1
2
3
4
5
6
7
8
9#include <linux/module.h>
10#include <linux/firmware.h>
11#include <linux/regmap.h>
12#include <asm/unaligned.h>
13
14#include <net/bluetooth/bluetooth.h>
15#include <net/bluetooth/hci_core.h>
16
17#include "btintel.h"
18
19#define VERSION "0.1"
20
21#define BDADDR_INTEL (&(bdaddr_t){{0x00, 0x8b, 0x9e, 0x19, 0x03, 0x00}})
22#define RSA_HEADER_LEN 644
23#define CSS_HEADER_OFFSET 8
24#define ECDSA_OFFSET 644
25#define ECDSA_HEADER_LEN 320
26
27#define CMD_WRITE_BOOT_PARAMS 0xfc0e
28struct cmd_write_boot_params {
29 u32 boot_addr;
30 u8 fw_build_num;
31 u8 fw_build_ww;
32 u8 fw_build_yy;
33} __packed;
34
35int btintel_check_bdaddr(struct hci_dev *hdev)
36{
37 struct hci_rp_read_bd_addr *bda;
38 struct sk_buff *skb;
39
40 skb = __hci_cmd_sync(hdev, HCI_OP_READ_BD_ADDR, 0, NULL,
41 HCI_INIT_TIMEOUT);
42 if (IS_ERR(skb)) {
43 int err = PTR_ERR(skb);
44 bt_dev_err(hdev, "Reading Intel device address failed (%d)",
45 err);
46 return err;
47 }
48
49 if (skb->len != sizeof(*bda)) {
50 bt_dev_err(hdev, "Intel device address length mismatch");
51 kfree_skb(skb);
52 return -EIO;
53 }
54
55 bda = (struct hci_rp_read_bd_addr *)skb->data;
56
57
58
59
60
61
62 if (!bacmp(&bda->bdaddr, BDADDR_INTEL)) {
63 bt_dev_err(hdev, "Found Intel default device address (%pMR)",
64 &bda->bdaddr);
65 set_bit(HCI_QUIRK_INVALID_BDADDR, &hdev->quirks);
66 }
67
68 kfree_skb(skb);
69
70 return 0;
71}
72EXPORT_SYMBOL_GPL(btintel_check_bdaddr);
73
74int btintel_enter_mfg(struct hci_dev *hdev)
75{
76 static const u8 param[] = { 0x01, 0x00 };
77 struct sk_buff *skb;
78
79 skb = __hci_cmd_sync(hdev, 0xfc11, 2, param, HCI_CMD_TIMEOUT);
80 if (IS_ERR(skb)) {
81 bt_dev_err(hdev, "Entering manufacturer mode failed (%ld)",
82 PTR_ERR(skb));
83 return PTR_ERR(skb);
84 }
85 kfree_skb(skb);
86
87 return 0;
88}
89EXPORT_SYMBOL_GPL(btintel_enter_mfg);
90
91int btintel_exit_mfg(struct hci_dev *hdev, bool reset, bool patched)
92{
93 u8 param[] = { 0x00, 0x00 };
94 struct sk_buff *skb;
95
96
97
98
99
100
101 if (reset)
102 param[1] |= patched ? 0x02 : 0x01;
103
104 skb = __hci_cmd_sync(hdev, 0xfc11, 2, param, HCI_CMD_TIMEOUT);
105 if (IS_ERR(skb)) {
106 bt_dev_err(hdev, "Exiting manufacturer mode failed (%ld)",
107 PTR_ERR(skb));
108 return PTR_ERR(skb);
109 }
110 kfree_skb(skb);
111
112 return 0;
113}
114EXPORT_SYMBOL_GPL(btintel_exit_mfg);
115
116int btintel_set_bdaddr(struct hci_dev *hdev, const bdaddr_t *bdaddr)
117{
118 struct sk_buff *skb;
119 int err;
120
121 skb = __hci_cmd_sync(hdev, 0xfc31, 6, bdaddr, HCI_INIT_TIMEOUT);
122 if (IS_ERR(skb)) {
123 err = PTR_ERR(skb);
124 bt_dev_err(hdev, "Changing Intel device address failed (%d)",
125 err);
126 return err;
127 }
128 kfree_skb(skb);
129
130 return 0;
131}
132EXPORT_SYMBOL_GPL(btintel_set_bdaddr);
133
134static int btintel_set_event_mask(struct hci_dev *hdev, bool debug)
135{
136 u8 mask[8] = { 0x87, 0x0c, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 };
137 struct sk_buff *skb;
138 int err;
139
140 if (debug)
141 mask[1] |= 0x62;
142
143 skb = __hci_cmd_sync(hdev, 0xfc52, 8, mask, HCI_INIT_TIMEOUT);
144 if (IS_ERR(skb)) {
145 err = PTR_ERR(skb);
146 bt_dev_err(hdev, "Setting Intel event mask failed (%d)", err);
147 return err;
148 }
149 kfree_skb(skb);
150
151 return 0;
152}
153
154int btintel_set_diag(struct hci_dev *hdev, bool enable)
155{
156 struct sk_buff *skb;
157 u8 param[3];
158 int err;
159
160 if (enable) {
161 param[0] = 0x03;
162 param[1] = 0x03;
163 param[2] = 0x03;
164 } else {
165 param[0] = 0x00;
166 param[1] = 0x00;
167 param[2] = 0x00;
168 }
169
170 skb = __hci_cmd_sync(hdev, 0xfc43, 3, param, HCI_INIT_TIMEOUT);
171 if (IS_ERR(skb)) {
172 err = PTR_ERR(skb);
173 if (err == -ENODATA)
174 goto done;
175 bt_dev_err(hdev, "Changing Intel diagnostic mode failed (%d)",
176 err);
177 return err;
178 }
179 kfree_skb(skb);
180
181done:
182 btintel_set_event_mask(hdev, enable);
183 return 0;
184}
185EXPORT_SYMBOL_GPL(btintel_set_diag);
186
187static int btintel_set_diag_mfg(struct hci_dev *hdev, bool enable)
188{
189 int err, ret;
190
191 err = btintel_enter_mfg(hdev);
192 if (err)
193 return err;
194
195 ret = btintel_set_diag(hdev, enable);
196
197 err = btintel_exit_mfg(hdev, false, false);
198 if (err)
199 return err;
200
201 return ret;
202}
203
204static int btintel_set_diag_combined(struct hci_dev *hdev, bool enable)
205{
206 int ret;
207
208
209
210
211
212
213 if (btintel_test_flag(hdev, INTEL_ROM_LEGACY))
214 ret = btintel_set_diag_mfg(hdev, enable);
215 else
216 ret = btintel_set_diag(hdev, enable);
217
218 return ret;
219}
220
221static void btintel_hw_error(struct hci_dev *hdev, u8 code)
222{
223 struct sk_buff *skb;
224 u8 type = 0x00;
225
226 bt_dev_err(hdev, "Hardware error 0x%2.2x", code);
227
228 skb = __hci_cmd_sync(hdev, HCI_OP_RESET, 0, NULL, HCI_INIT_TIMEOUT);
229 if (IS_ERR(skb)) {
230 bt_dev_err(hdev, "Reset after hardware error failed (%ld)",
231 PTR_ERR(skb));
232 return;
233 }
234 kfree_skb(skb);
235
236 skb = __hci_cmd_sync(hdev, 0xfc22, 1, &type, HCI_INIT_TIMEOUT);
237 if (IS_ERR(skb)) {
238 bt_dev_err(hdev, "Retrieving Intel exception info failed (%ld)",
239 PTR_ERR(skb));
240 return;
241 }
242
243 if (skb->len != 13) {
244 bt_dev_err(hdev, "Exception info size mismatch");
245 kfree_skb(skb);
246 return;
247 }
248
249 bt_dev_err(hdev, "Exception info %s", (char *)(skb->data + 1));
250
251 kfree_skb(skb);
252}
253
254int btintel_version_info(struct hci_dev *hdev, struct intel_version *ver)
255{
256 const char *variant;
257
258
259
260
261 if (ver->hw_platform != 0x37) {
262 bt_dev_err(hdev, "Unsupported Intel hardware platform (%u)",
263 ver->hw_platform);
264 return -EINVAL;
265 }
266
267
268
269
270
271
272
273 switch (ver->hw_variant) {
274 case 0x07:
275 case 0x08:
276 case 0x0b:
277 case 0x0c:
278 case 0x11:
279 case 0x12:
280 case 0x13:
281 case 0x14:
282 break;
283 default:
284 bt_dev_err(hdev, "Unsupported Intel hardware variant (%u)",
285 ver->hw_variant);
286 return -EINVAL;
287 }
288
289 switch (ver->fw_variant) {
290 case 0x01:
291 variant = "Legacy ROM 2.5";
292 break;
293 case 0x06:
294 variant = "Bootloader";
295 break;
296 case 0x22:
297 variant = "Legacy ROM 2.x";
298 break;
