drivers/bluetooth/btintel.c

   1 // SPDX-License-Identifier: GPL-2.0-or-later
   2 /*
   3  *
   4  *  Bluetooth support for Intel devices
   5  *
   6  *  Copyright (C) 2015  Intel Corporation
   7  */
   8
   9 #include <linux/module.h>
  10 #include <linux/firmware.h>
  11 #include <linux/regmap.h>
  12 #include <asm/unaligned.h>
  13
  14 #include <net/bluetooth/bluetooth.h>
  15 #include <net/bluetooth/hci_core.h>
  16
  17 #include "btintel.h"
  18
  19 #define VERSION "0.1"
  20
  21 #define BDADDR_INTEL            (&(bdaddr_t){{0x00, 0x8b, 0x9e, 0x19, 0x03, 0x00}})
  22 #define RSA_HEADER_LEN          644
  23 #define CSS_HEADER_OFFSET       8
  24 #define ECDSA_OFFSET            644
  25 #define ECDSA_HEADER_LEN        320
  26
  27 #define CMD_WRITE_BOOT_PARAMS   0xfc0e
  28 struct cmd_write_boot_params {
  29         u32 boot_addr;
  30         u8  fw_build_num;
  31         u8  fw_build_ww;
  32         u8  fw_build_yy;
  33 } __packed;
  34
  35 int btintel_check_bdaddr(struct hci_dev *hdev)
  36 {
  37         struct hci_rp_read_bd_addr *bda;
  38         struct sk_buff *skb;
  39
  40         skb = __hci_cmd_sync(hdev, HCI_OP_READ_BD_ADDR, 0, NULL,
  41                              HCI_INIT_TIMEOUT);
  42         if (IS_ERR(skb)) {
  43                 int err = PTR_ERR(skb);
  44                 bt_dev_err(hdev, "Reading Intel device address failed (%d)",
  45                            err);
  46                 return err;
  47         }
  48
  49         if (skb->len != sizeof(*bda)) {
  50                 bt_dev_err(hdev, "Intel device address length mismatch");
  51                 kfree_skb(skb);
  52                 return -EIO;
  53         }
  54
  55         bda = (struct hci_rp_read_bd_addr *)skb->data;
  56
  57         /* For some Intel based controllers, the default Bluetooth device
  58          * address 00:03:19:9E:8B:00 can be found. These controllers are
  59          * fully operational, but have the danger of duplicate addresses
  60          * and that in turn can cause problems with Bluetooth operation.
  61          */
  62         if (!bacmp(&bda->bdaddr, BDADDR_INTEL)) {
  63                 bt_dev_err(hdev, "Found Intel default device address (%pMR)",
  64                            &bda->bdaddr);
  65                 set_bit(HCI_QUIRK_INVALID_BDADDR, &hdev->quirks);
  66         }
  67
  68         kfree_skb(skb);
  69
  70         return 0;
  71 }
  72 EXPORT_SYMBOL_GPL(btintel_check_bdaddr);
  73
  74 int btintel_enter_mfg(struct hci_dev *hdev)
  75 {
  76         static const u8 param[] = { 0x01, 0x00 };
  77         struct sk_buff *skb;
  78
  79         skb = __hci_cmd_sync(hdev, 0xfc11, 2, param, HCI_CMD_TIMEOUT);
  80         if (IS_ERR(skb)) {
  81                 bt_dev_err(hdev, "Entering manufacturer mode failed (%ld)",
  82                            PTR_ERR(skb));
  83                 return PTR_ERR(skb);
  84         }
  85         kfree_skb(skb);
  86
  87         return 0;
  88 }
  89 EXPORT_SYMBOL_GPL(btintel_enter_mfg);
  90
  91 int btintel_exit_mfg(struct hci_dev *hdev, bool reset, bool patched)
  92 {
  93         u8 param[] = { 0x00, 0x00 };
  94         struct sk_buff *skb;
  95
  96         /* The 2nd command parameter specifies the manufacturing exit method:
  97          * 0x00: Just disable the manufacturing mode (0x00).
  98          * 0x01: Disable manufacturing mode and reset with patches deactivated.
  99          * 0x02: Disable manufacturing mode and reset with patches activated.
 100          */
 101         if (reset)
 102                 param[1] |= patched ? 0x02 : 0x01;
 103
 104         skb = __hci_cmd_sync(hdev, 0xfc11, 2, param, HCI_CMD_TIMEOUT);
 105         if (IS_ERR(skb)) {
 106                 bt_dev_err(hdev, "Exiting manufacturer mode failed (%ld)",
 107                            PTR_ERR(skb));
 108                 return PTR_ERR(skb);
 109         }
 110         kfree_skb(skb);
 111
 112         return 0;
 113 }
 114 EXPORT_SYMBOL_GPL(btintel_exit_mfg);
 115
 116 int btintel_set_bdaddr(struct hci_dev *hdev, const bdaddr_t *bdaddr)
 117 {
 118         struct sk_buff *skb;
 119         int err;
 120
 121         skb = __hci_cmd_sync(hdev, 0xfc31, 6, bdaddr, HCI_INIT_TIMEOUT);
 122         if (IS_ERR(skb)) {
 123                 err = PTR_ERR(skb);
 124                 bt_dev_err(hdev, "Changing Intel device address failed (%d)",
 125                            err);
 126                 return err;
 127         }
 128         kfree_skb(skb);
 129
 130         return 0;
 131 }
 132 EXPORT_SYMBOL_GPL(btintel_set_bdaddr);
 133
 134 static int btintel_set_event_mask(struct hci_dev *hdev, bool debug)
 135 {
 136         u8 mask[8] = { 0x87, 0x0c, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 };
 137         struct sk_buff *skb;
 138         int err;
 139
 140         if (debug)
 141                 mask[1] |= 0x62;
 142
 143         skb = __hci_cmd_sync(hdev, 0xfc52, 8, mask, HCI_INIT_TIMEOUT);
 144         if (IS_ERR(skb)) {
 145                 err = PTR_ERR(skb);
 146                 bt_dev_err(hdev, "Setting Intel event mask failed (%d)", err);
 147                 return err;
 148         }
 149         kfree_skb(skb);
 150
 151         return 0;
 152 }
 153
 154 int btintel_set_diag(struct hci_dev *hdev, bool enable)
 155 {
 156         struct sk_buff *skb;
 157         u8 param[3];
 158         int err;
 159
 160         if (enable) {
 161                 param[0] = 0x03;
 162                 param[1] = 0x03;
 163                 param[2] = 0x03;
 164         } else {
 165                 param[0] = 0x00;
 166                 param[1] = 0x00;
 167                 param[2] = 0x00;
 168         }
 169
 170         skb = __hci_cmd_sync(hdev, 0xfc43, 3, param, HCI_INIT_TIMEOUT);
 171         if (IS_ERR(skb)) {
 172                 err = PTR_ERR(skb);
 173                 if (err == -ENODATA)
 174                         goto done;
 175                 bt_dev_err(hdev, "Changing Intel diagnostic mode failed (%d)",
 176                            err);
 177                 return err;
 178         }
 179         kfree_skb(skb);
 180
 181 done:
 182         btintel_set_event_mask(hdev, enable);
 183         return 0;
 184 }
 185 EXPORT_SYMBOL_GPL(btintel_set_diag);
 186
 187 static int btintel_set_diag_mfg(struct hci_dev *hdev, bool enable)
 188 {
 189         int err, ret;
 190
 191         err = btintel_enter_mfg(hdev);
 192         if (err)
 193                 return err;
 194
 195         ret = btintel_set_diag(hdev, enable);
 196
 197         err = btintel_exit_mfg(hdev, false, false);
 198         if (err)
 199                 return err;
 200
 201         return ret;
 202 }
 203
 204 static int btintel_set_diag_combined(struct hci_dev *hdev, bool enable)
 205 {
 206         int ret;
 207
 208         /* Legacy ROM device needs to be in the manufacturer mode to apply
 209          * diagnostic setting
 210          *
 211          * This flag is set after reading the Intel version.
 212          */
 213         if (btintel_test_flag(hdev, INTEL_ROM_LEGACY))
 214                 ret = btintel_set_diag_mfg(hdev, enable);
 215         else
 216                 ret = btintel_set_diag(hdev, enable);
 217
 218         return ret;
 219 }
 220
 221 static void btintel_hw_error(struct hci_dev *hdev, u8 code)
 222 {
 223         struct sk_buff *skb;
 224         u8 type = 0x00;
 225
 226         bt_dev_err(hdev, "Hardware error 0x%2.2x", code);
 227
 228         skb = __hci_cmd_sync(hdev, HCI_OP_RESET, 0, NULL, HCI_INIT_TIMEOUT);
 229         if (IS_ERR(skb)) {
 230                 bt_dev_err(hdev, "Reset after hardware error failed (%ld)",
 231                            PTR_ERR(skb));
 232                 return;
 233         }
 234         kfree_skb(skb);
 235
 236         skb = __hci_cmd_sync(hdev, 0xfc22, 1, &type, HCI_INIT_TIMEOUT);
 237         if (IS_ERR(skb)) {
 238                 bt_dev_err(hdev, "Retrieving Intel exception info failed (%ld)",
 239                            PTR_ERR(skb));
 240                 return;
 241         }
 242
 243         if (skb->len != 13) {
 244                 bt_dev_err(hdev, "Exception info size mismatch");
 245                 kfree_skb(skb);
 246                 return;
 247         }
 248
 249         bt_dev_err(hdev, "Exception info %s", (char *)(skb->data + 1));
 250
 251         kfree_skb(skb);
 252 }
 253
 254 int btintel_version_info(struct hci_dev *hdev, struct intel_version *ver)
 255 {
 256         const char *variant;
 257
 258         /* The hardware platform number has a fixed value of 0x37 and
 259          * for now only accept this single value.
 260          */
 261         if (ver->hw_platform != 0x37) {
 262                 bt_dev_err(hdev, "Unsupported Intel hardware platform (%u)",
 263                            ver->hw_platform);
 264                 return -EINVAL;
 265         }
 266
 267         /* Check for supported iBT hardware variants of this firmware
 268          * loading method.
 269          *
 270          * This check has been put in place to ensure correct forward
 271          * compatibility options when newer hardware variants come along.
 272          */
 273         switch (ver->hw_variant) {
 274         case 0x07:      /* WP - Legacy ROM */
 275         case 0x08:      /* StP - Legacy ROM */
 276         case 0x0b:      /* SfP */
 277         case 0x0c:      /* WsP */
 278         case 0x11:      /* JfP */
 279         case 0x12:      /* ThP */
 280         case 0x13:      /* HrP */
 281         case 0x14:      /* CcP */
 282                 break;
 283         default:
 284                 bt_dev_err(hdev, "Unsupported Intel hardware variant (%u)",
 285                            ver->hw_variant);
 286                 return -EINVAL;
 287         }
 288
 289         switch (ver->fw_variant) {
 290         case 0x01:
 291                 variant = "Legacy ROM 2.5";
 292                 break;
 293         case 0x06:
 294                 variant = "Bootloader";
 295                 break;
 296         case 0x22:
 297                 variant = "Legacy ROM 2.x";
 298                 break;
 299         case 0x23:
 300                 variant = "Firmware";
 301                 break;
 302         default:
 303                 bt_dev_err(hdev, "Unsupported firmware variant(%02x)", ver->fw_variant);
 304                 return -EINVAL;
 305         }
 306
 307         bt_dev_info(hdev, "%s revision %u.%u build %u week %u %u",
 308                     variant, ver->fw_revision >> 4, ver->fw_revision & 0x0f,
 309                     ver->fw_build_num, ver->fw_build_ww,
 310                     2000 + ver->fw_build_yy);
 311
 312         return 0;
 313 }
 314 EXPORT_SYMBOL_GPL(btintel_version_info);
 315
 316 static int btintel_secure_send(struct hci_dev *hdev, u8 fragment_type, u32 plen,
 317                                const void *param)
 318 {
 319         while (plen > 0) {
 320                 struct sk_buff *skb;
 321                 u8 cmd_param[253], fragment_len = (plen > 252) ? 252 : plen;
 322
 323                 cmd_param[0] = fragment_type;
 324                 memcpy(cmd_param + 1, param, fragment_len);
 325
 326                 skb = __hci_cmd_sync(hdev, 0xfc09, fragment_len + 1,
 327                                      cmd_param, HCI_INIT_TIMEOUT);
 328                 if (IS_ERR(skb))
 329                         return PTR_ERR(skb);
 330
 331                 kfree_skb(skb);
 332
 333                 plen -= fragment_len;
 334                 param += fragment_len;
 335         }
 336
 337         return 0;
 338 }
 339
 340 int btintel_load_ddc_config(struct hci_dev *hdev, const char *ddc_name)
 341 {
 342         const struct firmware *fw;
 343         struct sk_buff *skb;
 344         const u8 *fw_ptr;
 345         int err;
 346
 347         err = request_firmware_direct(&fw, ddc_name, &hdev->dev);
 348         if (err < 0) {
 349                 bt_dev_err(hdev, "Failed to load Intel DDC file %s (%d)",
 350                            ddc_name, err);
 351                 return err;
 352         }
 353
 354         bt_dev_info(hdev, "Found Intel DDC parameters: %s", ddc_name);
 355
 356         fw_ptr = fw->data;
 357
 358         /* DDC file contains one or more DDC structure which has
 359          * Length (1 byte), DDC ID (2 bytes), and DDC value (Length - 2).
