2 * SPDX-License-Identifier: BSD-2-Clause-FreeBSD
4 * Copyright (c) 2013 Adrian Chadd <adrian@freebsd.org>
5 * Copyright (c) 2019 Vladimir Kondratyev <wulf@FreeBSD.org>
7 * Redistribution and use in source and binary forms, with or without
8 * modification, are permitted provided that the following conditions
10 * 1. Redistributions of source code must retain the above copyright
11 * notice, this list of conditions and the following disclaimer.
12 * 2. Redistributions in binary form must reproduce the above copyright
13 * notice, this list of conditions and the following disclaimer in the
14 * documentation and/or other materials provided with the distribution.
16 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
17 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
18 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
19 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
20 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
21 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
22 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
23 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
24 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
25 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
31 #include <sys/param.h>
33 #include <sys/endian.h>
48 #include "iwmbt_dbg.h"
50 #define _DEFAULT_IWMBT_FIRMWARE_PATH "/usr/share/firmware/intel"
52 int iwmbt_do_debug = 0;
53 int iwmbt_do_info = 0;
60 static struct iwmbt_devid iwmbt_list_72xx[] = {
62 /* Intel Wireless 7260/7265 and successors */
63 { .vendor_id = 0x8087, .product_id = 0x07dc },
64 { .vendor_id = 0x8087, .product_id = 0x0a2a },
65 { .vendor_id = 0x8087, .product_id = 0x0aa7 },
68 static struct iwmbt_devid iwmbt_list_82xx[] = {
70 /* Intel Wireless 8260/8265 and successors */
71 { .vendor_id = 0x8087, .product_id = 0x0a2b },
72 { .vendor_id = 0x8087, .product_id = 0x0aaa },
73 { .vendor_id = 0x8087, .product_id = 0x0025 },
74 { .vendor_id = 0x8087, .product_id = 0x0026 },
75 { .vendor_id = 0x8087, .product_id = 0x0029 },
79 iwmbt_is_7260(struct libusb_device_descriptor *d)
83 /* Search looking for whether it's an 7260/7265 */
84 for (i = 0; i < (int) nitems(iwmbt_list_72xx); i++) {
85 if ((iwmbt_list_72xx[i].product_id == d->idProduct) &&
86 (iwmbt_list_72xx[i].vendor_id == d->idVendor)) {
87 iwmbt_info("found 7260/7265");
97 iwmbt_is_8260(struct libusb_device_descriptor *d)
101 /* Search looking for whether it's an 8260/8265 */
102 for (i = 0; i < (int) nitems(iwmbt_list_82xx); i++) {
103 if ((iwmbt_list_82xx[i].product_id == d->idProduct) &&
104 (iwmbt_list_82xx[i].vendor_id == d->idVendor)) {
105 iwmbt_info("found 8260/8265");
114 static libusb_device *
115 iwmbt_find_device(libusb_context *ctx, int bus_id, int dev_id,
116 int *iwmbt_use_old_method)
118 libusb_device **list, *dev = NULL, *found = NULL;
119 struct libusb_device_descriptor d;
123 cnt = libusb_get_device_list(ctx, &list);
125 iwmbt_err("libusb_get_device_list() failed: code %lld",
126 (long long int) cnt);
131 * Scan through USB device list.
133 for (i = 0; i < cnt; i++) {
135 if (bus_id == libusb_get_bus_number(dev) &&
136 dev_id == libusb_get_device_address(dev)) {
137 /* Get the device descriptor for this device entry */
138 r = libusb_get_device_descriptor(dev, &d);
140 iwmbt_err("libusb_get_device_descriptor: %s",
145 /* Match on the vendor/product id */
146 if (iwmbt_is_7260(&d)) {
148 * Take a reference so it's not freed later on.
150 found = libusb_ref_device(dev);
151 *iwmbt_use_old_method = 1;
154 if (iwmbt_is_8260(&d)) {
156 * Take a reference so it's not freed later on.
