projects / linux-2.6-block.git / blame
? search:
summary | shortlog | log | commit | commitdiff | tree
blob | blame (incremental) | history | HEAD
Bluetooth: Support the quality report events
[linux-2.6-block.git] / drivers / bluetooth / btintel.c
CommitLineData
1a59d1b8 1// SPDX-License-Identifier: GPL-2.0-or-later
48f0ed1b
MH		 2/*
3 *
4 * Bluetooth support for Intel devices
5 *
6 * Copyright (C) 2015 Intel Corporation
48f0ed1b
MH		 7 */
8
9#include <linux/module.h>
145f2368 10#include <linux/firmware.h>
d06f107b 11#include <linux/regmap.h>
fbbe83c5 12#include <asm/unaligned.h>
48f0ed1b
MH		 13
14#include <net/bluetooth/bluetooth.h>
15#include <net/bluetooth/hci_core.h>
16
17#include "btintel.h"
18
19#define VERSION "0.1"
20
81ebea53
K		 21#define BDADDR_INTEL (&(bdaddr_t){{0x00, 0x8b, 0x9e, 0x19, 0x03, 0x00}})
22#define RSA_HEADER_LEN 644
23#define CSS_HEADER_OFFSET 8
24#define ECDSA_OFFSET 644
25#define ECDSA_HEADER_LEN 320
48f0ed1b 26
ac056546
LAD		 27#define CMD_WRITE_BOOT_PARAMS 0xfc0e
28struct cmd_write_boot_params {
29 u32 boot_addr;
30 u8 fw_build_num;
31 u8 fw_build_ww;
32 u8 fw_build_yy;
33} __packed;
34
48f0ed1b
MH		 35int btintel_check_bdaddr(struct hci_dev *hdev)
36{
37 struct hci_rp_read_bd_addr *bda;
38 struct sk_buff *skb;
39
40 skb = __hci_cmd_sync(hdev, HCI_OP_READ_BD_ADDR, 0, NULL,
41 HCI_INIT_TIMEOUT);
42 if (IS_ERR(skb)) {
43 int err = PTR_ERR(skb);
2064ee33
MH		 44 bt_dev_err(hdev, "Reading Intel device address failed (%d)",
45 err);
48f0ed1b
MH		 46 return err;
47 }
48
49 if (skb->len != sizeof(*bda)) {
2064ee33 50 bt_dev_err(hdev, "Intel device address length mismatch");
48f0ed1b
MH		 51 kfree_skb(skb);
52 return -EIO;
53 }
54
55 bda = (struct hci_rp_read_bd_addr *)skb->data;
48f0ed1b
MH		 56
57 /* For some Intel based controllers, the default Bluetooth device
58 * address 00:03:19:9E:8B:00 can be found. These controllers are
59 * fully operational, but have the danger of duplicate addresses
60 * and that in turn can cause problems with Bluetooth operation.
61 */
62 if (!bacmp(&bda->bdaddr, BDADDR_INTEL)) {
2064ee33
MH		 63 bt_dev_err(hdev, "Found Intel default device address (%pMR)",
64 &bda->bdaddr);
48f0ed1b
MH		 65 set_bit(HCI_QUIRK_INVALID_BDADDR, &hdev->quirks);
66 }
67
68 kfree_skb(skb);
69
70 return 0;
71}
72EXPORT_SYMBOL_GPL(btintel_check_bdaddr);
73
28dc4b92
LP		 74int btintel_enter_mfg(struct hci_dev *hdev)
75{
948c7ca0 76 static const u8 param[] = { 0x01, 0x00 };
28dc4b92
LP		 77 struct sk_buff *skb;
78
79 skb = __hci_cmd_sync(hdev, 0xfc11, 2, param, HCI_CMD_TIMEOUT);
80 if (IS_ERR(skb)) {
81 bt_dev_err(hdev, "Entering manufacturer mode failed (%ld)",
82 PTR_ERR(skb));
83 return PTR_ERR(skb);
84 }
85 kfree_skb(skb);
86
87 return 0;
88}
89EXPORT_SYMBOL_GPL(btintel_enter_mfg);
90
91int btintel_exit_mfg(struct hci_dev *hdev, bool reset, bool patched)
92{
93 u8 param[] = { 0x00, 0x00 };
94 struct sk_buff *skb;
95
96 /* The 2nd command parameter specifies the manufacturing exit method:
97 * 0x00: Just disable the manufacturing mode (0x00).
98 * 0x01: Disable manufacturing mode and reset with patches deactivated.
99 * 0x02: Disable manufacturing mode and reset with patches activated.
100 */
101 if (reset)
102 param[1] |= patched ? 0x02 : 0x01;
103
104 skb = __hci_cmd_sync(hdev, 0xfc11, 2, param, HCI_CMD_TIMEOUT);
105 if (IS_ERR(skb)) {
106 bt_dev_err(hdev, "Exiting manufacturer mode failed (%ld)",
107 PTR_ERR(skb));
108 return PTR_ERR(skb);
109 }
110 kfree_skb(skb);
111
112 return 0;
113}
114EXPORT_SYMBOL_GPL(btintel_exit_mfg);
115
48f0ed1b
MH		 116int btintel_set_bdaddr(struct hci_dev *hdev, const bdaddr_t *bdaddr)
117{
118 struct sk_buff *skb;
119 int err;
120
121 skb = __hci_cmd_sync(hdev, 0xfc31, 6, bdaddr, HCI_INIT_TIMEOUT);
122 if (IS_ERR(skb)) {
123 err = PTR_ERR(skb);
2064ee33
MH		 124 bt_dev_err(hdev, "Changing Intel device address failed (%d)",
125 err);
48f0ed1b
MH		 126 return err;
127 }
128 kfree_skb(skb);
129
130 return 0;
131}
132EXPORT_SYMBOL_GPL(btintel_set_bdaddr);
133
0d8603b4
THJA		 134static int btintel_set_event_mask(struct hci_dev *hdev, bool debug)
135{
136 u8 mask[8] = { 0x87, 0x0c, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 };
137 struct sk_buff *skb;
138 int err;
139
140 if (debug)
141 mask[1] |= 0x62;
142
143 skb = __hci_cmd_sync(hdev, 0xfc52, 8, mask, HCI_INIT_TIMEOUT);
144 if (IS_ERR(skb)) {
145 err = PTR_ERR(skb);
146 bt_dev_err(hdev, "Setting Intel event mask failed (%d)", err);
147 return err;
148 }
149 kfree_skb(skb);
150
151 return 0;
152}
153
6d2e50d2
MH		 154int btintel_set_diag(struct hci_dev *hdev, bool enable)
155{
156 struct sk_buff *skb;
157 u8 param[3];
158 int err;
159
6d2e50d2
MH		 160 if (enable) {
161 param[0] = 0x03;
162 param[1] = 0x03;
163 param[2] = 0x03;
164 } else {
165 param[0] = 0x00;
166 param[1] = 0x00;
167 param[2] = 0x00;
168 }
169
170 skb = __hci_cmd_sync(hdev, 0xfc43, 3, param, HCI_INIT_TIMEOUT);
171 if (IS_ERR(skb)) {
172 err = PTR_ERR(skb);
d8270fbb 173 if (err == -ENODATA)
213445b2 174 goto done;
2064ee33
MH		 175 bt_dev_err(hdev, "Changing Intel diagnostic mode failed (%d)",
176 err);
6d2e50d2
MH		 177 return err;
178 }
179 kfree_skb(skb);
180
213445b2
MH		 181done:
182 btintel_set_event_mask(hdev, enable);
6d2e50d2
MH		 183 return 0;
184}
185EXPORT_SYMBOL_GPL(btintel_set_diag);
186
83f2dafe 187static int btintel_set_diag_mfg(struct hci_dev *hdev, bool enable)
3e24767b 188{
28dc4b92 189 int err, ret;
3e24767b 190
28dc4b92
LP		 191 err = btintel_enter_mfg(hdev);
192 if (err)
193 return err;
3e24767b 194
28dc4b92 195 ret = btintel_set_diag(hdev, enable);
3e24767b 196
28dc4b92
LP		 197 err = btintel_exit_mfg(hdev, false, false);
198 if (err)
199 return err;
3e24767b 200
28dc4b92 201 return ret;
3e24767b 202}
3e24767b 203
55380714
THJA		 204static int btintel_set_diag_combined(struct hci_dev *hdev, bool enable)
205{
206 int ret;
207
208 /* Legacy ROM device needs to be in the manufacturer mode to apply
209 * diagnostic setting
210 *
211 * This flag is set after reading the Intel version.
212 */
213 if (btintel_test_flag(hdev, INTEL_ROM_LEGACY))
214 ret = btintel_set_diag_mfg(hdev, enable);
215 else
216 ret = btintel_set_diag(hdev, enable);
217
218 return ret;
219}
220
0d8603b4 221static void btintel_hw_error(struct hci_dev *hdev, u8 code)
973bb97e
MH		 222{
223 struct sk_buff *skb;
224 u8 type = 0x00;
225
2064ee33 226 bt_dev_err(hdev, "Hardware error 0x%2.2x", code);
973bb97e
MH		 227
228 skb = __hci_cmd_sync(hdev, HCI_OP_RESET, 0, NULL, HCI_INIT_TIMEOUT);
229 if (IS_ERR(skb)) {
2064ee33
MH		 230 bt_dev_err(hdev, "Reset after hardware error failed (%ld)",
231 PTR_ERR(skb));
973bb97e
MH		 232 return;
233 }
234 kfree_skb(skb);
235
236 skb = __hci_cmd_sync(hdev, 0xfc22, 1, &type, HCI_INIT_TIMEOUT);
237 if (IS_ERR(skb)) {
2064ee33
MH		 238 bt_dev_err(hdev, "Retrieving Intel exception info failed (%ld)",
239 PTR_ERR(skb));
973bb97e
MH		 240 return;
241 }
242
243 if (skb->len != 13) {
2064ee33 244 bt_dev_err(hdev, "Exception info size mismatch");
973bb97e
MH		 245 kfree_skb(skb);
246 return;
247 }
248
2064ee33 249 bt_dev_err(hdev, "Exception info %s", (char *)(skb->data + 1));
973bb97e
MH		 250
251 kfree_skb(skb);
252}
973bb97e 253
d68903da 254int btintel_version_info(struct hci_dev *hdev, struct intel_version *ver)
7feb99e1
MH		 255{
256 const char *variant;
257
d68903da
LAD		 258 /* The hardware platform number has a fixed value of 0x37 and
259 * for now only accept this single value.
260 */
261 if (ver->hw_platform != 0x37) {
262 bt_dev_err(hdev, "Unsupported Intel hardware platform (%u)",
263 ver->hw_platform);
264 return -EINVAL;
265 }
266
267 /* Check for supported iBT hardware variants of this firmware
268 * loading method.
269 *
270 * This check has been put in place to ensure correct forward
271 * compatibility options when newer hardware variants come along.