299 case 0x23:
300 variant = "Firmware";
301 break;
302 default:
303 bt_dev_err(hdev, "Unsupported firmware variant(%02x)", ver->fw_variant);
304 return -EINVAL;
305 }
306
307 bt_dev_info(hdev, "%s revision %u.%u build %u week %u %u",
308 variant, ver->fw_revision >> 4, ver->fw_revision & 0x0f,
309 ver->fw_build_num, ver->fw_build_ww,
310 2000 + ver->fw_build_yy);
311
312 return 0;
313}
314EXPORT_SYMBOL_GPL(btintel_version_info);
315
316static int btintel_secure_send(struct hci_dev *hdev, u8 fragment_type, u32 plen,
317 const void *param)
318{
319 while (plen > 0) {
320 struct sk_buff *skb;
321 u8 cmd_param[253], fragment_len = (plen > 252) ? 252 : plen;
322
323 cmd_param[0] = fragment_type;
324 memcpy(cmd_param + 1, param, fragment_len);
325
326 skb = __hci_cmd_sync(hdev, 0xfc09, fragment_len + 1,
327 cmd_param, HCI_INIT_TIMEOUT);
328 if (IS_ERR(skb))
329 return PTR_ERR(skb);
330
331 kfree_skb(skb);
332
333 plen -= fragment_len;
334 param += fragment_len;
335 }
336
337 return 0;
338}
339
340int btintel_load_ddc_config(struct hci_dev *hdev, const char *ddc_name)
341{
342 const struct firmware *fw;
343 struct sk_buff *skb;
344 const u8 *fw_ptr;
345 int err;
346
347 err = request_firmware_direct(&fw, ddc_name, &hdev->dev);
348 if (err < 0) {
349 bt_dev_err(hdev, "Failed to load Intel DDC file %s (%d)",
350 ddc_name, err);
351 return err;
352 }
353
354 bt_dev_info(hdev, "Found Intel DDC parameters: %s", ddc_name);
355
356 fw_ptr = fw->data;
357
358
359
360
361 while (fw->size > fw_ptr - fw->data) {
362 u8 cmd_plen = fw_ptr[0] + sizeof(u8);
363
364 skb = __hci_cmd_sync(hdev, 0xfc8b, cmd_plen, fw_ptr,
365 HCI_INIT_TIMEOUT);
366 if (IS_ERR(skb)) {
367 bt_dev_err(hdev, "Failed to send Intel_Write_DDC (%ld)",
368 PTR_ERR(skb));
369 release_firmware(fw);
370 return PTR_ERR(skb);
371 }
372
373 fw_ptr += cmd_plen;
374 kfree_skb(skb);
375 }
376
377 release_firmware(fw);
378
379 bt_dev_info(hdev, "Applying Intel DDC parameters completed");
380
381 return 0;
382}
383EXPORT_SYMBOL_GPL(btintel_load_ddc_config);
384
385int btintel_set_event_mask_mfg(struct hci_dev *hdev, bool debug)
386{
387 int err, ret;
388
389 err = btintel_enter_mfg(hdev);
390 if (err)
391 return err;
392
393 ret = btintel_set_event_mask(hdev, debug);
394
395 err = btintel_exit_mfg(hdev, false, false);
396 if (err)
397 return err;
398
399 return ret;
400}
401EXPORT_SYMBOL_GPL(btintel_set_event_mask_mfg);
402
403int btintel_read_version(struct hci_dev *hdev, struct intel_version *ver)
404{
405 struct sk_buff *skb;
406
407 skb = __hci_cmd_sync(hdev, 0xfc05, 0, NULL, HCI_CMD_TIMEOUT);
408 if (IS_ERR(skb)) {
409 bt_dev_err(hdev, "Reading Intel version information failed (%ld)",
410 PTR_ERR(skb));
411 return PTR_ERR(skb);
412 }
413
414 if (skb->len != sizeof(*ver)) {
415 bt_dev_err(hdev, "Intel version event size mismatch");
416 kfree_skb(skb);
417 return -EILSEQ;
418 }
419
420 memcpy(ver, skb->data, sizeof(*ver));
421
422 kfree_skb(skb);
423
424 return 0;
425}
426EXPORT_SYMBOL_GPL(btintel_read_version);
427
428static int btintel_version_info_tlv(struct hci_dev *hdev,
429 struct intel_version_tlv *version)
430{
431 const char *variant;
432
433
434
435
436 if (INTEL_HW_PLATFORM(version->cnvi_bt) != 0x37) {
437 bt_dev_err(hdev, "Unsupported Intel hardware platform (0x%2x)",
438 INTEL_HW_PLATFORM(version->cnvi_bt));
439 return -EINVAL;
440 }
441
442
443
444
445
446
447
448 switch (INTEL_HW_VARIANT(version->cnvi_bt)) {
449 case 0x17:
450 case 0x18:
451 case 0x19:
452 break;
453 default:
454 bt_dev_err(hdev, "Unsupported Intel hardware variant (0x%x)",
455 INTEL_HW_VARIANT(version->cnvi_bt));
456 return -EINVAL;
457 }
458
459 switch (version->img_type) {
460 case 0x01:
461 variant = "Bootloader";
462
463
464
465
466 if (version->limited_cce != 0x00) {
467 bt_dev_err(hdev, "Unsupported Intel firmware loading method (0x%x)",
468 version->limited_cce);
469 return -EINVAL;
470 }
471
472
473 if (version->sbe_type > 0x01) {
474 bt_dev_err(hdev, "Unsupported Intel secure boot engine type (0x%x)",
475 version->sbe_type);
476 return -EINVAL;
477 }
478
479 bt_dev_info(hdev, "Device revision is %u", version->dev_rev_id);
480 bt_dev_info(hdev, "Secure boot is %s",
481 version->secure_boot ? "enabled" : "disabled");
482 bt_dev_info(hdev, "OTP lock is %s",
483 version->otp_lock ? "enabled" : "disabled");
484 bt_dev_info(hdev, "API lock is %s",
485 version->api_lock ? "enabled" : "disabled");
486 bt_dev_info(hdev, "Debug lock is %s",
487 version->debug_lock ? "enabled" : "disabled");
488 bt_dev_info(hdev, "Minimum firmware build %u week %u %u",
489 version->min_fw_build_nn, version->min_fw_build_cw,
490 2000 + version->min_fw_build_yy);
491 break;
492 case 0x03:
493 variant = "Firmware";
494 break;
495 default:
496 bt_dev_err(hdev, "Unsupported image type(%02x)", version->img_type);
497 return -EINVAL;
498 }
499
500 bt_dev_info(hdev, "%s timestamp %u.%u buildtype %u build %u", variant,
501 2000 + (version->timestamp >> 8), version->timestamp & 0xff,
502 version->build_type, version->build_num);
503
504 return 0;
505}
506
507static int btintel_parse_version_tlv(struct hci_dev *hdev,
508 struct intel_version_tlv *version,
509 struct sk_buff *skb)
510{
511
512 skb_pull(skb, 1);
513
514
515
516
517
518
519 while (skb->len) {
520 struct intel_tlv *tlv;
521
522
523 if (skb->len < sizeof(*tlv))
524 return -EINVAL;
525
526 tlv = (struct intel_tlv *)skb->data;
527
528
529 if (skb->len < tlv->len + sizeof(*tlv))
530 return -EINVAL;
531
532 switch (tlv->type) {
533 case INTEL_TLV_CNVI_TOP:
534 version->cnvi_top = get_unaligned_le32(tlv->val);
535 break;
536 case INTEL_TLV_CNVR_TOP:
537 version->cnvr_top = get_unaligned_le32(tlv->val);
538 break;
539 case INTEL_TLV_CNVI_BT:
540 version->cnvi_bt = get_unaligned_le32(tlv->val);
541 break;
542 case INTEL_TLV_CNVR_BT:
543 version->cnvr_bt = get_unaligned_le32(tlv->val);
544 break;
545 case INTEL_TLV_DEV_REV_ID:
546 version->dev_rev_id = get_unaligned_le16(tlv->val);
547 break;
548 case INTEL_TLV_IMAGE_TYPE:
549 version->img_type = tlv->val[0];
550 break;
551 case INTEL_TLV_TIME_STAMP:
552
553
554
555
556 version->min_fw_build_cw = tlv->val[0];
557 version->min_fw_build_yy = tlv->val[1];