 360          */
 361         while (fw->size > fw_ptr - fw->data) {
 362                 u8 cmd_plen = fw_ptr[0] + sizeof(u8);
 363
 364                 skb = __hci_cmd_sync(hdev, 0xfc8b, cmd_plen, fw_ptr,
 365                                      HCI_INIT_TIMEOUT);
 366                 if (IS_ERR(skb)) {
 367                         bt_dev_err(hdev, "Failed to send Intel_Write_DDC (%ld)",
 368                                    PTR_ERR(skb));
 369                         release_firmware(fw);
 370                         return PTR_ERR(skb);
 371                 }
 372
 373                 fw_ptr += cmd_plen;
 374                 kfree_skb(skb);
 375         }
 376
 377         release_firmware(fw);
 378
 379         bt_dev_info(hdev, "Applying Intel DDC parameters completed");
 380
 381         return 0;
 382 }
 383 EXPORT_SYMBOL_GPL(btintel_load_ddc_config);
 384
 385 int btintel_set_event_mask_mfg(struct hci_dev *hdev, bool debug)
 386 {
 387         int err, ret;
 388
 389         err = btintel_enter_mfg(hdev);
 390         if (err)
 391                 return err;
 392
 393         ret = btintel_set_event_mask(hdev, debug);
 394
 395         err = btintel_exit_mfg(hdev, false, false);
 396         if (err)
 397                 return err;
 398
 399         return ret;
 400 }
 401 EXPORT_SYMBOL_GPL(btintel_set_event_mask_mfg);
 402
 403 int btintel_read_version(struct hci_dev *hdev, struct intel_version *ver)
 404 {
 405         struct sk_buff *skb;
 406
 407         skb = __hci_cmd_sync(hdev, 0xfc05, 0, NULL, HCI_CMD_TIMEOUT);
 408         if (IS_ERR(skb)) {
 409                 bt_dev_err(hdev, "Reading Intel version information failed (%ld)",
 410                            PTR_ERR(skb));
 411                 return PTR_ERR(skb);
 412         }
 413
 414         if (skb->len != sizeof(*ver)) {
 415                 bt_dev_err(hdev, "Intel version event size mismatch");
 416                 kfree_skb(skb);
 417                 return -EILSEQ;
 418         }
 419
 420         memcpy(ver, skb->data, sizeof(*ver));
 421
 422         kfree_skb(skb);
 423
 424         return 0;
 425 }
 426 EXPORT_SYMBOL_GPL(btintel_read_version);
 427
 428 static int btintel_version_info_tlv(struct hci_dev *hdev,
 429                                     struct intel_version_tlv *version)
 430 {
 431         const char *variant;
 432
 433         /* The hardware platform number has a fixed value of 0x37 and
 434          * for now only accept this single value.
 435          */
 436         if (INTEL_HW_PLATFORM(version->cnvi_bt) != 0x37) {
 437                 bt_dev_err(hdev, "Unsupported Intel hardware platform (0x%2x)",
 438                            INTEL_HW_PLATFORM(version->cnvi_bt));
 439                 return -EINVAL;
 440         }
 441
 442         /* Check for supported iBT hardware variants of this firmware
 443          * loading method.
 444          *
 445          * This check has been put in place to ensure correct forward
 446          * compatibility options when newer hardware variants come along.
 447          */
 448         switch (INTEL_HW_VARIANT(version->cnvi_bt)) {
 449         case 0x17:      /* TyP */
 450         case 0x18:      /* Slr */
 451         case 0x19:      /* Slr-F */
 452                 break;
 453         default:
 454                 bt_dev_err(hdev, "Unsupported Intel hardware variant (0x%x)",
 455                            INTEL_HW_VARIANT(version->cnvi_bt));
 456                 return -EINVAL;
 457         }
 458
 459         switch (version->img_type) {
 460         case 0x01:
 461                 variant = "Bootloader";
 462                 /* It is required that every single firmware fragment is acknowledged
 463                  * with a command complete event. If the boot parameters indicate
 464                  * that this bootloader does not send them, then abort the setup.
 465                  */
 466                 if (version->limited_cce != 0x00) {
 467                         bt_dev_err(hdev, "Unsupported Intel firmware loading method (0x%x)",
 468                                    version->limited_cce);
 469                         return -EINVAL;
 470                 }
 471
 472                 /* Secure boot engine type should be either 1 (ECDSA) or 0 (RSA) */
 473                 if (version->sbe_type > 0x01) {
 474                         bt_dev_err(hdev, "Unsupported Intel secure boot engine type (0x%x)",
 475                                    version->sbe_type);
 476                         return -EINVAL;
 477                 }
 478
 479                 bt_dev_info(hdev, "Device revision is %u", version->dev_rev_id);
 480                 bt_dev_info(hdev, "Secure boot is %s",
 481                             version->secure_boot ? "enabled" : "disabled");
 482                 bt_dev_info(hdev, "OTP lock is %s",
 483                             version->otp_lock ? "enabled" : "disabled");
 484                 bt_dev_info(hdev, "API lock is %s",
 485                             version->api_lock ? "enabled" : "disabled");
 486                 bt_dev_info(hdev, "Debug lock is %s",
 487                             version->debug_lock ? "enabled" : "disabled");
 488                 bt_dev_info(hdev, "Minimum firmware build %u week %u %u",
 489                             version->min_fw_build_nn, version->min_fw_build_cw,
 490                             2000 + version->min_fw_build_yy);
 491                 break;
 492         case 0x03:
 493                 variant = "Firmware";
 494                 break;
 495         default:
 496                 bt_dev_err(hdev, "Unsupported image type(%02x)", version->img_type);
 497                 return -EINVAL;
 498         }
 499
 500         bt_dev_info(hdev, "%s timestamp %u.%u buildtype %u build %u", variant,
 501                     2000 + (version->timestamp >> 8), version->timestamp & 0xff,
 502                     version->build_type, version->build_num);
 503
 504         return 0;
 505 }
 506
 507 static int btintel_parse_version_tlv(struct hci_dev *hdev,
 508                                      struct intel_version_tlv *version,
 509                                      struct sk_buff *skb)
 510 {
 511         /* Consume Command Complete Status field */
 512         skb_pull(skb, 1);
 513
 514         /* Event parameters contatin multiple TLVs. Read each of them
 515          * and only keep the required data. Also, it use existing legacy
 516          * version field like hw_platform, hw_variant, and fw_variant
 517          * to keep the existing setup flow
 518          */
 519         while (skb->len) {
 520                 struct intel_tlv *tlv;
 521
 522                 /* Make sure skb has a minimum length of the header */
 523                 if (skb->len < sizeof(*tlv))
 524                         return -EINVAL;
 525
 526                 tlv = (struct intel_tlv *)skb->data;
 527
 528                 /* Make sure skb has a enough data */
 529                 if (skb->len < tlv->len + sizeof(*tlv))
 530                         return -EINVAL;
 531
 532                 switch (tlv->type) {
 533                 case INTEL_TLV_CNVI_TOP:
 534                         version->cnvi_top = get_unaligned_le32(tlv->val);
 535                         break;
 536                 case INTEL_TLV_CNVR_TOP:
 537                         version->cnvr_top = get_unaligned_le32(tlv->val);
 538                         break;
 539                 case INTEL_TLV_CNVI_BT:
 540                         version->cnvi_bt = get_unaligned_le32(tlv->val);
 541                         break;
 542                 case INTEL_TLV_CNVR_BT:
 543                         version->cnvr_bt = get_unaligned_le32(tlv->val);
 544                         break;
 545                 case INTEL_TLV_DEV_REV_ID:
 546                         version->dev_rev_id = get_unaligned_le16(tlv->val);
 547                         break;
 548                 case INTEL_TLV_IMAGE_TYPE:
 549                         version->img_type = tlv->val[0];
 550                         break;
 551                 case INTEL_TLV_TIME_STAMP:
 552                         /* If image type is Operational firmware (0x03), then
 553                          * running FW Calendar Week and Year information can
 554                          * be extracted from Timestamp information
 555                          */
 556                         version->min_fw_build_cw = tlv->val[0];
 557                         version->min_fw_build_yy = tlv->val[1];
 558                         version->timestamp = get_unaligned_le16(tlv->val);
 559                         break;
 560                 case INTEL_TLV_BUILD_TYPE:
 561                         version->build_type = tlv->val[0];
 562                         break;
 563                 case INTEL_TLV_BUILD_NUM:
 564                         /* If image type is Operational firmware (0x03), then
 565                          * running FW build number can be extracted from the
 566                          * Build information
 567                          */
 568                         version->min_fw_build_nn = tlv->val[0];
 569                         version->build_num = get_unaligned_le32(tlv->val);
 570                         break;
 571                 case INTEL_TLV_SECURE_BOOT:
 572                         version->secure_boot = tlv->val[0];
 573                         break;
 574                 case INTEL_TLV_OTP_LOCK:
 575                         version->otp_lock = tlv->val[0];
 576                         break;
 577                 case INTEL_TLV_API_LOCK:
 578                         version->api_lock = tlv->val[0];
 579                         break;
 580                 case INTEL_TLV_DEBUG_LOCK:
 581                         version->debug_lock = tlv->val[0];
 582                         break;
 583                 case INTEL_TLV_MIN_FW:
 584                         version->min_fw_build_nn = tlv->val[0];
 585                         version->min_fw_build_cw = tlv->val[1];
 586                         version->min_fw_build_yy = tlv->val[2];
 587                         break;
 588                 case INTEL_TLV_LIMITED_CCE:
 589                         version->limited_cce = tlv->val[0];
 590                         break;
 591                 case INTEL_TLV_SBE_TYPE:
 592                         version->sbe_type = tlv->val[0];
 593                         break;
 594                 case INTEL_TLV_OTP_BDADDR:
 595                         memcpy(&version->otp_bd_addr, tlv->val,
 596                                                         sizeof(bdaddr_t));
 597                         break;
 598                 default:
 599                         /* Ignore rest of information */
 600                         break;
 601                 }
 602                 /* consume the current tlv and move to next*/
 603                 skb_pull(skb, tlv->len + sizeof(*tlv));
 604         }
 605
 606         return 0;
 607 }
 608
 609 static int btintel_read_version_tlv(struct hci_dev *hdev,
 610                                     struct intel_version_tlv *version)
 611 {
 612         struct sk_buff *skb;
 613         const u8 param[1] = { 0xFF };
 614
 615         if (!version)
 616                 return -EINVAL;
 617
 618         skb = __hci_cmd_sync(hdev, 0xfc05, 1, param, HCI_CMD_TIMEOUT);
 619         if (IS_ERR(skb)) {
 620                 bt_dev_err(hdev, "Reading Intel version information failed (%ld)",
 621                            PTR_ERR(skb));
 622                 return PTR_ERR(skb);
 623         }
 624
 625         if (skb->data[0]) {
 626                 bt_dev_err(hdev, "Intel Read Version command failed (%02x)",
 627                            skb->data[0]);
 628                 kfree_skb(skb);
 629                 return -EIO;
 630         }
 631
 632         btintel_parse_version_tlv(hdev, version, skb);
 633
 634         kfree_skb(skb);
 635         return 0;
 636 }
 637
 638 /* ------- REGMAP IBT SUPPORT ------- */
 639
 640 #define IBT_REG_MODE_8BIT  0x00
 641 #define IBT_REG_MODE_16BIT 0x01
 642 #define IBT_REG_MODE_32BIT 0x02
 643
 644 struct regmap_ibt_context {
 645         struct hci_dev *hdev;
 646         __u16 op_write;
 647         __u16 op_read;
 648 };
 649
 650 struct ibt_cp_reg_access {
 651         __le32  addr;
 652         __u8    mode;
 653         __u8    len;
 654         __u8    data[];
 655 } __packed;
 656
 657 struct ibt_rp_reg_access {
 658         __u8    status;
 659         __le32  addr;
 660         __u8    data[];
 661 } __packed;
 662
 663 static int regmap_ibt_read(void *context, const void *addr, size_t reg_size,
 664                            void *val, size_t val_size)
 665 {
 666         struct regmap_ibt_context *ctx = context;
 667         struct ibt_cp_reg_access cp;
 668         struct ibt_rp_reg_access *rp;
 669         struct sk_buff *skb;
 670         int err = 0;
 671
 672         if (reg_size != sizeof(__le32))
 673                 return -EINVAL;
 674
 675         switch (val_size) {
 676         case 1:
 677                 cp.mode = IBT_REG_MODE_8BIT;
 678                 break;
