drivers/bluetooth/btintel.c

   1 // SPDX-License-Identifier: GPL-2.0-or-later
   2 /*
   3  *
   4  *  Bluetooth support for Intel devices
   5  *
   6  *  Copyright (C) 2015  Intel Corporation
   7  */
   8
   9 #include <linux/module.h>
  10 #include <linux/firmware.h>
  11 #include <linux/regmap.h>
  12 #include <asm/unaligned.h>
  13
  14 #include <net/bluetooth/bluetooth.h>
  15 #include <net/bluetooth/hci_core.h>
  16
  17 #include "btintel.h"
  18
  19 #define VERSION "0.1"
  20
  21 #define BDADDR_INTEL            (&(bdaddr_t){{0x00, 0x8b, 0x9e, 0x19, 0x03, 0x00}})
  22 #define RSA_HEADER_LEN          644
  23 #define CSS_HEADER_OFFSET       8
  24 #define ECDSA_OFFSET            644
  25 #define ECDSA_HEADER_LEN        320
  26
  27 #define CMD_WRITE_BOOT_PARAMS   0xfc0e
  28 struct cmd_write_boot_params {
  29         u32 boot_addr;
  30         u8  fw_build_num;
  31         u8  fw_build_ww;
  32         u8  fw_build_yy;
  33 } __packed;
  34
  35 int btintel_check_bdaddr(struct hci_dev *hdev)
  36 {
  37         struct hci_rp_read_bd_addr *bda;
  38         struct sk_buff *skb;
  39
  40         skb = __hci_cmd_sync(hdev, HCI_OP_READ_BD_ADDR, 0, NULL,
  41                              HCI_INIT_TIMEOUT);
  42         if (IS_ERR(skb)) {
  43                 int err = PTR_ERR(skb);
  44                 bt_dev_err(hdev, "Reading Intel device address failed (%d)",
  45                            err);
  46                 return err;
  47         }
  48
  49         if (skb->len != sizeof(*bda)) {
  50                 bt_dev_err(hdev, "Intel device address length mismatch");
  51                 kfree_skb(skb);
  52                 return -EIO;
  53         }
  54
  55         bda = (struct hci_rp_read_bd_addr *)skb->data;
  56
  57         /* For some Intel based controllers, the default Bluetooth device
  58          * address 00:03:19:9E:8B:00 can be found. These controllers are
  59          * fully operational, but have the danger of duplicate addresses
  60          * and that in turn can cause problems with Bluetooth operation.
  61          */
  62         if (!bacmp(&bda->bdaddr, BDADDR_INTEL)) {
  63                 bt_dev_err(hdev, "Found Intel default device address (%pMR)",
  64                            &bda->bdaddr);
  65                 set_bit(HCI_QUIRK_INVALID_BDADDR, &hdev->quirks);
  66         }
  67
  68         kfree_skb(skb);
  69
  70         return 0;
  71 }
  72 EXPORT_SYMBOL_GPL(btintel_check_bdaddr);
  73
  74 int btintel_enter_mfg(struct hci_dev *hdev)
  75 {
  76         static const u8 param[] = { 0x01, 0x00 };
  77         struct sk_buff *skb;
  78
  79         skb = __hci_cmd_sync(hdev, 0xfc11, 2, param, HCI_CMD_TIMEOUT);
  80         if (IS_ERR(skb)) {
  81                 bt_dev_err(hdev, "Entering manufacturer mode failed (%ld)",
  82                            PTR_ERR(skb));
  83                 return PTR_ERR(skb);
  84         }
  85         kfree_skb(skb);
  86
  87         return 0;
  88 }
  89 EXPORT_SYMBOL_GPL(btintel_enter_mfg);
  90
  91 int btintel_exit_mfg(struct hci_dev *hdev, bool reset, bool patched)
  92 {
  93         u8 param[] = { 0x00, 0x00 };
  94         struct sk_buff *skb;
  95
  96         /* The 2nd command parameter specifies the manufacturing exit method:
  97          * 0x00: Just disable the manufacturing mode (0x00).
  98          * 0x01: Disable manufacturing mode and reset with patches deactivated.
  99          * 0x02: Disable manufacturing mode and reset with patches activated.
 100          */
 101         if (reset)
 102                 param[1] |= patched ? 0x02 : 0x01;
 103
 104         skb = __hci_cmd_sync(hdev, 0xfc11, 2, param, HCI_CMD_TIMEOUT);
 105         if (IS_ERR(skb)) {
 106                 bt_dev_err(hdev, "Exiting manufacturer mode failed (%ld)",
 107                            PTR_ERR(skb));
 108                 return PTR_ERR(skb);
 109         }
 110         kfree_skb(skb);
 111
 112         return 0;
 113 }
 114 EXPORT_SYMBOL_GPL(btintel_exit_mfg);
 115
 116 int btintel_set_bdaddr(struct hci_dev *hdev, const bdaddr_t *bdaddr)
 117 {
 118         struct sk_buff *skb;
 119         int err;
 120
 121         skb = __hci_cmd_sync(hdev, 0xfc31, 6, bdaddr, HCI_INIT_TIMEOUT);
 122         if (IS_ERR(skb)) {
 123                 err = PTR_ERR(skb);
 124                 bt_dev_err(hdev, "Changing Intel device address failed (%d)",
 125                            err);
 126                 return err;
 127         }
 128         kfree_skb(skb);
 129
 130         return 0;
 131 }
 132 EXPORT_SYMBOL_GPL(btintel_set_bdaddr);
 133
 134 int btintel_set_diag(struct hci_dev *hdev, bool enable)
 135 {
 136         struct sk_buff *skb;
 137         u8 param[3];
 138         int err;
 139
 140         if (enable) {
 141                 param[0] = 0x03;
 142                 param[1] = 0x03;
 143                 param[2] = 0x03;
 144         } else {
 145                 param[0] = 0x00;
 146                 param[1] = 0x00;
 147                 param[2] = 0x00;
 148         }
 149
 150         skb = __hci_cmd_sync(hdev, 0xfc43, 3, param, HCI_INIT_TIMEOUT);
 151         if (IS_ERR(skb)) {
 152                 err = PTR_ERR(skb);
 153                 if (err == -ENODATA)
 154                         goto done;
 155                 bt_dev_err(hdev, "Changing Intel diagnostic mode failed (%d)",
 156                            err);
 157                 return err;
 158         }
 159         kfree_skb(skb);
 160
 161 done:
 162         btintel_set_event_mask(hdev, enable);
 163         return 0;
 164 }
 165 EXPORT_SYMBOL_GPL(btintel_set_diag);
 166
 167 static int btintel_set_diag_mfg(struct hci_dev *hdev, bool enable)
 168 {
 169         int err, ret;
 170
 171         err = btintel_enter_mfg(hdev);
 172         if (err)
 173                 return err;
 174
 175         ret = btintel_set_diag(hdev, enable);
 176
 177         err = btintel_exit_mfg(hdev, false, false);
 178         if (err)
 179                 return err;
 180
 181         return ret;
 182 }
 183
 184 void btintel_hw_error(struct hci_dev *hdev, u8 code)
 185 {
 186         struct sk_buff *skb;
 187         u8 type = 0x00;
 188
 189         bt_dev_err(hdev, "Hardware error 0x%2.2x", code);
 190
 191         skb = __hci_cmd_sync(hdev, HCI_OP_RESET, 0, NULL, HCI_INIT_TIMEOUT);
 192         if (IS_ERR(skb)) {
 193                 bt_dev_err(hdev, "Reset after hardware error failed (%ld)",
 194                            PTR_ERR(skb));
 195                 return;
 196         }
 197         kfree_skb(skb);
 198
 199         skb = __hci_cmd_sync(hdev, 0xfc22, 1, &type, HCI_INIT_TIMEOUT);
 200         if (IS_ERR(skb)) {
 201                 bt_dev_err(hdev, "Retrieving Intel exception info failed (%ld)",
 202                            PTR_ERR(skb));
 203                 return;
 204         }
 205
 206         if (skb->len != 13) {
 207                 bt_dev_err(hdev, "Exception info size mismatch");
 208                 kfree_skb(skb);
 209                 return;
 210         }
 211
 212         bt_dev_err(hdev, "Exception info %s", (char *)(skb->data + 1));
 213
 214         kfree_skb(skb);
 215 }
 216 EXPORT_SYMBOL_GPL(btintel_hw_error);
 217
 218 int btintel_version_info(struct hci_dev *hdev, struct intel_version *ver)
 219 {
 220         const char *variant;
 221
 222         /* The hardware platform number has a fixed value of 0x37 and
 223          * for now only accept this single value.
 224          */
 225         if (ver->hw_platform != 0x37) {
 226                 bt_dev_err(hdev, "Unsupported Intel hardware platform (%u)",
 227                            ver->hw_platform);
 228                 return -EINVAL;
 229         }
 230
 231         /* Check for supported iBT hardware variants of this firmware
 232          * loading method.
