drivers/bluetooth/btintel.c

   1 // SPDX-License-Identifier: GPL-2.0-or-later
   2 /*
   3  *
   4  *  Bluetooth support for Intel devices
   5  *
   6  *  Copyright (C) 2015  Intel Corporation
   7  */
   8
   9 #include <linux/module.h>
  10 #include <linux/firmware.h>
  11 #include <linux/regmap.h>
  12 #include <asm/unaligned.h>
  13
  14 #include <net/bluetooth/bluetooth.h>
  15 #include <net/bluetooth/hci_core.h>
  16
  17 #include "btintel.h"
  18
  19 #define VERSION "0.1"
  20
  21 #define BDADDR_INTEL            (&(bdaddr_t){{0x00, 0x8b, 0x9e, 0x19, 0x03, 0x00}})
  22 #define RSA_HEADER_LEN          644
  23 #define CSS_HEADER_OFFSET       8
  24 #define ECDSA_OFFSET            644
  25 #define ECDSA_HEADER_LEN        320
  26
  27 #define CMD_WRITE_BOOT_PARAMS   0xfc0e
  28 struct cmd_write_boot_params {
  29         u32 boot_addr;
  30         u8  fw_build_num;
  31         u8  fw_build_ww;
  32         u8  fw_build_yy;
  33 } __packed;
  34
  35 int btintel_check_bdaddr(struct hci_dev *hdev)
  36 {
  37         struct hci_rp_read_bd_addr *bda;
  38         struct sk_buff *skb;
  39
  40         skb = __hci_cmd_sync(hdev, HCI_OP_READ_BD_ADDR, 0, NULL,
  41                              HCI_INIT_TIMEOUT);
  42         if (IS_ERR(skb)) {
  43                 int err = PTR_ERR(skb);
  44                 bt_dev_err(hdev, "Reading Intel device address failed (%d)",
  45                            err);
  46                 return err;
  47         }
  48
  49         if (skb->len != sizeof(*bda)) {
  50                 bt_dev_err(hdev, "Intel device address length mismatch");
  51                 kfree_skb(skb);
  52                 return -EIO;
  53         }
  54
  55         bda = (struct hci_rp_read_bd_addr *)skb->data;
  56
  57         /* For some Intel based controllers, the default Bluetooth device
  58          * address 00:03:19:9E:8B:00 can be found. These controllers are
  59          * fully operational, but have the danger of duplicate addresses
  60          * and that in turn can cause problems with Bluetooth operation.
  61          */
  62         if (!bacmp(&bda->bdaddr, BDADDR_INTEL)) {
  63                 bt_dev_err(hdev, "Found Intel default device address (%pMR)",
  64                            &bda->bdaddr);
  65                 set_bit(HCI_QUIRK_INVALID_BDADDR, &hdev->quirks);
  66         }
  67
  68         kfree_skb(skb);
  69
  70         return 0;
  71 }
  72 EXPORT_SYMBOL_GPL(btintel_check_bdaddr);
  73
  74 int btintel_enter_mfg(struct hci_dev *hdev)
  75 {
  76         static const u8 param[] = { 0x01, 0x00 };
  77         struct sk_buff *skb;
  78
  79         skb = __hci_cmd_sync(hdev, 0xfc11, 2, param, HCI_CMD_TIMEOUT);
  80         if (IS_ERR(skb)) {
  81                 bt_dev_err(hdev, "Entering manufacturer mode failed (%ld)",
  82                            PTR_ERR(skb));
  83                 return PTR_ERR(skb);
  84         }
  85         kfree_skb(skb);
  86
  87         return 0;
  88 }
  89 EXPORT_SYMBOL_GPL(btintel_enter_mfg);
  90
  91 int btintel_exit_mfg(struct hci_dev *hdev, bool reset, bool patched)
  92 {
  93         u8 param[] = { 0x00, 0x00 };
  94         struct sk_buff *skb;
  95
  96         /* The 2nd command parameter specifies the manufacturing exit method:
  97          * 0x00: Just disable the manufacturing mode (0x00).
  98          * 0x01: Disable manufacturing mode and reset with patches deactivated.
  99          * 0x02: Disable manufacturing mode and reset with patches activated.
 100          */
 101         if (reset)
 102                 param[1] |= patched ? 0x02 : 0x01;
 103
 104         skb = __hci_cmd_sync(hdev, 0xfc11, 2, param, HCI_CMD_TIMEOUT);
 105         if (IS_ERR(skb)) {
 106                 bt_dev_err(hdev, "Exiting manufacturer mode failed (%ld)",
 107                            PTR_ERR(skb));
 108                 return PTR_ERR(skb);
 109         }
 110         kfree_skb(skb);
 111
 112         return 0;
 113 }
 114 EXPORT_SYMBOL_GPL(btintel_exit_mfg);
 115
 116 int btintel_set_bdaddr(struct hci_dev *hdev, const bdaddr_t *bdaddr)
 117 {
 118         struct sk_buff *skb;
 119         int err;
 120
 121         skb = __hci_cmd_sync(hdev, 0xfc31, 6, bdaddr, HCI_INIT_TIMEOUT);
 122         if (IS_ERR(skb)) {
 123                 err = PTR_ERR(skb);
 124                 bt_dev_err(hdev, "Changing Intel device address failed (%d)",
 125                            err);
 126                 return err;
 127         }
 128         kfree_skb(skb);
 129
 130         return 0;
 131 }
 132 EXPORT_SYMBOL_GPL(btintel_set_bdaddr);
 133
 134 int btintel_set_diag(struct hci_dev *hdev, bool enable)
 135 {
 136         struct sk_buff *skb;
 137         u8 param[3];
 138         int err;
 139
 140         if (enable) {
 141                 param[0] = 0x03;
