_set_value_cansleep(reset_gpio, 1); return 0; } ret = btusb_qcom_sw_reset(hdev); if (!ret) return 0; ret = usb_autopm_get_interface(xport_data->intf); if (ret) { bt_dev_err(hdev, "reset: autopm get failed: %pe", ERR_PTR(ret)); clear_bit(QBT_MISC_RESET_ACTIVE, &qbt_data->misc_flags); return ret; } usb_autopm_put_interface_no_suspend(xport_data->intf); bt_dev_info(hdev, "usb reset"); /* Clear it here since usb reset isn't guaranteed to succeed. */ clear_bit(QBT_MISC_RESET_ACTIVE, &qbt_data->misc_flags); usb_queue_reset_device(xport_data->intf); return 0; } static void btusb_qcom_reset_sync(struct hci_dev *hdev) { int res; res = hci_cmd_sync_queue_once(hdev, btusb_do_reset_work, QBT_RESET_TYPE_SYNC, NULL); if (res) bt_dev_dbg(hdev, "queue reset work failed: %pe", ERR_PTR(res)); if (!res || res == -EEXIST || res == -ENODEV) return; btusb_do_reset_work(hdev, QBT_RESET_TYPE_DIRECT); } static void btqcom_reset_async(struct hci_dev *hdev, unsigned int delay_ms) { struct btqcom_data *qbt_data = hci_get_priv(hdev); set_bit(QBT_WORK_RESET_HDEV, &qbt_data->work_flags); schedule_delayed_work(&qbt_data->dwork, msecs_to_jiffies(delay_ms)); } /* * btusb_do_cmd_timeout_work - HCI cmd sync work function to handle command timeout * @hdev: the HCI device * @data: unused * * Return: 0 on success, or a negative errno on failure. */ static int btusb_do_cmd_timeout_work(struct hci_dev *hdev, void *data __maybe_unused) { struct btqcom_data *qbt_data = hci_get_priv(hdev); unsigned int wait_ms = 0; int ret = 0; if (!(qbt_data->flags & QBT_FLAG_MEMDUMP) || !(qbt_data->flags & QBT_FLAG_CMD_TIMEOUT_MEMDUMP)) goto out_reset; switch (qbt_data->category) { case QBTC_CAT_LEGACY: return -EOPNOTSUPP; case QBTC_CAT_UNIFIED: wait_ms = 800; ret = qbt_error_fatal_cmd(hdev); break; case QBTC_CAT_MSUBSYS: wait_ms = 1200; ret = qperi_initiate_bt_crash(hdev); break; default: return -EINVAL; } if (ret) goto out_reset; /* * Command timeout is solved by self-recovery after memdump. * Testing CMD_TIMEOUT in this wait is only to abandon it * immediately if required, not a sign the timeout is resolved. */ ret = wait_var_event_timeout(&qbt_data->misc_flags, test_bit(QBT_MISC_MEMDUMP_INCOMING, &qbt_data->misc_flags) || !test_bit(QBT_MISC_CMD_TIMEOUT, &qbt_data->misc_flags), msecs_to_jiffies(wait_ms)); if (!test_bit(QBT_MISC_CMD_TIMEOUT, &qbt_data->misc_flags)) { bt_dev_dbg(hdev, "Flag CMD_TIMEOUT cleared"); return 0; } if (ret) { bt_dev_dbg(hdev, "trigger memdump on command timeout succeeded"); return 0; } bt_dev_err(hdev, "trigger memdump on command timeout failed"); out_reset: btusb_do_reset_work(hdev, QBT_RESET_TYPE_SYNC); return 0; } /* Implements hdev->reset(). */ static void btusb_qcom_reset(struct hci_dev *hdev) { struct btqcom_data *qbt_data = hci_get_priv(hdev); bool has_cmd_timeout; int res; has_cmd_timeout = current_work() == &hdev->cmd_timer.work; bt_dev_info(hdev, "reset triggered by %s", has_cmd_timeout ? "command timeout" : "user"); if (test_bit(QBT_MISC_MEMDUMP_PERI, &qbt_data->misc_flags) || test_bit(QBT_MISC_MEMDUMP_BT, &qbt_data->misc_flags) || test_bit(QBT_MISC_MEMDUMP_TMEL, &qbt_data->misc_flags)) { bt_dev_info(hdev, "reset will happen after memdump"); return; } if (!has_cmd_timeout) { btusb_qcom_reset_sync(hdev); return; } if (test_and_set_bit(QBT_MISC_CMD_TIMEOUT, &qbt_data->misc_flags)) { bt_dev_info(hdev, "handling command timeout is in progress"); return; } res = hci_cmd_sync_queue_once(hdev, btusb_do_cmd_timeout_work, NULL, NULL); if (res) bt_dev_dbg(hdev, "queue command timeout work failed: %pe", ERR_PTR(res)); if (!res || res == -EEXIST || res == -ENODEV) return; btqcom_reset_async(hdev, 0); } /* Implements hdev->hw_error(). */ static void btqcom_hw_error(struct hci_dev *hdev, u8 code) { const char *subsys_name = qhci_subsys_name(QHCI_SUBSYS_PERI); struct btqcom_data *qbt_data = hci_get_priv(hdev); int res; if (!test_bit(QBT_MISC_HWERR_PERI, &qbt_data->misc_flags)) { set_bit(QBT_MISC_HWERR_BT, &qbt_data->misc_flags); subsys_name = qhci_subsys_name(QHCI_SUBSYS_INVALID); } bt_dev_info(hdev, "%s hardware error (0x%02x)", subsys_name, code); bt_dev_dbg(hdev, "md_pending_flags: 0x%lx", qbt_data->md_pending_flags); bt_dev_dbg(hdev, "md_submit_err: %d", qbt_data->md_submit_err); if (qbt_data->md_pending_flags && !qbt_data->md_submit_err) { res = hci_devcd_complete(hdev); if (res) bt_dev_err(hdev, "memdump complete on %s hardware error failed: %pe", subsys_name, ERR_PTR(res)); else bt_dev_info(hdev, "memdump completed on %s hardware error: %u bytes", subsys_name, qbt_data->md_submit_size); } qbt_data->md_pending_flags = 0; if (test_and_clear_bit(QBT_MISC_MEMDUMP_INCOMING, &qbt_data->misc_flags)) bt_dev_dbg(hdev, "clear MEMDUMP_INCOMING on %s hardware error", subsys_name); } static int btusb_qcom_shutdown_unified(struct hci_dev *hdev) { struct btqcom_data *qbt_data = hci_get_priv(hdev); bool had_hwerr, had_memdump; unsigned int delay_ms = 10; int ret; had_memdump = test_bit(QBT_MISC_MEMDUMP_BT, &qbt_data->misc_flags); had_hwerr = test_bit(QBT_MISC_HWERR_BT, &qbt_data->misc_flags); bt_dev_dbg(hdev, "shutdown: had_memdump %d, had_hwerr %d", had_memdump, had_hwerr); if (!had_hwerr && !had_memdump) { ret = __hci_reset_sync(hdev); if (ret) bt_dev_err(hdev, "shutdown: HCI reset failed: %pe", ERR_PTR(ret)); else bt_dev_info(hdev, "shutdown: HCI reset succeeded"); goto out; } if (!had_memdump) { ret = __hci_cmd_sync_status(hdev, HCI_OP_RESET, 0, NULL, HCI_CMD_TIMEOUT); if (!ret) { clear_bit(QBT_MISC_HWERR_BT, &qbt_data->misc_flags); bt_dev_info(hdev, "shutdown: recovered from hardware error via HCI reset"); goto out; } bt_dev_warn(hdev, "shutdown: HCI reset failed to recover from hardware error: %pe", ERR_PTR(ret)); } ret = -EIO; if (had_memdump && !btqcom_has_btc_reset(hdev)) { bt_dev_info(hdev, "shutdown: BTC will self-recover via re-enumeration"); return ret; } bt_dev_info(hdev, "shutdown: reset BTC after %u msec", delay_ms); btqcom_reset_async(hdev, delay_ms); return ret; out: /* * The flag is usually already unset here in a normal shutdown; * clear it just in case. No wake_up_var() is needed since the * waiter is never waiting at this time. */ if (test_and_clear_bit(QBT_MISC_CMD_TIMEOUT, &qbt_data->misc_flags)) bt_dev_dbg(hdev, "clear CMD_TIMEOUT on shutdown"); return ret; } static int btusb_qcom_shutdown_msubsys(struct hci_dev *hdev) { struct btqcom_data *qbt_data = hci_get_priv(hdev); bool had_peri_hwerr, had_peri_memdump; bool had_bt_hwerr, had_bt_memdump; bool had_tmel_memdump; unsigned int delay_ms; int ret; delay_ms = 10; had_peri_memdump = test_bit(QBT_MISC_MEMDUMP_PERI, &qbt_data->misc_flags); had_peri_hwerr = test_bit(QBT_MISC_HWERR_PERI, &qbt_data->misc_flags); had_bt_memdump = test_bit(QBT_MISC_MEMDUMP_BT, &qbt_data->misc_flags); had_bt_hwerr = test_bit(QBT_MISC_HWERR_BT, &qbt_data->misc_flags); had_tmel_memdump = test_bit(QBT_MISC_MEMDUMP_TMEL, &qbt_data->misc_flags); bt_dev_dbg(hdev, "shutdown: had_peri_memdump %d, had_peri_hwerr %d", had_peri_memdump, had_peri_hwerr); bt_dev_dbg(hdev, "shutdown: had_bt_memdump %d, had_bt_hwerr %d", had_bt_memdump, had_bt_hwerr); bt_dev_dbg(hdev, "shutdown: had_tmel_memdump %d", had_tmel_memdump); ret = -EIO; if (had_peri_memdump || had_peri_hwerr || had_tmel_memdump) goto out_reset; ret = btusb_qcom_deactivate_msubsys_bt(hdev); if (ret && (had_bt_memdump || had_bt_hwerr)) goto out_reset; clear_bit(QBT_MISC_HWERR_BT, &qbt_data->misc_flags); clear_bit(QBT_MISC_MEMDUMP_BT, &qbt_data->misc_flags); /* Same as in btusb_qcom_shutdown_unified(). */ if (test_and_clear_bit(QBT_MISC_CMD_TIMEOUT, &qbt_data->misc_flags)) bt_dev_dbg(hdev, "clear CMD_TIMEOUT on shutdown"); return ret; out_reset: bt_dev_info(hdev, "shutdown: reset BTC after %u msec", delay_ms); btqcom_reset_async(hdev, delay_ms); return ret; } /* Implements hdev->shutdown(). */ static int btusb_qcom_shutdown(struct hci_dev *hdev) { struct btqcom_data *qbt_data = hci_get_priv(hdev); int ret; switch (qbt_data->category) { case QBTC_CAT_LEGACY: ret = -EOPNOTSUPP; break; case QBTC_CAT_UNIFIED: ret = btusb_qcom_shutdown_unified(hdev); break; case QBTC_CAT_MSUBSYS: ret = btusb_qcom_shutdown_msubsys(hdev); break; default: ret = -EINVAL; break; } return ret; } /* * ============================================================================ * QDFU firmware downloading * ============================================================================ */ #define QBT_FW_PATH_MAX 96 enum qbt_fw_type { QBT_FW_TYPE_PATCH, QBT_FW_TYPE_NVM, QBT_FW_TYPE_MAX, }; #define QBT_PATCH_TYPE_TLV 0x01 #define QBT_NVM_TYPE_TLV 0x02 struct qbt_tlv_file_hdr { u8 type; u8 length[3]; } __packed; struct qbt_patch_tlv_hdr { struct qbt_tlv_file_hdr tlv_hdr; __le32 total_len; __le32 patch_data_len; u8 sign_ver; u8 sign_algo; u8 download_cfg; u8 image_type; __le16 product_id; __le16 rom_ver; __le16 patch_ver; u8 reserved1[2]; __le32 anti_rollback_ver; __le32 serial_low; __le16 serial_high; u8 debug_option; u8 reserved2; __le32 entry_addr; } __packed; struct qbt_nvm_tlv_hdr { struct qbt_tlv_file_hdr tlv_hdr; } __packed; /* * struct qdfu_fw_cfg - QDFU firmware download configuration * @desc: short description for logging (e.g. "PERI patch", "PERI NVM") * @format: QBT_PATCH_TYPE_TLV or QBT_NVM_TYPE_TLV * @hdr_size: TLV header size for @format * @request: QDFU_BT_CMD_VSC_REQ_DOWNLOAD_(LOCAL|REMOTE) * @loaded_flag: QDFU_BT_STATE_* flag that marks fw downloaded or not * @settle_us: default time to wait after download for the BTC to settle * @get_path: build firmware file path, return number of paths or error * @check: check firmware, return 0 on success or a negative errno * @download: download firmware, return 0 on success or a negative errno * @get_settle_us: get the time to wait for BTC to settle * @post_download: run after download, return 0 on success or a negative errno */ struct qdfu_fw_cfg { const char *desc; u8 format; u8 hdr_size; u8 request; u8 loaded_flag; u32 settle_us; int (*get_path)(struct hci_dev *hdev, const struct qdfu_fw_cfg *fw_cfg, const struct qbtc_info *info, const struct qdfu_bt_id *ctrl_id, char path[], size_t size); int (*check)(struct hci_dev *hdev, const struct qdfu_fw_cfg *fw_cfg, const struct qbtc_info *info, const struct qdfu_bt_id *ctrl_id, const struct firmware *fw); int (*download)(struct hci_dev *hdev, const struct qdfu_fw_cfg *fw_cfg, const struct qbtc_info *info, const struct qdfu_bt_id *ctrl_id, const void *data, size_t size); u32 (*get_settle_us)(struct hci_dev *hdev, const struct qdfu_fw_cfg *fw_cfg, const struct qbtc_info *info, const struct qdfu_bt_id *ctrl_id); int (*post_download)(struct hci_dev *hdev, const struct qdfu_fw_cfg *fw_cfg, const struct qbtc_info *info, const struct qdfu_bt_id *ctrl_id); }; static int get_qbtc_subsys(const struct qdfu_fw_cfg *fw_cfg); static void qhci_to_qdfu_id(struct qdfu_bt_id *dfu_id, const struct qhci_btc_ver *hci_ver, u16 board_id) { dfu_id->rom_version = (u32)hci_ver->product_id << 16 | hci_ver->rom_ver; dfu_id->patch_version = hci_ver->patch_ver; dfu_id->soc_id = hci_ver->soc_ver; dfu_id->board_id = board_id; } static void qdfu_to_qhci_id(struct qhci_btc_ver *hci_ver, u16 *board_id, const struct qdfu_bt_id *dfu_id) { hci_ver->product_id = upper_16_bits(dfu_id->rom_version); hci_ver->rom_ver = lower_16_bits(dfu_id->rom_version); hci_ver->patch_ver = (u16)dfu_id->patch_version; hci_ver->soc_ver = dfu_id->soc_id; *board_id = dfu_id->board_id; } static int get_qdfu_id_via_hci(struct hci_dev *hdev, struct qdfu_bt_id *dfu_id) { struct qhci_btc_ver hci_ver; u16 board_id; int ret; ret = qbt_edl_patch_getver(hdev, &hci_ver); if (ret) return ret; ret = qbt_edl_get_board_id(hdev, &board_id); if (ret) return ret; qhci_to_qdfu_id(dfu_id, &hci_ver, board_id); return 0; } static const char *get_fw_directory(struct hci_dev *hdev, const struct qbtc_info *info, const struct qdfu_bt_id *ctrl_id) { struct btqcom_data *qbt_data = hci_get_priv(hdev); const struct qbtc_bid_fwdir *custom_fwdir; if (qbt_data->fw_dir) return qbt_data->fw_dir; if (!info->custom_fw_table) goto info_fw_dir; for (custom_fwdir = info->custom_fw_table; custom_fwdir->board_id; custom_fwdir++) { if (custom_fwdir->board_id == ctrl_id->board_id) return custom_fwdir->fw_dir; } info_fw_dir: if (info->fw_dir) return info->fw_dir; return "qca"; } /* * btusb_get_patch_path - build the patch firmware file path * @hdev: the HCI device to build the path for * @fw_cfg: the firmware download config * @info: BTC info for this hdev * @ctrl_id: BTC QDFU ID * @path: output buffer for the built path * @size: size of @path * * Used as the qdfu_fw_cfg ->get_path() callback. * * Return: 1 path written into @path, or a negative errno on failure. */ static int btusb_get_patch_path(struct hci_dev *hdev, const struct qdfu_fw_cfg *fw_cfg, const struct qbtc_info *info, const struct qdfu_bt_id *ctrl_id, char path[], size_t size) { const char *fw_dir = get_fw_directory(hdev, info, ctrl_id); int qbtc_subsys; int len; qbtc_subsys = get_qbtc_subsys(fw_cfg); if (qbtc_subsys == QBTC_SUBSYS_INVALID) { /* BT function unit. */ len = snprintf(path, size, "%s/rampatch_usb_%08x.bin", fw_dir, ctrl_id->rom_version); goto out; } switch (qbtc_subsys) { case QBTC_SUBSYS_PERI: len = snprintf(path, size, "%s/peripatch_usb_%08x.bin", fw_dir, ctrl_id->rom_version); break; case QBTC_SUBSYS_TMEL: return -EOPNOTSUPP; default: return -EINVAL; } out: if (len >= size) return -ENAMETOOLONG; return 1; } /* * btusb_get_nvm_path - build the NVM firmware file path(s) * @hdev: the HCI device to build the path for * @fw_cfg: the firmware download config * @info: BTC info for this hdev * @ctrl_id: BTC QDFU ID * @path: output buffer for the built path(s) * @size: size of @path * * @path may hold two NUL-terminated paths back-to-back: a board-ID path * followed by a fallback path, when NVM fallback is enabled. * * Used as the qdfu_fw_cfg ->get_path() callback. * * Return: number of paths (1 or 2) written into @path, or a negative * errno on failure. */ static int btusb_get_nvm_path(struct hci_dev *hdev, const struct qdfu_fw_cfg *fw_cfg, const struct qbtc_info *info, const struct qdfu_bt_id *ctrl_id, char path[], size_t size) { const char *fw_dir = get_fw_directory(hdev, info, ctrl_id); const char *prefix = NULL, *foundry_str = NULL; bool has_bid = false, need_fb = false; char fw_fb[QBT_FW_PATH_MAX] = { 0 }; int qbtc_subsys; int len = 0; qbtc_subsys = get_qbtc_subsys(fw_cfg); if (qbtc_subsys == QBTC_SUBSYS_INVALID) { /* BT function unit. */ prefix = "nvm_usb"; } else { switch (qbtc_subsys) { case QBTC_SUBSYS_PERI: prefix = "perinvm_usb"; break; case QBTC_SUBSYS_TMEL: return -EOPNOTSUPP; default: return -EINVAL; } } if (info->flags & QBT_FLAG_FOUNDRY_NVM) { u8 foundry = FIELD_GET(GENMASK(15, 12), ctrl_id->soc_id); switch (foundry) { /* GlobalFoundries */ case 0x01: foundry_str = "_gf"; break; default: break; } } if ((info->flags & QBT_FLAG_BID_NVM) && ctrl_id->board_id) { has_bid = true; if (info->flags & QBT_FLAG_NVM_FALLBACK) need_fb = true; } len = snprintf(path, size, "%s/%s_%08x", fw_dir, prefix, ctrl_id->rom_version); if (len >= size) return -ENAMETOOLONG; if (foundry_str) { len += snprintf(path + len, size - len, "%s", foundry_str); if (len >= size) return -ENAMETOOLONG; } if (!has_bid) { len += snprintf(path + len, size - len, ".bin"); if (len >= size) return -ENAMETOOLONG; return 1; } if (need_fb) { int fb_len = snprintf(fw_fb, sizeof(fw_fb), "%s.bin", path); if (fb_len >= sizeof(fw_fb)) return -ENAMETOOLONG; len += snprintf(path + len, size - len, "_%04x.bin", ctrl_id->board_id); if (len >= size) return -ENAMETOOLONG; /* path holds two NUL-terminated strings back-to-back: * [board-id path '\0'][fallback path '\0'] * Verify the buffer fits both before writing. */ if (len + fb_len + 2 > size) return -ENAMETOOLONG; len += 1; snprintf(path + len, size - len, "%s", fw_fb); return 2; } len += snprintf(path + len, size - len, "_%04x.bin", ctrl_id->board_id); if (len >= size) return -ENAMETOOLONG; return 1; } /* check the TLV file header; return 0 on success, or a negative errno */ static int qbt_check_tlv_file(struct hci_dev *hdev, const struct firmware *fw, u8 format) { const struct qbt_tlv_file_hdr *tlv_hdr = (const struct qbt_tlv_file_hdr *)fw->data; size_t file_len; if (fw->size < sizeof(*tlv_hdr)) return -ENODATA; if (tlv_hdr->type != format) return -EINVAL; file_len = get_unaligned_le24(tlv_hdr->length) + sizeof(*tlv_hdr); if (file_len != fw->size) return -EBADF; return 0; } /* * btusb_check_patch_tlv - validate a patch TLV file against the BTC * before download * @hdev: the HCI device to validate the file for * @fw_cfg: the firmware download config (unused) * @info: BTC info for this hdev (unused) * @ctrl_id: BTC QDFU ID * @fw: the firmware to validate * * Used as the qdfu_fw_cfg ->check() callback. * * Return: 0 on success, or a negative errno on failure. */ static int btusb_check_patch_tlv(struct hci_dev *hdev, const struct qdfu_fw_cfg *fw_cfg, const struct qbtc_info *info __maybe_unused, const struct qdfu_bt_id *ctrl_id, const struct firmware *fw) { const struct qbt_patch_tlv_hdr *patch_hdr = (const void *)fw->data; u32 fw_rom_version, fw_patch_version; int ret; ret = qbt_check_tlv_file(hdev, fw, QBT_PATCH_TYPE_TLV); if (ret) { bt_dev_err(hdev, "Check %s TLV file header failed: %pe", fw_cfg->desc, ERR_PTR(ret)); return ret; } if (fw->size < sizeof(*patch_hdr)) { bt_dev_err(hdev, "%s header truncated (%zu bytes, header needs %zu)", fw_cfg->desc, fw->size, sizeof(*patch_hdr)); return -ENODATA; } if (likely(upper_16_bits(ctrl_id->rom_version))) { fw_rom_version = (le16_to_cpu(patch_hdr->product_id) << 16) | le16_to_cpu(patch_hdr->rom_ver); } else { bt_dev_warn(hdev, "check %s: invalid rom_version 