drivers/bluetooth/btintel.c

   1 // SPDX-License-Identifier: GPL-2.0-or-later
   2 /*
   3  *
   4  *  Bluetooth support for Intel devices
   5  *
   6  *  Copyright (C) 2015  Intel Corporation
   7  */
   8
   9 #include <linux/module.h>
  10 #include <linux/firmware.h>
  11 #include <linux/regmap.h>
  12 #include <asm/unaligned.h>
  13
  14 #include <net/bluetooth/bluetooth.h>
  15 #include <net/bluetooth/hci_core.h>
  16
  17 #include "btintel.h"
  18
  19 #define VERSION "0.1"
  20
  21 #define BDADDR_INTEL            (&(bdaddr_t){{0x00, 0x8b, 0x9e, 0x19, 0x03, 0x00}})
  22 #define RSA_HEADER_LEN          644
  23 #define CSS_HEADER_OFFSET       8
  24 #define ECDSA_OFFSET            644
  25 #define ECDSA_HEADER_LEN        320
  26
  27 #define CMD_WRITE_BOOT_PARAMS   0xfc0e
  28 struct cmd_write_boot_params {
  29         u32 boot_addr;
  30         u8  fw_build_num;
  31         u8  fw_build_ww;
  32         u8  fw_build_yy;
  33 } __packed;
  34
  35 int btintel_check_bdaddr(struct hci_dev *hdev)
  36 {
  37         struct hci_rp_read_bd_addr *bda;
  38         struct sk_buff *skb;
  39
  40         skb = __hci_cmd_sync(hdev, HCI_OP_READ_BD_ADDR, 0, NULL,
  41                              HCI_INIT_TIMEOUT);
  42         if (IS_ERR(skb)) {
  43                 int err = PTR_ERR(skb);
  44                 bt_dev_err(hdev, "Reading Intel device address failed (%d)",
  45                            err);
  46                 return err;
  47         }
  48
  49         if (skb->len != sizeof(*bda)) {
  50                 bt_dev_err(hdev, "Intel device address length mismatch");
  51                 kfree_skb(skb);
  52                 return -EIO;
  53         }
  54
  55         bda = (struct hci_rp_read_bd_addr *)skb->data;
  56
  57         /* For some Intel based controllers, the default Bluetooth device
  58          * address 00:03:19:9E:8B:00 can be found. These controllers are
  59          * fully operational, but have the danger of duplicate addresses
  60          * and that in turn can cause problems with Bluetooth operation.
  61          */
  62         if (!bacmp(&bda->bdaddr, BDADDR_INTEL)) {
  63                 bt_dev_err(hdev, "Found Intel default device address (%pMR)",
  64                            &bda->bdaddr);
  65                 set_bit(HCI_QUIRK_INVALID_BDADDR, &hdev->quirks);
  66         }
  67
  68         kfree_skb(skb);
  69
  70         return 0;
  71 }
  72 EXPORT_SYMBOL_GPL(btintel_check_bdaddr);
  73
  74 int btintel_enter_mfg(struct hci_dev *hdev)
  75 {
  76         static const u8 param[] = { 0x01, 0x00 };
  77         struct sk_buff *skb;
  78
  79         skb = __hci_cmd_sync(hdev, 0xfc11, 2, param, HCI_CMD_TIMEOUT);
  80         if (IS_ERR(skb)) {
  81                 bt_dev_err(hdev, "Entering manufacturer mode failed (%ld)",
  82                            PTR_ERR(skb));
  83                 return PTR_ERR(skb);
  84         }
  85         kfree_skb(skb);
  86
  87         return 0;
  88 }
  89 EXPORT_SYMBOL_GPL(btintel_enter_mfg);
  90
  91 int btintel_exit_mfg(struct hci_dev *hdev, bool reset, bool patched)
  92 {
  93         u8 param[] = { 0x00, 0x00 };
  94         struct sk_buff *skb;
  95
  96         /* The 2nd command parameter specifies the manufacturing exit method:
  97          * 0x00: Just disable the manufacturing mode (0x00).
  98          * 0x01: Disable manufacturing mode and reset with patches deactivated.
  99          * 0x02: Disable manufacturing mode and reset with patches activated.
 100          */
 101         if (reset)
 102                 param[1] |= patched ? 0x02 : 0x01;
 103
 104         skb = __hci_cmd_sync(hdev, 0xfc11, 2, param, HCI_CMD_TIMEOUT);
 105         if (IS_ERR(skb)) {
 106                 bt_dev_err(hdev, "Exiting manufacturer mode failed (%ld)",
 107                            PTR_ERR(skb));
 108                 return PTR_ERR(skb);
 109         }
 110         kfree_skb(skb);
 111
 112         return 0;
 113 }
 114 EXPORT_SYMBOL_GPL(btintel_exit_mfg);
 115
 116 int btintel_set_bdaddr(struct hci_dev *hdev, const bdaddr_t *bdaddr)
 117 {
 118         struct sk_buff *skb;
 119         int err;
 120
 121         skb = __hci_cmd_sync(hdev, 0xfc31, 6, bdaddr, HCI_INIT_TIMEOUT);
 122         if (IS_ERR(skb)) {
 123                 err = PTR_ERR(skb);
 124                 bt_dev_err(hdev, "Changing Intel device address failed (%d)",
 125                            err);
 126                 return err;
 127         }
 128         kfree_skb(skb);
 129
 130         return 0;
 131 }
 132 EXPORT_SYMBOL_GPL(btintel_set_bdaddr);
 133
 134 static int btintel_set_event_mask(struct hci_dev *hdev, bool debug)
 135 {
 136         u8 mask[8] = { 0x87, 0x0c, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 };
 137         struct sk_buff *skb;
 138         int err;
 139
 140         if (debug)
 141                 mask[1] |= 0x62;
 142
 143         skb = __hci_cmd_sync(hdev, 0xfc52, 8, mask, HCI_INIT_TIMEOUT);
 144         if (IS_ERR(skb)) {
 145                 err = PTR_ERR(skb);
 146                 bt_dev_err(hdev, "Setting Intel event mask failed (%d)", err);
 147                 return err;
 148         }
 149         kfree_skb(skb);
 150
 151         return 0;
 152 }
 153
 154 int btintel_set_diag(struct hci_dev *hdev, bool enable)
 155 {
 156         struct sk_buff *skb;
 157         u8 param[3];
 158         int err;
 159
 160         if (enable) {
 161                 param[0] = 0x03;
 162                 param[1] = 0x03;
 163                 param[2] = 0x03;
 164         } else {
 165                 param[0] = 0x00;
 166                 param[1] = 0x00;
 167                 param[2] = 0x00;
 168         }
 169
 170         skb = __hci_cmd_sync(hdev, 0xfc43, 3, param, HCI_INIT_TIMEOUT);
 171         if (IS_ERR(skb)) {
 172                 err = PTR_ERR(skb);
 173                 if (err == -ENODATA)
 174                         goto done;
 175                 bt_dev_err(hdev, "Changing Intel diagnostic mode failed (%d)",
 176                            err);
 177                 return err;
 178         }
 179         kfree_skb(skb);
 180
 181 done:
 182         btintel_set_event_mask(hdev, enable);
 183         return 0;
 184 }
 185 EXPORT_SYMBOL_GPL(btintel_set_diag);
 186
 187 static int btintel_set_diag_mfg(struct hci_dev *hdev, bool enable)
 188 {
 189         int err, ret;
 190
 191         err = btintel_enter_mfg(hdev);
 192         if (err)
 193                 return err;
 194
 195         ret = btintel_set_diag(hdev, enable);
 196
 197         err = btintel_exit_mfg(hdev, false, false);
 198         if (err)
 199                 return err;
 200
 201         return ret;
 202 }
 203
 204 static int btintel_set_diag_combined(struct hci_dev *hdev, bool enable)
 205 {
 206         int ret;
 207
 208         /* Legacy ROM device needs to be in the manufacturer mode to apply
 209          * diagnostic setting
 210          *
 211          * This flag is set after reading the Intel version.
 212          */
 213         if (btintel_test_flag(hdev, INTEL_ROM_LEGACY))
 214                 ret = btintel_set_diag_mfg(hdev, enable);
 215         else
 216                 ret = btintel_set_diag(hdev, enable);
 217
 218         return ret;
 219 }
 220
 221 static void btintel_hw_error(struct hci_dev *hdev, u8 code)
 222 {
 223         struct sk_buff *skb;
 224         u8 type = 0x00;
 225
 226         bt_dev_err(hdev, "Hardware error 0x%2.2x", code);
 227
 228         skb = __hci_cmd_sync(hdev, HCI_OP_RESET, 0, NULL, HCI_INIT_TIMEOUT);
 229         if (IS_ERR(skb)) {
 230                 bt_dev_err(hdev, "Reset after hardware error failed (%ld)",
 231                            PTR_ERR(skb));
 232                 return;
 233         }
 234         kfree_skb(skb);
 235
 236         skb = __hci_cmd_sync(hdev, 0xfc22, 1, &type, HCI_INIT_TIMEOUT);
 237         if (IS_ERR(skb)) {
 238                 bt_dev_err(hdev, "Retrieving Intel exception info failed (%ld)",
 239                            PTR_ERR(skb));
 240                 return;
 241         }
 242
 243         if (skb->len != 13) {
 244                 bt_dev_err(hdev, "Exception info size mismatch");
 245                 kfree_skb(skb);
 246                 return;
 247         }
 248
 249         bt_dev_err(hdev, "Exception info %s", (char *)(skb->data + 1));
 250
 251         kfree_skb(skb);
 252 }
 253
 254 int btintel_version_info(struct hci_dev *hdev, struct intel_version *ver)
 255 {
 256         const char *variant;
 257
 258         /* The hardware platform number has a fixed value of 0x37 and
 259          * for now only accept this single value.
 260          */
 261         if (ver->hw_platform != 0x37) {
 262                 bt_dev_err(hdev, "Unsupported Intel hardware platform (%u)",
 263                            ver->hw_platform);
 264                 return -EINVAL;
 265         }
 266
 267         /* Check for supported iBT hardware variants of this firmware
 268          * loading method.
 269          *
 270          * This check has been put in place to ensure correct forward
 271          * compatibility options when newer hardware variants come along.
 272          */
 273         switch (ver->hw_variant) {
 274         case 0x07:      /* WP - Legacy ROM */
 275         case 0x08:      /* StP - Legacy ROM */
 276         case 0x0b:      /* SfP */
 277         case 0x0c:      /* WsP */
 278         case 0x11:      /* JfP */
 279         case 0x12:      /* ThP */
 280         case 0x13:      /* HrP */
 281         case 0x14:      /* CcP */
 282                 break;
 283         default:
 284                 bt_dev_err(hdev, "Unsupported Intel hardware variant (%u)",
 285                            ver->hw_variant);
 286                 return -EINVAL;
 287         }
 288
 289         switch (ver->fw_variant) {
 290         case 0x01:
 291                 variant = "Legacy ROM 2.5";
 292                 break;
 293         case 0x06:
 294                 variant = "Bootloader";
 295                 break;
 296         case 0x22:
 297                 variant = "Legacy ROM 2.x";
 298                 break;
 299         case 0x23:
 300                 variant = "Firmware";
 301                 break;
 302         default:
 303                 bt_dev_err(hdev, "Unsupported firmware variant(%02x)", ver->fw_variant);
 304                 return -EINVAL;
 305         }
 306
 307         bt_dev_info(hdev, "%s revision %u.%u build %u week %u %u",
 308                     variant, ver->fw_revision >> 4, ver->fw_revision & 0x0f,
 309                     ver->fw_build_num, ver->fw_build_ww,
 310                     2000 + ver->fw_build_yy);
 311
 312         return 0;
 313 }
 314 EXPORT_SYMBOL_GPL(btintel_version_info);
 315
 316 static int btintel_secure_send(struct hci_dev *hdev, u8 fragment_type, u32 plen,
 317                                const void *param)
 318 {
 319         while (plen > 0) {
 320                 struct sk_buff *skb;
 321                 u8 cmd_param[253], fragment_len = (plen > 252) ? 252 : plen;
 322
 323                 cmd_param[0] = fragment_type;
 324                 memcpy(cmd_param + 1, param, fragment_len);
 325
 326                 skb = __hci_cmd_sync(hdev, 0xfc09, fragment_len + 1,
 327                                      cmd_param, HCI_INIT_TIMEOUT);
 328                 if (IS_ERR(skb))
 329                         return PTR_ERR(skb);
 330
 331                 kfree_skb(skb);
 332
 333                 plen -= fragment_len;
 334                 param += fragment_len;
 335         }
 336
 337         return 0;
 338 }
 339
 340 int btintel_load_ddc_config(struct hci_dev *hdev, const char *ddc_name)
 341 {
 342         const struct firmware *fw;
 343         struct sk_buff *skb;
 344         const u8 *fw_ptr;
 345         int err;
 346
 347         err = request_firmware_direct(&fw, ddc_name, &hdev->dev);
 348         if (err < 0) {
 349                 bt_dev_err(hdev, "Failed to load Intel DDC file %s (%d)",
 350                            ddc_name, err);
 351                 return err;
 352         }
 353
 354         bt_dev_info(hdev, "Found Intel DDC parameters: %s", ddc_name);
 355
 356         fw_ptr = fw->data;
 357
 358         /* DDC file contains one or more DDC structure which has
 359          * Length (1 byte), DDC ID (2 bytes), and DDC value (Length - 2).