 142                 param[1] = 0x03;
 143                 param[2] = 0x03;
 144         } else {
 145                 param[0] = 0x00;
 146                 param[1] = 0x00;
 147                 param[2] = 0x00;
 148         }
 149
 150         skb = __hci_cmd_sync(hdev, 0xfc43, 3, param, HCI_INIT_TIMEOUT);
 151         if (IS_ERR(skb)) {
 152                 err = PTR_ERR(skb);
 153                 if (err == -ENODATA)
 154                         goto done;
 155                 bt_dev_err(hdev, "Changing Intel diagnostic mode failed (%d)",
 156                            err);
 157                 return err;
 158         }
 159         kfree_skb(skb);
 160
 161 done:
 162         btintel_set_event_mask(hdev, enable);
 163         return 0;
 164 }
 165 EXPORT_SYMBOL_GPL(btintel_set_diag);
 166
 167 int btintel_set_diag_mfg(struct hci_dev *hdev, bool enable)
 168 {
 169         int err, ret;
 170
 171         err = btintel_enter_mfg(hdev);
 172         if (err)
 173                 return err;
 174
 175         ret = btintel_set_diag(hdev, enable);
 176
 177         err = btintel_exit_mfg(hdev, false, false);
 178         if (err)
 179                 return err;
 180
 181         return ret;
 182 }
 183 EXPORT_SYMBOL_GPL(btintel_set_diag_mfg);
 184
 185 void btintel_hw_error(struct hci_dev *hdev, u8 code)
 186 {
 187         struct sk_buff *skb;
 188         u8 type = 0x00;
 189
 190         bt_dev_err(hdev, "Hardware error 0x%2.2x", code);
 191
 192         skb = __hci_cmd_sync(hdev, HCI_OP_RESET, 0, NULL, HCI_INIT_TIMEOUT);
 193         if (IS_ERR(skb)) {
 194                 bt_dev_err(hdev, "Reset after hardware error failed (%ld)",
 195                            PTR_ERR(skb));
 196                 return;
 197         }
 198         kfree_skb(skb);
 199
 200         skb = __hci_cmd_sync(hdev, 0xfc22, 1, &type, HCI_INIT_TIMEOUT);
 201         if (IS_ERR(skb)) {
 202                 bt_dev_err(hdev, "Retrieving Intel exception info failed (%ld)",
 203                            PTR_ERR(skb));
 204                 return;
 205         }
 206
 207         if (skb->len != 13) {
 208                 bt_dev_err(hdev, "Exception info size mismatch");
 209                 kfree_skb(skb);
 210                 return;
 211         }
 212
 213         bt_dev_err(hdev, "Exception info %s", (char *)(skb->data + 1));
 214
 215         kfree_skb(skb);
 216 }
 217 EXPORT_SYMBOL_GPL(btintel_hw_error);
 218
 219 void btintel_version_info(struct hci_dev *hdev, struct intel_version *ver)
 220 {
 221         const char *variant;
 222
 223         switch (ver->fw_variant) {
 224         case 0x06:
 225                 variant = "Bootloader";
 226                 break;
 227         case 0x23:
 228                 variant = "Firmware";
 229                 break;
 230         default:
 231                 return;
 232         }
 233
 234         bt_dev_info(hdev, "%s revision %u.%u build %u week %u %u",
 235                     variant, ver->fw_revision >> 4, ver->fw_revision & 0x0f,
 236                     ver->fw_build_num, ver->fw_build_ww,
 237                     2000 + ver->fw_build_yy);
 238 }
 239 EXPORT_SYMBOL_GPL(btintel_version_info);
 240
 241 int btintel_secure_send(struct hci_dev *hdev, u8 fragment_type, u32 plen,
 242                         const void *param)
 243 {
 244         while (plen > 0) {
 245                 struct sk_buff *skb;
 246                 u8 cmd_param[253], fragment_len = (plen > 252) ? 252 : plen;
 247
 248                 cmd_param[0] = fragment_type;
 249                 memcpy(cmd_param + 1, param, fragment_len);
 250
 251                 skb = __hci_cmd_sync(hdev, 0xfc09, fragment_len + 1,
 252                                      cmd_param, HCI_INIT_TIMEOUT);
 253                 if (IS_ERR(skb))
 254                         return PTR_ERR(skb);
 255
 256                 kfree_skb(skb);
 257
 258                 plen -= fragment_len;
 259                 param += fragment_len;
 260         }
 261
 262         return 0;
 263 }
 264 EXPORT_SYMBOL_GPL(btintel_secure_send);
 265
 266 int btintel_load_ddc_config(struct hci_dev *hdev, const char *ddc_name)
 267 {
 268         const struct firmware *fw;
 269         struct sk_buff *skb;
 270         const u8 *fw_ptr;
 271         int err;
 272
 273         err = request_firmware_direct(&fw, ddc_name, &hdev->dev);
 274         if (err < 0) {
 275                 bt_dev_err(hdev, "Failed to load Intel DDC file %s (%d)",
 276                            ddc_name, err);
 277                 return err;
 278         }
 279
 280         bt_dev_info(hdev, "Found Intel DDC parameters: %s", ddc_name);
 281
 282         fw_ptr = fw->data;
 283
 284         /* DDC file contains one or more DDC structure which has
 285          * Length (1 byte), DDC ID (2 bytes), and DDC value (Length - 2).