 679         case 2:
 680                 cp.mode = IBT_REG_MODE_16BIT;
 681                 break;
 682         case 4:
 683                 cp.mode = IBT_REG_MODE_32BIT;
 684                 break;
 685         default:
 686                 return -EINVAL;
 687         }
 688
 689         /* regmap provides a little-endian formatted addr */
 690         cp.addr = *(__le32 *)addr;
 691         cp.len = val_size;
 692
 693         bt_dev_dbg(ctx->hdev, "Register (0x%x) read", le32_to_cpu(cp.addr));
 694
 695         skb = hci_cmd_sync(ctx->hdev, ctx->op_read, sizeof(cp), &cp,
 696                            HCI_CMD_TIMEOUT);
 697         if (IS_ERR(skb)) {
 698                 err = PTR_ERR(skb);
 699                 bt_dev_err(ctx->hdev, "regmap: Register (0x%x) read error (%d)",
 700                            le32_to_cpu(cp.addr), err);
 701                 return err;
 702         }
 703
 704         if (skb->len != sizeof(*rp) + val_size) {
 705                 bt_dev_err(ctx->hdev, "regmap: Register (0x%x) read error, bad len",
 706                            le32_to_cpu(cp.addr));
 707                 err = -EINVAL;
 708                 goto done;
 709         }
 710
 711         rp = (struct ibt_rp_reg_access *)skb->data;
 712
 713         if (rp->addr != cp.addr) {
 714                 bt_dev_err(ctx->hdev, "regmap: Register (0x%x) read error, bad addr",
 715                            le32_to_cpu(rp->addr));
 716                 err = -EINVAL;
 717                 goto done;
 718         }
 719
 720         memcpy(val, rp->data, val_size);
 721
 722 done:
 723         kfree_skb(skb);
 724         return err;
 725 }
 726
 727 static int regmap_ibt_gather_write(void *context,
 728                                    const void *addr, size_t reg_size,
 729                                    const void *val, size_t val_size)
 730 {
 731         struct regmap_ibt_context *ctx = context;
 732         struct ibt_cp_reg_access *cp;
 733         struct sk_buff *skb;
 734         int plen = sizeof(*cp) + val_size;
 735         u8 mode;
 736         int err = 0;
 737
 738         if (reg_size != sizeof(__le32))
 739                 return -EINVAL;
 740
 741         switch (val_size) {
 742         case 1:
 743                 mode = IBT_REG_MODE_8BIT;
 744                 break;
 745         case 2:
 746                 mode = IBT_REG_MODE_16BIT;
 747                 break;
 748         case 4:
 749                 mode = IBT_REG_MODE_32BIT;
 750                 break;
 751         default:
 752                 return -EINVAL;
 753         }
 754
 755         cp = kmalloc(plen, GFP_KERNEL);
 756         if (!cp)
 757                 return -ENOMEM;
 758
 759         /* regmap provides a little-endian formatted addr/value */
 760         cp->addr = *(__le32 *)addr;
 761         cp->mode = mode;
 762         cp->len = val_size;
 763         memcpy(&cp->data, val, val_size);
 764
 765         bt_dev_dbg(ctx->hdev, "Register (0x%x) write", le32_to_cpu(cp->addr));
 766
 767         skb = hci_cmd_sync(ctx->hdev, ctx->op_write, plen, cp, HCI_CMD_TIMEOUT);
 768         if (IS_ERR(skb)) {
 769                 err = PTR_ERR(skb);
 770                 bt_dev_err(ctx->hdev, "regmap: Register (0x%x) write error (%d)",
 771                            le32_to_cpu(cp->addr), err);
 772                 goto done;
 773         }
 774         kfree_skb(skb);
 775
 776 done:
 777         kfree(cp);
 778         return err;
 779 }
 780
 781 static int regmap_ibt_write(void *context, const void *data, size_t count)
 782 {
 783         /* data contains register+value, since we only support 32bit addr,
 784          * minimum data size is 4 bytes.
 785          */
 786         if (WARN_ONCE(count < 4, "Invalid register access"))
 787                 return -EINVAL;
 788
 789         return regmap_ibt_gather_write(context, data, 4, data + 4, count - 4);
 790 }
 791
 792 static void regmap_ibt_free_context(void *context)
 793 {
 794         kfree(context);
 795 }
 796
 797 static const struct regmap_bus regmap_ibt = {
 798         .read = regmap_ibt_read,
 799         .write = regmap_ibt_write,
 800         .gather_write = regmap_ibt_gather_write,
 801         .free_context = regmap_ibt_free_context,
 802         .reg_format_endian_default = REGMAP_ENDIAN_LITTLE,
 803         .val_format_endian_default = REGMAP_ENDIAN_LITTLE,
 804 };
 805
 806 /* Config is the same for all register regions */
 807 static const struct regmap_config regmap_ibt_cfg = {
 808         .name      = "btintel_regmap",
 809         .reg_bits  = 32,
 810         .val_bits  = 32,
 811 };
 812
 813 struct regmap *btintel_regmap_init(struct hci_dev *hdev, u16 opcode_read,
 814                                    u16 opcode_write)
 815 {
 816         struct regmap_ibt_context *ctx;
 817
 818         bt_dev_info(hdev, "regmap: Init R%x-W%x region", opcode_read,
 819                     opcode_write);
 820
 821         ctx = kzalloc(sizeof(*ctx), GFP_KERNEL);
 822         if (!ctx)
 823                 return ERR_PTR(-ENOMEM);
 824
 825         ctx->op_read = opcode_read;
 826         ctx->op_write = opcode_write;
 827         ctx->hdev = hdev;
 828
 829         return regmap_init(&hdev->dev, &regmap_ibt, ctx, &regmap_ibt_cfg);
 830 }
 831 EXPORT_SYMBOL_GPL(btintel_regmap_init);
 832
 833 int btintel_send_intel_reset(struct hci_dev *hdev, u32 boot_param)
 834 {
 835         struct intel_reset params = { 0x00, 0x01, 0x00, 0x01, 0x00000000 };
 836         struct sk_buff *skb;
 837
 838         params.boot_param = cpu_to_le32(boot_param);
 839
 840         skb = __hci_cmd_sync(hdev, 0xfc01, sizeof(params), &params,
 841                              HCI_INIT_TIMEOUT);
 842         if (IS_ERR(skb)) {
 843                 bt_dev_err(hdev, "Failed to send Intel Reset command");
 844                 return PTR_ERR(skb);
 845         }
 846
 847         kfree_skb(skb);
 848
 849         return 0;
 850 }
 851 EXPORT_SYMBOL_GPL(btintel_send_intel_reset);
 852
 853 int btintel_read_boot_params(struct hci_dev *hdev,
 854                              struct intel_boot_params *params)
 855 {
 856         struct sk_buff *skb;
 857
 858         skb = __hci_cmd_sync(hdev, 0xfc0d, 0, NULL, HCI_INIT_TIMEOUT);
 859         if (IS_ERR(skb)) {
 860                 bt_dev_err(hdev, "Reading Intel boot parameters failed (%ld)",
 861                            PTR_ERR(skb));
 862                 return PTR_ERR(skb);
 863         }
 864
 865         if (skb->len != sizeof(*params)) {
 866                 bt_dev_err(hdev, "Intel boot parameters size mismatch");
 867                 kfree_skb(skb);
 868                 return -EILSEQ;
 869         }
 870
 871         memcpy(params, skb->data, sizeof(*params));
 872
 873         kfree_skb(skb);
 874
 875         if (params->status) {
 876                 bt_dev_err(hdev, "Intel boot parameters command failed (%02x)",
 877                            params->status);
 878                 return -bt_to_errno(params->status);
 879         }
 880
 881         bt_dev_info(hdev, "Device revision is %u",
 882                     le16_to_cpu(params->dev_revid));
 883
 884         bt_dev_info(hdev, "Secure boot is %s",
 885                     params->secure_boot ? "enabled" : "disabled");
 886
 887         bt_dev_info(hdev, "OTP lock is %s",
 888                     params->otp_lock ? "enabled" : "disabled");
 889
 890         bt_dev_info(hdev, "API lock is %s",
 891                     params->api_lock ? "enabled" : "disabled");
 892
 893         bt_dev_info(hdev, "Debug lock is %s",
 894                     params->debug_lock ? "enabled" : "disabled");
 895
 896         bt_dev_info(hdev, "Minimum firmware build %u week %u %u",
 897                     params->min_fw_build_nn, params->min_fw_build_cw,
 898                     2000 + params->min_fw_build_yy);
 899
 900         return 0;
 901 }
 902 EXPORT_SYMBOL_GPL(btintel_read_boot_params);
 903
 904 static int btintel_sfi_rsa_header_secure_send(struct hci_dev *hdev,
 905                                               const struct firmware *fw)
 906 {
 907         int err;
 908
 909         /* Start the firmware download transaction with the Init fragment
 910          * represented by the 128 bytes of CSS header.
 911          */
 912         err = btintel_secure_send(hdev, 0x00, 128, fw->data);
 913         if (err < 0) {
 914                 bt_dev_err(hdev, "Failed to send firmware header (%d)", err);
 915                 goto done;
 916         }
 917
 918         /* Send the 256 bytes of public key information from the firmware
 919          * as the PKey fragment.
 920          */
 921         err = btintel_secure_send(hdev, 0x03, 256, fw->data + 128);
 922         if (err < 0) {
 923                 bt_dev_err(hdev, "Failed to send firmware pkey (%d)", err);
 924                 goto done;
 925         }
 926
 927         /* Send the 256 bytes of signature information from the firmware
 928          * as the Sign fragment.
 929          */
 930         err = btintel_secure_send(hdev, 0x02, 256, fw->data + 388);
 931         if (err < 0) {
 932                 bt_dev_err(hdev, "Failed to send firmware signature (%d)", err);
 933                 goto done;
 934         }
 935
 936 done:
 937         return err;
 938 }
 939
 940 static int btintel_sfi_ecdsa_header_secure_send(struct hci_dev *hdev,
 941                                                 const struct firmware *fw)
 942 {
 943         int err;
 944
 945         /* Start the firmware download transaction with the Init fragment
 946          * represented by the 128 bytes of CSS header.
 947          */
 948         err = btintel_secure_send(hdev, 0x00, 128, fw->data + 644);
 949         if (err < 0) {
 950                 bt_dev_err(hdev, "Failed to send firmware header (%d)", err);
 951                 return err;
 952         }
 953
 954         /* Send the 96 bytes of public key information from the firmware
 955          * as the PKey fragment.
 956          */
 957         err = btintel_secure_send(hdev, 0x03, 96, fw->data + 644 + 128);
 958         if (err < 0) {
 959                 bt_dev_err(hdev, "Failed to send firmware pkey (%d)", err);
 960                 return err;
 961         }
 962
 963         /* Send the 96 bytes of signature information from the firmware
 964          * as the Sign fragment
 965          */
 966         err = btintel_secure_send(hdev, 0x02, 96, fw->data + 644 + 224);
 967         if (err < 0) {
 968                 bt_dev_err(hdev, "Failed to send firmware signature (%d)",
 969                            err);
 970                 return err;
 971         }
 972         return 0;
 973 }
 974
 975 static int btintel_download_firmware_payload(struct hci_dev *hdev,
 976                                              const struct firmware *fw,
 977                                              size_t offset)
 978 {
 979         int err;
 980         const u8 *fw_ptr;
 981         u32 frag_len;
 982
 983         fw_ptr = fw->data + offset;
 984         frag_len = 0;
 985         err = -EINVAL;
 986
 987         while (fw_ptr - fw->data < fw->size) {
 988                 struct hci_command_hdr *cmd = (void *)(fw_ptr + frag_len);
 989
 990                 frag_len += sizeof(*cmd) + cmd->plen;
 991
 992                 /* The parameter length of the secure send command requires
 993                  * a 4 byte alignment. It happens so that the firmware file
 994                  * contains proper Intel_NOP commands to align the fragments
 995                  * as needed.
 996                  *
 997                  * Send set of commands with 4 byte alignment from the
 998                  * firmware data buffer as a single Data fragement.
 999                  */
1000                 if (!(frag_len % 4)) {
1001                         err = btintel_secure_send(hdev, 0x01, frag_len, fw_ptr);
1002                         if (err < 0) {
1003                                 bt_dev_err(hdev,
1004                                            "Failed to send firmware data (%d)",
1005                                            err);
1006                                 goto done;
1007                         }
1008
1009                         fw_ptr += frag_len;
1010                         frag_len = 0;
1011                 }
1012         }
1013
1014 done:
1015         return err;
1016 }
1017
1018 static bool btintel_firmware_version(struct hci_dev *hdev,
1019                                      u8 num, u8 ww, u8 yy,
1020                                      const struct firmware *fw,
1021                                      u32 *boot_addr)
1022 {
1023         const u8 *fw_ptr;
1024
1025         fw_ptr = fw->data;
1026
1027         while (fw_ptr - fw->data < fw->size) {
1028                 struct hci_command_hdr *cmd = (void *)(fw_ptr);
1029
1030                 /* Each SKU has a different reset parameter to use in the
1031                  * HCI_Intel_Reset command and it is embedded in the firmware
1032                  * data. So, instead of using static value per SKU, check
1033                  * the firmware data and save it for later use.