158 found = libusb_ref_device(dev);
159 *iwmbt_use_old_method = 0;
165 libusb_free_device_list(list, 1);
170 iwmbt_dump_version(struct iwmbt_version *ver)
172 iwmbt_info("status 0x%02x", ver->status);
173 iwmbt_info("hw_platform 0x%02x", ver->hw_platform);
174 iwmbt_info("hw_variant 0x%02x", ver->hw_variant);
175 iwmbt_info("hw_revision 0x%02x", ver->hw_revision);
176 iwmbt_info("fw_variant 0x%02x", ver->fw_variant);
177 iwmbt_info("fw_revision 0x%02x", ver->fw_revision);
178 iwmbt_info("fw_build_num 0x%02x", ver->fw_build_num);
179 iwmbt_info("fw_build_ww 0x%02x", ver->fw_build_ww);
180 iwmbt_info("fw_build_yy 0x%02x", ver->fw_build_yy);
181 iwmbt_info("fw_patch_num 0x%02x", ver->fw_patch_num);
185 iwmbt_dump_boot_params(struct iwmbt_boot_params *params)
187 iwmbt_info("Device revision: %u", le16toh(params->dev_revid));
188 iwmbt_info("Secure Boot: %s", params->secure_boot ? "on" : "off");
189 iwmbt_info("OTP lock: %s", params->otp_lock ? "on" : "off");
190 iwmbt_info("API lock: %s", params->api_lock ? "on" : "off");
191 iwmbt_info("Debug lock: %s", params->debug_lock ? "on" : "off");
192 iwmbt_info("Minimum firmware build %u week %u year %u",
193 params->min_fw_build_nn,
194 params->min_fw_build_cw,
195 2000 + params->min_fw_build_yy);
196 iwmbt_info("OTC BD_ADDR: %02x:%02x:%02x:%02x:%02x:%02x",
197 params->otp_bdaddr[5],
198 params->otp_bdaddr[4],
199 params->otp_bdaddr[3],
200 params->otp_bdaddr[2],
201 params->otp_bdaddr[1],
202 params->otp_bdaddr[0]);
206 iwmbt_patch_firmware(libusb_device_handle *hdl, const char *firmware_path)
208 struct iwmbt_firmware fw;
211 iwmbt_debug("loading %s", firmware_path);
213 /* Read in the firmware */
214 if (iwmbt_fw_read(&fw, firmware_path) <= 0) {
215 iwmbt_debug("iwmbt_fw_read() failed");
219 /* Load in the firmware */
220 ret = iwmbt_patch_fwfile(hdl, &fw);
222 iwmbt_debug("Loading firmware file failed");
231 iwmbt_init_firmware(libusb_device_handle *hdl, const char *firmware_path,
232 uint32_t *boot_param)
234 struct iwmbt_firmware fw;
237 iwmbt_debug("loading %s", firmware_path);
239 /* Read in the firmware */
240 if (iwmbt_fw_read(&fw, firmware_path) <= 0) {
241 iwmbt_debug("iwmbt_fw_read() failed");
245 /* Load in the firmware */
246 ret = iwmbt_load_fwfile(hdl, &fw, boot_param);
248 iwmbt_debug("Loading firmware file failed");
257 iwmbt_init_ddc(libusb_device_handle *hdl, const char *ddc_path)
259 struct iwmbt_firmware ddc;
262 iwmbt_debug("loading %s", ddc_path);
264 /* Read in the DDC file */
265 if (iwmbt_fw_read(&ddc, ddc_path) <= 0) {
266 iwmbt_debug("iwmbt_fw_read() failed");
270 /* Load in the DDC file */
271 ret = iwmbt_load_ddc(hdl, &ddc);
273 iwmbt_debug("Loading DDC file failed");
282 * Parse ugen name and extract device's bus and address
286 parse_ugen_name(char const *ugen, uint8_t *bus, uint8_t *addr)
290 if (strncmp(ugen, "ugen", 4) != 0)
293 *bus = (uint8_t) strtoul(ugen + 4, &ep, 10);
297 *addr = (uint8_t) strtoul(ep + 1, &ep, 10);
308 "Usage: iwmbtfw (-D) -d ugenX.Y (-f firmware path) (-I)\n");
309 fprintf(stderr, " -D: enable debugging\n");
310 fprintf(stderr, " -d: device to operate upon\n");
311 fprintf(stderr, " -f: firmware path, if not default\n");
312 fprintf(stderr, " -I: enable informational output\n");
317 main(int argc, char *argv[])
319 libusb_context *ctx = NULL;
320 libusb_device *dev = NULL;
321 libusb_device_handle *hdl = NULL;
322 static struct iwmbt_version ver;
323 static struct iwmbt_boot_params params;
326 uint8_t bus_id = 0, dev_id = 0;
329 char *firmware_dir = NULL;
330 char *firmware_path = NULL;
332 int iwmbt_use_old_method = 0;
334 /* Parse command line arguments */
335 while ((n = getopt(argc, argv, "Dd:f:hIm:p:v:")) != -1) {
337 case 'd': /* ugen device name */
339 if (parse_ugen_name(optarg, &bus_id, &dev_id) < 0)
345 case 'f': /* firmware dir */
348 firmware_dir = strdup(optarg);
361 /* Ensure the devid was given! */
362 if (devid_set == 0) {
368 r = libusb_init(&ctx);
370 iwmbt_err("libusb_init failed: code %d", r);
374 iwmbt_debug("opening dev %d.%d", (int) bus_id, (int) dev_id);
376 /* Find a device based on the bus/dev id */