 360          */
 361         while (fw->size > fw_ptr - fw->data) {
 362                 u8 cmd_plen = fw_ptr[0] + sizeof(u8);
 363
 364                 skb = __hci_cmd_sync(hdev, 0xfc8b, cmd_plen, fw_ptr,
 365                                      HCI_INIT_TIMEOUT);
 366                 if (IS_ERR(skb)) {
 367                         bt_dev_err(hdev, "Failed to send Intel_Write_DDC (%ld)",
 368                                    PTR_ERR(skb));
 369                         release_firmware(fw);
 370                         return PTR_ERR(skb);
 371                 }
 372
 373                 fw_ptr += cmd_plen;
 374                 kfree_skb(skb);
 375         }
 376
 377         release_firmware(fw);
 378
 379         bt_dev_info(hdev, "Applying Intel DDC parameters completed");
 380
 381         return 0;
 382 }
 383 EXPORT_SYMBOL_GPL(btintel_load_ddc_config);
 384
 385 int btintel_set_event_mask_mfg(struct hci_dev *hdev, bool debug)
 386 {
 387         int err, ret;
 388
 389         err = btintel_enter_mfg(hdev);
 390         if (err)
 391                 return err;
 392
 393         ret = btintel_set_event_mask(hdev, debug);
 394
 395         err = btintel_exit_mfg(hdev, false, false);
 396         if (err)
 397                 return err;
 398
 399         return ret;
 400 }
 401 EXPORT_SYMBOL_GPL(btintel_set_event_mask_mfg);
 402
 403 int btintel_read_version(struct hci_dev *hdev, struct intel_version *ver)
 404 {
 405         struct sk_buff *skb;
 406
 407         skb = __hci_cmd_sync(hdev, 0xfc05, 0, NULL, HCI_CMD_TIMEOUT);
 408         if (IS_ERR(skb)) {
 409                 bt_dev_err(hdev, "Reading Intel version information failed (%ld)",
 410                            PTR_ERR(skb));
 411                 return PTR_ERR(skb);
 412         }
 413
 414         if (skb->len != sizeof(*ver)) {
 415                 bt_dev_err(hdev, "Intel version event size mismatch");
 416                 kfree_skb(skb);
 417                 return -EILSEQ;
 418         }
 419
 420         memcpy(ver, skb->data, sizeof(*ver));
 421
 422         kfree_skb(skb);
 423
 424         return 0;
 425 }
 426 EXPORT_SYMBOL_GPL(btintel_read_version);
 427
 428 static int btintel_version_info_tlv(struct hci_dev *hdev,
 429                                     struct intel_version_tlv *version)
 430 {
 431         const char *variant;
 432
 433         /* The hardware platform number has a fixed value of 0x37 and
 434          * for now only accept this single value.
 435          */
 436         if (INTEL_HW_PLATFORM(version->cnvi_bt) != 0x37) {
 437                 bt_dev_err(hdev, "Unsupported Intel hardware platform (0x%2x)",
 438                            INTEL_HW_PLATFORM(version->cnvi_bt));
 439                 return -EINVAL;
 440         }
 441
 442         /* Check for supported iBT hardware variants of this firmware
 443          * loading method.
 444          *
 445          * This check has been put in place to ensure correct forward
 446          * compatibility options when newer hardware variants come along.
 447          */
 448         switch (INTEL_HW_VARIANT(version->cnvi_bt)) {
 449         case 0x17:      /* TyP */
 450         case 0x18:      /* Slr */
 451         case 0x19:      /* Slr-F */
 452                 break;
 453         default:
 454                 bt_dev_err(hdev, "Unsupported Intel hardware variant (0x%x)",
 455                            INTEL_HW_VARIANT(version->cnvi_bt));
 456                 return -EINVAL;
 457         }
 458
 459         switch (version->img_type) {
 460         case 0x01:
 461                 variant = "Bootloader";
 462                 /* It is required that every single firmware fragment is acknowledged
 463                  * with a command complete event. If the boot parameters indicate
 464                  * that this bootloader does not send them, then abort the setup.
 465                  */
 466                 if (version->limited_cce != 0x00) {
 467                         bt_dev_err(hdev, "Unsupported Intel firmware loading method (0x%x)",
 468                                    version->limited_cce);
 469                         return -EINVAL;
 470                 }
 471
 472                 /* Secure boot engine type should be either 1 (ECDSA) or 0 (RSA) */
 473                 if (version->sbe_type > 0x01) {
 474                         bt_dev_err(hdev, "Unsupported Intel secure boot engine type (0x%x)",
 475                                    version->sbe_type);
 476                         return -EINVAL;
 477                 }
 478
 479                 bt_dev_info(hdev, "Device revision is %u", version->dev_rev_id);
 480                 bt_dev_info(hdev, "Secure boot is %s",
 481                             version->secure_boot ? "enabled" : "disabled");
 482                 bt_dev_info(hdev, "OTP lock is %s",
 483                             version->otp_lock ? "enabled" : "disabled");
 484                 bt_dev_info(hdev, "API lock is %s",
 485                             version->api_lock ? "enabled" : "disabled");
 486                 bt_dev_info(hdev, "Debug lock is %s",
 487                             version->debug_lock ? "enabled" : "disabled");
 488                 bt_dev_info(hdev, "Minimum firmware build %u week %u %u",
 489                             version->min_fw_build_nn, version->min_fw_build_cw,
 490                             2000 + version->min_fw_build_yy);
 491                 break;
 492         case 0x03:
 493                 variant = "Firmware";
 494                 break;
 495         default:
 496                 bt_dev_err(hdev, "Unsupported image type(%02x)", version->img_type);
 497                 return -EINVAL;
 498         }
 499
 500         bt_dev_info(hdev, "%s timestamp %u.%u buildtype %u build %u", variant,
 501                     2000 + (version->timestamp >> 8), version->timestamp & 0xff,
 502                     version->build_type, version->build_num);
 503
 504         return 0;
 505 }
 506
 507 static int btintel_parse_version_tlv(struct hci_dev *hdev,
 508                                      struct intel_version_tlv *version,
 509                                      struct sk_buff *skb)
 510 {
 511         /* Consume Command Complete Status field */
 512         skb_pull(skb, 1);
 513
 514         /* Event parameters contatin multiple TLVs. Read each of them
 515          * and only keep the required data. Also, it use existing legacy
 516          * version field like hw_platform, hw_variant, and fw_variant
 517          * to keep the existing setup flow
 518          */
 519         while (skb->len) {
 520                 struct intel_tlv *tlv;
 521
 522                 /* Make sure skb has a minimum length of the header */
 523                 if (skb->len < sizeof(*tlv))
 524                         return -EINVAL;
 525
 526                 tlv = (struct intel_tlv *)skb->data;
 527
 528                 /* Make sure skb has a enough data */
 529                 if (skb->len < tlv->len + sizeof(*tlv))
 530                         return -EINVAL;
 531
 532                 switch (tlv->type) {
 533                 case INTEL_TLV_CNVI_TOP:
 534                         version->cnvi_top = get_unaligned_le32(tlv->val);
 535                         break;
 536                 case INTEL_TLV_CNVR_TOP:
 537                         version->cnvr_top = get_unaligned_le32(tlv->val);
 538                         break;
 539                 case INTEL_TLV_CNVI_BT:
 540                         version->cnvi_bt = get_unaligned_le32(tlv->val);
 541                         break;
 542                 case INTEL_TLV_CNVR_BT:
 543                         version->cnvr_bt = get_unaligned_le32(tlv->val);
 544                         break;
 545                 case INTEL_TLV_DEV_REV_ID:
 546                         version->dev_rev_id = get_unaligned_le16(tlv->val);
 547                         break;
 548                 case INTEL_TLV_IMAGE_TYPE:
 549                         version->img_type = tlv->val[0];
 550                         break;
 551                 case INTEL_TLV_TIME_STAMP:
 552                         /* If image type is Operational firmware (0x03), then
 553                          * running FW Calendar Week and Year information can
 554                          * be extracted from Timestamp information
 555                          */
 556                         version->min_fw_build_cw = tlv->val[0];
 557                         version->min_fw_build_yy = tlv->val[1];
 558                         version->timestamp = get_unaligned_le16(tlv->val);
 559                         break;
 560                 case INTEL_TLV_BUILD_TYPE:
 561                         version->build_type = tlv->val[0];
 562                         break;
 563                 case INTEL_TLV_BUILD_NUM:
 564                         /* If image type is Operational firmware (0x03), then
 565                          * running FW build number can be extracted from the
 566                          * Build information
 567                          */
 568                         version->min_fw_build_nn = tlv->val[0];
 569                         version->build_num = get_unaligned_le32(tlv->val);
 570                         break;
 571                 case INTEL_TLV_SECURE_BOOT:
 572                         version->secure_boot = tlv->val[0];
 573                         break;
 574                 case INTEL_TLV_OTP_LOCK:
 575                         version->otp_lock = tlv->val[0];
 576                         break;
 577                 case INTEL_TLV_API_LOCK:
 578                         version->api_lock = tlv->val[0];
 579                         break;
 580                 case INTEL_TLV_DEBUG_LOCK:
 581                         version->debug_lock = tlv->val[0];
 582                         break;
 583                 case INTEL_TLV_MIN_FW:
 584                         version->min_fw_build_nn = tlv->val[0];
 585                         version->min_fw_build_cw = tlv->val[1];
 586                         version->min_fw_build_yy = tlv->val[2];
 587                         break;
 588                 case INTEL_TLV_LIMITED_CCE:
 589                         version->limited_cce = tlv->val[0];
 590                         break;
 591                 case INTEL_TLV_SBE_TYPE:
 592                         version->sbe_type = tlv->val[0];
 593                         break;
 594                 case INTEL_TLV_OTP_BDADDR:
 595                         memcpy(&version->otp_bd_addr, tlv->val,
 596                                                         sizeof(bdaddr_t));
 597                         break;
 598                 default:
 599                         /* Ignore rest of information */
 600                         break;
 601                 }
 602                 /* consume the current tlv and move to next*/
 603                 skb_pull(skb, tlv->len + sizeof(*tlv));
 604         }
 605
 606         return 0;
 607 }
 608
 609 static int btintel_read_version_tlv(struct hci_dev *hdev,