558 version->timestamp = get_unaligned_le16(tlv->val);
559 break;
560 case INTEL_TLV_BUILD_TYPE:
561 version->build_type = tlv->val[0];
562 break;
563 case INTEL_TLV_BUILD_NUM:
564
565
566
567
568 version->min_fw_build_nn = tlv->val[0];
569 version->build_num = get_unaligned_le32(tlv->val);
570 break;
571 case INTEL_TLV_SECURE_BOOT:
572 version->secure_boot = tlv->val[0];
573 break;
574 case INTEL_TLV_OTP_LOCK:
575 version->otp_lock = tlv->val[0];
576 break;
577 case INTEL_TLV_API_LOCK:
578 version->api_lock = tlv->val[0];
579 break;
580 case INTEL_TLV_DEBUG_LOCK:
581 version->debug_lock = tlv->val[0];
582 break;
583 case INTEL_TLV_MIN_FW:
584 version->min_fw_build_nn = tlv->val[0];
585 version->min_fw_build_cw = tlv->val[1];
586 version->min_fw_build_yy = tlv->val[2];
587 break;
588 case INTEL_TLV_LIMITED_CCE:
589 version->limited_cce = tlv->val[0];
590 break;
591 case INTEL_TLV_SBE_TYPE:
592 version->sbe_type = tlv->val[0];
593 break;
594 case INTEL_TLV_OTP_BDADDR:
595 memcpy(&version->otp_bd_addr, tlv->val,
596 sizeof(bdaddr_t));
597 break;
598 default:
599
600 break;
601 }
602
603 skb_pull(skb, tlv->len + sizeof(*tlv));
604 }
605
606 return 0;
607}
608
609static int btintel_read_version_tlv(struct hci_dev *hdev,
610 struct intel_version_tlv *version)
611{
612 struct sk_buff *skb;
613 const u8 param[1] = { 0xFF };
614
615 if (!version)
616 return -EINVAL;
617
618 skb = __hci_cmd_sync(hdev, 0xfc05, 1, param, HCI_CMD_TIMEOUT);
619 if (IS_ERR(skb)) {
620 bt_dev_err(hdev, "Reading Intel version information failed (%ld)",
621 PTR_ERR(skb));
622 return PTR_ERR(skb);
623 }
624
625 if (skb->data[0]) {
626 bt_dev_err(hdev, "Intel Read Version command failed (%02x)",
627 skb->data[0]);
628 kfree_skb(skb);
629 return -EIO;
630 }
631
632 btintel_parse_version_tlv(hdev, version, skb);
633
634 kfree_skb(skb);
635 return 0;
636}
637
638
639
640#define IBT_REG_MODE_8BIT 0x00
641#define IBT_REG_MODE_16BIT 0x01
642#define IBT_REG_MODE_32BIT 0x02
643
644struct regmap_ibt_context {
645 struct hci_dev *hdev;
646 __u16 op_write;
647 __u16 op_read;
648};
649
650struct ibt_cp_reg_access {
651 __le32 addr;
652 __u8 mode;
653 __u8 len;
654 __u8 data[];
655} __packed;
656
657struct ibt_rp_reg_access {
658 __u8 status;
659 __le32 addr;
660 __u8 data[];
661} __packed;
662
663static int regmap_ibt_read(void *context, const void *addr, size_t reg_size,
664 void *val, size_t val_size)
665{
666 struct regmap_ibt_context *ctx = context;
667 struct ibt_cp_reg_access cp;
668 struct ibt_rp_reg_access *rp;
669 struct sk_buff *skb;
670 int err = 0;
671
672 if (reg_size != sizeof(__le32))
673 return -EINVAL;
674
675 switch (val_size) {
676 case 1:
677 cp.mode = IBT_REG_MODE_8BIT;
678 break;
679 case 2:
680 cp.mode = IBT_REG_MODE_16BIT;
681 break;
682 case 4:
683 cp.mode = IBT_REG_MODE_32BIT;
684 break;
685 default:
686 return -EINVAL;
687 }
688
689
690 cp.addr = *(__le32 *)addr;
691 cp.len = val_size;
692
693 bt_dev_dbg(ctx->hdev, "Register (0x%x) read", le32_to_cpu(cp.addr));
694
695 skb = hci_cmd_sync(ctx->hdev, ctx->op_read, sizeof(cp), &cp,
696 HCI_CMD_TIMEOUT);
697 if (IS_ERR(skb)) {
698 err = PTR_ERR(skb);
699 bt_dev_err(ctx->hdev, "regmap: Register (0x%x) read error (%d)",
700 le32_to_cpu(cp.addr), err);
701 return err;
702 }
703
704 if (skb->len != sizeof(*rp) + val_size) {
705 bt_dev_err(ctx->hdev, "regmap: Register (0x%x) read error, bad len",
706 le32_to_cpu(cp.addr));
707 err = -EINVAL;
708 goto done;
709 }
710
711 rp = (struct ibt_rp_reg_access *)skb->data;
712
713 if (rp->addr != cp.addr) {
714 bt_dev_err(ctx->hdev, "regmap: Register (0x%x) read error, bad addr",
715 le32_to_cpu(rp->addr));
716 err = -EINVAL;
717 goto done;
718 }
719
720 memcpy(val, rp->data, val_size);
721
722done:
723 kfree_skb(skb);
724 return err;
725}
726
727static int regmap_ibt_gather_write(void *context,
728 const void *addr, size_t reg_size,
729 const void *val, size_t val_size)
730{
731 struct regmap_ibt_context *ctx = context;
732 struct ibt_cp_reg_access *cp;
733 struct sk_buff *skb;
734 int plen = sizeof(*cp) + val_size;
735 u8 mode;
736 int err = 0;
737
738 if (reg_size != sizeof(__le32))
739 return -EINVAL;
740
741 switch (val_size) {
742 case 1:
743 mode = IBT_REG_MODE_8BIT;
744 break;
745 case 2:
746 mode = IBT_REG_MODE_16BIT;
747 break;
748 case 4:
749 mode = IBT_REG_MODE_32BIT;
750 break;
751 default:
752 return -EINVAL;
753 }
754
755 cp = kmalloc(plen, GFP_KERNEL);
756 if (!cp)
757 return -ENOMEM;
758
759
760 cp->addr = *(__le32 *)addr;
761 cp->mode = mode;
762 cp->len = val_size;
763 memcpy(&cp->data, val, val_size);
764
765 bt_dev_dbg(ctx->hdev, "Register (0x%x) write", le32_to_cpu(cp->addr));
766
767 skb = hci_cmd_sync(ctx->hdev, ctx->op_write, plen, cp, HCI_CMD_TIMEOUT);
768 if (IS_ERR(skb)) {
769 err = PTR_ERR(skb);
770 bt_dev_err(ctx->hdev, "regmap: Register (0x%x) write error (%d)",
771 le32_to_cpu(cp->addr), err);
772 goto done;
773 }
774 kfree_skb(skb);
775
776done:
777 kfree(cp);
778 return err;
779}
780
781static int regmap_ibt_write(void *context, const void *data, size_t count)
782{
783
784
785
786 if (WARN_ONCE(count < 4, "Invalid register access"))
787 return -EINVAL;
788
789 return regmap_ibt_gather_write(context, data, 4, data + 4, count - 4);
790}
791
792static void regmap_ibt_free_context(void *context)
793{
794 kfree(context);
795}
796
797static struct regmap_bus regmap_ibt = {
798 .read = regmap_ibt_read,
799 .write = regmap_ibt_write,
800 .gather_write = regmap_ibt_gather_write,
801 .free_context = regmap_ibt_free_context,
802 .reg_format_endian_default = REGMAP_ENDIAN_LITTLE,
803 .val_format_endian_default = REGMAP_ENDIAN_LITTLE,
804};
805
806
807static const struct regmap_config regmap_ibt_cfg = {
808 .name = "btintel_regmap",
809 .reg_bits = 32,
810 .val_bits = 32,
811};
812
813struct regmap *btintel_regmap_init(struct hci_dev *hdev, u16 opcode_read,
814 u16 opcode_write)
815{
816 struct regmap_ibt_context *ctx;
817
818 bt_dev_info(hdev, "regmap: Init R%x-W%x region", opcode_read,
819 opcode_write);
820
821 ctx = kzalloc(sizeof(*ctx), GFP_KERNEL);
822 if (!ctx)
823 return ERR_PTR(-ENOMEM);
824
825 ctx->op_read = opcode_read;
826 ctx->op_write = opcode_write;