272 */
273 switch (ver->hw_variant) {
ca5425e1
THJA		 274 case 0x07: /* WP - Legacy ROM */
275 case 0x08: /* StP - Legacy ROM */
d68903da
LAD		 276 case 0x0b: /* SfP */
277 case 0x0c: /* WsP */
278 case 0x11: /* JfP */
279 case 0x12: /* ThP */
280 case 0x13: /* HrP */
281 case 0x14: /* CcP */
282 break;
283 default:
284 bt_dev_err(hdev, "Unsupported Intel hardware variant (%u)",
285 ver->hw_variant);
286 return -EINVAL;
287 }
288
7feb99e1 289 switch (ver->fw_variant) {
ca5425e1
THJA		 290 case 0x01:
291 variant = "Legacy ROM 2.5";
292 break;
7feb99e1
MH		 293 case 0x06:
294 variant = "Bootloader";
295 break;
ca5425e1
THJA		 296 case 0x22:
297 variant = "Legacy ROM 2.x";
298 break;
7feb99e1
MH		 299 case 0x23:
300 variant = "Firmware";
301 break;
302 default:
d68903da
LAD		 303 bt_dev_err(hdev, "Unsupported firmware variant(%02x)", ver->fw_variant);
304 return -EINVAL;
7feb99e1
MH		 305 }
306
2064ee33
MH		 307 bt_dev_info(hdev, "%s revision %u.%u build %u week %u %u",
308 variant, ver->fw_revision >> 4, ver->fw_revision & 0x0f,
309 ver->fw_build_num, ver->fw_build_ww,
310 2000 + ver->fw_build_yy);
d68903da
LAD		 311
312 return 0;
7feb99e1
MH		 313}
314EXPORT_SYMBOL_GPL(btintel_version_info);
315
0d8603b4
THJA		 316static int btintel_secure_send(struct hci_dev *hdev, u8 fragment_type, u32 plen,
317 const void *param)
09df123d
MH		 318{
319 while (plen > 0) {
320 struct sk_buff *skb;
321 u8 cmd_param[253], fragment_len = (plen > 252) ? 252 : plen;
322
323 cmd_param[0] = fragment_type;
324 memcpy(cmd_param + 1, param, fragment_len);
325
326 skb = __hci_cmd_sync(hdev, 0xfc09, fragment_len + 1,
327 cmd_param, HCI_INIT_TIMEOUT);
328 if (IS_ERR(skb))
329 return PTR_ERR(skb);
330
331 kfree_skb(skb);
332
333 plen -= fragment_len;
334 param += fragment_len;
335 }
336
337 return 0;
338}
09df123d 339
145f2368
LP		 340int btintel_load_ddc_config(struct hci_dev *hdev, const char *ddc_name)
341{
342 const struct firmware *fw;
343 struct sk_buff *skb;
344 const u8 *fw_ptr;
345 int err;
346
347 err = request_firmware_direct(&fw, ddc_name, &hdev->dev);
348 if (err < 0) {
349 bt_dev_err(hdev, "Failed to load Intel DDC file %s (%d)",
350 ddc_name, err);
351 return err;
352 }
353
354 bt_dev_info(hdev, "Found Intel DDC parameters: %s", ddc_name);
355
356 fw_ptr = fw->data;
357
358 /* DDC file contains one or more DDC structure which has
359 * Length (1 byte), DDC ID (2 bytes), and DDC value (Length - 2).
360 */
361 while (fw->size > fw_ptr - fw->data) {
362 u8 cmd_plen = fw_ptr[0] + sizeof(u8);
363
364 skb = __hci_cmd_sync(hdev, 0xfc8b, cmd_plen, fw_ptr,
365 HCI_INIT_TIMEOUT);
366 if (IS_ERR(skb)) {
367 bt_dev_err(hdev, "Failed to send Intel_Write_DDC (%ld)",
368 PTR_ERR(skb));
369 release_firmware(fw);
370 return PTR_ERR(skb);
371 }
372
373 fw_ptr += cmd_plen;
374 kfree_skb(skb);
375 }
376
377 release_firmware(fw);
378
379 bt_dev_info(hdev, "Applying Intel DDC parameters completed");
380
381 return 0;
382}
383EXPORT_SYMBOL_GPL(btintel_load_ddc_config);
384
213445b2
MH		 385int btintel_set_event_mask_mfg(struct hci_dev *hdev, bool debug)
386{
28dc4b92 387 int err, ret;
213445b2 388
28dc4b92
LP		 389 err = btintel_enter_mfg(hdev);
390 if (err)
391 return err;
213445b2 392
28dc4b92 393 ret = btintel_set_event_mask(hdev, debug);
213445b2 394
28dc4b92
LP		 395 err = btintel_exit_mfg(hdev, false, false);
396 if (err)
397 return err;
213445b2 398
28dc4b92 399 return ret;
213445b2
MH		 400}
401EXPORT_SYMBOL_GPL(btintel_set_event_mask_mfg);
402
6c483de1
LP		 403int btintel_read_version(struct hci_dev *hdev, struct intel_version *ver)
404{
405 struct sk_buff *skb;
406
407 skb = __hci_cmd_sync(hdev, 0xfc05, 0, NULL, HCI_CMD_TIMEOUT);
408 if (IS_ERR(skb)) {
409 bt_dev_err(hdev, "Reading Intel version information failed (%ld)",
410 PTR_ERR(skb));
411 return PTR_ERR(skb);
412 }
413
414 if (skb->len != sizeof(*ver)) {
415 bt_dev_err(hdev, "Intel version event size mismatch");
416 kfree_skb(skb);
417 return -EILSEQ;
418 }
419
420 memcpy(ver, skb->data, sizeof(*ver));
421
422 kfree_skb(skb);
423
424 return 0;
425}
426EXPORT_SYMBOL_GPL(btintel_read_version);
427
0d8603b4
THJA		 428static int btintel_version_info_tlv(struct hci_dev *hdev,
429 struct intel_version_tlv *version)
57375bee
K		 430{
431 const char *variant;
432
0a460d8f
LAD		 433 /* The hardware platform number has a fixed value of 0x37 and
434 * for now only accept this single value.
435 */
436 if (INTEL_HW_PLATFORM(version->cnvi_bt) != 0x37) {
437 bt_dev_err(hdev, "Unsupported Intel hardware platform (0x%2x)",
438 INTEL_HW_PLATFORM(version->cnvi_bt));
439 return -EINVAL;
440 }
441
442 /* Check for supported iBT hardware variants of this firmware
443 * loading method.
444 *
445 * This check has been put in place to ensure correct forward
446 * compatibility options when newer hardware variants come along.
447 */
448 switch (INTEL_HW_VARIANT(version->cnvi_bt)) {
449 case 0x17: /* TyP */
450 case 0x18: /* Slr */
451 case 0x19: /* Slr-F */
452 break;
453 default:
454 bt_dev_err(hdev, "Unsupported Intel hardware variant (0x%x)",
455 INTEL_HW_VARIANT(version->cnvi_bt));
456 return -EINVAL;
457 }
458
57375bee
K		 459 switch (version->img_type) {
460 case 0x01:
461 variant = "Bootloader";
7de3a42c
LS		 462 /* It is required that every single firmware fragment is acknowledged
463 * with a command complete event. If the boot parameters indicate
464 * that this bootloader does not send them, then abort the setup.
465 */
466 if (version->limited_cce != 0x00) {
467 bt_dev_err(hdev, "Unsupported Intel firmware loading method (0x%x)",
468 version->limited_cce);
469 return -EINVAL;
470 }
471
472 /* Secure boot engine type should be either 1 (ECDSA) or 0 (RSA) */
473 if (version->sbe_type > 0x01) {
474 bt_dev_err(hdev, "Unsupported Intel secure boot engine type (0x%x)",
475 version->sbe_type);
476 return -EINVAL;
477 }
478
57375bee
K		 479 bt_dev_info(hdev, "Device revision is %u", version->dev_rev_id);
480 bt_dev_info(hdev, "Secure boot is %s",
481 version->secure_boot ? "enabled" : "disabled");
482 bt_dev_info(hdev, "OTP lock is %s",
483 version->otp_lock ? "enabled" : "disabled");
484 bt_dev_info(hdev, "API lock is %s",
485 version->api_lock ? "enabled" : "disabled");
486 bt_dev_info(hdev, "Debug lock is %s",
487 version->debug_lock ? "enabled" : "disabled");
488 bt_dev_info(hdev, "Minimum firmware build %u week %u %u",
489 version->min_fw_build_nn, version->min_fw_build_cw,
490 2000 + version->min_fw_build_yy);
491 break;
492 case 0x03:
493 variant = "Firmware";
494 break;
495 default:
496 bt_dev_err(hdev, "Unsupported image type(%02x)", version->img_type);
0a460d8f 497 return -EINVAL;
57375bee
K		 498 }
499
500 bt_dev_info(hdev, "%s timestamp %u.%u buildtype %u build %u", variant,
501 2000 + (version->timestamp >> 8), version->timestamp & 0xff,
502 version->build_type, version->build_num);
503
0a460d8f 504 return 0;
57375bee 505}
57375bee 506
ca5425e1
THJA		 507static int btintel_parse_version_tlv(struct hci_dev *hdev,
508 struct intel_version_tlv *version,
509 struct sk_buff *skb)
510{
511 /* Consume Command Complete Status field */
512 skb_pull(skb, 1);
513
514 /* Event parameters contatin multiple TLVs. Read each of them
515 * and only keep the required data. Also, it use existing legacy
516 * version field like hw_platform, hw_variant, and fw_variant
517 * to keep the existing setup flow
518 */
519 while (skb->len) {
520 struct intel_tlv *tlv;
521
522 /* Make sure skb has a minimum length of the header */
523 if (skb->len < sizeof(*tlv))
524 return -EINVAL;
525
526 tlv = (struct intel_tlv *)skb->data;
527
528 /* Make sure skb has a enough data */
529 if (skb->len < tlv->len + sizeof(*tlv))
530 return -EINVAL;
531
532 switch (tlv->type) {
533 case INTEL_TLV_CNVI_TOP:
534 version->cnvi_top = get_unaligned_le32(tlv->val);
535 break;
536 case INTEL_TLV_CNVR_TOP:
537 version->cnvr_top = get_unaligned_le32(tlv->val);
538 break;
539 case INTEL_TLV_CNVI_BT:
540 version->cnvi_bt = get_unaligned_le32(tlv->val);
541 break;
542 case INTEL_TLV_CNVR_BT:
543 version->cnvr_bt = get_unaligned_le32(tlv->val);
544 break;
545 case INTEL_TLV_DEV_REV_ID:
546 version->dev_rev_id = get_unaligned_le16(tlv->val);
547 break;
548 case INTEL_TLV_IMAGE_TYPE:
549 version->img_type = tlv->val[0];
550 break;
551 case INTEL_TLV_TIME_STAMP:
552 /* If image type is Operational firmware (0x03), then
553 * running FW Calendar Week and Year information can
554 * be extracted from Timestamp information
555 */
556 version->min_fw_build_cw = tlv->val[0];
557 version->min_fw_build_yy = tlv->val[1];
558 version->timestamp = get_unaligned_le16(tlv->val);
559 break;
560 case INTEL_TLV_BUILD_TYPE:
561 version->build_type = tlv->val[0];
562 break;
563 case INTEL_TLV_BUILD_NUM:
564 /* If image type is Operational firmware (0x03), then
565 * running FW build number can be extracted from the
566 * Build information
567 */
568 version->min_fw_build_nn = tlv->val[0];
569 version->build_num = get_unaligned_le32(tlv->val);
570 break;
571 case INTEL_TLV_SECURE_BOOT:
572 version->secure_boot = tlv->val[0];
573 break;
574 case INTEL_TLV_OTP_LOCK:
575 version->otp_lock = tlv->val[0];
576 break;
577 case INTEL_TLV_API_LOCK:
578 version->api_lock = tlv->val[0];
579 break;
580 case INTEL_TLV_DEBUG_LOCK:
581 version->debug_lock = tlv->val[0];
582 break;
583 case INTEL_TLV_MIN_FW:
584 version->min_fw_build_nn = tlv->val[0];
585 version->min_fw_build_cw = tlv->val[1];
586 version->min_fw_build_yy = tlv->val[2];
587 break;
588 case INTEL_TLV_LIMITED_CCE:
589 version->limited_cce = tlv->val[0];
590 break;