 610                                     struct intel_version_tlv *version)
 611 {
 612         struct sk_buff *skb;
 613         const u8 param[1] = { 0xFF };
 614
 615         if (!version)
 616                 return -EINVAL;
 617
 618         skb = __hci_cmd_sync(hdev, 0xfc05, 1, param, HCI_CMD_TIMEOUT);
 619         if (IS_ERR(skb)) {
 620                 bt_dev_err(hdev, "Reading Intel version information failed (%ld)",
 621                            PTR_ERR(skb));
 622                 return PTR_ERR(skb);
 623         }
 624
 625         if (skb->data[0]) {
 626                 bt_dev_err(hdev, "Intel Read Version command failed (%02x)",
 627                            skb->data[0]);
 628                 kfree_skb(skb);
 629                 return -EIO;
 630         }
 631
 632         btintel_parse_version_tlv(hdev, version, skb);
 633
 634         kfree_skb(skb);
 635         return 0;
 636 }
 637
 638 /* ------- REGMAP IBT SUPPORT ------- */
 639
 640 #define IBT_REG_MODE_8BIT  0x00
 641 #define IBT_REG_MODE_16BIT 0x01
 642 #define IBT_REG_MODE_32BIT 0x02
 643
 644 struct regmap_ibt_context {
 645         struct hci_dev *hdev;
 646         __u16 op_write;
 647         __u16 op_read;
 648 };
 649
 650 struct ibt_cp_reg_access {
 651         __le32  addr;
 652         __u8    mode;
 653         __u8    len;
 654         __u8    data[];
 655 } __packed;
 656
 657 struct ibt_rp_reg_access {
 658         __u8    status;
 659         __le32  addr;
 660         __u8    data[];
 661 } __packed;
 662
 663 static int regmap_ibt_read(void *context, const void *addr, size_t reg_size,
 664                            void *val, size_t val_size)
 665 {
 666         struct regmap_ibt_context *ctx = context;
 667         struct ibt_cp_reg_access cp;
 668         struct ibt_rp_reg_access *rp;
 669         struct sk_buff *skb;
 670         int err = 0;
 671
 672         if (reg_size != sizeof(__le32))
 673                 return -EINVAL;
 674
 675         switch (val_size) {
 676         case 1:
 677                 cp.mode = IBT_REG_MODE_8BIT;
 678                 break;
 679         case 2:
 680                 cp.mode = IBT_REG_MODE_16BIT;
 681                 break;
 682         case 4:
 683                 cp.mode = IBT_REG_MODE_32BIT;
 684                 break;
 685         default:
 686                 return -EINVAL;
 687         }
 688
 689         /* regmap provides a little-endian formatted addr */
 690         cp.addr = *(__le32 *)addr;
 691         cp.len = val_size;
 692
 693         bt_dev_dbg(ctx->hdev, "Register (0x%x) read", le32_to_cpu(cp.addr));
 694
 695         skb = hci_cmd_sync(ctx->hdev, ctx->op_read, sizeof(cp), &cp,
 696                            HCI_CMD_TIMEOUT);
 697         if (IS_ERR(skb)) {
 698                 err = PTR_ERR(skb);
 699                 bt_dev_err(ctx->hdev, "regmap: Register (0x%x) read error (%d)",
 700                            le32_to_cpu(cp.addr), err);
 701                 return err;
 702         }
 703
 704         if (skb->len != sizeof(*rp) + val_size) {
 705                 bt_dev_err(ctx->hdev, "regmap: Register (0x%x) read error, bad len",
 706                            le32_to_cpu(cp.addr));
 707                 err = -EINVAL;
 708                 goto done;
 709         }
 710
 711         rp = (struct ibt_rp_reg_access *)skb->data;
 712
 713         if (rp->addr != cp.addr) {
 714                 bt_dev_err(ctx->hdev, "regmap: Register (0x%x) read error, bad addr",
 715                            le32_to_cpu(rp->addr));
 716                 err = -EINVAL;
 717                 goto done;
 718         }
 719
 720         memcpy(val, rp->data, val_size);
 721
 722 done:
 723         kfree_skb(skb);
 724         return err;
 725 }
 726
 727 static int regmap_ibt_gather_write(void *context,
 728                                    const void *addr, size_t reg_size,
 729                                    const void *val, size_t val_size)
 730 {
 731         struct regmap_ibt_context *ctx = context;
 732         struct ibt_cp_reg_access *cp;
 733         struct sk_buff *skb;
 734         int plen = sizeof(*cp) + val_size;
 735         u8 mode;
 736         int err = 0;
 737
 738         if (reg_size != sizeof(__le32))
 739                 return -EINVAL;
 740
 741         switch (val_size) {
 742         case 1:
 743                 mode = IBT_REG_MODE_8BIT;
 744                 break;
 745         case 2:
 746                 mode = IBT_REG_MODE_16BIT;
 747                 break;
 748         case 4:
 749                 mode = IBT_REG_MODE_32BIT;
 750                 break;
 751         default:
 752                 return -EINVAL;
 753         }
 754
 755         cp = kmalloc(plen, GFP_KERNEL);
 756         if (!cp)
 757                 return -ENOMEM;
 758
 759         /* regmap provides a little-endian formatted addr/value */
 760         cp->addr = *(__le32 *)addr;
 761         cp->mode = mode;
 762         cp->len = val_size;
 763         memcpy(&cp->data, val, val_size);
 764
 765         bt_dev_dbg(ctx->hdev, "Register (0x%x) write", le32_to_cpu(cp->addr));
 766
 767         skb = hci_cmd_sync(ctx->hdev, ctx->op_write, plen, cp, HCI_CMD_TIMEOUT);
 768         if (IS_ERR(skb)) {
 769                 err = PTR_ERR(skb);
 770                 bt_dev_err(ctx->hdev, "regmap: Register (0x%x) write error (%d)",
 771                            le32_to_cpu(cp->addr), err);
 772                 goto done;
 773         }
 774         kfree_skb(skb);
 775
 776 done:
 777         kfree(cp);
 778         return err;
 779 }
 780
 781 static int regmap_ibt_write(void *context, const void *data, size_t count)
 782 {
 783         /* data contains register+value, since we only support 32bit addr,
 784          * minimum data size is 4 bytes.
 785          */
 786         if (WARN_ONCE(count < 4, "Invalid register access"))
 787                 return -EINVAL;
 788
 789         return regmap_ibt_gather_write(context, data, 4, data + 4, count - 4);
 790 }
 791
 792 static void regmap_ibt_free_context(void *context)
 793 {
 794         kfree(context);
 795 }
 796
 797 static struct regmap_bus regmap_ibt = {
 798         .read = regmap_ibt_read,
 799         .write = regmap_ibt_write,
 800         .gather_write = regmap_ibt_gather_write,
 801         .free_context = regmap_ibt_free_context,
 802         .reg_format_endian_default = REGMAP_ENDIAN_LITTLE,
 803         .val_format_endian_default = REGMAP_ENDIAN_LITTLE,
 804 };
 805
 806 /* Config is the same for all register regions */
 807 static const struct regmap_config regmap_ibt_cfg = {
 808         .name      = "btintel_regmap",
 809         .reg_bits  = 32,
 810         .val_bits  = 32,
 811 };
 812
 813 struct regmap *btintel_regmap_init(struct hci_dev *hdev, u16 opcode_read,
 814                                    u16 opcode_write)
 815 {
 816         struct regmap_ibt_context *ctx;
 817
 818         bt_dev_info(hdev, "regmap: Init R%x-W%x region", opcode_read,
 819                     opcode_write);
 820
 821         ctx = kzalloc(sizeof(*ctx), GFP_KERNEL);
 822         if (!ctx)
 823                 return ERR_PTR(-ENOMEM);
 824
 825         ctx->op_read = opcode_read;
 826         ctx->op_write = opcode_write;
 827         ctx->hdev = hdev;
 828
 829         return regmap_init(&hdev->dev, &regmap_ibt, ctx, &regmap_ibt_cfg);
 830 }
 831 EXPORT_SYMBOL_GPL(btintel_regmap_init);
 832
 833 int btintel_send_intel_reset(struct hci_dev *hdev, u32 boot_param)
 834 {
 835         struct intel_reset params = { 0x00, 0x01, 0x00, 0x01, 0x00000000 };
 836         struct sk_buff *skb;
 837
 838         params.boot_param = cpu_to_le32(boot_param);
 839
 840         skb = __hci_cmd_sync(hdev, 0xfc01, sizeof(params), &params,
 841                              HCI_INIT_TIMEOUT);
 842         if (IS_ERR(skb)) {
 843                 bt_dev_err(hdev, "Failed to send Intel Reset command");
 844                 return PTR_ERR(skb);
 845         }
 846
 847         kfree_skb(skb);
 848
 849         return 0;
 850 }
 851 EXPORT_SYMBOL_GPL(btintel_send_intel_reset);
 852
 853 int btintel_read_boot_params(struct hci_dev *hdev,
 854                              struct intel_boot_params *params)
 855 {
 856         struct sk_buff *skb;
 857
 858         skb = __hci_cmd_sync(hdev, 0xfc0d, 0, NULL, HCI_INIT_TIMEOUT);
 859         if (IS_ERR(skb)) {
 860                 bt_dev_err(hdev, "Reading Intel boot parameters failed (%ld)",
 861                            PTR_ERR(skb));
 862                 return PTR_ERR(skb);
 863         }
 864
 865         if (skb->len != sizeof(*params)) {
 866                 bt_dev_err(hdev, "Intel boot parameters size mismatch");
 867                 kfree_skb(skb);
 868                 return -EILSEQ;
 869         }
 870
 871         memcpy(params, skb->data, sizeof(*params));
 872
 873         kfree_skb(skb);
 874
 875         if (params->status) {
 876                 bt_dev_err(hdev, "Intel boot parameters command failed (%02x)",
 877                            params->status);
 878                 return -bt_to_errno(params->status);
 879         }
 880
 881         bt_dev_info(hdev, "Device revision is %u",
 882                     le16_to_cpu(params->dev_revid));
 883
 884         bt_dev_info(hdev, "Secure boot is %s",
 885                     params->secure_boot ? "enabled" : "disabled");
 886
 887         bt_dev_info(hdev, "OTP lock is %s",
 888                     params->otp_lock ? "enabled" : "disabled");
 889
 890         bt_dev_info(hdev, "API lock is %s",
 891                     params->api_lock ? "enabled" : "disabled");
 892
 893         bt_dev_info(hdev, "Debug lock is %s",
 894                     params->debug_lock ? "enabled" : "disabled");
 895
 896         bt_dev_info(hdev, "Minimum firmware build %u week %u %u",
 897                     params->min_fw_build_nn, params->min_fw_build_cw,
 898                     2000 + params->min_fw_build_yy);
 899
 900         return 0;
 901 }
 902 EXPORT_SYMBOL_GPL(btintel_read_boot_params);
 903
 904 static int btintel_sfi_rsa_header_secure_send(struct hci_dev *hdev,
 905                                               const struct firmware *fw)
 906 {
 907         int err;
 908
 909         /* Start the firmware download transaction with the Init fragment
 910          * represented by the 128 bytes of CSS header.
 911          */
 912         err = btintel_secure_send(hdev, 0x00, 128, fw->data);
 913         if (err < 0) {
 914                 bt_dev_err(hdev, "Failed to send firmware header (%d)", err);
 915                 goto done;
 916         }
 917
 918         /* Send the 256 bytes of public key information from the firmware
 919          * as the PKey fragment.
 920          */
 921         err = btintel_secure_send(hdev, 0x03, 256, fw->data + 128);
 922         if (err < 0) {
 923                 bt_dev_err(hdev, "Failed to send firmware pkey (%d)", err);
 924                 goto done;
 925         }
 926
 927         /* Send the 256 bytes of signature information from the firmware
 928          * as the Sign fragment.