0x%08x", fw_cfg->desc, ctrl_id->rom_version); fw_rom_version = le16_to_cpu(patch_hdr->rom_ver); } fw_patch_version = le16_to_cpu(patch_hdr->patch_ver); if (fw_rom_version != ctrl_id->rom_version) { bt_dev_err(hdev, "%s ROM version 0x%08x does not match controller 0x%08x", fw_cfg->desc, fw_rom_version, ctrl_id->rom_version); return -EINVAL; } if (fw_patch_version < ctrl_id->patch_version) { bt_dev_err(hdev, "%s version 0x%x older than controller 0x%x, anti-rollback", fw_cfg->desc, fw_patch_version, ctrl_id->patch_version); return -EPERM; } return 0; } /* * validate a NVM TLV file against the BTC * Used as the qdfu_fw_cfg ->check() callback. */ static int btusb_check_nvm_tlv(struct hci_dev *hdev, const struct qdfu_fw_cfg *fw_cfg, const struct qbtc_info *info __maybe_unused, const struct qdfu_bt_id *ctrl_id __maybe_unused, const struct firmware *fw) { int ret; ret = qbt_check_tlv_file(hdev, fw, QBT_NVM_TYPE_TLV); if (ret) { bt_dev_err(hdev, "Check %s TLV file header failed: %pe", fw_cfg->desc, ERR_PTR(ret)); return ret; } return 0; } /* * btusb_download_via_qdfu - download a firmware image via QDFU to BTC * @hdev: the HCI device to send the firmware to * @fw_cfg: the firmware download config * @info: BTC info for this hdev (unused) * @ctrl_id: BTC QDFU ID (unused) * @fw_data: the firmware image to send, header included * @fw_size: size of @fw_data * * Used as the qdfu_fw_cfg ->download() callback. * * Return: 0 on success, or a negative errno on failure. */ static int btusb_download_via_qdfu(struct hci_dev *hdev, const struct qdfu_fw_cfg *fw_cfg, const struct qbtc_info *info __maybe_unused, const struct qdfu_bt_id *ctrl_id __maybe_unused, const void *fw_data, size_t fw_size) { struct btusb_qcom *xport_data = btusb_qcom_xport_data(hdev); unsigned int pipe = usb_sndbulkpipe(xport_data->udev, 0x02); const unsigned int xfer_timeout_ms = 3000; const size_t xfer_size = SZ_4K; const u8 *base = fw_data; const u8 *ptr = fw_data; size_t seg_size, size; int snd_len, ret; u8 *buf; ret = qdfu_vsc_req_download(hdev, fw_cfg->request, ptr, fw_cfg->hdr_size); if (ret) return ret; ptr += fw_cfg->hdr_size; size = fw_size - fw_cfg->hdr_size; /* ep2 needs time to switch from ACL to DFU function mode. */ fsleep(20 * 1000); buf = kmalloc(xfer_size, GFP_KERNEL); if (!buf) return -ENOMEM; while (size) { seg_size = min_t(size_t, size, xfer_size); memcpy(buf, ptr, seg_size); snd_len = 0; ret = usb_bulk_msg(xport_data->udev, pipe, buf, seg_size, &snd_len, xfer_timeout_ms); if (ret < 0) { bt_dev_err(hdev, "QDFU bulk send failed at offset %zu: %pe", ptr - base, ERR_PTR(ret)); break; } if (seg_size != snd_len) { bt_dev_err(hdev, "QDFU bulk short write (%d of %zu bytes) at offset %zu", snd_len, seg_size, ptr - base); ret = -EIO; break; } ptr += seg_size; size -= seg_size; } kfree(buf); return ret; } /* * Used as the qdfu_fw_cfg ->get_settle_us() callback. * Kept here for future per-BTC settle time use. */ static u32 btusb_get_settle_us(struct hci_dev *hdev __maybe_unused, const struct qdfu_fw_cfg *fw_cfg, const struct qbtc_info *info __maybe_unused, const struct qdfu_bt_id *ctrl_id __maybe_unused) { return fw_cfg->settle_us; } /* Used as the qdfu_fw_cfg ->post_download() callback. */ static int btusb_post_download_unified_bt(struct hci_dev *hdev, const struct qdfu_fw_cfg *fw_cfg __maybe_unused, const struct qbtc_info *info __maybe_unused, const struct qdfu_bt_id *ctrl_id __maybe_unused) { struct btqcom_data *qbt_data = hci_get_priv(hdev); char *build_info = NULL; int ret; ret = qbt_edl_get_build_info(hdev, &build_info); if (!ret) { strscpy(qbt_data->build_info, build_info, sizeof(qbt_data->build_info)); kfree(build_info); } ret = __hci_reset_sync(hdev); if (ret) bt_dev_err(hdev, "HCI reset after BT NVM download failed: %pe", ERR_PTR(ret)); else bt_dev_info(hdev, "HCI reset after BT NVM download succeeded"); return ret; } /* Used as the qdfu_fw_cfg ->post_download() callback. */ static int btusb_post_download_msubsys_peri(struct hci_dev *hdev, const struct qdfu_fw_cfg *fw_cfg __maybe_unused, const struct qbtc_info *info __maybe_unused, const struct qdfu_bt_id *ctrl_id __maybe_unused) { struct btqcom_data *qbt_data = hci_get_priv(hdev); struct qbtc_subsys_data *subsys_data; char *build_info = NULL; int ret; subsys_data = &qbt_data->subsys[QBTC_SUBSYS_PERI]; ret = qperi_get_subsys_build_info(hdev, QHCI_SUBSYS_PERI, &build_info); if (!ret) { strscpy(subsys_data->build_info, build_info, sizeof(subsys_data->build_info)); kfree(build_info); } /* Resetting PERI HCI is only allowed after downloading PERI NVM. */ if (qbt_data->flags & QBT_FLAG_RESET_PERI_HCI) ret = qperi_hci_reset(hdev); else ret = qdfu_reset_peri_hci(hdev); return ret; } static const struct qdfu_fw_cfg qdfu_fw_cfgs_bt[QBTC_CAT_MAX][QBT_FW_TYPE_MAX] = { [QBTC_CAT_UNIFIED][QBT_FW_TYPE_PATCH] = { .desc = "patch", .format = QBT_PATCH_TYPE_TLV, .hdr_size = sizeof(struct qbt_patch_tlv_hdr), .request = QDFU_BT_CMD_VSC_REQ_DOWNLOAD_LOCAL, .loaded_flag = QDFU_BT_STATE_PATCHED_LOCAL, .settle_us = 10 * 1000, .get_path = btusb_get_patch_path, .check = btusb_check_patch_tlv, .download = btusb_download_via_qdfu, .get_settle_us = btusb_get_settle_us, .post_download = NULL, }, [QBTC_CAT_UNIFIED][QBT_FW_TYPE_NVM] = { .desc = "NVM", .format = QBT_NVM_TYPE_TLV, .hdr_size = sizeof(struct qbt_nvm_tlv_hdr), .request = QDFU_BT_CMD_VSC_REQ_DOWNLOAD_LOCAL, .loaded_flag = QDFU_BT_STATE_NVMED_LOCAL, .settle_us = 40 * 1000, .get_path = btusb_get_nvm_path, .check = btusb_check_nvm_tlv, .download = btusb_download_via_qdfu, .get_settle_us = btusb_get_settle_us, .post_download = btusb_post_download_unified_bt, }, [QBTC_CAT_MSUBSYS][QBT_FW_TYPE_PATCH] = { .desc = "BT patch", .format = QBT_PATCH_TYPE_TLV, .hdr_size = sizeof(struct qbt_patch_tlv_hdr), .request = QDFU_BT_CMD_VSC_REQ_DOWNLOAD_REMOTE, .loaded_flag = QDFU_BT_STATE_PATCHED_REMOTE, .settle_us = 30 * 1000, .get_path = btusb_get_patch_path, .check = btusb_check_patch_tlv, .download = btusb_download_via_qdfu, .get_settle_us = btusb_get_settle_us, .post_download = NULL, }, [QBTC_CAT_MSUBSYS][QBT_FW_TYPE_NVM] = { .desc = "BT NVM", .format = QBT_NVM_TYPE_TLV, .hdr_size = sizeof(struct qbt_nvm_tlv_hdr), .request = QDFU_BT_CMD_VSC_REQ_DOWNLOAD_REMOTE, .loaded_flag = QDFU_BT_STATE_NVMED_REMOTE, .settle_us = 60 * 1000, .get_path = btusb_get_nvm_path, .check = btusb_check_nvm_tlv, .download = btusb_download_via_qdfu, .get_settle_us = btusb_get_settle_us, .post_download = btusb_post_download_unified_bt, }, }; static const struct qdfu_fw_cfg qdfu_fw_cfgs_subsys[QBTC_SUBSYS_MAX][QBT_FW_TYPE_MAX] = { [QBTC_SUBSYS_PERI][QBT_FW_TYPE_PATCH] = { .desc = "PERI patch", .format = QBT_PATCH_TYPE_TLV, .hdr_size = sizeof(struct qbt_patch_tlv_hdr), .request = QDFU_BT_CMD_VSC_REQ_DOWNLOAD_LOCAL, .loaded_flag = QDFU_BT_STATE_PATCHED_LOCAL, .settle_us = 10 * 1000, .get_path = btusb_get_patch_path, .check = btusb_check_patch_tlv, .download = btusb_download_via_qdfu, .get_settle_us = btusb_get_settle_us, .post_download = NULL, }, [QBTC_SUBSYS_PERI][QBT_FW_TYPE_NVM] = { .desc = "PERI NVM", .format = QBT_NVM_TYPE_TLV, .hdr_size = sizeof(struct qbt_nvm_tlv_hdr), .request = QDFU_BT_CMD_VSC_REQ_DOWNLOAD_LOCAL, .loaded_flag = QDFU_BT_STATE_NVMED_LOCAL, .settle_us = 20 * 1000, .get_path = btusb_get_nvm_path, .check = btusb_check_nvm_tlv, .download = btusb_download_via_qdfu, .get_settle_us = btusb_get_settle_us, .post_download = btusb_post_download_msubsys_peri, }, }; static int get_qbtc_subsys(const struct qdfu_fw_cfg *fw_cfg) { int qbtc_subsys; int fw_type; for (qbtc_subsys = 0; qbtc_subsys < QBTC_SUBSYS_MAX; qbtc_subsys++) { for (fw_type = 0; fw_type < QBT_FW_TYPE_MAX; fw_type++) { if (&qdfu_fw_cfgs_subsys[qbtc_subsys][fw_type] == fw_cfg) return qbtc_subsys; } } return QBTC_SUBSYS_INVALID; } /* * btusb_download_fw - download a firmware image * @hdev: the HCI device to download the firmware to * @fw_cfg: the firmware download config * @info: BTC info for this hdev * @ctrl_id: BTC ID * * Return: 1 if downloaded, 0 if already downloaded, or a negative errno * on failure. */ static int btusb_download_fw(struct hci_dev *hdev, const struct qdfu_fw_cfg *fw_cfg, const struct qbtc_info *info, const struct qdfu_bt_id *ctrl_id) { const struct firmware *fw = NULL; char paths[QBT_FW_PATH_MAX * 2]; const char *loaded_name; u8 state, state_new; u32 settle_us; int n_paths; int ret; bt_dev_dbg(hdev, "download %s", fw_cfg->desc); ret = qdfu_get_target_state(hdev, &state); if (ret) goto out; if (state & fw_cfg->loaded_flag) { bt_dev_info(hdev, "%s already downloaded", fw_cfg->desc); goto out; } n_paths = fw_cfg->get_path(hdev, fw_cfg, info, ctrl_id, paths, sizeof(paths)); if (n_paths < 0) { bt_dev_err(hdev, "Failed to get %s path: %pe", fw_cfg->desc, ERR_PTR(n_paths)); ret = n_paths; goto out; } bt_dev_dbg(hdev, "%s path: %s", fw_cfg->desc, paths); if (n_paths == 2) bt_dev_dbg(hdev, "%s fallback path: %s", fw_cfg->desc, paths + strlen(paths) + 1); loaded_name = paths; ret = request_firmware(&fw, paths, &hdev->dev); if (ret == -ENOENT && n_paths == 2) { bt_dev_err(hdev, "Failed to request %s %s: %pe", fw_cfg->desc, loaded_name, ERR_PTR(ret)); loaded_name = paths + strlen(paths) + 1; ret = request_firmware(&fw, loaded_name, &hdev->dev); } if (ret) { bt_dev_err(hdev, "Failed to request %s %s: %pe", fw_cfg->desc, loaded_name, ERR_PTR(ret)); goto out; } bt_dev_dbg(hdev, "%s request succeeded: %s", fw_cfg->desc, loaded_name); ret = fw_cfg->check(hdev, fw_cfg, info, ctrl_id, fw); if (ret) goto out_free_fw; ret = fw_cfg->download(hdev, fw_cfg, info, ctrl_id, fw->data, fw->size); if (ret) goto out_free_fw; bt_dev_info(hdev, "%s download succeeded: %s", fw_cfg->desc, loaded_name); ret = qdfu_poll_state(hdev, &state_new, true, fw_cfg->loaded_flag); if (ret) goto out_free_fw; if (state_new != state) bt_dev_dbg(hdev, "%s state: 0x%02x -> 0x%02x", fw_cfg->desc, state, state_new); if (fw_cfg->get_settle_us) settle_us = fw_cfg->get_settle_us(hdev, fw_cfg, info, ctrl_id); else settle_us = fw_cfg->settle_us; fsleep(settle_us); if (fw_cfg->post_download) { ret = fw_cfg->post_download(hdev, fw_cfg, info, ctrl_id); if (ret) bt_dev_err(hdev, "%s post-download failed: %pe", fw_cfg->desc, ERR_PTR(ret)); else bt_dev_dbg(hdev, "%s post-download succeeded", fw_cfg->desc); } if (!ret) { bt_dev_dbg(hdev, "download %s succeeded", fw_cfg->desc); ret = 1; } out_free_fw: release_firmware(fw); out: if (ret < 0) bt_dev_err(hdev, "download %s failed: %pe", fw_cfg->desc, ERR_PTR(ret)); return ret; } /* * ============================================================================ * btusb_qcom.h APIs * ============================================================================ */ /* size of the hci priv area */ int btusb_qcom_hdev_priv_size(void) { return sizeof(struct btqcom_data) + sizeof(struct btusb_qcom); } /* get @hdev's transport-specific data */ struct btusb_qcom *btusb_qcom_xport_data(struct hci_dev *hdev) { struct btqcom_data *qbt_data = hci_get_priv(hdev); return (struct btusb_qcom *)(qbt_data + 1); } /* work function for qbt_data->dwork */ static void btqcom_work(struct work_struct *work) { struct btqcom_data *qbt_data; struct hci_dev *hdev; qbt_data = container_of(to_delayed_work(work), struct btqcom_data, dwork); hdev = qbt_data->hdev; if (test_and_clear_bit(QBT_WORK_RESET_HDEV, &qbt_data->work_flags)) { hci_dev_hold(hdev); hci_req_sync_lock(hdev); btusb_do_reset_work(hdev, QBT_RESET_TYPE_ASYNC); hci_req_sync_unlock(hdev); hci_dev_put(hdev); } } static void devm_btusb_qcom_deinit(void *data) { struct btqcom_data *qbt_data = data; struct btusb_qcom *xport_data; if (!qbt_data->inited) return; xport_data = qbt_data->xport_data; mutex_destroy(&qbt_data->req_mutex); mutex_destroy(&xport_data->tx_mutex); qbt_data->inited = false; bt_dev_dbg(qbt_data->hdev, "btusb qcom deinited"); } static