591 case INTEL_TLV_SBE_TYPE:
592 version->sbe_type = tlv->val[0];
593 break;
594 case INTEL_TLV_OTP_BDADDR:
595 memcpy(&version->otp_bd_addr, tlv->val,
596 sizeof(bdaddr_t));
597 break;
598 default:
599 /* Ignore rest of information */
600 break;
601 }
602 /* consume the current tlv and move to next*/
603 skb_pull(skb, tlv->len + sizeof(*tlv));
604 }
605
606 return 0;
607}
608
0d8603b4
THJA		 609static int btintel_read_version_tlv(struct hci_dev *hdev,
610 struct intel_version_tlv *version)
57375bee
K		 611{
612 struct sk_buff *skb;
613 const u8 param[1] = { 0xFF };
614
615 if (!version)
616 return -EINVAL;
617
618 skb = __hci_cmd_sync(hdev, 0xfc05, 1, param, HCI_CMD_TIMEOUT);
619 if (IS_ERR(skb)) {
620 bt_dev_err(hdev, "Reading Intel version information failed (%ld)",
621 PTR_ERR(skb));
622 return PTR_ERR(skb);
623 }
624
625 if (skb->data[0]) {
626 bt_dev_err(hdev, "Intel Read Version command failed (%02x)",
627 skb->data[0]);
628 kfree_skb(skb);
629 return -EIO;
630 }
631
019a1caa 632 btintel_parse_version_tlv(hdev, version, skb);
57375bee
K		 633
634 kfree_skb(skb);
635 return 0;
636}
57375bee 637
d06f107b
LP		 638/* ------- REGMAP IBT SUPPORT ------- */
639
640#define IBT_REG_MODE_8BIT 0x00
641#define IBT_REG_MODE_16BIT 0x01
642#define IBT_REG_MODE_32BIT 0x02
643
644struct regmap_ibt_context {
645 struct hci_dev *hdev;
646 __u16 op_write;
647 __u16 op_read;
648};
649
650struct ibt_cp_reg_access {
651 __le32 addr;
652 __u8 mode;
653 __u8 len;
683cc86d 654 __u8 data[];
d06f107b
LP		 655} __packed;
656
657struct ibt_rp_reg_access {
658 __u8 status;
659 __le32 addr;
683cc86d 660 __u8 data[];
d06f107b
LP		 661} __packed;
662
663static int regmap_ibt_read(void *context, const void *addr, size_t reg_size,
664 void *val, size_t val_size)
665{
666 struct regmap_ibt_context *ctx = context;
667 struct ibt_cp_reg_access cp;
668 struct ibt_rp_reg_access *rp;
669 struct sk_buff *skb;
670 int err = 0;
671
672 if (reg_size != sizeof(__le32))
673 return -EINVAL;
674
675 switch (val_size) {
676 case 1:
677 cp.mode = IBT_REG_MODE_8BIT;
678 break;
679 case 2:
680 cp.mode = IBT_REG_MODE_16BIT;
681 break;
682 case 4:
683 cp.mode = IBT_REG_MODE_32BIT;
684 break;
685 default:
686 return -EINVAL;
687 }
688
689 /* regmap provides a little-endian formatted addr */
690 cp.addr = *(__le32 *)addr;
691 cp.len = val_size;
692
693 bt_dev_dbg(ctx->hdev, "Register (0x%x) read", le32_to_cpu(cp.addr));
694
695 skb = hci_cmd_sync(ctx->hdev, ctx->op_read, sizeof(cp), &cp,
696 HCI_CMD_TIMEOUT);
697 if (IS_ERR(skb)) {
698 err = PTR_ERR(skb);
699 bt_dev_err(ctx->hdev, "regmap: Register (0x%x) read error (%d)",
700 le32_to_cpu(cp.addr), err);
701 return err;
702 }
703
704 if (skb->len != sizeof(*rp) + val_size) {
705 bt_dev_err(ctx->hdev, "regmap: Register (0x%x) read error, bad len",
706 le32_to_cpu(cp.addr));
707 err = -EINVAL;
708 goto done;
709 }
710
711 rp = (struct ibt_rp_reg_access *)skb->data;
712
713 if (rp->addr != cp.addr) {
714 bt_dev_err(ctx->hdev, "regmap: Register (0x%x) read error, bad addr",
715 le32_to_cpu(rp->addr));
716 err = -EINVAL;
717 goto done;
718 }
719
720 memcpy(val, rp->data, val_size);
721
722done:
723 kfree_skb(skb);
724 return err;
725}
726
727static int regmap_ibt_gather_write(void *context,
728 const void *addr, size_t reg_size,
729 const void *val, size_t val_size)
730{
731 struct regmap_ibt_context *ctx = context;
732 struct ibt_cp_reg_access *cp;
733 struct sk_buff *skb;
734 int plen = sizeof(*cp) + val_size;
735 u8 mode;
736 int err = 0;
737
738 if (reg_size != sizeof(__le32))
739 return -EINVAL;
740
741 switch (val_size) {
742 case 1:
743 mode = IBT_REG_MODE_8BIT;
744 break;
745 case 2:
746 mode = IBT_REG_MODE_16BIT;
747 break;
748 case 4:
749 mode = IBT_REG_MODE_32BIT;
750 break;
751 default:
752 return -EINVAL;
753 }
754
755 cp = kmalloc(plen, GFP_KERNEL);
756 if (!cp)
757 return -ENOMEM;
758
759 /* regmap provides a little-endian formatted addr/value */
760 cp->addr = *(__le32 *)addr;
761 cp->mode = mode;
762 cp->len = val_size;
763 memcpy(&cp->data, val, val_size);
764
765 bt_dev_dbg(ctx->hdev, "Register (0x%x) write", le32_to_cpu(cp->addr));
766
767 skb = hci_cmd_sync(ctx->hdev, ctx->op_write, plen, cp, HCI_CMD_TIMEOUT);
768 if (IS_ERR(skb)) {
769 err = PTR_ERR(skb);
770 bt_dev_err(ctx->hdev, "regmap: Register (0x%x) write error (%d)",
771 le32_to_cpu(cp->addr), err);
772 goto done;
773 }
774 kfree_skb(skb);
775
776done:
777 kfree(cp);
778 return err;
779}
780
781static int regmap_ibt_write(void *context, const void *data, size_t count)
782{
783 /* data contains register+value, since we only support 32bit addr,
784 * minimum data size is 4 bytes.
785 */
786 if (WARN_ONCE(count < 4, "Invalid register access"))
787 return -EINVAL;
788
789 return regmap_ibt_gather_write(context, data, 4, data + 4, count - 4);
790}
791
792static void regmap_ibt_free_context(void *context)
793{
794 kfree(context);
795}
796
797static struct regmap_bus regmap_ibt = {
798 .read = regmap_ibt_read,
799 .write = regmap_ibt_write,
800 .gather_write = regmap_ibt_gather_write,
801 .free_context = regmap_ibt_free_context,
802 .reg_format_endian_default = REGMAP_ENDIAN_LITTLE,
803 .val_format_endian_default = REGMAP_ENDIAN_LITTLE,
804};
805
806/* Config is the same for all register regions */
807static const struct regmap_config regmap_ibt_cfg = {
808 .name = "btintel_regmap",
809 .reg_bits = 32,
810 .val_bits = 32,
811};
812
813struct regmap *btintel_regmap_init(struct hci_dev *hdev, u16 opcode_read,
814 u16 opcode_write)
815{
816 struct regmap_ibt_context *ctx;
817
818 bt_dev_info(hdev, "regmap: Init R%x-W%x region", opcode_read,
819 opcode_write);
820
821 ctx = kzalloc(sizeof(*ctx), GFP_KERNEL);
822 if (!ctx)
823 return ERR_PTR(-ENOMEM);
824
825 ctx->op_read = opcode_read;
826 ctx->op_write = opcode_write;
827 ctx->hdev = hdev;
828
829 return regmap_init(&hdev->dev, &regmap_ibt, ctx, &regmap_ibt_cfg);
830}
831EXPORT_SYMBOL_GPL(btintel_regmap_init);
832
e5889af6
THJA		 833int btintel_send_intel_reset(struct hci_dev *hdev, u32 boot_param)
834{
835 struct intel_reset params = { 0x00, 0x01, 0x00, 0x01, 0x00000000 };
836 struct sk_buff *skb;
837
838 params.boot_param = cpu_to_le32(boot_param);
839
840 skb = __hci_cmd_sync(hdev, 0xfc01, sizeof(params), &params,
841 HCI_INIT_TIMEOUT);
842 if (IS_ERR(skb)) {
843 bt_dev_err(hdev, "Failed to send Intel Reset command");
844 return PTR_ERR(skb);
845 }
846
847 kfree_skb(skb);
848
849 return 0;
850}
851EXPORT_SYMBOL_GPL(btintel_send_intel_reset);
852
faf174d2
THJA		 853int btintel_read_boot_params(struct hci_dev *hdev,
854 struct intel_boot_params *params)
855{
856 struct sk_buff *skb;
857
858 skb = __hci_cmd_sync(hdev, 0xfc0d, 0, NULL, HCI_INIT_TIMEOUT);
859 if (IS_ERR(skb)) {
860 bt_dev_err(hdev, "Reading Intel boot parameters failed (%ld)",
861 PTR_ERR(skb));
862 return PTR_ERR(skb);
863 }
864
865 if (skb->len != sizeof(*params)) {
866 bt_dev_err(hdev, "Intel boot parameters size mismatch");
867 kfree_skb(skb);
868 return -EILSEQ;
869 }
870
871 memcpy(params, skb->data, sizeof(*params));
872
873 kfree_skb(skb);
874
875 if (params->status) {
876 bt_dev_err(hdev, "Intel boot parameters command failed (%02x)",
877 params->status);
878 return -bt_to_errno(params->status);
879 }
880
881 bt_dev_info(hdev, "Device revision is %u",
882 le16_to_cpu(params->dev_revid));
883
884 bt_dev_info(hdev, "Secure boot is %s",
885 params->secure_boot ? "enabled" : "disabled");
886
887 bt_dev_info(hdev, "OTP lock is %s",
888 params->otp_lock ? "enabled" : "disabled");
889
890 bt_dev_info(hdev, "API lock is %s",
891 params->api_lock ? "enabled" : "disabled");
892
893 bt_dev_info(hdev, "Debug lock is %s",
894 params->debug_lock ? "enabled" : "disabled");
895
896 bt_dev_info(hdev, "Minimum firmware build %u week %u %u",
897 params->min_fw_build_nn, params->min_fw_build_cw,
898 2000 + params->min_fw_build_yy);
899
900 return 0;
901}
902EXPORT_SYMBOL_GPL(btintel_read_boot_params);
903
e9117215
K		 904static int btintel_sfi_rsa_header_secure_send(struct hci_dev *hdev,
905 const struct firmware *fw)
fbbe83c5
THJA		 906{
907 int err;
fbbe83c5
THJA		 908
909 /* Start the firmware download transaction with the Init fragment
910 * represented by the 128 bytes of CSS header.
911 */
912 err = btintel_secure_send(hdev, 0x00, 128, fw->data);
913 if (err < 0) {
914 bt_dev_err(hdev, "Failed to send firmware header (%d)", err);
915 goto done;
916 }
917
918 /* Send the 256 bytes of public key information from the firmware
919 * as the PKey fragment.
920 */
921 err = btintel_secure_send(hdev, 0x03, 256, fw->data + 128);
922 if (err < 0) {
923 bt_dev_err(hdev, "Failed to send firmware pkey (%d)", err);
924 goto done;
925 }
926
927 /* Send the 256 bytes of signature information from the firmware
928 * as the Sign fragment.
929 */
930 err = btintel_secure_send(hdev, 0x02, 256, fw->data + 388);
931 if (err < 0) {
932 bt_dev_err(hdev, "Failed to send firmware signature (%d)", err);
933 goto done;
934 }
935
e9117215
K		 936done:
937 return err;
938}
939
81ebea53
K		 940static int btintel_sfi_ecdsa_header_secure_send(struct hci_dev *hdev,
941 const struct firmware *fw)
942{
943 int err;
944
945 /* Start the firmware download transaction with the Init fragment
946 * represented by the 128 bytes of CSS header.
947 */
948 err = btintel_secure_send(hdev, 0x00, 128, fw->data + 644);
949 if (err < 0) {
950 bt_dev_err(hdev, "Failed to send firmware header (%d)", err);
951 return err;
952 }
953
954 /* Send the 96 bytes of public key information from the firmware
955 * as the PKey fragment.