 286          */
 287         while (fw->size > fw_ptr - fw->data) {
 288                 u8 cmd_plen = fw_ptr[0] + sizeof(u8);
 289
 290                 skb = __hci_cmd_sync(hdev, 0xfc8b, cmd_plen, fw_ptr,
 291                                      HCI_INIT_TIMEOUT);
 292                 if (IS_ERR(skb)) {
 293                         bt_dev_err(hdev, "Failed to send Intel_Write_DDC (%ld)",
 294                                    PTR_ERR(skb));
 295                         release_firmware(fw);
 296                         return PTR_ERR(skb);
 297                 }
 298
 299                 fw_ptr += cmd_plen;
 300                 kfree_skb(skb);
 301         }
 302
 303         release_firmware(fw);
 304
 305         bt_dev_info(hdev, "Applying Intel DDC parameters completed");
 306
 307         return 0;
 308 }
 309 EXPORT_SYMBOL_GPL(btintel_load_ddc_config);
 310
 311 int btintel_set_event_mask(struct hci_dev *hdev, bool debug)
 312 {
 313         u8 mask[8] = { 0x87, 0x0c, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 };
 314         struct sk_buff *skb;
 315         int err;
 316
 317         if (debug)
 318                 mask[1] |= 0x62;
 319
 320         skb = __hci_cmd_sync(hdev, 0xfc52, 8, mask, HCI_INIT_TIMEOUT);
 321         if (IS_ERR(skb)) {
 322                 err = PTR_ERR(skb);
 323                 bt_dev_err(hdev, "Setting Intel event mask failed (%d)", err);
 324                 return err;
 325         }
 326         kfree_skb(skb);
 327
 328         return 0;
 329 }
 330 EXPORT_SYMBOL_GPL(btintel_set_event_mask);
 331
 332 int btintel_set_event_mask_mfg(struct hci_dev *hdev, bool debug)
 333 {
 334         int err, ret;
 335
 336         err = btintel_enter_mfg(hdev);
 337         if (err)
 338                 return err;
 339
 340         ret = btintel_set_event_mask(hdev, debug);
 341
 342         err = btintel_exit_mfg(hdev, false, false);
 343         if (err)
 344                 return err;
 345
 346         return ret;
 347 }
 348 EXPORT_SYMBOL_GPL(btintel_set_event_mask_mfg);
 349
 350 int btintel_read_version(struct hci_dev *hdev, struct intel_version *ver)
 351 {
 352         struct sk_buff *skb;
 353
 354         skb = __hci_cmd_sync(hdev, 0xfc05, 0, NULL, HCI_CMD_TIMEOUT);
 355         if (IS_ERR(skb)) {
 356                 bt_dev_err(hdev, "Reading Intel version information failed (%ld)",
 357                            PTR_ERR(skb));
 358                 return PTR_ERR(skb);
 359         }
 360
 361         if (skb->len != sizeof(*ver)) {
 362                 bt_dev_err(hdev, "Intel version event size mismatch");
 363                 kfree_skb(skb);
 364                 return -EILSEQ;
 365         }
 366
 367         memcpy(ver, skb->data, sizeof(*ver));
 368
 369         kfree_skb(skb);
 370
 371         return 0;
 372 }
 373 EXPORT_SYMBOL_GPL(btintel_read_version);
 374
 375 int btintel_version_info_tlv(struct hci_dev *hdev, struct intel_version_tlv *version)
 376 {
 377         const char *variant;
 378
 379         /* The hardware platform number has a fixed value of 0x37 and
 380          * for now only accept this single value.
 381          */
 382         if (INTEL_HW_PLATFORM(version->cnvi_bt) != 0x37) {
 383                 bt_dev_err(hdev, "Unsupported Intel hardware platform (0x%2x)",
 384                            INTEL_HW_PLATFORM(version->cnvi_bt));
 385                 return -EINVAL;
 386         }
 387
 388         /* Check for supported iBT hardware variants of this firmware
 389          * loading method.
 390          *
 391          * This check has been put in place to ensure correct forward
 392          * compatibility options when newer hardware variants come along.
 393          */
 394         switch (INTEL_HW_VARIANT(version->cnvi_bt)) {
 395         case 0x17:      /* TyP */
 396         case 0x18:      /* Slr */
 397         case 0x19:      /* Slr-F */
 398                 break;
 399         default:
 400                 bt_dev_err(hdev, "Unsupported Intel hardware variant (0x%x)",
 401                            INTEL_HW_VARIANT(version->cnvi_bt));
 402                 return -EINVAL;
 403         }
 404
 405         /* It is required that every single firmware fragment is acknowledged
 406          * with a command complete event. If the boot parameters indicate
 407          * that this bootloader does not send them, then abort the setup.
 408          */
 409         if (version->limited_cce != 0x00) {
 410                 bt_dev_err(hdev, "Unsupported Intel firmware loading method (0x%x)",
 411                            version->limited_cce);
 412                 return -EINVAL;
 413         }
 414
 415         /* Secure boot engine type should be either 1 (ECDSA) or 0 (RSA) */
 416         if (version->sbe_type > 0x01) {
 417                 bt_dev_err(hdev, "Unsupported Intel secure boot engine type (0x%x)",
 418                            version->sbe_type);
 419                 return -EINVAL;
 420         }
 421
 422         switch (version->img_type) {
 423         case 0x01:
 424                 variant = "Bootloader";
 425                 bt_dev_info(hdev, "Device revision is %u", version->dev_rev_id);
 426                 bt_dev_info(hdev, "Secure boot is %s",
 427                             version->secure_boot ? "enabled" : "disabled");
 428                 bt_dev_info(hdev, "OTP lock is %s",
 429                             version->otp_lock ? "enabled" : "disabled");
 430                 bt_dev_info(hdev, "API lock is %s",
 431                             version->api_lock ? "enabled" : "disabled");
 432                 bt_dev_info(hdev, "Debug lock is %s",
 433                             version->debug_lock ? "enabled" : "disabled");
 434                 bt_dev_info(hdev, "Minimum firmware build %u week %u %u",
 435                             version->min_fw_build_nn, version->min_fw_build_cw,
 436                             2000 + version->min_fw_build_yy);
 437                 break;
 438         case 0x03:
 439                 variant = "Firmware";
 440                 break;
 441         default:
 442                 bt_dev_err(hdev, "Unsupported image type(%02x)", version->img_type);
 443                 return -EINVAL;
 444         }
 445
 446         bt_dev_info(hdev, "%s timestamp %u.%u buildtype %u build %u", variant,
