Bug 237083

Summary: [ubt] Init fails on Intel Wireless 8260/8265 (Thinkpad t480s and others)
Product: Base System Reporter: Alexander Sieg <ports>
Component: wirelessAssignee: Vladimir Kondratyev <wulf>
Status: Closed FIXED    
Severity: Affects Some People CC: 0mp, ae, amvandemore, bwidawsk, bz, contact, jlduran, jrm, nikola.lecic, tomek, wulf
Priority: --- Keywords: patch
Version: 12.0-STABLE   
Hardware: Any   
OS: Any   
See Also: https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=267581
Attachments:
Description Flags
block ng_ubt attachment if operational firmware is not downloaded yet
none
firmware downloader - kernel part (blocks ng_ubt attachment if firmware is not in operational state)
none
firmware downloader - userland part. downloader itself
none
firmware downloader - ports part. firmwares
none
firmware downloader - ports part. firmwares
none
firmware downloader - ports part. firmwares
koobs: maintainer-approval+
poudriere log of ports part none

Description Alexander Sieg 2019-04-07 20:56:48 UTC
When trying to start the bluetooth stack on a Thinkpad t480s with the Intel Dual Band Wireless-AC 8265: 2x2 Wi-Fi 802.11ac with MU-MIMO, Bluetooth 4.1 module.

ubt0 on uhub0
ubt0: <vendor 0x8087 product 0x0a2b, class 224/1, rev 2.00/0.10, addr 4> on usbus0
ubt0: ubt_ctrl_write_callback:782: control transfer failed: USB_ERR_TIMEOUT
ng_hci_process_command_timeout: ubt0hci - unable to complete HCI command OGF=0x3, OCF=0x3. Timeout
Comment 1 Alexander Sieg 2019-04-10 14:50:06 UTC
To provide  a bit more infomation.
FreeBSD 12.0-STABLE r346077 GENERIC 

usbconfig ugen0.5 dump_device_desc output:
ugen0.5: <vendor 0x8087 product 0x0a2b> at usbus0, cfg=0 md=HOST spd=FULL (12Mbps) pwr=ON (100mA)

  bLength = 0x0012 
  bDescriptorType = 0x0001 
  bcdUSB = 0x0200 
  bDeviceClass = 0x00e0  <Wireless controller>
  bDeviceSubClass = 0x0001 
  bDeviceProtocol = 0x0001 
  bMaxPacketSize0 = 0x0040 
  idVendor = 0x8087 
  idProduct = 0x0a2b 
  bcdDevice = 0x0010 
  iManufacturer = 0x0000  <no string>
  iProduct = 0x0000  <no string>
  iSerialNumber = 0x0000  <no string>
  bNumConfigurations = 0x0001
Comment 2 Bjoern A. Zeeb freebsd_committer freebsd_triage 2019-04-13 14:15:39 UTC
I can possibly go and have a look on Tuesday though I have never done BT on FreeBSD I have to admit. Is there a good list of things to run to reproduce this, or is it just loading the kernel module?
Comment 3 Alexander Sieg 2019-04-13 15:12:47 UTC
Just loading the kernel module will produce the error. And `service bluetooth start ubt0` will provide the same error.
Comment 4 Bjoern A. Zeeb freebsd_committer freebsd_triage 2019-04-15 22:17:35 UTC
Ok, confirmed; I'll go and have a look if no one else beats me to it (in which case please take the PR from me again).

Autoloading module: ng_ubt.ko
ubt0 on uhub1
ubt0: <vendor 0x8087 product 0x0a2b, class 224/1, rev 2.00/0.10, addr 3> on usbus0
Autoloading module: ng_ubt.ko
Autoloading module: ng_ubt.ko
Autoloading module: ng_ubt.ko
ubt0: ubt_ctrl_write_callback:782: control transfer failed: USB_ERR_TIMEOUT
ng_hci_process_command_timeout: ubt0hci - unable to complete HCI command OGF=0x3, OCF=0x3. Timeout
/etc/rc.d/bluetooth: ERROR: Unable to setup Bluetooth stack for device ubt0