956 */
957 err = btintel_secure_send(hdev, 0x03, 96, fw->data + 644 + 128);
958 if (err < 0) {
959 bt_dev_err(hdev, "Failed to send firmware pkey (%d)", err);
960 return err;
961 }
962
963 /* Send the 96 bytes of signature information from the firmware
964 * as the Sign fragment
965 */
966 err = btintel_secure_send(hdev, 0x02, 96, fw->data + 644 + 224);
967 if (err < 0) {
968 bt_dev_err(hdev, "Failed to send firmware signature (%d)",
969 err);
970 return err;
971 }
972 return 0;
973}
974
e9117215
K		 975static int btintel_download_firmware_payload(struct hci_dev *hdev,
976 const struct firmware *fw,
ac056546 977 size_t offset)
e9117215
K		 978{
979 int err;
980 const u8 *fw_ptr;
981 u32 frag_len;
982
983 fw_ptr = fw->data + offset;
fbbe83c5 984 frag_len = 0;
e9117215 985 err = -EINVAL;
fbbe83c5
THJA		 986
987 while (fw_ptr - fw->data < fw->size) {
988 struct hci_command_hdr *cmd = (void *)(fw_ptr + frag_len);
989
fbbe83c5
THJA		 990 frag_len += sizeof(*cmd) + cmd->plen;
991
992 /* The parameter length of the secure send command requires
993 * a 4 byte alignment. It happens so that the firmware file
994 * contains proper Intel_NOP commands to align the fragments
995 * as needed.
996 *
997 * Send set of commands with 4 byte alignment from the
998 * firmware data buffer as a single Data fragement.
999 */
1000 if (!(frag_len % 4)) {
1001 err = btintel_secure_send(hdev, 0x01, frag_len, fw_ptr);
1002 if (err < 0) {
1003 bt_dev_err(hdev,
1004 "Failed to send firmware data (%d)",
1005 err);
1006 goto done;
1007 }
1008
1009 fw_ptr += frag_len;
1010 frag_len = 0;
1011 }
1012 }
1013
1014done:
1015 return err;
1016}
e9117215 1017
ac056546
LAD		 1018static bool btintel_firmware_version(struct hci_dev *hdev,
1019 u8 num, u8 ww, u8 yy,
1020 const struct firmware *fw,
1021 u32 *boot_addr)
1022{
1023 const u8 *fw_ptr;
1024
1025 fw_ptr = fw->data;
1026
1027 while (fw_ptr - fw->data < fw->size) {
1028 struct hci_command_hdr *cmd = (void *)(fw_ptr);
1029
1030 /* Each SKU has a different reset parameter to use in the
1031 * HCI_Intel_Reset command and it is embedded in the firmware
1032 * data. So, instead of using static value per SKU, check
1033 * the firmware data and save it for later use.
1034 */
1035 if (le16_to_cpu(cmd->opcode) == CMD_WRITE_BOOT_PARAMS) {
1036 struct cmd_write_boot_params *params;
1037
1038 params = (void *)(fw_ptr + sizeof(*cmd));
1039
1040 bt_dev_info(hdev, "Boot Address: 0x%x",
1041 le32_to_cpu(params->boot_addr));
1042
1043 bt_dev_info(hdev, "Firmware Version: %u-%u.%u",
1044 params->fw_build_num, params->fw_build_ww,
1045 params->fw_build_yy);
1046
1047 return (num == params->fw_build_num &&
1048 ww == params->fw_build_ww &&
1049 yy == params->fw_build_yy);
1050 }
1051
1052 fw_ptr += sizeof(*cmd) + cmd->plen;
1053 }
1054
1055 return false;
1056}
1057
e9117215 1058int btintel_download_firmware(struct hci_dev *hdev,
ac056546 1059 struct intel_version *ver,
e9117215
K		 1060 const struct firmware *fw,
1061 u32 *boot_param)
1062{
1063 int err;
1064
ac056546
LAD		 1065 /* SfP and WsP don't seem to update the firmware version on file
1066 * so version checking is currently not possible.
1067 */
1068 switch (ver->hw_variant) {
1069 case 0x0b: /* SfP */
1070 case 0x0c: /* WsP */
1071 /* Skip version checking */
1072 break;
1073 default:
1f4ec585
LS		 1074 /* Skip reading firmware file version in bootloader mode */
1075 if (ver->fw_variant == 0x06)
1076 break;
1077
ac056546
LAD		 1078 /* Skip download if firmware has the same version */
1079 if (btintel_firmware_version(hdev, ver->fw_build_num,
1080 ver->fw_build_ww, ver->fw_build_yy,
1081 fw, boot_param)) {
1082 bt_dev_info(hdev, "Firmware already loaded");
1083 /* Return -EALREADY to indicate that the firmware has
1084 * already been loaded.
1085 */
1086 return -EALREADY;
1087 }
1088 }
1089
9b16bfbf
LAD		 1090 /* The firmware variant determines if the device is in bootloader
1091 * mode or is running operational firmware. The value 0x06 identifies
1092 * the bootloader and the value 0x23 identifies the operational
1093 * firmware.
1094 *
1095 * If the firmware version has changed that means it needs to be reset
1096 * to bootloader when operational so the new firmware can be loaded.
1097 */
1098 if (ver->fw_variant == 0x23)
1099 return -EINVAL;
1100
e9117215
K		 1101 err = btintel_sfi_rsa_header_secure_send(hdev, fw);
1102 if (err)
1103 return err;
1104
ac056546 1105 return btintel_download_firmware_payload(hdev, fw, RSA_HEADER_LEN);
e9117215 1106}
fbbe83c5
THJA		 1107EXPORT_SYMBOL_GPL(btintel_download_firmware);
1108
019a1caa
THJA		 1109static int btintel_download_fw_tlv(struct hci_dev *hdev,
1110 struct intel_version_tlv *ver,
1111 const struct firmware *fw, u32 *boot_param,
1112 u8 hw_variant, u8 sbe_type)
81ebea53
K		 1113{
1114 int err;
1115 u32 css_header_ver;
1116
1f4ec585
LS		 1117 /* Skip reading firmware file version in bootloader mode */
1118 if (ver->img_type != 0x01) {
1119 /* Skip download if firmware has the same version */
1120 if (btintel_firmware_version(hdev, ver->min_fw_build_nn,
1121 ver->min_fw_build_cw,
1122 ver->min_fw_build_yy,
1123 fw, boot_param)) {
1124 bt_dev_info(hdev, "Firmware already loaded");
1125 /* Return -EALREADY to indicate that firmware has
1126 * already been loaded.
1127 */
1128 return -EALREADY;
1129 }
ac056546
LAD		 1130 }
1131
9b16bfbf
LAD		 1132 /* The firmware variant determines if the device is in bootloader
1133 * mode or is running operational firmware. The value 0x01 identifies
1134 * the bootloader and the value 0x03 identifies the operational
1135 * firmware.
1136 *
1137 * If the firmware version has changed that means it needs to be reset
1138 * to bootloader when operational so the new firmware can be loaded.
1139 */
1140 if (ver->img_type == 0x03)
1141 return -EINVAL;
1142
81ebea53
K		 1143 /* iBT hardware variants 0x0b, 0x0c, 0x11, 0x12, 0x13, 0x14 support
1144 * only RSA secure boot engine. Hence, the corresponding sfi file will
1145 * have RSA header of 644 bytes followed by Command Buffer.
1146 *
1147 * iBT hardware variants 0x17, 0x18 onwards support both RSA and ECDSA
1148 * secure boot engine. As a result, the corresponding sfi file will
1149 * have RSA header of 644, ECDSA header of 320 bytes followed by
1150 * Command Buffer.
1151 *
1152 * CSS Header byte positions 0x08 to 0x0B represent the CSS Header
1153 * version: RSA(0x00010000) , ECDSA (0x00020000)
1154 */
1155 css_header_ver = get_unaligned_le32(fw->data + CSS_HEADER_OFFSET);
1156 if (css_header_ver != 0x00010000) {
1157 bt_dev_err(hdev, "Invalid CSS Header version");
1158 return -EINVAL;
1159 }
1160
1161 if (hw_variant <= 0x14) {
1162 if (sbe_type != 0x00) {
1163 bt_dev_err(hdev, "Invalid SBE type for hardware variant (%d)",
1164 hw_variant);
1165 return -EINVAL;
1166 }
1167
1168 err = btintel_sfi_rsa_header_secure_send(hdev, fw);
1169 if (err)
1170 return err;
1171
ac056546 1172 err = btintel_download_firmware_payload(hdev, fw, RSA_HEADER_LEN);
81ebea53
K		 1173 if (err)
1174 return err;
1175 } else if (hw_variant >= 0x17) {
1176 /* Check if CSS header for ECDSA follows the RSA header */
1177 if (fw->data[ECDSA_OFFSET] != 0x06)
1178 return -EINVAL;
1179
1180 /* Check if the CSS Header version is ECDSA(0x00020000) */
1181 css_header_ver = get_unaligned_le32(fw->data + ECDSA_OFFSET + CSS_HEADER_OFFSET);
1182 if (css_header_ver != 0x00020000) {
1183 bt_dev_err(hdev, "Invalid CSS Header version");
1184 return -EINVAL;
1185 }
1186
1187 if (sbe_type == 0x00) {
1188 err = btintel_sfi_rsa_header_secure_send(hdev, fw);
1189 if (err)
1190 return err;
1191
1192 err = btintel_download_firmware_payload(hdev, fw,
81ebea53
K		 1193 RSA_HEADER_LEN + ECDSA_HEADER_LEN);
1194 if (err)
1195 return err;
1196 } else if (sbe_type == 0x01) {
1197 err = btintel_sfi_ecdsa_header_secure_send(hdev, fw);
1198 if (err)
1199 return err;
1200
1201 err = btintel_download_firmware_payload(hdev, fw,
81ebea53
K		 1202 RSA_HEADER_LEN + ECDSA_HEADER_LEN);
1203 if (err)
1204 return err;
1205 }
1206 }
1207 return 0;
1208}
81ebea53 1209
0d8603b4 1210static void btintel_reset_to_bootloader(struct hci_dev *hdev)
b9a2562f
AB		 1211{
1212 struct intel_reset params;
1213 struct sk_buff *skb;
1214
1215 /* Send Intel Reset command. This will result in
1216 * re-enumeration of BT controller.
1217 *
1218 * Intel Reset parameter description:
1219 * reset_type : 0x00 (Soft reset),
1220 * 0x01 (Hard reset)
1221 * patch_enable : 0x00 (Do not enable),
1222 * 0x01 (Enable)
1223 * ddc_reload : 0x00 (Do not reload),
1224 * 0x01 (Reload)
1225 * boot_option: 0x00 (Current image),
1226 * 0x01 (Specified boot address)
1227 * boot_param: Boot address
1228 *
1229 */
1230 params.reset_type = 0x01;
1231 params.patch_enable = 0x01;
1232 params.ddc_reload = 0x01;
1233 params.boot_option = 0x00;
1234 params.boot_param = cpu_to_le32(0x00000000);
1235
1236 skb = __hci_cmd_sync(hdev, 0xfc01, sizeof(params),
1237 &params, HCI_INIT_TIMEOUT);
1238 if (IS_ERR(skb)) {
1239 bt_dev_err(hdev, "FW download error recovery failed (%ld)",
1240 PTR_ERR(skb));
1241 return;
1242 }
1243 bt_dev_info(hdev, "Intel reset sent to retry FW download");
1244 kfree_skb(skb);
1245
1246 /* Current Intel BT controllers(ThP/JfP) hold the USB reset
1247 * lines for 2ms when it receives Intel Reset in bootloader mode.
1248 * Whereas, the upcoming Intel BT controllers will hold USB reset
1249 * for 150ms. To keep the delay generic, 150ms is chosen here.