827 ctx->hdev = hdev;
828
829 return regmap_init(&hdev->dev, ®map_ibt, ctx, ®map_ibt_cfg);
830}
831EXPORT_SYMBOL_GPL(btintel_regmap_init);
832
833int btintel_send_intel_reset(struct hci_dev *hdev, u32 boot_param)
834{
835 struct intel_reset params = { 0x00, 0x01, 0x00, 0x01, 0x00000000 };
836 struct sk_buff *skb;
837
838 params.boot_param = cpu_to_le32(boot_param);
839
840 skb = __hci_cmd_sync(hdev, 0xfc01, sizeof(params), ¶ms,
841 HCI_INIT_TIMEOUT);
842 if (IS_ERR(skb)) {
843 bt_dev_err(hdev, "Failed to send Intel Reset command");
844 return PTR_ERR(skb);
845 }
846
847 kfree_skb(skb);
848
849 return 0;
850}
851EXPORT_SYMBOL_GPL(btintel_send_intel_reset);
852
853int btintel_read_boot_params(struct hci_dev *hdev,
854 struct intel_boot_params *params)
855{
856 struct sk_buff *skb;
857
858 skb = __hci_cmd_sync(hdev, 0xfc0d, 0, NULL, HCI_INIT_TIMEOUT);
859 if (IS_ERR(skb)) {
860 bt_dev_err(hdev, "Reading Intel boot parameters failed (%ld)",
861 PTR_ERR(skb));
862 return PTR_ERR(skb);
863 }
864
865 if (skb->len != sizeof(*params)) {
866 bt_dev_err(hdev, "Intel boot parameters size mismatch");
867 kfree_skb(skb);
868 return -EILSEQ;
869 }
870
871 memcpy(params, skb->data, sizeof(*params));
872
873 kfree_skb(skb);
874
875 if (params->status) {
876 bt_dev_err(hdev, "Intel boot parameters command failed (%02x)",
877 params->status);
878 return -bt_to_errno(params->status);
879 }
880
881 bt_dev_info(hdev, "Device revision is %u",
882 le16_to_cpu(params->dev_revid));
883
884 bt_dev_info(hdev, "Secure boot is %s",
885 params->secure_boot ? "enabled" : "disabled");
886
887 bt_dev_info(hdev, "OTP lock is %s",
888 params->otp_lock ? "enabled" : "disabled");
889
890 bt_dev_info(hdev, "API lock is %s",
891 params->api_lock ? "enabled" : "disabled");
892
893 bt_dev_info(hdev, "Debug lock is %s",
894 params->debug_lock ? "enabled" : "disabled");
895
896 bt_dev_info(hdev, "Minimum firmware build %u week %u %u",
897 params->min_fw_build_nn, params->min_fw_build_cw,
898 2000 + params->min_fw_build_yy);
899
900 return 0;
901}
902EXPORT_SYMBOL_GPL(btintel_read_boot_params);
903
904static int btintel_sfi_rsa_header_secure_send(struct hci_dev *hdev,
905 const struct firmware *fw)
906{
907 int err;
908
909
910
911
912 err = btintel_secure_send(hdev, 0x00, 128, fw->data);
913 if (err < 0) {
914 bt_dev_err(hdev, "Failed to send firmware header (%d)", err);
915 goto done;
916 }
917
918
919
920
921 err = btintel_secure_send(hdev, 0x03, 256, fw->data + 128);
922 if (err < 0) {
923 bt_dev_err(hdev, "Failed to send firmware pkey (%d)", err);
924 goto done;
925 }
926
927
928
929
930 err = btintel_secure_send(hdev, 0x02, 256, fw->data + 388);
931 if (err < 0) {
932 bt_dev_err(hdev, "Failed to send firmware signature (%d)", err);
933 goto done;
934 }
935
936done:
937 return err;
938}
939
940static int btintel_sfi_ecdsa_header_secure_send(struct hci_dev *hdev,
941 const struct firmware *fw)
942{
943 int err;
944
945
946
947
948 err = btintel_secure_send(hdev, 0x00, 128, fw->data + 644);
949 if (err < 0) {
950 bt_dev_err(hdev, "Failed to send firmware header (%d)", err);
951 return err;
952 }
953
954
955
956
957 err = btintel_secure_send(hdev, 0x03, 96, fw->data + 644 + 128);
958 if (err < 0) {
959 bt_dev_err(hdev, "Failed to send firmware pkey (%d)", err);
960 return err;
961 }
962
963
964
965
966 err = btintel_secure_send(hdev, 0x02, 96, fw->data + 644 + 224);
967 if (err < 0) {
968 bt_dev_err(hdev, "Failed to send firmware signature (%d)",
969 err);
970 return err;
971 }
972 return 0;
973}
974
975static int btintel_download_firmware_payload(struct hci_dev *hdev,
976 const struct firmware *fw,
977 size_t offset)
978{
979 int err;
980 const u8 *fw_ptr;
981 u32 frag_len;
982
983 fw_ptr = fw->data + offset;
984 frag_len = 0;
985 err = -EINVAL;
986
987 while (fw_ptr - fw->data < fw->size) {
988 struct hci_command_hdr *cmd = (void *)(fw_ptr + frag_len);
989
990 frag_len += sizeof(*cmd) + cmd->plen;
991
992
993
994
995
996
997
998
999
1000 if (!(frag_len % 4)) {
1001 err = btintel_secure_send(hdev, 0x01, frag_len, fw_ptr);
1002 if (err < 0) {
1003 bt_dev_err(hdev,
1004 "Failed to send firmware data (%d)",
1005 err);
1006 goto done;
1007 }
1008
1009 fw_ptr += frag_len;
1010 frag_len = 0;
1011 }
1012 }
1013
1014done:
1015 return err;
1016}
1017
1018static bool btintel_firmware_version(struct hci_dev *hdev,
1019 u8 num, u8 ww, u8 yy,
1020 const struct firmware *fw,
1021 u32 *boot_addr)
1022{
1023 const u8 *fw_ptr;
1024
1025 fw_ptr = fw->data;
1026
1027 while (fw_ptr - fw->data < fw->size) {
1028 struct hci_command_hdr *cmd = (void *)(fw_ptr);
1029
1030
1031
1032
1033
1034
1035 if (le16_to_cpu(cmd->opcode) == CMD_WRITE_BOOT_PARAMS) {
1036 struct cmd_write_boot_params *params;
1037
1038 params = (void *)(fw_ptr + sizeof(*cmd));
1039
1040 bt_dev_info(hdev, "Boot Address: 0x%x",
1041 le32_to_cpu(params->boot_addr));
1042
1043 bt_dev_info(hdev, "Firmware Version: %u-%u.%u",
1044 params->fw_build_num, params->fw_build_ww,
1045 params->fw_build_yy);
1046
1047 return (num == params->fw_build_num &&
1048 ww == params->fw_build_ww &&
1049 yy == params->fw_build_yy);
1050 }
1051
1052 fw_ptr += sizeof(*cmd) + cmd->plen;
1053 }
1054
1055 return false;
1056}
1057
1058int btintel_download_firmware(struct hci_dev *hdev,
1059 struct intel_version *ver,
1060 const struct firmware *fw,
1061 u32 *boot_param)
1062{
1063 int err;
1064
1065
1066
1067
1068 switch (ver->hw_variant) {
1069 case 0x0b:
1070 case 0x0c:
1071
1072 break;
1073 default:
1074
1075 if (ver->fw_variant == 0x06)
1076 break;
1077
1078
1079 if (btintel_firmware_version(hdev, ver->fw_build_num,
1080 ver->fw_build_ww, ver->fw_build_yy,
1081 fw, boot_param)) {
1082 bt_dev_info(hdev, "Firmware already loaded");
1083
1084
1085
1086 return -EALREADY;
1087 }
1088 }
1089
1090
1091
1092
1093
1094
1095
1096
1097
1098 if (ver->fw_variant == 0x23)
1099 return -EINVAL;
1100
1101 err = btintel_sfi_rsa_header_secure_send(hdev, fw);
1102 if (err)
1103 return err;
1104
1105 return btintel_download_firmware_payload(hdev, fw, RSA_HEADER_LEN);
1106}
1107EXPORT_SYMBOL_GPL(btintel_download_firmware);
1108
1109static int btintel_download_fw_tlv(struct hci_dev *hdev,