1034                  */
1035                 if (le16_to_cpu(cmd->opcode) == CMD_WRITE_BOOT_PARAMS) {
1036                         struct cmd_write_boot_params *params;
1037
1038                         params = (void *)(fw_ptr + sizeof(*cmd));
1039
1040                         *boot_addr = le32_to_cpu(params->boot_addr);
1041
1042                         bt_dev_info(hdev, "Boot Address: 0x%x", *boot_addr);
1043
1044                         bt_dev_info(hdev, "Firmware Version: %u-%u.%u",
1045                                     params->fw_build_num, params->fw_build_ww,
1046                                     params->fw_build_yy);
1047
1048                         return (num == params->fw_build_num &&
1049                                 ww == params->fw_build_ww &&
1050                                 yy == params->fw_build_yy);
1051                 }
1052
1053                 fw_ptr += sizeof(*cmd) + cmd->plen;
1054         }
1055
1056         return false;
1057 }
1058
1059 int btintel_download_firmware(struct hci_dev *hdev,
1060                               struct intel_version *ver,
1061                               const struct firmware *fw,
1062                               u32 *boot_param)
1063 {
1064         int err;
1065
1066         /* SfP and WsP don't seem to update the firmware version on file
1067          * so version checking is currently not possible.
1068          */
1069         switch (ver->hw_variant) {
1070         case 0x0b:      /* SfP */
1071         case 0x0c:      /* WsP */
1072                 /* Skip version checking */
1073                 break;
1074         default:
1075
1076                 /* Skip download if firmware has the same version */
1077                 if (btintel_firmware_version(hdev, ver->fw_build_num,
1078                                              ver->fw_build_ww, ver->fw_build_yy,
1079                                              fw, boot_param)) {
1080                         bt_dev_info(hdev, "Firmware already loaded");
1081                         /* Return -EALREADY to indicate that the firmware has
1082                          * already been loaded.
1083                          */
1084                         return -EALREADY;
1085                 }
1086         }
1087
1088         /* The firmware variant determines if the device is in bootloader
1089          * mode or is running operational firmware. The value 0x06 identifies
1090          * the bootloader and the value 0x23 identifies the operational
1091          * firmware.
1092          *
1093          * If the firmware version has changed that means it needs to be reset
1094          * to bootloader when operational so the new firmware can be loaded.
1095          */
1096         if (ver->fw_variant == 0x23)
1097                 return -EINVAL;
1098
1099         err = btintel_sfi_rsa_header_secure_send(hdev, fw);
1100         if (err)
1101                 return err;
1102
1103         return btintel_download_firmware_payload(hdev, fw, RSA_HEADER_LEN);
1104 }
1105 EXPORT_SYMBOL_GPL(btintel_download_firmware);
1106
1107 static int btintel_download_fw_tlv(struct hci_dev *hdev,
1108                                    struct intel_version_tlv *ver,
1109                                    const struct firmware *fw, u32 *boot_param,
1110                                    u8 hw_variant, u8 sbe_type)
1111 {
1112         int err;
1113         u32 css_header_ver;
1114
1115         /* Skip download if firmware has the same version */
1116         if (btintel_firmware_version(hdev, ver->min_fw_build_nn,
1117                                      ver->min_fw_build_cw,
1118                                      ver->min_fw_build_yy,
1119                                      fw, boot_param)) {
1120                 bt_dev_info(hdev, "Firmware already loaded");
1121                 /* Return -EALREADY to indicate that firmware has
1122                  * already been loaded.
1123                  */
1124                 return -EALREADY;
1125         }
1126
1127         /* The firmware variant determines if the device is in bootloader
1128          * mode or is running operational firmware. The value 0x01 identifies
1129          * the bootloader and the value 0x03 identifies the operational
1130          * firmware.
1131          *
1132          * If the firmware version has changed that means it needs to be reset
1133          * to bootloader when operational so the new firmware can be loaded.
1134          */
1135         if (ver->img_type == 0x03)
1136                 return -EINVAL;
1137
1138         /* iBT hardware variants 0x0b, 0x0c, 0x11, 0x12, 0x13, 0x14 support
1139          * only RSA secure boot engine. Hence, the corresponding sfi file will
1140          * have RSA header of 644 bytes followed by Command Buffer.
1141          *
1142          * iBT hardware variants 0x17, 0x18 onwards support both RSA and ECDSA
1143          * secure boot engine. As a result, the corresponding sfi file will
1144          * have RSA header of 644, ECDSA header of 320 bytes followed by
1145          * Command Buffer.
1146          *
1147          * CSS Header byte positions 0x08 to 0x0B represent the CSS Header
1148          * version: RSA(0x00010000) , ECDSA (0x00020000)
1149          */
1150         css_header_ver = get_unaligned_le32(fw->data + CSS_HEADER_OFFSET);
1151         if (css_header_ver != 0x00010000) {
1152                 bt_dev_err(hdev, "Invalid CSS Header version");
1153                 return -EINVAL;
1154         }
1155
1156         if (hw_variant <= 0x14) {
1157                 if (sbe_type != 0x00) {
1158                         bt_dev_err(hdev, "Invalid SBE type for hardware variant (%d)",
1159                                    hw_variant);
1160                         return -EINVAL;
1161                 }
1162
1163                 err = btintel_sfi_rsa_header_secure_send(hdev, fw);
1164                 if (err)
1165                         return err;
1166
1167                 err = btintel_download_firmware_payload(hdev, fw, RSA_HEADER_LEN);
1168                 if (err)
1169                         return err;
1170         } else if (hw_variant >= 0x17) {
1171                 /* Check if CSS header for ECDSA follows the RSA header */
1172                 if (fw->data[ECDSA_OFFSET] != 0x06)
1173                         return -EINVAL;
1174
1175                 /* Check if the CSS Header version is ECDSA(0x00020000) */
1176                 css_header_ver = get_unaligned_le32(fw->data + ECDSA_OFFSET + CSS_HEADER_OFFSET);
1177                 if (css_header_ver != 0x00020000) {
1178                         bt_dev_err(hdev, "Invalid CSS Header version");
1179                         return -EINVAL;
1180                 }
1181
1182                 if (sbe_type == 0x00) {
1183                         err = btintel_sfi_rsa_header_secure_send(hdev, fw);
1184                         if (err)
1185                                 return err;
1186
1187                         err = btintel_download_firmware_payload(hdev, fw,
1188                                                                 RSA_HEADER_LEN + ECDSA_HEADER_LEN);
1189                         if (err)
1190                                 return err;
1191                 } else if (sbe_type == 0x01) {
1192                         err = btintel_sfi_ecdsa_header_secure_send(hdev, fw);
1193                         if (err)
1194                                 return err;
1195
1196                         err = btintel_download_firmware_payload(hdev, fw,
1197                                                                 RSA_HEADER_LEN + ECDSA_HEADER_LEN);
1198                         if (err)
1199                                 return err;
1200                 }
1201         }
1202         return 0;
1203 }
1204
1205 static void btintel_reset_to_bootloader(struct hci_dev *hdev)
1206 {
1207         struct intel_reset params;
1208         struct sk_buff *skb;
1209
1210         /* Send Intel Reset command. This will result in
1211          * re-enumeration of BT controller.
1212          *
1213          * Intel Reset parameter description:
1214          * reset_type :   0x00 (Soft reset),
1215          *                0x01 (Hard reset)
1216          * patch_enable : 0x00 (Do not enable),
1217          *                0x01 (Enable)
1218          * ddc_reload :   0x00 (Do not reload),
1219          *                0x01 (Reload)
1220          * boot_option:   0x00 (Current image),
1221          *                0x01 (Specified boot address)
1222          * boot_param:    Boot address
1223          *
1224          */
1225         params.reset_type = 0x01;
1226         params.patch_enable = 0x01;
1227         params.ddc_reload = 0x01;
1228         params.boot_option = 0x00;
1229         params.boot_param = cpu_to_le32(0x00000000);
1230
1231         skb = __hci_cmd_sync(hdev, 0xfc01, sizeof(params),
1232                              &params, HCI_INIT_TIMEOUT);
1233         if (IS_ERR(skb)) {
1234                 bt_dev_err(hdev, "FW download error recovery failed (%ld)",
1235                            PTR_ERR(skb));
1236                 return;
1237         }
1238         bt_dev_info(hdev, "Intel reset sent to retry FW download");
1239         kfree_skb(skb);
1240
1241         /* Current Intel BT controllers(ThP/JfP) hold the USB reset
1242          * lines for 2ms when it receives Intel Reset in bootloader mode.
1243          * Whereas, the upcoming Intel BT controllers will hold USB reset
1244          * for 150ms. To keep the delay generic, 150ms is chosen here.
1245          */
1246         msleep(150);
1247 }
1248
1249 static int btintel_read_debug_features(struct hci_dev *hdev,
1250                                        struct intel_debug_features *features)
1251 {
1252         struct sk_buff *skb;
1253         u8 page_no = 1;
1254
1255         /* Intel controller supports two pages, each page is of 128-bit
1256          * feature bit mask. And each bit defines specific feature support
1257          */
1258         skb = __hci_cmd_sync(hdev, 0xfca6, sizeof(page_no), &page_no,
1259                              HCI_INIT_TIMEOUT);
1260         if (IS_ERR(skb)) {
1261                 bt_dev_err(hdev, "Reading supported features failed (%ld)",
1262                            PTR_ERR(skb));
1263                 return PTR_ERR(skb);
1264         }
1265
1266         if (skb->len != (sizeof(features->page1) + 3)) {
1267                 bt_dev_err(hdev, "Supported features event size mismatch");
1268                 kfree_skb(skb);
1269                 return -EILSEQ;
1270         }
1271
1272         memcpy(features->page1, skb->data + 3, sizeof(features->page1));
1273
1274         /* Read the supported features page2 if required in future.
1275          */
1276         kfree_skb(skb);
1277         return 0;
1278 }
1279
1280 static int btintel_set_debug_features(struct hci_dev *hdev,
1281                                const struct intel_debug_features *features)
1282 {
1283         u8 mask[11] = { 0x0a, 0x92, 0x02, 0x7f, 0x00, 0x00, 0x00, 0x00,
1284                         0x00, 0x00, 0x00 };
1285         u8 period[5] = { 0x04, 0x91, 0x02, 0x05, 0x00 };
1286         u8 trace_enable = 0x02;
1287         struct sk_buff *skb;
1288
1289         if (!features) {
1290                 bt_dev_warn(hdev, "Debug features not read");
1291                 return -EINVAL;
1292         }
1293
1294         if (!(features->page1[0] & 0x3f)) {
1295                 bt_dev_info(hdev, "Telemetry exception format not supported");
1296                 return 0;
1297         }
1298
1299         skb = __hci_cmd_sync(hdev, 0xfc8b, 11, mask, HCI_INIT_TIMEOUT);
1300         if (IS_ERR(skb)) {
1301                 bt_dev_err(hdev, "Setting Intel telemetry ddc write event mask failed (%ld)",
1302                            PTR_ERR(skb));
1303                 return PTR_ERR(skb);
1304         }
1305         kfree_skb(skb);
1306
1307         skb = __hci_cmd_sync(hdev, 0xfc8b, 5, period, HCI_INIT_TIMEOUT);
1308         if (IS_ERR(skb)) {
1309                 bt_dev_err(hdev, "Setting periodicity for link statistics traces failed (%ld)",
1310                            PTR_ERR(skb));
1311                 return PTR_ERR(skb);
1312         }
1313         kfree_skb(skb);
1314
1315         skb = __hci_cmd_sync(hdev, 0xfca1, 1, &trace_enable, HCI_INIT_TIMEOUT);
1316         if (IS_ERR(skb)) {
1317                 bt_dev_err(hdev, "Enable tracing of link statistics events failed (%ld)",
1318                            PTR_ERR(skb));
1319                 return PTR_ERR(skb);
1320         }
1321         kfree_skb(skb);
1322
1323         bt_dev_info(hdev, "set debug features: trace_enable 0x%02x mask 0x%02x",
1324                     trace_enable, mask[3]);
1325
1326         return 0;
1327 }
1328
1329 static int btintel_reset_debug_features(struct hci_dev *hdev,
1330                                  const struct intel_debug_features *features)
1331 {
1332         u8 mask[11] = { 0x0a, 0x92, 0x02, 0x00, 0x00, 0x00, 0x00, 0x00,
1333                         0x00, 0x00, 0x00 };
1334         u8 trace_enable = 0x00;
1335         struct sk_buff *skb;
1336
1337         if (!features) {
1338                 bt_dev_warn(hdev, "Debug features not read");
1339                 return -EINVAL;
1340         }
1341
1342         if (!(features->page1[0] & 0x3f)) {
1343                 bt_dev_info(hdev, "Telemetry exception format not supported");
1344                 return 0;
1345         }
1346
1347         /* Should stop the trace before writing ddc event mask. */
1348         skb = __hci_cmd_sync(hdev, 0xfca1, 1, &trace_enable, HCI_INIT_TIMEOUT);
1349         if (IS_ERR(skb)) {
1350                 bt_dev_err(hdev, "Stop tracing of link statistics events failed (%ld)",
1351                            PTR_ERR(skb));
1352                 return PTR_ERR(skb);
1353         }
1354         kfree_skb(skb);
1355
1356         skb = __hci_cmd_sync(hdev, 0xfc8b, 11, mask, HCI_INIT_TIMEOUT);
1357         if (IS_ERR(skb)) {
1358                 bt_dev_err(hdev, "Setting Intel telemetry ddc write event mask failed (%ld)",
1359                            PTR_ERR(skb));
1360                 return PTR_ERR(skb);
1361         }
1362         kfree_skb(skb);
1363
1364         bt_dev_info(hdev, "reset debug features: trace_enable 0x%02x mask 0x%02x",
1365                     trace_enable, mask[3]);
1366
1367         return 0;
1368 }
1369
1370 int btintel_set_quality_report(struct hci_dev *hdev, bool enable)
1371 {
1372         struct intel_debug_features features;
1373         int err;
1374
1375         bt_dev_dbg(hdev, "enable %d", enable);
1376
1377         /* Read the Intel supported features and if new exception formats
1378          * supported, need to load the additional DDC config to enable.