1250 */
1251 msleep(150);
1252}
b9a2562f 1253
0d8603b4
THJA		 1254static int btintel_read_debug_features(struct hci_dev *hdev,
1255 struct intel_debug_features *features)
d74abe21
C		 1256{
1257 struct sk_buff *skb;
1258 u8 page_no = 1;
1259
1260 /* Intel controller supports two pages, each page is of 128-bit
1261 * feature bit mask. And each bit defines specific feature support
1262 */
1263 skb = __hci_cmd_sync(hdev, 0xfca6, sizeof(page_no), &page_no,
1264 HCI_INIT_TIMEOUT);
1265 if (IS_ERR(skb)) {
1266 bt_dev_err(hdev, "Reading supported features failed (%ld)",
1267 PTR_ERR(skb));
1268 return PTR_ERR(skb);
1269 }
1270
1271 if (skb->len != (sizeof(features->page1) + 3)) {
1272 bt_dev_err(hdev, "Supported features event size mismatch");
1273 kfree_skb(skb);
1274 return -EILSEQ;
1275 }
1276
1277 memcpy(features->page1, skb->data + 3, sizeof(features->page1));
1278
1279 /* Read the supported features page2 if required in future.
1280 */
1281 kfree_skb(skb);
1282 return 0;
1283}
d74abe21 1284
0d8603b4 1285static int btintel_set_debug_features(struct hci_dev *hdev,
c453b10c
C		 1286 const struct intel_debug_features *features)
1287{
76a56bbd 1288 u8 mask[11] = { 0x0a, 0x92, 0x02, 0x7f, 0x00, 0x00, 0x00, 0x00,
c453b10c 1289 0x00, 0x00, 0x00 };
76a56bbd
C		 1290 u8 period[5] = { 0x04, 0x91, 0x02, 0x05, 0x00 };
1291 u8 trace_enable = 0x02;
c453b10c
C		 1292 struct sk_buff *skb;
1293
1294 if (!features)
1295 return -EINVAL;
1296
1297 if (!(features->page1[0] & 0x3f)) {
1298 bt_dev_info(hdev, "Telemetry exception format not supported");
1299 return 0;
1300 }
1301
1302 skb = __hci_cmd_sync(hdev, 0xfc8b, 11, mask, HCI_INIT_TIMEOUT);
1303 if (IS_ERR(skb)) {
1304 bt_dev_err(hdev, "Setting Intel telemetry ddc write event mask failed (%ld)",
1305 PTR_ERR(skb));
1306 return PTR_ERR(skb);
1307 }
76a56bbd
C		 1308 kfree_skb(skb);
1309
1310 skb = __hci_cmd_sync(hdev, 0xfc8b, 5, period, HCI_INIT_TIMEOUT);
1311 if (IS_ERR(skb)) {
1312 bt_dev_err(hdev, "Setting periodicity for link statistics traces failed (%ld)",
1313 PTR_ERR(skb));
1314 return PTR_ERR(skb);
1315 }
1316 kfree_skb(skb);
c453b10c 1317
76a56bbd
C		 1318 skb = __hci_cmd_sync(hdev, 0xfca1, 1, &trace_enable, HCI_INIT_TIMEOUT);
1319 if (IS_ERR(skb)) {
1320 bt_dev_err(hdev, "Enable tracing of link statistics events failed (%ld)",
1321 PTR_ERR(skb));
1322 return PTR_ERR(skb);
1323 }
c453b10c 1324 kfree_skb(skb);
76a56bbd 1325
c453b10c
C		 1326 return 0;
1327}
c453b10c 1328
83f2dafe
THJA		 1329static const struct firmware *btintel_legacy_rom_get_fw(struct hci_dev *hdev,
1330 struct intel_version *ver)
1331{
1332 const struct firmware *fw;
1333 char fwname[64];
1334 int ret;
1335
1336 snprintf(fwname, sizeof(fwname),
1337 "intel/ibt-hw-%x.%x.%x-fw-%x.%x.%x.%x.%x.bseq",
1338 ver->hw_platform, ver->hw_variant, ver->hw_revision,
1339 ver->fw_variant, ver->fw_revision, ver->fw_build_num,
1340 ver->fw_build_ww, ver->fw_build_yy);
1341
1342 ret = request_firmware(&fw, fwname, &hdev->dev);
1343 if (ret < 0) {
1344 if (ret == -EINVAL) {
1345 bt_dev_err(hdev, "Intel firmware file request failed (%d)",
1346 ret);
1347 return NULL;
1348 }
1349
1350 bt_dev_err(hdev, "failed to open Intel firmware file: %s (%d)",
1351 fwname, ret);
1352
1353 /* If the correct firmware patch file is not found, use the
1354 * default firmware patch file instead
1355 */
1356 snprintf(fwname, sizeof(fwname), "intel/ibt-hw-%x.%x.bseq",
1357 ver->hw_platform, ver->hw_variant);
1358 if (request_firmware(&fw, fwname, &hdev->dev) < 0) {
1359 bt_dev_err(hdev, "failed to open default fw file: %s",
1360 fwname);
1361 return NULL;
1362 }
1363 }
1364
1365 bt_dev_info(hdev, "Intel Bluetooth firmware file: %s", fwname);
1366
1367 return fw;
1368}
1369
1370static int btintel_legacy_rom_patching(struct hci_dev *hdev,
1371 const struct firmware *fw,
1372 const u8 **fw_ptr, int *disable_patch)
1373{
1374 struct sk_buff *skb;
1375 struct hci_command_hdr *cmd;
1376 const u8 *cmd_param;
1377 struct hci_event_hdr *evt = NULL;
1378 const u8 *evt_param = NULL;
1379 int remain = fw->size - (*fw_ptr - fw->data);
1380
1381 /* The first byte indicates the types of the patch command or event.
1382 * 0x01 means HCI command and 0x02 is HCI event. If the first bytes
1383 * in the current firmware buffer doesn't start with 0x01 or
1384 * the size of remain buffer is smaller than HCI command header,
1385 * the firmware file is corrupted and it should stop the patching
1386 * process.
1387 */
1388 if (remain > HCI_COMMAND_HDR_SIZE && *fw_ptr[0] != 0x01) {
1389 bt_dev_err(hdev, "Intel fw corrupted: invalid cmd read");
1390 return -EINVAL;
1391 }
1392 (*fw_ptr)++;
1393 remain--;
1394
1395 cmd = (struct hci_command_hdr *)(*fw_ptr);
1396 *fw_ptr += sizeof(*cmd);
1397 remain -= sizeof(*cmd);
1398
1399 /* Ensure that the remain firmware data is long enough than the length
1400 * of command parameter. If not, the firmware file is corrupted.
1401 */
1402 if (remain < cmd->plen) {
1403 bt_dev_err(hdev, "Intel fw corrupted: invalid cmd len");
1404 return -EFAULT;
1405 }
1406
1407 /* If there is a command that loads a patch in the firmware
1408 * file, then enable the patch upon success, otherwise just
1409 * disable the manufacturer mode, for example patch activation
1410 * is not required when the default firmware patch file is used
1411 * because there are no patch data to load.
1412 */
1413 if (*disable_patch && le16_to_cpu(cmd->opcode) == 0xfc8e)
1414 *disable_patch = 0;
1415
1416 cmd_param = *fw_ptr;
1417 *fw_ptr += cmd->plen;
1418 remain -= cmd->plen;
1419
1420 /* This reads the expected events when the above command is sent to the
1421 * device. Some vendor commands expects more than one events, for
1422 * example command status event followed by vendor specific event.
1423 * For this case, it only keeps the last expected event. so the command
1424 * can be sent with __hci_cmd_sync_ev() which returns the sk_buff of
1425 * last expected event.
1426 */
1427 while (remain > HCI_EVENT_HDR_SIZE && *fw_ptr[0] == 0x02) {
1428 (*fw_ptr)++;
1429 remain--;
1430
1431 evt = (struct hci_event_hdr *)(*fw_ptr);
1432 *fw_ptr += sizeof(*evt);
1433 remain -= sizeof(*evt);
1434
1435 if (remain < evt->plen) {
1436 bt_dev_err(hdev, "Intel fw corrupted: invalid evt len");
1437 return -EFAULT;
1438 }
1439
1440 evt_param = *fw_ptr;
1441 *fw_ptr += evt->plen;
1442 remain -= evt->plen;
1443 }
1444
1445 /* Every HCI commands in the firmware file has its correspond event.
1446 * If event is not found or remain is smaller than zero, the firmware
1447 * file is corrupted.
1448 */
1449 if (!evt || !evt_param || remain < 0) {
1450 bt_dev_err(hdev, "Intel fw corrupted: invalid evt read");
1451 return -EFAULT;
1452 }
1453
1454 skb = __hci_cmd_sync_ev(hdev, le16_to_cpu(cmd->opcode), cmd->plen,
1455 cmd_param, evt->evt, HCI_INIT_TIMEOUT);
1456 if (IS_ERR(skb)) {
1457 bt_dev_err(hdev, "sending Intel patch command (0x%4.4x) failed (%ld)",
1458 cmd->opcode, PTR_ERR(skb));
1459 return PTR_ERR(skb);
1460 }
1461
1462 /* It ensures that the returned event matches the event data read from
1463 * the firmware file. At fist, it checks the length and then
1464 * the contents of the event.
1465 */
1466 if (skb->len != evt->plen) {
1467 bt_dev_err(hdev, "mismatch event length (opcode 0x%4.4x)",
1468 le16_to_cpu(cmd->opcode));
1469 kfree_skb(skb);
1470 return -EFAULT;
1471 }
1472
1473 if (memcmp(skb->data, evt_param, evt->plen)) {
1474 bt_dev_err(hdev, "mismatch event parameter (opcode 0x%4.4x)",
1475 le16_to_cpu(cmd->opcode));
1476 kfree_skb(skb);
1477 return -EFAULT;
1478 }
1479 kfree_skb(skb);
1480
1481 return 0;
1482}
1483
1484static int btintel_legacy_rom_setup(struct hci_dev *hdev,
1485 struct intel_version *ver)
1486{
1487 const struct firmware *fw;
1488 const u8 *fw_ptr;
1489 int disable_patch, err;
1490 struct intel_version new_ver;
1491
1492 BT_DBG("%s", hdev->name);
1493
1494 /* fw_patch_num indicates the version of patch the device currently
1495 * have. If there is no patch data in the device, it is always 0x00.
1496 * So, if it is other than 0x00, no need to patch the device again.
1497 */
1498 if (ver->fw_patch_num) {
1499 bt_dev_info(hdev,
1500 "Intel device is already patched. patch num: %02x",
1501 ver->fw_patch_num);
1502 goto complete;
1503 }
1504
1505 /* Opens the firmware patch file based on the firmware version read
1506 * from the controller. If it fails to open the matching firmware
1507 * patch file, it tries to open the default firmware patch file.
1508 * If no patch file is found, allow the device to operate without
1509 * a patch.
1510 */
1511 fw = btintel_legacy_rom_get_fw(hdev, ver);
1512 if (!fw)
1513 goto complete;
1514 fw_ptr = fw->data;
1515
1516 /* Enable the manufacturer mode of the controller.
1517 * Only while this mode is enabled, the driver can download the
1518 * firmware patch data and configuration parameters.
1519 */
1520 err = btintel_enter_mfg(hdev);
1521 if (err) {
1522 release_firmware(fw);
1523 return err;
1524 }
1525
1526 disable_patch = 1;
1527
1528 /* The firmware data file consists of list of Intel specific HCI
1529 * commands and its expected events. The first byte indicates the
1530 * type of the message, either HCI command or HCI event.
1531 *
1532 * It reads the command and its expected event from the firmware file,
1533 * and send to the controller. Once __hci_cmd_sync_ev() returns,
1534 * the returned event is compared with the event read from the firmware
1535 * file and it will continue until all the messages are downloaded to
1536 * the controller.
1537 *
1538 * Once the firmware patching is completed successfully,
1539 * the manufacturer mode is disabled with reset and activating the
1540 * downloaded patch.
