drivers/bluetooth/btintel.c

   1 // SPDX-License-Identifier: GPL-2.0-or-later
   2 /*
   3  *
   4  *  Bluetooth support for Intel devices
   5  *
   6  *  Copyright (C) 2015  Intel Corporation
   7  */
   8
   9 #include <linux/module.h>
  10 #include <linux/firmware.h>
  11 #include <linux/regmap.h>
  12 #include <asm/unaligned.h>
  13
  14 #include <net/bluetooth/bluetooth.h>
  15 #include <net/bluetooth/hci_core.h>
  16
  17 #include "btintel.h"
  18
  19 #define VERSION "0.1"
  20
  21 #define BDADDR_INTEL            (&(bdaddr_t){{0x00, 0x8b, 0x9e, 0x19, 0x03, 0x00}})
  22 #define RSA_HEADER_LEN          644
  23 #define CSS_HEADER_OFFSET       8
  24 #define ECDSA_OFFSET            644
  25 #define ECDSA_HEADER_LEN        320
  26
  27 #define CMD_WRITE_BOOT_PARAMS   0xfc0e
  28 struct cmd_write_boot_params {
  29         u32 boot_addr;
  30         u8  fw_build_num;
  31         u8  fw_build_ww;
  32         u8  fw_build_yy;
  33 } __packed;
  34
  35 int btintel_check_bdaddr(struct hci_dev *hdev)
  36 {
  37         struct hci_rp_read_bd_addr *bda;
  38         struct sk_buff *skb;
  39
  40         skb = __hci_cmd_sync(hdev, HCI_OP_READ_BD_ADDR, 0, NULL,
  41                              HCI_INIT_TIMEOUT);
  42         if (IS_ERR(skb)) {
  43                 int err = PTR_ERR(skb);
  44                 bt_dev_err(hdev, "Reading Intel device address failed (%d)",
  45                            err);
  46                 return err;
  47         }
  48
  49         if (skb->len != sizeof(*bda)) {
  50                 bt_dev_err(hdev, "Intel device address length mismatch");
  51                 kfree_skb(skb);
  52                 return -EIO;
  53         }
  54
  55         bda = (struct hci_rp_read_bd_addr *)skb->data;
  56
  57         /* For some Intel based controllers, the default Bluetooth device
  58          * address 00:03:19:9E:8B:00 can be found. These controllers are
  59          * fully operational, but have the danger of duplicate addresses
  60          * and that in turn can cause problems with Bluetooth operation.
  61          */
  62         if (!bacmp(&bda->bdaddr, BDADDR_INTEL)) {
  63                 bt_dev_err(hdev, "Found Intel default device address (%pMR)",
  64                            &bda->bdaddr);
  65                 set_bit(HCI_QUIRK_INVALID_BDADDR, &hdev->quirks);
  66         }
  67
  68         kfree_skb(skb);
  69
  70         return 0;
  71 }
  72 EXPORT_SYMBOL_GPL(btintel_check_bdaddr);
  73
  74 int btintel_enter_mfg(struct hci_dev *hdev)
  75 {
  76         static const u8 param[] = { 0x01, 0x00 };
  77         struct sk_buff *skb;
  78
  79         skb = __hci_cmd_sync(hdev, 0xfc11, 2, param, HCI_CMD_TIMEOUT);
  80         if (IS_ERR(skb)) {
  81                 bt_dev_err(hdev, "Entering manufacturer mode failed (%ld)",
  82                            PTR_ERR(skb));
  83                 return PTR_ERR(skb);
  84         }
  85         kfree_skb(skb);
  86
  87         return 0;
  88 }
  89 EXPORT_SYMBOL_GPL(btintel_enter_mfg);
  90
  91 int btintel_exit_mfg(struct hci_dev *hdev, bool reset, bool patched)
  92 {
  93         u8 param[] = { 0x00, 0x00 };
  94         struct sk_buff *skb;
  95
  96         /* The 2nd command parameter specifies the manufacturing exit method:
  97          * 0x00: Just disable the manufacturing mode (0x00).
  98          * 0x01: Disable manufacturing mode and reset with patches deactivated.
  99          * 0x02: Disable manufacturing mode and reset with patches activated.
 100          */
 101         if (reset)
 102                 param[1] |= patched ? 0x02 : 0x01;
 103
 104         skb = __hci_cmd_sync(hdev, 0xfc11, 2, param, HCI_CMD_TIMEOUT);
 105         if (IS_ERR(skb)) {
 106                 bt_dev_err(hdev, "Exiting manufacturer mode failed (%ld)",
 107                            PTR_ERR(skb));
 108                 return PTR_ERR(skb);
 109         }
 110         kfree_skb(skb);
 111
 112         return 0;
 113 }
 114 EXPORT_SYMBOL_GPL(btintel_exit_mfg);
 115
 116 int btintel_set_bdaddr(struct hci_dev *hdev, const bdaddr_t *bdaddr)
 117 {
 118         struct sk_buff *skb;
 119         int err;
 120
 121         skb = __hci_cmd_sync(hdev, 0xfc31, 6, bdaddr, HCI_INIT_TIMEOUT);
 122         if (IS_ERR(skb)) {
 123                 err = PTR_ERR(skb);
 124                 bt_dev_err(hdev, "Changing Intel device address failed (%d)",
 125                            err);
 126                 return err;
 127         }
 128         kfree_skb(skb);
 129
 130         return 0;
 131 }
 132 EXPORT_SYMBOL_GPL(btintel_set_bdaddr);
 133
 134 static int btintel_set_event_mask(struct hci_dev *hdev, bool debug)
 135 {
 136         u8 mask[8] = { 0x87, 0x0c, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 };
 137         struct sk_buff *skb;
 138         int err;
 139
 140         if (debug)
 141                 mask[1] |= 0x62;
 142
 143         skb = __hci_cmd_sync(hdev, 0xfc52, 8, mask, HCI_INIT_TIMEOUT);
 144         if (IS_ERR(skb)) {
 145                 err = PTR_ERR(skb);
 146                 bt_dev_err(hdev, "Setting Intel event mask failed (%d)", err);
 147                 return err;
 148         }
 149         kfree_skb(skb);
 150
 151         return 0;
 152 }
 153
 154 int btintel_set_diag(struct hci_dev *hdev, bool enable)
 155 {
 156         struct sk_buff *skb;
 157         u8 param[3];
 158         int err;
 159
 160         if (enable) {
 161                 param[0] = 0x03;
 162                 param[1] = 0x03;
 163                 param[2] = 0x03;
 164         } else {
 165                 param[0] = 0x00;
 166                 param[1] = 0x00;
 167                 param[2] = 0x00;
 168         }
 169
 170         skb = __hci_cmd_sync(hdev, 0xfc43, 3, param, HCI_INIT_TIMEOUT);
 171         if (IS_ERR(skb)) {
 172                 err = PTR_ERR(skb);
 173                 if (err == -ENODATA)
 174                         goto done;
 175                 bt_dev_err(hdev, "Changing Intel diagnostic mode failed (%d)",
 176                            err);
 177                 return err;
 178         }
 179         kfree_skb(skb);
 180
 181 done:
 182         btintel_set_event_mask(hdev, enable);
 183         return 0;
 184 }
 185 EXPORT_SYMBOL_GPL(btintel_set_diag);
 186
 187 static int btintel_set_diag_mfg(struct hci_dev *hdev, bool enable)
 188 {
 189         int err, ret;
 190
 191         err = btintel_enter_mfg(hdev);
 192         if (err)
 193                 return err;
 194
 195         ret = btintel_set_diag(hdev, enable);
 196
 197         err = btintel_exit_mfg(hdev, false, false);
 198         if (err)
 199                 return err;
 200
 201         return ret;
 202 }
 203
 204 static int btintel_set_diag_combined(struct hci_dev *hdev, bool enable)
 205 {
 206         int ret;
 207
 208         /* Legacy ROM device needs to be in the manufacturer mode to apply
 209          * diagnostic setting
 210          *
 211          * This flag is set after reading the Intel version.
 212          */
 213         if (btintel_test_flag(hdev, INTEL_ROM_LEGACY))
 214                 ret = btintel_set_diag_mfg(hdev, enable);
 215         else
 216                 ret = btintel_set_diag(hdev, enable);
 217
 218         return ret;
 219 }
 220
 221 static void btintel_hw_error(struct hci_dev *hdev, u8 code)
 222 {
 223         struct sk_buff *skb;
 224         u8 type = 0x00;
 225
 226         bt_dev_err(hdev, "Hardware error 0x%2.2x", code);
 227
 228         skb = __hci_cmd_sync(hdev, HCI_OP_RESET, 0, NULL, HCI_INIT_TIMEOUT);
 229         if (IS_ERR(skb)) {
 230                 bt_dev_err(hdev, "Reset after hardware error failed (%ld)",
 231                            PTR_ERR(skb));
 232                 return;
 233         }
 234         kfree_skb(skb);
 235
 236         skb = __hci_cmd_sync(hdev, 0xfc22, 1, &type, HCI_INIT_TIMEOUT);
 237         if (IS_ERR(skb)) {
 238                 bt_dev_err(hdev, "Retrieving Intel exception info failed (%ld)",
 239                            PTR_ERR(skb));
 240                 return;
 241         }
 242
 243         if (skb->len != 13) {
 244                 bt_dev_err(hdev, "Exception info size mismatch");
 245                 kfree_skb(skb);
 246                 return;
 247         }
 248
 249         bt_dev_err(hdev, "Exception info %s", (char *)(skb->data + 1));
 250
 251         kfree_skb(skb);
 252 }
 253
 254 int btintel_version_info(struct hci_dev *hdev, struct intel_version *ver)
 255 {
 256         const char *variant;
 257
 258         /* The hardware platform number has a fixed value of 0x37 and
 259          * for now only accept this single value.
 260          */
 261         if (ver->hw_platform != 0x37) {
 262                 bt_dev_err(hdev, "Unsupported Intel hardware platform (%u)",
 263                            ver->hw_platform);
 264                 return -EINVAL;
 265         }
 266
 267         /* Check for supported iBT hardware variants of this firmware
 268          * loading method.
 269          *
 270          * This check has been put in place to ensure correct forward
 271          * compatibility options when newer hardware variants come along.
 272          */
 273         switch (ver->hw_variant) {
 274         case 0x07:      /* WP - Legacy ROM */
 275         case 0x08:      /* StP - Legacy ROM */
 276         case 0x0b:      /* SfP */
 277         case 0x0c:      /* WsP */
 278         case 0x11:      /* JfP */
 279         case 0x12:      /* ThP */
 280         case 0x13:      /* HrP */
 281         case 0x14:      /* CcP */
 282                 break;
 283         default:
 284                 bt_dev_err(hdev, "Unsupported Intel hardware variant (%u)",
 285                            ver->hw_variant);
 286                 return -EINVAL;
 287         }
 288
 289         switch (ver->fw_variant) {
 290         case 0x01:
 291                 variant = "Legacy ROM 2.5";
 292                 break;
 293         case 0x06:
 294                 variant = "Bootloader";
 295                 break;
 296         case 0x22:
 297                 variant = "Legacy ROM 2.x";
 298                 break;
 299         case 0x23:
 300                 variant = "Firmware";
 301                 break;
 302         default:
 303                 bt_dev_err(hdev, "Unsupported firmware variant(%02x)", ver->fw_variant);
 304                 return -EINVAL;
 305         }
 306
 307         bt_dev_info(hdev, "%s revision %u.%u build %u week %u %u",
 308                     variant, ver->fw_revision >> 4, ver->fw_revision & 0x0f,
 309                     ver->fw_build_num, ver->fw_build_ww,
 310                     2000 + ver->fw_build_yy);
 311
 312         return 0;
 313 }
 314 EXPORT_SYMBOL_GPL(btintel_version_info);
 315
 316 static int btintel_secure_send(struct hci_dev *hdev, u8 fragment_type, u32 plen,
 317                                const void *param)
 318 {
 319         while (plen > 0) {
 320                 struct sk_buff *skb;
 321                 u8 cmd_param[253], fragment_len = (plen > 252) ? 252 : plen;
 322
 323                 cmd_param[0] = fragment_type;
 324                 memcpy(cmd_param + 1, param, fragment_len);
 325
 326                 skb = __hci_cmd_sync(hdev, 0xfc09, fragment_len + 1,
 327                                      cmd_param, HCI_INIT_TIMEOUT);
 328                 if (IS_ERR(skb))
 329                         return PTR_ERR(skb);
 330
 331                 kfree_skb(skb);
 332
 333                 plen -= fragment_len;
 334                 param += fragment_len;
 335         }
 336
 337         return 0;
 338 }
 339
 340 int btintel_load_ddc_config(struct hci_dev *hdev, const char *ddc_name)
 341 {
 342         const struct firmware *fw;
 343         struct sk_buff *skb;
 344         const u8 *fw_ptr;
 345         int err;
 346
 347         err = request_firmware_direct(&fw, ddc_name, &hdev->dev);
 348         if (err < 0) {
 349                 bt_dev_err(hdev, "Failed to load Intel DDC file %s (%d)",
 350                            ddc_name, err);
 351                 return err;
 352         }
 353
 354         bt_dev_info(hdev, "Found Intel DDC parameters: %s", ddc_name);
 355
 356         fw_ptr = fw->data;
 357
 358         /* DDC file contains one or more DDC structure which has
 359          * Length (1 byte), DDC ID (2 bytes), and DDC value (Length - 2).