1379          */
1380         err = btintel_read_debug_features(hdev, &features);
1381         if (err)
1382                 return err;
1383
1384         /* Set or reset the debug features. */
1385         if (enable)
1386                 err = btintel_set_debug_features(hdev, &features);
1387         else
1388                 err = btintel_reset_debug_features(hdev, &features);
1389
1390         return err;
1391 }
1392 EXPORT_SYMBOL_GPL(btintel_set_quality_report);
1393
1394 static const struct firmware *btintel_legacy_rom_get_fw(struct hci_dev *hdev,
1395                                                struct intel_version *ver)
1396 {
1397         const struct firmware *fw;
1398         char fwname[64];
1399         int ret;
1400
1401         snprintf(fwname, sizeof(fwname),
1402                  "intel/ibt-hw-%x.%x.%x-fw-%x.%x.%x.%x.%x.bseq",
1403                  ver->hw_platform, ver->hw_variant, ver->hw_revision,
1404                  ver->fw_variant,  ver->fw_revision, ver->fw_build_num,
1405                  ver->fw_build_ww, ver->fw_build_yy);
1406
1407         ret = request_firmware(&fw, fwname, &hdev->dev);
1408         if (ret < 0) {
1409                 if (ret == -EINVAL) {
1410                         bt_dev_err(hdev, "Intel firmware file request failed (%d)",
1411                                    ret);
1412                         return NULL;
1413                 }
1414
1415                 bt_dev_err(hdev, "failed to open Intel firmware file: %s (%d)",
1416                            fwname, ret);
1417
1418                 /* If the correct firmware patch file is not found, use the
1419                  * default firmware patch file instead
1420                  */
1421                 snprintf(fwname, sizeof(fwname), "intel/ibt-hw-%x.%x.bseq",
1422                          ver->hw_platform, ver->hw_variant);
1423                 if (request_firmware(&fw, fwname, &hdev->dev) < 0) {
1424                         bt_dev_err(hdev, "failed to open default fw file: %s",
1425                                    fwname);
1426                         return NULL;
1427                 }
1428         }
1429
1430         bt_dev_info(hdev, "Intel Bluetooth firmware file: %s", fwname);
1431
1432         return fw;
1433 }
1434
1435 static int btintel_legacy_rom_patching(struct hci_dev *hdev,
1436                                       const struct firmware *fw,
1437                                       const u8 **fw_ptr, int *disable_patch)
1438 {
1439         struct sk_buff *skb;
1440         struct hci_command_hdr *cmd;
1441         const u8 *cmd_param;
1442         struct hci_event_hdr *evt = NULL;
1443         const u8 *evt_param = NULL;
1444         int remain = fw->size - (*fw_ptr - fw->data);
1445
1446         /* The first byte indicates the types of the patch command or event.
1447          * 0x01 means HCI command and 0x02 is HCI event. If the first bytes
1448          * in the current firmware buffer doesn't start with 0x01 or
1449          * the size of remain buffer is smaller than HCI command header,
1450          * the firmware file is corrupted and it should stop the patching
1451          * process.
1452          */
1453         if (remain > HCI_COMMAND_HDR_SIZE && *fw_ptr[0] != 0x01) {
1454                 bt_dev_err(hdev, "Intel fw corrupted: invalid cmd read");
1455                 return -EINVAL;
1456         }
1457         (*fw_ptr)++;
1458         remain--;
1459
1460         cmd = (struct hci_command_hdr *)(*fw_ptr);
1461         *fw_ptr += sizeof(*cmd);
1462         remain -= sizeof(*cmd);
1463
1464         /* Ensure that the remain firmware data is long enough than the length
1465          * of command parameter. If not, the firmware file is corrupted.
1466          */
1467         if (remain < cmd->plen) {
1468                 bt_dev_err(hdev, "Intel fw corrupted: invalid cmd len");
1469                 return -EFAULT;
1470         }
1471
1472         /* If there is a command that loads a patch in the firmware
1473          * file, then enable the patch upon success, otherwise just
1474          * disable the manufacturer mode, for example patch activation
1475          * is not required when the default firmware patch file is used
1476          * because there are no patch data to load.
1477          */
1478         if (*disable_patch && le16_to_cpu(cmd->opcode) == 0xfc8e)
1479                 *disable_patch = 0;
1480
1481         cmd_param = *fw_ptr;
1482         *fw_ptr += cmd->plen;
1483         remain -= cmd->plen;
1484
1485         /* This reads the expected events when the above command is sent to the
1486          * device. Some vendor commands expects more than one events, for
1487          * example command status event followed by vendor specific event.
1488          * For this case, it only keeps the last expected event. so the command
1489          * can be sent with __hci_cmd_sync_ev() which returns the sk_buff of
1490          * last expected event.
1491          */
1492         while (remain > HCI_EVENT_HDR_SIZE && *fw_ptr[0] == 0x02) {
1493                 (*fw_ptr)++;
1494                 remain--;
1495
1496                 evt = (struct hci_event_hdr *)(*fw_ptr);
1497                 *fw_ptr += sizeof(*evt);
1498                 remain -= sizeof(*evt);
1499
1500                 if (remain < evt->plen) {
1501                         bt_dev_err(hdev, "Intel fw corrupted: invalid evt len");
1502                         return -EFAULT;
1503                 }
1504
1505                 evt_param = *fw_ptr;
1506                 *fw_ptr += evt->plen;
1507                 remain -= evt->plen;
1508         }
1509
1510         /* Every HCI commands in the firmware file has its correspond event.
1511          * If event is not found or remain is smaller than zero, the firmware
1512          * file is corrupted.
1513          */
1514         if (!evt || !evt_param || remain < 0) {
1515                 bt_dev_err(hdev, "Intel fw corrupted: invalid evt read");
1516                 return -EFAULT;
1517         }
1518
1519         skb = __hci_cmd_sync_ev(hdev, le16_to_cpu(cmd->opcode), cmd->plen,
1520                                 cmd_param, evt->evt, HCI_INIT_TIMEOUT);
1521         if (IS_ERR(skb)) {
1522                 bt_dev_err(hdev, "sending Intel patch command (0x%4.4x) failed (%ld)",
1523                            cmd->opcode, PTR_ERR(skb));
1524                 return PTR_ERR(skb);
1525         }
1526
1527         /* It ensures that the returned event matches the event data read from
1528          * the firmware file. At fist, it checks the length and then
1529          * the contents of the event.
1530          */
1531         if (skb->len != evt->plen) {
1532                 bt_dev_err(hdev, "mismatch event length (opcode 0x%4.4x)",
1533                            le16_to_cpu(cmd->opcode));
1534                 kfree_skb(skb);
1535                 return -EFAULT;
1536         }
1537
1538         if (memcmp(skb->data, evt_param, evt->plen)) {
1539                 bt_dev_err(hdev, "mismatch event parameter (opcode 0x%4.4x)",
1540                            le16_to_cpu(cmd->opcode));
1541                 kfree_skb(skb);
1542                 return -EFAULT;
1543         }
1544         kfree_skb(skb);
1545
1546         return 0;
1547 }
1548
1549 static int btintel_legacy_rom_setup(struct hci_dev *hdev,
1550                                     struct intel_version *ver)
1551 {
1552         const struct firmware *fw;
1553         const u8 *fw_ptr;
1554         int disable_patch, err;
1555         struct intel_version new_ver;
1556
1557         BT_DBG("%s", hdev->name);
1558
1559         /* fw_patch_num indicates the version of patch the device currently
1560          * have. If there is no patch data in the device, it is always 0x00.
1561          * So, if it is other than 0x00, no need to patch the device again.
1562          */
1563         if (ver->fw_patch_num) {
1564                 bt_dev_info(hdev,
1565                             "Intel device is already patched. patch num: %02x",
1566                             ver->fw_patch_num);
1567                 goto complete;
1568         }
1569
1570         /* Opens the firmware patch file based on the firmware version read
1571          * from the controller. If it fails to open the matching firmware
1572          * patch file, it tries to open the default firmware patch file.
1573          * If no patch file is found, allow the device to operate without
1574          * a patch.
1575          */
1576         fw = btintel_legacy_rom_get_fw(hdev, ver);
1577         if (!fw)
1578                 goto complete;
1579         fw_ptr = fw->data;
1580
1581         /* Enable the manufacturer mode of the controller.
1582          * Only while this mode is enabled, the driver can download the
1583          * firmware patch data and configuration parameters.
1584          */
1585         err = btintel_enter_mfg(hdev);
1586         if (err) {
1587                 release_firmware(fw);
1588                 return err;
1589         }
1590
1591         disable_patch = 1;
1592
1593         /* The firmware data file consists of list of Intel specific HCI
1594          * commands and its expected events. The first byte indicates the
1595          * type of the message, either HCI command or HCI event.
1596          *
1597          * It reads the command and its expected event from the firmware file,
1598          * and send to the controller. Once __hci_cmd_sync_ev() returns,
1599          * the returned event is compared with the event read from the firmware
1600          * file and it will continue until all the messages are downloaded to
1601          * the controller.
1602          *
1603          * Once the firmware patching is completed successfully,
1604          * the manufacturer mode is disabled with reset and activating the
1605          * downloaded patch.
1606          *
1607          * If the firmware patching fails, the manufacturer mode is
1608          * disabled with reset and deactivating the patch.
1609          *
1610          * If the default patch file is used, no reset is done when disabling
1611          * the manufacturer.
1612          */
1613         while (fw->size > fw_ptr - fw->data) {
1614                 int ret;
1615
1616                 ret = btintel_legacy_rom_patching(hdev, fw, &fw_ptr,
1617                                                  &disable_patch);
1618                 if (ret < 0)
1619                         goto exit_mfg_deactivate;
1620         }
1621
1622         release_firmware(fw);
1623
1624         if (disable_patch)
1625                 goto exit_mfg_disable;
1626
1627         /* Patching completed successfully and disable the manufacturer mode
1628          * with reset and activate the downloaded firmware patches.
1629          */
1630         err = btintel_exit_mfg(hdev, true, true);
1631         if (err)
1632                 return err;
1633
1634         /* Need build number for downloaded fw patches in
1635          * every power-on boot
1636          */
1637         err = btintel_read_version(hdev, &new_ver);
1638         if (err)
1639                 return err;
1640
1641         bt_dev_info(hdev, "Intel BT fw patch 0x%02x completed & activated",
1642                     new_ver.fw_patch_num);
1643
1644         goto complete;
1645
1646 exit_mfg_disable:
1647         /* Disable the manufacturer mode without reset */
1648         err = btintel_exit_mfg(hdev, false, false);
1649         if (err)
1650                 return err;
1651
1652         bt_dev_info(hdev, "Intel firmware patch completed");
1653
1654         goto complete;
1655
1656 exit_mfg_deactivate:
1657         release_firmware(fw);
1658
1659         /* Patching failed. Disable the manufacturer mode with reset and
1660          * deactivate the downloaded firmware patches.
1661          */
1662         err = btintel_exit_mfg(hdev, true, false);
1663         if (err)
1664                 return err;
1665
1666         bt_dev_info(hdev, "Intel firmware patch completed and deactivated");
1667
1668 complete:
1669         /* Set the event mask for Intel specific vendor events. This enables
1670          * a few extra events that are useful during general operation.