1541 *
1542 * If the firmware patching fails, the manufacturer mode is
1543 * disabled with reset and deactivating the patch.
1544 *
1545 * If the default patch file is used, no reset is done when disabling
1546 * the manufacturer.
1547 */
1548 while (fw->size > fw_ptr - fw->data) {
1549 int ret;
1550
1551 ret = btintel_legacy_rom_patching(hdev, fw, &fw_ptr,
1552 &disable_patch);
1553 if (ret < 0)
1554 goto exit_mfg_deactivate;
1555 }
1556
1557 release_firmware(fw);
1558
1559 if (disable_patch)
1560 goto exit_mfg_disable;
1561
1562 /* Patching completed successfully and disable the manufacturer mode
1563 * with reset and activate the downloaded firmware patches.
1564 */
1565 err = btintel_exit_mfg(hdev, true, true);
1566 if (err)
1567 return err;
1568
1569 /* Need build number for downloaded fw patches in
1570 * every power-on boot
1571 */
1572 err = btintel_read_version(hdev, &new_ver);
1573 if (err)
1574 return err;
1575
1576 bt_dev_info(hdev, "Intel BT fw patch 0x%02x completed & activated",
1577 new_ver.fw_patch_num);
1578
1579 goto complete;
1580
1581exit_mfg_disable:
1582 /* Disable the manufacturer mode without reset */
1583 err = btintel_exit_mfg(hdev, false, false);
1584 if (err)
1585 return err;
1586
1587 bt_dev_info(hdev, "Intel firmware patch completed");
1588
1589 goto complete;
1590
1591exit_mfg_deactivate:
1592 release_firmware(fw);
1593
1594 /* Patching failed. Disable the manufacturer mode with reset and
1595 * deactivate the downloaded firmware patches.
1596 */
1597 err = btintel_exit_mfg(hdev, true, false);
1598 if (err)
1599 return err;
1600
1601 bt_dev_info(hdev, "Intel firmware patch completed and deactivated");
1602
1603complete:
1604 /* Set the event mask for Intel specific vendor events. This enables
1605 * a few extra events that are useful during general operation.
1606 */
1607 btintel_set_event_mask_mfg(hdev, false);
1608
1609 btintel_check_bdaddr(hdev);
1610
1611 return 0;
1612}
1613
019a1caa
THJA		 1614static int btintel_download_wait(struct hci_dev *hdev, ktime_t calltime, int msec)
1615{
1616 ktime_t delta, rettime;
1617 unsigned long long duration;
1618 int err;
1619
1620 btintel_set_flag(hdev, INTEL_FIRMWARE_LOADED);
1621
1622 bt_dev_info(hdev, "Waiting for firmware download to complete");
1623
1624 err = btintel_wait_on_flag_timeout(hdev, INTEL_DOWNLOADING,
1625 TASK_INTERRUPTIBLE,
1626 msecs_to_jiffies(msec));
1627 if (err == -EINTR) {
1628 bt_dev_err(hdev, "Firmware loading interrupted");
1629 return err;
1630 }
1631
1632 if (err) {
1633 bt_dev_err(hdev, "Firmware loading timeout");
1634 return -ETIMEDOUT;
1635 }
1636
1637 if (btintel_test_flag(hdev, INTEL_FIRMWARE_FAILED)) {
1638 bt_dev_err(hdev, "Firmware loading failed");
1639 return -ENOEXEC;
1640 }
1641
1642 rettime = ktime_get();
1643 delta = ktime_sub(rettime, calltime);
1644 duration = (unsigned long long)ktime_to_ns(delta) >> 10;
1645
1646 bt_dev_info(hdev, "Firmware loaded in %llu usecs", duration);
1647
1648 return 0;
1649}
1650
1651static int btintel_boot_wait(struct hci_dev *hdev, ktime_t calltime, int msec)
1652{
1653 ktime_t delta, rettime;
1654 unsigned long long duration;
1655 int err;
1656
1657 bt_dev_info(hdev, "Waiting for device to boot");
1658
1659 err = btintel_wait_on_flag_timeout(hdev, INTEL_BOOTING,
1660 TASK_INTERRUPTIBLE,
1661 msecs_to_jiffies(msec));
1662 if (err == -EINTR) {
1663 bt_dev_err(hdev, "Device boot interrupted");
1664 return -EINTR;
1665 }
1666
1667 if (err) {
1668 bt_dev_err(hdev, "Device boot timeout");
1669 return -ETIMEDOUT;
1670 }
1671
1672 rettime = ktime_get();
1673 delta = ktime_sub(rettime, calltime);
1674 duration = (unsigned long long) ktime_to_ns(delta) >> 10;
1675
1676 bt_dev_info(hdev, "Device booted in %llu usecs", duration);
1677
1678 return 0;
1679}
1680
1681static int btintel_boot(struct hci_dev *hdev, u32 boot_addr)
1682{
1683 ktime_t calltime;
1684 int err;
1685
1686 calltime = ktime_get();
1687
1688 btintel_set_flag(hdev, INTEL_BOOTING);
1689
1690 err = btintel_send_intel_reset(hdev, boot_addr);
1691 if (err) {
1692 bt_dev_err(hdev, "Intel Soft Reset failed (%d)", err);
1693 btintel_reset_to_bootloader(hdev);
1694 return err;
1695 }
1696
1697 /* The bootloader will not indicate when the device is ready. This
1698 * is done by the operational firmware sending bootup notification.
1699 *
1700 * Booting into operational firmware should not take longer than
1701 * 1 second. However if that happens, then just fail the setup
1702 * since something went wrong.
1703 */
1704 err = btintel_boot_wait(hdev, calltime, 1000);
1705 if (err == -ETIMEDOUT)
1706 btintel_reset_to_bootloader(hdev);
1707
1708 return err;
1709}
1710
1711static int btintel_get_fw_name(struct intel_version *ver,
1712 struct intel_boot_params *params,
1713 char *fw_name, size_t len,
1714 const char *suffix)
1715{
1716 switch (ver->hw_variant) {
1717 case 0x0b: /* SfP */
1718 case 0x0c: /* WsP */
1719 snprintf(fw_name, len, "intel/ibt-%u-%u.%s",
1720 le16_to_cpu(ver->hw_variant),
1721 le16_to_cpu(params->dev_revid),
1722 suffix);
1723 break;
1724 case 0x11: /* JfP */
1725 case 0x12: /* ThP */
1726 case 0x13: /* HrP */
1727 case 0x14: /* CcP */
1728 snprintf(fw_name, len, "intel/ibt-%u-%u-%u.%s",
1729 le16_to_cpu(ver->hw_variant),
1730 le16_to_cpu(ver->hw_revision),
1731 le16_to_cpu(ver->fw_revision),
1732 suffix);
1733 break;
1734 default:
1735 return -EINVAL;
1736 }
1737
1738 return 0;
1739}
1740
1741static int btintel_download_fw(struct hci_dev *hdev,
1742 struct intel_version *ver,
1743 struct intel_boot_params *params,
1744 u32 *boot_param)
1745{
1746 const struct firmware *fw;
1747 char fwname[64];
1748 int err;
1749 ktime_t calltime;
1750
1751 if (!ver || !params)
1752 return -EINVAL;
1753
1754 /* The firmware variant determines if the device is in bootloader
1755 * mode or is running operational firmware. The value 0x06 identifies
1756 * the bootloader and the value 0x23 identifies the operational
1757 * firmware.
1758 *
1759 * When the operational firmware is already present, then only
1760 * the check for valid Bluetooth device address is needed. This
1761 * determines if the device will be added as configured or
1762 * unconfigured controller.
1763 *
1764 * It is not possible to use the Secure Boot Parameters in this
1765 * case since that command is only available in bootloader mode.
1766 */
1767 if (ver->fw_variant == 0x23) {
1768 btintel_clear_flag(hdev, INTEL_BOOTLOADER);
1769 btintel_check_bdaddr(hdev);
1770
1771 /* SfP and WsP don't seem to update the firmware version on file
1772 * so version checking is currently possible.
1773 */
1774 switch (ver->hw_variant) {
1775 case 0x0b: /* SfP */
1776 case 0x0c: /* WsP */
1777 return 0;
1778 }
1779
1780 /* Proceed to download to check if the version matches */
1781 goto download;
1782 }
1783
1784 /* Read the secure boot parameters to identify the operating
1785 * details of the bootloader.
1786 */
1787 err = btintel_read_boot_params(hdev, params);
1788 if (err)
1789 return err;
1790
1791 /* It is required that every single firmware fragment is acknowledged
1792 * with a command complete event. If the boot parameters indicate
1793 * that this bootloader does not send them, then abort the setup.
1794 */
1795 if (params->limited_cce != 0x00) {
1796 bt_dev_err(hdev, "Unsupported Intel firmware loading method (%u)",
1797 params->limited_cce);
1798 return -EINVAL;
1799 }
1800
1801 /* If the OTP has no valid Bluetooth device address, then there will
1802 * also be no valid address for the operational firmware.
1803 */
1804 if (!bacmp(&params->otp_bdaddr, BDADDR_ANY)) {
1805 bt_dev_info(hdev, "No device address configured");
1806 set_bit(HCI_QUIRK_INVALID_BDADDR, &hdev->quirks);
1807 }
1808
1809download:
1810 /* With this Intel bootloader only the hardware variant and device
1811 * revision information are used to select the right firmware for SfP
1812 * and WsP.
1813 *
1814 * The firmware filename is ibt-<hw_variant>-<dev_revid>.sfi.
1815 *
1816 * Currently the supported hardware variants are:
1817 * 11 (0x0b) for iBT3.0 (LnP/SfP)
1818 * 12 (0x0c) for iBT3.5 (WsP)
1819 *
1820 * For ThP/JfP and for future SKU's, the FW name varies based on HW
1821 * variant, HW revision and FW revision, as these are dependent on CNVi
1822 * and RF Combination.
1823 *
1824 * 17 (0x11) for iBT3.5 (JfP)
1825 * 18 (0x12) for iBT3.5 (ThP)
1826 *
1827 * The firmware file name for these will be
1828 * ibt-<hw_variant>-<hw_revision>-<fw_revision>.sfi.
1829 *
1830 */
1831 err = btintel_get_fw_name(ver, params, fwname, sizeof(fwname), "sfi");
1832 if (err < 0) {
1833 if (!btintel_test_flag(hdev, INTEL_BOOTLOADER)) {
1834 /* Firmware has already been loaded */
1835 btintel_set_flag(hdev, INTEL_FIRMWARE_LOADED);
1836 return 0;
1837 }
1838
1839 bt_dev_err(hdev, "Unsupported Intel firmware naming");
1840 return -EINVAL;
1841 }
1842
1843 err = firmware_request_nowarn(&fw, fwname, &hdev->dev);
1844 if (err < 0) {
1845 if (!btintel_test_flag(hdev, INTEL_BOOTLOADER)) {
1846 /* Firmware has already been loaded */
1847 btintel_set_flag(hdev, INTEL_FIRMWARE_LOADED);
1848 return 0;
1849 }
1850
1851 bt_dev_err(hdev, "Failed to load Intel firmware file %s (%d)",
1852 fwname, err);
1853 return err;
1854 }
1855
1856 bt_dev_info(hdev, "Found device firmware: %s", fwname);
1857
1858 if (fw->size < 644) {
1859 bt_dev_err(hdev, "Invalid size of firmware file (%zu)",
1860 fw->size);
1861 err = -EBADF;
1862 goto done;
1863 }
1864
1865 calltime = ktime_get();
1866
1867 btintel_set_flag(hdev, INTEL_DOWNLOADING);
1868
1869 /* Start firmware downloading and get boot parameter */
1870 err = btintel_download_firmware(hdev, ver, fw, boot_param);
1871 if (err < 0) {
1872 if (err == -EALREADY) {
1873 /* Firmware has already been loaded */
1874 btintel_set_flag(hdev, INTEL_FIRMWARE_LOADED);
1875 err = 0;
1876 goto done;
1877 }
1878
1879 /* When FW download fails, send Intel Reset to retry
1880 * FW download.