 360          */
 361         while (fw->size > fw_ptr - fw->data) {
 362                 u8 cmd_plen = fw_ptr[0] + sizeof(u8);
 363
 364                 skb = __hci_cmd_sync(hdev, 0xfc8b, cmd_plen, fw_ptr,
 365                                      HCI_INIT_TIMEOUT);
 366                 if (IS_ERR(skb)) {
 367                         bt_dev_err(hdev, "Failed to send Intel_Write_DDC (%ld)",
 368                                    PTR_ERR(skb));
 369                         release_firmware(fw);
 370                         return PTR_ERR(skb);
 371                 }
 372
 373                 fw_ptr += cmd_plen;
 374                 kfree_skb(skb);
 375         }
 376
 377         release_firmware(fw);
 378
 379         bt_dev_info(hdev, "Applying Intel DDC parameters completed");
 380
 381         return 0;
 382 }
 383 EXPORT_SYMBOL_GPL(btintel_load_ddc_config);
 384
 385 int btintel_set_event_mask_mfg(struct hci_dev *hdev, bool debug)
 386 {
 387         int err, ret;
 388
 389         err = btintel_enter_mfg(hdev);
 390         if (err)
 391                 return err;
 392
 393         ret = btintel_set_event_mask(hdev, debug);
 394
 395         err = btintel_exit_mfg(hdev, false, false);
 396         if (err)
 397                 return err;
 398
 399         return ret;
 400 }
 401 EXPORT_SYMBOL_GPL(btintel_set_event_mask_mfg);
 402
 403 int btintel_read_version(struct hci_dev *hdev, struct intel_version *ver)
 404 {
 405         struct sk_buff *skb;
 406
 407         skb = __hci_cmd_sync(hdev, 0xfc05, 0, NULL, HCI_CMD_TIMEOUT);
 408         if (IS_ERR(skb)) {
 409                 bt_dev_err(hdev, "Reading Intel version information failed (%ld)",
 410                            PTR_ERR(skb));
 411                 return PTR_ERR(skb);
 412         }
 413
 414         if (skb->len != sizeof(*ver)) {
 415                 bt_dev_err(hdev, "Intel version event size mismatch");
 416                 kfree_skb(skb);
 417                 return -EILSEQ;
 418         }
 419
 420         memcpy(ver, skb->data, sizeof(*ver));
 421
 422         kfree_skb(skb);
 423
 424         return 0;
 425 }
 426 EXPORT_SYMBOL_GPL(btintel_read_version);
 427
 428 static int btintel_version_info_tlv(struct hci_dev *hdev,
 429                                     struct intel_version_tlv *version)
 430 {
 431         const char *variant;
 432
 433         /* The hardware platform number has a fixed value of 0x37 and
 434          * for now only accept this single value.
 435          */
 436         if (INTEL_HW_PLATFORM(version->cnvi_bt) != 0x37) {
 437                 bt_dev_err(hdev, "Unsupported Intel hardware platform (0x%2x)",
 438                            INTEL_HW_PLATFORM(version->cnvi_bt));
 439                 return -EINVAL;
 440         }
 441
 442         /* Check for supported iBT hardware variants of this firmware
 443          * loading method.
 444          *
 445          * This check has been put in place to ensure correct forward
 446          * compatibility options when newer hardware variants come along.
 447          */
 448         switch (INTEL_HW_VARIANT(version->cnvi_bt)) {
 449         case 0x17:      /* TyP */
 450         case 0x18:      /* Slr */
 451         case 0x19:      /* Slr-F */
 452                 break;
 453         default:
 454                 bt_dev_err(hdev, "Unsupported Intel hardware variant (0x%x)",
 455                            INTEL_HW_VARIANT(version->cnvi_bt));
 456                 return -EINVAL;
 457         }
 458
 459         switch (version->img_type) {
 460         case 0x01:
 461                 variant = "Bootloader";
 462                 /* It is required that every single firmware fragment is acknowledged
 463                  * with a command complete event. If the boot parameters indicate
 464                  * that this bootloader does not send them, then abort the setup.
 465                  */
 466                 if (version->limited_cce != 0x00) {
 467                         bt_dev_err(hdev, "Unsupported Intel firmware loading method (0x%x)",
 468                                    version->limited_cce);
 469                         return -EINVAL;
 470                 }
 471
 472                 /* Secure boot engine type should be either 1 (ECDSA) or 0 (RSA) */
 473                 if (version->sbe_type > 0x01) {
 474                         bt_dev_err(hdev, "Unsupported Intel secure boot engine type (0x%x)",
 475                                    version->sbe_type);
 476                         return -EINVAL;
 477                 }
 478
 479                 bt_dev_info(hdev, "Device revision is %u", version->dev_rev_id);
 480                 bt_dev_info(hdev, "Secure boot is %s",
 481                             version->secure_boot ? "enabled" : "disabled");
 482                 bt_dev_info(hdev, "OTP lock is %s",
 483                             version->otp_lock ? "enabled" : "disabled");
 484                 bt_dev_info(hdev, "API lock is %s",
 485                             version->api_lock ? "enabled" : "disabled");
 486                 bt_dev_info(hdev, "Debug lock is %s",
 487                             version->debug_lock ? "enabled" : "disabled");
 488                 bt_dev_info(hdev, "Minimum firmware build %u week %u %u",
 489                             version->min_fw_build_nn, version->min_fw_build_cw,
 490                             2000 + version->min_fw_build_yy);
 491                 break;
 492         case 0x03:
 493                 variant = "Firmware";
 494                 break;
 495         default:
 496                 bt_dev_err(hdev, "Unsupported image type(%02x)", version->img_type);
 497                 return -EINVAL;
 498         }
 499
 500         bt_dev_info(hdev, "%s timestamp %u.%u buildtype %u build %u", variant,
 501                     2000 + (version->timestamp >> 8), version->timestamp & 0xff,
 502                     version->build_type, version->build_num);
 503
 504         return 0;
 505 }
 506
 507 static int btintel_parse_version_tlv(struct hci_dev *hdev,
 508                                      struct intel_version_tlv *version,
 509                                      struct sk_buff *skb)
 510 {
 511         /* Consume Command Complete Status field */
 512         skb_pull(skb, 1);
 513
 514         /* Event parameters contatin multiple TLVs. Read each of them
 515          * and only keep the required data. Also, it use existing legacy
 516          * version field like hw_platform, hw_variant, and fw_variant
 517          * to keep the existing setup flow
 518          */
 519         while (skb->len) {
 520                 struct intel_tlv *tlv;
 521
 522                 /* Make sure skb has a minimum length of the header */
 523                 if (skb->len < sizeof(*tlv))
 524                         return -EINVAL;
 525
 526                 tlv = (struct intel_tlv *)skb->data;
 527
 528                 /* Make sure skb has a enough data */
 529                 if (skb->len < tlv->len + sizeof(*tlv))
 530                         return -EINVAL;
 531
 532                 switch (tlv->type) {
 533                 case INTEL_TLV_CNVI_TOP:
 534                         version->cnvi_top = get_unaligned_le32(tlv->val);
 535                         break;
 536                 case INTEL_TLV_CNVR_TOP:
 537                         version->cnvr_top = get_unaligned_le32(tlv->val);
 538                         break;
 539                 case INTEL_TLV_CNVI_BT:
 540                         version->cnvi_bt = get_unaligned_le32(tlv->val);
 541                         break;
 542                 case INTEL_TLV_CNVR_BT:
 543                         version->cnvr_bt = get_unaligned_le32(tlv->val);
 544                         break;
 545                 case INTEL_TLV_DEV_REV_ID:
 546                         version->dev_rev_id = get_unaligned_le16(tlv->val);
 547                         break;
 548                 case INTEL_TLV_IMAGE_TYPE:
 549                         version->img_type = tlv->val[0];
 550                         break;
 551                 case INTEL_TLV_TIME_STAMP:
 552                         /* If image type is Operational firmware (0x03), then
 553                          * running FW Calendar Week and Year information can
 554                          * be extracted from Timestamp information
 555                          */
 556                         version->min_fw_build_cw = tlv->val[0];
 557                         version->min_fw_build_yy = tlv->val[1];
 558                         version->timestamp = get_unaligned_le16(tlv->val);
 559                         break;
 560                 case INTEL_TLV_BUILD_TYPE:
 561                         version->build_type = tlv->val[0];
 562                         break;
 563                 case INTEL_TLV_BUILD_NUM:
 564                         /* If image type is Operational firmware (0x03), then
 565                          * running FW build number can be extracted from the
 566                          * Build information
 567                          */
 568                         version->min_fw_build_nn = tlv->val[0];
 569                         version->build_num = get_unaligned_le32(tlv->val);
 570                         break;
 571                 case INTEL_TLV_SECURE_BOOT:
 572                         version->secure_boot = tlv->val[0];
 573                         break;
 574                 case INTEL_TLV_OTP_LOCK:
 575                         version->otp_lock = tlv->val[0];
 576                         break;
 577                 case INTEL_TLV_API_LOCK:
 578                         version->api_lock = tlv->val[0];
 579                         break;
 580                 case INTEL_TLV_DEBUG_LOCK:
 581                         version->debug_lock = tlv->val[0];
 582                         break;
 583                 case INTEL_TLV_MIN_FW:
 584                         version->min_fw_build_nn = tlv->val[0];
 585                         version->min_fw_build_cw = tlv->val[1];
 586                         version->min_fw_build_yy = tlv->val[2];
 587                         break;
 588                 case INTEL_TLV_LIMITED_CCE:
 589                         version->limited_cce = tlv->val[0];
 590                         break;
 591                 case INTEL_TLV_SBE_TYPE:
 592                         version->sbe_type = tlv->val[0];
 593                         break;
 594                 case INTEL_TLV_OTP_BDADDR:
 595                         memcpy(&version->otp_bd_addr, tlv->val,
 596                                                         sizeof(bdaddr_t));
 597                         break;
 598                 default:
 599                         /* Ignore rest of information */
 600                         break;
 601                 }
 602                 /* consume the current tlv and move to next*/
 603                 skb_pull(skb, tlv->len + sizeof(*tlv));
 604         }
 605
 606         return 0;
 607 }
 608
 609 static int btintel_read_version_tlv(struct hci_dev *hdev,
 610                                     struct intel_version_tlv *version)
 611 {
 612         struct sk_buff *skb;
 613         const u8 param[1] = { 0xFF };
 614
 615         if (!version)
 616                 return -EINVAL;
 617
 618         skb = __hci_cmd_sync(hdev, 0xfc05, 1, param, HCI_CMD_TIMEOUT);
 619         if (IS_ERR(skb)) {
 620                 bt_dev_err(hdev, "Reading Intel version information failed (%ld)",
 621                            PTR_ERR(skb));
 622                 return PTR_ERR(skb);
 623         }
 624
 625         if (skb->data[0]) {
 626                 bt_dev_err(hdev, "Intel Read Version command failed (%02x)",
 627                            skb->data[0]);
 628                 kfree_skb(skb);
 629                 return -EIO;
 630         }
 631
 632         btintel_parse_version_tlv(hdev, version, skb);
 633
 634         kfree_skb(skb);
 635         return 0;
 636 }
 637
 638 /* ------- REGMAP IBT SUPPORT ------- */
 639
 640 #define IBT_REG_MODE_8BIT  0x00
 641 #define IBT_REG_MODE_16BIT 0x01
 642 #define IBT_REG_MODE_32BIT 0x02
 643
 644 struct regmap_ibt_context {
 645         struct hci_dev *hdev;
 646         __u16 op_write;
 647         __u16 op_read;
 648 };
 649
 650 struct ibt_cp_reg_access {
 651         __le32  addr;
 652         __u8    mode;
 653         __u8    len;
 654         __u8    data[];
 655 } __packed;