 447                     2000 + (version->timestamp >> 8), version->timestamp & 0xff,
 448                     version->build_type, version->build_num);
 449
 450         return 0;
 451 }
 452 EXPORT_SYMBOL_GPL(btintel_version_info_tlv);
 453
 454 int btintel_read_version_tlv(struct hci_dev *hdev, struct intel_version_tlv *version)
 455 {
 456         struct sk_buff *skb;
 457         const u8 param[1] = { 0xFF };
 458
 459         if (!version)
 460                 return -EINVAL;
 461
 462         skb = __hci_cmd_sync(hdev, 0xfc05, 1, param, HCI_CMD_TIMEOUT);
 463         if (IS_ERR(skb)) {
 464                 bt_dev_err(hdev, "Reading Intel version information failed (%ld)",
 465                            PTR_ERR(skb));
 466                 return PTR_ERR(skb);
 467         }
 468
 469         if (skb->data[0]) {
 470                 bt_dev_err(hdev, "Intel Read Version command failed (%02x)",
 471                            skb->data[0]);
 472                 kfree_skb(skb);
 473                 return -EIO;
 474         }
 475
 476         /* Consume Command Complete Status field */
 477         skb_pull(skb, 1);
 478
 479         /* Event parameters contatin multiple TLVs. Read each of them
 480          * and only keep the required data. Also, it use existing legacy
 481          * version field like hw_platform, hw_variant, and fw_variant
 482          * to keep the existing setup flow
 483          */
 484         while (skb->len) {
 485                 struct intel_tlv *tlv;
 486
 487                 tlv = (struct intel_tlv *)skb->data;
 488                 switch (tlv->type) {
 489                 case INTEL_TLV_CNVI_TOP:
 490                         version->cnvi_top = get_unaligned_le32(tlv->val);
 491                         break;
 492                 case INTEL_TLV_CNVR_TOP:
 493                         version->cnvr_top = get_unaligned_le32(tlv->val);
 494                         break;
 495                 case INTEL_TLV_CNVI_BT:
 496                         version->cnvi_bt = get_unaligned_le32(tlv->val);
 497                         break;
 498                 case INTEL_TLV_CNVR_BT:
 499                         version->cnvr_bt = get_unaligned_le32(tlv->val);
 500                         break;
 501                 case INTEL_TLV_DEV_REV_ID:
 502                         version->dev_rev_id = get_unaligned_le16(tlv->val);
 503                         break;
 504                 case INTEL_TLV_IMAGE_TYPE:
 505                         version->img_type = tlv->val[0];
 506                         break;
 507                 case INTEL_TLV_TIME_STAMP:
 508                         version->timestamp = get_unaligned_le16(tlv->val);
 509                         break;
 510                 case INTEL_TLV_BUILD_TYPE:
 511                         version->build_type = tlv->val[0];
 512                         break;
 513                 case INTEL_TLV_BUILD_NUM:
 514                         version->build_num = get_unaligned_le32(tlv->val);
 515                         break;
 516                 case INTEL_TLV_SECURE_BOOT:
 517                         version->secure_boot = tlv->val[0];
 518                         break;
 519                 case INTEL_TLV_OTP_LOCK:
 520                         version->otp_lock = tlv->val[0];
 521                         break;
 522                 case INTEL_TLV_API_LOCK:
 523                         version->api_lock = tlv->val[0];
 524                         break;
 525                 case INTEL_TLV_DEBUG_LOCK:
 526                         version->debug_lock = tlv->val[0];
 527                         break;
 528                 case INTEL_TLV_MIN_FW:
 529                         version->min_fw_build_nn = tlv->val[0];
 530                         version->min_fw_build_cw = tlv->val[1];
 531                         version->min_fw_build_yy = tlv->val[2];
 532                         break;
 533                 case INTEL_TLV_LIMITED_CCE:
 534                         version->limited_cce = tlv->val[0];
 535                         break;
 536                 case INTEL_TLV_SBE_TYPE:
 537                         version->sbe_type = tlv->val[0];
 538                         break;
 539                 case INTEL_TLV_OTP_BDADDR:
 540                         memcpy(&version->otp_bd_addr, tlv->val, tlv->len);
 541                         break;
 542                 default:
 543                         /* Ignore rest of information */
 544                         break;
 545                 }
 546                 /* consume the current tlv and move to next*/
 547                 skb_pull(skb, tlv->len + sizeof(*tlv));
 548         }
 549
 550         kfree_skb(skb);
 551         return 0;
 552 }
 553 EXPORT_SYMBOL_GPL(btintel_read_version_tlv);
 554
 555 /* ------- REGMAP IBT SUPPORT ------- */
 556
 557 #define IBT_REG_MODE_8BIT  0x00
 558 #define IBT_REG_MODE_16BIT 0x01
 559 #define IBT_REG_MODE_32BIT 0x02
 560
 561 struct regmap_ibt_context {
 562         struct hci_dev *hdev;
 563         __u16 op_write;
 564         __u16 op_read;
 565 };
 566
 567 struct ibt_cp_reg_access {
 568         __le32  addr;
 569         __u8    mode;
 570         __u8    len;
 571         __u8    data[];
 572 } __packed;
 573
 574 struct ibt_rp_reg_access {
 575         __u8    status;
 576         __le32  addr;
 577         __u8    data[];
 578 } __packed;
 579
 580 static int regmap_ibt_read(void *context, const void *addr, size_t reg_size,
 581                            void *val, size_t val_size)
 582 {
 583         struct regmap_ibt_context *ctx = context;
 584         struct ibt_cp_reg_access cp;
 585         struct ibt_rp_reg_access *rp;
 586         struct sk_buff *skb;
 587         int err = 0;
 588
 589         if (reg_size != sizeof(__le32))
 590                 return -EINVAL;
 591
 592         switch (val_size) {
 593         case 1:
 594                 cp.mode = IBT_REG_MODE_8BIT;
 595                 break;
 596         case 2:
 597                 cp.mode = IBT_REG_MODE_16BIT;
 598                 break;
 599         case 4:
 600                 cp.mode = IBT_REG_MODE_32BIT;
 601                 break;
 602         default:
 603                 return -EINVAL;
 604         }
 605
 606         /* regmap provides a little-endian formatted addr */
 607         cp.addr = *(__le32 *)addr;
 608         cp.len = val_size;
 609