void __maybe_unused btusb_qcom_deinit(struct btqcom_data *qbt_data) { devm_release_action(&qbt_data->hdev->dev, devm_btusb_qcom_deinit, qbt_data); } /* * btusb_qcom_init - initialize hdev and per-device btqcom_data * @qbt_data: the btqcom_data to initialize * * Doesn't touch btqcom_data fields that live for the hdev's lifetime, * e.g. @fw_dir and @fw_logging. * * Return: 0 on success, or a negative errno on failure. */ static int btusb_qcom_init(struct btqcom_data *qbt_data) { struct btusb_qcom *xport_data = qbt_data->xport_data; struct hci_dev *hdev = qbt_data->hdev; int res; WRITE_ONCE(qbt_data->misc_flags, 0); WRITE_ONCE(qbt_data->work_flags, 0); qbt_data->md_state = HCI_DEVCOREDUMP_IDLE; qbt_data->md_submit_err = 0; qbt_data->md_submit_size = 0; qbt_data->md_pending_flags = 0; btqcom_reset_memdump(&qbt_data->md); WRITE_ONCE(qbt_data->req, NULL); WRITE_ONCE(qbt_data->req_state, QHCI_REQ_DONE); if (qbt_data->inited) return 0; hci_set_quirk(hdev, HCI_QUIRK_NON_PERSISTENT_SETUP); hci_set_quirk(hdev, HCI_QUIRK_SIMULTANEOUS_DISCOVERY); hci_set_quirk(hdev, HCI_QUIRK_WIDEBAND_SPEECH_SUPPORTED); if (qbt_data->flags & QBT_FLAG_AOSP_EXT) hci_set_aosp_capable(hdev); if (qbt_data->flags & QBT_FLAG_MSFT_EXT) hci_set_msft_opcode(hdev, 0xFD70); res = devm_add_action(&hdev->dev, devm_btusb_qcom_deinit, qbt_data); if (res) { bt_dev_err(hdev, "Add btusb qcom deinit action failed: %pe", ERR_PTR(res)); return res; } INIT_DELAYED_WORK(&qbt_data->dwork, btqcom_work); mutex_init(&xport_data->tx_mutex); mutex_init(&qbt_data->req_mutex); init_waitqueue_head(&qbt_data->req_wait_q); spin_lock_init(&qbt_data->req_spinlock); hdev->set_bdaddr = btqcom_set_bdaddr; hdev->reset = btusb_qcom_reset; hdev->shutdown = btusb_qcom_shutdown; hdev->hw_error = btqcom_hw_error; hdev->handle_ev_vendor = btqcom_handle_ev_vendor; hdev->recv_vendor_pkt = btqcom_recv_vendor_pkt; qbt_data->md_ready = false; if (qbt_data->flags & QBT_FLAG_MEMDUMP) { res = hci_devcd_register(hdev, btusb_qcom_trigger_memdump, btusb_qcom_memdump_hdr, btusb_qcom_notify_memdump); if (!res) qbt_data->md_ready = true; else if (res == -EOPNOTSUPP) bt_dev_warn(hdev, "CONFIG_DEV_COREDUMP not enabled"); else bt_dev_err(hdev, "register devcoredump failed: %pe", ERR_PTR(res)); } /* pairs with smp_load_acquire() in btusb_qcom_disconnect() */ smp_store_release(&qbt_data->inited, true); bt_dev_dbg(hdev, "btusb qcom inited"); return 0; } /* * btusb_qcom_setup_unified - setup for a unified BTC * @hdev: the HCI device to set up * @info: BTC info for this hdev * @ctrl_id: BTC QDFU ID * * Return: 0 on success, or a negative errno on failure. */ static int btusb_qcom_setup_unified(struct hci_dev *hdev, const struct qbtc_info *info, const struct qdfu_bt_id *ctrl_id) { struct btqcom_data *qbt_data = hci_get_priv(hdev); enum qbtc_category btc_cat = info->category; const struct qdfu_fw_cfg *cfgs_bt; struct qdfu_bt_id bt_id; int ret; cfgs_bt = qdfu_fw_cfgs_bt[btc_cat]; ret = btusb_download_fw(hdev, &cfgs_bt[QBT_FW_TYPE_PATCH], info, ctrl_id); if (ret < 0) return ret; ret = qdfu_get_target_version(hdev, &bt_id); if (ret) return ret; qdfu_to_qhci_id(&qbt_data->ver, &qbt_data->board_id, &bt_id); ret = btusb_download_fw(hdev, &cfgs_bt[QBT_FW_TYPE_NVM], info, &bt_id); if (ret) return ret < 0 ? ret : 0; ret = __hci_reset_sync(hdev); if (ret) bt_dev_err(hdev, "HCI reset failed: %pe", ERR_PTR(ret)); else bt_dev_dbg(hdev, "HCI reset succeeded"); return ret; } /* * btusb_qcom_setup_msubsys - setup for a multi-subsystem BTC * @hdev: the HCI device to set up * @info: BTC info for this hdev * @ctrl_id: BTC QDFU ID * * Return: 0 on success, or a negative errno on failure. */ static int btusb_qcom_setup_msubsys(struct hci_dev *hdev, const struct qbtc_info *info, const struct qdfu_bt_id *ctrl_id) { const struct qdfu_fw_cfg *cfgs_peri = qdfu_fw_cfgs_subsys[QBTC_SUBSYS_PERI]; const struct qdfu_fw_cfg *cfgs_bt = qdfu_fw_cfgs_bt[QBTC_CAT_MSUBSYS]; struct btqcom_data *qbt_data = hci_get_priv(hdev); struct qbtc_subsys_data *subsys_peri; struct qdfu_bt_id peri_id, bt_id; int ret; subsys_peri = &qbt_data->subsys[QBTC_SUBSYS_PERI]; ret = btusb_download_fw(hdev, &cfgs_peri[QBT_FW_TYPE_PATCH], info, ctrl_id); if (ret < 0) return ret; ret = qdfu_get_target_version(hdev, &peri_id); if (ret) return ret; qdfu_to_qhci_id(&subsys_peri->ver, &subsys_peri->board_id, &peri_id); ret = btusb_download_fw(hdev, &cfgs_peri[QBT_FW_TYPE_NVM], info, &peri_id); if (ret < 0) return ret; ret = qdfu_reset_msubsys_bt(hdev); if (ret) return ret; ret = get_qdfu_id_via_hci(hdev, &bt_id); if (ret) return ret; if (bt_id.rom_version != peri_id.rom_version || bt_id.soc_id != peri_id.soc_id || bt_id.board_id != peri_id.board_id) { bt_dev_info(hdev, "BT ROM Version: 0x%08x", bt_id.rom_version); bt_dev_info(hdev, "BT Patch Version: 0x%08x", bt_id.patch_version); bt_dev_info(hdev, "BT SoC Version: 0x%08x", bt_id.soc_id); bt_dev_info(hdev, "BT Board ID: 0x%04x", bt_id.board_id); } ret = btusb_download_fw(hdev, &cfgs_bt[QBT_FW_TYPE_PATCH], info, &bt_id); if (ret < 0) return ret; ret = get_qdfu_id_via_hci(hdev, &bt_id); if (ret) return ret; qdfu_to_qhci_id(&qbt_data->ver, &qbt_data->board_id, &bt_id); ret = btusb_download_fw(hdev, &cfgs_bt[QBT_FW_TYPE_NVM], info, &bt_id); if (ret < 0) return ret; return 0; } static int btqcom_post_setup(struct hci_dev *hdev) { struct btqcom_data *qbt_data = hci_get_priv(hdev); struct qbtc_subsys_data *subsys_data; char *build_info = NULL; char buf[512]; int len = 0; int res; bt_dev_dbg(hdev, "flags: 0x%lx", qbt_data->flags); bt_dev_info(hdev, "memdump ready? %s", str_yes_no(qbt_data->md_ready)); qbt_config_fw_logging(hdev, qbt_data->fw_logging); hci_set_hw_info(hdev, "%s", qbt_data->btc_name); if (qbt_data->category == QBTC_CAT_MSUBSYS) { subsys_data = &qbt_data->subsys[QBTC_SUBSYS_PERI]; if (subsys_data->build_info[0] == '\0') { res = qperi_get_subsys_build_info(hdev, QHCI_SUBSYS_PERI, &build_info); if (!res) { strscpy(subsys_data->build_info, build_info, sizeof(subsys_data->build_info)); kfree(build_info); } } bt_dev_info(hdev, "%s build info: %s", qbtc_subsys_name(QBTC_SUBSYS_PERI), subsys_data->build_info); len = scnprintf(buf, sizeof(buf), "%s: %s\n", qbtc_subsys_name(QBTC_SUBSYS_PERI), subsys_data->build_info); } if (qbt_data->build_info[0] == '\0') { build_info = NULL; res = qbt_edl_get_build_info(hdev, &build_info); if (!res) { strscpy(qbt_data->build_info, build_info, sizeof(qbt_data->build_info)); kfree(build_info); } } bt_dev_info(hdev, "BT build info: %s", qbt_data->build_info); len += snprintf(buf + len, sizeof(buf) - len, "BT: %s", qbt_data->build_info); hci_set_fw_info(hdev, "%s", buf); return 0; } /* * btusb_qcom_setup - setup a BTC * @hdev: the HCI device * * Identifies the BTC, then dispatches setup based on its category. * Implements hdev->setup(). * * Return: 0 on success, or a negative errno on failure. */ int btusb_qcom_setup(struct hci_dev *hdev) { struct btusb_qcom *xport_data = btusb_qcom_xport_data(hdev); bool is_first_setup = hci_dev_test_flag(hdev, HCI_SETUP); struct btqcom_data *qbt_data = hci_get_priv(hdev); const struct qbtc_id *id_entry = qbtc_id_table; struct qdfu_bt_id ctrl_id; int ret; qbt_data->hdev = hdev; xport_data->intf = to_usb_interface(hdev->dev.parent); xport_data->udev = interface_to_usbdev(xport_data->intf); xport_data->idVendor = le16_to_cpu(xport_data->udev->descriptor.idVendor); xport_data->idProduct = le16_to_cpu(xport_data->udev->descriptor.idProduct); qbt_data->xport_data = xport_data; ret = usb_autopm_get_interface(xport_data->intf); if (ret) { bt_dev_err(hdev, "get autopm for QCOM BTUSB setup failed: %pe", ERR_PTR(ret)); return ret; } ret = qdfu_get_target_version(hdev, &ctrl_id); if (ret) goto out; while (id_entry->rom_version) { if (id_entry->rom_version == ctrl_id.rom_version) break; id_entry++; } if (!id_entry->rom_version) { ret = -ENODEV; bt_dev_warn(hdev, "Detected unsupported BT controller:"); } else { bt_dev_info(hdev, "%s QCOM %s BT controller: %s", is_first_setup ? "Detected" : "Setup", qbtc_category_name(id_entry->btc_info->category), id_entry->name); } bt_dev_info(hdev, "ROM Version : 0x%08x", ctrl_id.rom_version); bt_dev_info(hdev, "Patch Version: 0x%08x", ctrl_id.patch_version); bt_dev_info(hdev, "SoC Version : 0x%08x", ctrl_id.soc_id); bt_dev_info(hdev, "Board ID : 0x%04x", ctrl_id.board_id); if (ret) goto out; if (!qbt_data->drv_name) qbt_data->drv_name = dev_driver_string(&xport_data->intf->dev); qbt_data->btc_name = id_entry->name; qbt_data->category = id_entry->btc_info->category; qbt_data->flags = id_entry->btc_info->flags & QBT_FLAG_BTC_CFG_MASK; if (xport_data->reset_gpio) qbt_data->flags |= QBT_FLAG_HW_RESET; ret = btusb_qcom_init(qbt_data); if (ret) goto out; switch (qbt_data->category) { case QBTC_CAT_LEGACY: ret = -EOPNOTSUPP; break; case QBTC_CAT_UNIFIED: hci_set_quirk(hdev, HCI_QUIRK_BROKEN_ENHANCED_SETUP_SYNC_CONN); ret = btusb_qcom_setup_unified(hdev, id_entry->btc_info, &ctrl_id); break; case QBTC_CAT_MSUBSYS: ret = btusb_qcom_setup_msubsys(hdev, id_entry->btc_info, &ctrl_id); break; default: ret = -EINVAL; break; } if (!ret) ret = btqcom_post_setup(hdev); out: usb_autopm_put_interface(xport_data->intf); if (!ret) bt_dev_info(hdev, "QCOM BTUSB setup succeeded (^_^)"); else bt_dev_err(hdev, "QCOM BTUSB setup failed: %pe", ERR_PTR(ret)); return ret; } /* * btusb_qcom_disconnect - clean up on USB disconnect * @hdev: the HCI device being disconnected * * Return: 0 on success, or a negative errno on failure. */ int btusb_qcom_disconnect(struct hci_dev *hdev) { struct btqcom_data *qbt_data = hci_get_priv(hdev); /* pairs with smp_store_release() in btusb_qcom_init() */ if (!smp_load_acquire(&qbt_data->inited)) return 0; bt_dev_dbg(hdev, "disconnection: misc_flags(0x%lx)", READ_ONCE(qbt_data->misc_flags)); if (test_bit(QBT_MISC_MEMDUMP_INCOMING, &qbt_data->misc_flags) && !qbt_data->md_submit_err) bt_dev_warn(hdev, "memdump collection interrupted by disconnection"); qperi_tx_sync_cancel_sync(hdev, -ENODEV); if (test_and_clear_bit(QBT_MISC_CMD_TIMEOUT, &qbt_data->misc_flags)) { wake_up_var(&qbt_data->misc_flags); bt_dev_dbg(hdev, "wake command-timeout waiter on disconnection"); } disable_delayed_work_sync(&qbt_data->dwork); return 0; } /* * btusb_qcom_send_frame - send a frame for BT or PERI * @hdev: the HCI device * @skb: the frame to send * * Implements hdev->send(). * * Return: 0 on success, or a negative errno on failure. */ int btusb_qcom_send_frame(struct hci_dev *hdev, struct sk_buff *skb) __context_unsafe(/* conditional locking */) { struct btusb_qcom *xport_data = btusb_qcom_xport_data(hdev); struct btqcom_data *qbt_data = hci_get_priv(hdev); bool is_vendor; bool need_lock; u8 pkt_type; int ret; if (qbt_data->category != QBTC_CAT_MSUBSYS) return xport_data->send_bt_frame(hdev, skb); pkt_type = hci_skb_pkt_type(skb); is_vendor = pkt_type == HCI_VENDOR_PKT; /* an empty vendor packet has no path to reach here */ if (is_vendor) hci_skb_pkt_type(skb) = *(const u8 *)skb_pull_data(skb, 1); pkt_type = hci_skb_pkt_type(skb); need_lock = pkt_type == HCI_COMMAND_PKT || pkt_type == QPERI_COMMAND_PKT; if (need_lock) mutex_lock(&xport_data->tx_mutex); if (is_vendor) ret = xport_data->send_vendor_frame(hdev, skb); else ret = xport_data->send_bt_frame(hdev, skb); if (need_lock) mutex_unlock(&xport_data->tx_mutex); return ret; } /* * RX flow: * * USB intr/bulk endpoint (byte stream) * -> btusb_qcom_recv_{intr,bulk}() (reassemble to frame) * -> btqcom_recv_frame() * -> btusb_upward_frame() (dispatch frame upwards) * -> hci_recv_frame() (PERI frame as HCI_VENDOR_PKT) * -> xport_data->recv_bt_frame() (BT, back to btusb_main.c) */ /* * btusb_upward_frame - dispatch a received frame upwards * @hdev: the HCI device the @skb comes from * @skb: the frame to dispatch upwards * * Return: 0 