 656
 657 struct ibt_rp_reg_access {
 658         __u8    status;
 659         __le32  addr;
 660         __u8    data[];
 661 } __packed;
 662
 663 static int regmap_ibt_read(void *context, const void *addr, size_t reg_size,
 664                            void *val, size_t val_size)
 665 {
 666         struct regmap_ibt_context *ctx = context;
 667         struct ibt_cp_reg_access cp;
 668         struct ibt_rp_reg_access *rp;
 669         struct sk_buff *skb;
 670         int err = 0;
 671
 672         if (reg_size != sizeof(__le32))
 673                 return -EINVAL;
 674
 675         switch (val_size) {
 676         case 1:
 677                 cp.mode = IBT_REG_MODE_8BIT;
 678                 break;
 679         case 2:
 680                 cp.mode = IBT_REG_MODE_16BIT;
 681                 break;
 682         case 4:
 683                 cp.mode = IBT_REG_MODE_32BIT;
 684                 break;
 685         default:
 686                 return -EINVAL;
 687         }
 688
 689         /* regmap provides a little-endian formatted addr */
 690         cp.addr = *(__le32 *)addr;
 691         cp.len = val_size;
 692
 693         bt_dev_dbg(ctx->hdev, "Register (0x%x) read", le32_to_cpu(cp.addr));
 694
 695         skb = hci_cmd_sync(ctx->hdev, ctx->op_read, sizeof(cp), &cp,
 696                            HCI_CMD_TIMEOUT);
 697         if (IS_ERR(skb)) {
 698                 err = PTR_ERR(skb);
 699                 bt_dev_err(ctx->hdev, "regmap: Register (0x%x) read error (%d)",
 700                            le32_to_cpu(cp.addr), err);
 701                 return err;
 702         }
 703
 704         if (skb->len != sizeof(*rp) + val_size) {
 705                 bt_dev_err(ctx->hdev, "regmap: Register (0x%x) read error, bad len",
 706                            le32_to_cpu(cp.addr));
 707                 err = -EINVAL;
 708                 goto done;
 709         }
 710
 711         rp = (struct ibt_rp_reg_access *)skb->data;
 712
 713         if (rp->addr != cp.addr) {
 714                 bt_dev_err(ctx->hdev, "regmap: Register (0x%x) read error, bad addr",
 715                            le32_to_cpu(rp->addr));
 716                 err = -EINVAL;
 717                 goto done;
 718         }
 719
 720         memcpy(val, rp->data, val_size);
 721
 722 done:
 723         kfree_skb(skb);
 724         return err;
 725 }
 726
 727 static int regmap_ibt_gather_write(void *context,
 728                                    const void *addr, size_t reg_size,
 729                                    const void *val, size_t val_size)
 730 {
 731         struct regmap_ibt_context *ctx = context;
 732         struct ibt_cp_reg_access *cp;
 733         struct sk_buff *skb;
 734         int plen = sizeof(*cp) + val_size;
 735         u8 mode;
 736         int err = 0;
 737
 738         if (reg_size != sizeof(__le32))
 739                 return -EINVAL;
 740
 741         switch (val_size) {
 742         case 1:
 743                 mode = IBT_REG_MODE_8BIT;
 744                 break;
 745         case 2:
 746                 mode = IBT_REG_MODE_16BIT;
 747                 break;
 748         case 4:
 749                 mode = IBT_REG_MODE_32BIT;
 750                 break;
 751         default:
 752                 return -EINVAL;
 753         }
 754
 755         cp = kmalloc(plen, GFP_KERNEL);
 756         if (!cp)
 757                 return -ENOMEM;
 758
 759         /* regmap provides a little-endian formatted addr/value */
 760         cp->addr = *(__le32 *)addr;
 761         cp->mode = mode;
 762         cp->len = val_size;
 763         memcpy(&cp->data, val, val_size);
 764
 765         bt_dev_dbg(ctx->hdev, "Register (0x%x) write", le32_to_cpu(cp->addr));
 766
 767         skb = hci_cmd_sync(ctx->hdev, ctx->op_write, plen, cp, HCI_CMD_TIMEOUT);
 768         if (IS_ERR(skb)) {
 769                 err = PTR_ERR(skb);
 770                 bt_dev_err(ctx->hdev, "regmap: Register (0x%x) write error (%d)",
 771                            le32_to_cpu(cp->addr), err);
 772                 goto done;
 773         }
 774         kfree_skb(skb);
 775
 776 done:
 777         kfree(cp);
 778         return err;
 779 }
 780
 781 static int regmap_ibt_write(void *context, const void *data, size_t count)
 782 {
 783         /* data contains register+value, since we only support 32bit addr,
 784          * minimum data size is 4 bytes.
 785          */
 786         if (WARN_ONCE(count < 4, "Invalid register access"))
 787                 return -EINVAL;
 788
 789         return regmap_ibt_gather_write(context, data, 4, data + 4, count - 4);
 790 }
 791
 792 static void regmap_ibt_free_context(void *context)
 793 {
 794         kfree(context);
 795 }
 796
 797 static struct regmap_bus regmap_ibt = {
 798         .read = regmap_ibt_read,
 799         .write = regmap_ibt_write,
 800         .gather_write = regmap_ibt_gather_write,
 801         .free_context = regmap_ibt_free_context,
 802         .reg_format_endian_default = REGMAP_ENDIAN_LITTLE,
 803         .val_format_endian_default = REGMAP_ENDIAN_LITTLE,
 804 };
 805
 806 /* Config is the same for all register regions */
 807 static const struct regmap_config regmap_ibt_cfg = {
 808         .name      = "btintel_regmap",
 809         .reg_bits  = 32,
 810         .val_bits  = 32,
 811 };
 812
 813 struct regmap *btintel_regmap_init(struct hci_dev *hdev, u16 opcode_read,
 814                                    u16 opcode_write)
 815 {
 816         struct regmap_ibt_context *ctx;
 817
 818         bt_dev_info(hdev, "regmap: Init R%x-W%x region", opcode_read,
 819                     opcode_write);
 820
 821         ctx = kzalloc(sizeof(*ctx), GFP_KERNEL);
 822         if (!ctx)
 823                 return ERR_PTR(-ENOMEM);
 824
 825         ctx->op_read = opcode_read;
 826         ctx->op_write = opcode_write;
 827         ctx->hdev = hdev;
 828
 829         return regmap_init(&hdev->dev, &regmap_ibt, ctx, &regmap_ibt_cfg);
 830 }
 831 EXPORT_SYMBOL_GPL(btintel_regmap_init);
 832
 833 int btintel_send_intel_reset(struct hci_dev *hdev, u32 boot_param)
 834 {
 835         struct intel_reset params = { 0x00, 0x01, 0x00, 0x01, 0x00000000 };
 836         struct sk_buff *skb;
 837
 838         params.boot_param = cpu_to_le32(boot_param);
 839
 840         skb = __hci_cmd_sync(hdev, 0xfc01, sizeof(params), &params,
 841                              HCI_INIT_TIMEOUT);
 842         if (IS_ERR(skb)) {
 843                 bt_dev_err(hdev, "Failed to send Intel Reset command");
 844                 return PTR_ERR(skb);
 845         }
 846
 847         kfree_skb(skb);
 848
 849         return 0;
 850 }
 851 EXPORT_SYMBOL_GPL(btintel_send_intel_reset);
 852
 853 int btintel_read_boot_params(struct hci_dev *hdev,
 854                              struct intel_boot_params *params)
 855 {
 856         struct sk_buff *skb;
 857
 858         skb = __hci_cmd_sync(hdev, 0xfc0d, 0, NULL, HCI_INIT_TIMEOUT);
 859         if (IS_ERR(skb)) {
 860                 bt_dev_err(hdev, "Reading Intel boot parameters failed (%ld)",
 861                            PTR_ERR(skb));
 862                 return PTR_ERR(skb);
 863         }
 864
 865         if (skb->len != sizeof(*params)) {
 866                 bt_dev_err(hdev, "Intel boot parameters size mismatch");
 867                 kfree_skb(skb);
 868                 return -EILSEQ;
 869         }
 870
 871         memcpy(params, skb->data, sizeof(*params));
 872
 873         kfree_skb(skb);
 874
 875         if (params->status) {
 876                 bt_dev_err(hdev, "Intel boot parameters command failed (%02x)",
 877                            params->status);
 878                 return -bt_to_errno(params->status);
 879         }
 880
 881         bt_dev_info(hdev, "Device revision is %u",
 882                     le16_to_cpu(params->dev_revid));
 883
 884         bt_dev_info(hdev, "Secure boot is %s",
 885                     params->secure_boot ? "enabled" : "disabled");
 886
 887         bt_dev_info(hdev, "OTP lock is %s",
 888                     params->otp_lock ? "enabled" : "disabled");
 889
 890         bt_dev_info(hdev, "API lock is %s",
 891                     params->api_lock ? "enabled" : "disabled");
 892
 893         bt_dev_info(hdev, "Debug lock is %s",
 894                     params->debug_lock ? "enabled" : "disabled");
 895
 896         bt_dev_info(hdev, "Minimum firmware build %u week %u %u",
 897                     params->min_fw_build_nn, params->min_fw_build_cw,
 898                     2000 + params->min_fw_build_yy);
 899
 900         return 0;
 901 }
 902 EXPORT_SYMBOL_GPL(btintel_read_boot_params);
 903
 904 static int btintel_sfi_rsa_header_secure_send(struct hci_dev *hdev,
 905                                               const struct firmware *fw)
 906 {
 907         int err;
 908
 909         /* Start the firmware download transaction with the Init fragment
 910          * represented by the 128 bytes of CSS header.
 911          */
 912         err = btintel_secure_send(hdev, 0x00, 128, fw->data);
 913         if (err < 0) {
 914                 bt_dev_err(hdev, "Failed to send firmware header (%d)", err);
 915                 goto done;
 916         }
 917
 918         /* Send the 256 bytes of public key information from the firmware
 919          * as the PKey fragment.
 920          */
 921         err = btintel_secure_send(hdev, 0x03, 256, fw->data + 128);
 922         if (err < 0) {
 923                 bt_dev_err(hdev, "Failed to send firmware pkey (%d)", err);
 924                 goto done;
 925         }
 926
 927         /* Send the 256 bytes of signature information from the firmware
 928          * as the Sign fragment.
 929          */
 930         err = btintel_secure_send(hdev, 0x02, 256, fw->data + 388);
 931         if (err < 0) {
 932                 bt_dev_err(hdev, "Failed to send firmware signature (%d)", err);
 933                 goto done;
 934         }
 935
 936 done:
 937         return err;
 938 }
 939
 940 static int btintel_sfi_ecdsa_header_secure_send(struct hci_dev *hdev,
 941                                                 const struct firmware *fw)
 942 {
 943         int err;
 944
 945         /* Start the firmware download transaction with the Init fragment
 946          * represented by the 128 bytes of CSS header.
 947          */
 948         err = btintel_secure_send(hdev, 0x00, 128, fw->data + 644);
 949         if (err < 0) {
 950                 bt_dev_err(hdev, "Failed to send firmware header (%d)", err);
 951                 return err;
 952         }
 953
 954         /* Send the 96 bytes of public key information from the firmware
 955          * as the PKey fragment.
 956          */
 957         err = btintel_secure_send(hdev, 0x03, 96, fw->data + 644 + 128);
 958         if (err < 0) {
 959                 bt_dev_err(hdev, "Failed to send firmware pkey (%d)", err);
 960                 return err;
 961         }
 962
 963         /* Send the 96 bytes of signature information from the firmware
 964          * as the Sign fragment
 965          */
 966         err = btintel_secure_send(hdev, 0x02, 96, fw->data + 644 + 224);
 967         if (err < 0) {
 968                 bt_dev_err(hdev, "Failed to send firmware signature (%d)",
 969                            err);
 970                 return err;
 971         }
 972         return 0;
 973 }
 974
 975 static int btintel_download_firmware_payload(struct hci_dev *hdev,
 976                                              const struct firmware *fw,
 977                                              size_t offset)
 978 {
 979         int err;
 980         const u8 *fw_ptr;
 981         u32 frag_len;
 982
 983         fw_ptr = fw->data + offset;
 984         frag_len = 0;
 985         err = -EINVAL;
 986
 987         while (fw_ptr - fw->data < fw->size) {
 988                 struct hci_command_hdr *cmd = (void *)(fw_ptr + frag_len);
 989
 990                 frag_len += sizeof(*cmd) + cmd->plen;
 991
 992                 /* The parameter length of the secure send command requires
 993                  * a 4 byte alignment. It happens so that the firmware file
 994                  * contains proper Intel_NOP commands to align the fragments
 995                  * as needed.
 996                  *
 997                  * Send set of commands with 4 byte alignment from the
 998                  * firmware data buffer as a single Data fragement.