1881 */
1882 btintel_reset_to_bootloader(hdev);
1883 goto done;
1884 }
1885
1886 /* Before switching the device into operational mode and with that
1887 * booting the loaded firmware, wait for the bootloader notification
1888 * that all fragments have been successfully received.
1889 *
1890 * When the event processing receives the notification, then the
1891 * INTEL_DOWNLOADING flag will be cleared.
1892 *
1893 * The firmware loading should not take longer than 5 seconds
1894 * and thus just timeout if that happens and fail the setup
1895 * of this device.
1896 */
1897 err = btintel_download_wait(hdev, calltime, 5000);
1898 if (err == -ETIMEDOUT)
1899 btintel_reset_to_bootloader(hdev);
1900
1901done:
1902 release_firmware(fw);
1903 return err;
1904}
1905
1906static int btintel_bootloader_setup(struct hci_dev *hdev,
1907 struct intel_version *ver)
1908{
1909 struct intel_version new_ver;
1910 struct intel_boot_params params;
1911 u32 boot_param;
1912 char ddcname[64];
1913 int err;
019a1caa
THJA		 1914
1915 BT_DBG("%s", hdev->name);
1916
1917 /* Set the default boot parameter to 0x0 and it is updated to
1918 * SKU specific boot parameter after reading Intel_Write_Boot_Params
1919 * command while downloading the firmware.
1920 */
1921 boot_param = 0x00000000;
1922
1923 btintel_set_flag(hdev, INTEL_BOOTLOADER);
1924
1925 err = btintel_download_fw(hdev, ver, &params, &boot_param);
1926 if (err)
1927 return err;
1928
1929 /* controller is already having an operational firmware */
1930 if (ver->fw_variant == 0x23)
1931 goto finish;
1932
1933 err = btintel_boot(hdev, boot_param);
1934 if (err)
1935 return err;
1936
1937 btintel_clear_flag(hdev, INTEL_BOOTLOADER);
1938
1939 err = btintel_get_fw_name(ver, &params, ddcname,
1940 sizeof(ddcname), "ddc");
1941
1942 if (err < 0) {
1943 bt_dev_err(hdev, "Unsupported Intel firmware naming");
1944 } else {
1945 /* Once the device is running in operational mode, it needs to
1946 * apply the device configuration (DDC) parameters.
1947 *
1948 * The device can work without DDC parameters, so even if it
1949 * fails to load the file, no need to fail the setup.
1950 */
1951 btintel_load_ddc_config(hdev, ddcname);
1952 }
1953
019a1caa
THJA		 1954 /* Read the Intel version information after loading the FW */
1955 err = btintel_read_version(hdev, &new_ver);
1956 if (err)
1957 return err;
1958
1959 btintel_version_info(hdev, &new_ver);
1960
1961finish:
019a1caa
THJA		 1962 /* Set the event mask for Intel specific vendor events. This enables
1963 * a few extra events that are useful during general operation. It
1964 * does not enable any debugging related events.
1965 *
1966 * The device will function correctly without these events enabled
1967 * and thus no need to fail the setup.
1968 */
1969 btintel_set_event_mask(hdev, false);
1970
1971 return 0;
1972}
1973
1974static void btintel_get_fw_name_tlv(const struct intel_version_tlv *ver,
1975 char *fw_name, size_t len,
1976 const char *suffix)
1977{
1978 /* The firmware file name for new generation controllers will be
1979 * ibt-<cnvi_top type+cnvi_top step>-<cnvr_top type+cnvr_top step>
1980 */
1981 snprintf(fw_name, len, "intel/ibt-%04x-%04x.%s",
1982 INTEL_CNVX_TOP_PACK_SWAB(INTEL_CNVX_TOP_TYPE(ver->cnvi_top),
1983 INTEL_CNVX_TOP_STEP(ver->cnvi_top)),
1984 INTEL_CNVX_TOP_PACK_SWAB(INTEL_CNVX_TOP_TYPE(ver->cnvr_top),
1985 INTEL_CNVX_TOP_STEP(ver->cnvr_top)),
1986 suffix);
1987}
1988
1989static int btintel_prepare_fw_download_tlv(struct hci_dev *hdev,
1990 struct intel_version_tlv *ver,
1991 u32 *boot_param)
1992{
1993 const struct firmware *fw;
1994 char fwname[64];
1995 int err;
1996 ktime_t calltime;
1997
1998 if (!ver || !boot_param)
1999 return -EINVAL;
2000
2001 /* The firmware variant determines if the device is in bootloader
2002 * mode or is running operational firmware. The value 0x03 identifies
2003 * the bootloader and the value 0x23 identifies the operational
2004 * firmware.
2005 *
2006 * When the operational firmware is already present, then only
2007 * the check for valid Bluetooth device address is needed. This
2008 * determines if the device will be added as configured or
2009 * unconfigured controller.
2010 *
2011 * It is not possible to use the Secure Boot Parameters in this
2012 * case since that command is only available in bootloader mode.
2013 */
2014 if (ver->img_type == 0x03) {
2015 btintel_clear_flag(hdev, INTEL_BOOTLOADER);
2016 btintel_check_bdaddr(hdev);
2017 }
2018
2019 /* If the OTP has no valid Bluetooth device address, then there will
2020 * also be no valid address for the operational firmware.
2021 */
2022 if (!bacmp(&ver->otp_bd_addr, BDADDR_ANY)) {
2023 bt_dev_info(hdev, "No device address configured");
2024 set_bit(HCI_QUIRK_INVALID_BDADDR, &hdev->quirks);
2025 }
2026
2027 btintel_get_fw_name_tlv(ver, fwname, sizeof(fwname), "sfi");
2028 err = firmware_request_nowarn(&fw, fwname, &hdev->dev);
2029 if (err < 0) {
2030 if (!btintel_test_flag(hdev, INTEL_BOOTLOADER)) {
2031 /* Firmware has already been loaded */
2032 btintel_set_flag(hdev, INTEL_FIRMWARE_LOADED);
2033 return 0;
2034 }
2035
2036 bt_dev_err(hdev, "Failed to load Intel firmware file %s (%d)",
2037 fwname, err);
2038
2039 return err;
2040 }
2041
2042 bt_dev_info(hdev, "Found device firmware: %s", fwname);
2043
2044 if (fw->size < 644) {
2045 bt_dev_err(hdev, "Invalid size of firmware file (%zu)",
2046 fw->size);
2047 err = -EBADF;
2048 goto done;
2049 }
2050
2051 calltime = ktime_get();
2052
2053 btintel_set_flag(hdev, INTEL_DOWNLOADING);
2054
2055 /* Start firmware downloading and get boot parameter */
2056 err = btintel_download_fw_tlv(hdev, ver, fw, boot_param,
2057 INTEL_HW_VARIANT(ver->cnvi_bt),
2058 ver->sbe_type);
2059 if (err < 0) {
2060 if (err == -EALREADY) {
2061 /* Firmware has already been loaded */
2062 btintel_set_flag(hdev, INTEL_FIRMWARE_LOADED);
2063 err = 0;
2064 goto done;
2065 }
2066
2067 /* When FW download fails, send Intel Reset to retry
2068 * FW download.
2069 */
2070 btintel_reset_to_bootloader(hdev);
2071 goto done;
2072 }
2073
2074 /* Before switching the device into operational mode and with that
2075 * booting the loaded firmware, wait for the bootloader notification
2076 * that all fragments have been successfully received.
2077 *
2078 * When the event processing receives the notification, then the
2079 * BTUSB_DOWNLOADING flag will be cleared.
2080 *
2081 * The firmware loading should not take longer than 5 seconds
2082 * and thus just timeout if that happens and fail the setup
2083 * of this device.
2084 */
2085 err = btintel_download_wait(hdev, calltime, 5000);
2086 if (err == -ETIMEDOUT)
2087 btintel_reset_to_bootloader(hdev);
2088
2089done:
2090 release_firmware(fw);
2091 return err;
2092}
2093
2094static int btintel_bootloader_setup_tlv(struct hci_dev *hdev,
2095 struct intel_version_tlv *ver)
2096{
2097 u32 boot_param;
2098 char ddcname[64];
2099 int err;
019a1caa
THJA		 2100 struct intel_version_tlv new_ver;
2101
2102 bt_dev_dbg(hdev, "");
2103
2104 /* Set the default boot parameter to 0x0 and it is updated to
2105 * SKU specific boot parameter after reading Intel_Write_Boot_Params
2106 * command while downloading the firmware.
2107 */
2108 boot_param = 0x00000000;
2109
2110 btintel_set_flag(hdev, INTEL_BOOTLOADER);
2111
2112 err = btintel_prepare_fw_download_tlv(hdev, ver, &boot_param);
2113 if (err)
2114 return err;
2115
2116 /* check if controller is already having an operational firmware */
2117 if (ver->img_type == 0x03)
2118 goto finish;
2119
2120 err = btintel_boot(hdev, boot_param);
2121 if (err)
2122 return err;
2123
2124 btintel_clear_flag(hdev, INTEL_BOOTLOADER);
2125
2126 btintel_get_fw_name_tlv(ver, ddcname, sizeof(ddcname), "ddc");
2127 /* Once the device is running in operational mode, it needs to
2128 * apply the device configuration (DDC) parameters.
2129 *
2130 * The device can work without DDC parameters, so even if it
2131 * fails to load the file, no need to fail the setup.
2132 */
2133 btintel_load_ddc_config(hdev, ddcname);
2134
019a1caa
THJA		 2135 /* Read the Intel version information after loading the FW */
2136 err = btintel_read_version_tlv(hdev, &new_ver);
2137 if (err)
2138 return err;
2139
2140 btintel_version_info_tlv(hdev, &new_ver);
2141
2142finish:
2143 /* Set the event mask for Intel specific vendor events. This enables
2144 * a few extra events that are useful during general operation. It
2145 * does not enable any debugging related events.
2146 *
2147 * The device will function correctly without these events enabled
2148 * and thus no need to fail the setup.
2149 */
2150 btintel_set_event_mask(hdev, false);
2151
2152 return 0;
2153}
2154
1804fdf6
THJA		 2155static void btintel_set_msft_opcode(struct hci_dev *hdev, u8 hw_variant)
2156{
2157 switch (hw_variant) {
2158 /* Legacy bootloader devices that supports MSFT Extension */
2159 case 0x11: /* JfP */
2160 case 0x12: /* ThP */
2161 case 0x13: /* HrP */
2162 case 0x14: /* CcP */
2163 /* All Intel new genration controllers support the Microsoft vendor
2164 * extension are using 0xFC1E for VsMsftOpCode.
2165 */
2166 case 0x17:
2167 case 0x18:
2168 case 0x19:
2169 hci_set_msft_opcode(hdev, 0xFC1E);
2170 break;
2171 default:
2172 /* Not supported */
2173 break;
2174 }
2175}
2176
ca5425e1
THJA		 2177static int btintel_setup_combined(struct hci_dev *hdev)
2178{
2179 const u8 param[1] = { 0xFF };
2180 struct intel_version ver;
2181 struct intel_version_tlv ver_tlv;
2182 struct sk_buff *skb;
2183 int err;
2184
2185 BT_DBG("%s", hdev->name);
2186
ea7c4c0e
THJA		 2187 /* The some controllers have a bug with the first HCI command sent to it
2188 * returning number of completed commands as zero. This would stall the
2189 * command processing in the Bluetooth core.
2190 *
2191 * As a workaround, send HCI Reset command first which will reset the
2192 * number of completed commands and allow normal command processing
2193 * from now on.