 929          */
 930         err = btintel_secure_send(hdev, 0x02, 256, fw->data + 388);
 931         if (err < 0) {
 932                 bt_dev_err(hdev, "Failed to send firmware signature (%d)", err);
 933                 goto done;
 934         }
 935
 936 done:
 937         return err;
 938 }
 939
 940 static int btintel_sfi_ecdsa_header_secure_send(struct hci_dev *hdev,
 941                                                 const struct firmware *fw)
 942 {
 943         int err;
 944
 945         /* Start the firmware download transaction with the Init fragment
 946          * represented by the 128 bytes of CSS header.
 947          */
 948         err = btintel_secure_send(hdev, 0x00, 128, fw->data + 644);
 949         if (err < 0) {
 950                 bt_dev_err(hdev, "Failed to send firmware header (%d)", err);
 951                 return err;
 952         }
 953
 954         /* Send the 96 bytes of public key information from the firmware
 955          * as the PKey fragment.
 956          */
 957         err = btintel_secure_send(hdev, 0x03, 96, fw->data + 644 + 128);
 958         if (err < 0) {
 959                 bt_dev_err(hdev, "Failed to send firmware pkey (%d)", err);
 960                 return err;
 961         }
 962
 963         /* Send the 96 bytes of signature information from the firmware
 964          * as the Sign fragment
 965          */
 966         err = btintel_secure_send(hdev, 0x02, 96, fw->data + 644 + 224);
 967         if (err < 0) {
 968                 bt_dev_err(hdev, "Failed to send firmware signature (%d)",
 969                            err);
 970                 return err;
 971         }
 972         return 0;
 973 }
 974
 975 static int btintel_download_firmware_payload(struct hci_dev *hdev,
 976                                              const struct firmware *fw,
 977                                              size_t offset)
 978 {
 979         int err;
 980         const u8 *fw_ptr;
 981         u32 frag_len;
 982
 983         fw_ptr = fw->data + offset;
 984         frag_len = 0;
 985         err = -EINVAL;
 986
 987         while (fw_ptr - fw->data < fw->size) {
 988                 struct hci_command_hdr *cmd = (void *)(fw_ptr + frag_len);
 989
 990                 frag_len += sizeof(*cmd) + cmd->plen;
 991
 992                 /* The parameter length of the secure send command requires
 993                  * a 4 byte alignment. It happens so that the firmware file
 994                  * contains proper Intel_NOP commands to align the fragments
 995                  * as needed.
 996                  *
 997                  * Send set of commands with 4 byte alignment from the
 998                  * firmware data buffer as a single Data fragement.
 999                  */
1000                 if (!(frag_len % 4)) {
1001                         err = btintel_secure_send(hdev, 0x01, frag_len, fw_ptr);
1002                         if (err < 0) {
1003                                 bt_dev_err(hdev,
1004                                            "Failed to send firmware data (%d)",
1005                                            err);
1006                                 goto done;
1007                         }
1008
1009                         fw_ptr += frag_len;
1010                         frag_len = 0;
1011                 }
1012         }
1013
1014 done:
1015         return err;
1016 }
1017
1018 static bool btintel_firmware_version(struct hci_dev *hdev,
1019                                      u8 num, u8 ww, u8 yy,
1020                                      const struct firmware *fw,
1021                                      u32 *boot_addr)
1022 {
1023         const u8 *fw_ptr;
1024
1025         fw_ptr = fw->data;
1026
1027         while (fw_ptr - fw->data < fw->size) {
1028                 struct hci_command_hdr *cmd = (void *)(fw_ptr);
1029
1030                 /* Each SKU has a different reset parameter to use in the
1031                  * HCI_Intel_Reset command and it is embedded in the firmware
1032                  * data. So, instead of using static value per SKU, check
1033                  * the firmware data and save it for later use.
1034                  */
1035                 if (le16_to_cpu(cmd->opcode) == CMD_WRITE_BOOT_PARAMS) {
1036                         struct cmd_write_boot_params *params;
1037
1038                         params = (void *)(fw_ptr + sizeof(*cmd));
1039
1040                         bt_dev_info(hdev, "Boot Address: 0x%x",
1041                                     le32_to_cpu(params->boot_addr));
1042
1043                         bt_dev_info(hdev, "Firmware Version: %u-%u.%u",
1044                                     params->fw_build_num, params->fw_build_ww,
1045                                     params->fw_build_yy);
1046
1047                         return (num == params->fw_build_num &&
1048                                 ww == params->fw_build_ww &&
1049                                 yy == params->fw_build_yy);
1050                 }
1051
1052                 fw_ptr += sizeof(*cmd) + cmd->plen;
1053         }
1054
1055         return false;
1056 }
1057
1058 int btintel_download_firmware(struct hci_dev *hdev,
1059                               struct intel_version *ver,
1060                               const struct firmware *fw,
1061                               u32 *boot_param)
1062 {
1063         int err;
1064
1065         /* SfP and WsP don't seem to update the firmware version on file
1066          * so version checking is currently not possible.
1067          */
1068         switch (ver->hw_variant) {
1069         case 0x0b:      /* SfP */
1070         case 0x0c:      /* WsP */
1071                 /* Skip version checking */
1072                 break;
1073         default:
1074                 /* Skip reading firmware file version in bootloader mode */
1075                 if (ver->fw_variant == 0x06)
1076                         break;
1077
1078                 /* Skip download if firmware has the same version */
1079                 if (btintel_firmware_version(hdev, ver->fw_build_num,
1080                                              ver->fw_build_ww, ver->fw_build_yy,
1081                                              fw, boot_param)) {
1082                         bt_dev_info(hdev, "Firmware already loaded");
1083                         /* Return -EALREADY to indicate that the firmware has
1084                          * already been loaded.
1085                          */
1086                         return -EALREADY;
1087                 }
1088         }
1089
1090         /* The firmware variant determines if the device is in bootloader
1091          * mode or is running operational firmware. The value 0x06 identifies
1092          * the bootloader and the value 0x23 identifies the operational
1093          * firmware.
1094          *
1095          * If the firmware version has changed that means it needs to be reset
1096          * to bootloader when operational so the new firmware can be loaded.
1097          */
1098         if (ver->fw_variant == 0x23)
1099                 return -EINVAL;
1100
1101         err = btintel_sfi_rsa_header_secure_send(hdev, fw);
1102         if (err)
1103                 return err;
1104
1105         return btintel_download_firmware_payload(hdev, fw, RSA_HEADER_LEN);
1106 }
1107 EXPORT_SYMBOL_GPL(btintel_download_firmware);
1108
1109 static int btintel_download_fw_tlv(struct hci_dev *hdev,
1110                                    struct intel_version_tlv *ver,
1111                                    const struct firmware *fw, u32 *boot_param,
1112                                    u8 hw_variant, u8 sbe_type)
1113 {
1114         int err;
1115         u32 css_header_ver;
1116
1117         /* Skip reading firmware file version in bootloader mode */
1118         if (ver->img_type != 0x01) {
1119                 /* Skip download if firmware has the same version */
1120                 if (btintel_firmware_version(hdev, ver->min_fw_build_nn,
1121                                              ver->min_fw_build_cw,
1122                                              ver->min_fw_build_yy,
1123                                              fw, boot_param)) {
1124                         bt_dev_info(hdev, "Firmware already loaded");
1125                         /* Return -EALREADY to indicate that firmware has
1126                          * already been loaded.
1127                          */
1128                         return -EALREADY;
1129                 }
1130         }
1131
1132         /* The firmware variant determines if the device is in bootloader
1133          * mode or is running operational firmware. The value 0x01 identifies
1134          * the bootloader and the value 0x03 identifies the operational
1135          * firmware.
1136          *
1137          * If the firmware version has changed that means it needs to be reset
1138          * to bootloader when operational so the new firmware can be loaded.
1139          */
1140         if (ver->img_type == 0x03)
1141                 return -EINVAL;
1142
1143         /* iBT hardware variants 0x0b, 0x0c, 0x11, 0x12, 0x13, 0x14 support
1144          * only RSA secure boot engine. Hence, the corresponding sfi file will
1145          * have RSA header of 644 bytes followed by Command Buffer.
1146          *
1147          * iBT hardware variants 0x17, 0x18 onwards support both RSA and ECDSA
1148          * secure boot engine. As a result, the corresponding sfi file will
1149          * have RSA header of 644, ECDSA header of 320 bytes followed by
1150          * Command Buffer.
1151          *
1152          * CSS Header byte positions 0x08 to 0x0B represent the CSS Header
1153          * version: RSA(0x00010000) , ECDSA (0x00020000)
1154          */
1155         css_header_ver = get_unaligned_le32(fw->data + CSS_HEADER_OFFSET);
1156         if (css_header_ver != 0x00010000) {
1157                 bt_dev_err(hdev, "Invalid CSS Header version");
1158                 return -EINVAL;
1159         }
1160
1161         if (hw_variant <= 0x14) {
1162                 if (sbe_type != 0x00) {
1163                         bt_dev_err(hdev, "Invalid SBE type for hardware variant (%d)",
1164                                    hw_variant);
1165                         return -EINVAL;
1166                 }
1167
1168                 err = btintel_sfi_rsa_header_secure_send(hdev, fw);
1169                 if (err)
1170                         return err;
1171
1172                 err = btintel_download_firmware_payload(hdev, fw, RSA_HEADER_LEN);
1173                 if (err)
1174                         return err;
1175         } else if (hw_variant >= 0x17) {
1176                 /* Check if CSS header for ECDSA follows the RSA header */
1177                 if (fw->data[ECDSA_OFFSET] != 0x06)
1178                         return -EINVAL;
1179
1180                 /* Check if the CSS Header version is ECDSA(0x00020000) */
1181                 css_header_ver = get_unaligned_le32(fw->data + ECDSA_OFFSET + CSS_HEADER_OFFSET);
1182                 if (css_header_ver != 0x00020000) {
1183                         bt_dev_err(hdev, "Invalid CSS Header version");
1184                         return -EINVAL;
1185                 }
1186
1187                 if (sbe_type == 0x00) {
1188                         err = btintel_sfi_rsa_header_secure_send(hdev, fw);
1189                         if (err)
1190                                 return err;
1191
1192                         err = btintel_download_firmware_payload(hdev, fw,
1193                                                                 RSA_HEADER_LEN + ECDSA_HEADER_LEN);
1194                         if (err)
1195                                 return err;
1196                 } else if (sbe_type == 0x01) {
1197                         err = btintel_sfi_ecdsa_header_secure_send(hdev, fw);
1198                         if (err)
1199                                 return err;
1200
1201                         err = btintel_download_firmware_payload(hdev, fw,
1202                                                                 RSA_HEADER_LEN + ECDSA_HEADER_LEN);
1203                         if (err)
1204                                 return err;
1205                 }
1206         }
1207         return 0;
1208 }
1209
1210 static void btintel_reset_to_bootloader(struct hci_dev *hdev)
1211 {
1212         struct intel_reset params;
1213         struct sk_buff *skb;
1214
1215         /* Send Intel Reset command. This will result in
1216          * re-enumeration of BT controller.
1217          *
1218          * Intel Reset parameter description:
1219          * reset_type :   0x00 (Soft reset),
1220          *                0x01 (Hard reset)
1221          * patch_enable : 0x00 (Do not enable),
1222          *                0x01 (Enable)
1223          * ddc_reload :   0x00 (Do not reload),
1224          *                0x01 (Reload)
1225          * boot_option:   0x00 (Current image),
1226          *                0x01 (Specified boot address)
1227          * boot_param:    Boot address
1228          *
1229          */
1230         params.reset_type = 0x01;
1231         params.patch_enable = 0x01;
1232         params.ddc_reload = 0x01;
1233         params.boot_option = 0x00;
1234         params.boot_param = cpu_to_le32(0x00000000);
1235
1236         skb = __hci_cmd_sync(hdev, 0xfc01, sizeof(params),
1237                              &params, HCI_INIT_TIMEOUT);
1238         if (IS_ERR(skb)) {
1239                 bt_dev_err(hdev, "FW download error recovery failed (%ld)",
1240                            PTR_ERR(skb));
1241                 return;
1242         }
1243         bt_dev_info(hdev, "Intel reset sent to retry FW download");
1244         kfree_skb(skb);
1245
1246         /* Current Intel BT controllers(ThP/JfP) hold the USB reset
1247          * lines for 2ms when it receives Intel Reset in bootloader mode.