 610         bt_dev_dbg(ctx->hdev, "Register (0x%x) read", le32_to_cpu(cp.addr));
 611
 612         skb = hci_cmd_sync(ctx->hdev, ctx->op_read, sizeof(cp), &cp,
 613                            HCI_CMD_TIMEOUT);
 614         if (IS_ERR(skb)) {
 615                 err = PTR_ERR(skb);
 616                 bt_dev_err(ctx->hdev, "regmap: Register (0x%x) read error (%d)",
 617                            le32_to_cpu(cp.addr), err);
 618                 return err;
 619         }
 620
 621         if (skb->len != sizeof(*rp) + val_size) {
 622                 bt_dev_err(ctx->hdev, "regmap: Register (0x%x) read error, bad len",
 623                            le32_to_cpu(cp.addr));
 624                 err = -EINVAL;
 625                 goto done;
 626         }
 627
 628         rp = (struct ibt_rp_reg_access *)skb->data;
 629
 630         if (rp->addr != cp.addr) {
 631                 bt_dev_err(ctx->hdev, "regmap: Register (0x%x) read error, bad addr",
 632                            le32_to_cpu(rp->addr));
 633                 err = -EINVAL;
 634                 goto done;
 635         }
 636
 637         memcpy(val, rp->data, val_size);
 638
 639 done:
 640         kfree_skb(skb);
 641         return err;
 642 }
 643
 644 static int regmap_ibt_gather_write(void *context,
 645                                    const void *addr, size_t reg_size,
 646                                    const void *val, size_t val_size)
 647 {
 648         struct regmap_ibt_context *ctx = context;
 649         struct ibt_cp_reg_access *cp;
 650         struct sk_buff *skb;
 651         int plen = sizeof(*cp) + val_size;
 652         u8 mode;
 653         int err = 0;
 654
 655         if (reg_size != sizeof(__le32))
 656                 return -EINVAL;
 657
 658         switch (val_size) {
 659         case 1:
 660                 mode = IBT_REG_MODE_8BIT;
 661                 break;
 662         case 2:
 663                 mode = IBT_REG_MODE_16BIT;
 664                 break;
 665         case 4:
 666                 mode = IBT_REG_MODE_32BIT;
 667                 break;
 668         default:
 669                 return -EINVAL;
 670         }
 671
 672         cp = kmalloc(plen, GFP_KERNEL);
 673         if (!cp)
 674                 return -ENOMEM;
 675
 676         /* regmap provides a little-endian formatted addr/value */
 677         cp->addr = *(__le32 *)addr;
 678         cp->mode = mode;
 679         cp->len = val_size;
 680         memcpy(&cp->data, val, val_size);
 681
 682         bt_dev_dbg(ctx->hdev, "Register (0x%x) write", le32_to_cpu(cp->addr));
 683
 684         skb = hci_cmd_sync(ctx->hdev, ctx->op_write, plen, cp, HCI_CMD_TIMEOUT);
 685         if (IS_ERR(skb)) {
 686                 err = PTR_ERR(skb);
 687                 bt_dev_err(ctx->hdev, "regmap: Register (0x%x) write error (%d)",
 688                            le32_to_cpu(cp->addr), err);
 689                 goto done;
 690         }
 691         kfree_skb(skb);
 692
 693 done:
 694         kfree(cp);
 695         return err;
 696 }
 697
 698 static int regmap_ibt_write(void *context, const void *data, size_t count)
 699 {
 700         /* data contains register+value, since we only support 32bit addr,
 701          * minimum data size is 4 bytes.
 702          */
 703         if (WARN_ONCE(count < 4, "Invalid register access"))
 704                 return -EINVAL;
 705
 706         return regmap_ibt_gather_write(context, data, 4, data + 4, count - 4);
 707 }
 708
 709 static void regmap_ibt_free_context(void *context)
 710 {
 711         kfree(context);
 712 }
 713
 714 static struct regmap_bus regmap_ibt = {
 715         .read = regmap_ibt_read,
 716         .write = regmap_ibt_write,
 717         .gather_write = regmap_ibt_gather_write,
 718         .free_context = regmap_ibt_free_context,
 719         .reg_format_endian_default = REGMAP_ENDIAN_LITTLE,
 720         .val_format_endian_default = REGMAP_ENDIAN_LITTLE,
 721 };
 722
 723 /* Config is the same for all register regions */
 724 static const struct regmap_config regmap_ibt_cfg = {
 725         .name      = "btintel_regmap",
 726         .reg_bits  = 32,
 727         .val_bits  = 32,
 728 };
 729
 730 struct regmap *btintel_regmap_init(struct hci_dev *hdev, u16 opcode_read,
 731                                    u16 opcode_write)
 732 {
 733         struct regmap_ibt_context *ctx;
 734
 735         bt_dev_info(hdev, "regmap: Init R%x-W%x region", opcode_read,
 736                     opcode_write);
 737
 738         ctx = kzalloc(sizeof(*ctx), GFP_KERNEL);
 739         if (!ctx)
 740                 return ERR_PTR(-ENOMEM);
 741
 742         ctx->op_read = opcode_read;
 743         ctx->op_write = opcode_write;
 744         ctx->hdev = hdev;
 745
 746         return regmap_init(&hdev->dev, &regmap_ibt, ctx, &regmap_ibt_cfg);
 747 }
 748 EXPORT_SYMBOL_GPL(btintel_regmap_init);
 749
 750 int btintel_send_intel_reset(struct hci_dev *hdev, u32 boot_param)
 751 {
 752         struct intel_reset params = { 0x00, 0x01, 0x00, 0x01, 0x00000000 };
 753         struct sk_buff *skb;
 754
 755         params.boot_param = cpu_to_le32(boot_param);
 756
 757         skb = __hci_cmd_sync(hdev, 0xfc01, sizeof(params), &params,
 758                              HCI_INIT_TIMEOUT);
 759         if (IS_ERR(skb)) {
 760                 bt_dev_err(hdev, "Failed to send Intel Reset command");
 761                 return PTR_ERR(skb);
 762         }
 763
 764         kfree_skb(skb);
 765
 766         return 0;
 767 }
 768 EXPORT_SYMBOL_GPL(btintel_send_intel_reset);
 769
 770 int btintel_read_boot_params(struct hci_dev *hdev,
 771                              struct intel_boot_params *params)
 772 {
 773         struct sk_buff *skb;
 774
 775         skb = __hci_cmd_sync(hdev, 0xfc0d, 0, NULL, HCI_INIT_TIMEOUT);
 776         if (IS_ERR(skb)) {
 777                 bt_dev_err(hdev, "Reading Intel boot parameters failed (%ld)",
 778                            PTR_ERR(skb));
 779                 return PTR_ERR(skb);
 780         }
 781
 782         if (skb->len != sizeof(*params)) {
 783                 bt_dev_err(hdev, "Intel boot parameters size mismatch");
 784                 kfree_skb(skb);
 785                 return -EILSEQ;
 786         }
 787
 788         memcpy(params, skb->data, sizeof(*params));
 789
 790         kfree_skb(skb);
 791
 792         if (params->status) {