377 dev = iwmbt_find_device(ctx, bus_id, dev_id, &iwmbt_use_old_method);
379 iwmbt_err("device not found");
383 /* XXX enforce that bInterfaceNumber is 0 */
385 /* XXX enforce the device/product id if they're non-zero */
387 /* Grab device handle */
388 r = libusb_open(dev, &hdl);
390 iwmbt_err("libusb_open() failed: code %d", r);
394 /* Check if ng_ubt is attached */
395 r = libusb_kernel_driver_active(hdl, 0);
397 iwmbt_err("libusb_kernel_driver_active() failed: code %d", r);
401 iwmbt_info("Firmware has already been downloaded");
406 /* Get Intel version */
407 r = iwmbt_get_version(hdl, &ver);
409 iwmbt_debug("iwmbt_get_version() failed code %d", r);
412 iwmbt_dump_version(&ver);
413 iwmbt_debug("fw_variant=0x%02x", (int) ver.fw_variant);
415 if (iwmbt_use_old_method) {
417 /* fw_patch_num = >0 operational mode */
418 if (ver.fw_patch_num > 0x00) {
419 iwmbt_info("Firmware has already been downloaded");
424 /* Default the firmware path */
425 if (firmware_dir == NULL)
426 firmware_dir = strdup(_DEFAULT_IWMBT_FIRMWARE_PATH);
428 firmware_path = iwmbt_get_fwname(&ver, ¶ms, firmware_dir, "bseq");
429 if (firmware_path == NULL)
432 iwmbt_debug("firmware_path = %s", firmware_path);
434 /* Enter manufacturer mode */
435 r = iwmbt_enter_manufacturer(hdl);
437 iwmbt_debug("iwmbt_enter_manufacturer() failed code %d", r);
441 /* Download firmware and parse it for magic Intel Reset parameter */
442 r = iwmbt_patch_firmware(hdl, firmware_path);
445 (void)iwmbt_exit_manufacturer(hdl, 0x01);
449 iwmbt_info("Firmware download complete");
451 /* Exit manufacturer mode */
452 r = iwmbt_exit_manufacturer(hdl, r == 0 ? 0x00 : 0x02);
454 iwmbt_debug("iwmbt_exit_manufacturer() failed code %d", r);
458 /* Once device is running in operational mode we can ignore failures */
461 /* Execute Read Intel Version one more time */
462 r = iwmbt_get_version(hdl, &ver);
464 iwmbt_dump_version(&ver);
466 /* Set Intel Event mask */
467 if (iwmbt_enter_manufacturer(hdl) < 0)
469 r = iwmbt_set_event_mask(hdl);
471 iwmbt_info("Intel Event Mask is set");
472 (void)iwmbt_exit_manufacturer(hdl, 0x00);
476 /* fw_variant = 0x06 bootloader mode / 0x23 operational mode */
477 if (ver.fw_variant == 0x23) {
478 iwmbt_info("Firmware has already been downloaded");
483 if (ver.fw_variant != 0x06){
484 iwmbt_err("unknown fw_variant 0x%02x", (int) ver.fw_variant);
488 /* Read Intel Secure Boot Params */
489 r = iwmbt_get_boot_params(hdl, ¶ms);
491 iwmbt_debug("iwmbt_get_boot_params() failed!");
494 iwmbt_dump_boot_params(¶ms);
496 /* Check if firmware fragments are ACKed with a cmd complete event */
497 if (params.limited_cce != 0x00) {
498 iwmbt_err("Unsupported Intel firmware loading method (%u)",
503 /* Default the firmware path */
504 if (firmware_dir == NULL)
505 firmware_dir = strdup(_DEFAULT_IWMBT_FIRMWARE_PATH);
507 firmware_path = iwmbt_get_fwname(&ver, ¶ms, firmware_dir, "sfi");
508 if (firmware_path == NULL)
511 iwmbt_debug("firmware_path = %s", firmware_path);
513 /* Download firmware and parse it for magic Intel Reset parameter */
514 r = iwmbt_init_firmware(hdl, firmware_path, &boot_param);
519 iwmbt_info("Firmware download complete");
521 r = iwmbt_intel_reset(hdl, boot_param);
523 iwmbt_debug("iwmbt_intel_reset() failed!");
527 iwmbt_info("Firmware operational");
529 /* Once device is running in operational mode we can ignore failures */
532 /* Execute Read Intel Version one more time */
533 r = iwmbt_get_version(hdl, &ver);
535 iwmbt_dump_version(&ver);
537 /* Apply the device configuration (DDC) parameters */
538 firmware_path = iwmbt_get_fwname(&ver, ¶ms, firmware_dir, "ddc");
539 iwmbt_debug("ddc_path = %s", firmware_path);
540 if (firmware_path != NULL) {
541 r = iwmbt_init_ddc(hdl, firmware_path);
543 iwmbt_info("DDC download complete");
547 /* Set Intel Event mask */
548 r = iwmbt_set_event_mask(hdl);
550 iwmbt_info("Intel Event Mask is set");
555 /* Ask kernel driver to probe and attach device again */
556 r = libusb_reset_device(hdl);
558 iwmbt_err("libusb_reset_device() failed: %s",
569 libusb_unref_device(dev);
575 iwmbt_info("Firmware download is succesful!");
577 iwmbt_err("Firmware download failed!");