 233          *
 234          * This check has been put in place to ensure correct forward
 235          * compatibility options when newer hardware variants come along.
 236          */
 237         switch (ver->hw_variant) {
 238         case 0x07:      /* WP - Legacy ROM */
 239         case 0x08:      /* StP - Legacy ROM */
 240         case 0x0b:      /* SfP */
 241         case 0x0c:      /* WsP */
 242         case 0x11:      /* JfP */
 243         case 0x12:      /* ThP */
 244         case 0x13:      /* HrP */
 245         case 0x14:      /* CcP */
 246                 break;
 247         default:
 248                 bt_dev_err(hdev, "Unsupported Intel hardware variant (%u)",
 249                            ver->hw_variant);
 250                 return -EINVAL;
 251         }
 252
 253         switch (ver->fw_variant) {
 254         case 0x01:
 255                 variant = "Legacy ROM 2.5";
 256                 break;
 257         case 0x06:
 258                 variant = "Bootloader";
 259                 break;
 260         case 0x22:
 261                 variant = "Legacy ROM 2.x";
 262                 break;
 263         case 0x23:
 264                 variant = "Firmware";
 265                 break;
 266         default:
 267                 bt_dev_err(hdev, "Unsupported firmware variant(%02x)", ver->fw_variant);
 268                 return -EINVAL;
 269         }
 270
 271         bt_dev_info(hdev, "%s revision %u.%u build %u week %u %u",
 272                     variant, ver->fw_revision >> 4, ver->fw_revision & 0x0f,
 273                     ver->fw_build_num, ver->fw_build_ww,
 274                     2000 + ver->fw_build_yy);
 275
 276         return 0;
 277 }
 278 EXPORT_SYMBOL_GPL(btintel_version_info);
 279
 280 int btintel_secure_send(struct hci_dev *hdev, u8 fragment_type, u32 plen,
 281                         const void *param)
 282 {
 283         while (plen > 0) {
 284                 struct sk_buff *skb;
 285                 u8 cmd_param[253], fragment_len = (plen > 252) ? 252 : plen;
 286
 287                 cmd_param[0] = fragment_type;
 288                 memcpy(cmd_param + 1, param, fragment_len);
 289
 290                 skb = __hci_cmd_sync(hdev, 0xfc09, fragment_len + 1,
 291                                      cmd_param, HCI_INIT_TIMEOUT);
 292                 if (IS_ERR(skb))
 293                         return PTR_ERR(skb);
 294
 295                 kfree_skb(skb);
 296
 297                 plen -= fragment_len;
 298                 param += fragment_len;
 299         }
 300
 301         return 0;
 302 }
 303 EXPORT_SYMBOL_GPL(btintel_secure_send);
 304
 305 int btintel_load_ddc_config(struct hci_dev *hdev, const char *ddc_name)
 306 {
 307         const struct firmware *fw;
 308         struct sk_buff *skb;
 309         const u8 *fw_ptr;
 310         int err;
 311
 312         err = request_firmware_direct(&fw, ddc_name, &hdev->dev);
 313         if (err < 0) {
 314                 bt_dev_err(hdev, "Failed to load Intel DDC file %s (%d)",
 315                            ddc_name, err);
 316                 return err;
 317         }
 318
 319         bt_dev_info(hdev, "Found Intel DDC parameters: %s", ddc_name);
 320
 321         fw_ptr = fw->data;
 322
 323         /* DDC file contains one or more DDC structure which has
 324          * Length (1 byte), DDC ID (2 bytes), and DDC value (Length - 2).
 325          */
 326         while (fw->size > fw_ptr - fw->data) {
 327                 u8 cmd_plen = fw_ptr[0] + sizeof(u8);
 328
 329                 skb = __hci_cmd_sync(hdev, 0xfc8b, cmd_plen, fw_ptr,
 330                                      HCI_INIT_TIMEOUT);
 331                 if (IS_ERR(skb)) {
 332                         bt_dev_err(hdev, "Failed to send Intel_Write_DDC (%ld)",
 333                                    PTR_ERR(skb));
 334                         release_firmware(fw);
 335                         return PTR_ERR(skb);
 336                 }
 337
 338                 fw_ptr += cmd_plen;
 339                 kfree_skb(skb);
 340         }
 341
 342         release_firmware(fw);
 343
 344         bt_dev_info(hdev, "Applying Intel DDC parameters completed");
 345
 346         return 0;
 347 }
 348 EXPORT_SYMBOL_GPL(btintel_load_ddc_config);
 349
 350 int btintel_set_event_mask(struct hci_dev *hdev, bool debug)
 351 {
 352         u8 mask[8] = { 0x87, 0x0c, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 };
 353         struct sk_buff *skb;
 354         int err;
 355
 356         if (debug)
 357                 mask[1] |= 0x62;
 358
 359         skb = __hci_cmd_sync(hdev, 0xfc52, 8, mask, HCI_INIT_TIMEOUT);
 360         if (IS_ERR(skb)) {
 361                 err = PTR_ERR(skb);
 362                 bt_dev_err(hdev, "Setting Intel event mask failed (%d)", err);
 363                 return err;
 364         }
 365         kfree_skb(skb);
 366
 367         return 0;
 368 }
 369 EXPORT_SYMBOL_GPL(btintel_set_event_mask);
 370
 371 int btintel_set_event_mask_mfg(struct hci_dev *hdev, bool debug)
 372 {
 373         int err, ret;
 374
 375         err = btintel_enter_mfg(hdev);
 376         if (err)
 377                 return err;
 378
 379         ret = btintel_set_event_mask(hdev, debug);
 380
 381         err = btintel_exit_mfg(hdev, false, false);
 382         if (err)
 383                 return err;
 384
 385         return ret;
 386 }
 387 EXPORT_SYMBOL_GPL(btintel_set_event_mask_mfg);
 388
 389 int btintel_read_version(struct hci_dev *hdev, struct intel_version *ver)
 390 {
 391         struct sk_buff *skb;
 392
 393         skb = __hci_cmd_sync(hdev, 0xfc05, 0, NULL, HCI_CMD_TIMEOUT);
 394         if (IS_ERR(skb)) {
 395                 bt_dev_err(hdev, "Reading Intel version information failed (%ld)",
 396                            PTR_ERR(skb));
 397                 return PTR_ERR(skb);
 398         }
 399
 400         if (skb->len != sizeof(*ver)) {
 401                 bt_dev_err(hdev, "Intel version event size mismatch");
 402                 kfree_skb(skb);
 403                 return -EILSEQ;
 404         }
 405
 406         memcpy(ver, skb->data, sizeof(*ver));
 407
 408         kfree_skb(skb);
 409
 410         return 0;
 411 }
 412 EXPORT_SYMBOL_GPL(btintel_read_version);
 413
 414 int btintel_version_info_tlv(struct hci_dev *hdev, struct intel_version_tlv *version)
 415 {
 416         const char *variant;
 417
 418         /* The hardware platform number has a fixed value of 0x37 and
 419          * for now only accept this single value.
 420          */
 421         if (INTEL_HW_PLATFORM(version->cnvi_bt) != 0x37) {
 422                 bt_dev_err(hdev, "Unsupported Intel hardware platform (0x%2x)",
 423                            INTEL_HW_PLATFORM(version->cnvi_bt));
 424                 return -EINVAL;
 425         }
 426
 427         /* Check for supported iBT hardware variants of this firmware
 428          * loading method.
 429          *
 430          * This check has been put in place to ensure correct forward
 431          * compatibility options when newer hardware variants come along.
 432          */
 433         switch (INTEL_HW_VARIANT(version->cnvi_bt)) {
 434         case 0x17:      /* TyP */
 435         case 0x18:      /* Slr */
 436         case 0x19:      /* Slr-F */
 437                 break;
 438         default:
 439                 bt_dev_err(hdev, "Unsupported Intel hardware variant (0x%x)",
 440                            INTEL_HW_VARIANT(version->cnvi_bt));
 441                 return -EINVAL;
 442         }
 443
 444         switch (version->img_type) {
 445         case 0x01:
 446                 variant = "Bootloader";
 447                 /* It is required that every single firmware fragment is acknowledged
 448                  * with a command complete event. If the boot parameters indicate
 449                  * that this bootloader does not send them, then abort the setup.