1110 struct intel_version_tlv *ver,
1111 const struct firmware *fw, u32 *boot_param,
1112 u8 hw_variant, u8 sbe_type)
1113{
1114 int err;
1115 u32 css_header_ver;
1116
1117
1118 if (ver->img_type != 0x01) {
1119
1120 if (btintel_firmware_version(hdev, ver->min_fw_build_nn,
1121 ver->min_fw_build_cw,
1122 ver->min_fw_build_yy,
1123 fw, boot_param)) {
1124 bt_dev_info(hdev, "Firmware already loaded");
1125
1126
1127
1128 return -EALREADY;
1129 }
1130 }
1131
1132
1133
1134
1135
1136
1137
1138
1139
1140 if (ver->img_type == 0x03)
1141 return -EINVAL;
1142
1143
1144
1145
1146
1147
1148
1149
1150
1151
1152
1153
1154
1155 css_header_ver = get_unaligned_le32(fw->data + CSS_HEADER_OFFSET);
1156 if (css_header_ver != 0x00010000) {
1157 bt_dev_err(hdev, "Invalid CSS Header version");
1158 return -EINVAL;
1159 }
1160
1161 if (hw_variant <= 0x14) {
1162 if (sbe_type != 0x00) {
1163 bt_dev_err(hdev, "Invalid SBE type for hardware variant (%d)",
1164 hw_variant);
1165 return -EINVAL;
1166 }
1167
1168 err = btintel_sfi_rsa_header_secure_send(hdev, fw);
1169 if (err)
1170 return err;
1171
1172 err = btintel_download_firmware_payload(hdev, fw, RSA_HEADER_LEN);
1173 if (err)
1174 return err;
1175 } else if (hw_variant >= 0x17) {
1176
1177 if (fw->data[ECDSA_OFFSET] != 0x06)
1178 return -EINVAL;
1179
1180
1181 css_header_ver = get_unaligned_le32(fw->data + ECDSA_OFFSET + CSS_HEADER_OFFSET);
1182 if (css_header_ver != 0x00020000) {
1183 bt_dev_err(hdev, "Invalid CSS Header version");
1184 return -EINVAL;
1185 }
1186
1187 if (sbe_type == 0x00) {
1188 err = btintel_sfi_rsa_header_secure_send(hdev, fw);
1189 if (err)
1190 return err;
1191
1192 err = btintel_download_firmware_payload(hdev, fw,
1193 RSA_HEADER_LEN + ECDSA_HEADER_LEN);
1194 if (err)
1195 return err;
1196 } else if (sbe_type == 0x01) {
1197 err = btintel_sfi_ecdsa_header_secure_send(hdev, fw);
1198 if (err)
1199 return err;
1200
1201 err = btintel_download_firmware_payload(hdev, fw,
1202 RSA_HEADER_LEN + ECDSA_HEADER_LEN);
1203 if (err)
1204 return err;
1205 }
1206 }
1207 return 0;
1208}
1209
1210static void btintel_reset_to_bootloader(struct hci_dev *hdev)
1211{
1212 struct intel_reset params;
1213 struct sk_buff *skb;
1214
1215
1216
1217
1218
1219
1220
1221
1222
1223
1224
1225
1226
1227
1228
1229
1230 params.reset_type = 0x01;
1231 params.patch_enable = 0x01;
1232 params.ddc_reload = 0x01;
1233 params.boot_option = 0x00;
1234 params.boot_param = cpu_to_le32(0x00000000);
1235
1236 skb = __hci_cmd_sync(hdev, 0xfc01, sizeof(params),
1237 ¶ms, HCI_INIT_TIMEOUT);
1238 if (IS_ERR(skb)) {
1239 bt_dev_err(hdev, "FW download error recovery failed (%ld)",
1240 PTR_ERR(skb));
1241 return;
1242 }
1243 bt_dev_info(hdev, "Intel reset sent to retry FW download");
1244 kfree_skb(skb);
1245
1246
1247
1248
1249
1250
1251 msleep(150);
1252}
1253
1254static int btintel_read_debug_features(struct hci_dev *hdev,
1255 struct intel_debug_features *features)
1256{
1257 struct sk_buff *skb;
1258 u8 page_no = 1;
1259
1260
1261
1262
1263 skb = __hci_cmd_sync(hdev, 0xfca6, sizeof(page_no), &page_no,
1264 HCI_INIT_TIMEOUT);
1265 if (IS_ERR(skb)) {
1266 bt_dev_err(hdev, "Reading supported features failed (%ld)",
1267 PTR_ERR(skb));
1268 return PTR_ERR(skb);
1269 }
1270
1271 if (skb->len != (sizeof(features->page1) + 3)) {
1272 bt_dev_err(hdev, "Supported features event size mismatch");
1273 kfree_skb(skb);
1274 return -EILSEQ;
1275 }
1276
1277 memcpy(features->page1, skb->data + 3, sizeof(features->page1));
1278
1279
1280
1281 kfree_skb(skb);
1282 return 0;
1283}
1284
1285static int btintel_set_debug_features(struct hci_dev *hdev,
1286 const struct intel_debug_features *features)
1287{
1288 u8 mask[11] = { 0x0a, 0x92, 0x02, 0x07, 0x00, 0x00, 0x00, 0x00,
1289 0x00, 0x00, 0x00 };
1290 struct sk_buff *skb;
1291
1292 if (!features)
1293 return -EINVAL;
1294
1295 if (!(features->page1[0] & 0x3f)) {
1296 bt_dev_info(hdev, "Telemetry exception format not supported");
1297 return 0;
1298 }
1299
1300 skb = __hci_cmd_sync(hdev, 0xfc8b, 11, mask, HCI_INIT_TIMEOUT);
1301 if (IS_ERR(skb)) {
1302 bt_dev_err(hdev, "Setting Intel telemetry ddc write event mask failed (%ld)",
1303 PTR_ERR(skb));
1304 return PTR_ERR(skb);
1305 }
1306
1307 kfree_skb(skb);
1308 return 0;
1309}
1310
1311static const struct firmware *btintel_legacy_rom_get_fw(struct hci_dev *hdev,
1312 struct intel_version *ver)
1313{
1314 const struct firmware *fw;
1315 char fwname[64];
1316 int ret;
1317
1318 snprintf(fwname, sizeof(fwname),
1319 "intel/ibt-hw-%x.%x.%x-fw-%x.%x.%x.%x.%x.bseq",
1320 ver->hw_platform, ver->hw_variant, ver->hw_revision,
1321 ver->fw_variant, ver->fw_revision, ver->fw_build_num,
1322 ver->fw_build_ww, ver->fw_build_yy);
1323
1324 ret = request_firmware(&fw, fwname, &hdev->dev);
1325 if (ret < 0) {
1326 if (ret == -EINVAL) {
1327 bt_dev_err(hdev, "Intel firmware file request failed (%d)",
1328 ret);
1329 return NULL;
1330 }
1331
1332 bt_dev_err(hdev, "failed to open Intel firmware file: %s (%d)",
1333 fwname, ret);
1334
1335
1336
1337
1338 snprintf(fwname, sizeof(fwname), "intel/ibt-hw-%x.%x.bseq",
1339 ver->hw_platform, ver->hw_variant);
1340 if (request_firmware(&fw, fwname, &hdev->dev) < 0) {
1341 bt_dev_err(hdev, "failed to open default fw file: %s",
1342 fwname);
1343 return NULL;
1344 }
1345 }
1346
1347 bt_dev_info(hdev, "Intel Bluetooth firmware file: %s", fwname);
1348
1349 return fw;
1350}
1351
1352static int btintel_legacy_rom_patching(struct hci_dev *hdev,
1353 const struct firmware *fw,
1354 const u8 **fw_ptr, int *disable_patch)
1355{
1356 struct sk_buff *skb;
1357 struct hci_command_hdr *cmd;
1358 const u8 *cmd_param;
1359 struct hci_event_hdr *evt = NULL;
1360 const u8 *evt_param = NULL;
1361 int remain = fw->size - (*fw_ptr - fw->data);
1362
1363
1364
1365
1366
1367
1368
1369
1370 if (remain > HCI_COMMAND_HDR_SIZE && *fw_ptr[0] != 0x01) {
1371 bt_dev_err(hdev, "Intel fw corrupted: invalid cmd read");
1372 return -EINVAL;
1373 }
1374 (*fw_ptr)++;
1375 remain--;
1376
1377 cmd = (struct hci_command_hdr *)(*fw_ptr);
1378 *fw_ptr += sizeof(*cmd);
1379 remain -= sizeof(*cmd);
1380
1381
1382
1383
1384 if (remain < cmd->plen) {
1385 bt_dev_err(hdev, "Intel fw corrupted: invalid cmd len");