# usbconfig -d 0.4 dump_device_desc
ugen0.4: <vendor 0x8087 product 0x0a2b> at usbus0, cfg=0 md=HOST spd=FULL (12Mbps) pwr=ON (100mA)

  bLength = 0x0012
  bDescriptorType = 0x0001
  bcdUSB = 0x0200
  bDeviceClass = 0x00e0  <Wireless controller>
  bDeviceSubClass = 0x0001
  bDeviceProtocol = 0x0001
  bMaxPacketSize0 = 0x0040
  idVendor = 0x8087
  idProduct = 0x0a2b
  bcdDevice = 0x0010
  iManufacturer = 0x0000  <no string>
  iProduct = 0x0000  <no string>
  iSerialNumber = 0x0000  <no string>
  bNumConfigurations = 0x0001
Comment 5 Bjoern A. Zeeb freebsd_committer freebsd_triage 2019-04-21 22:34:11 UTC
It seems the device needs a bit of extra driver to handle separate firmware.
Reset the bug to bugs@ as I am not sure if bluetooth people watch on wireless.

Some support from Intel on docs or a Dual/BSD Licensed source would help a lot here.
Comment 6 Vladimir Kondratyev freebsd_committer freebsd_triage 2019-04-28 23:24:22 UTC
> ubt0: <vendor 0x8087 product 0x0a2b, class 224/1, rev 2.00/0.10, addr 4>
This device requires firmware downloader to work.
I use this one: https://github.com/wulf7/iwmbt-firmware

Note: Execution of /etc/rc.d/bluetooth locks up bluetooth adapter hardly if firmware has not been downloaded yet and full power cycle is required to restore its state.
That means that downloader *must* always be run before first /etc/rc.d/bluetooth script execution.
Comment 7 Vladimir Kondratyev freebsd_committer freebsd_triage 2019-05-10 09:24:15 UTC
Created attachment 204303 [details]
block ng_ubt attachment if operational firmware is not downloaded yet

Safety belt to reduce chances of BT adapter lockup.
Not strictly necessary to download the firmware.
Comment 8 Nikola Lečić 2019-05-10 09:38:39 UTC
(In reply to Vladimir Kondratyev from comment #7)

Hi Vladimir,

I tried your code on Asus Zenbook 14 UX410UFR. After 'make install' and reboot:

ubt0 on uhub0
ubt0: <vendor 0x8087 product 0x0a2b, class 224/1, rev 2.00/0.10, addr 2> on usbus0
wlan0: Ethernet address: 50:76:af:0c:7e:f7
WARNING: attempt to domain_add(bluetooth) after domainfinalize()
WARNING: attempt to domain_add(netgraph) after domainfinalize()
wlan0: link state changed to UP
iwm0: frame 2/75 b800002c UNHANDLED (this should not happen)
Security policy loaded: MAC/ntpd (mac_ntpd)

[root@pers:/root]# iwmbtfw
USB Path: 08
Firmware downloading failed

And there is no ubt0 device. Am I missing something obvious?
Comment 9 Vladimir Kondratyev freebsd_committer freebsd_triage 2019-05-10 10:25:50 UTC
(In reply to Nikola Lečić from comment #8)
> Am I missing something obvious?
It is tricky to run downloader ATM due to bug in ng_ubt.c (it unconditionally starts SCO transfer that kills an BT adaptor)

Please try:

1. Comment out following lines in /etc/devd.conf:

# When a USB Bluetooth dongle appears, activate it
attach 100 {
        device-name "ubt[0-9]+";
        action "service bluetooth quietstart $device-name";
};

2. Do a full power off/on cycle. Just reboot is not enough to restore BT-adaptor!!!

3. # iwmbtfw

4. # service bluetooth start ubt0
Comment 10 Nikola Lečić 2019-05-10 10:51:36 UTC
(In reply to Vladimir Kondratyev from comment #9)

Thanks; this is what I got:

# iwmbtfw
USB Path: 08
ubt0: at uhub0, port 8, addr 2 (disconnected)
ubt0: detached
Done 0
iwm0: frame 3/47 b800002c UNHANDLED (this should not happen)
ubt0 on uhub0
ubt0: <vendor 0x8087 product 0x0a2b, class 244/1, rev 2.00/0.10, addr2> on usbus0
iwm0: frame 3/47 b800002c UNHANDLED (this should not happen)

# service bluetooth start ubt0
iwm0: frame 3/47 b800002c UNHANDLED (this should not happen)

Only (unrelated) iwm0 message; nothing else happens, no /dev/ubt0.
Comment 11 Vladimir Kondratyev freebsd_committer freebsd_triage 2019-05-10 11:01:27 UTC
(In reply to Nikola Lečić from comment #10)
ng_ubt is netgraph device, so no /dev/ubt0 should appear

Properly initialized bt device looks like:

# ngctl list
There are 9 total nodes:
  Name: ubt0            Type: ubt             ID: 00000001   Num hooks: 1
  Name: btsock_hci_raw  Type: btsock_hci_raw  ID: 00000002   Num hooks: 1
  Name: btsock_l2c_raw  Type: btsock_l2c_raw  ID: 00000003   Num hooks: 1
  Name: btsock_l2c      Type: btsock_l2c      ID: 00000004   Num hooks: 1
  Name: btsock_sco      Type: btsock_sco      ID: 00000005   Num hooks: 0
  Name: ubt0hci         Type: hci             ID: 00000007   Num hooks: 3
  Name: ubt0l2cap       Type: l2cap           ID: 0000000b   Num hooks: 3
  Name: wlan0           Type: ether           ID: 00000011   Num hooks: 0
  Name: ngctl11859      Type: socket          ID: 00000012   Num hooks: 0
Comment 12 Nikola Lečić 2019-05-10 11:04:43 UTC
(In reply to Vladimir Kondratyev from comment #11)

Ah, I see. In my case:

ngctl list
There are 8 total nodes:
  Name: ubt0l2cap       Type: l2cap           ID: 00000021   Num hooks: 3
  Name: btsock_hci_raw  Type: btsock_hci_raw  ID: 00000005   Num hooks: 1
  Name: btsock_l2c_raw  Type: btsock_l2c_raw  ID: 00000006   Num hooks: 1
  Name: ngctl1468       Type: socket          ID: 00000027   Num hooks: 0
  Name: btsock_l2c      Type: btsock_l2c      ID: 00000007   Num hooks: 1
  Name: btsock_sco      Type: btsock_sco      ID: 00000008   Num hooks: 0
  Name: ubt0            Type: ubt             ID: 0000001b   Num hooks: 1
  Name: ubt0hci         Type: hci             ID: 0000001d   Num hooks: 3

Looks good?
Comment 13 Vladimir Kondratyev freebsd_committer freebsd_triage 2019-05-10 11:13:40 UTC
(In reply to Nikola Lečić from comment #12)
> Looks good?
It looks initialized. So try 

# hccontrol Inquiry

and so on to start. bluetooth-config is worth a try too but it never works for me :-(
Comment 14 Nikola Lečić 2019-05-10 11:31:01 UTC
(In reply to Vladimir Kondratyev from comment #13)

Great, mouse paired, works as expected. After reboot and manual starting bluetooth, everything works again.

Владимир, спасибо огромное за код и за помощь. Всего доброго от московского соседа. :)
Comment 15 Vladimir Kondratyev freebsd_committer freebsd_triage 2019-06-27 22:04:32 UTC
Created attachment 205385 [details]
firmware downloader - kernel part (blocks ng_ubt attachment if firmware is not in operational state)
Comment 16 Vladimir Kondratyev freebsd_committer freebsd_triage 2019-06-27 22:05:59 UTC
Created attachment 205386 [details]
firmware downloader - userland part. downloader itself
Comment 17 Vladimir Kondratyev freebsd_committer freebsd_triage 2019-06-27 22:07:05 UTC
Created attachment 205387 [details]
firmware downloader - ports part. firmwares
Comment 18 Vladimir Kondratyev freebsd_committer freebsd_triage 2019-06-27 22:09:22 UTC
Created attachment 205388 [details]
firmware downloader - ports part. firmwares
Comment 19 Vladimir Kondratyev freebsd_committer freebsd_triage 2019-06-27 22:17:46 UTC
BSD-licensed port of btintel driver is uploaded above.