1248          * Whereas, the upcoming Intel BT controllers will hold USB reset
1249          * for 150ms. To keep the delay generic, 150ms is chosen here.
1250          */
1251         msleep(150);
1252 }
1253
1254 static int btintel_read_debug_features(struct hci_dev *hdev,
1255                                        struct intel_debug_features *features)
1256 {
1257         struct sk_buff *skb;
1258         u8 page_no = 1;
1259
1260         /* Intel controller supports two pages, each page is of 128-bit
1261          * feature bit mask. And each bit defines specific feature support
1262          */
1263         skb = __hci_cmd_sync(hdev, 0xfca6, sizeof(page_no), &page_no,
1264                              HCI_INIT_TIMEOUT);
1265         if (IS_ERR(skb)) {
1266                 bt_dev_err(hdev, "Reading supported features failed (%ld)",
1267                            PTR_ERR(skb));
1268                 return PTR_ERR(skb);
1269         }
1270
1271         if (skb->len != (sizeof(features->page1) + 3)) {
1272                 bt_dev_err(hdev, "Supported features event size mismatch");
1273                 kfree_skb(skb);
1274                 return -EILSEQ;
1275         }
1276
1277         memcpy(features->page1, skb->data + 3, sizeof(features->page1));
1278
1279         /* Read the supported features page2 if required in future.
1280          */
1281         kfree_skb(skb);
1282         return 0;
1283 }
1284
1285 static int btintel_set_debug_features(struct hci_dev *hdev,
1286                                const struct intel_debug_features *features)
1287 {
1288         u8 mask[11] = { 0x0a, 0x92, 0x02, 0x07, 0x00, 0x00, 0x00, 0x00,
1289                         0x00, 0x00, 0x00 };
1290         struct sk_buff *skb;
1291
1292         if (!features)
1293                 return -EINVAL;
1294
1295         if (!(features->page1[0] & 0x3f)) {
1296                 bt_dev_info(hdev, "Telemetry exception format not supported");
1297                 return 0;
1298         }
1299
1300         skb = __hci_cmd_sync(hdev, 0xfc8b, 11, mask, HCI_INIT_TIMEOUT);
1301         if (IS_ERR(skb)) {
1302                 bt_dev_err(hdev, "Setting Intel telemetry ddc write event mask failed (%ld)",
1303                            PTR_ERR(skb));
1304                 return PTR_ERR(skb);
1305         }
1306
1307         kfree_skb(skb);
1308         return 0;
1309 }
1310
1311 static const struct firmware *btintel_legacy_rom_get_fw(struct hci_dev *hdev,
1312                                                struct intel_version *ver)
1313 {
1314         const struct firmware *fw;
1315         char fwname[64];
1316         int ret;
1317
1318         snprintf(fwname, sizeof(fwname),
1319                  "intel/ibt-hw-%x.%x.%x-fw-%x.%x.%x.%x.%x.bseq",
1320                  ver->hw_platform, ver->hw_variant, ver->hw_revision,
1321                  ver->fw_variant,  ver->fw_revision, ver->fw_build_num,
1322                  ver->fw_build_ww, ver->fw_build_yy);
1323
1324         ret = request_firmware(&fw, fwname, &hdev->dev);
1325         if (ret < 0) {
1326                 if (ret == -EINVAL) {
1327                         bt_dev_err(hdev, "Intel firmware file request failed (%d)",
1328                                    ret);
1329                         return NULL;
1330                 }
1331
1332                 bt_dev_err(hdev, "failed to open Intel firmware file: %s (%d)",
1333                            fwname, ret);
1334
1335                 /* If the correct firmware patch file is not found, use the
1336                  * default firmware patch file instead
1337                  */
1338                 snprintf(fwname, sizeof(fwname), "intel/ibt-hw-%x.%x.bseq",
1339                          ver->hw_platform, ver->hw_variant);
1340                 if (request_firmware(&fw, fwname, &hdev->dev) < 0) {
1341                         bt_dev_err(hdev, "failed to open default fw file: %s",
1342                                    fwname);
1343                         return NULL;
1344                 }
1345         }
1346
1347         bt_dev_info(hdev, "Intel Bluetooth firmware file: %s", fwname);
1348
1349         return fw;
1350 }
1351
1352 static int btintel_legacy_rom_patching(struct hci_dev *hdev,
1353                                       const struct firmware *fw,
1354                                       const u8 **fw_ptr, int *disable_patch)
1355 {
1356         struct sk_buff *skb;
1357         struct hci_command_hdr *cmd;
1358         const u8 *cmd_param;
1359         struct hci_event_hdr *evt = NULL;
1360         const u8 *evt_param = NULL;
1361         int remain = fw->size - (*fw_ptr - fw->data);
1362
1363         /* The first byte indicates the types of the patch command or event.
1364          * 0x01 means HCI command and 0x02 is HCI event. If the first bytes
1365          * in the current firmware buffer doesn't start with 0x01 or
1366          * the size of remain buffer is smaller than HCI command header,
1367          * the firmware file is corrupted and it should stop the patching
1368          * process.
1369          */
1370         if (remain > HCI_COMMAND_HDR_SIZE && *fw_ptr[0] != 0x01) {
1371                 bt_dev_err(hdev, "Intel fw corrupted: invalid cmd read");
1372                 return -EINVAL;
1373         }
1374         (*fw_ptr)++;
1375         remain--;
1376
1377         cmd = (struct hci_command_hdr *)(*fw_ptr);
1378         *fw_ptr += sizeof(*cmd);
1379         remain -= sizeof(*cmd);
1380
1381         /* Ensure that the remain firmware data is long enough than the length
1382          * of command parameter. If not, the firmware file is corrupted.
1383          */
1384         if (remain < cmd->plen) {
1385                 bt_dev_err(hdev, "Intel fw corrupted: invalid cmd len");
1386                 return -EFAULT;
1387         }
1388
1389         /* If there is a command that loads a patch in the firmware
1390          * file, then enable the patch upon success, otherwise just
1391          * disable the manufacturer mode, for example patch activation
1392          * is not required when the default firmware patch file is used
1393          * because there are no patch data to load.
1394          */
1395         if (*disable_patch && le16_to_cpu(cmd->opcode) == 0xfc8e)
1396                 *disable_patch = 0;
1397
1398         cmd_param = *fw_ptr;
1399         *fw_ptr += cmd->plen;
1400         remain -= cmd->plen;
1401
1402         /* This reads the expected events when the above command is sent to the
1403          * device. Some vendor commands expects more than one events, for
1404          * example command status event followed by vendor specific event.
1405          * For this case, it only keeps the last expected event. so the command
1406          * can be sent with __hci_cmd_sync_ev() which returns the sk_buff of
1407          * last expected event.
1408          */
1409         while (remain > HCI_EVENT_HDR_SIZE && *fw_ptr[0] == 0x02) {
1410                 (*fw_ptr)++;
1411                 remain--;
1412
1413                 evt = (struct hci_event_hdr *)(*fw_ptr);
1414                 *fw_ptr += sizeof(*evt);
1415                 remain -= sizeof(*evt);
1416
1417                 if (remain < evt->plen) {
1418                         bt_dev_err(hdev, "Intel fw corrupted: invalid evt len");
1419                         return -EFAULT;
1420                 }
1421
1422                 evt_param = *fw_ptr;
1423                 *fw_ptr += evt->plen;
1424                 remain -= evt->plen;
1425         }
1426
1427         /* Every HCI commands in the firmware file has its correspond event.
1428          * If event is not found or remain is smaller than zero, the firmware
1429          * file is corrupted.
1430          */
1431         if (!evt || !evt_param || remain < 0) {
1432                 bt_dev_err(hdev, "Intel fw corrupted: invalid evt read");
1433                 return -EFAULT;
1434         }
1435
1436         skb = __hci_cmd_sync_ev(hdev, le16_to_cpu(cmd->opcode), cmd->plen,
1437                                 cmd_param, evt->evt, HCI_INIT_TIMEOUT);
1438         if (IS_ERR(skb)) {
1439                 bt_dev_err(hdev, "sending Intel patch command (0x%4.4x) failed (%ld)",
1440                            cmd->opcode, PTR_ERR(skb));
1441                 return PTR_ERR(skb);
1442         }
1443
1444         /* It ensures that the returned event matches the event data read from
1445          * the firmware file. At fist, it checks the length and then
1446          * the contents of the event.
1447          */
1448         if (skb->len != evt->plen) {
1449                 bt_dev_err(hdev, "mismatch event length (opcode 0x%4.4x)",
1450                            le16_to_cpu(cmd->opcode));
1451                 kfree_skb(skb);
1452                 return -EFAULT;
1453         }
1454
1455         if (memcmp(skb->data, evt_param, evt->plen)) {
1456                 bt_dev_err(hdev, "mismatch event parameter (opcode 0x%4.4x)",
1457                            le16_to_cpu(cmd->opcode));
1458                 kfree_skb(skb);
1459                 return -EFAULT;
1460         }
1461         kfree_skb(skb);
1462
1463         return 0;
1464 }
1465
1466 static int btintel_legacy_rom_setup(struct hci_dev *hdev,
1467                                     struct intel_version *ver)
1468 {
1469         const struct firmware *fw;
1470         const u8 *fw_ptr;
1471         int disable_patch, err;
1472         struct intel_version new_ver;
1473
1474         BT_DBG("%s", hdev->name);
1475
1476         /* fw_patch_num indicates the version of patch the device currently
1477          * have. If there is no patch data in the device, it is always 0x00.
1478          * So, if it is other than 0x00, no need to patch the device again.
1479          */
1480         if (ver->fw_patch_num) {
1481                 bt_dev_info(hdev,
1482                             "Intel device is already patched. patch num: %02x",
1483                             ver->fw_patch_num);
1484                 goto complete;
1485         }
1486
1487         /* Opens the firmware patch file based on the firmware version read
1488          * from the controller. If it fails to open the matching firmware
1489          * patch file, it tries to open the default firmware patch file.
1490          * If no patch file is found, allow the device to operate without
1491          * a patch.
1492          */
1493         fw = btintel_legacy_rom_get_fw(hdev, ver);
1494         if (!fw)
1495                 goto complete;
1496         fw_ptr = fw->data;
1497
1498         /* Enable the manufacturer mode of the controller.
1499          * Only while this mode is enabled, the driver can download the
1500          * firmware patch data and configuration parameters.
1501          */
1502         err = btintel_enter_mfg(hdev);
1503         if (err) {
1504                 release_firmware(fw);
1505                 return err;
1506         }
1507
1508         disable_patch = 1;
1509
1510         /* The firmware data file consists of list of Intel specific HCI
1511          * commands and its expected events. The first byte indicates the
1512          * type of the message, either HCI command or HCI event.
1513          *
1514          * It reads the command and its expected event from the firmware file,
1515          * and send to the controller. Once __hci_cmd_sync_ev() returns,
1516          * the returned event is compared with the event read from the firmware
1517          * file and it will continue until all the messages are downloaded to
1518          * the controller.
1519          *
1520          * Once the firmware patching is completed successfully,
1521          * the manufacturer mode is disabled with reset and activating the
1522          * downloaded patch.
1523          *
1524          * If the firmware patching fails, the manufacturer mode is
1525          * disabled with reset and deactivating the patch.
1526          *
1527          * If the default patch file is used, no reset is done when disabling
1528          * the manufacturer.
1529          */
1530         while (fw->size > fw_ptr - fw->data) {
1531                 int ret;
1532
1533                 ret = btintel_legacy_rom_patching(hdev, fw, &fw_ptr,
1534                                                  &disable_patch);
1535                 if (ret < 0)
1536                         goto exit_mfg_deactivate;
1537         }
1538
1539         release_firmware(fw);
1540
1541         if (disable_patch)
1542                 goto exit_mfg_disable;
1543
1544         /* Patching completed successfully and disable the manufacturer mode
1545          * with reset and activate the downloaded firmware patches.