 450                  */
 451                 if (version->limited_cce != 0x00) {
 452                         bt_dev_err(hdev, "Unsupported Intel firmware loading method (0x%x)",
 453                                    version->limited_cce);
 454                         return -EINVAL;
 455                 }
 456
 457                 /* Secure boot engine type should be either 1 (ECDSA) or 0 (RSA) */
 458                 if (version->sbe_type > 0x01) {
 459                         bt_dev_err(hdev, "Unsupported Intel secure boot engine type (0x%x)",
 460                                    version->sbe_type);
 461                         return -EINVAL;
 462                 }
 463
 464                 bt_dev_info(hdev, "Device revision is %u", version->dev_rev_id);
 465                 bt_dev_info(hdev, "Secure boot is %s",
 466                             version->secure_boot ? "enabled" : "disabled");
 467                 bt_dev_info(hdev, "OTP lock is %s",
 468                             version->otp_lock ? "enabled" : "disabled");
 469                 bt_dev_info(hdev, "API lock is %s",
 470                             version->api_lock ? "enabled" : "disabled");
 471                 bt_dev_info(hdev, "Debug lock is %s",
 472                             version->debug_lock ? "enabled" : "disabled");
 473                 bt_dev_info(hdev, "Minimum firmware build %u week %u %u",
 474                             version->min_fw_build_nn, version->min_fw_build_cw,
 475                             2000 + version->min_fw_build_yy);
 476                 break;
 477         case 0x03:
 478                 variant = "Firmware";
 479                 break;
 480         default:
 481                 bt_dev_err(hdev, "Unsupported image type(%02x)", version->img_type);
 482                 return -EINVAL;
 483         }
 484
 485         bt_dev_info(hdev, "%s timestamp %u.%u buildtype %u build %u", variant,
 486                     2000 + (version->timestamp >> 8), version->timestamp & 0xff,
 487                     version->build_type, version->build_num);
 488
 489         return 0;
 490 }
 491 EXPORT_SYMBOL_GPL(btintel_version_info_tlv);
 492
 493 static int btintel_parse_version_tlv(struct hci_dev *hdev,
 494                                      struct intel_version_tlv *version,
 495                                      struct sk_buff *skb)
 496 {
 497         /* Consume Command Complete Status field */
 498         skb_pull(skb, 1);
 499
 500         /* Event parameters contatin multiple TLVs. Read each of them
 501          * and only keep the required data. Also, it use existing legacy
 502          * version field like hw_platform, hw_variant, and fw_variant
 503          * to keep the existing setup flow
 504          */
 505         while (skb->len) {
 506                 struct intel_tlv *tlv;
 507
 508                 /* Make sure skb has a minimum length of the header */
 509                 if (skb->len < sizeof(*tlv))
 510                         return -EINVAL;
 511
 512                 tlv = (struct intel_tlv *)skb->data;
 513
 514                 /* Make sure skb has a enough data */
 515                 if (skb->len < tlv->len + sizeof(*tlv))
 516                         return -EINVAL;
 517
 518                 switch (tlv->type) {
 519                 case INTEL_TLV_CNVI_TOP:
 520                         version->cnvi_top = get_unaligned_le32(tlv->val);
 521                         break;
 522                 case INTEL_TLV_CNVR_TOP:
 523                         version->cnvr_top = get_unaligned_le32(tlv->val);
 524                         break;
 525                 case INTEL_TLV_CNVI_BT:
 526                         version->cnvi_bt = get_unaligned_le32(tlv->val);
 527                         break;
 528                 case INTEL_TLV_CNVR_BT:
 529                         version->cnvr_bt = get_unaligned_le32(tlv->val);
 530                         break;
 531                 case INTEL_TLV_DEV_REV_ID:
 532                         version->dev_rev_id = get_unaligned_le16(tlv->val);
 533                         break;
 534                 case INTEL_TLV_IMAGE_TYPE:
 535                         version->img_type = tlv->val[0];
 536                         break;
 537                 case INTEL_TLV_TIME_STAMP:
 538                         /* If image type is Operational firmware (0x03), then
 539                          * running FW Calendar Week and Year information can
 540                          * be extracted from Timestamp information
 541                          */
 542                         version->min_fw_build_cw = tlv->val[0];
 543                         version->min_fw_build_yy = tlv->val[1];
 544                         version->timestamp = get_unaligned_le16(tlv->val);
 545                         break;
 546                 case INTEL_TLV_BUILD_TYPE:
 547                         version->build_type = tlv->val[0];
 548                         break;
 549                 case INTEL_TLV_BUILD_NUM:
 550                         /* If image type is Operational firmware (0x03), then
 551                          * running FW build number can be extracted from the
 552                          * Build information
 553                          */
 554                         version->min_fw_build_nn = tlv->val[0];
 555                         version->build_num = get_unaligned_le32(tlv->val);
 556                         break;
 557                 case INTEL_TLV_SECURE_BOOT:
 558                         version->secure_boot = tlv->val[0];
 559                         break;
 560                 case INTEL_TLV_OTP_LOCK:
 561                         version->otp_lock = tlv->val[0];
 562                         break;
 563                 case INTEL_TLV_API_LOCK:
 564                         version->api_lock = tlv->val[0];
 565                         break;
 566                 case INTEL_TLV_DEBUG_LOCK:
 567                         version->debug_lock = tlv->val[0];
 568                         break;
 569                 case INTEL_TLV_MIN_FW:
 570                         version->min_fw_build_nn = tlv->val[0];
 571                         version->min_fw_build_cw = tlv->val[1];
 572                         version->min_fw_build_yy = tlv->val[2];
 573                         break;
 574                 case INTEL_TLV_LIMITED_CCE:
 575                         version->limited_cce = tlv->val[0];
 576                         break;
 577                 case INTEL_TLV_SBE_TYPE:
 578                         version->sbe_type = tlv->val[0];
 579                         break;
 580                 case INTEL_TLV_OTP_BDADDR:
 581                         memcpy(&version->otp_bd_addr, tlv->val,
 582                                                         sizeof(bdaddr_t));
 583                         break;
 584                 default:
 585                         /* Ignore rest of information */
 586                         break;
 587                 }
 588                 /* consume the current tlv and move to next*/
 589                 skb_pull(skb, tlv->len + sizeof(*tlv));
 590         }
 591
 592         return 0;
 593 }
 594
 595 int btintel_read_version_tlv(struct hci_dev *hdev, struct intel_version_tlv *version)
 596 {
 597         struct sk_buff *skb;
 598         const u8 param[1] = { 0xFF };
 599
 600         if (!version)
 601                 return -EINVAL;
 602
 603         skb = __hci_cmd_sync(hdev, 0xfc05, 1, param, HCI_CMD_TIMEOUT);
 604         if (IS_ERR(skb)) {
 605                 bt_dev_err(hdev, "Reading Intel version information failed (%ld)",
 606                            PTR_ERR(skb));
 607                 return PTR_ERR(skb);
 608         }
 609
 610         if (skb->data[0]) {
 611                 bt_dev_err(hdev, "Intel Read Version command failed (%02x)",
 612                            skb->data[0]);
 613                 kfree_skb(skb);
 614                 return -EIO;
 615         }
 616
 617         /* Consume Command Complete Status field */
 618         skb_pull(skb, 1);
 619
 620         /* Event parameters contatin multiple TLVs. Read each of them
 621          * and only keep the required data. Also, it use existing legacy
 622          * version field like hw_platform, hw_variant, and fw_variant
 623          * to keep the existing setup flow
 624          */
 625         while (skb->len) {
 626                 struct intel_tlv *tlv;
 627
 628                 tlv = (struct intel_tlv *)skb->data;
 629                 switch (tlv->type) {
 630                 case INTEL_TLV_CNVI_TOP:
 631                         version->cnvi_top = get_unaligned_le32(tlv->val);