1386 return -EFAULT;
1387 }
1388
1389
1390
1391
1392
1393
1394
1395 if (*disable_patch && le16_to_cpu(cmd->opcode) == 0xfc8e)
1396 *disable_patch = 0;
1397
1398 cmd_param = *fw_ptr;
1399 *fw_ptr += cmd->plen;
1400 remain -= cmd->plen;
1401
1402
1403
1404
1405
1406
1407
1408
1409 while (remain > HCI_EVENT_HDR_SIZE && *fw_ptr[0] == 0x02) {
1410 (*fw_ptr)++;
1411 remain--;
1412
1413 evt = (struct hci_event_hdr *)(*fw_ptr);
1414 *fw_ptr += sizeof(*evt);
1415 remain -= sizeof(*evt);
1416
1417 if (remain < evt->plen) {
1418 bt_dev_err(hdev, "Intel fw corrupted: invalid evt len");
1419 return -EFAULT;
1420 }
1421
1422 evt_param = *fw_ptr;
1423 *fw_ptr += evt->plen;
1424 remain -= evt->plen;
1425 }
1426
1427
1428
1429
1430
1431 if (!evt || !evt_param || remain < 0) {
1432 bt_dev_err(hdev, "Intel fw corrupted: invalid evt read");
1433 return -EFAULT;
1434 }
1435
1436 skb = __hci_cmd_sync_ev(hdev, le16_to_cpu(cmd->opcode), cmd->plen,
1437 cmd_param, evt->evt, HCI_INIT_TIMEOUT);
1438 if (IS_ERR(skb)) {
1439 bt_dev_err(hdev, "sending Intel patch command (0x%4.4x) failed (%ld)",
1440 cmd->opcode, PTR_ERR(skb));
1441 return PTR_ERR(skb);
1442 }
1443
1444
1445
1446
1447
1448 if (skb->len != evt->plen) {
1449 bt_dev_err(hdev, "mismatch event length (opcode 0x%4.4x)",
1450 le16_to_cpu(cmd->opcode));
1451 kfree_skb(skb);
1452 return -EFAULT;
1453 }
1454
1455 if (memcmp(skb->data, evt_param, evt->plen)) {
1456 bt_dev_err(hdev, "mismatch event parameter (opcode 0x%4.4x)",
1457 le16_to_cpu(cmd->opcode));
1458 kfree_skb(skb);
1459 return -EFAULT;
1460 }
1461 kfree_skb(skb);
1462
1463 return 0;
1464}
1465
1466static int btintel_legacy_rom_setup(struct hci_dev *hdev,
1467 struct intel_version *ver)
1468{
1469 const struct firmware *fw;
1470 const u8 *fw_ptr;
1471 int disable_patch, err;
1472 struct intel_version new_ver;
1473
1474 BT_DBG("%s", hdev->name);
1475
1476
1477
1478
1479
1480 if (ver->fw_patch_num) {
1481 bt_dev_info(hdev,
1482 "Intel device is already patched. patch num: %02x",
1483 ver->fw_patch_num);
1484 goto complete;
1485 }
1486
1487
1488
1489
1490
1491
1492
1493 fw = btintel_legacy_rom_get_fw(hdev, ver);
1494 if (!fw)
1495 goto complete;
1496 fw_ptr = fw->data;
1497
1498
1499
1500
1501
1502 err = btintel_enter_mfg(hdev);
1503 if (err) {
1504 release_firmware(fw);
1505 return err;
1506 }
1507
1508 disable_patch = 1;
1509
1510
1511
1512
1513
1514
1515
1516
1517
1518
1519
1520
1521
1522
1523
1524
1525
1526
1527
1528
1529
1530 while (fw->size > fw_ptr - fw->data) {
1531 int ret;
1532
1533 ret = btintel_legacy_rom_patching(hdev, fw, &fw_ptr,
1534 &disable_patch);
1535 if (ret < 0)
1536 goto exit_mfg_deactivate;
1537 }
1538
1539 release_firmware(fw);
1540
1541 if (disable_patch)
1542 goto exit_mfg_disable;
1543
1544
1545
1546
1547 err = btintel_exit_mfg(hdev, true, true);
1548 if (err)
1549 return err;
1550
1551
1552
1553
1554 err = btintel_read_version(hdev, &new_ver);
1555 if (err)
1556 return err;
1557
1558 bt_dev_info(hdev, "Intel BT fw patch 0x%02x completed & activated",
1559 new_ver.fw_patch_num);
1560
1561 goto complete;
1562
1563exit_mfg_disable:
1564
1565 err = btintel_exit_mfg(hdev, false, false);
1566 if (err)
1567 return err;
1568
1569 bt_dev_info(hdev, "Intel firmware patch completed");
1570
1571 goto complete;
1572
1573exit_mfg_deactivate:
1574 release_firmware(fw);
1575
1576
1577
1578
1579 err = btintel_exit_mfg(hdev, true, false);
1580 if (err)
1581 return err;
1582
1583 bt_dev_info(hdev, "Intel firmware patch completed and deactivated");
1584
1585complete:
1586
1587
1588
1589 btintel_set_event_mask_mfg(hdev, false);
1590
1591 btintel_check_bdaddr(hdev);
1592
1593 return 0;
1594}
1595
1596static int btintel_download_wait(struct hci_dev *hdev, ktime_t calltime, int msec)
1597{
1598 ktime_t delta, rettime;
1599 unsigned long long duration;
1600 int err;
1601
1602 btintel_set_flag(hdev, INTEL_FIRMWARE_LOADED);
1603
1604 bt_dev_info(hdev, "Waiting for firmware download to complete");
1605
1606 err = btintel_wait_on_flag_timeout(hdev, INTEL_DOWNLOADING,
1607 TASK_INTERRUPTIBLE,
1608 msecs_to_jiffies(msec));
1609 if (err == -EINTR) {
1610 bt_dev_err(hdev, "Firmware loading interrupted");
1611 return err;
1612 }
1613
1614 if (err) {
1615 bt_dev_err(hdev, "Firmware loading timeout");
1616 return -ETIMEDOUT;
1617 }
1618
1619 if (btintel_test_flag(hdev, INTEL_FIRMWARE_FAILED)) {
1620 bt_dev_err(hdev, "Firmware loading failed");
1621 return -ENOEXEC;
1622 }
1623
1624 rettime = ktime_get();
1625 delta = ktime_sub(rettime, calltime);
1626 duration = (unsigned long long)ktime_to_ns(delta) >> 10;
1627
1628 bt_dev_info(hdev, "Firmware loaded in %llu usecs", duration);
1629
1630 return 0;
1631}
1632
1633static int btintel_boot_wait(struct hci_dev *hdev, ktime_t calltime, int msec)
1634{
1635 ktime_t delta, rettime;
1636 unsigned long long duration;
1637 int err;
1638
1639 bt_dev_info(hdev, "Waiting for device to boot");
1640
1641 err = btintel_wait_on_flag_timeout(hdev, INTEL_BOOTING,
1642 TASK_INTERRUPTIBLE,
1643 msecs_to_jiffies(msec));
1644 if (err == -EINTR) {
1645 bt_dev_err(hdev, "Device boot interrupted");
1646 return -EINTR;
1647 }
1648
1649 if (err) {
1650 bt_dev_err(hdev, "Device boot timeout");
1651 return -ETIMEDOUT;
1652 }
1653
1654 rettime = ktime_get();
1655 delta = ktime_sub(rettime, calltime);
1656 duration = (unsigned long long) ktime_to_ns(delta) >> 10;
1657
1658 bt_dev_info(hdev, "Device booted in %llu usecs", duration);
1659
1660 return 0;
1661}
1662
1663static int btintel_boot(struct hci_dev *hdev, u32 boot_addr)
1664{
1665 ktime_t calltime;
1666 int err;
1667
1668 calltime = ktime_get();
1669
1670 btintel_set_flag(hdev, INTEL_BOOTING);
1671
1672 err = btintel_send_intel_reset(hdev, boot_addr);
1673 if (err) {
1674 bt_dev_err(hdev, "Intel Soft Reset failed (%d)", err);
1675 btintel_reset_to_bootloader(hdev);
1676 return err;
1677 }
1678
1679
1680
1681
1682
1683
1684
1685
1686 err = btintel_boot_wait(hdev, calltime, 1000);
1687 if (err == -ETIMEDOUT)
1688 btintel_reset_to_bootloader(hdev);
1689
1690 return err;
1691}
1692
1693static int btintel_get_fw_name(struct intel_version *ver,
1694 struct intel_boot_params *params,