 999                  */
1000                 if (!(frag_len % 4)) {
1001                         err = btintel_secure_send(hdev, 0x01, frag_len, fw_ptr);
1002                         if (err < 0) {
1003                                 bt_dev_err(hdev,
1004                                            "Failed to send firmware data (%d)",
1005                                            err);
1006                                 goto done;
1007                         }
1008
1009                         fw_ptr += frag_len;
1010                         frag_len = 0;
1011                 }
1012         }
1013
1014 done:
1015         return err;
1016 }
1017
1018 static bool btintel_firmware_version(struct hci_dev *hdev,
1019                                      u8 num, u8 ww, u8 yy,
1020                                      const struct firmware *fw,
1021                                      u32 *boot_addr)
1022 {
1023         const u8 *fw_ptr;
1024
1025         fw_ptr = fw->data;
1026
1027         while (fw_ptr - fw->data < fw->size) {
1028                 struct hci_command_hdr *cmd = (void *)(fw_ptr);
1029
1030                 /* Each SKU has a different reset parameter to use in the
1031                  * HCI_Intel_Reset command and it is embedded in the firmware
1032                  * data. So, instead of using static value per SKU, check
1033                  * the firmware data and save it for later use.
1034                  */
1035                 if (le16_to_cpu(cmd->opcode) == CMD_WRITE_BOOT_PARAMS) {
1036                         struct cmd_write_boot_params *params;
1037
1038                         params = (void *)(fw_ptr + sizeof(*cmd));
1039
1040                         *boot_addr = le32_to_cpu(params->boot_addr);
1041
1042                         bt_dev_info(hdev, "Boot Address: 0x%x", *boot_addr);
1043
1044                         bt_dev_info(hdev, "Firmware Version: %u-%u.%u",
1045                                     params->fw_build_num, params->fw_build_ww,
1046                                     params->fw_build_yy);
1047
1048                         return (num == params->fw_build_num &&
1049                                 ww == params->fw_build_ww &&
1050                                 yy == params->fw_build_yy);
1051                 }
1052
1053                 fw_ptr += sizeof(*cmd) + cmd->plen;
1054         }
1055
1056         return false;
1057 }
1058
1059 int btintel_download_firmware(struct hci_dev *hdev,
1060                               struct intel_version *ver,
1061                               const struct firmware *fw,
1062                               u32 *boot_param)
1063 {
1064         int err;
1065
1066         /* SfP and WsP don't seem to update the firmware version on file
1067          * so version checking is currently not possible.
1068          */
1069         switch (ver->hw_variant) {
1070         case 0x0b:      /* SfP */
1071         case 0x0c:      /* WsP */
1072                 /* Skip version checking */
1073                 break;
1074         default:
1075
1076                 /* Skip download if firmware has the same version */
1077                 if (btintel_firmware_version(hdev, ver->fw_build_num,
1078                                              ver->fw_build_ww, ver->fw_build_yy,
1079                                              fw, boot_param)) {
1080                         bt_dev_info(hdev, "Firmware already loaded");
1081                         /* Return -EALREADY to indicate that the firmware has
1082                          * already been loaded.
1083                          */
1084                         return -EALREADY;
1085                 }
1086         }
1087
1088         /* The firmware variant determines if the device is in bootloader
1089          * mode or is running operational firmware. The value 0x06 identifies
1090          * the bootloader and the value 0x23 identifies the operational
1091          * firmware.
1092          *
1093          * If the firmware version has changed that means it needs to be reset
1094          * to bootloader when operational so the new firmware can be loaded.
1095          */
1096         if (ver->fw_variant == 0x23)
1097                 return -EINVAL;
1098
1099         err = btintel_sfi_rsa_header_secure_send(hdev, fw);
1100         if (err)
1101                 return err;
1102
1103         return btintel_download_firmware_payload(hdev, fw, RSA_HEADER_LEN);
1104 }
1105 EXPORT_SYMBOL_GPL(btintel_download_firmware);
1106
1107 static int btintel_download_fw_tlv(struct hci_dev *hdev,
1108                                    struct intel_version_tlv *ver,
1109                                    const struct firmware *fw, u32 *boot_param,
1110                                    u8 hw_variant, u8 sbe_type)
1111 {
1112         int err;
1113         u32 css_header_ver;
1114
1115         /* Skip download if firmware has the same version */
1116         if (btintel_firmware_version(hdev, ver->min_fw_build_nn,
1117                                      ver->min_fw_build_cw,
1118                                      ver->min_fw_build_yy,
1119                                      fw, boot_param)) {
1120                 bt_dev_info(hdev, "Firmware already loaded");
1121                 /* Return -EALREADY to indicate that firmware has
1122                  * already been loaded.
1123                  */
1124                 return -EALREADY;
1125         }
1126
1127         /* The firmware variant determines if the device is in bootloader
1128          * mode or is running operational firmware. The value 0x01 identifies
1129          * the bootloader and the value 0x03 identifies the operational
1130          * firmware.
1131          *
1132          * If the firmware version has changed that means it needs to be reset
1133          * to bootloader when operational so the new firmware can be loaded.
1134          */
1135         if (ver->img_type == 0x03)
1136                 return -EINVAL;
1137
1138         /* iBT hardware variants 0x0b, 0x0c, 0x11, 0x12, 0x13, 0x14 support
1139          * only RSA secure boot engine. Hence, the corresponding sfi file will
1140          * have RSA header of 644 bytes followed by Command Buffer.
1141          *
1142          * iBT hardware variants 0x17, 0x18 onwards support both RSA and ECDSA
1143          * secure boot engine. As a result, the corresponding sfi file will
1144          * have RSA header of 644, ECDSA header of 320 bytes followed by
1145          * Command Buffer.
1146          *
1147          * CSS Header byte positions 0x08 to 0x0B represent the CSS Header
1148          * version: RSA(0x00010000) , ECDSA (0x00020000)
1149          */
1150         css_header_ver = get_unaligned_le32(fw->data + CSS_HEADER_OFFSET);
1151         if (css_header_ver != 0x00010000) {
1152                 bt_dev_err(hdev, "Invalid CSS Header version");
1153                 return -EINVAL;
1154         }
1155
1156         if (hw_variant <= 0x14) {
1157                 if (sbe_type != 0x00) {
1158                         bt_dev_err(hdev, "Invalid SBE type for hardware variant (%d)",
1159                                    hw_variant);
1160                         return -EINVAL;
1161                 }
1162
1163                 err = btintel_sfi_rsa_header_secure_send(hdev, fw);
1164                 if (err)
1165                         return err;
1166
1167                 err = btintel_download_firmware_payload(hdev, fw, RSA_HEADER_LEN);
1168                 if (err)
1169                         return err;
1170         } else if (hw_variant >= 0x17) {
1171                 /* Check if CSS header for ECDSA follows the RSA header */
1172                 if (fw->data[ECDSA_OFFSET] != 0x06)
1173                         return -EINVAL;
1174
1175                 /* Check if the CSS Header version is ECDSA(0x00020000) */
1176                 css_header_ver = get_unaligned_le32(fw->data + ECDSA_OFFSET + CSS_HEADER_OFFSET);
1177                 if (css_header_ver != 0x00020000) {
1178                         bt_dev_err(hdev, "Invalid CSS Header version");
1179                         return -EINVAL;
1180                 }
1181
1182                 if (sbe_type == 0x00) {
1183                         err = btintel_sfi_rsa_header_secure_send(hdev, fw);
1184                         if (err)
1185                                 return err;
1186
1187                         err = btintel_download_firmware_payload(hdev, fw,
1188                                                                 RSA_HEADER_LEN + ECDSA_HEADER_LEN);
1189                         if (err)
1190                                 return err;
1191                 } else if (sbe_type == 0x01) {
1192                         err = btintel_sfi_ecdsa_header_secure_send(hdev, fw);
1193                         if (err)
1194                                 return err;
1195
1196                         err = btintel_download_firmware_payload(hdev, fw,
1197                                                                 RSA_HEADER_LEN + ECDSA_HEADER_LEN);
1198                         if (err)
1199                                 return err;
1200                 }
1201         }
1202         return 0;
1203 }
1204
1205 static void btintel_reset_to_bootloader(struct hci_dev *hdev)
1206 {
1207         struct intel_reset params;
1208         struct sk_buff *skb;
1209
1210         /* Send Intel Reset command. This will result in
1211          * re-enumeration of BT controller.
1212          *
1213          * Intel Reset parameter description:
1214          * reset_type :   0x00 (Soft reset),
1215          *                0x01 (Hard reset)
1216          * patch_enable : 0x00 (Do not enable),
1217          *                0x01 (Enable)
1218          * ddc_reload :   0x00 (Do not reload),
1219          *                0x01 (Reload)
1220          * boot_option:   0x00 (Current image),
1221          *                0x01 (Specified boot address)
1222          * boot_param:    Boot address
1223          *
1224          */
1225         params.reset_type = 0x01;
1226         params.patch_enable = 0x01;
1227         params.ddc_reload = 0x01;
1228         params.boot_option = 0x00;
1229         params.boot_param = cpu_to_le32(0x00000000);
1230
1231         skb = __hci_cmd_sync(hdev, 0xfc01, sizeof(params),
1232                              &params, HCI_INIT_TIMEOUT);
1233         if (IS_ERR(skb)) {
1234                 bt_dev_err(hdev, "FW download error recovery failed (%ld)",
1235                            PTR_ERR(skb));
1236                 return;
1237         }
1238         bt_dev_info(hdev, "Intel reset sent to retry FW download");
1239         kfree_skb(skb);
1240
1241         /* Current Intel BT controllers(ThP/JfP) hold the USB reset
1242          * lines for 2ms when it receives Intel Reset in bootloader mode.
1243          * Whereas, the upcoming Intel BT controllers will hold USB reset
1244          * for 150ms. To keep the delay generic, 150ms is chosen here.
1245          */
1246         msleep(150);
1247 }
1248
1249 static int btintel_read_debug_features(struct hci_dev *hdev,
1250                                        struct intel_debug_features *features)
1251 {
1252         struct sk_buff *skb;
1253         u8 page_no = 1;
1254
1255         /* Intel controller supports two pages, each page is of 128-bit
1256          * feature bit mask. And each bit defines specific feature support
1257          */
1258         skb = __hci_cmd_sync(hdev, 0xfca6, sizeof(page_no), &page_no,
1259                              HCI_INIT_TIMEOUT);
1260         if (IS_ERR(skb)) {
1261                 bt_dev_err(hdev, "Reading supported features failed (%ld)",
1262                            PTR_ERR(skb));
1263                 return PTR_ERR(skb);
1264         }
1265
1266         if (skb->len != (sizeof(features->page1) + 3)) {
1267                 bt_dev_err(hdev, "Supported features event size mismatch");
1268                 kfree_skb(skb);
1269                 return -EILSEQ;
1270         }
1271
1272         memcpy(features->page1, skb->data + 3, sizeof(features->page1));
1273
1274         /* Read the supported features page2 if required in future.