 632                         break;
 633                 case INTEL_TLV_CNVR_TOP:
 634                         version->cnvr_top = get_unaligned_le32(tlv->val);
 635                         break;
 636                 case INTEL_TLV_CNVI_BT:
 637                         version->cnvi_bt = get_unaligned_le32(tlv->val);
 638                         break;
 639                 case INTEL_TLV_CNVR_BT:
 640                         version->cnvr_bt = get_unaligned_le32(tlv->val);
 641                         break;
 642                 case INTEL_TLV_DEV_REV_ID:
 643                         version->dev_rev_id = get_unaligned_le16(tlv->val);
 644                         break;
 645                 case INTEL_TLV_IMAGE_TYPE:
 646                         version->img_type = tlv->val[0];
 647                         break;
 648                 case INTEL_TLV_TIME_STAMP:
 649                         /* If image type is Operational firmware (0x03), then
 650                          * running FW Calendar Week and Year information can
 651                          * be extracted from Timestamp information
 652                          */
 653                         version->min_fw_build_cw = tlv->val[0];
 654                         version->min_fw_build_yy = tlv->val[1];
 655                         version->timestamp = get_unaligned_le16(tlv->val);
 656                         break;
 657                 case INTEL_TLV_BUILD_TYPE:
 658                         version->build_type = tlv->val[0];
 659                         break;
 660                 case INTEL_TLV_BUILD_NUM:
 661                         /* If image type is Operational firmware (0x03), then
 662                          * running FW build number can be extracted from the
 663                          * Build information
 664                          */
 665                         version->min_fw_build_nn = tlv->val[0];
 666                         version->build_num = get_unaligned_le32(tlv->val);
 667                         break;
 668                 case INTEL_TLV_SECURE_BOOT:
 669                         version->secure_boot = tlv->val[0];
 670                         break;
 671                 case INTEL_TLV_OTP_LOCK:
 672                         version->otp_lock = tlv->val[0];
 673                         break;
 674                 case INTEL_TLV_API_LOCK:
 675                         version->api_lock = tlv->val[0];
 676                         break;
 677                 case INTEL_TLV_DEBUG_LOCK:
 678                         version->debug_lock = tlv->val[0];
 679                         break;
 680                 case INTEL_TLV_MIN_FW:
 681                         version->min_fw_build_nn = tlv->val[0];
 682                         version->min_fw_build_cw = tlv->val[1];
 683                         version->min_fw_build_yy = tlv->val[2];
 684                         break;
 685                 case INTEL_TLV_LIMITED_CCE:
 686                         version->limited_cce = tlv->val[0];
 687                         break;
 688                 case INTEL_TLV_SBE_TYPE:
 689                         version->sbe_type = tlv->val[0];
 690                         break;
 691                 case INTEL_TLV_OTP_BDADDR:
 692                         memcpy(&version->otp_bd_addr, tlv->val, tlv->len);
 693                         break;
 694                 default:
 695                         /* Ignore rest of information */
 696                         break;
 697                 }
 698                 /* consume the current tlv and move to next*/
 699                 skb_pull(skb, tlv->len + sizeof(*tlv));
 700         }
 701
 702         kfree_skb(skb);
 703         return 0;
 704 }
 705 EXPORT_SYMBOL_GPL(btintel_read_version_tlv);
 706
 707 /* ------- REGMAP IBT SUPPORT ------- */
 708
 709 #define IBT_REG_MODE_8BIT  0x00
 710 #define IBT_REG_MODE_16BIT 0x01
 711 #define IBT_REG_MODE_32BIT 0x02
 712
 713 struct regmap_ibt_context {
 714         struct hci_dev *hdev;
 715         __u16 op_write;
 716         __u16 op_read;
 717 };
 718
 719 struct ibt_cp_reg_access {
 720         __le32  addr;
 721         __u8    mode;
 722         __u8    len;
 723         __u8    data[];
 724 } __packed;
 725
 726 struct ibt_rp_reg_access {
 727         __u8    status;
 728         __le32  addr;
 729         __u8    data[];
 730 } __packed;
 731
 732 static int regmap_ibt_read(void *context, const void *addr, size_t reg_size,
 733                            void *val, size_t val_size)
 734 {
 735         struct regmap_ibt_context *ctx = context;
 736         struct ibt_cp_reg_access cp;
 737         struct ibt_rp_reg_access *rp;
 738         struct sk_buff *skb;
 739         int err = 0;
 740
 741         if (reg_size != sizeof(__le32))
 742                 return -EINVAL;
 743
 744         switch (val_size) {
 745         case 1:
 746                 cp.mode = IBT_REG_MODE_8BIT;
 747                 break;
 748         case 2:
 749                 cp.mode = IBT_REG_MODE_16BIT;
 750                 break;
 751         case 4:
 752                 cp.mode = IBT_REG_MODE_32BIT;
 753                 break;
 754         default:
 755                 return -EINVAL;
 756         }
 757
 758         /* regmap provides a little-endian formatted addr */
 759         cp.addr = *(__le32 *)addr;
 760         cp.len = val_size;
 761
 762         bt_dev_dbg(ctx->hdev, "Register (0x%x) read", le32_to_cpu(cp.addr));
 763
 764         skb = hci_cmd_sync(ctx->hdev, ctx->op_read, sizeof(cp), &cp,
 765                            HCI_CMD_TIMEOUT);
 766         if (IS_ERR(skb)) {
 767                 err = PTR_ERR(skb);
 768                 bt_dev_err(ctx->hdev, "regmap: Register (0x%x) read error (%d)",
 769                            le32_to_cpu(cp.addr), err);
 770                 return err;
 771         }
 772
 773         if (skb->len != sizeof(*rp) + val_size) {
 774                 bt_dev_err(ctx->hdev, "regmap: Register (0x%x) read error, bad len",
 775                            le32_to_cpu(cp.addr));
 776                 err = -EINVAL;
 777                 goto done;
 778         }
 779
 780         rp = (struct ibt_rp_reg_access *)skb->data;
 781
 782         if (rp->addr != cp.addr) {
 783                 bt_dev_err(ctx->hdev, "regmap: Register (0x%x) read error, bad addr",
 784                            le32_to_cpu(rp->addr));
 785                 err = -EINVAL;
 786                 goto done;
 787         }
 788
 789         memcpy(val, rp->data, val_size);
 790
 791 done:
 792         kfree_skb(skb);
 793         return err;
 794 }
 795
 796 static int regmap_ibt_gather_write(void *context,
 797                                    const void *addr, size_t reg_size,
 798                                    const void *val, size_t val_size)
 799 {
 800         struct regmap_ibt_context *ctx = context;
 801         struct ibt_cp_reg_access *cp;
 802         struct sk_buff *skb;
 803         int plen = sizeof(*cp) + val_size;
 804         u8 mode;
 805         int err = 0;
 806
 807         if (reg_size != sizeof(__le32))
 808                 return -EINVAL;
 809
 810         switch (val_size) {
 811         case 1:
 812                 mode = IBT_REG_MODE_8BIT;
 813                 break;
 814         case 2:
 815                 mode = IBT_REG_MODE_16BIT;
 816                 break;
 817         case 4:
 818                 mode = IBT_REG_MODE_32BIT;
 819                 break;
 820         default:
 821                 return -EINVAL;
 822         }
 823
 824         cp = kmalloc(plen, GFP_KERNEL);
 825         if (!cp)
 826                 return -ENOMEM;
 827
 828         /* regmap provides a little-endian formatted addr/value */
 829         cp->addr = *(__le32 *)addr;
 830         cp->mode = mode;
 831         cp->len = val_size;
 832         memcpy(&cp->data, val, val_size);
 833
 834         bt_dev_dbg(ctx->hdev, "Register (0x%x) write", le32_to_cpu(cp->addr));
 835
 836         skb = hci_cmd_sync(ctx->hdev, ctx->op_write, plen, cp, HCI_CMD_TIMEOUT);
 837         if (IS_ERR(skb)) {
 838                 err = PTR_ERR(skb);
 839                 bt_dev_err(ctx->hdev, "regmap: Register (0x%x) write error (%d)",
 840                            le32_to_cpu(cp->addr), err);
 841                 goto done;
 842         }
 843         kfree_skb(skb);
 844
 845 done:
 846         kfree(cp);
 847         return err;
 848 }
 849
 850 static int regmap_ibt_write(void *context, const void *data, size_t count)
 851 {
 852         /* data contains register+value, since we only support 32bit addr,
 853          * minimum data size is 4 bytes.