1695 char *fw_name, size_t len,
1696 const char *suffix)
1697{
1698 switch (ver->hw_variant) {
1699 case 0x0b:
1700 case 0x0c:
1701 snprintf(fw_name, len, "intel/ibt-%u-%u.%s",
1702 le16_to_cpu(ver->hw_variant),
1703 le16_to_cpu(params->dev_revid),
1704 suffix);
1705 break;
1706 case 0x11:
1707 case 0x12:
1708 case 0x13:
1709 case 0x14:
1710 snprintf(fw_name, len, "intel/ibt-%u-%u-%u.%s",
1711 le16_to_cpu(ver->hw_variant),
1712 le16_to_cpu(ver->hw_revision),
1713 le16_to_cpu(ver->fw_revision),
1714 suffix);
1715 break;
1716 default:
1717 return -EINVAL;
1718 }
1719
1720 return 0;
1721}
1722
1723static int btintel_download_fw(struct hci_dev *hdev,
1724 struct intel_version *ver,
1725 struct intel_boot_params *params,
1726 u32 *boot_param)
1727{
1728 const struct firmware *fw;
1729 char fwname[64];
1730 int err;
1731 ktime_t calltime;
1732
1733 if (!ver || !params)
1734 return -EINVAL;
1735
1736
1737
1738
1739
1740
1741
1742
1743
1744
1745
1746
1747
1748
1749 if (ver->fw_variant == 0x23) {
1750 btintel_clear_flag(hdev, INTEL_BOOTLOADER);
1751 btintel_check_bdaddr(hdev);
1752
1753
1754
1755
1756 switch (ver->hw_variant) {
1757 case 0x0b:
1758 case 0x0c:
1759 return 0;
1760 }
1761
1762
1763 goto download;
1764 }
1765
1766
1767
1768
1769 err = btintel_read_boot_params(hdev, params);
1770 if (err)
1771 return err;
1772
1773
1774
1775
1776
1777 if (params->limited_cce != 0x00) {
1778 bt_dev_err(hdev, "Unsupported Intel firmware loading method (%u)",
1779 params->limited_cce);
1780 return -EINVAL;
1781 }
1782
1783
1784
1785
1786 if (!bacmp(¶ms->otp_bdaddr, BDADDR_ANY)) {
1787 bt_dev_info(hdev, "No device address configured");
1788 set_bit(HCI_QUIRK_INVALID_BDADDR, &hdev->quirks);
1789 }
1790
1791download:
1792
1793
1794
1795
1796
1797
1798
1799
1800
1801
1802
1803
1804
1805
1806
1807
1808
1809
1810
1811
1812
1813 err = btintel_get_fw_name(ver, params, fwname, sizeof(fwname), "sfi");
1814 if (err < 0) {
1815 if (!btintel_test_flag(hdev, INTEL_BOOTLOADER)) {
1816
1817 btintel_set_flag(hdev, INTEL_FIRMWARE_LOADED);
1818 return 0;
1819 }
1820
1821 bt_dev_err(hdev, "Unsupported Intel firmware naming");
1822 return -EINVAL;
1823 }
1824
1825 err = firmware_request_nowarn(&fw, fwname, &hdev->dev);
1826 if (err < 0) {
1827 if (!btintel_test_flag(hdev, INTEL_BOOTLOADER)) {
1828
1829 btintel_set_flag(hdev, INTEL_FIRMWARE_LOADED);
1830 return 0;
1831 }
1832
1833 bt_dev_err(hdev, "Failed to load Intel firmware file %s (%d)",
1834 fwname, err);
1835 return err;
1836 }
1837
1838 bt_dev_info(hdev, "Found device firmware: %s", fwname);
1839
1840 if (fw->size < 644) {
1841 bt_dev_err(hdev, "Invalid size of firmware file (%zu)",
1842 fw->size);
1843 err = -EBADF;
1844 goto done;
1845 }
1846
1847 calltime = ktime_get();
1848
1849 btintel_set_flag(hdev, INTEL_DOWNLOADING);
1850
1851
1852 err = btintel_download_firmware(hdev, ver, fw, boot_param);
1853 if (err < 0) {
1854 if (err == -EALREADY) {
1855
1856 btintel_set_flag(hdev, INTEL_FIRMWARE_LOADED);
1857 err = 0;
1858 goto done;
1859 }
1860
1861
1862
1863
1864 btintel_reset_to_bootloader(hdev);
1865 goto done;
1866 }
1867
1868
1869
1870
1871
1872
1873
1874
1875
1876
1877
1878
1879 err = btintel_download_wait(hdev, calltime, 5000);
1880 if (err == -ETIMEDOUT)
1881 btintel_reset_to_bootloader(hdev);
1882
1883done:
1884 release_firmware(fw);
1885 return err;
1886}
1887
1888static int btintel_bootloader_setup(struct hci_dev *hdev,
1889 struct intel_version *ver)
1890{
1891 struct intel_version new_ver;
1892 struct intel_boot_params params;
1893 u32 boot_param;
1894 char ddcname[64];
1895 int err;
1896 struct intel_debug_features features;
1897
1898 BT_DBG("%s", hdev->name);
1899
1900
1901
1902
1903
1904 boot_param = 0x00000000;
1905
1906 btintel_set_flag(hdev, INTEL_BOOTLOADER);
1907
1908 err = btintel_download_fw(hdev, ver, ¶ms, &boot_param);
1909 if (err)
1910 return err;
1911
1912
1913 if (ver->fw_variant == 0x23)
1914 goto finish;
1915
1916 err = btintel_boot(hdev, boot_param);
1917 if (err)
1918 return err;
1919
1920 btintel_clear_flag(hdev, INTEL_BOOTLOADER);
1921
1922 err = btintel_get_fw_name(ver, ¶ms, ddcname,
1923 sizeof(ddcname), "ddc");
1924
1925 if (err < 0) {
1926 bt_dev_err(hdev, "Unsupported Intel firmware naming");
1927 } else {
1928
1929
1930
1931
1932
1933
1934 btintel_load_ddc_config(hdev, ddcname);
1935 }
1936
1937
1938
1939
1940 err = btintel_read_debug_features(hdev, &features);
1941 if (!err) {
1942
1943 btintel_set_debug_features(hdev, &features);
1944 }
1945
1946
1947 err = btintel_read_version(hdev, &new_ver);
1948 if (err)
1949 return err;
1950
1951 btintel_version_info(hdev, &new_ver);
1952
1953finish:
1954
1955
1956
1957
1958
1959
1960
1961 btintel_set_event_mask(hdev, false);
1962
1963 return 0;
1964}
1965
1966static void btintel_get_fw_name_tlv(const struct intel_version_tlv *ver,
1967 char *fw_name, size_t len,
1968 const char *suffix)
1969{
1970
1971
1972
1973 snprintf(fw_name, len, "intel/ibt-%04x-%04x.%s",
1974 INTEL_CNVX_TOP_PACK_SWAB(INTEL_CNVX_TOP_TYPE(ver->cnvi_top),
1975 INTEL_CNVX_TOP_STEP(ver->cnvi_top)),
1976 INTEL_CNVX_TOP_PACK_SWAB(INTEL_CNVX_TOP_TYPE(ver->cnvr_top),
1977 INTEL_CNVX_TOP_STEP(ver->cnvr_top)),
1978 suffix);
1979}
1980
1981static int btintel_prepare_fw_download_tlv(struct hci_dev *hdev,
1982 struct intel_version_tlv *ver,
1983 u32 *boot_param)
1984{
1985 const struct firmware *fw;
1986 char fwname[64];
1987 int err;
1988 ktime_t calltime;
1989
1990 if (!ver || !boot_param)
1991 return -EINVAL;
1992
1993
1994
1995
1996
1997
1998
1999
2000
2001
2002
2003
2004
2005
2006 if (ver->img_type == 0x03) {
2007 btintel_clear_flag(hdev, INTEL_BOOTLOADER);
2008 btintel_check_bdaddr(hdev);
2009 }
2010
2011
2012
2013
2014 if (!bacmp(&ver->otp_bd_addr, BDADDR_ANY)) {
2015 bt_dev_info(hdev, "No device address configured");
2016 set_bit(HCI_QUIRK_INVALID_BDADDR, &hdev->quirks);
2017 }
2018
2019 btintel_get_fw_name_tlv(ver, fwname, sizeof(fwname), "sfi");
2020 err = firmware_request_nowarn(&fw, fwname, &hdev->dev);
2021 if (err < 0) {
2022 if (!btintel_test_flag(hdev, INTEL_BOOTLOADER)) {
2023
2024 btintel_set_flag(hdev, INTEL_FIRMWARE_LOADED);
2025 return 0;
2026 }
2027