1546          */
1547         err = btintel_exit_mfg(hdev, true, true);
1548         if (err)
1549                 return err;
1550
1551         /* Need build number for downloaded fw patches in
1552          * every power-on boot
1553          */
1554         err = btintel_read_version(hdev, &new_ver);
1555         if (err)
1556                 return err;
1557
1558         bt_dev_info(hdev, "Intel BT fw patch 0x%02x completed & activated",
1559                     new_ver.fw_patch_num);
1560
1561         goto complete;
1562
1563 exit_mfg_disable:
1564         /* Disable the manufacturer mode without reset */
1565         err = btintel_exit_mfg(hdev, false, false);
1566         if (err)
1567                 return err;
1568
1569         bt_dev_info(hdev, "Intel firmware patch completed");
1570
1571         goto complete;
1572
1573 exit_mfg_deactivate:
1574         release_firmware(fw);
1575
1576         /* Patching failed. Disable the manufacturer mode with reset and
1577          * deactivate the downloaded firmware patches.
1578          */
1579         err = btintel_exit_mfg(hdev, true, false);
1580         if (err)
1581                 return err;
1582
1583         bt_dev_info(hdev, "Intel firmware patch completed and deactivated");
1584
1585 complete:
1586         /* Set the event mask for Intel specific vendor events. This enables
1587          * a few extra events that are useful during general operation.
1588          */
1589         btintel_set_event_mask_mfg(hdev, false);
1590
1591         btintel_check_bdaddr(hdev);
1592
1593         return 0;
1594 }
1595
1596 static int btintel_download_wait(struct hci_dev *hdev, ktime_t calltime, int msec)
1597 {
1598         ktime_t delta, rettime;
1599         unsigned long long duration;
1600         int err;
1601
1602         btintel_set_flag(hdev, INTEL_FIRMWARE_LOADED);
1603
1604         bt_dev_info(hdev, "Waiting for firmware download to complete");
1605
1606         err = btintel_wait_on_flag_timeout(hdev, INTEL_DOWNLOADING,
1607                                            TASK_INTERRUPTIBLE,
1608                                            msecs_to_jiffies(msec));
1609         if (err == -EINTR) {
1610                 bt_dev_err(hdev, "Firmware loading interrupted");
1611                 return err;
1612         }
1613
1614         if (err) {
1615                 bt_dev_err(hdev, "Firmware loading timeout");
1616                 return -ETIMEDOUT;
1617         }
1618
1619         if (btintel_test_flag(hdev, INTEL_FIRMWARE_FAILED)) {
1620                 bt_dev_err(hdev, "Firmware loading failed");
1621                 return -ENOEXEC;
1622         }
1623
1624         rettime = ktime_get();
1625         delta = ktime_sub(rettime, calltime);
1626         duration = (unsigned long long)ktime_to_ns(delta) >> 10;
1627
1628         bt_dev_info(hdev, "Firmware loaded in %llu usecs", duration);
1629
1630         return 0;
1631 }
1632
1633 static int btintel_boot_wait(struct hci_dev *hdev, ktime_t calltime, int msec)
1634 {
1635         ktime_t delta, rettime;
1636         unsigned long long duration;
1637         int err;
1638
1639         bt_dev_info(hdev, "Waiting for device to boot");
1640
1641         err = btintel_wait_on_flag_timeout(hdev, INTEL_BOOTING,
1642                                            TASK_INTERRUPTIBLE,
1643                                            msecs_to_jiffies(msec));
1644         if (err == -EINTR) {
1645                 bt_dev_err(hdev, "Device boot interrupted");
1646                 return -EINTR;
1647         }
1648
1649         if (err) {
1650                 bt_dev_err(hdev, "Device boot timeout");
1651                 return -ETIMEDOUT;
1652         }
1653
1654         rettime = ktime_get();
1655         delta = ktime_sub(rettime, calltime);
1656         duration = (unsigned long long) ktime_to_ns(delta) >> 10;
1657
1658         bt_dev_info(hdev, "Device booted in %llu usecs", duration);
1659
1660         return 0;
1661 }
1662
1663 static int btintel_boot(struct hci_dev *hdev, u32 boot_addr)
1664 {
1665         ktime_t calltime;
1666         int err;
1667
1668         calltime = ktime_get();
1669
1670         btintel_set_flag(hdev, INTEL_BOOTING);
1671
1672         err = btintel_send_intel_reset(hdev, boot_addr);
1673         if (err) {
1674                 bt_dev_err(hdev, "Intel Soft Reset failed (%d)", err);
1675                 btintel_reset_to_bootloader(hdev);
1676                 return err;
1677         }
1678
1679         /* The bootloader will not indicate when the device is ready. This
1680          * is done by the operational firmware sending bootup notification.
1681          *
1682          * Booting into operational firmware should not take longer than
1683          * 1 second. However if that happens, then just fail the setup
1684          * since something went wrong.
1685          */
1686         err = btintel_boot_wait(hdev, calltime, 1000);
1687         if (err == -ETIMEDOUT)
1688                 btintel_reset_to_bootloader(hdev);
1689
1690         return err;
1691 }
1692
1693 static int btintel_get_fw_name(struct intel_version *ver,
1694                                              struct intel_boot_params *params,
1695                                              char *fw_name, size_t len,
1696                                              const char *suffix)
1697 {
1698         switch (ver->hw_variant) {
1699         case 0x0b:      /* SfP */
1700         case 0x0c:      /* WsP */
1701                 snprintf(fw_name, len, "intel/ibt-%u-%u.%s",
1702                         le16_to_cpu(ver->hw_variant),
1703                         le16_to_cpu(params->dev_revid),
1704                         suffix);
1705                 break;
1706         case 0x11:      /* JfP */
1707         case 0x12:      /* ThP */
1708         case 0x13:      /* HrP */
1709         case 0x14:      /* CcP */
1710                 snprintf(fw_name, len, "intel/ibt-%u-%u-%u.%s",
1711                         le16_to_cpu(ver->hw_variant),
1712                         le16_to_cpu(ver->hw_revision),
1713                         le16_to_cpu(ver->fw_revision),
1714                         suffix);
1715                 break;
1716         default:
1717                 return -EINVAL;
1718         }
1719
1720         return 0;
1721 }
1722
1723 static int btintel_download_fw(struct hci_dev *hdev,
1724                                          struct intel_version *ver,
1725                                          struct intel_boot_params *params,
1726                                          u32 *boot_param)
1727 {
1728         const struct firmware *fw;
1729         char fwname[64];
1730         int err;
1731         ktime_t calltime;
1732
1733         if (!ver || !params)
1734                 return -EINVAL;
1735
1736         /* The firmware variant determines if the device is in bootloader
1737          * mode or is running operational firmware. The value 0x06 identifies
1738          * the bootloader and the value 0x23 identifies the operational
1739          * firmware.
1740          *
1741          * When the operational firmware is already present, then only
1742          * the check for valid Bluetooth device address is needed. This
1743          * determines if the device will be added as configured or
1744          * unconfigured controller.
1745          *
1746          * It is not possible to use the Secure Boot Parameters in this
1747          * case since that command is only available in bootloader mode.
1748          */
1749         if (ver->fw_variant == 0x23) {
1750                 btintel_clear_flag(hdev, INTEL_BOOTLOADER);
1751                 btintel_check_bdaddr(hdev);
1752
1753                 /* SfP and WsP don't seem to update the firmware version on file
1754                  * so version checking is currently possible.
1755                  */
1756                 switch (ver->hw_variant) {
1757                 case 0x0b:      /* SfP */
1758                 case 0x0c:      /* WsP */
1759                         return 0;
1760                 }
1761
1762                 /* Proceed to download to check if the version matches */
1763                 goto download;
1764         }
1765
1766         /* Read the secure boot parameters to identify the operating
1767          * details of the bootloader.
1768          */
1769         err = btintel_read_boot_params(hdev, params);
1770         if (err)
1771                 return err;
1772
1773         /* It is required that every single firmware fragment is acknowledged
1774          * with a command complete event. If the boot parameters indicate
1775          * that this bootloader does not send them, then abort the setup.
1776          */
1777         if (params->limited_cce != 0x00) {
1778                 bt_dev_err(hdev, "Unsupported Intel firmware loading method (%u)",
1779                            params->limited_cce);
1780                 return -EINVAL;
1781         }
1782
1783         /* If the OTP has no valid Bluetooth device address, then there will
1784          * also be no valid address for the operational firmware.
1785          */
1786         if (!bacmp(&params->otp_bdaddr, BDADDR_ANY)) {
1787                 bt_dev_info(hdev, "No device address configured");
1788                 set_bit(HCI_QUIRK_INVALID_BDADDR, &hdev->quirks);
1789         }
1790
1791 download:
1792         /* With this Intel bootloader only the hardware variant and device
1793          * revision information are used to select the right firmware for SfP
1794          * and WsP.
1795          *
1796          * The firmware filename is ibt-<hw_variant>-<dev_revid>.sfi.
1797          *
1798          * Currently the supported hardware variants are:
1799          *   11 (0x0b) for iBT3.0 (LnP/SfP)
1800          *   12 (0x0c) for iBT3.5 (WsP)
1801          *
1802          * For ThP/JfP and for future SKU's, the FW name varies based on HW
1803          * variant, HW revision and FW revision, as these are dependent on CNVi
1804          * and RF Combination.
1805          *
1806          *   17 (0x11) for iBT3.5 (JfP)
1807          *   18 (0x12) for iBT3.5 (ThP)
1808          *
1809          * The firmware file name for these will be
1810          * ibt-<hw_variant>-<hw_revision>-<fw_revision>.sfi.
1811          *
1812          */
1813         err = btintel_get_fw_name(ver, params, fwname, sizeof(fwname), "sfi");
1814         if (err < 0) {
1815                 if (!btintel_test_flag(hdev, INTEL_BOOTLOADER)) {
1816                         /* Firmware has already been loaded */
1817                         btintel_set_flag(hdev, INTEL_FIRMWARE_LOADED);
1818                         return 0;
1819                 }
1820
1821                 bt_dev_err(hdev, "Unsupported Intel firmware naming");
1822                 return -EINVAL;
1823         }
1824
1825         err = firmware_request_nowarn(&fw, fwname, &hdev->dev);
1826         if (err < 0) {
1827                 if (!btintel_test_flag(hdev, INTEL_BOOTLOADER)) {
1828                         /* Firmware has already been loaded */
1829                         btintel_set_flag(hdev, INTEL_FIRMWARE_LOADED);
1830                         return 0;
1831                 }
1832
1833                 bt_dev_err(hdev, "Failed to load Intel firmware file %s (%d)",
1834                            fwname, err);
1835                 return err;
1836         }
1837
1838         bt_dev_info(hdev, "Found device firmware: %s", fwname);
1839
1840         if (fw->size < 644) {
1841                 bt_dev_err(hdev, "Invalid size of firmware file (%zu)",
1842                            fw->size);
1843                 err = -EBADF;
1844                 goto done;
1845         }
1846
1847         calltime = ktime_get();
1848
1849         btintel_set_flag(hdev, INTEL_DOWNLOADING);
1850
1851         /* Start firmware downloading and get boot parameter */
1852         err = btintel_download_firmware(hdev, ver, fw, boot_param);
1853         if (err < 0) {
1854                 if (err == -EALREADY) {
1855                         /* Firmware has already been loaded */
1856                         btintel_set_flag(hdev, INTEL_FIRMWARE_LOADED);
1857                         err = 0;
1858                         goto done;
1859                 }
1860
1861                 /* When FW download fails, send Intel Reset to retry
1862                  * FW download.
1863                  */
1864                 btintel_reset_to_bootloader(hdev);
1865                 goto done;
1866         }
1867
1868         /* Before switching the device into operational mode and with that
1869          * booting the loaded firmware, wait for the bootloader notification
1870          * that all fragments have been successfully received.