All 3 parts should be installed to work properly.
Kernel & userland patches are to be applied to src tree.
Ports patch - to ports tree.
Comment 20 amvandemore 2019-07-25 10:35:49 UTC
Works for me on 12-STABLE and:

iwm0@pci0:2:0:0:        class=0x028000 card=0x10108086 chip=0x24fd8086 rev=0x78 hdr=0x00
    vendor     = 'Intel Corporation'
    device     = 'Wireless 8265 / 8275'

This is good, thanks!  What needs to be done to get it committed?
Comment 21 Vladimir Kondratyev freebsd_committer freebsd_triage 2019-07-25 21:34:26 UTC
(In reply to amvandemore from comment #20)
> Works for me on 12-STABLE and:
> iwm0@pci0:2:0:0:        class=0x028000 card=0x10108086 chip=0x24fd8086 rev=0x78 > hdr=0x00
>    vendor     = 'Intel Corporation'
>    device     = 'Wireless 8265 / 8275'
Intel Wireless 8265 is a dual BT/WiFi combo. Lines above are related to WiFi part of it. To check BT part you should successfully execute any bluetooth command like 
`hccontrol Inquiry` or just make your BT device working.

> What needs to be done to get it committed?
It was delayed slightly due to one (hopefully, fixed) minor bug and parallel work on packaging of the bluetooth utilities and now is on the way to be committed:
https://reviews.freebsd.org/D21071
Comment 22 Kubilay Kocak freebsd_committer freebsd_triage 2019-08-14 07:35:58 UTC
@Vladimir Does the port pass QA (portlint, poudriere) ?

Other than that, one minor improvement:

- Add pkg-descr: WWW: https://packages.debian.org/firmware-iwlwifi (in addition to but prior to the existing WWW: URL) as this is the source of the firmware
Comment 23 Vladimir Kondratyev freebsd_committer freebsd_triage 2019-08-14 23:11:18 UTC
Created attachment 206565 [details]
firmware downloader - ports part. firmwares

WWW: https://packages.debian.org/firmware-iwlwifi added prior to the existing WWW: URL in pkg-descr file.
Port version bumped up to 20190717
Comment 24 Vladimir Kondratyev freebsd_committer freebsd_triage 2019-08-14 23:13:24 UTC
Created attachment 206566 [details]
poudriere log of ports part
Comment 25 Vladimir Kondratyev freebsd_committer freebsd_triage 2019-08-14 23:16:02 UTC
(In reply to Kubilay Kocak from comment #22)
> @Vladimir Does the port pass QA (portlint, poudriere) ?

Poudriere log is attached.

portlint output:
$ portlint -ACN                      
WARN: Makefile: using hyphen in PORTNAME. consider using PKGNAMEPREFIX and/or PKGNAMESUFFIX.
WARN: Consider to set DEVELOPER=yes in /etc/make.conf
0 fatal errors and 2 warnings found.

So I think it passes QA
Comment 26 Kubilay Kocak freebsd_committer freebsd_triage 2019-08-16 02:30:05 UTC
Comment on attachment 206565 [details]
firmware downloader - ports part. firmwares

PR: 237083
Reviewed by: koobs (ports)
Approved by: koobs (ports)
Comment 27 Andrey V. Elsukov freebsd_committer freebsd_triage 2019-08-16 09:30:29 UTC
Just a question - we have firmwares for iwm(4) in the base system, why it is impossible to have firmware for bt part in the base system too?
Comment 28 Vladimir Kondratyev freebsd_committer freebsd_triage 2019-08-16 20:33:48 UTC
(In reply to Andrey V. Elsukov from comment #27)

I am not a copyright lawyer and I don't know all the steps required to include firmwares into the base system legally. That is why I decided to ship them separately.