1275          */
1276         kfree_skb(skb);
1277         return 0;
1278 }
1279
1280 static int btintel_set_debug_features(struct hci_dev *hdev,
1281                                const struct intel_debug_features *features)
1282 {
1283         u8 mask[11] = { 0x0a, 0x92, 0x02, 0x7f, 0x00, 0x00, 0x00, 0x00,
1284                         0x00, 0x00, 0x00 };
1285         u8 period[5] = { 0x04, 0x91, 0x02, 0x05, 0x00 };
1286         u8 trace_enable = 0x02;
1287         struct sk_buff *skb;
1288
1289         if (!features) {
1290                 bt_dev_warn(hdev, "Debug features not read");
1291                 return -EINVAL;
1292         }
1293
1294         if (!(features->page1[0] & 0x3f)) {
1295                 bt_dev_info(hdev, "Telemetry exception format not supported");
1296                 return 0;
1297         }
1298
1299         skb = __hci_cmd_sync(hdev, 0xfc8b, 11, mask, HCI_INIT_TIMEOUT);
1300         if (IS_ERR(skb)) {
1301                 bt_dev_err(hdev, "Setting Intel telemetry ddc write event mask failed (%ld)",
1302                            PTR_ERR(skb));
1303                 return PTR_ERR(skb);
1304         }
1305         kfree_skb(skb);
1306
1307         skb = __hci_cmd_sync(hdev, 0xfc8b, 5, period, HCI_INIT_TIMEOUT);
1308         if (IS_ERR(skb)) {
1309                 bt_dev_err(hdev, "Setting periodicity for link statistics traces failed (%ld)",
1310                            PTR_ERR(skb));
1311                 return PTR_ERR(skb);
1312         }
1313         kfree_skb(skb);
1314
1315         skb = __hci_cmd_sync(hdev, 0xfca1, 1, &trace_enable, HCI_INIT_TIMEOUT);
1316         if (IS_ERR(skb)) {
1317                 bt_dev_err(hdev, "Enable tracing of link statistics events failed (%ld)",
1318                            PTR_ERR(skb));
1319                 return PTR_ERR(skb);
1320         }
1321         kfree_skb(skb);
1322
1323         bt_dev_info(hdev, "set debug features: trace_enable 0x%02x mask 0x%02x",
1324                     trace_enable, mask[3]);
1325
1326         return 0;
1327 }
1328
1329 static int btintel_reset_debug_features(struct hci_dev *hdev,
1330                                  const struct intel_debug_features *features)
1331 {
1332         u8 mask[11] = { 0x0a, 0x92, 0x02, 0x00, 0x00, 0x00, 0x00, 0x00,
1333                         0x00, 0x00, 0x00 };
1334         u8 trace_enable = 0x00;
1335         struct sk_buff *skb;
1336
1337         if (!features) {
1338                 bt_dev_warn(hdev, "Debug features not read");
1339                 return -EINVAL;
1340         }
1341
1342         if (!(features->page1[0] & 0x3f)) {
1343                 bt_dev_info(hdev, "Telemetry exception format not supported");
1344                 return 0;
1345         }
1346
1347         /* Should stop the trace before writing ddc event mask. */
1348         skb = __hci_cmd_sync(hdev, 0xfca1, 1, &trace_enable, HCI_INIT_TIMEOUT);
1349         if (IS_ERR(skb)) {
1350                 bt_dev_err(hdev, "Stop tracing of link statistics events failed (%ld)",
1351                            PTR_ERR(skb));
1352                 return PTR_ERR(skb);
1353         }
1354         kfree_skb(skb);
1355
1356         skb = __hci_cmd_sync(hdev, 0xfc8b, 11, mask, HCI_INIT_TIMEOUT);
1357         if (IS_ERR(skb)) {
1358                 bt_dev_err(hdev, "Setting Intel telemetry ddc write event mask failed (%ld)",
1359                            PTR_ERR(skb));
1360                 return PTR_ERR(skb);
1361         }
1362         kfree_skb(skb);
1363
1364         bt_dev_info(hdev, "reset debug features: trace_enable 0x%02x mask 0x%02x",
1365                     trace_enable, mask[3]);
1366
1367         return 0;
1368 }
1369
1370 int btintel_set_quality_report(struct hci_dev *hdev, bool enable)
1371 {
1372         struct intel_debug_features features;
1373         int err;
1374
1375         bt_dev_dbg(hdev, "enable %d", enable);
1376
1377         /* Read the Intel supported features and if new exception formats
1378          * supported, need to load the additional DDC config to enable.
1379          */
1380         err = btintel_read_debug_features(hdev, &features);
1381         if (err)
1382                 return err;
1383
1384         /* Set or reset the debug features. */
1385         if (enable)
1386                 err = btintel_set_debug_features(hdev, &features);
1387         else
1388                 err = btintel_reset_debug_features(hdev, &features);
1389
1390         return err;
1391 }
1392 EXPORT_SYMBOL_GPL(btintel_set_quality_report);
1393
1394 static const struct firmware *btintel_legacy_rom_get_fw(struct hci_dev *hdev,
1395                                                struct intel_version *ver)
1396 {
1397         const struct firmware *fw;
1398         char fwname[64];
1399         int ret;
1400
1401         snprintf(fwname, sizeof(fwname),
1402                  "intel/ibt-hw-%x.%x.%x-fw-%x.%x.%x.%x.%x.bseq",
1403                  ver->hw_platform, ver->hw_variant, ver->hw_revision,
1404                  ver->fw_variant,  ver->fw_revision, ver->fw_build_num,
1405                  ver->fw_build_ww, ver->fw_build_yy);
1406
1407         ret = request_firmware(&fw, fwname, &hdev->dev);
1408         if (ret < 0) {
1409                 if (ret == -EINVAL) {
1410                         bt_dev_err(hdev, "Intel firmware file request failed (%d)",
1411                                    ret);
1412                         return NULL;
1413                 }
1414
1415                 bt_dev_err(hdev, "failed to open Intel firmware file: %s (%d)",
1416                            fwname, ret);
1417
1418                 /* If the correct firmware patch file is not found, use the
1419                  * default firmware patch file instead
1420                  */
1421                 snprintf(fwname, sizeof(fwname), "intel/ibt-hw-%x.%x.bseq",
1422                          ver->hw_platform, ver->hw_variant);
1423                 if (request_firmware(&fw, fwname, &hdev->dev) < 0) {
1424                         bt_dev_err(hdev, "failed to open default fw file: %s",
1425                                    fwname);
1426                         return NULL;
1427                 }
1428         }
1429
1430         bt_dev_info(hdev, "Intel Bluetooth firmware file: %s", fwname);
1431
1432         return fw;
1433 }
1434
1435 static int btintel_legacy_rom_patching(struct hci_dev *hdev,
1436                                       const struct firmware *fw,
1437                                       const u8 **fw_ptr, int *disable_patch)
1438 {
1439         struct sk_buff *skb;
1440         struct hci_command_hdr *cmd;
1441         const u8 *cmd_param;
1442         struct hci_event_hdr *evt = NULL;
1443         const u8 *evt_param = NULL;
1444         int remain = fw->size - (*fw_ptr - fw->data);
1445
1446         /* The first byte indicates the types of the patch command or event.
1447          * 0x01 means HCI command and 0x02 is HCI event. If the first bytes
1448          * in the current firmware buffer doesn't start with 0x01 or
1449          * the size of remain buffer is smaller than HCI command header,
1450          * the firmware file is corrupted and it should stop the patching
1451          * process.
1452          */
1453         if (remain > HCI_COMMAND_HDR_SIZE && *fw_ptr[0] != 0x01) {
1454                 bt_dev_err(hdev, "Intel fw corrupted: invalid cmd read");
1455                 return -EINVAL;
1456         }
1457         (*fw_ptr)++;
1458         remain--;
1459
1460         cmd = (struct hci_command_hdr *)(*fw_ptr);
1461         *fw_ptr += sizeof(*cmd);
1462         remain -= sizeof(*cmd);
1463
1464         /* Ensure that the remain firmware data is long enough than the length
1465          * of command parameter. If not, the firmware file is corrupted.
1466          */
1467         if (remain < cmd->plen) {
1468                 bt_dev_err(hdev, "Intel fw corrupted: invalid cmd len");
1469                 return -EFAULT;
1470         }
1471
1472         /* If there is a command that loads a patch in the firmware
1473          * file, then enable the patch upon success, otherwise just
1474          * disable the manufacturer mode, for example patch activation
1475          * is not required when the default firmware patch file is used
1476          * because there are no patch data to load.
1477          */
1478         if (*disable_patch && le16_to_cpu(cmd->opcode) == 0xfc8e)
1479                 *disable_patch = 0;
1480
1481         cmd_param = *fw_ptr;
1482         *fw_ptr += cmd->plen;
1483         remain -= cmd->plen;
1484
1485         /* This reads the expected events when the above command is sent to the
1486          * device. Some vendor commands expects more than one events, for
1487          * example command status event followed by vendor specific event.
1488          * For this case, it only keeps the last expected event. so the command
1489          * can be sent with __hci_cmd_sync_ev() which returns the sk_buff of
1490          * last expected event.
1491          */
1492         while (remain > HCI_EVENT_HDR_SIZE && *fw_ptr[0] == 0x02) {
1493                 (*fw_ptr)++;
1494                 remain--;
1495
1496                 evt = (struct hci_event_hdr *)(*fw_ptr);
1497                 *fw_ptr += sizeof(*evt);
1498                 remain -= sizeof(*evt);
1499
1500                 if (remain < evt->plen) {
1501                         bt_dev_err(hdev, "Intel fw corrupted: invalid evt len");
1502                         return -EFAULT;
1503                 }
1504
1505                 evt_param = *fw_ptr;
1506                 *fw_ptr += evt->plen;
1507                 remain -= evt->plen;
1508         }
1509
1510         /* Every HCI commands in the firmware file has its correspond event.
1511          * If event is not found or remain is smaller than zero, the firmware
1512          * file is corrupted.
1513          */
1514         if (!evt || !evt_param || remain < 0) {
1515                 bt_dev_err(hdev, "Intel fw corrupted: invalid evt read");
1516                 return -EFAULT;
1517         }
1518
1519         skb = __hci_cmd_sync_ev(hdev, le16_to_cpu(cmd->opcode), cmd->plen,
1520                                 cmd_param, evt->evt, HCI_INIT_TIMEOUT);
1521         if (IS_ERR(skb)) {
1522                 bt_dev_err(hdev, "sending Intel patch command (0x%4.4x) failed (%ld)",
1523                            cmd->opcode, PTR_ERR(skb));
1524                 return PTR_ERR(skb);
1525         }
1526
1527         /* It ensures that the returned event matches the event data read from
1528          * the firmware file. At fist, it checks the length and then
1529          * the contents of the event.
1530          */
1531         if (skb->len != evt->plen) {
1532                 bt_dev_err(hdev, "mismatch event length (opcode 0x%4.4x)",
1533                            le16_to_cpu(cmd->opcode));
1534                 kfree_skb(skb);
1535                 return -EFAULT;
1536         }
1537
1538         if (memcmp(skb->data, evt_param, evt->plen)) {
1539                 bt_dev_err(hdev, "mismatch event parameter (opcode 0x%4.4x)",
1540                            le16_to_cpu(cmd->opcode));
1541                 kfree_skb(skb);
1542                 return -EFAULT;
1543         }
1544         kfree_skb(skb);
1545
1546         return 0;
1547 }
1548
1549 static int btintel_legacy_rom_setup(struct hci_dev *hdev,
1550                                     struct intel_version *ver)
1551 {
1552         const struct firmware *fw;
1553         const u8 *fw_ptr;
1554         int disable_patch, err;
1555         struct intel_version new_ver;
1556
1557         BT_DBG("%s", hdev->name);
1558
1559         /* fw_patch_num indicates the version of patch the device currently
1560          * have. If there is no patch data in the device, it is always 0x00.
1561          * So, if it is other than 0x00, no need to patch the device again.
1562          */
1563         if (ver->fw_patch_num) {
1564                 bt_dev_info(hdev,
1565                             "Intel device is already patched. patch num: %02x",
1566                             ver->fw_patch_num);
1567                 goto complete;
1568         }
1569
1570         /* Opens the firmware patch file based on the firmware version read
1571          * from the controller. If it fails to open the matching firmware
1572          * patch file, it tries to open the default firmware patch file.
1573          * If no patch file is found, allow the device to operate without
1574          * a patch.
1575          */
1576         fw = btintel_legacy_rom_get_fw(hdev, ver);
1577         if (!fw)
1578                 goto complete;
1579         fw_ptr = fw->data;
1580
1581         /* Enable the manufacturer mode of the controller.
1582          * Only while this mode is enabled, the driver can download the
1583          * firmware patch data and configuration parameters.
1584          */
1585         err = btintel_enter_mfg(hdev);
1586         if (err) {
1587                 release_firmware(fw);
1588                 return err;
1589         }
1590
1591         disable_patch = 1;
1592
1593         /* The firmware data file consists of list of Intel specific HCI
1594          * commands and its expected events. The first byte indicates the
1595          * type of the message, either HCI command or HCI event.
1596          *
1597          * It reads the command and its expected event from the firmware file,
1598          * and send to the controller. Once __hci_cmd_sync_ev() returns,
1599          * the returned event is compared with the event read from the firmware
1600          * file and it will continue until all the messages are downloaded to
1601          * the controller.
1602          *
1603          * Once the firmware patching is completed successfully,
1604          * the manufacturer mode is disabled with reset and activating the
1605          * downloaded patch.
1606          *
1607          * If the firmware patching fails, the manufacturer mode is
1608          * disabled with reset and deactivating the patch.
1609          *
1610          * If the default patch file is used, no reset is done when disabling
1611          * the manufacturer.
1612          */
1613         while (fw->size > fw_ptr - fw->data) {
1614                 int ret;
1615
1616                 ret = btintel_legacy_rom_patching(hdev, fw, &fw_ptr,
1617                                                  &disable_patch);
1618                 if (ret < 0)
1619                         goto exit_mfg_deactivate;
1620         }
1621
1622         release_firmware(fw);
1623
1624         if (disable_patch)
1625                 goto exit_mfg_disable;
1626
1627         /* Patching completed successfully and disable the manufacturer mode
1628          * with reset and activate the downloaded firmware patches.