 854          */
 855         if (WARN_ONCE(count < 4, "Invalid register access"))
 856                 return -EINVAL;
 857
 858         return regmap_ibt_gather_write(context, data, 4, data + 4, count - 4);
 859 }
 860
 861 static void regmap_ibt_free_context(void *context)
 862 {
 863         kfree(context);
 864 }
 865
 866 static struct regmap_bus regmap_ibt = {
 867         .read = regmap_ibt_read,
 868         .write = regmap_ibt_write,
 869         .gather_write = regmap_ibt_gather_write,
 870         .free_context = regmap_ibt_free_context,
 871         .reg_format_endian_default = REGMAP_ENDIAN_LITTLE,
 872         .val_format_endian_default = REGMAP_ENDIAN_LITTLE,
 873 };
 874
 875 /* Config is the same for all register regions */
 876 static const struct regmap_config regmap_ibt_cfg = {
 877         .name      = "btintel_regmap",
 878         .reg_bits  = 32,
 879         .val_bits  = 32,
 880 };
 881
 882 struct regmap *btintel_regmap_init(struct hci_dev *hdev, u16 opcode_read,
 883                                    u16 opcode_write)
 884 {
 885         struct regmap_ibt_context *ctx;
 886
 887         bt_dev_info(hdev, "regmap: Init R%x-W%x region", opcode_read,
 888                     opcode_write);
 889
 890         ctx = kzalloc(sizeof(*ctx), GFP_KERNEL);
 891         if (!ctx)
 892                 return ERR_PTR(-ENOMEM);
 893
 894         ctx->op_read = opcode_read;
 895         ctx->op_write = opcode_write;
 896         ctx->hdev = hdev;
 897
 898         return regmap_init(&hdev->dev, &regmap_ibt, ctx, &regmap_ibt_cfg);
 899 }
 900 EXPORT_SYMBOL_GPL(btintel_regmap_init);
 901
 902 int btintel_send_intel_reset(struct hci_dev *hdev, u32 boot_param)
 903 {
 904         struct intel_reset params = { 0x00, 0x01, 0x00, 0x01, 0x00000000 };
 905         struct sk_buff *skb;
 906
 907         params.boot_param = cpu_to_le32(boot_param);
 908
 909         skb = __hci_cmd_sync(hdev, 0xfc01, sizeof(params), &params,
 910                              HCI_INIT_TIMEOUT);
 911         if (IS_ERR(skb)) {
 912                 bt_dev_err(hdev, "Failed to send Intel Reset command");
 913                 return PTR_ERR(skb);
 914         }
 915
 916         kfree_skb(skb);
 917
 918         return 0;
 919 }
 920 EXPORT_SYMBOL_GPL(btintel_send_intel_reset);
 921
 922 int btintel_read_boot_params(struct hci_dev *hdev,
 923                              struct intel_boot_params *params)
 924 {
 925         struct sk_buff *skb;
 926
 927         skb = __hci_cmd_sync(hdev, 0xfc0d, 0, NULL, HCI_INIT_TIMEOUT);
 928         if (IS_ERR(skb)) {
 929                 bt_dev_err(hdev, "Reading Intel boot parameters failed (%ld)",
 930                            PTR_ERR(skb));
 931                 return PTR_ERR(skb);
 932         }
 933
 934         if (skb->len != sizeof(*params)) {
 935                 bt_dev_err(hdev, "Intel boot parameters size mismatch");
 936                 kfree_skb(skb);
 937                 return -EILSEQ;
 938         }
 939
 940         memcpy(params, skb->data, sizeof(*params));
 941
 942         kfree_skb(skb);
 943
 944         if (params->status) {
 945                 bt_dev_err(hdev, "Intel boot parameters command failed (%02x)",
 946                            params->status);
 947                 return -bt_to_errno(params->status);
 948         }
 949
 950         bt_dev_info(hdev, "Device revision is %u",
 951                     le16_to_cpu(params->dev_revid));
 952
 953         bt_dev_info(hdev, "Secure boot is %s",
 954                     params->secure_boot ? "enabled" : "disabled");
 955
 956         bt_dev_info(hdev, "OTP lock is %s",
 957                     params->otp_lock ? "enabled" : "disabled");
 958
 959         bt_dev_info(hdev, "API lock is %s",
 960                     params->api_lock ? "enabled" : "disabled");
 961
 962         bt_dev_info(hdev, "Debug lock is %s",
 963                     params->debug_lock ? "enabled" : "disabled");
 964
 965         bt_dev_info(hdev, "Minimum firmware build %u week %u %u",
 966                     params->min_fw_build_nn, params->min_fw_build_cw,
 967                     2000 + params->min_fw_build_yy);
 968
 969         return 0;
 970 }
 971 EXPORT_SYMBOL_GPL(btintel_read_boot_params);
 972
 973 static int btintel_sfi_rsa_header_secure_send(struct hci_dev *hdev,
 974                                               const struct firmware *fw)
 975 {
 976         int err;
 977
 978         /* Start the firmware download transaction with the Init fragment
 979          * represented by the 128 bytes of CSS header.
 980          */
 981         err = btintel_secure_send(hdev, 0x00, 128, fw->data);
 982         if (err < 0) {
 983                 bt_dev_err(hdev, "Failed to send firmware header (%d)", err);
 984                 goto done;
 985         }
 986
 987         /* Send the 256 bytes of public key information from the firmware
 988          * as the PKey fragment.
 989          */
 990         err = btintel_secure_send(hdev, 0x03, 256, fw->data + 128);
 991         if (err < 0) {
 992                 bt_dev_err(hdev, "Failed to send firmware pkey (%d)", err);
 993                 goto done;
 994         }
 995
 996         /* Send the 256 bytes of signature information from the firmware
 997          * as the Sign fragment.
 998          */
 999         err = btintel_secure_send(hdev, 0x02, 256, fw->data + 388);
1000         if (err < 0) {
1001                 bt_dev_err(hdev, "Failed to send firmware signature (%d)", err);
1002                 goto done;
1003         }
1004
1005 done:
1006         return err;
1007 }
1008
1009 static int btintel_sfi_ecdsa_header_secure_send(struct hci_dev *hdev,
1010                                                 const struct firmware *fw)
1011 {
1012         int err;
1013
1014         /* Start the firmware download transaction with the Init fragment
1015          * represented by the 128 bytes of CSS header.
1016          */
1017         err = btintel_secure_send(hdev, 0x00, 128, fw->data + 644);
1018         if (err < 0) {
1019                 bt_dev_err(hdev, "Failed to send firmware header (%d)", err);
1020                 return err;
1021         }
1022
1023         /* Send the 96 bytes of public key information from the firmware
1024          * as the PKey fragment.
1025          */
1026         err = btintel_secure_send(hdev, 0x03, 96, fw->data + 644 + 128);
1027         if (err < 0) {
1028                 bt_dev_err(hdev, "Failed to send firmware pkey (%d)", err);
1029                 return err;
1030         }
1031
1032         /* Send the 96 bytes of signature information from the firmware
1033          * as the Sign fragment
1034          */
1035         err = btintel_secure_send(hdev, 0x02, 96, fw->data + 644 + 224);
1036         if (err < 0) {
1037                 bt_dev_err(hdev, "Failed to send firmware signature (%d)",
1038                            err);
1039                 return err;
1040         }
1041         return 0;
1042 }
1043
1044 static int btintel_download_firmware_payload(struct hci_dev *hdev,
1045                                              const struct firmware *fw,
1046                                              size_t offset)
1047 {
1048         int err;
1049         const u8 *fw_ptr;
1050         u32 frag_len;
1051
1052         fw_ptr = fw->data + offset;
1053         frag_len = 0;
1054         err = -EINVAL;
1055
1056         while (fw_ptr - fw->data < fw->size) {
1057                 struct hci_command_hdr *cmd = (void *)(fw_ptr + frag_len);
1058
1059                 frag_len += sizeof(*cmd) + cmd->plen;
1060
1061                 /* The parameter length of the secure send command requires
1062                  * a 4 byte alignment. It happens so that the firmware file
1063                  * contains proper Intel_NOP commands to align the fragments
1064                  * as needed.
1065                  *
1066                  * Send set of commands with 4 byte alignment from the
1067                  * firmware data buffer as a single Data fragement.
1068                  */
1069                 if (!(frag_len % 4)) {
1070                         err = btintel_secure_send(hdev, 0x01, frag_len, fw_ptr);
1071                         if (err < 0) {
1072                                 bt_dev_err(hdev,
1073                                            "Failed to send firmware data (%d)",
1074                                            err);
1075                                 goto done;
1076                         }
1077
1078                         fw_ptr += frag_len;
1079                         frag_len = 0;
1080                 }
1081         }
1082
1083 done:
1084         return err;
1085 }
1086
1087 static bool btintel_firmware_version(struct hci_dev *hdev,
1088                                      u8 num, u8 ww, u8 yy,
1089                                      const struct firmware *fw,
1090                                      u32 *boot_addr)
1091 {
1092         const u8 *fw_ptr;
1093
1094         fw_ptr = fw->data;
1095
1096         while (fw_ptr - fw->data < fw->size) {
1097                 struct hci_command_hdr *cmd = (void *)(fw_ptr);
1098
1099                 /* Each SKU has a different reset parameter to use in the
1100                  * HCI_Intel_Reset command and it is embedded in the firmware
1101                  * data. So, instead of using static value per SKU, check
1102                  * the firmware data and save it for later use.
1103                  */
1104                 if (le16_to_cpu(cmd->opcode) == CMD_WRITE_BOOT_PARAMS) {
1105                         struct cmd_write_boot_params *params;
1106
1107                         params = (void *)(fw_ptr + sizeof(*cmd));
1108
1109                         bt_dev_info(hdev, "Boot Address: 0x%x",
1110                                     le32_to_cpu(params->boot_addr));
1111
1112                         bt_dev_info(hdev, "Firmware Version: %u-%u.%u",
1113                                     params->fw_build_num, params->fw_build_ww,
1114                                     params->fw_build_yy);
1115
1116                         return (num == params->fw_build_num &&
1117                                 ww == params->fw_build_ww &&
1118                                 yy == params->fw_build_yy);
1119                 }
1120
1121                 fw_ptr += sizeof(*cmd) + cmd->plen;
1122         }
1123
1124         return false;
1125 }
1126
1127 int btintel_download_firmware(struct hci_dev *hdev,
1128                               struct intel_version *ver,
1129                               const struct firmware *fw,
1130                               u32 *boot_param)
1131 {
1132         int err;
1133
1134         /* SfP and WsP don't seem to update the firmware version on file
1135          * so version checking is currently not possible.