 793                 bt_dev_err(hdev, "Intel boot parameters command failed (%02x)",
 794                            params->status);
 795                 return -bt_to_errno(params->status);
 796         }
 797
 798         bt_dev_info(hdev, "Device revision is %u",
 799                     le16_to_cpu(params->dev_revid));
 800
 801         bt_dev_info(hdev, "Secure boot is %s",
 802                     params->secure_boot ? "enabled" : "disabled");
 803
 804         bt_dev_info(hdev, "OTP lock is %s",
 805                     params->otp_lock ? "enabled" : "disabled");
 806
 807         bt_dev_info(hdev, "API lock is %s",
 808                     params->api_lock ? "enabled" : "disabled");
 809
 810         bt_dev_info(hdev, "Debug lock is %s",
 811                     params->debug_lock ? "enabled" : "disabled");
 812
 813         bt_dev_info(hdev, "Minimum firmware build %u week %u %u",
 814                     params->min_fw_build_nn, params->min_fw_build_cw,
 815                     2000 + params->min_fw_build_yy);
 816
 817         return 0;
 818 }
 819 EXPORT_SYMBOL_GPL(btintel_read_boot_params);
 820
 821 static int btintel_sfi_rsa_header_secure_send(struct hci_dev *hdev,
 822                                               const struct firmware *fw)
 823 {
 824         int err;
 825
 826         /* Start the firmware download transaction with the Init fragment
 827          * represented by the 128 bytes of CSS header.
 828          */
 829         err = btintel_secure_send(hdev, 0x00, 128, fw->data);
 830         if (err < 0) {
 831                 bt_dev_err(hdev, "Failed to send firmware header (%d)", err);
 832                 goto done;
 833         }
 834
 835         /* Send the 256 bytes of public key information from the firmware
 836          * as the PKey fragment.
 837          */
 838         err = btintel_secure_send(hdev, 0x03, 256, fw->data + 128);
 839         if (err < 0) {
 840                 bt_dev_err(hdev, "Failed to send firmware pkey (%d)", err);
 841                 goto done;
 842         }
 843
 844         /* Send the 256 bytes of signature information from the firmware
 845          * as the Sign fragment.
 846          */
 847         err = btintel_secure_send(hdev, 0x02, 256, fw->data + 388);
 848         if (err < 0) {
 849                 bt_dev_err(hdev, "Failed to send firmware signature (%d)", err);
 850                 goto done;
 851         }
 852
 853 done:
 854         return err;
 855 }
 856
 857 static int btintel_sfi_ecdsa_header_secure_send(struct hci_dev *hdev,
 858                                                 const struct firmware *fw)
 859 {
 860         int err;
 861
 862         /* Start the firmware download transaction with the Init fragment
 863          * represented by the 128 bytes of CSS header.
 864          */
 865         err = btintel_secure_send(hdev, 0x00, 128, fw->data + 644);
 866         if (err < 0) {
 867                 bt_dev_err(hdev, "Failed to send firmware header (%d)", err);
 868                 return err;
 869         }
 870
 871         /* Send the 96 bytes of public key information from the firmware
 872          * as the PKey fragment.
 873          */
 874         err = btintel_secure_send(hdev, 0x03, 96, fw->data + 644 + 128);
 875         if (err < 0) {
 876                 bt_dev_err(hdev, "Failed to send firmware pkey (%d)", err);
 877                 return err;
 878         }
 879
 880         /* Send the 96 bytes of signature information from the firmware
 881          * as the Sign fragment
 882          */
 883         err = btintel_secure_send(hdev, 0x02, 96, fw->data + 644 + 224);
 884         if (err < 0) {
 885                 bt_dev_err(hdev, "Failed to send firmware signature (%d)",
 886                            err);
 887                 return err;
 888         }
 889         return 0;
 890 }
 891
 892 static int btintel_download_firmware_payload(struct hci_dev *hdev,
 893                                              const struct firmware *fw,
 894                                              size_t offset)
 895 {
 896         int err;
 897         const u8 *fw_ptr;
 898         u32 frag_len;
 899
 900         fw_ptr = fw->data + offset;
 901         frag_len = 0;
 902         err = -EINVAL;
 903
 904         while (fw_ptr - fw->data < fw->size) {
 905                 struct hci_command_hdr *cmd = (void *)(fw_ptr + frag_len);
 906
 907                 frag_len += sizeof(*cmd) + cmd->plen;
 908
 909                 /* The parameter length of the secure send command requires
 910                  * a 4 byte alignment. It happens so that the firmware file
 911                  * contains proper Intel_NOP commands to align the fragments
 912                  * as needed.
 913                  *
 914                  * Send set of commands with 4 byte alignment from the
 915                  * firmware data buffer as a single Data fragement.
 916                  */
 917                 if (!(frag_len % 4)) {
 918                         err = btintel_secure_send(hdev, 0x01, frag_len, fw_ptr);
 919                         if (err < 0) {
 920                                 bt_dev_err(hdev,
 921                                            "Failed to send firmware data (%d)",
 922                                            err);
 923                                 goto done;
 924                         }
 925
 926                         fw_ptr += frag_len;
 927                         frag_len = 0;
 928                 }
 929         }
 930
 931 done:
 932         return err;
 933 }
 934
 935 static bool btintel_firmware_version(struct hci_dev *hdev,
 936                                      u8 num, u8 ww, u8 yy,
 937                                      const struct firmware *fw,
 938                                      u32 *boot_addr)
 939 {
 940         const u8 *fw_ptr;
 941
 942         fw_ptr = fw->data;
 943
 944         while (fw_ptr - fw->data < fw->size) {
 945                 struct hci_command_hdr *cmd = (void *)(fw_ptr);
 946
 947                 /* Each SKU has a different reset parameter to use in the
 948                  * HCI_Intel_Reset command and it is embedded in the firmware
 949                  * data. So, instead of using static value per SKU, check
 950                  * the firmware data and save it for later use.