1629          */
1630         err = btintel_exit_mfg(hdev, true, true);
1631         if (err)
1632                 return err;
1633
1634         /* Need build number for downloaded fw patches in
1635          * every power-on boot
1636          */
1637         err = btintel_read_version(hdev, &new_ver);
1638         if (err)
1639                 return err;
1640
1641         bt_dev_info(hdev, "Intel BT fw patch 0x%02x completed & activated",
1642                     new_ver.fw_patch_num);
1643
1644         goto complete;
1645
1646 exit_mfg_disable:
1647         /* Disable the manufacturer mode without reset */
1648         err = btintel_exit_mfg(hdev, false, false);
1649         if (err)
1650                 return err;
1651
1652         bt_dev_info(hdev, "Intel firmware patch completed");
1653
1654         goto complete;
1655
1656 exit_mfg_deactivate:
1657         release_firmware(fw);
1658
1659         /* Patching failed. Disable the manufacturer mode with reset and
1660          * deactivate the downloaded firmware patches.
1661          */
1662         err = btintel_exit_mfg(hdev, true, false);
1663         if (err)
1664                 return err;
1665
1666         bt_dev_info(hdev, "Intel firmware patch completed and deactivated");
1667
1668 complete:
1669         /* Set the event mask for Intel specific vendor events. This enables
1670          * a few extra events that are useful during general operation.
1671          */
1672         btintel_set_event_mask_mfg(hdev, false);
1673
1674         btintel_check_bdaddr(hdev);
1675
1676         return 0;
1677 }
1678
1679 static int btintel_download_wait(struct hci_dev *hdev, ktime_t calltime, int msec)
1680 {
1681         ktime_t delta, rettime;
1682         unsigned long long duration;
1683         int err;
1684
1685         btintel_set_flag(hdev, INTEL_FIRMWARE_LOADED);
1686
1687         bt_dev_info(hdev, "Waiting for firmware download to complete");
1688
1689         err = btintel_wait_on_flag_timeout(hdev, INTEL_DOWNLOADING,
1690                                            TASK_INTERRUPTIBLE,
1691                                            msecs_to_jiffies(msec));
1692         if (err == -EINTR) {
1693                 bt_dev_err(hdev, "Firmware loading interrupted");
1694                 return err;
1695         }
1696
1697         if (err) {
1698                 bt_dev_err(hdev, "Firmware loading timeout");
1699                 return -ETIMEDOUT;
1700         }
1701
1702         if (btintel_test_flag(hdev, INTEL_FIRMWARE_FAILED)) {
1703                 bt_dev_err(hdev, "Firmware loading failed");
1704                 return -ENOEXEC;
1705         }
1706
1707         rettime = ktime_get();
1708         delta = ktime_sub(rettime, calltime);
1709         duration = (unsigned long long)ktime_to_ns(delta) >> 10;
1710
1711         bt_dev_info(hdev, "Firmware loaded in %llu usecs", duration);
1712
1713         return 0;
1714 }
1715
1716 static int btintel_boot_wait(struct hci_dev *hdev, ktime_t calltime, int msec)
1717 {
1718         ktime_t delta, rettime;
1719         unsigned long long duration;
1720         int err;
1721
1722         bt_dev_info(hdev, "Waiting for device to boot");
1723
1724         err = btintel_wait_on_flag_timeout(hdev, INTEL_BOOTING,
1725                                            TASK_INTERRUPTIBLE,
1726                                            msecs_to_jiffies(msec));
1727         if (err == -EINTR) {
1728                 bt_dev_err(hdev, "Device boot interrupted");
1729                 return -EINTR;
1730         }
1731
1732         if (err) {
1733                 bt_dev_err(hdev, "Device boot timeout");
1734                 return -ETIMEDOUT;
1735         }
1736
1737         rettime = ktime_get();
1738         delta = ktime_sub(rettime, calltime);
1739         duration = (unsigned long long) ktime_to_ns(delta) >> 10;
1740
1741         bt_dev_info(hdev, "Device booted in %llu usecs", duration);
1742
1743         return 0;
1744 }
1745
1746 static int btintel_boot(struct hci_dev *hdev, u32 boot_addr)
1747 {
1748         ktime_t calltime;
1749         int err;
1750
1751         calltime = ktime_get();
1752
1753         btintel_set_flag(hdev, INTEL_BOOTING);
1754
1755         err = btintel_send_intel_reset(hdev, boot_addr);
1756         if (err) {
1757                 bt_dev_err(hdev, "Intel Soft Reset failed (%d)", err);
1758                 btintel_reset_to_bootloader(hdev);
1759                 return err;
1760         }
1761
1762         /* The bootloader will not indicate when the device is ready. This
1763          * is done by the operational firmware sending bootup notification.
1764          *
1765          * Booting into operational firmware should not take longer than
1766          * 1 second. However if that happens, then just fail the setup
1767          * since something went wrong.
1768          */
1769         err = btintel_boot_wait(hdev, calltime, 1000);
1770         if (err == -ETIMEDOUT)
1771                 btintel_reset_to_bootloader(hdev);
1772
1773         return err;
1774 }
1775
1776 static int btintel_get_fw_name(struct intel_version *ver,
1777                                              struct intel_boot_params *params,
1778                                              char *fw_name, size_t len,
1779                                              const char *suffix)
1780 {
1781         switch (ver->hw_variant) {
1782         case 0x0b:      /* SfP */
1783         case 0x0c:      /* WsP */
1784                 snprintf(fw_name, len, "intel/ibt-%u-%u.%s",
1785                         le16_to_cpu(ver->hw_variant),
1786                         le16_to_cpu(params->dev_revid),
1787                         suffix);
1788                 break;
1789         case 0x11:      /* JfP */
1790         case 0x12:      /* ThP */
1791         case 0x13:      /* HrP */
1792         case 0x14:      /* CcP */
1793                 snprintf(fw_name, len, "intel/ibt-%u-%u-%u.%s",
1794                         le16_to_cpu(ver->hw_variant),
1795                         le16_to_cpu(ver->hw_revision),
1796                         le16_to_cpu(ver->fw_revision),
1797                         suffix);
1798                 break;
1799         default:
1800                 return -EINVAL;
1801         }
1802
1803         return 0;
1804 }
1805
1806 static int btintel_download_fw(struct hci_dev *hdev,
1807                                          struct intel_version *ver,
1808                                          struct intel_boot_params *params,
1809                                          u32 *boot_param)
1810 {
1811         const struct firmware *fw;
1812         char fwname[64];
1813         int err;
1814         ktime_t calltime;
1815
1816         if (!ver || !params)
1817                 return -EINVAL;
1818
1819         /* The firmware variant determines if the device is in bootloader
1820          * mode or is running operational firmware. The value 0x06 identifies
1821          * the bootloader and the value 0x23 identifies the operational
1822          * firmware.
1823          *
1824          * When the operational firmware is already present, then only
1825          * the check for valid Bluetooth device address is needed. This
1826          * determines if the device will be added as configured or
1827          * unconfigured controller.
1828          *
1829          * It is not possible to use the Secure Boot Parameters in this
1830          * case since that command is only available in bootloader mode.
1831          */
1832         if (ver->fw_variant == 0x23) {
1833                 btintel_clear_flag(hdev, INTEL_BOOTLOADER);
1834                 btintel_check_bdaddr(hdev);
1835
1836                 /* SfP and WsP don't seem to update the firmware version on file
1837                  * so version checking is currently possible.
1838                  */
1839                 switch (ver->hw_variant) {
1840                 case 0x0b:      /* SfP */
1841                 case 0x0c:      /* WsP */
1842                         return 0;
1843                 }
1844
1845                 /* Proceed to download to check if the version matches */
1846                 goto download;
1847         }
1848
1849         /* Read the secure boot parameters to identify the operating
1850          * details of the bootloader.
1851          */
1852         err = btintel_read_boot_params(hdev, params);
1853         if (err)
1854                 return err;
1855
1856         /* It is required that every single firmware fragment is acknowledged
1857          * with a command complete event. If the boot parameters indicate
1858          * that this bootloader does not send them, then abort the setup.
1859          */
1860         if (params->limited_cce != 0x00) {
1861                 bt_dev_err(hdev, "Unsupported Intel firmware loading method (%u)",
1862                            params->limited_cce);
1863                 return -EINVAL;
1864         }
1865
1866         /* If the OTP has no valid Bluetooth device address, then there will
1867          * also be no valid address for the operational firmware.
1868          */
1869         if (!bacmp(&params->otp_bdaddr, BDADDR_ANY)) {
1870                 bt_dev_info(hdev, "No device address configured");
1871                 set_bit(HCI_QUIRK_INVALID_BDADDR, &hdev->quirks);
1872         }
1873
1874 download:
1875         /* With this Intel bootloader only the hardware variant and device
1876          * revision information are used to select the right firmware for SfP
1877          * and WsP.
1878          *
1879          * The firmware filename is ibt-<hw_variant>-<dev_revid>.sfi.
1880          *
1881          * Currently the supported hardware variants are:
1882          *   11 (0x0b) for iBT3.0 (LnP/SfP)
1883          *   12 (0x0c) for iBT3.5 (WsP)
1884          *
1885          * For ThP/JfP and for future SKU's, the FW name varies based on HW
1886          * variant, HW revision and FW revision, as these are dependent on CNVi
1887          * and RF Combination.
1888          *
1889          *   17 (0x11) for iBT3.5 (JfP)
1890          *   18 (0x12) for iBT3.5 (ThP)
1891          *
1892          * The firmware file name for these will be
1893          * ibt-<hw_variant>-<hw_revision>-<fw_revision>.sfi.
1894          *
1895          */
1896         err = btintel_get_fw_name(ver, params, fwname, sizeof(fwname), "sfi");
1897         if (err < 0) {
1898                 if (!btintel_test_flag(hdev, INTEL_BOOTLOADER)) {
1899                         /* Firmware has already been loaded */
1900                         btintel_set_flag(hdev, INTEL_FIRMWARE_LOADED);
1901                         return 0;
1902                 }
1903
1904                 bt_dev_err(hdev, "Unsupported Intel firmware naming");
1905                 return -EINVAL;
1906         }
1907
1908         err = firmware_request_nowarn(&fw, fwname, &hdev->dev);
1909         if (err < 0) {
1910                 if (!btintel_test_flag(hdev, INTEL_BOOTLOADER)) {
1911                         /* Firmware has already been loaded */
1912                         btintel_set_flag(hdev, INTEL_FIRMWARE_LOADED);
1913                         return 0;
1914                 }
1915
1916                 bt_dev_err(hdev, "Failed to load Intel firmware file %s (%d)",
1917                            fwname, err);
1918                 return err;
1919         }
1920
1921         bt_dev_info(hdev, "Found device firmware: %s", fwname);
1922
1923         if (fw->size < 644) {
1924                 bt_dev_err(hdev, "Invalid size of firmware file (%zu)",
1925                            fw->size);
1926                 err = -EBADF;
1927                 goto done;
1928         }
1929
1930         calltime = ktime_get();
1931
1932         btintel_set_flag(hdev, INTEL_DOWNLOADING);
1933
1934         /* Start firmware downloading and get boot parameter */
1935         err = btintel_download_firmware(hdev, ver, fw, boot_param);
1936         if (err < 0) {
1937                 if (err == -EALREADY) {
1938                         /* Firmware has already been loaded */
1939                         btintel_set_flag(hdev, INTEL_FIRMWARE_LOADED);
1940                         err = 0;
1941                         goto done;
1942                 }
1943
1944                 /* When FW download fails, send Intel Reset to retry
1945                  * FW download.
1946                  */
1947                 btintel_reset_to_bootloader(hdev);
1948                 goto done;
1949         }
1950
1951         /* Before switching the device into operational mode and with that
1952          * booting the loaded firmware, wait for the bootloader notification
1953          * that all fragments have been successfully received.
1954          *
1955          * When the event processing receives the notification, then the
1956          * INTEL_DOWNLOADING flag will be cleared.
1957          *
1958          * The firmware loading should not take longer than 5 seconds
1959          * and thus just timeout if that happens and fail the setup
1960          * of this device.
1961          */
1962         err = btintel_download_wait(hdev, calltime, 5000);
1963         if (err == -ETIMEDOUT)
1964                 btintel_reset_to_bootloader(hdev);
1965
1966 done:
1967         release_firmware(fw);
1968         return err;
1969 }
1970
1971 static int btintel_bootloader_setup(struct hci_dev *hdev,
1972                                     struct intel_version *ver)
1973 {
1974         struct intel_version new_ver;
1975         struct intel_boot_params params;
1976         u32 boot_param;
1977         char ddcname[64];
1978         int err;
1979
1980         BT_DBG("%s", hdev->name);
1981
1982         /* Set the default boot parameter to 0x0 and it is updated to
1983          * SKU specific boot parameter after reading Intel_Write_Boot_Params
1984          * command while downloading the firmware.