1136          */
1137         switch (ver->hw_variant) {
1138         case 0x0b:      /* SfP */
1139         case 0x0c:      /* WsP */
1140                 /* Skip version checking */
1141                 break;
1142         default:
1143                 /* Skip reading firmware file version in bootloader mode */
1144                 if (ver->fw_variant == 0x06)
1145                         break;
1146
1147                 /* Skip download if firmware has the same version */
1148                 if (btintel_firmware_version(hdev, ver->fw_build_num,
1149                                              ver->fw_build_ww, ver->fw_build_yy,
1150                                              fw, boot_param)) {
1151                         bt_dev_info(hdev, "Firmware already loaded");
1152                         /* Return -EALREADY to indicate that the firmware has
1153                          * already been loaded.
1154                          */
1155                         return -EALREADY;
1156                 }
1157         }
1158
1159         /* The firmware variant determines if the device is in bootloader
1160          * mode or is running operational firmware. The value 0x06 identifies
1161          * the bootloader and the value 0x23 identifies the operational
1162          * firmware.
1163          *
1164          * If the firmware version has changed that means it needs to be reset
1165          * to bootloader when operational so the new firmware can be loaded.
1166          */
1167         if (ver->fw_variant == 0x23)
1168                 return -EINVAL;
1169
1170         err = btintel_sfi_rsa_header_secure_send(hdev, fw);
1171         if (err)
1172                 return err;
1173
1174         return btintel_download_firmware_payload(hdev, fw, RSA_HEADER_LEN);
1175 }
1176 EXPORT_SYMBOL_GPL(btintel_download_firmware);
1177
1178 int btintel_download_firmware_newgen(struct hci_dev *hdev,
1179                                      struct intel_version_tlv *ver,
1180                                      const struct firmware *fw, u32 *boot_param,
1181                                      u8 hw_variant, u8 sbe_type)
1182 {
1183         int err;
1184         u32 css_header_ver;
1185
1186         /* Skip reading firmware file version in bootloader mode */
1187         if (ver->img_type != 0x01) {
1188                 /* Skip download if firmware has the same version */
1189                 if (btintel_firmware_version(hdev, ver->min_fw_build_nn,
1190                                              ver->min_fw_build_cw,
1191                                              ver->min_fw_build_yy,
1192                                              fw, boot_param)) {
1193                         bt_dev_info(hdev, "Firmware already loaded");
1194                         /* Return -EALREADY to indicate that firmware has
1195                          * already been loaded.
1196                          */
1197                         return -EALREADY;
1198                 }
1199         }
1200
1201         /* The firmware variant determines if the device is in bootloader
1202          * mode or is running operational firmware. The value 0x01 identifies
1203          * the bootloader and the value 0x03 identifies the operational
1204          * firmware.
1205          *
1206          * If the firmware version has changed that means it needs to be reset
1207          * to bootloader when operational so the new firmware can be loaded.
1208          */
1209         if (ver->img_type == 0x03)
1210                 return -EINVAL;
1211
1212         /* iBT hardware variants 0x0b, 0x0c, 0x11, 0x12, 0x13, 0x14 support
1213          * only RSA secure boot engine. Hence, the corresponding sfi file will
1214          * have RSA header of 644 bytes followed by Command Buffer.
1215          *
1216          * iBT hardware variants 0x17, 0x18 onwards support both RSA and ECDSA
1217          * secure boot engine. As a result, the corresponding sfi file will
1218          * have RSA header of 644, ECDSA header of 320 bytes followed by
1219          * Command Buffer.
1220          *
1221          * CSS Header byte positions 0x08 to 0x0B represent the CSS Header
1222          * version: RSA(0x00010000) , ECDSA (0x00020000)
1223          */
1224         css_header_ver = get_unaligned_le32(fw->data + CSS_HEADER_OFFSET);
1225         if (css_header_ver != 0x00010000) {
1226                 bt_dev_err(hdev, "Invalid CSS Header version");
1227                 return -EINVAL;
1228         }
1229
1230         if (hw_variant <= 0x14) {
1231                 if (sbe_type != 0x00) {
1232                         bt_dev_err(hdev, "Invalid SBE type for hardware variant (%d)",
1233                                    hw_variant);
1234                         return -EINVAL;
1235                 }
1236
1237                 err = btintel_sfi_rsa_header_secure_send(hdev, fw);
1238                 if (err)
1239                         return err;
1240
1241                 err = btintel_download_firmware_payload(hdev, fw, RSA_HEADER_LEN);
1242                 if (err)
1243                         return err;
1244         } else if (hw_variant >= 0x17) {
1245                 /* Check if CSS header for ECDSA follows the RSA header */
1246                 if (fw->data[ECDSA_OFFSET] != 0x06)
1247                         return -EINVAL;
1248
1249                 /* Check if the CSS Header version is ECDSA(0x00020000) */
1250                 css_header_ver = get_unaligned_le32(fw->data + ECDSA_OFFSET + CSS_HEADER_OFFSET);
1251                 if (css_header_ver != 0x00020000) {
1252                         bt_dev_err(hdev, "Invalid CSS Header version");
1253                         return -EINVAL;
1254                 }
1255
1256                 if (sbe_type == 0x00) {
1257                         err = btintel_sfi_rsa_header_secure_send(hdev, fw);
1258                         if (err)
1259                                 return err;
1260
1261                         err = btintel_download_firmware_payload(hdev, fw,
1262                                                                 RSA_HEADER_LEN + ECDSA_HEADER_LEN);
1263                         if (err)
1264                                 return err;
1265                 } else if (sbe_type == 0x01) {
1266                         err = btintel_sfi_ecdsa_header_secure_send(hdev, fw);
1267                         if (err)
1268                                 return err;
1269
1270                         err = btintel_download_firmware_payload(hdev, fw,
1271                                                                 RSA_HEADER_LEN + ECDSA_HEADER_LEN);
1272                         if (err)
1273                                 return err;
1274                 }
1275         }
1276         return 0;
1277 }
1278 EXPORT_SYMBOL_GPL(btintel_download_firmware_newgen);
1279
1280 void btintel_reset_to_bootloader(struct hci_dev *hdev)
1281 {
1282         struct intel_reset params;
1283         struct sk_buff *skb;
1284
1285         /* Send Intel Reset command. This will result in
1286          * re-enumeration of BT controller.
1287          *
1288          * Intel Reset parameter description:
1289          * reset_type :   0x00 (Soft reset),
1290          *                0x01 (Hard reset)
1291          * patch_enable : 0x00 (Do not enable),
1292          *                0x01 (Enable)
1293          * ddc_reload :   0x00 (Do not reload),
1294          *                0x01 (Reload)
1295          * boot_option:   0x00 (Current image),
1296          *                0x01 (Specified boot address)
1297          * boot_param:    Boot address
1298          *
1299          */
1300         params.reset_type = 0x01;
1301         params.patch_enable = 0x01;
1302         params.ddc_reload = 0x01;
1303         params.boot_option = 0x00;
1304         params.boot_param = cpu_to_le32(0x00000000);
1305
1306         skb = __hci_cmd_sync(hdev, 0xfc01, sizeof(params),
1307                              &params, HCI_INIT_TIMEOUT);
1308         if (IS_ERR(skb)) {
1309                 bt_dev_err(hdev, "FW download error recovery failed (%ld)",
1310                            PTR_ERR(skb));
1311                 return;
1312         }
1313         bt_dev_info(hdev, "Intel reset sent to retry FW download");
1314         kfree_skb(skb);
1315
1316         /* Current Intel BT controllers(ThP/JfP) hold the USB reset
1317          * lines for 2ms when it receives Intel Reset in bootloader mode.
1318          * Whereas, the upcoming Intel BT controllers will hold USB reset
1319          * for 150ms. To keep the delay generic, 150ms is chosen here.
1320          */
1321         msleep(150);
1322 }
1323 EXPORT_SYMBOL_GPL(btintel_reset_to_bootloader);
1324
1325 int btintel_read_debug_features(struct hci_dev *hdev,
1326                                 struct intel_debug_features *features)
1327 {
1328         struct sk_buff *skb;
1329         u8 page_no = 1;
1330
1331         /* Intel controller supports two pages, each page is of 128-bit
1332          * feature bit mask. And each bit defines specific feature support
1333          */
1334         skb = __hci_cmd_sync(hdev, 0xfca6, sizeof(page_no), &page_no,
1335                              HCI_INIT_TIMEOUT);
1336         if (IS_ERR(skb)) {
1337                 bt_dev_err(hdev, "Reading supported features failed (%ld)",
1338                            PTR_ERR(skb));
1339                 return PTR_ERR(skb);
1340         }
1341
1342         if (skb->len != (sizeof(features->page1) + 3)) {
1343                 bt_dev_err(hdev, "Supported features event size mismatch");
1344                 kfree_skb(skb);
1345                 return -EILSEQ;
1346         }
1347
1348         memcpy(features->page1, skb->data + 3, sizeof(features->page1));
1349
1350         /* Read the supported features page2 if required in future.