1871          *
1872          * When the event processing receives the notification, then the
1873          * INTEL_DOWNLOADING flag will be cleared.
1874          *
1875          * The firmware loading should not take longer than 5 seconds
1876          * and thus just timeout if that happens and fail the setup
1877          * of this device.
1878          */
1879         err = btintel_download_wait(hdev, calltime, 5000);
1880         if (err == -ETIMEDOUT)
1881                 btintel_reset_to_bootloader(hdev);
1882
1883 done:
1884         release_firmware(fw);
1885         return err;
1886 }
1887
1888 static int btintel_bootloader_setup(struct hci_dev *hdev,
1889                                     struct intel_version *ver)
1890 {
1891         struct intel_version new_ver;
1892         struct intel_boot_params params;
1893         u32 boot_param;
1894         char ddcname[64];
1895         int err;
1896         struct intel_debug_features features;
1897
1898         BT_DBG("%s", hdev->name);
1899
1900         /* Set the default boot parameter to 0x0 and it is updated to
1901          * SKU specific boot parameter after reading Intel_Write_Boot_Params
1902          * command while downloading the firmware.
1903          */
1904         boot_param = 0x00000000;
1905
1906         btintel_set_flag(hdev, INTEL_BOOTLOADER);
1907
1908         err = btintel_download_fw(hdev, ver, &params, &boot_param);
1909         if (err)
1910                 return err;
1911
1912         /* controller is already having an operational firmware */
1913         if (ver->fw_variant == 0x23)
1914                 goto finish;
1915
1916         err = btintel_boot(hdev, boot_param);
1917         if (err)
1918                 return err;
1919
1920         btintel_clear_flag(hdev, INTEL_BOOTLOADER);
1921
1922         err = btintel_get_fw_name(ver, &params, ddcname,
1923                                                 sizeof(ddcname), "ddc");
1924
1925         if (err < 0) {
1926                 bt_dev_err(hdev, "Unsupported Intel firmware naming");
1927         } else {
1928                 /* Once the device is running in operational mode, it needs to
1929                  * apply the device configuration (DDC) parameters.
1930                  *
1931                  * The device can work without DDC parameters, so even if it
1932                  * fails to load the file, no need to fail the setup.
1933                  */
1934                 btintel_load_ddc_config(hdev, ddcname);
1935         }
1936
1937         /* Read the Intel supported features and if new exception formats
1938          * supported, need to load the additional DDC config to enable.
1939          */
1940         err = btintel_read_debug_features(hdev, &features);
1941         if (!err) {
1942                 /* Set DDC mask for available debug features */
1943                 btintel_set_debug_features(hdev, &features);
1944         }
1945
1946         /* Read the Intel version information after loading the FW  */
1947         err = btintel_read_version(hdev, &new_ver);
1948         if (err)
1949                 return err;
1950
1951         btintel_version_info(hdev, &new_ver);
1952
1953 finish:
1954         /* Set the event mask for Intel specific vendor events. This enables
1955          * a few extra events that are useful during general operation. It
1956          * does not enable any debugging related events.
1957          *
1958          * The device will function correctly without these events enabled
1959          * and thus no need to fail the setup.
1960          */
1961         btintel_set_event_mask(hdev, false);
1962
1963         return 0;
1964 }
1965
1966 static void btintel_get_fw_name_tlv(const struct intel_version_tlv *ver,
1967                                     char *fw_name, size_t len,
1968                                     const char *suffix)
1969 {
1970         /* The firmware file name for new generation controllers will be
1971          * ibt-<cnvi_top type+cnvi_top step>-<cnvr_top type+cnvr_top step>
1972          */
1973         snprintf(fw_name, len, "intel/ibt-%04x-%04x.%s",
1974                  INTEL_CNVX_TOP_PACK_SWAB(INTEL_CNVX_TOP_TYPE(ver->cnvi_top),
1975                                           INTEL_CNVX_TOP_STEP(ver->cnvi_top)),
1976                  INTEL_CNVX_TOP_PACK_SWAB(INTEL_CNVX_TOP_TYPE(ver->cnvr_top),
1977                                           INTEL_CNVX_TOP_STEP(ver->cnvr_top)),
1978                  suffix);
1979 }
1980
1981 static int btintel_prepare_fw_download_tlv(struct hci_dev *hdev,
1982                                            struct intel_version_tlv *ver,
1983                                            u32 *boot_param)
1984 {
1985         const struct firmware *fw;
1986         char fwname[64];
1987         int err;
1988         ktime_t calltime;
1989
1990         if (!ver || !boot_param)
1991                 return -EINVAL;
1992
1993         /* The firmware variant determines if the device is in bootloader
1994          * mode or is running operational firmware. The value 0x03 identifies
1995          * the bootloader and the value 0x23 identifies the operational
1996          * firmware.
1997          *
1998          * When the operational firmware is already present, then only
1999          * the check for valid Bluetooth device address is needed. This
2000          * determines if the device will be added as configured or
2001          * unconfigured controller.
2002          *
2003          * It is not possible to use the Secure Boot Parameters in this
2004          * case since that command is only available in bootloader mode.
2005          */
2006         if (ver->img_type == 0x03) {
2007                 btintel_clear_flag(hdev, INTEL_BOOTLOADER);
2008                 btintel_check_bdaddr(hdev);
2009         }
2010
2011         /* If the OTP has no valid Bluetooth device address, then there will
2012          * also be no valid address for the operational firmware.
2013          */
2014         if (!bacmp(&ver->otp_bd_addr, BDADDR_ANY)) {
2015                 bt_dev_info(hdev, "No device address configured");
2016                 set_bit(HCI_QUIRK_INVALID_BDADDR, &hdev->quirks);
2017         }
2018
2019         btintel_get_fw_name_tlv(ver, fwname, sizeof(fwname), "sfi");
2020         err = firmware_request_nowarn(&fw, fwname, &hdev->dev);
2021         if (err < 0) {
2022                 if (!btintel_test_flag(hdev, INTEL_BOOTLOADER)) {
2023                         /* Firmware has already been loaded */
2024                         btintel_set_flag(hdev, INTEL_FIRMWARE_LOADED);
2025                         return 0;
2026                 }
2027
2028                 bt_dev_err(hdev, "Failed to load Intel firmware file %s (%d)",
2029                            fwname, err);
2030
2031                 return err;
2032         }
2033
2034         bt_dev_info(hdev, "Found device firmware: %s", fwname);
2035
2036         if (fw->size < 644) {
2037                 bt_dev_err(hdev, "Invalid size of firmware file (%zu)",
2038                            fw->size);
2039                 err = -EBADF;
2040                 goto done;
2041         }
2042
2043         calltime = ktime_get();
2044
2045         btintel_set_flag(hdev, INTEL_DOWNLOADING);
2046
2047         /* Start firmware downloading and get boot parameter */
2048         err = btintel_download_fw_tlv(hdev, ver, fw, boot_param,
2049                                                INTEL_HW_VARIANT(ver->cnvi_bt),
2050                                                ver->sbe_type);
2051         if (err < 0) {
2052                 if (err == -EALREADY) {
2053                         /* Firmware has already been loaded */
2054                         btintel_set_flag(hdev, INTEL_FIRMWARE_LOADED);
2055                         err = 0;
2056                         goto done;
2057                 }
2058
2059                 /* When FW download fails, send Intel Reset to retry
2060                  * FW download.
2061                  */
2062                 btintel_reset_to_bootloader(hdev);
2063                 goto done;
2064         }
2065
2066         /* Before switching the device into operational mode and with that
2067          * booting the loaded firmware, wait for the bootloader notification
2068          * that all fragments have been successfully received.
2069          *
2070          * When the event processing receives the notification, then the
2071          * BTUSB_DOWNLOADING flag will be cleared.
2072          *
2073          * The firmware loading should not take longer than 5 seconds
2074          * and thus just timeout if that happens and fail the setup
2075          * of this device.
2076          */
2077         err = btintel_download_wait(hdev, calltime, 5000);
2078         if (err == -ETIMEDOUT)
2079                 btintel_reset_to_bootloader(hdev);
2080
2081 done:
2082         release_firmware(fw);
2083         return err;
2084 }
2085
2086 static int btintel_bootloader_setup_tlv(struct hci_dev *hdev,
2087                                         struct intel_version_tlv *ver)
2088 {
2089         u32 boot_param;
2090         char ddcname[64];
2091         int err;
2092         struct intel_debug_features features;
2093         struct intel_version_tlv new_ver;
2094
2095         bt_dev_dbg(hdev, "");
2096
2097         /* Set the default boot parameter to 0x0 and it is updated to
2098          * SKU specific boot parameter after reading Intel_Write_Boot_Params
2099          * command while downloading the firmware.
2100          */
2101         boot_param = 0x00000000;
2102
2103         btintel_set_flag(hdev, INTEL_BOOTLOADER);
2104
2105         err = btintel_prepare_fw_download_tlv(hdev, ver, &boot_param);
2106         if (err)
2107                 return err;
2108
2109         /* check if controller is already having an operational firmware */
2110         if (ver->img_type == 0x03)
2111                 goto finish;
2112
2113         err = btintel_boot(hdev, boot_param);
2114         if (err)
2115                 return err;
2116
2117         btintel_clear_flag(hdev, INTEL_BOOTLOADER);
2118
2119         btintel_get_fw_name_tlv(ver, ddcname, sizeof(ddcname), "ddc");
2120         /* Once the device is running in operational mode, it needs to
2121          * apply the device configuration (DDC) parameters.
2122          *
2123          * The device can work without DDC parameters, so even if it
2124          * fails to load the file, no need to fail the setup.
2125          */
2126         btintel_load_ddc_config(hdev, ddcname);
2127
2128         /* Read the Intel supported features and if new exception formats
2129          * supported, need to load the additional DDC config to enable.
2130          */
2131         err = btintel_read_debug_features(hdev, &features);
2132         if (!err) {
2133                 /* Set DDC mask for available debug features */
2134                 btintel_set_debug_features(hdev, &features);
2135         }
2136
2137         /* Read the Intel version information after loading the FW  */
2138         err = btintel_read_version_tlv(hdev, &new_ver);
2139         if (err)
2140                 return err;
2141
2142         btintel_version_info_tlv(hdev, &new_ver);
2143
2144 finish:
2145         /* Set the event mask for Intel specific vendor events. This enables
2146          * a few extra events that are useful during general operation. It
2147          * does not enable any debugging related events.
2148          *
2149          * The device will function correctly without these events enabled
2150          * and thus no need to fail the setup.
2151          */
2152         btintel_set_event_mask(hdev, false);
2153
2154         return 0;
2155 }
2156
2157 static void btintel_set_msft_opcode(struct hci_dev *hdev, u8 hw_variant)
2158 {
2159         switch (hw_variant) {
2160         /* Legacy bootloader devices that supports MSFT Extension */
2161         case 0x11:      /* JfP */
2162         case 0x12:      /* ThP */
2163         case 0x13:      /* HrP */
2164         case 0x14:      /* CcP */
2165         /* All Intel new genration controllers support the Microsoft vendor
2166          * extension are using 0xFC1E for VsMsftOpCode.
2167          */
2168         case 0x17:
2169         case 0x18:
2170         case 0x19:
2171                 hci_set_msft_opcode(hdev, 0xFC1E);
2172                 break;
2173         default:
2174                 /* Not supported */
2175                 break;
2176         }
2177 }
2178
2179 static int btintel_setup_combined(struct hci_dev *hdev)
2180 {
2181         const u8 param[1] = { 0xFF };
2182         struct intel_version ver;
2183         struct intel_version_tlv ver_tlv;
2184         struct sk_buff *skb;
2185         int err;
2186
2187         BT_DBG("%s", hdev->name);
2188
2189         /* The some controllers have a bug with the first HCI command sent to it
2190          * returning number of completed commands as zero. This would stall the
2191          * command processing in the Bluetooth core.