1671          */
1672         btintel_set_event_mask_mfg(hdev, false);
1673
1674         btintel_check_bdaddr(hdev);
1675
1676         return 0;
1677 }
1678
1679 static int btintel_download_wait(struct hci_dev *hdev, ktime_t calltime, int msec)
1680 {
1681         ktime_t delta, rettime;
1682         unsigned long long duration;
1683         int err;
1684
1685         btintel_set_flag(hdev, INTEL_FIRMWARE_LOADED);
1686
1687         bt_dev_info(hdev, "Waiting for firmware download to complete");
1688
1689         err = btintel_wait_on_flag_timeout(hdev, INTEL_DOWNLOADING,
1690                                            TASK_INTERRUPTIBLE,
1691                                            msecs_to_jiffies(msec));
1692         if (err == -EINTR) {
1693                 bt_dev_err(hdev, "Firmware loading interrupted");
1694                 return err;
1695         }
1696
1697         if (err) {
1698                 bt_dev_err(hdev, "Firmware loading timeout");
1699                 return -ETIMEDOUT;
1700         }
1701
1702         if (btintel_test_flag(hdev, INTEL_FIRMWARE_FAILED)) {
1703                 bt_dev_err(hdev, "Firmware loading failed");
1704                 return -ENOEXEC;
1705         }
1706
1707         rettime = ktime_get();
1708         delta = ktime_sub(rettime, calltime);
1709         duration = (unsigned long long)ktime_to_ns(delta) >> 10;
1710
1711         bt_dev_info(hdev, "Firmware loaded in %llu usecs", duration);
1712
1713         return 0;
1714 }
1715
1716 static int btintel_boot_wait(struct hci_dev *hdev, ktime_t calltime, int msec)
1717 {
1718         ktime_t delta, rettime;
1719         unsigned long long duration;
1720         int err;
1721
1722         bt_dev_info(hdev, "Waiting for device to boot");
1723
1724         err = btintel_wait_on_flag_timeout(hdev, INTEL_BOOTING,
1725                                            TASK_INTERRUPTIBLE,
1726                                            msecs_to_jiffies(msec));
1727         if (err == -EINTR) {
1728                 bt_dev_err(hdev, "Device boot interrupted");
1729                 return -EINTR;
1730         }
1731
1732         if (err) {
1733                 bt_dev_err(hdev, "Device boot timeout");
1734                 return -ETIMEDOUT;
1735         }
1736
1737         rettime = ktime_get();
1738         delta = ktime_sub(rettime, calltime);
1739         duration = (unsigned long long) ktime_to_ns(delta) >> 10;
1740
1741         bt_dev_info(hdev, "Device booted in %llu usecs", duration);
1742
1743         return 0;
1744 }
1745
1746 static int btintel_boot(struct hci_dev *hdev, u32 boot_addr)
1747 {
1748         ktime_t calltime;
1749         int err;
1750
1751         calltime = ktime_get();
1752
1753         btintel_set_flag(hdev, INTEL_BOOTING);
1754
1755         err = btintel_send_intel_reset(hdev, boot_addr);
1756         if (err) {
1757                 bt_dev_err(hdev, "Intel Soft Reset failed (%d)", err);
1758                 btintel_reset_to_bootloader(hdev);
1759                 return err;
1760         }
1761
1762         /* The bootloader will not indicate when the device is ready. This
1763          * is done by the operational firmware sending bootup notification.
1764          *
1765          * Booting into operational firmware should not take longer than
1766          * 1 second. However if that happens, then just fail the setup
1767          * since something went wrong.
1768          */
1769         err = btintel_boot_wait(hdev, calltime, 1000);
1770         if (err == -ETIMEDOUT)
1771                 btintel_reset_to_bootloader(hdev);
1772
1773         return err;
1774 }
1775
1776 static int btintel_get_fw_name(struct intel_version *ver,
1777                                              struct intel_boot_params *params,
1778                                              char *fw_name, size_t len,
1779                                              const char *suffix)
1780 {
1781         switch (ver->hw_variant) {
1782         case 0x0b:      /* SfP */
1783         case 0x0c:      /* WsP */
1784                 snprintf(fw_name, len, "intel/ibt-%u-%u.%s",
1785                         le16_to_cpu(ver->hw_variant),
1786                         le16_to_cpu(params->dev_revid),
1787                         suffix);
1788                 break;
1789         case 0x11:      /* JfP */
1790         case 0x12:      /* ThP */
1791         case 0x13:      /* HrP */
1792         case 0x14:      /* CcP */
1793                 snprintf(fw_name, len, "intel/ibt-%u-%u-%u.%s",
1794                         le16_to_cpu(ver->hw_variant),
1795                         le16_to_cpu(ver->hw_revision),
1796                         le16_to_cpu(ver->fw_revision),
1797                         suffix);
1798                 break;
1799         default:
1800                 return -EINVAL;
1801         }
1802
1803         return 0;
1804 }
1805
1806 static int btintel_download_fw(struct hci_dev *hdev,
1807                                          struct intel_version *ver,
1808                                          struct intel_boot_params *params,
1809                                          u32 *boot_param)
1810 {
1811         const struct firmware *fw;
1812         char fwname[64];
1813         int err;
1814         ktime_t calltime;
1815
1816         if (!ver || !params)
1817                 return -EINVAL;
1818
1819         /* The firmware variant determines if the device is in bootloader
1820          * mode or is running operational firmware. The value 0x06 identifies
1821          * the bootloader and the value 0x23 identifies the operational
1822          * firmware.
1823          *
1824          * When the operational firmware is already present, then only
1825          * the check for valid Bluetooth device address is needed. This
1826          * determines if the device will be added as configured or
1827          * unconfigured controller.
1828          *
1829          * It is not possible to use the Secure Boot Parameters in this
1830          * case since that command is only available in bootloader mode.
1831          */
1832         if (ver->fw_variant == 0x23) {
1833                 btintel_clear_flag(hdev, INTEL_BOOTLOADER);
1834                 btintel_check_bdaddr(hdev);
1835
1836                 /* SfP and WsP don't seem to update the firmware version on file
1837                  * so version checking is currently possible.
1838                  */
1839                 switch (ver->hw_variant) {
1840                 case 0x0b:      /* SfP */
1841                 case 0x0c:      /* WsP */
1842                         return 0;
1843                 }
1844
1845                 /* Proceed to download to check if the version matches */
1846                 goto download;
1847         }
1848
1849         /* Read the secure boot parameters to identify the operating
1850          * details of the bootloader.
1851          */
1852         err = btintel_read_boot_params(hdev, params);
1853         if (err)
1854                 return err;
1855
1856         /* It is required that every single firmware fragment is acknowledged
1857          * with a command complete event. If the boot parameters indicate
1858          * that this bootloader does not send them, then abort the setup.
1859          */
1860         if (params->limited_cce != 0x00) {
1861                 bt_dev_err(hdev, "Unsupported Intel firmware loading method (%u)",
1862                            params->limited_cce);
1863                 return -EINVAL;
1864         }
1865
1866         /* If the OTP has no valid Bluetooth device address, then there will
1867          * also be no valid address for the operational firmware.
1868          */
1869         if (!bacmp(&params->otp_bdaddr, BDADDR_ANY)) {
1870                 bt_dev_info(hdev, "No device address configured");
1871                 set_bit(HCI_QUIRK_INVALID_BDADDR, &hdev->quirks);
1872         }
1873
1874 download:
1875         /* With this Intel bootloader only the hardware variant and device
1876          * revision information are used to select the right firmware for SfP
1877          * and WsP.
1878          *
1879          * The firmware filename is ibt-<hw_variant>-<dev_revid>.sfi.
1880          *
1881          * Currently the supported hardware variants are:
1882          *   11 (0x0b) for iBT3.0 (LnP/SfP)
1883          *   12 (0x0c) for iBT3.5 (WsP)
1884          *
1885          * For ThP/JfP and for future SKU's, the FW name varies based on HW
1886          * variant, HW revision and FW revision, as these are dependent on CNVi
1887          * and RF Combination.
1888          *
1889          *   17 (0x11) for iBT3.5 (JfP)
1890          *   18 (0x12) for iBT3.5 (ThP)
1891          *
1892          * The firmware file name for these will be
1893          * ibt-<hw_variant>-<hw_revision>-<fw_revision>.sfi.
1894          *
1895          */
1896         err = btintel_get_fw_name(ver, params, fwname, sizeof(fwname), "sfi");
1897         if (err < 0) {
1898                 if (!btintel_test_flag(hdev, INTEL_BOOTLOADER)) {
1899                         /* Firmware has already been loaded */
1900                         btintel_set_flag(hdev, INTEL_FIRMWARE_LOADED);
1901                         return 0;
1902                 }
1903
1904                 bt_dev_err(hdev, "Unsupported Intel firmware naming");
1905                 return -EINVAL;
1906         }
1907
1908         err = firmware_request_nowarn(&fw, fwname, &hdev->dev);
1909         if (err < 0) {
1910                 if (!btintel_test_flag(hdev, INTEL_BOOTLOADER)) {
1911                         /* Firmware has already been loaded */
1912                         btintel_set_flag(hdev, INTEL_FIRMWARE_LOADED);
1913                         return 0;
1914                 }
1915
1916                 bt_dev_err(hdev, "Failed to load Intel firmware file %s (%d)",
1917                            fwname, err);
1918                 return err;
1919         }
1920
1921         bt_dev_info(hdev, "Found device firmware: %s", fwname);
1922
1923         if (fw->size < 644) {
1924                 bt_dev_err(hdev, "Invalid size of firmware file (%zu)",
1925                            fw->size);
1926                 err = -EBADF;
1927                 goto done;
1928         }
1929
1930         calltime = ktime_get();
1931
1932         btintel_set_flag(hdev, INTEL_DOWNLOADING);
1933
1934         /* Start firmware downloading and get boot parameter */
1935         err = btintel_download_firmware(hdev, ver, fw, boot_param);
1936         if (err < 0) {
1937                 if (err == -EALREADY) {
1938                         /* Firmware has already been loaded */
1939                         btintel_set_flag(hdev, INTEL_FIRMWARE_LOADED);
1940                         err = 0;
1941                         goto done;
1942                 }
1943
1944                 /* When FW download fails, send Intel Reset to retry
1945                  * FW download.
1946                  */
1947                 btintel_reset_to_bootloader(hdev);
1948                 goto done;
1949         }
1950
1951         /* Before switching the device into operational mode and with that
1952          * booting the loaded firmware, wait for the bootloader notification
1953          * that all fragments have been successfully received.
1954          *
1955          * When the event processing receives the notification, then the
1956          * INTEL_DOWNLOADING flag will be cleared.
1957          *
1958          * The firmware loading should not take longer than 5 seconds
1959          * and thus just timeout if that happens and fail the setup
1960          * of this device.
1961          */
1962         err = btintel_download_wait(hdev, calltime, 5000);
1963         if (err == -ETIMEDOUT)
1964                 btintel_reset_to_bootloader(hdev);
1965
1966 done:
1967         release_firmware(fw);
1968         return err;
1969 }
1970
1971 static int btintel_bootloader_setup(struct hci_dev *hdev,
1972                                     struct intel_version *ver)
1973 {
1974         struct intel_version new_ver;
1975         struct intel_boot_params params;
1976         u32 boot_param;
1977         char ddcname[64];
1978         int err;
1979
1980         BT_DBG("%s", hdev->name);
1981
1982         /* Set the default boot parameter to 0x0 and it is updated to
1983          * SKU specific boot parameter after reading Intel_Write_Boot_Params
1984          * command while downloading the firmware.
1985          */
1986         boot_param = 0x00000000;
1987
1988         btintel_set_flag(hdev, INTEL_BOOTLOADER);
1989
1990         err = btintel_download_fw(hdev, ver, &params, &boot_param);
1991         if (err)
1992                 return err;
1993
1994         /* controller is already having an operational firmware */
1995         if (ver->fw_variant == 0x23)
1996                 goto finish;
1997
1998         err = btintel_boot(hdev, boot_param);
1999         if (err)
2000                 return err;
2001
2002         btintel_clear_flag(hdev, INTEL_BOOTLOADER);
2003
2004         err = btintel_get_fw_name(ver, &params, ddcname,
2005                                                 sizeof(ddcname), "ddc");
2006
2007         if (err < 0) {
2008                 bt_dev_err(hdev, "Unsupported Intel firmware naming");
2009         } else {
2010                 /* Once the device is running in operational mode, it needs to
2011                  * apply the device configuration (DDC) parameters.
2012                  *
2013                  * The device can work without DDC parameters, so even if it
2014                  * fails to load the file, no need to fail the setup.