2194 */
2195 if (btintel_test_flag(hdev, INTEL_BROKEN_INITIAL_NCMD)) {
2196 skb = __hci_cmd_sync(hdev, HCI_OP_RESET, 0, NULL,
2197 HCI_INIT_TIMEOUT);
2198 if (IS_ERR(skb)) {
2199 bt_dev_err(hdev,
2200 "sending initial HCI reset failed (%ld)",
2201 PTR_ERR(skb));
2202 return PTR_ERR(skb);
2203 }
2204 kfree_skb(skb);
2205 }
2206
ca5425e1
THJA		 2207 /* Starting from TyP device, the command parameter and response are
2208 * changed even though the OCF for HCI_Intel_Read_Version command
2209 * remains same. The legacy devices can handle even if the
2210 * command has a parameter and returns a correct version information.
2211 * So, it uses new format to support both legacy and new format.
2212 */
2213 skb = __hci_cmd_sync(hdev, 0xfc05, 1, param, HCI_CMD_TIMEOUT);
2214 if (IS_ERR(skb)) {
2215 bt_dev_err(hdev, "Reading Intel version command failed (%ld)",
2216 PTR_ERR(skb));
2217 return PTR_ERR(skb);
2218 }
2219
2220 /* Check the status */
2221 if (skb->data[0]) {
2222 bt_dev_err(hdev, "Intel Read Version command failed (%02x)",
2223 skb->data[0]);
2224 err = -EIO;
2225 goto exit_error;
2226 }
2227
3df4dfbe
THJA		 2228 /* Apply the common HCI quirks for Intel device */
2229 set_bit(HCI_QUIRK_STRICT_DUPLICATE_FILTER, &hdev->quirks);
2230 set_bit(HCI_QUIRK_SIMULTANEOUS_DISCOVERY, &hdev->quirks);
2231 set_bit(HCI_QUIRK_NON_PERSISTENT_DIAG, &hdev->quirks);
2232
ca5425e1
THJA		 2233 /* For Legacy device, check the HW platform value and size */
2234 if (skb->len == sizeof(ver) && skb->data[1] == 0x37) {
2235 bt_dev_dbg(hdev, "Read the legacy Intel version information");
2236
2237 memcpy(&ver, skb->data, sizeof(ver));
2238
2239 /* Display version information */
2240 btintel_version_info(hdev, &ver);
2241
2242 /* Check for supported iBT hardware variants of this firmware
2243 * loading method.
2244 *
2245 * This check has been put in place to ensure correct forward
2246 * compatibility options when newer hardware variants come
2247 * along.
2248 */
2249 switch (ver.hw_variant) {
2250 case 0x07: /* WP */
2251 case 0x08: /* StP */
2252 /* Legacy ROM product */
55380714 2253 btintel_set_flag(hdev, INTEL_ROM_LEGACY);
ffcba827 2254
3df4dfbe
THJA		 2255 /* Apply the device specific HCI quirks
2256 *
2257 * WBS for SdP - SdP and Stp have a same hw_varaint but
2258 * different fw_variant
2259 */
2260 if (ver.hw_variant == 0x08 && ver.fw_variant == 0x22)
2261 set_bit(HCI_QUIRK_WIDEBAND_SPEECH_SUPPORTED,
2262 &hdev->quirks);
2263
ffcba827
THJA		 2264 /* These devices have an issue with LED which doesn't
2265 * go off immediately during shutdown. Set the flag
2266 * here to send the LED OFF command during shutdown.
2267 */
2268 btintel_set_flag(hdev, INTEL_BROKEN_LED);
2269
83f2dafe 2270 err = btintel_legacy_rom_setup(hdev, &ver);
ca5425e1
THJA		 2271 break;
2272 case 0x0b: /* SfP */
2273 case 0x0c: /* WsP */
2274 case 0x11: /* JfP */
2275 case 0x12: /* ThP */
2276 case 0x13: /* HrP */
2277 case 0x14: /* CcP */
3df4dfbe
THJA		 2278 /* Apply the device specific HCI quirks
2279 *
2280 * All Legacy bootloader devices support WBS
2281 */
2282 set_bit(HCI_QUIRK_WIDEBAND_SPEECH_SUPPORTED,
2283 &hdev->quirks);
2284
2285 /* Valid LE States quirk for JfP/ThP familiy */
2286 if (ver.hw_variant == 0x11 || ver.hw_variant == 0x12)
2287 set_bit(HCI_QUIRK_VALID_LE_STATES,
2288 &hdev->quirks);
2289
1804fdf6
THJA		 2290 /* Setup MSFT Extension support */
2291 btintel_set_msft_opcode(hdev, ver.hw_variant);
2292
019a1caa 2293 err = btintel_bootloader_setup(hdev, &ver);
ca5425e1
THJA		 2294 break;
2295 default:
2296 bt_dev_err(hdev, "Unsupported Intel hw variant (%u)",
2297 ver.hw_variant);
2298 err = -EINVAL;
2299 }
2300
2301 goto exit_error;
2302 }
2303
2304 /* For TLV type device, parse the tlv data */
2305 err = btintel_parse_version_tlv(hdev, &ver_tlv, skb);
2306 if (err) {
2307 bt_dev_err(hdev, "Failed to parse TLV version information");
2308 goto exit_error;
2309 }
2310
2311 if (INTEL_HW_PLATFORM(ver_tlv.cnvi_bt) != 0x37) {
2312 bt_dev_err(hdev, "Unsupported Intel hardware platform (0x%2x)",
2313 INTEL_HW_PLATFORM(ver_tlv.cnvi_bt));
2314 err = -EINVAL;
2315 goto exit_error;
2316 }
2317
019a1caa
THJA		 2318 /* Check for supported iBT hardware variants of this firmware
2319 * loading method.
2320 *
2321 * This check has been put in place to ensure correct forward
2322 * compatibility options when newer hardware variants come
2323 * along.
2324 */
2325 switch (INTEL_HW_VARIANT(ver_tlv.cnvi_bt)) {
c86c7285
THJA		 2326 case 0x11: /* JfP */
2327 case 0x12: /* ThP */
2328 case 0x13: /* HrP */
2329 case 0x14: /* CcP */
2330 /* Some legacy bootloader devices from JfP supports both old
2331 * and TLV based HCI_Intel_Read_Version command. But we don't
2332 * want to use the TLV based setup routines for those legacy
2333 * bootloader device.
2334 *
2335 * Also, it is not easy to convert TLV based version from the
2336 * legacy version format.
2337 *
2338 * So, as a workaround for those devices, use the legacy
2339 * HCI_Intel_Read_Version to get the version information and
2340 * run the legacy bootloader setup.
2341 */
2342 err = btintel_read_version(hdev, &ver);
2343 if (err)
2344 return err;
2345 err = btintel_bootloader_setup(hdev, &ver);
2346 break;
019a1caa
THJA		 2347 case 0x17:
2348 case 0x18:
2349 case 0x19:
2350 /* Display version information of TLV type */
2351 btintel_version_info_tlv(hdev, &ver_tlv);
2352
3df4dfbe
THJA		 2353 /* Apply the device specific HCI quirks for TLV based devices
2354 *
2355 * All TLV based devices support WBS
2356 */
2357 set_bit(HCI_QUIRK_WIDEBAND_SPEECH_SUPPORTED, &hdev->quirks);
2358
2359 /* Valid LE States quirk for GfP */
2360 if (INTEL_HW_VARIANT(ver_tlv.cnvi_bt) == 0x18)
2361 set_bit(HCI_QUIRK_VALID_LE_STATES, &hdev->quirks);
2362
1804fdf6
THJA		 2363 /* Setup MSFT Extension support */
2364 btintel_set_msft_opcode(hdev,
2365 INTEL_HW_VARIANT(ver_tlv.cnvi_bt));
2366
019a1caa
THJA		 2367 err = btintel_bootloader_setup_tlv(hdev, &ver_tlv);
2368 break;
2369 default:
2370 bt_dev_err(hdev, "Unsupported Intel hw variant (%u)",
2371 INTEL_HW_VARIANT(ver_tlv.cnvi_bt));
2372 return -EINVAL;
2373 }
ca5425e1
THJA		 2374
2375exit_error:
2376 kfree_skb(skb);
2377
2378 return err;
2379}
2380
2381static int btintel_shutdown_combined(struct hci_dev *hdev)
2382{
2383 struct sk_buff *skb;
ffcba827 2384 int ret;
ca5425e1
THJA		 2385
2386 /* Send HCI Reset to the controller to stop any BT activity which
2387 * were triggered. This will help to save power and maintain the
2388 * sync b/w Host and controller
2389 */
2390 skb = __hci_cmd_sync(hdev, HCI_OP_RESET, 0, NULL, HCI_INIT_TIMEOUT);
2391 if (IS_ERR(skb)) {
2392 bt_dev_err(hdev, "HCI reset during shutdown failed");
2393 return PTR_ERR(skb);
2394 }
2395 kfree_skb(skb);
2396
ffcba827
THJA		 2397
2398 /* Some platforms have an issue with BT LED when the interface is
2399 * down or BT radio is turned off, which takes 5 seconds to BT LED
2400 * goes off. This command turns off the BT LED immediately.
2401 */
2402 if (btintel_test_flag(hdev, INTEL_BROKEN_LED)) {
2403 skb = __hci_cmd_sync(hdev, 0xfc3f, 0, NULL, HCI_INIT_TIMEOUT);
2404 if (IS_ERR(skb)) {
2405 ret = PTR_ERR(skb);
2406 bt_dev_err(hdev, "turning off Intel device LED failed");
2407 return ret;
2408 }
2409 kfree_skb(skb);
2410 }
2411
ca5425e1
THJA		 2412 return 0;
2413}
2414
2415int btintel_configure_setup(struct hci_dev *hdev)
2416{
ca5425e1
THJA		 2417 hdev->manufacturer = 2;
2418 hdev->setup = btintel_setup_combined;
2419 hdev->shutdown = btintel_shutdown_combined;
019a1caa 2420 hdev->hw_error = btintel_hw_error;
55380714 2421 hdev->set_diag = btintel_set_diag_combined;
83f2dafe 2422 hdev->set_bdaddr = btintel_set_bdaddr;
ca5425e1
THJA		 2423
2424 return 0;
2425}
2426EXPORT_SYMBOL_GPL(btintel_configure_setup);
2427
019a1caa
THJA		 2428void btintel_bootup(struct hci_dev *hdev, const void *ptr, unsigned int len)
2429{
2430 const struct intel_bootup *evt = ptr;
2431
2432 if (len != sizeof(*evt))
2433 return;
2434
2435 if (btintel_test_and_clear_flag(hdev, INTEL_BOOTING))
2436 btintel_wake_up_flag(hdev, INTEL_BOOTING);
2437}
2438EXPORT_SYMBOL_GPL(btintel_bootup);
2439
2440void btintel_secure_send_result(struct hci_dev *hdev,
2441 const void *ptr, unsigned int len)
2442{
2443 const struct intel_secure_send_result *evt = ptr;
2444
2445 if (len != sizeof(*evt))
2446 return;
2447
2448 if (evt->result)
2449 btintel_set_flag(hdev, INTEL_FIRMWARE_FAILED);
2450
2451 if (btintel_test_and_clear_flag(hdev, INTEL_DOWNLOADING) &&
2452 btintel_test_flag(hdev, INTEL_FIRMWARE_LOADED))
2453 btintel_wake_up_flag(hdev, INTEL_DOWNLOADING);
2454}
2455EXPORT_SYMBOL_GPL(btintel_secure_send_result);
2456
48f0ed1b
MH		 2457MODULE_AUTHOR("Marcel Holtmann <marcel@holtmann.org>");
2458MODULE_DESCRIPTION("Bluetooth support for Intel devices ver " VERSION);
2459MODULE_VERSION(VERSION);
2460MODULE_LICENSE("GPL");
0ed97e82
MH		 2461MODULE_FIRMWARE("intel/ibt-11-5.sfi");
2462MODULE_FIRMWARE("intel/ibt-11-5.ddc");
d1b7abae
JB		 2463MODULE_FIRMWARE("intel/ibt-12-16.sfi");
2464MODULE_FIRMWARE("intel/ibt-12-16.ddc");
Linux 6.x block layer and io_uring tree(s)