I wouldn't object if someone would go this way and would take required permissions.
Comment 29 commit-hook freebsd_committer freebsd_triage 2019-08-18 22:05:58 UTC
A commit references this bug:

Author: wulf
Date: Sun Aug 18 22:05:39 UTC 2019
New revision: 509242
URL: https://svnweb.freebsd.org/changeset/ports/509242

Log:
  New port:	comms/iwmbt-firmware

  Firmware for the Intel Wireless 8260/8265 chip based Bluetooth USB devices.
  To be downloaded with iwmbtfw(8).

  WWW: https://packages.debian.org/firmware-iwlwifi
  WWW: https://git.kernel.org/pub/scm/linux/kernel/git/firmware/linux-firmware.git

  PR:		237083
  Reviewed by:	koobs
  Approved by:	koobs

Changes:
  head/comms/Makefile
  head/comms/iwmbt-firmware/
  head/comms/iwmbt-firmware/Makefile
  head/comms/iwmbt-firmware/distinfo
  head/comms/iwmbt-firmware/pkg-descr
  head/comms/iwmbt-firmware/pkg-plist
Comment 30 commit-hook freebsd_committer freebsd_triage 2019-08-18 22:12:02 UTC
A commit references this bug:

Author: wulf
Date: Sun Aug 18 22:11:43 UTC 2019
New revision: 351196
URL: https://svnweb.freebsd.org/changeset/base/351196

Log:
  ng_ubt(4): do not attach Intel Wireless 8260/8265 in bootloader mode.

  Add helper function for synchronous execution of HCI commands at probe
  stage and use this function to check firmware state of Intel Wireless
  8260/8265 bluetooth devices found in many post 2016 year laptops.

  Attempt to initialize FreeBSD bluetooth stack while such a device is in
  bootloader mode locks the adapter hardly so it requires power on/off
  cycle to restore.

  This change blocks ng_ubt attachment unless operational firmware is
  loaded thus preventing the lock up.

  PR:			237083
  Reviewed by:		hps, emax
  MFC after:		2 weeks
  Differential Revision:	https://reviews.freebsd.org/D21071

Changes:
  head/sys/conf/files
  head/sys/modules/netgraph/bluetooth/ubt/Makefile
  head/sys/netgraph/bluetooth/drivers/ubt/ng_ubt.c
  head/sys/netgraph/bluetooth/drivers/ubt/ng_ubt_intel.c
  head/sys/netgraph/bluetooth/drivers/ubt/ng_ubt_var.h
Comment 31 commit-hook freebsd_committer freebsd_triage 2019-08-18 22:21:05 UTC
A commit references this bug:

Author: wulf
Date: Sun Aug 18 22:20:31 UTC 2019
New revision: 351197
URL: https://svnweb.freebsd.org/changeset/base/351197

Log:
  iwmbtfw: Firmware loader for Intel Wireless 8260 based Bluetooth USB devices

  Currently supported models are: 8260, 8265, 9560, 9260 and 22161.
  Firmware files can be installed with comms/iwmbt-firmware port.

  PR:			237083
  Reviewed by:		hps, emax
  X-MFC with:		r351196
  Differential Revision:	https://reviews.freebsd.org/D21071

Changes:
  head/targets/pseudo/userland/Makefile.depend
  head/tools/build/mk/OptionalObsoleteFiles.inc
  head/usr.sbin/bluetooth/Makefile
  head/usr.sbin/bluetooth/iwmbtfw/
  head/usr.sbin/bluetooth/iwmbtfw/Makefile
  head/usr.sbin/bluetooth/iwmbtfw/iwmbt_dbg.h
  head/usr.sbin/bluetooth/iwmbtfw/iwmbt_fw.c
  head/usr.sbin/bluetooth/iwmbtfw/iwmbt_fw.h
  head/usr.sbin/bluetooth/iwmbtfw/iwmbt_hw.c
  head/usr.sbin/bluetooth/iwmbtfw/iwmbt_hw.h
  head/usr.sbin/bluetooth/iwmbtfw/iwmbtfw.8
  head/usr.sbin/bluetooth/iwmbtfw/iwmbtfw.conf
  head/usr.sbin/bluetooth/iwmbtfw/main.c
Comment 32 commit-hook freebsd_committer freebsd_triage 2019-09-09 18:51:07 UTC
A commit references this bug:

Author: wulf
Date: Mon Sep  9 18:50:39 UTC 2019
New revision: 352101
URL: https://svnweb.freebsd.org/changeset/base/352101

Log:
  MFC r351196, r351324, r351326:

  ng_ubt(4): do not attach Intel Wireless 8260/8265 in bootloader mode.

  Add helper function for synchronous execution of HCI commands at probe
  stage and use this function to check firmware state of Intel Wireless
  8260/8265 bluetooth devices found in many post 2016 year laptops.

  Attempt to initialize FreeBSD bluetooth stack while such a device is in
  bootloader mode locks the adapter hardly so it requires power on/off
  cycle to restore.

  This change blocks ng_ubt attachment unless operational firmware is
  loaded thus preventing the lock up.

  PR:			237083
  Reviewed by:		hps, emax
  MFC after:		2 weeks
  Differential Revision:	https://reviews.freebsd.org/D21071

Changes:
_U  stable/12/
  stable/12/sys/conf/files
  stable/12/sys/modules/netgraph/bluetooth/ubt/Makefile
  stable/12/sys/netgraph/bluetooth/drivers/ubt/ng_ubt.c
  stable/12/sys/netgraph/bluetooth/drivers/ubt/ng_ubt_intel.c
  stable/12/sys/netgraph/bluetooth/drivers/ubt/ng_ubt_var.h
Comment 33 Joseph Mingrone freebsd_committer freebsd_triage 2019-09-09 18:57:46 UTC
Since core@ was added to CC: please provide more information if you think any action is needed by core.
Comment 34 commit-hook freebsd_committer freebsd_triage 2019-09-09 18:58:11 UTC
A commit references this bug:

Author: wulf
Date: Mon Sep  9 18:57:18 UTC 2019
New revision: 352102
URL: https://svnweb.freebsd.org/changeset/base/352102

Log:
  MFC r351197, r351199:

  iwmbtfw: Firmware loader for Intel Wireless 8260 based Bluetooth USB devices

  Currently supported models are: 8260, 8265, 9560, 9260 and 22161.
  Firmware files can be installed with comms/iwmbt-firmware port.

  PR:			237083
  Reviewed by:		hps, emax
  Differential Revision:	https://reviews.freebsd.org/D21071

Changes:
_U  stable/12/
  stable/12/targets/pseudo/userland/Makefile.depend
  stable/12/tools/build/mk/OptionalObsoleteFiles.inc
  stable/12/usr.sbin/bluetooth/Makefile
  stable/12/usr.sbin/bluetooth/iwmbtfw/
  stable/12/usr.sbin/bluetooth/iwmbtfw/Makefile
  stable/12/usr.sbin/bluetooth/iwmbtfw/iwmbt_hw.c
Comment 35 Vladimir Kondratyev freebsd_committer freebsd_triage 2019-09-09 19:11:33 UTC
(In reply to Joseph Mingrone from comment #33)
> Since core@ was added to CC: please provide more information if you think any action is needed by core.

I do not know why core@ was CC-ed
Comment 36 Evilham 2019-12-09 12:37:53 UTC
Hello, thank you for working on this.

I can confirm it works with latest 13-CURRENT perfectly fine and was just wondering: is this a reason why this isn't closed, seeing that the changes have been merged?
Comment 37 Vladimir Kondratyev freebsd_committer freebsd_triage 2019-12-11 09:53:21 UTC
> is this a reason why this isn't closed, seeing that the changes have been merged?

Close this. Thank you for reminder.
Comment 38 Tomasz "CeDeROM" CEDRO 2021-10-11 19:16:09 UTC
This helped me running Bluetooth adapter on Panasonic ToughBook CF-MX4. TANK U! :-)