2192          *
2193          * As a workaround, send HCI Reset command first which will reset the
2194          * number of completed commands and allow normal command processing
2195          * from now on.
2196          */
2197         if (btintel_test_flag(hdev, INTEL_BROKEN_INITIAL_NCMD)) {
2198                 skb = __hci_cmd_sync(hdev, HCI_OP_RESET, 0, NULL,
2199                                      HCI_INIT_TIMEOUT);
2200                 if (IS_ERR(skb)) {
2201                         bt_dev_err(hdev,
2202                                    "sending initial HCI reset failed (%ld)",
2203                                    PTR_ERR(skb));
2204                         return PTR_ERR(skb);
2205                 }
2206                 kfree_skb(skb);
2207         }
2208
2209         /* Starting from TyP device, the command parameter and response are
2210          * changed even though the OCF for HCI_Intel_Read_Version command
2211          * remains same. The legacy devices can handle even if the
2212          * command has a parameter and returns a correct version information.
2213          * So, it uses new format to support both legacy and new format.
2214          */
2215         skb = __hci_cmd_sync(hdev, 0xfc05, 1, param, HCI_CMD_TIMEOUT);
2216         if (IS_ERR(skb)) {
2217                 bt_dev_err(hdev, "Reading Intel version command failed (%ld)",
2218                            PTR_ERR(skb));
2219                 return PTR_ERR(skb);
2220         }
2221
2222         /* Check the status */
2223         if (skb->data[0]) {
2224                 bt_dev_err(hdev, "Intel Read Version command failed (%02x)",
2225                            skb->data[0]);
2226                 err = -EIO;
2227                 goto exit_error;
2228         }
2229
2230         /* Apply the common HCI quirks for Intel device */
2231         set_bit(HCI_QUIRK_STRICT_DUPLICATE_FILTER, &hdev->quirks);
2232         set_bit(HCI_QUIRK_SIMULTANEOUS_DISCOVERY, &hdev->quirks);
2233         set_bit(HCI_QUIRK_NON_PERSISTENT_DIAG, &hdev->quirks);
2234
2235         /* For Legacy device, check the HW platform value and size */
2236         if (skb->len == sizeof(ver) && skb->data[1] == 0x37) {
2237                 bt_dev_dbg(hdev, "Read the legacy Intel version information");
2238
2239                 memcpy(&ver, skb->data, sizeof(ver));
2240
2241                 /* Display version information */
2242                 btintel_version_info(hdev, &ver);
2243
2244                 /* Check for supported iBT hardware variants of this firmware
2245                  * loading method.
2246                  *
2247                  * This check has been put in place to ensure correct forward
2248                  * compatibility options when newer hardware variants come
2249                  * along.
2250                  */
2251                 switch (ver.hw_variant) {
2252                 case 0x07:      /* WP */
2253                 case 0x08:      /* StP */
2254                         /* Legacy ROM product */
2255                         btintel_set_flag(hdev, INTEL_ROM_LEGACY);
2256
2257                         /* Apply the device specific HCI quirks
2258                          *
2259                          * WBS for SdP - SdP and Stp have a same hw_varaint but
2260                          * different fw_variant
2261                          */
2262                         if (ver.hw_variant == 0x08 && ver.fw_variant == 0x22)
2263                                 set_bit(HCI_QUIRK_WIDEBAND_SPEECH_SUPPORTED,
2264                                         &hdev->quirks);
2265
2266                         /* These devices have an issue with LED which doesn't
2267                          * go off immediately during shutdown. Set the flag
2268                          * here to send the LED OFF command during shutdown.
2269                          */
2270                         btintel_set_flag(hdev, INTEL_BROKEN_LED);
2271
2272                         err = btintel_legacy_rom_setup(hdev, &ver);
2273                         break;
2274                 case 0x0b:      /* SfP */
2275                 case 0x0c:      /* WsP */
2276                 case 0x11:      /* JfP */
2277                 case 0x12:      /* ThP */
2278                 case 0x13:      /* HrP */
2279                 case 0x14:      /* CcP */
2280                         /* Apply the device specific HCI quirks
2281                          *
2282                          * All Legacy bootloader devices support WBS
2283                          */
2284                         set_bit(HCI_QUIRK_WIDEBAND_SPEECH_SUPPORTED,
2285                                 &hdev->quirks);
2286
2287                         /* Valid LE States quirk for JfP/ThP familiy */
2288                         if (ver.hw_variant == 0x11 || ver.hw_variant == 0x12)
2289                                 set_bit(HCI_QUIRK_VALID_LE_STATES,
2290                                         &hdev->quirks);
2291
2292                         /* Setup MSFT Extension support */
2293                         btintel_set_msft_opcode(hdev, ver.hw_variant);
2294
2295                         err = btintel_bootloader_setup(hdev, &ver);
2296                         break;
2297                 default:
2298                         bt_dev_err(hdev, "Unsupported Intel hw variant (%u)",
2299                                    ver.hw_variant);
2300                         err = -EINVAL;
2301                 }
2302
2303                 goto exit_error;
2304         }
2305
2306         /* For TLV type device, parse the tlv data */
2307         err = btintel_parse_version_tlv(hdev, &ver_tlv, skb);
2308         if (err) {
2309                 bt_dev_err(hdev, "Failed to parse TLV version information");
2310                 goto exit_error;
2311         }
2312
2313         if (INTEL_HW_PLATFORM(ver_tlv.cnvi_bt) != 0x37) {
2314                 bt_dev_err(hdev, "Unsupported Intel hardware platform (0x%2x)",
2315                            INTEL_HW_PLATFORM(ver_tlv.cnvi_bt));
2316                 err = -EINVAL;
2317                 goto exit_error;
2318         }
2319
2320         /* Check for supported iBT hardware variants of this firmware
2321          * loading method.
2322          *
2323          * This check has been put in place to ensure correct forward
2324          * compatibility options when newer hardware variants come
2325          * along.
2326          */
2327         switch (INTEL_HW_VARIANT(ver_tlv.cnvi_bt)) {
2328         case 0x11:      /* JfP */
2329         case 0x12:      /* ThP */
2330         case 0x13:      /* HrP */
2331         case 0x14:      /* CcP */
2332                 /* Some legacy bootloader devices from JfP supports both old
2333                  * and TLV based HCI_Intel_Read_Version command. But we don't
2334                  * want to use the TLV based setup routines for those legacy
2335                  * bootloader device.
2336                  *
2337                  * Also, it is not easy to convert TLV based version from the
2338                  * legacy version format.
2339                  *
2340                  * So, as a workaround for those devices, use the legacy
2341                  * HCI_Intel_Read_Version to get the version information and
2342                  * run the legacy bootloader setup.
2343                  */
2344                 err = btintel_read_version(hdev, &ver);
2345                 if (err)
2346                         return err;
2347                 err = btintel_bootloader_setup(hdev, &ver);
2348                 break;
2349         case 0x17:
2350         case 0x18:
2351         case 0x19:
2352                 /* Display version information of TLV type */
2353                 btintel_version_info_tlv(hdev, &ver_tlv);
2354
2355                 /* Apply the device specific HCI quirks for TLV based devices
2356                  *
2357                  * All TLV based devices support WBS
2358                  */
2359                 set_bit(HCI_QUIRK_WIDEBAND_SPEECH_SUPPORTED, &hdev->quirks);
2360
2361                 /* Valid LE States quirk for GfP */
2362                 if (INTEL_HW_VARIANT(ver_tlv.cnvi_bt) == 0x18)
2363                         set_bit(HCI_QUIRK_VALID_LE_STATES, &hdev->quirks);
2364
2365                 /* Setup MSFT Extension support */
2366                 btintel_set_msft_opcode(hdev,
2367                                         INTEL_HW_VARIANT(ver_tlv.cnvi_bt));
2368
2369                 err = btintel_bootloader_setup_tlv(hdev, &ver_tlv);
2370                 break;
2371         default:
2372                 bt_dev_err(hdev, "Unsupported Intel hw variant (%u)",
2373                            INTEL_HW_VARIANT(ver_tlv.cnvi_bt));
2374                 return -EINVAL;
2375         }
2376
2377 exit_error:
2378         kfree_skb(skb);
2379
2380         return err;
2381 }
2382
2383 static int btintel_shutdown_combined(struct hci_dev *hdev)
2384 {
2385         struct sk_buff *skb;
2386         int ret;
2387
2388         /* Send HCI Reset to the controller to stop any BT activity which
2389          * were triggered. This will help to save power and maintain the
2390          * sync b/w Host and controller
2391          */
2392         skb = __hci_cmd_sync(hdev, HCI_OP_RESET, 0, NULL, HCI_INIT_TIMEOUT);
2393         if (IS_ERR(skb)) {
2394                 bt_dev_err(hdev, "HCI reset during shutdown failed");
2395                 return PTR_ERR(skb);
2396         }
2397         kfree_skb(skb);
2398
2399
2400         /* Some platforms have an issue with BT LED when the interface is
2401          * down or BT radio is turned off, which takes 5 seconds to BT LED
2402          * goes off. This command turns off the BT LED immediately.
2403          */
2404         if (btintel_test_flag(hdev, INTEL_BROKEN_LED)) {
2405                 skb = __hci_cmd_sync(hdev, 0xfc3f, 0, NULL, HCI_INIT_TIMEOUT);
2406                 if (IS_ERR(skb)) {
2407                         ret = PTR_ERR(skb);
2408                         bt_dev_err(hdev, "turning off Intel device LED failed");
2409                         return ret;
2410                 }
2411                 kfree_skb(skb);
2412         }
2413
2414         return 0;
2415 }
2416
2417 int btintel_configure_setup(struct hci_dev *hdev)
2418 {
2419         hdev->manufacturer = 2;
2420         hdev->setup = btintel_setup_combined;
2421         hdev->shutdown = btintel_shutdown_combined;
2422         hdev->hw_error = btintel_hw_error;
2423         hdev->set_diag = btintel_set_diag_combined;
2424         hdev->set_bdaddr = btintel_set_bdaddr;
2425
2426         return 0;
2427 }
2428 EXPORT_SYMBOL_GPL(btintel_configure_setup);
2429
2430 void btintel_bootup(struct hci_dev *hdev, const void *ptr, unsigned int len)
2431 {
2432         const struct intel_bootup *evt = ptr;
2433
2434         if (len != sizeof(*evt))
2435                 return;
2436
2437         if (btintel_test_and_clear_flag(hdev, INTEL_BOOTING))
2438                 btintel_wake_up_flag(hdev, INTEL_BOOTING);
2439 }
2440 EXPORT_SYMBOL_GPL(btintel_bootup);
2441
2442 void btintel_secure_send_result(struct hci_dev *hdev,
2443                                 const void *ptr, unsigned int len)
2444 {
2445         const struct intel_secure_send_result *evt = ptr;
2446
2447         if (len != sizeof(*evt))
2448                 return;
2449
2450         if (evt->result)
2451                 btintel_set_flag(hdev, INTEL_FIRMWARE_FAILED);
2452
2453         if (btintel_test_and_clear_flag(hdev, INTEL_DOWNLOADING) &&
2454             btintel_test_flag(hdev, INTEL_FIRMWARE_LOADED))
2455                 btintel_wake_up_flag(hdev, INTEL_DOWNLOADING);
2456 }
2457 EXPORT_SYMBOL_GPL(btintel_secure_send_result);
2458
2459 MODULE_AUTHOR("Marcel Holtmann <[email protected]>");
2460 MODULE_DESCRIPTION("Bluetooth support for Intel devices ver " VERSION);
2461 MODULE_VERSION(VERSION);
2462 MODULE_LICENSE("GPL");
2463 MODULE_FIRMWARE("intel/ibt-11-5.sfi");
2464 MODULE_FIRMWARE("intel/ibt-11-5.ddc");
2465 MODULE_FIRMWARE("intel/ibt-12-16.sfi");
2466 MODULE_FIRMWARE("intel/ibt-12-16.ddc");