2015                  */
2016                 btintel_load_ddc_config(hdev, ddcname);
2017         }
2018
2019         hci_dev_clear_flag(hdev, HCI_QUALITY_REPORT);
2020
2021         /* Read the Intel version information after loading the FW  */
2022         err = btintel_read_version(hdev, &new_ver);
2023         if (err)
2024                 return err;
2025
2026         btintel_version_info(hdev, &new_ver);
2027
2028 finish:
2029         /* Set the event mask for Intel specific vendor events. This enables
2030          * a few extra events that are useful during general operation. It
2031          * does not enable any debugging related events.
2032          *
2033          * The device will function correctly without these events enabled
2034          * and thus no need to fail the setup.
2035          */
2036         btintel_set_event_mask(hdev, false);
2037
2038         return 0;
2039 }
2040
2041 static void btintel_get_fw_name_tlv(const struct intel_version_tlv *ver,
2042                                     char *fw_name, size_t len,
2043                                     const char *suffix)
2044 {
2045         /* The firmware file name for new generation controllers will be
2046          * ibt-<cnvi_top type+cnvi_top step>-<cnvr_top type+cnvr_top step>
2047          */
2048         snprintf(fw_name, len, "intel/ibt-%04x-%04x.%s",
2049                  INTEL_CNVX_TOP_PACK_SWAB(INTEL_CNVX_TOP_TYPE(ver->cnvi_top),
2050                                           INTEL_CNVX_TOP_STEP(ver->cnvi_top)),
2051                  INTEL_CNVX_TOP_PACK_SWAB(INTEL_CNVX_TOP_TYPE(ver->cnvr_top),
2052                                           INTEL_CNVX_TOP_STEP(ver->cnvr_top)),
2053                  suffix);
2054 }
2055
2056 static int btintel_prepare_fw_download_tlv(struct hci_dev *hdev,
2057                                            struct intel_version_tlv *ver,
2058                                            u32 *boot_param)
2059 {
2060         const struct firmware *fw;
2061         char fwname[64];
2062         int err;
2063         ktime_t calltime;
2064
2065         if (!ver || !boot_param)
2066                 return -EINVAL;
2067
2068         /* The firmware variant determines if the device is in bootloader
2069          * mode or is running operational firmware. The value 0x03 identifies
2070          * the bootloader and the value 0x23 identifies the operational
2071          * firmware.
2072          *
2073          * When the operational firmware is already present, then only
2074          * the check for valid Bluetooth device address is needed. This
2075          * determines if the device will be added as configured or
2076          * unconfigured controller.
2077          *
2078          * It is not possible to use the Secure Boot Parameters in this
2079          * case since that command is only available in bootloader mode.
2080          */
2081         if (ver->img_type == 0x03) {
2082                 btintel_clear_flag(hdev, INTEL_BOOTLOADER);
2083                 btintel_check_bdaddr(hdev);
2084         } else {
2085                 /*
2086                  * Check for valid bd address in boot loader mode. Device
2087                  * will be marked as unconfigured if empty bd address is
2088                  * found.
2089                  */
2090                 if (!bacmp(&ver->otp_bd_addr, BDADDR_ANY)) {
2091                         bt_dev_info(hdev, "No device address configured");
2092                         set_bit(HCI_QUIRK_INVALID_BDADDR, &hdev->quirks);
2093                 }
2094         }
2095
2096         btintel_get_fw_name_tlv(ver, fwname, sizeof(fwname), "sfi");
2097         err = firmware_request_nowarn(&fw, fwname, &hdev->dev);
2098         if (err < 0) {
2099                 if (!btintel_test_flag(hdev, INTEL_BOOTLOADER)) {
2100                         /* Firmware has already been loaded */
2101                         btintel_set_flag(hdev, INTEL_FIRMWARE_LOADED);
2102                         return 0;
2103                 }
2104
2105                 bt_dev_err(hdev, "Failed to load Intel firmware file %s (%d)",
2106                            fwname, err);
2107
2108                 return err;
2109         }
2110
2111         bt_dev_info(hdev, "Found device firmware: %s", fwname);
2112
2113         if (fw->size < 644) {
2114                 bt_dev_err(hdev, "Invalid size of firmware file (%zu)",
2115                            fw->size);
2116                 err = -EBADF;
2117                 goto done;
2118         }
2119
2120         calltime = ktime_get();
2121
2122         btintel_set_flag(hdev, INTEL_DOWNLOADING);
2123
2124         /* Start firmware downloading and get boot parameter */
2125         err = btintel_download_fw_tlv(hdev, ver, fw, boot_param,
2126                                                INTEL_HW_VARIANT(ver->cnvi_bt),
2127                                                ver->sbe_type);
2128         if (err < 0) {
2129                 if (err == -EALREADY) {
2130                         /* Firmware has already been loaded */
2131                         btintel_set_flag(hdev, INTEL_FIRMWARE_LOADED);
2132                         err = 0;
2133                         goto done;
2134                 }
2135
2136                 /* When FW download fails, send Intel Reset to retry
2137                  * FW download.
2138                  */
2139                 btintel_reset_to_bootloader(hdev);
2140                 goto done;
2141         }
2142
2143         /* Before switching the device into operational mode and with that
2144          * booting the loaded firmware, wait for the bootloader notification
2145          * that all fragments have been successfully received.
2146          *
2147          * When the event processing receives the notification, then the
2148          * BTUSB_DOWNLOADING flag will be cleared.
2149          *
2150          * The firmware loading should not take longer than 5 seconds
2151          * and thus just timeout if that happens and fail the setup
2152          * of this device.
2153          */
2154         err = btintel_download_wait(hdev, calltime, 5000);
2155         if (err == -ETIMEDOUT)
2156                 btintel_reset_to_bootloader(hdev);
2157
2158 done:
2159         release_firmware(fw);
2160         return err;
2161 }
2162
2163 static int btintel_get_codec_config_data(struct hci_dev *hdev,
2164                                          __u8 link, struct bt_codec *codec,
2165                                          __u8 *ven_len, __u8 **ven_data)
2166 {
2167         int err = 0;
2168
2169         if (!ven_data || !ven_len)
2170                 return -EINVAL;
2171
2172         *ven_len = 0;
2173         *ven_data = NULL;
2174
2175         if (link != ESCO_LINK) {
2176                 bt_dev_err(hdev, "Invalid link type(%u)", link);
2177                 return -EINVAL;
2178         }
2179
2180         *ven_data = kmalloc(sizeof(__u8), GFP_KERNEL);
2181         if (!*ven_data) {
2182                 err = -ENOMEM;
2183                 goto error;
2184         }
2185
2186         /* supports only CVSD and mSBC offload codecs */
2187         switch (codec->id) {
2188         case 0x02:
2189                 **ven_data = 0x00;
2190                 break;
2191         case 0x05:
2192                 **ven_data = 0x01;
2193                 break;
2194         default:
2195                 err = -EINVAL;
2196                 bt_dev_err(hdev, "Invalid codec id(%u)", codec->id);
2197                 goto error;
2198         }
2199         /* codec and its capabilities are pre-defined to ids
2200          * preset id = 0x00 represents CVSD codec with sampling rate 8K
2201          * preset id = 0x01 represents mSBC codec with sampling rate 16K
2202          */
2203         *ven_len = sizeof(__u8);
2204         return err;
2205
2206 error:
2207         kfree(*ven_data);
2208         *ven_data = NULL;
2209         return err;
2210 }
2211
2212 static int btintel_get_data_path_id(struct hci_dev *hdev, __u8 *data_path_id)
2213 {
2214         /* Intel uses 1 as data path id for all the usecases */
2215         *data_path_id = 1;
2216         return 0;
2217 }
2218
2219 static int btintel_configure_offload(struct hci_dev *hdev)
2220 {
2221         struct sk_buff *skb;
2222         int err = 0;
2223         struct intel_offload_use_cases *use_cases;
2224
2225         skb = __hci_cmd_sync(hdev, 0xfc86, 0, NULL, HCI_INIT_TIMEOUT);
2226         if (IS_ERR(skb)) {
2227                 bt_dev_err(hdev, "Reading offload use cases failed (%ld)",
2228                            PTR_ERR(skb));
2229                 return PTR_ERR(skb);
2230         }
2231
2232         if (skb->len < sizeof(*use_cases)) {
2233                 err = -EIO;
2234                 goto error;
2235         }
2236
2237         use_cases = (void *)skb->data;
2238
2239         if (use_cases->status) {
2240                 err = -bt_to_errno(skb->data[0]);
2241                 goto error;
2242         }
2243
2244         if (use_cases->preset[0] & 0x03) {
2245                 hdev->get_data_path_id = btintel_get_data_path_id;
2246                 hdev->get_codec_config_data = btintel_get_codec_config_data;
2247         }
2248 error:
2249         kfree_skb(skb);
2250         return err;
2251 }
2252
2253 static int btintel_bootloader_setup_tlv(struct hci_dev *hdev,
2254                                         struct intel_version_tlv *ver)
2255 {
2256         u32 boot_param;
2257         char ddcname[64];
2258         int err;
2259         struct intel_version_tlv new_ver;
2260
2261         bt_dev_dbg(hdev, "");
2262
2263         /* Set the default boot parameter to 0x0 and it is updated to
2264          * SKU specific boot parameter after reading Intel_Write_Boot_Params
2265          * command while downloading the firmware.
2266          */
2267         boot_param = 0x00000000;
2268
2269         btintel_set_flag(hdev, INTEL_BOOTLOADER);
2270
2271         err = btintel_prepare_fw_download_tlv(hdev, ver, &boot_param);
2272         if (err)
2273                 return err;
2274
2275         /* check if controller is already having an operational firmware */
2276         if (ver->img_type == 0x03)
2277                 goto finish;
2278
2279         err = btintel_boot(hdev, boot_param);
2280         if (err)
2281                 return err;
2282
2283         btintel_clear_flag(hdev, INTEL_BOOTLOADER);
2284
2285         btintel_get_fw_name_tlv(ver, ddcname, sizeof(ddcname), "ddc");
2286         /* Once the device is running in operational mode, it needs to
2287          * apply the device configuration (DDC) parameters.
2288          *
2289          * The device can work without DDC parameters, so even if it
2290          * fails to load the file, no need to fail the setup.
2291          */
2292         btintel_load_ddc_config(hdev, ddcname);
2293
2294         /* Read supported use cases and set callbacks to fetch datapath id */
2295         btintel_configure_offload(hdev);
2296
2297         hci_dev_clear_flag(hdev, HCI_QUALITY_REPORT);
2298
2299         /* Read the Intel version information after loading the FW  */
2300         err = btintel_read_version_tlv(hdev, &new_ver);
2301         if (err)
2302                 return err;
2303
2304         btintel_version_info_tlv(hdev, &new_ver);
2305
2306 finish:
2307         /* Set the event mask for Intel specific vendor events. This enables
2308          * a few extra events that are useful during general operation. It
2309          * does not enable any debugging related events.
2310          *
2311          * The device will function correctly without these events enabled
2312          * and thus no need to fail the setup.
2313          */
2314         btintel_set_event_mask(hdev, false);
2315
2316         return 0;
2317 }
2318
2319 static void btintel_set_msft_opcode(struct hci_dev *hdev, u8 hw_variant)
2320 {
2321         switch (hw_variant) {
2322         /* Legacy bootloader devices that supports MSFT Extension */
2323         case 0x11:      /* JfP */
2324         case 0x12:      /* ThP */
2325         case 0x13:      /* HrP */
2326         case 0x14:      /* CcP */
2327         /* All Intel new genration controllers support the Microsoft vendor
2328          * extension are using 0xFC1E for VsMsftOpCode.
2329          */
2330         case 0x17:
2331         case 0x18:
2332         case 0x19:
2333                 hci_set_msft_opcode(hdev, 0xFC1E);
2334                 break;
2335         default:
2336                 /* Not supported */
2337                 break;
2338         }
2339 }
2340
2341 static int btintel_setup_combined(struct hci_dev *hdev)
2342 {
2343         const u8 param[1] = { 0xFF };
2344         struct intel_version ver;
2345         struct intel_version_tlv ver_tlv;
2346         struct sk_buff *skb;
2347         int err;
2348
2349         BT_DBG("%s", hdev->name);
2350
2351         /* The some controllers have a bug with the first HCI command sent to it
2352          * returning number of completed commands as zero. This would stall the
2353          * command processing in the Bluetooth core.
2354          *
2355          * As a workaround, send HCI Reset command first which will reset the
2356          * number of completed commands and allow normal command processing
2357          * from now on.
2358          *
2359          * Regarding the INTEL_BROKEN_SHUTDOWN_LED flag, these devices maybe
2360          * in the SW_RFKILL ON state as a workaround of fixing LED issue during
2361          * the shutdown() procedure, and once the device is in SW_RFKILL ON
2362          * state, the only way to exit out of it is sending the HCI_Reset
2363          * command.