 951                  */
 952                 if (le16_to_cpu(cmd->opcode) == CMD_WRITE_BOOT_PARAMS) {
 953                         struct cmd_write_boot_params *params;
 954
 955                         params = (void *)(fw_ptr + sizeof(*cmd));
 956
 957                         bt_dev_info(hdev, "Boot Address: 0x%x",
 958                                     le32_to_cpu(params->boot_addr));
 959
 960                         bt_dev_info(hdev, "Firmware Version: %u-%u.%u",
 961                                     params->fw_build_num, params->fw_build_ww,
 962                                     params->fw_build_yy);
 963
 964                         return (num == params->fw_build_num &&
 965                                 ww == params->fw_build_ww &&
 966                                 yy == params->fw_build_yy);
 967                 }
 968
 969                 fw_ptr += sizeof(*cmd) + cmd->plen;
 970         }
 971
 972         return false;
 973 }
 974
 975 int btintel_download_firmware(struct hci_dev *hdev,
 976                               struct intel_version *ver,
 977                               const struct firmware *fw,
 978                               u32 *boot_param)
 979 {
 980         int err;
 981
 982         /* SfP and WsP don't seem to update the firmware version on file
 983          * so version checking is currently not possible.
 984          */
 985         switch (ver->hw_variant) {
 986         case 0x0b:      /* SfP */
 987         case 0x0c:      /* WsP */
 988                 /* Skip version checking */
 989                 break;
 990         default:
 991                 /* Skip download if firmware has the same version */
 992                 if (btintel_firmware_version(hdev, ver->fw_build_num,
 993                                              ver->fw_build_ww, ver->fw_build_yy,
 994                                              fw, boot_param)) {
 995                         bt_dev_info(hdev, "Firmware already loaded");
 996                         /* Return -EALREADY to indicate that the firmware has
 997                          * already been loaded.
 998                          */
 999                         return -EALREADY;
1000                 }
1001         }
1002
1003         /* The firmware variant determines if the device is in bootloader
1004          * mode or is running operational firmware. The value 0x06 identifies
1005          * the bootloader and the value 0x23 identifies the operational
1006          * firmware.
1007          *
1008          * If the firmware version has changed that means it needs to be reset
1009          * to bootloader when operational so the new firmware can be loaded.
1010          */
1011         if (ver->fw_variant == 0x23)
1012                 return -EINVAL;
1013
1014         err = btintel_sfi_rsa_header_secure_send(hdev, fw);
1015         if (err)
1016                 return err;
1017
1018         return btintel_download_firmware_payload(hdev, fw, RSA_HEADER_LEN);
1019 }
1020 EXPORT_SYMBOL_GPL(btintel_download_firmware);
1021
1022 int btintel_download_firmware_newgen(struct hci_dev *hdev,
1023                                      struct intel_version_tlv *ver,
1024                                      const struct firmware *fw, u32 *boot_param,
1025                                      u8 hw_variant, u8 sbe_type)
1026 {
1027         int err;
1028         u32 css_header_ver;
1029
1030         /* Skip download if firmware has the same version */
1031         if (btintel_firmware_version(hdev, ver->min_fw_build_nn,
1032                                      ver->min_fw_build_cw, ver->min_fw_build_yy,
1033                                      fw, boot_param)) {
1034                 bt_dev_info(hdev, "Firmware already loaded");
1035                 /* Return -EALREADY to indicate that firmware has already been
1036                  * loaded.
1037                  */
1038                 return -EALREADY;
1039         }
1040
1041         /* The firmware variant determines if the device is in bootloader
1042          * mode or is running operational firmware. The value 0x01 identifies
1043          * the bootloader and the value 0x03 identifies the operational
1044          * firmware.
1045          *
1046          * If the firmware version has changed that means it needs to be reset
1047          * to bootloader when operational so the new firmware can be loaded.
1048          */
1049         if (ver->img_type == 0x03)
1050                 return -EINVAL;
1051
1052         /* iBT hardware variants 0x0b, 0x0c, 0x11, 0x12, 0x13, 0x14 support
1053          * only RSA secure boot engine. Hence, the corresponding sfi file will
1054          * have RSA header of 644 bytes followed by Command Buffer.
1055          *
1056          * iBT hardware variants 0x17, 0x18 onwards support both RSA and ECDSA
1057          * secure boot engine. As a result, the corresponding sfi file will
1058          * have RSA header of 644, ECDSA header of 320 bytes followed by
1059          * Command Buffer.