1985          */
1986         boot_param = 0x00000000;
1987
1988         btintel_set_flag(hdev, INTEL_BOOTLOADER);
1989
1990         err = btintel_download_fw(hdev, ver, &params, &boot_param);
1991         if (err)
1992                 return err;
1993
1994         /* controller is already having an operational firmware */
1995         if (ver->fw_variant == 0x23)
1996                 goto finish;
1997
1998         err = btintel_boot(hdev, boot_param);
1999         if (err)
2000                 return err;
2001
2002         btintel_clear_flag(hdev, INTEL_BOOTLOADER);
2003
2004         err = btintel_get_fw_name(ver, &params, ddcname,
2005                                                 sizeof(ddcname), "ddc");
2006
2007         if (err < 0) {
2008                 bt_dev_err(hdev, "Unsupported Intel firmware naming");
2009         } else {
2010                 /* Once the device is running in operational mode, it needs to
2011                  * apply the device configuration (DDC) parameters.
2012                  *
2013                  * The device can work without DDC parameters, so even if it
2014                  * fails to load the file, no need to fail the setup.
2015                  */
2016                 btintel_load_ddc_config(hdev, ddcname);
2017         }
2018
2019         hci_dev_clear_flag(hdev, HCI_QUALITY_REPORT);
2020
2021         /* Read the Intel version information after loading the FW  */
2022         err = btintel_read_version(hdev, &new_ver);
2023         if (err)
2024                 return err;
2025
2026         btintel_version_info(hdev, &new_ver);
2027
2028 finish:
2029         /* Set the event mask for Intel specific vendor events. This enables
2030          * a few extra events that are useful during general operation. It
2031          * does not enable any debugging related events.
2032          *
2033          * The device will function correctly without these events enabled
2034          * and thus no need to fail the setup.
2035          */
2036         btintel_set_event_mask(hdev, false);
2037
2038         return 0;
2039 }
2040
2041 static void btintel_get_fw_name_tlv(const struct intel_version_tlv *ver,
2042                                     char *fw_name, size_t len,
2043                                     const char *suffix)
2044 {
2045         /* The firmware file name for new generation controllers will be
2046          * ibt-<cnvi_top type+cnvi_top step>-<cnvr_top type+cnvr_top step>
2047          */
2048         snprintf(fw_name, len, "intel/ibt-%04x-%04x.%s",
2049                  INTEL_CNVX_TOP_PACK_SWAB(INTEL_CNVX_TOP_TYPE(ver->cnvi_top),
2050                                           INTEL_CNVX_TOP_STEP(ver->cnvi_top)),
2051                  INTEL_CNVX_TOP_PACK_SWAB(INTEL_CNVX_TOP_TYPE(ver->cnvr_top),
2052                                           INTEL_CNVX_TOP_STEP(ver->cnvr_top)),
2053                  suffix);
2054 }
2055
2056 static int btintel_prepare_fw_download_tlv(struct hci_dev *hdev,
2057                                            struct intel_version_tlv *ver,
2058                                            u32 *boot_param)
2059 {
2060         const struct firmware *fw;
2061         char fwname[64];
2062         int err;
2063         ktime_t calltime;
2064
2065         if (!ver || !boot_param)
2066                 return -EINVAL;
2067
2068         /* The firmware variant determines if the device is in bootloader
2069          * mode or is running operational firmware. The value 0x03 identifies
2070          * the bootloader and the value 0x23 identifies the operational
2071          * firmware.
2072          *
2073          * When the operational firmware is already present, then only
2074          * the check for valid Bluetooth device address is needed. This
2075          * determines if the device will be added as configured or
2076          * unconfigured controller.
2077          *
2078          * It is not possible to use the Secure Boot Parameters in this
2079          * case since that command is only available in bootloader mode.
2080          */
2081         if (ver->img_type == 0x03) {
2082                 btintel_clear_flag(hdev, INTEL_BOOTLOADER);
2083                 btintel_check_bdaddr(hdev);
2084         }
2085
2086         /* If the OTP has no valid Bluetooth device address, then there will
2087          * also be no valid address for the operational firmware.
2088          */
2089         if (!bacmp(&ver->otp_bd_addr, BDADDR_ANY)) {
2090                 bt_dev_info(hdev, "No device address configured");
2091                 set_bit(HCI_QUIRK_INVALID_BDADDR, &hdev->quirks);
2092         }
2093
2094         btintel_get_fw_name_tlv(ver, fwname, sizeof(fwname), "sfi");
2095         err = firmware_request_nowarn(&fw, fwname, &hdev->dev);
2096         if (err < 0) {
2097                 if (!btintel_test_flag(hdev, INTEL_BOOTLOADER)) {
2098                         /* Firmware has already been loaded */
2099                         btintel_set_flag(hdev, INTEL_FIRMWARE_LOADED);
2100                         return 0;
2101                 }
2102
2103                 bt_dev_err(hdev, "Failed to load Intel firmware file %s (%d)",
2104                            fwname, err);
2105
2106                 return err;
2107         }
2108
2109         bt_dev_info(hdev, "Found device firmware: %s", fwname);
2110
2111         if (fw->size < 644) {
2112                 bt_dev_err(hdev, "Invalid size of firmware file (%zu)",
2113                            fw->size);
2114                 err = -EBADF;
2115                 goto done;
2116         }
2117
2118         calltime = ktime_get();
2119
2120         btintel_set_flag(hdev, INTEL_DOWNLOADING);
2121
2122         /* Start firmware downloading and get boot parameter */
2123         err = btintel_download_fw_tlv(hdev, ver, fw, boot_param,
2124                                                INTEL_HW_VARIANT(ver->cnvi_bt),
2125                                                ver->sbe_type);
2126         if (err < 0) {
2127                 if (err == -EALREADY) {
2128                         /* Firmware has already been loaded */
2129                         btintel_set_flag(hdev, INTEL_FIRMWARE_LOADED);
2130                         err = 0;
2131                         goto done;
2132                 }
2133
2134                 /* When FW download fails, send Intel Reset to retry
2135                  * FW download.
2136                  */
2137                 btintel_reset_to_bootloader(hdev);
2138                 goto done;
2139         }
2140
2141         /* Before switching the device into operational mode and with that
2142          * booting the loaded firmware, wait for the bootloader notification
2143          * that all fragments have been successfully received.
2144          *
2145          * When the event processing receives the notification, then the
2146          * BTUSB_DOWNLOADING flag will be cleared.
2147          *
2148          * The firmware loading should not take longer than 5 seconds
2149          * and thus just timeout if that happens and fail the setup
2150          * of this device.
2151          */
2152         err = btintel_download_wait(hdev, calltime, 5000);
2153         if (err == -ETIMEDOUT)
2154                 btintel_reset_to_bootloader(hdev);
2155
2156 done:
2157         release_firmware(fw);
2158         return err;
2159 }
2160
2161 static int btintel_get_codec_config_data(struct hci_dev *hdev,
2162                                          __u8 link, struct bt_codec *codec,
2163                                          __u8 *ven_len, __u8 **ven_data)
2164 {
2165         int err = 0;
2166
2167         if (!ven_data || !ven_len)
2168                 return -EINVAL;
2169
2170         *ven_len = 0;
2171         *ven_data = NULL;
2172
2173         if (link != ESCO_LINK) {
2174                 bt_dev_err(hdev, "Invalid link type(%u)", link);
2175                 return -EINVAL;
2176         }
2177
2178         *ven_data = kmalloc(sizeof(__u8), GFP_KERNEL);
2179         if (!*ven_data) {
2180                 err = -ENOMEM;
2181                 goto error;
2182         }
2183
2184         /* supports only CVSD and mSBC offload codecs */
2185         switch (codec->id) {
2186         case 0x02:
2187                 **ven_data = 0x00;
2188                 break;
2189         case 0x05:
2190                 **ven_data = 0x01;
2191                 break;
2192         default:
2193                 err = -EINVAL;
2194                 bt_dev_err(hdev, "Invalid codec id(%u)", codec->id);
2195                 goto error;
2196         }
2197         /* codec and its capabilities are pre-defined to ids
2198          * preset id = 0x00 represents CVSD codec with sampling rate 8K
2199          * preset id = 0x01 represents mSBC codec with sampling rate 16K
2200          */
2201         *ven_len = sizeof(__u8);
2202         return err;
2203
2204 error:
2205         kfree(*ven_data);
2206         *ven_data = NULL;
2207         return err;
2208 }
2209
2210 static int btintel_get_data_path_id(struct hci_dev *hdev, __u8 *data_path_id)
2211 {
2212         /* Intel uses 1 as data path id for all the usecases */
2213         *data_path_id = 1;
2214         return 0;
2215 }
2216
2217 static int btintel_configure_offload(struct hci_dev *hdev)
2218 {
2219         struct sk_buff *skb;
2220         int err = 0;
2221         struct intel_offload_use_cases *use_cases;
2222
2223         skb = __hci_cmd_sync(hdev, 0xfc86, 0, NULL, HCI_INIT_TIMEOUT);
2224         if (IS_ERR(skb)) {
2225                 bt_dev_err(hdev, "Reading offload use cases failed (%ld)",
2226                            PTR_ERR(skb));
2227                 return PTR_ERR(skb);
2228         }
2229
2230         if (skb->len < sizeof(*use_cases)) {
2231                 err = -EIO;
2232                 goto error;
2233         }
2234
2235         use_cases = (void *)skb->data;
2236
2237         if (use_cases->status) {
2238                 err = -bt_to_errno(skb->data[0]);
2239                 goto error;
2240         }
2241
2242         if (use_cases->preset[0] & 0x03) {
2243                 hdev->get_data_path_id = btintel_get_data_path_id;
2244                 hdev->get_codec_config_data = btintel_get_codec_config_data;
2245         }
2246 error:
2247         kfree_skb(skb);
2248         return err;
2249 }
2250
2251 static int btintel_bootloader_setup_tlv(struct hci_dev *hdev,
2252                                         struct intel_version_tlv *ver)
2253 {
2254         u32 boot_param;
2255         char ddcname[64];
2256         int err;
2257         struct intel_version_tlv new_ver;
2258
2259         bt_dev_dbg(hdev, "");
2260
2261         /* Set the default boot parameter to 0x0 and it is updated to
2262          * SKU specific boot parameter after reading Intel_Write_Boot_Params
2263          * command while downloading the firmware.
2264          */
2265         boot_param = 0x00000000;
2266
2267         btintel_set_flag(hdev, INTEL_BOOTLOADER);
2268
2269         err = btintel_prepare_fw_download_tlv(hdev, ver, &boot_param);
2270         if (err)
2271                 return err;
2272
2273         /* check if controller is already having an operational firmware */
2274         if (ver->img_type == 0x03)
2275                 goto finish;
2276
2277         err = btintel_boot(hdev, boot_param);
2278         if (err)
2279                 return err;
2280
2281         btintel_clear_flag(hdev, INTEL_BOOTLOADER);
2282
2283         btintel_get_fw_name_tlv(ver, ddcname, sizeof(ddcname), "ddc");
2284         /* Once the device is running in operational mode, it needs to
2285          * apply the device configuration (DDC) parameters.
2286          *
2287          * The device can work without DDC parameters, so even if it
2288          * fails to load the file, no need to fail the setup.
2289          */
2290         btintel_load_ddc_config(hdev, ddcname);
2291
2292         /* Read supported use cases and set callbacks to fetch datapath id */
2293         btintel_configure_offload(hdev);
2294
2295         hci_dev_clear_flag(hdev, HCI_QUALITY_REPORT);
2296
2297         /* Read the Intel version information after loading the FW  */
2298         err = btintel_read_version_tlv(hdev, &new_ver);
2299         if (err)
2300                 return err;
2301
2302         btintel_version_info_tlv(hdev, &new_ver);
2303
2304 finish:
2305         /* Set the event mask for Intel specific vendor events. This enables
2306          * a few extra events that are useful during general operation. It
2307          * does not enable any debugging related events.
2308          *
2309          * The device will function correctly without these events enabled
2310          * and thus no need to fail the setup.
2311          */
2312         btintel_set_event_mask(hdev, false);
2313
2314         return 0;
2315 }
2316
2317 static void btintel_set_msft_opcode(struct hci_dev *hdev, u8 hw_variant)
2318 {
2319         switch (hw_variant) {
2320         /* Legacy bootloader devices that supports MSFT Extension */
2321         case 0x11:      /* JfP */
2322         case 0x12:      /* ThP */
2323         case 0x13:      /* HrP */
2324         case 0x14:      /* CcP */
2325         /* All Intel new genration controllers support the Microsoft vendor
2326          * extension are using 0xFC1E for VsMsftOpCode.