2364          */
2365         if (btintel_test_flag(hdev, INTEL_BROKEN_INITIAL_NCMD) ||
2366             btintel_test_flag(hdev, INTEL_BROKEN_SHUTDOWN_LED)) {
2367                 skb = __hci_cmd_sync(hdev, HCI_OP_RESET, 0, NULL,
2368                                      HCI_INIT_TIMEOUT);
2369                 if (IS_ERR(skb)) {
2370                         bt_dev_err(hdev,
2371                                    "sending initial HCI reset failed (%ld)",
2372                                    PTR_ERR(skb));
2373                         return PTR_ERR(skb);
2374                 }
2375                 kfree_skb(skb);
2376         }
2377
2378         /* Starting from TyP device, the command parameter and response are
2379          * changed even though the OCF for HCI_Intel_Read_Version command
2380          * remains same. The legacy devices can handle even if the
2381          * command has a parameter and returns a correct version information.
2382          * So, it uses new format to support both legacy and new format.
2383          */
2384         skb = __hci_cmd_sync(hdev, 0xfc05, 1, param, HCI_CMD_TIMEOUT);
2385         if (IS_ERR(skb)) {
2386                 bt_dev_err(hdev, "Reading Intel version command failed (%ld)",
2387                            PTR_ERR(skb));
2388                 return PTR_ERR(skb);
2389         }
2390
2391         /* Check the status */
2392         if (skb->data[0]) {
2393                 bt_dev_err(hdev, "Intel Read Version command failed (%02x)",
2394                            skb->data[0]);
2395                 err = -EIO;
2396                 goto exit_error;
2397         }
2398
2399         /* Apply the common HCI quirks for Intel device */
2400         set_bit(HCI_QUIRK_STRICT_DUPLICATE_FILTER, &hdev->quirks);
2401         set_bit(HCI_QUIRK_SIMULTANEOUS_DISCOVERY, &hdev->quirks);
2402         set_bit(HCI_QUIRK_NON_PERSISTENT_DIAG, &hdev->quirks);
2403
2404         /* Set up the quality report callback for Intel devices */
2405         hdev->set_quality_report = btintel_set_quality_report;
2406
2407         /* For Legacy device, check the HW platform value and size */
2408         if (skb->len == sizeof(ver) && skb->data[1] == 0x37) {
2409                 bt_dev_dbg(hdev, "Read the legacy Intel version information");
2410
2411                 memcpy(&ver, skb->data, sizeof(ver));
2412
2413                 /* Display version information */
2414                 btintel_version_info(hdev, &ver);
2415
2416                 /* Check for supported iBT hardware variants of this firmware
2417                  * loading method.
2418                  *
2419                  * This check has been put in place to ensure correct forward
2420                  * compatibility options when newer hardware variants come
2421                  * along.
2422                  */
2423                 switch (ver.hw_variant) {
2424                 case 0x07:      /* WP */
2425                 case 0x08:      /* StP */
2426                         /* Legacy ROM product */
2427                         btintel_set_flag(hdev, INTEL_ROM_LEGACY);
2428
2429                         /* Apply the device specific HCI quirks
2430                          *
2431                          * WBS for SdP - For the Legacy ROM products, only SdP
2432                          * supports the WBS. But the version information is not
2433                          * enough to use here because the StP2 and SdP have same
2434                          * hw_variant and fw_variant. So, this flag is set by
2435                          * the transport driver (btusb) based on the HW info
2436                          * (idProduct)
2437                          */
2438                         if (!btintel_test_flag(hdev,
2439                                                INTEL_ROM_LEGACY_NO_WBS_SUPPORT))
2440                                 set_bit(HCI_QUIRK_WIDEBAND_SPEECH_SUPPORTED,
2441                                         &hdev->quirks);
2442
2443                         err = btintel_legacy_rom_setup(hdev, &ver);
2444                         break;
2445                 case 0x0b:      /* SfP */
2446                 case 0x0c:      /* WsP */
2447                 case 0x11:      /* JfP */
2448                 case 0x12:      /* ThP */
2449                 case 0x13:      /* HrP */
2450                 case 0x14:      /* CcP */
2451                         /* Apply the device specific HCI quirks
2452                          *
2453                          * All Legacy bootloader devices support WBS
2454                          */
2455                         set_bit(HCI_QUIRK_WIDEBAND_SPEECH_SUPPORTED,
2456                                 &hdev->quirks);
2457
2458                         /* Valid LE States quirk for JfP/ThP familiy */
2459                         if (ver.hw_variant == 0x11 || ver.hw_variant == 0x12)
2460                                 set_bit(HCI_QUIRK_VALID_LE_STATES,
2461                                         &hdev->quirks);
2462
2463                         /* Setup MSFT Extension support */
2464                         btintel_set_msft_opcode(hdev, ver.hw_variant);
2465
2466                         err = btintel_bootloader_setup(hdev, &ver);
2467                         break;
2468                 default:
2469                         bt_dev_err(hdev, "Unsupported Intel hw variant (%u)",
2470                                    ver.hw_variant);
2471                         err = -EINVAL;
2472                 }
2473
2474                 goto exit_error;
2475         }
2476
2477         /* memset ver_tlv to start with clean state as few fields are exclusive
2478          * to bootloader mode and are not populated in operational mode
2479          */
2480         memset(&ver_tlv, 0, sizeof(ver_tlv));
2481         /* For TLV type device, parse the tlv data */
2482         err = btintel_parse_version_tlv(hdev, &ver_tlv, skb);
2483         if (err) {
2484                 bt_dev_err(hdev, "Failed to parse TLV version information");
2485                 goto exit_error;
2486         }
2487
2488         if (INTEL_HW_PLATFORM(ver_tlv.cnvi_bt) != 0x37) {
2489                 bt_dev_err(hdev, "Unsupported Intel hardware platform (0x%2x)",
2490                            INTEL_HW_PLATFORM(ver_tlv.cnvi_bt));
2491                 err = -EINVAL;
2492                 goto exit_error;
2493         }
2494
2495         /* Check for supported iBT hardware variants of this firmware
2496          * loading method.
2497          *
2498          * This check has been put in place to ensure correct forward
2499          * compatibility options when newer hardware variants come
2500          * along.
2501          */
2502         switch (INTEL_HW_VARIANT(ver_tlv.cnvi_bt)) {
2503         case 0x11:      /* JfP */
2504         case 0x12:      /* ThP */
2505         case 0x13:      /* HrP */
2506         case 0x14:      /* CcP */
2507                 /* Some legacy bootloader devices starting from JfP,
2508                  * the operational firmware supports both old and TLV based
2509                  * HCI_Intel_Read_Version command based on the command
2510                  * parameter.
2511                  *
2512                  * For upgrading firmware case, the TLV based version cannot
2513                  * be used because the firmware filename for legacy bootloader
2514                  * is based on the old format.
2515                  *
2516                  * Also, it is not easy to convert TLV based version from the
2517                  * legacy version format.
2518                  *
2519                  * So, as a workaround for those devices, use the legacy
2520                  * HCI_Intel_Read_Version to get the version information and
2521                  * run the legacy bootloader setup.
2522                  */
2523                 err = btintel_read_version(hdev, &ver);
2524                 if (err)
2525                         return err;
2526
2527                 /* Apply the device specific HCI quirks
2528                  *
2529                  * All Legacy bootloader devices support WBS
2530                  */
2531                 set_bit(HCI_QUIRK_WIDEBAND_SPEECH_SUPPORTED, &hdev->quirks);
2532
2533                 /* Valid LE States quirk for JfP/ThP familiy */
2534                 if (ver.hw_variant == 0x11 || ver.hw_variant == 0x12)
2535                         set_bit(HCI_QUIRK_VALID_LE_STATES, &hdev->quirks);
2536
2537                 /* Setup MSFT Extension support */
2538                 btintel_set_msft_opcode(hdev, ver.hw_variant);
2539
2540                 err = btintel_bootloader_setup(hdev, &ver);
2541                 break;
2542         case 0x17:
2543         case 0x18:
2544         case 0x19:
2545                 /* Display version information of TLV type */
2546                 btintel_version_info_tlv(hdev, &ver_tlv);
2547
2548                 /* Apply the device specific HCI quirks for TLV based devices
2549                  *
2550                  * All TLV based devices support WBS
2551                  */
2552                 set_bit(HCI_QUIRK_WIDEBAND_SPEECH_SUPPORTED, &hdev->quirks);
2553
2554                 /* Valid LE States quirk for GfP */
2555                 if (INTEL_HW_VARIANT(ver_tlv.cnvi_bt) == 0x18)
2556                         set_bit(HCI_QUIRK_VALID_LE_STATES, &hdev->quirks);
2557
2558                 /* Setup MSFT Extension support */
2559                 btintel_set_msft_opcode(hdev,
2560                                         INTEL_HW_VARIANT(ver_tlv.cnvi_bt));
2561
2562                 err = btintel_bootloader_setup_tlv(hdev, &ver_tlv);
2563                 break;
2564         default:
2565                 bt_dev_err(hdev, "Unsupported Intel hw variant (%u)",
2566                            INTEL_HW_VARIANT(ver_tlv.cnvi_bt));
2567                 return -EINVAL;
2568         }
2569
2570 exit_error:
2571         kfree_skb(skb);
2572
2573         return err;
2574 }
2575
2576 static int btintel_shutdown_combined(struct hci_dev *hdev)
2577 {
2578         struct sk_buff *skb;
2579         int ret;
2580
2581         /* Send HCI Reset to the controller to stop any BT activity which
2582          * were triggered. This will help to save power and maintain the
2583          * sync b/w Host and controller
2584          */
2585         skb = __hci_cmd_sync(hdev, HCI_OP_RESET, 0, NULL, HCI_INIT_TIMEOUT);
2586         if (IS_ERR(skb)) {
2587                 bt_dev_err(hdev, "HCI reset during shutdown failed");
2588                 return PTR_ERR(skb);
2589         }
2590         kfree_skb(skb);
2591
2592
2593         /* Some platforms have an issue with BT LED when the interface is
2594          * down or BT radio is turned off, which takes 5 seconds to BT LED
2595          * goes off. As a workaround, sends HCI_Intel_SW_RFKILL to put the
2596          * device in the RFKILL ON state which turns off the BT LED immediately.
2597          */
2598         if (btintel_test_flag(hdev, INTEL_BROKEN_SHUTDOWN_LED)) {
2599                 skb = __hci_cmd_sync(hdev, 0xfc3f, 0, NULL, HCI_INIT_TIMEOUT);
2600                 if (IS_ERR(skb)) {
2601                         ret = PTR_ERR(skb);
2602                         bt_dev_err(hdev, "turning off Intel device LED failed");
2603                         return ret;
2604                 }
2605                 kfree_skb(skb);
2606         }
2607
2608         return 0;
2609 }
2610
2611 int btintel_configure_setup(struct hci_dev *hdev)
2612 {
2613         hdev->manufacturer = 2;
2614         hdev->setup = btintel_setup_combined;
2615         hdev->shutdown = btintel_shutdown_combined;
2616         hdev->hw_error = btintel_hw_error;
2617         hdev->set_diag = btintel_set_diag_combined;
2618         hdev->set_bdaddr = btintel_set_bdaddr;
2619
2620         return 0;
2621 }
2622 EXPORT_SYMBOL_GPL(btintel_configure_setup);
2623
2624 void btintel_bootup(struct hci_dev *hdev, const void *ptr, unsigned int len)
2625 {
2626         const struct intel_bootup *evt = ptr;
2627
2628         if (len != sizeof(*evt))
2629                 return;
2630
2631         if (btintel_test_and_clear_flag(hdev, INTEL_BOOTING))
2632                 btintel_wake_up_flag(hdev, INTEL_BOOTING);
2633 }
2634 EXPORT_SYMBOL_GPL(btintel_bootup);
2635
2636 void btintel_secure_send_result(struct hci_dev *hdev,
2637                                 const void *ptr, unsigned int len)
2638 {
2639         const struct intel_secure_send_result *evt = ptr;
2640
2641         if (len != sizeof(*evt))
2642                 return;
2643
2644         if (evt->result)
2645                 btintel_set_flag(hdev, INTEL_FIRMWARE_FAILED);
2646
2647         if (btintel_test_and_clear_flag(hdev, INTEL_DOWNLOADING) &&
2648             btintel_test_flag(hdev, INTEL_FIRMWARE_LOADED))
2649                 btintel_wake_up_flag(hdev, INTEL_DOWNLOADING);
2650 }
2651 EXPORT_SYMBOL_GPL(btintel_secure_send_result);
2652
2653 MODULE_AUTHOR("Marcel Holtmann <marcel@holtmann.org>");
2654 MODULE_DESCRIPTION("Bluetooth support for Intel devices ver " VERSION);
2655 MODULE_VERSION(VERSION);
2656 MODULE_LICENSE("GPL");
2657 MODULE_FIRMWARE("intel/ibt-11-5.sfi");
2658 MODULE_FIRMWARE("intel/ibt-11-5.ddc");
2659 MODULE_FIRMWARE("intel/ibt-12-16.sfi");
2660 MODULE_FIRMWARE("intel/ibt-12-16.ddc");