1060          *
1061          * CSS Header byte positions 0x08 to 0x0B represent the CSS Header
1062          * version: RSA(0x00010000) , ECDSA (0x00020000)
1063          */
1064         css_header_ver = get_unaligned_le32(fw->data + CSS_HEADER_OFFSET);
1065         if (css_header_ver != 0x00010000) {
1066                 bt_dev_err(hdev, "Invalid CSS Header version");
1067                 return -EINVAL;
1068         }
1069
1070         if (hw_variant <= 0x14) {
1071                 if (sbe_type != 0x00) {
1072                         bt_dev_err(hdev, "Invalid SBE type for hardware variant (%d)",
1073                                    hw_variant);
1074                         return -EINVAL;
1075                 }
1076
1077                 err = btintel_sfi_rsa_header_secure_send(hdev, fw);
1078                 if (err)
1079                         return err;
1080
1081                 err = btintel_download_firmware_payload(hdev, fw, RSA_HEADER_LEN);
1082                 if (err)
1083                         return err;
1084         } else if (hw_variant >= 0x17) {
1085                 /* Check if CSS header for ECDSA follows the RSA header */
1086                 if (fw->data[ECDSA_OFFSET] != 0x06)
1087                         return -EINVAL;
1088
1089                 /* Check if the CSS Header version is ECDSA(0x00020000) */
1090                 css_header_ver = get_unaligned_le32(fw->data + ECDSA_OFFSET + CSS_HEADER_OFFSET);
1091                 if (css_header_ver != 0x00020000) {
1092                         bt_dev_err(hdev, "Invalid CSS Header version");
1093                         return -EINVAL;
1094                 }
1095
1096                 if (sbe_type == 0x00) {
1097                         err = btintel_sfi_rsa_header_secure_send(hdev, fw);
1098                         if (err)
1099                                 return err;
1100
1101                         err = btintel_download_firmware_payload(hdev, fw,
1102                                                                 RSA_HEADER_LEN + ECDSA_HEADER_LEN);
1103                         if (err)
1104                                 return err;
1105                 } else if (sbe_type == 0x01) {
1106                         err = btintel_sfi_ecdsa_header_secure_send(hdev, fw);
1107                         if (err)
1108                                 return err;
1109
1110                         err = btintel_download_firmware_payload(hdev, fw,
1111                                                                 RSA_HEADER_LEN + ECDSA_HEADER_LEN);
1112                         if (err)
1113                                 return err;
1114                 }
1115         }
1116         return 0;
1117 }
1118 EXPORT_SYMBOL_GPL(btintel_download_firmware_newgen);
1119
1120 void btintel_reset_to_bootloader(struct hci_dev *hdev)
1121 {
1122         struct intel_reset params;
1123         struct sk_buff *skb;
1124
1125         /* Send Intel Reset command. This will result in
1126          * re-enumeration of BT controller.
1127          *
1128          * Intel Reset parameter description:
1129          * reset_type :   0x00 (Soft reset),
1130          *                0x01 (Hard reset)
1131          * patch_enable : 0x00 (Do not enable),
1132          *                0x01 (Enable)
1133          * ddc_reload :   0x00 (Do not reload),
1134          *                0x01 (Reload)
1135          * boot_option:   0x00 (Current image),
1136          *                0x01 (Specified boot address)
1137          * boot_param:    Boot address
1138          *
1139          */
1140         params.reset_type = 0x01;
1141         params.patch_enable = 0x01;
1142         params.ddc_reload = 0x01;
1143         params.boot_option = 0x00;
1144         params.boot_param = cpu_to_le32(0x00000000);
1145
1146         skb = __hci_cmd_sync(hdev, 0xfc01, sizeof(params),
1147                              &params, HCI_INIT_TIMEOUT);
1148         if (IS_ERR(skb)) {
1149                 bt_dev_err(hdev, "FW download error recovery failed (%ld)",
1150                            PTR_ERR(skb));
1151                 return;
1152         }
1153         bt_dev_info(hdev, "Intel reset sent to retry FW download");
1154         kfree_skb(skb);
1155
1156         /* Current Intel BT controllers(ThP/JfP) hold the USB reset
1157          * lines for 2ms when it receives Intel Reset in bootloader mode.
1158          * Whereas, the upcoming Intel BT controllers will hold USB reset
1159          * for 150ms. To keep the delay generic, 150ms is chosen here.
1160          */
1161         msleep(150);
1162 }
1163 EXPORT_SYMBOL_GPL(btintel_reset_to_bootloader);
1164
1165 int btintel_read_debug_features(struct hci_dev *hdev,
1166                                 struct intel_debug_features *features)
1167 {
1168         struct sk_buff *skb;
1169         u8 page_no = 1;
1170
1171         /* Intel controller supports two pages, each page is of 128-bit
1172          * feature bit mask. And each bit defines specific feature support
1173          */
1174         skb = __hci_cmd_sync(hdev, 0xfca6, sizeof(page_no), &page_no,
1175                              HCI_INIT_TIMEOUT);
1176         if (IS_ERR(skb)) {
1177                 bt_dev_err(hdev, "Reading supported features failed (%ld)",
1178                            PTR_ERR(skb));
1179                 return PTR_ERR(skb);
1180         }
1181
1182         if (skb->len != (sizeof(features->page1) + 3)) {
1183                 bt_dev_err(hdev, "Supported features event size mismatch");
1184                 kfree_skb(skb);
1185                 return -EILSEQ;
1186         }
1187
1188         memcpy(features->page1, skb->data + 3, sizeof(features->page1));
1189
1190         /* Read the supported features page2 if required in future.
1191          */
1192         kfree_skb(skb);
1193         return 0;
1194 }
1195 EXPORT_SYMBOL_GPL(btintel_read_debug_features);
1196
1197 int btintel_set_debug_features(struct hci_dev *hdev,
1198                                const struct intel_debug_features *features)
1199 {
1200         u8 mask[11] = { 0x0a, 0x92, 0x02, 0x07, 0x00, 0x00, 0x00, 0x00,
1201                         0x00, 0x00, 0x00 };
1202         struct sk_buff *skb;
1203
1204         if (!features)
1205                 return -EINVAL;
1206
1207         if (!(features->page1[0] & 0x3f)) {
1208                 bt_dev_info(hdev, "Telemetry exception format not supported");
1209                 return 0;
1210         }
1211
1212         skb = __hci_cmd_sync(hdev, 0xfc8b, 11, mask, HCI_INIT_TIMEOUT);
1213         if (IS_ERR(skb)) {
1214                 bt_dev_err(hdev, "Setting Intel telemetry ddc write event mask failed (%ld)",
1215                            PTR_ERR(skb));
1216                 return PTR_ERR(skb);
1217         }
1218
1219         kfree_skb(skb);
1220         return 0;
1221 }
1222 EXPORT_SYMBOL_GPL(btintel_set_debug_features);
1223
1224 MODULE_AUTHOR("Marcel Holtmann <marcel@holtmann.org>");
1225 MODULE_DESCRIPTION("Bluetooth support for Intel devices ver " VERSION);
1226 MODULE_VERSION(VERSION);
1227 MODULE_LICENSE("GPL");
1228 MODULE_FIRMWARE("intel/ibt-11-5.sfi");
1229 MODULE_FIRMWARE("intel/ibt-11-5.ddc");
1230 MODULE_FIRMWARE("intel/ibt-12-16.sfi");
1231 MODULE_FIRMWARE("intel/ibt-12-16.ddc");