2327          */
2328         case 0x17:
2329         case 0x18:
2330         case 0x19:
2331                 hci_set_msft_opcode(hdev, 0xFC1E);
2332                 break;
2333         default:
2334                 /* Not supported */
2335                 break;
2336         }
2337 }
2338
2339 static int btintel_setup_combined(struct hci_dev *hdev)
2340 {
2341         const u8 param[1] = { 0xFF };
2342         struct intel_version ver;
2343         struct intel_version_tlv ver_tlv;
2344         struct sk_buff *skb;
2345         int err;
2346
2347         BT_DBG("%s", hdev->name);
2348
2349         /* The some controllers have a bug with the first HCI command sent to it
2350          * returning number of completed commands as zero. This would stall the
2351          * command processing in the Bluetooth core.
2352          *
2353          * As a workaround, send HCI Reset command first which will reset the
2354          * number of completed commands and allow normal command processing
2355          * from now on.
2356          */
2357         if (btintel_test_flag(hdev, INTEL_BROKEN_INITIAL_NCMD)) {
2358                 skb = __hci_cmd_sync(hdev, HCI_OP_RESET, 0, NULL,
2359                                      HCI_INIT_TIMEOUT);
2360                 if (IS_ERR(skb)) {
2361                         bt_dev_err(hdev,
2362                                    "sending initial HCI reset failed (%ld)",
2363                                    PTR_ERR(skb));
2364                         return PTR_ERR(skb);
2365                 }
2366                 kfree_skb(skb);
2367         }
2368
2369         /* Starting from TyP device, the command parameter and response are
2370          * changed even though the OCF for HCI_Intel_Read_Version command
2371          * remains same. The legacy devices can handle even if the
2372          * command has a parameter and returns a correct version information.
2373          * So, it uses new format to support both legacy and new format.
2374          */
2375         skb = __hci_cmd_sync(hdev, 0xfc05, 1, param, HCI_CMD_TIMEOUT);
2376         if (IS_ERR(skb)) {
2377                 bt_dev_err(hdev, "Reading Intel version command failed (%ld)",
2378                            PTR_ERR(skb));
2379                 return PTR_ERR(skb);
2380         }
2381
2382         /* Check the status */
2383         if (skb->data[0]) {
2384                 bt_dev_err(hdev, "Intel Read Version command failed (%02x)",
2385                            skb->data[0]);
2386                 err = -EIO;
2387                 goto exit_error;
2388         }
2389
2390         /* Apply the common HCI quirks for Intel device */
2391         set_bit(HCI_QUIRK_STRICT_DUPLICATE_FILTER, &hdev->quirks);
2392         set_bit(HCI_QUIRK_SIMULTANEOUS_DISCOVERY, &hdev->quirks);
2393         set_bit(HCI_QUIRK_NON_PERSISTENT_DIAG, &hdev->quirks);
2394
2395         /* Set up the quality report callback for Intel devices */
2396         hdev->set_quality_report = btintel_set_quality_report;
2397
2398         /* For Legacy device, check the HW platform value and size */
2399         if (skb->len == sizeof(ver) && skb->data[1] == 0x37) {
2400                 bt_dev_dbg(hdev, "Read the legacy Intel version information");
2401
2402                 memcpy(&ver, skb->data, sizeof(ver));
2403
2404                 /* Display version information */
2405                 btintel_version_info(hdev, &ver);
2406
2407                 /* Check for supported iBT hardware variants of this firmware
2408                  * loading method.
2409                  *
2410                  * This check has been put in place to ensure correct forward
2411                  * compatibility options when newer hardware variants come
2412                  * along.
2413                  */
2414                 switch (ver.hw_variant) {
2415                 case 0x07:      /* WP */
2416                 case 0x08:      /* StP */
2417                         /* Legacy ROM product */
2418                         btintel_set_flag(hdev, INTEL_ROM_LEGACY);
2419
2420                         /* Apply the device specific HCI quirks
2421                          *
2422                          * WBS for SdP - SdP and Stp have a same hw_varaint but
2423                          * different fw_variant
2424                          */
2425                         if (ver.hw_variant == 0x08 && ver.fw_variant == 0x22)
2426                                 set_bit(HCI_QUIRK_WIDEBAND_SPEECH_SUPPORTED,
2427                                         &hdev->quirks);
2428
2429                         /* These devices have an issue with LED which doesn't
2430                          * go off immediately during shutdown. Set the flag
2431                          * here to send the LED OFF command during shutdown.
2432                          */
2433                         btintel_set_flag(hdev, INTEL_BROKEN_LED);
2434
2435                         err = btintel_legacy_rom_setup(hdev, &ver);
2436                         break;
2437                 case 0x0b:      /* SfP */
2438                 case 0x0c:      /* WsP */
2439                 case 0x11:      /* JfP */
2440                 case 0x12:      /* ThP */
2441                 case 0x13:      /* HrP */
2442                 case 0x14:      /* CcP */
2443                         /* Apply the device specific HCI quirks
2444                          *
2445                          * All Legacy bootloader devices support WBS
2446                          */
2447                         set_bit(HCI_QUIRK_WIDEBAND_SPEECH_SUPPORTED,
2448                                 &hdev->quirks);
2449
2450                         /* Valid LE States quirk for JfP/ThP familiy */
2451                         if (ver.hw_variant == 0x11 || ver.hw_variant == 0x12)
2452                                 set_bit(HCI_QUIRK_VALID_LE_STATES,
2453                                         &hdev->quirks);
2454
2455                         /* Setup MSFT Extension support */
2456                         btintel_set_msft_opcode(hdev, ver.hw_variant);
2457
2458                         err = btintel_bootloader_setup(hdev, &ver);
2459                         break;
2460                 default:
2461                         bt_dev_err(hdev, "Unsupported Intel hw variant (%u)",
2462                                    ver.hw_variant);
2463                         err = -EINVAL;
2464                 }
2465
2466                 goto exit_error;
2467         }
2468
2469         /* For TLV type device, parse the tlv data */
2470         err = btintel_parse_version_tlv(hdev, &ver_tlv, skb);
2471         if (err) {
2472                 bt_dev_err(hdev, "Failed to parse TLV version information");
2473                 goto exit_error;
2474         }
2475
2476         if (INTEL_HW_PLATFORM(ver_tlv.cnvi_bt) != 0x37) {
2477                 bt_dev_err(hdev, "Unsupported Intel hardware platform (0x%2x)",
2478                            INTEL_HW_PLATFORM(ver_tlv.cnvi_bt));
2479                 err = -EINVAL;
2480                 goto exit_error;
2481         }
2482
2483         /* Check for supported iBT hardware variants of this firmware
2484          * loading method.
2485          *
2486          * This check has been put in place to ensure correct forward
2487          * compatibility options when newer hardware variants come
2488          * along.
2489          */
2490         switch (INTEL_HW_VARIANT(ver_tlv.cnvi_bt)) {
2491         case 0x11:      /* JfP */
2492         case 0x12:      /* ThP */
2493         case 0x13:      /* HrP */
2494         case 0x14:      /* CcP */
2495                 /* Some legacy bootloader devices from JfP supports both old
2496                  * and TLV based HCI_Intel_Read_Version command. But we don't
2497                  * want to use the TLV based setup routines for those legacy
2498                  * bootloader device.
2499                  *
2500                  * Also, it is not easy to convert TLV based version from the
2501                  * legacy version format.
2502                  *
2503                  * So, as a workaround for those devices, use the legacy
2504                  * HCI_Intel_Read_Version to get the version information and
2505                  * run the legacy bootloader setup.
2506                  */
2507                 err = btintel_read_version(hdev, &ver);
2508                 if (err)
2509                         return err;
2510                 err = btintel_bootloader_setup(hdev, &ver);
2511                 break;
2512         case 0x17:
2513         case 0x18:
2514         case 0x19:
2515                 /* Display version information of TLV type */
2516                 btintel_version_info_tlv(hdev, &ver_tlv);
2517
2518                 /* Apply the device specific HCI quirks for TLV based devices
2519                  *
2520                  * All TLV based devices support WBS
2521                  */
2522                 set_bit(HCI_QUIRK_WIDEBAND_SPEECH_SUPPORTED, &hdev->quirks);
2523
2524                 /* Valid LE States quirk for GfP */
2525                 if (INTEL_HW_VARIANT(ver_tlv.cnvi_bt) == 0x18)
2526                         set_bit(HCI_QUIRK_VALID_LE_STATES, &hdev->quirks);
2527
2528                 /* Setup MSFT Extension support */
2529                 btintel_set_msft_opcode(hdev,
2530                                         INTEL_HW_VARIANT(ver_tlv.cnvi_bt));
2531
2532                 err = btintel_bootloader_setup_tlv(hdev, &ver_tlv);
2533                 break;
2534         default:
2535                 bt_dev_err(hdev, "Unsupported Intel hw variant (%u)",
2536                            INTEL_HW_VARIANT(ver_tlv.cnvi_bt));
2537                 return -EINVAL;
2538         }
2539
2540 exit_error:
2541         kfree_skb(skb);
2542
2543         return err;
2544 }
2545
2546 static int btintel_shutdown_combined(struct hci_dev *hdev)
2547 {
2548         struct sk_buff *skb;
2549         int ret;
2550
2551         /* Send HCI Reset to the controller to stop any BT activity which
2552          * were triggered. This will help to save power and maintain the
2553          * sync b/w Host and controller
2554          */
2555         skb = __hci_cmd_sync(hdev, HCI_OP_RESET, 0, NULL, HCI_INIT_TIMEOUT);
2556         if (IS_ERR(skb)) {
2557                 bt_dev_err(hdev, "HCI reset during shutdown failed");
2558                 return PTR_ERR(skb);
2559         }
2560         kfree_skb(skb);
2561
2562
2563         /* Some platforms have an issue with BT LED when the interface is
2564          * down or BT radio is turned off, which takes 5 seconds to BT LED
2565          * goes off. This command turns off the BT LED immediately.
2566          */
2567         if (btintel_test_flag(hdev, INTEL_BROKEN_LED)) {
2568                 skb = __hci_cmd_sync(hdev, 0xfc3f, 0, NULL, HCI_INIT_TIMEOUT);
2569                 if (IS_ERR(skb)) {
2570                         ret = PTR_ERR(skb);
2571                         bt_dev_err(hdev, "turning off Intel device LED failed");
2572                         return ret;
2573                 }
2574                 kfree_skb(skb);
2575         }
2576
2577         return 0;
2578 }
2579
2580 int btintel_configure_setup(struct hci_dev *hdev)
2581 {
2582         hdev->manufacturer = 2;
2583         hdev->setup = btintel_setup_combined;
2584         hdev->shutdown = btintel_shutdown_combined;
2585         hdev->hw_error = btintel_hw_error;
2586         hdev->set_diag = btintel_set_diag_combined;
2587         hdev->set_bdaddr = btintel_set_bdaddr;
2588
2589         return 0;
2590 }
2591 EXPORT_SYMBOL_GPL(btintel_configure_setup);
2592
2593 void btintel_bootup(struct hci_dev *hdev, const void *ptr, unsigned int len)
2594 {
2595         const struct intel_bootup *evt = ptr;
2596
2597         if (len != sizeof(*evt))
2598                 return;
2599
2600         if (btintel_test_and_clear_flag(hdev, INTEL_BOOTING))
2601                 btintel_wake_up_flag(hdev, INTEL_BOOTING);
2602 }
2603 EXPORT_SYMBOL_GPL(btintel_bootup);
2604
2605 void btintel_secure_send_result(struct hci_dev *hdev,
2606                                 const void *ptr, unsigned int len)
2607 {
2608         const struct intel_secure_send_result *evt = ptr;
2609
2610         if (len != sizeof(*evt))
2611                 return;
2612
2613         if (evt->result)
2614                 btintel_set_flag(hdev, INTEL_FIRMWARE_FAILED);
2615
2616         if (btintel_test_and_clear_flag(hdev, INTEL_DOWNLOADING) &&
2617             btintel_test_flag(hdev, INTEL_FIRMWARE_LOADED))
2618                 btintel_wake_up_flag(hdev, INTEL_DOWNLOADING);
2619 }
2620 EXPORT_SYMBOL_GPL(btintel_secure_send_result);
2621
2622 MODULE_AUTHOR("Marcel Holtmann <marcel@holtmann.org>");
2623 MODULE_DESCRIPTION("Bluetooth support for Intel devices ver " VERSION);
2624 MODULE_VERSION(VERSION);
2625 MODULE_LICENSE("GPL");
2626 MODULE_FIRMWARE("intel/ibt-11-5.sfi");
2627 MODULE_FIRMWARE("intel/ibt-11-5.ddc");
2628 MODULE_FIRMWARE("intel/ibt-12-16.sfi");
2629 MODULE_FIRMWARE("intel/ibt-12-16.ddc");