1351          */
1352         kfree_skb(skb);
1353         return 0;
1354 }
1355 EXPORT_SYMBOL_GPL(btintel_read_debug_features);
1356
1357 int btintel_set_debug_features(struct hci_dev *hdev,
1358                                const struct intel_debug_features *features)
1359 {
1360         u8 mask[11] = { 0x0a, 0x92, 0x02, 0x07, 0x00, 0x00, 0x00, 0x00,
1361                         0x00, 0x00, 0x00 };
1362         struct sk_buff *skb;
1363
1364         if (!features)
1365                 return -EINVAL;
1366
1367         if (!(features->page1[0] & 0x3f)) {
1368                 bt_dev_info(hdev, "Telemetry exception format not supported");
1369                 return 0;
1370         }
1371
1372         skb = __hci_cmd_sync(hdev, 0xfc8b, 11, mask, HCI_INIT_TIMEOUT);
1373         if (IS_ERR(skb)) {
1374                 bt_dev_err(hdev, "Setting Intel telemetry ddc write event mask failed (%ld)",
1375                            PTR_ERR(skb));
1376                 return PTR_ERR(skb);
1377         }
1378
1379         kfree_skb(skb);
1380         return 0;
1381 }
1382 EXPORT_SYMBOL_GPL(btintel_set_debug_features);
1383
1384 static const struct firmware *btintel_legacy_rom_get_fw(struct hci_dev *hdev,
1385                                                struct intel_version *ver)
1386 {
1387         const struct firmware *fw;
1388         char fwname[64];
1389         int ret;
1390
1391         snprintf(fwname, sizeof(fwname),
1392                  "intel/ibt-hw-%x.%x.%x-fw-%x.%x.%x.%x.%x.bseq",
1393                  ver->hw_platform, ver->hw_variant, ver->hw_revision,
1394                  ver->fw_variant,  ver->fw_revision, ver->fw_build_num,
1395                  ver->fw_build_ww, ver->fw_build_yy);
1396
1397         ret = request_firmware(&fw, fwname, &hdev->dev);
1398         if (ret < 0) {
1399                 if (ret == -EINVAL) {
1400                         bt_dev_err(hdev, "Intel firmware file request failed (%d)",
1401                                    ret);
1402                         return NULL;
1403                 }
1404
1405                 bt_dev_err(hdev, "failed to open Intel firmware file: %s (%d)",
1406                            fwname, ret);
1407
1408                 /* If the correct firmware patch file is not found, use the
1409                  * default firmware patch file instead
1410                  */
1411                 snprintf(fwname, sizeof(fwname), "intel/ibt-hw-%x.%x.bseq",
1412                          ver->hw_platform, ver->hw_variant);
1413                 if (request_firmware(&fw, fwname, &hdev->dev) < 0) {
1414                         bt_dev_err(hdev, "failed to open default fw file: %s",
1415                                    fwname);
1416                         return NULL;
1417                 }
1418         }
1419
1420         bt_dev_info(hdev, "Intel Bluetooth firmware file: %s", fwname);
1421
1422         return fw;
1423 }
1424
1425 static int btintel_legacy_rom_patching(struct hci_dev *hdev,
1426                                       const struct firmware *fw,
1427                                       const u8 **fw_ptr, int *disable_patch)
1428 {
1429         struct sk_buff *skb;
1430         struct hci_command_hdr *cmd;
1431         const u8 *cmd_param;
1432         struct hci_event_hdr *evt = NULL;
1433         const u8 *evt_param = NULL;
1434         int remain = fw->size - (*fw_ptr - fw->data);
1435
1436         /* The first byte indicates the types of the patch command or event.
1437          * 0x01 means HCI command and 0x02 is HCI event. If the first bytes
1438          * in the current firmware buffer doesn't start with 0x01 or
1439          * the size of remain buffer is smaller than HCI command header,
1440          * the firmware file is corrupted and it should stop the patching
1441          * process.
1442          */
1443         if (remain > HCI_COMMAND_HDR_SIZE && *fw_ptr[0] != 0x01) {
1444                 bt_dev_err(hdev, "Intel fw corrupted: invalid cmd read");
1445                 return -EINVAL;
1446         }
1447         (*fw_ptr)++;
1448         remain--;
1449
1450         cmd = (struct hci_command_hdr *)(*fw_ptr);
1451         *fw_ptr += sizeof(*cmd);
1452         remain -= sizeof(*cmd);
1453
1454         /* Ensure that the remain firmware data is long enough than the length
1455          * of command parameter. If not, the firmware file is corrupted.
1456          */
1457         if (remain < cmd->plen) {
1458                 bt_dev_err(hdev, "Intel fw corrupted: invalid cmd len");
1459                 return -EFAULT;
1460         }
1461
1462         /* If there is a command that loads a patch in the firmware
1463          * file, then enable the patch upon success, otherwise just
1464          * disable the manufacturer mode, for example patch activation
1465          * is not required when the default firmware patch file is used
1466          * because there are no patch data to load.
1467          */
1468         if (*disable_patch && le16_to_cpu(cmd->opcode) == 0xfc8e)
1469                 *disable_patch = 0;
1470
1471         cmd_param = *fw_ptr;
1472         *fw_ptr += cmd->plen;
1473         remain -= cmd->plen;
1474
1475         /* This reads the expected events when the above command is sent to the
1476          * device. Some vendor commands expects more than one events, for
1477          * example command status event followed by vendor specific event.
1478          * For this case, it only keeps the last expected event. so the command
1479          * can be sent with __hci_cmd_sync_ev() which returns the sk_buff of
1480          * last expected event.
1481          */
1482         while (remain > HCI_EVENT_HDR_SIZE && *fw_ptr[0] == 0x02) {
1483                 (*fw_ptr)++;
1484                 remain--;
1485
1486                 evt = (struct hci_event_hdr *)(*fw_ptr);
1487                 *fw_ptr += sizeof(*evt);
1488                 remain -= sizeof(*evt);
1489
1490                 if (remain < evt->plen) {
1491                         bt_dev_err(hdev, "Intel fw corrupted: invalid evt len");
1492                         return -EFAULT;
1493                 }
1494
1495                 evt_param = *fw_ptr;
1496                 *fw_ptr += evt->plen;
1497                 remain -= evt->plen;
1498         }
1499
1500         /* Every HCI commands in the firmware file has its correspond event.
1501          * If event is not found or remain is smaller than zero, the firmware
1502          * file is corrupted.
1503          */
1504         if (!evt || !evt_param || remain < 0) {
1505                 bt_dev_err(hdev, "Intel fw corrupted: invalid evt read");
1506                 return -EFAULT;
1507         }
1508
1509         skb = __hci_cmd_sync_ev(hdev, le16_to_cpu(cmd->opcode), cmd->plen,
1510                                 cmd_param, evt->evt, HCI_INIT_TIMEOUT);
1511         if (IS_ERR(skb)) {
1512                 bt_dev_err(hdev, "sending Intel patch command (0x%4.4x) failed (%ld)",
1513                            cmd->opcode, PTR_ERR(skb));
1514                 return PTR_ERR(skb);
1515         }
1516
1517         /* It ensures that the returned event matches the event data read from
1518          * the firmware file. At fist, it checks the length and then
1519          * the contents of the event.
1520          */
1521         if (skb->len != evt->plen) {
1522                 bt_dev_err(hdev, "mismatch event length (opcode 0x%4.4x)",
1523                            le16_to_cpu(cmd->opcode));
1524                 kfree_skb(skb);
1525                 return -EFAULT;
1526         }
1527
1528         if (memcmp(skb->data, evt_param, evt->plen)) {
1529                 bt_dev_err(hdev, "mismatch event parameter (opcode 0x%4.4x)",
1530                            le16_to_cpu(cmd->opcode));
1531                 kfree_skb(skb);
1532                 return -EFAULT;
1533         }
1534         kfree_skb(skb);
1535
1536         return 0;
1537 }
1538
1539 static int btintel_legacy_rom_setup(struct hci_dev *hdev,
1540                                     struct intel_version *ver)
1541 {
1542         const struct firmware *fw;
1543         const u8 *fw_ptr;
1544         int disable_patch, err;
1545         struct intel_version new_ver;
1546
1547         BT_DBG("%s", hdev->name);
1548
1549         /* fw_patch_num indicates the version of patch the device currently
1550          * have. If there is no patch data in the device, it is always 0x00.
1551          * So, if it is other than 0x00, no need to patch the device again.
1552          */
1553         if (ver->fw_patch_num) {
1554                 bt_dev_info(hdev,
1555                             "Intel device is already patched. patch num: %02x",
1556                             ver->fw_patch_num);
1557                 goto complete;
1558         }
1559
1560         /* Opens the firmware patch file based on the firmware version read
1561          * from the controller. If it fails to open the matching firmware
1562          * patch file, it tries to open the default firmware patch file.
1563          * If no patch file is found, allow the device to operate without
1564          * a patch.