on success, or a negative errno on failure. */ static int btusb_upward_frame(struct hci_dev *hdev, struct sk_buff *skb) { struct btusb_qcom *xport_data = btusb_qcom_xport_data(hdev); u8 pkt_type = hci_skb_pkt_type(skb); u16 handle; int ret; switch (pkt_type) { case QPERI_EVENT_PKT: case QPERI_ACLDATA_PKT: *(u8 *)skb_push(skb, 1) = pkt_type; hci_skb_pkt_type(skb) = HCI_VENDOR_PKT; break; case HCI_EVENT_PKT: break; case HCI_ACLDATA_PKT: handle = hci_acl_handle(skb); /* reroute vendor ACLs as HCI_VENDOR_PKT */ if (handle == QBT_HANDLE_ENHANCED_LOGGING || handle == QBT_HANDLE_MEMDUMP) { *(u8 *)skb_push(skb, 1) = pkt_type; hci_skb_pkt_type(skb) = HCI_VENDOR_PKT; } break; default: dev_kfree_skb_irq(skb); ret = -EINVAL; goto out; } if (hci_skb_pkt_type(skb) == HCI_VENDOR_PKT) ret = hci_recv_frame(hdev, skb); else ret = xport_data->recv_bt_frame(hdev, skb); out: if (ret) bt_dev_err(hdev, "upward frame with type (0x%02x) failed: %pe", pkt_type, ERR_PTR(ret)); return ret; } /* Every frame lands here first — the ideal spot for pre-processing. */ static int btqcom_recv_frame(struct hci_dev *hdev, struct sk_buff *skb) { u8 pkt_type = hci_skb_pkt_type(skb); switch (pkt_type) { case HCI_EVENT_PKT: case QPERI_EVENT_PKT: case HCI_ACLDATA_PKT: case QPERI_ACLDATA_PKT: break; default: dev_kfree_skb_irq(skb); bt_dev_err_ratelimited(hdev, "unexpected pkt type 0x%02x", pkt_type); return -EINVAL; } return btusb_upward_frame(hdev, skb); } /* * RX reassembly state, stashed in hci_skb_pkt_seqnum(skb) between calls: * QRX_STATE_INDICATOR - determining the packet type * QRX_STATE_HEADER - receiving the packet header * QRX_STATE_PAYLOAD - receiving the payload */ enum { QRX_STATE_INDICATOR, QRX_STATE_HEADER, QRX_STATE_PAYLOAD, }; /* * btusb_qcom_recv_intr - reassemble byte stream from the intr endpoint to frame * @hdev: the HCI device * @skb: the in-progress frame, or NULL to start a new one * @buffer: bytes received * @count: bytes count * @err: output error code * * See the RX flow diagram above for further dispatch. * * Return: the in-progress frame to resume on the next call, or NULL * otherwise. */ struct sk_buff *btusb_qcom_recv_intr(struct hci_dev *hdev, struct sk_buff *skb, void *buffer, int count, int *err) { struct btqcom_data *qbt_data = hci_get_priv(hdev); enum qbtc_category btc_cat = qbt_data->category; int rx_state; u8 pkt_type; int len; int res; *err = 0; while (count) { if (!skb) { u8 host_id = *(u8 *)buffer; skb = bt_skb_alloc(QPERI_MAX_EVENT_SIZE, GFP_ATOMIC); if (!skb) { *err = -ENOMEM; break; } /* see struct qperi_event_hdr for PERI event format */ if (host_id == QHCI_HOST_ID_BT) { hci_skb_pkt_type(skb) = QPERI_EVENT_PKT; hci_skb_pkt_seqnum(skb) = QRX_STATE_HEADER; hci_skb_expect(skb) = QPERI_EVENT_HDR_SIZE; } else { hci_skb_pkt_type(skb) = HCI_EVENT_PKT; hci_skb_pkt_seqnum(skb) = QRX_STATE_HEADER; hci_skb_expect(skb) = HCI_EVENT_HDR_SIZE; } } len = min_t(uint, hci_skb_expect(skb), count); skb_put_data(skb, buffer, len); count -= len; buffer += len; hci_skb_expect(skb) -= len; if (hci_skb_expect(skb)) continue; rx_state = hci_skb_pkt_seqnum(skb); if (rx_state == QRX_STATE_PAYLOAD) goto frame_done; hci_skb_pkt_seqnum(skb) = QRX_STATE_PAYLOAD; pkt_type = hci_skb_pkt_type(skb); if (pkt_type == QPERI_EVENT_PKT) hci_skb_expect(skb) = qperi_event_header(skb)->plen; else if (pkt_type == HCI_EVENT_PKT) hci_skb_expect(skb) = hci_event_hdr(skb)->plen; if (hci_skb_expect(skb)) continue; frame_done: if (count && count < HCI_EVENT_HDR_SIZE) { bt_dev_warn(hdev, "Unexpected continuation: %d bytes", count); if (btc_cat != QBTC_CAT_MSUBSYS) count = 0; } hci_skb_pkt_seqnum(skb) = 0; res = btqcom_recv_frame(hdev, skb); if (res) bt_dev_err_ratelimited(hdev, "recv intr frame failed: %pe", ERR_PTR(res)); skb = NULL; } return skb; } /* * btusb_qcom_recv_bulk - reassemble byte stream from the bulk endpoint to frame * @hdev: the HCI device * @skb: the in-progress frame, or NULL to start a new one * @buffer: bytes received * @count: bytes count * @err: output error code * * See the RX flow diagram above for further dispatch. * * Return: the in-progress frame to resume on the next call, or NULL * otherwise. */ struct sk_buff *btusb_qcom_recv_bulk(struct hci_dev *hdev, struct sk_buff *skb, void *buffer, int count, int *err) { struct qperi_acl_hdr *peri_hdr; u16 peri_handle; int rx_state; u8 pkt_type; int res; int len; *err = 0; while (count) { if (!skb) { skb = bt_skb_alloc(QPERI_MAX_FRAME_SIZE, GFP_ATOMIC); if (!skb) { *err = -ENOMEM; break; } hci_skb_pkt_seqnum(skb) = QRX_STATE_INDICATOR; hci_skb_expect(skb) = HCI_ACL_HDR_SIZE; } len = min_t(uint, hci_skb_expect(skb), count); skb_put_data(skb, buffer, len); count -= len; buffer += len; hci_skb_expect(skb) -= len; if (hci_skb_expect(skb)) continue; rx_state = hci_skb_pkt_seqnum(skb); switch (rx_state) { case QRX_STATE_INDICATOR: hci_skb_pkt_seqnum(skb) = QRX_STATE_HEADER; peri_hdr = qperi_acl_header(skb); peri_handle = qperi_acl_handle(skb); if (peri_hdr->host_id == QHCI_HOST_ID_BT && peri_handle >= 0xEC0 && peri_handle <= 0xECF) { hci_skb_pkt_type(skb) = QPERI_ACLDATA_PKT; hci_skb_expect(skb) = QPERI_ACL_HDR_SIZE - HCI_ACL_HDR_SIZE; continue; } hci_skb_pkt_type(skb) = HCI_ACLDATA_PKT; fallthrough; case QRX_STATE_HEADER: pkt_type = hci_skb_pkt_type(skb); if (pkt_type == QPERI_ACLDATA_PKT) hci_skb_expect(skb) = qperi_acl_dlen(skb); else if (pkt_type == HCI_ACLDATA_PKT) hci_skb_expect(skb) = hci_acl_dlen(skb); if (hci_skb_expect(skb) > QPERI_MAX_FRAME_SIZE - skb->len) { dev_kfree_skb_irq(skb); skb = NULL; *err = -EILSEQ; return NULL; } hci_skb_pkt_seqnum(skb) = QRX_STATE_PAYLOAD; if (hci_skb_expect(skb)) continue; fallthrough; case QRX_STATE_PAYLOAD: break; } hci_skb_pkt_seqnum(skb) = 0; res = btqcom_recv_frame(hdev, skb); if (res) bt_dev_err_ratelimited(hdev, "recv bulk frame failed: %pe", ERR_PTR(res)); skb = NULL; } return skb; } MODULE_AUTHOR("Zijun Hu ");