1565          */
1566         fw = btintel_legacy_rom_get_fw(hdev, ver);
1567         if (!fw)
1568                 goto complete;
1569         fw_ptr = fw->data;
1570
1571         /* Enable the manufacturer mode of the controller.
1572          * Only while this mode is enabled, the driver can download the
1573          * firmware patch data and configuration parameters.
1574          */
1575         err = btintel_enter_mfg(hdev);
1576         if (err) {
1577                 release_firmware(fw);
1578                 return err;
1579         }
1580
1581         disable_patch = 1;
1582
1583         /* The firmware data file consists of list of Intel specific HCI
1584          * commands and its expected events. The first byte indicates the
1585          * type of the message, either HCI command or HCI event.
1586          *
1587          * It reads the command and its expected event from the firmware file,
1588          * and send to the controller. Once __hci_cmd_sync_ev() returns,
1589          * the returned event is compared with the event read from the firmware
1590          * file and it will continue until all the messages are downloaded to
1591          * the controller.
1592          *
1593          * Once the firmware patching is completed successfully,
1594          * the manufacturer mode is disabled with reset and activating the
1595          * downloaded patch.
1596          *
1597          * If the firmware patching fails, the manufacturer mode is
1598          * disabled with reset and deactivating the patch.
1599          *
1600          * If the default patch file is used, no reset is done when disabling
1601          * the manufacturer.
1602          */
1603         while (fw->size > fw_ptr - fw->data) {
1604                 int ret;
1605
1606                 ret = btintel_legacy_rom_patching(hdev, fw, &fw_ptr,
1607                                                  &disable_patch);
1608                 if (ret < 0)
1609                         goto exit_mfg_deactivate;
1610         }
1611
1612         release_firmware(fw);
1613
1614         if (disable_patch)
1615                 goto exit_mfg_disable;
1616
1617         /* Patching completed successfully and disable the manufacturer mode
1618          * with reset and activate the downloaded firmware patches.
1619          */
1620         err = btintel_exit_mfg(hdev, true, true);
1621         if (err)
1622                 return err;
1623
1624         /* Need build number for downloaded fw patches in
1625          * every power-on boot
1626          */
1627         err = btintel_read_version(hdev, &new_ver);
1628         if (err)
1629                 return err;
1630
1631         bt_dev_info(hdev, "Intel BT fw patch 0x%02x completed & activated",
1632                     new_ver.fw_patch_num);
1633
1634         goto complete;
1635
1636 exit_mfg_disable:
1637         /* Disable the manufacturer mode without reset */
1638         err = btintel_exit_mfg(hdev, false, false);
1639         if (err)
1640                 return err;
1641
1642         bt_dev_info(hdev, "Intel firmware patch completed");
1643
1644         goto complete;
1645
1646 exit_mfg_deactivate:
1647         release_firmware(fw);
1648
1649         /* Patching failed. Disable the manufacturer mode with reset and
1650          * deactivate the downloaded firmware patches.
1651          */
1652         err = btintel_exit_mfg(hdev, true, false);
1653         if (err)
1654                 return err;
1655
1656         bt_dev_info(hdev, "Intel firmware patch completed and deactivated");
1657
1658 complete:
1659         /* Set the event mask for Intel specific vendor events. This enables
1660          * a few extra events that are useful during general operation.
1661          */
1662         btintel_set_event_mask_mfg(hdev, false);
1663
1664         btintel_check_bdaddr(hdev);
1665
1666         return 0;
1667 }
1668
1669 static int btintel_setup_combined(struct hci_dev *hdev)
1670 {
1671         const u8 param[1] = { 0xFF };
1672         struct intel_version ver;
1673         struct intel_version_tlv ver_tlv;
1674         struct sk_buff *skb;
1675         int err;
1676
1677         BT_DBG("%s", hdev->name);
1678
1679         /* Starting from TyP device, the command parameter and response are
1680          * changed even though the OCF for HCI_Intel_Read_Version command
1681          * remains same. The legacy devices can handle even if the
1682          * command has a parameter and returns a correct version information.
1683          * So, it uses new format to support both legacy and new format.
1684          */
1685         skb = __hci_cmd_sync(hdev, 0xfc05, 1, param, HCI_CMD_TIMEOUT);
1686         if (IS_ERR(skb)) {
1687                 bt_dev_err(hdev, "Reading Intel version command failed (%ld)",
1688                            PTR_ERR(skb));
1689                 return PTR_ERR(skb);
1690         }
1691
1692         /* Check the status */
1693         if (skb->data[0]) {
1694                 bt_dev_err(hdev, "Intel Read Version command failed (%02x)",
1695                            skb->data[0]);
1696                 err = -EIO;
1697                 goto exit_error;
1698         }
1699
1700         /* For Legacy device, check the HW platform value and size */
1701         if (skb->len == sizeof(ver) && skb->data[1] == 0x37) {
1702                 bt_dev_dbg(hdev, "Read the legacy Intel version information");
1703
1704                 memcpy(&ver, skb->data, sizeof(ver));
1705
1706                 /* Display version information */
1707                 btintel_version_info(hdev, &ver);
1708
1709                 /* Check for supported iBT hardware variants of this firmware
1710                  * loading method.
1711                  *
1712                  * This check has been put in place to ensure correct forward
1713                  * compatibility options when newer hardware variants come
1714                  * along.
1715                  */
1716                 switch (ver.hw_variant) {
1717                 case 0x07:      /* WP */
1718                 case 0x08:      /* StP */
1719                         /* Legacy ROM product */
1720                         err = btintel_legacy_rom_setup(hdev, &ver);
1721                         break;
1722                 case 0x0b:      /* SfP */
1723                 case 0x0c:      /* WsP */
1724                 case 0x11:      /* JfP */
1725                 case 0x12:      /* ThP */
1726                 case 0x13:      /* HrP */
1727                 case 0x14:      /* CcP */
1728                         /* TODO: call setup routine for bootloader product */
1729                         break;
1730                 default:
1731                         bt_dev_err(hdev, "Unsupported Intel hw variant (%u)",
1732                                    ver.hw_variant);
1733                         err = -EINVAL;
1734                 }
1735
1736                 goto exit_error;
1737         }
1738
1739         /* For TLV type device, parse the tlv data */
1740         err = btintel_parse_version_tlv(hdev, &ver_tlv, skb);
1741         if (err) {
1742                 bt_dev_err(hdev, "Failed to parse TLV version information");
1743                 goto exit_error;
1744         }
1745
1746         if (INTEL_HW_PLATFORM(ver_tlv.cnvi_bt) != 0x37) {
1747                 bt_dev_err(hdev, "Unsupported Intel hardware platform (0x%2x)",
1748                            INTEL_HW_PLATFORM(ver_tlv.cnvi_bt));
1749                 err = -EINVAL;
1750                 goto exit_error;
1751         }
1752
1753         /* Display version information of TLV type */
1754         btintel_version_info_tlv(hdev, &ver_tlv);
1755
1756         /* TODO: Need to filter the device for new generation */
1757         /* TODO: call setup routine for tlv based bootloader product */
1758
1759 exit_error:
1760         kfree_skb(skb);
1761
1762         return err;
1763 }
1764
1765 static int btintel_shutdown_combined(struct hci_dev *hdev)
1766 {
1767         struct sk_buff *skb;
1768
1769         /* Send HCI Reset to the controller to stop any BT activity which
1770          * were triggered. This will help to save power and maintain the
1771          * sync b/w Host and controller
1772          */
1773         skb = __hci_cmd_sync(hdev, HCI_OP_RESET, 0, NULL, HCI_INIT_TIMEOUT);
1774         if (IS_ERR(skb)) {
1775                 bt_dev_err(hdev, "HCI reset during shutdown failed");
1776                 return PTR_ERR(skb);
1777         }
1778         kfree_skb(skb);
1779
1780         return 0;
1781 }
1782
1783 int btintel_configure_setup(struct hci_dev *hdev)
1784 {
1785         hdev->manufacturer = 2;
1786         hdev->setup = btintel_setup_combined;
1787         hdev->shutdown = btintel_shutdown_combined;
1788         hdev->set_diag = btintel_set_diag_mfg;
1789         hdev->set_bdaddr = btintel_set_bdaddr;
1790
1791         return 0;
1792 }
1793 EXPORT_SYMBOL_GPL(btintel_configure_setup);
1794
1795 MODULE_AUTHOR("Marcel Holtmann <marcel@holtmann.org>");
1796 MODULE_DESCRIPTION("Bluetooth support for Intel devices ver " VERSION);
1797 MODULE_VERSION(VERSION);
1798 MODULE_LICENSE("GPL");
1799 MODULE_FIRMWARE("intel/ibt-11-5.sfi");
1800 MODULE_FIRMWARE("intel/ibt-11-5.ddc");
1801 MODULE_FIRMWARE("intel/ibt-12-16.sfi");
1802 MODULE_FIRMWARE("intel/ibt-12-16.ddc");