2028 bt_dev_err(hdev, "Failed to load Intel firmware file %s (%d)",
2029 fwname, err);
2030
2031 return err;
2032 }
2033
2034 bt_dev_info(hdev, "Found device firmware: %s", fwname);
2035
2036 if (fw->size < 644) {
2037 bt_dev_err(hdev, "Invalid size of firmware file (%zu)",
2038 fw->size);
2039 err = -EBADF;
2040 goto done;
2041 }
2042
2043 calltime = ktime_get();
2044
2045 btintel_set_flag(hdev, INTEL_DOWNLOADING);
2046
2047
2048 err = btintel_download_fw_tlv(hdev, ver, fw, boot_param,
2049 INTEL_HW_VARIANT(ver->cnvi_bt),
2050 ver->sbe_type);
2051 if (err < 0) {
2052 if (err == -EALREADY) {
2053
2054 btintel_set_flag(hdev, INTEL_FIRMWARE_LOADED);
2055 err = 0;
2056 goto done;
2057 }
2058
2059
2060
2061
2062 btintel_reset_to_bootloader(hdev);
2063 goto done;
2064 }
2065
2066
2067
2068
2069
2070
2071
2072
2073
2074
2075
2076
2077 err = btintel_download_wait(hdev, calltime, 5000);
2078 if (err == -ETIMEDOUT)
2079 btintel_reset_to_bootloader(hdev);
2080
2081done:
2082 release_firmware(fw);
2083 return err;
2084}
2085
2086static int btintel_bootloader_setup_tlv(struct hci_dev *hdev,
2087 struct intel_version_tlv *ver)
2088{
2089 u32 boot_param;
2090 char ddcname[64];
2091 int err;
2092 struct intel_debug_features features;
2093 struct intel_version_tlv new_ver;
2094
2095 bt_dev_dbg(hdev, "");
2096
2097
2098
2099
2100
2101 boot_param = 0x00000000;
2102
2103 btintel_set_flag(hdev, INTEL_BOOTLOADER);
2104
2105 err = btintel_prepare_fw_download_tlv(hdev, ver, &boot_param);
2106 if (err)
2107 return err;
2108
2109
2110 if (ver->img_type == 0x03)
2111 goto finish;
2112
2113 err = btintel_boot(hdev, boot_param);
2114 if (err)
2115 return err;
2116
2117 btintel_clear_flag(hdev, INTEL_BOOTLOADER);
2118
2119 btintel_get_fw_name_tlv(ver, ddcname, sizeof(ddcname), "ddc");
2120
2121
2122
2123
2124
2125
2126 btintel_load_ddc_config(hdev, ddcname);
2127
2128
2129
2130
2131 err = btintel_read_debug_features(hdev, &features);
2132 if (!err) {
2133
2134 btintel_set_debug_features(hdev, &features);
2135 }
2136
2137
2138 err = btintel_read_version_tlv(hdev, &new_ver);
2139 if (err)
2140 return err;
2141
2142 btintel_version_info_tlv(hdev, &new_ver);
2143
2144finish:
2145
2146
2147
2148
2149
2150
2151
2152 btintel_set_event_mask(hdev, false);
2153
2154 return 0;
2155}
2156
2157static void btintel_set_msft_opcode(struct hci_dev *hdev, u8 hw_variant)
2158{
2159 switch (hw_variant) {
2160
2161 case 0x11:
2162 case 0x12:
2163 case 0x13:
2164 case 0x14:
2165
2166
2167
2168 case 0x17:
2169 case 0x18:
2170 case 0x19:
2171 hci_set_msft_opcode(hdev, 0xFC1E);
2172 break;
2173 default:
2174
2175 break;
2176 }
2177}
2178
2179static int btintel_setup_combined(struct hci_dev *hdev)
2180{
2181 const u8 param[1] = { 0xFF };
2182 struct intel_version ver;
2183 struct intel_version_tlv ver_tlv;
2184 struct sk_buff *skb;
2185 int err;
2186
2187 BT_DBG("%s", hdev->name);
2188
2189
2190
2191
2192
2193
2194
2195
2196
2197 if (btintel_test_flag(hdev, INTEL_BROKEN_INITIAL_NCMD)) {
2198 skb = __hci_cmd_sync(hdev, HCI_OP_RESET, 0, NULL,
2199 HCI_INIT_TIMEOUT);
2200 if (IS_ERR(skb)) {
2201 bt_dev_err(hdev,
2202 "sending initial HCI reset failed (%ld)",
2203 PTR_ERR(skb));
2204 return PTR_ERR(skb);
2205 }
2206 kfree_skb(skb);
2207 }
2208
2209
2210
2211
2212
2213
2214
2215 skb = __hci_cmd_sync(hdev, 0xfc05, 1, param, HCI_CMD_TIMEOUT);
2216 if (IS_ERR(skb)) {
2217 bt_dev_err(hdev, "Reading Intel version command failed (%ld)",
2218 PTR_ERR(skb));
2219 return PTR_ERR(skb);
2220 }
2221
2222
2223 if (skb->data[0]) {
2224 bt_dev_err(hdev, "Intel Read Version command failed (%02x)",
2225 skb->data[0]);
2226 err = -EIO;
2227 goto exit_error;
2228 }
2229
2230
2231 set_bit(HCI_QUIRK_STRICT_DUPLICATE_FILTER, &hdev->quirks);
2232 set_bit(HCI_QUIRK_SIMULTANEOUS_DISCOVERY, &hdev->quirks);
2233 set_bit(HCI_QUIRK_NON_PERSISTENT_DIAG, &hdev->quirks);
2234
2235
2236 if (skb->len == sizeof(ver) && skb->data[1] == 0x37) {
2237 bt_dev_dbg(hdev, "Read the legacy Intel version information");
2238
2239 memcpy(&ver, skb->data, sizeof(ver));
2240
2241
2242 btintel_version_info(hdev, &ver);
2243
2244
2245
2246
2247
2248
2249
2250
2251 switch (ver.hw_variant) {
2252 case 0x07:
2253 case 0x08:
2254
2255 btintel_set_flag(hdev, INTEL_ROM_LEGACY);
2256
2257
2258
2259
2260
2261
2262 if (ver.hw_variant == 0x08 && ver.fw_variant == 0x22)
2263 set_bit(HCI_QUIRK_WIDEBAND_SPEECH_SUPPORTED,
2264 &hdev->quirks);
2265
2266
2267
2268
2269
2270 btintel_set_flag(hdev, INTEL_BROKEN_LED);
2271
2272 err = btintel_legacy_rom_setup(hdev, &ver);
2273 break;
2274 case 0x0b:
2275 case 0x0c:
2276 case 0x11:
2277 case 0x12:
2278 case 0x13:
2279 case 0x14:
2280
2281
2282
2283
2284 set_bit(HCI_QUIRK_WIDEBAND_SPEECH_SUPPORTED,
2285 &hdev->quirks);
2286
2287
2288 if (ver.hw_variant == 0x11 || ver.hw_variant == 0x12)
2289 set_bit(HCI_QUIRK_VALID_LE_STATES,
2290 &hdev->quirks);
2291
2292
2293 btintel_set_msft_opcode(hdev, ver.hw_variant);
2294
2295 err = btintel_bootloader_setup(hdev, &ver);
2296 break;
2297 default:
2298 bt_dev_err(hdev, "Unsupported Intel hw variant (%u)",
2299 ver.hw_variant);
2300 err = -EINVAL;
2301 }
2302
2303 goto exit_error;
2304 }
2305
2306
2307 err = btintel_parse_version_tlv(hdev, &ver_tlv, skb);
2308 if (err) {
2309 bt_dev_err(hdev, "Failed to parse TLV version information");
2310 goto exit_error;
2311 }
2312
2313 if (INTEL_HW_PLATFORM(ver_tlv.cnvi_bt) != 0x37) {
2314 bt_dev_err(hdev, "Unsupported Intel hardware platform (0x%2x)",
2315 INTEL_HW_PLATFORM(ver_tlv.cnvi_bt));
2316 err = -EINVAL;
2317 goto exit_error;
2318 }
2319
2320
2321
2322
2323
2324
2325
2326
2327 switch (INTEL_HW_VARIANT(ver_tlv.cnvi_bt)) {
2328 case 0x11:
2329 case 0x12:
2330 case 0x13:
2331 case 0x14:
2332
2333
2334
2335
2336
2337
2338
2339
2340
2341
2342
2343
2344 err = btintel_read_version(hdev, &ver);
2345 if (err)
2346 return err;
2347 err = btintel_bootloader_setup(hdev, &ver);
2348 break;
2349 case 0x17:
2350 case 0x18:
2351 case 0x19:
2352
2353 btintel_version_info_tlv(hdev, &ver_tlv);
2354
2355
2356
2357
2358
2359 set_bit(HCI_QUIRK_WIDEBAND_SPEECH_SUPPORTED, &hdev->quirks);
2360
2361
2362 if (INTEL_HW_VARIANT(ver_tlv.cnvi_bt) == 0x18)
2363 set_bit(HCI_QUIRK_VALID_LE_STATES, &hdev->quirks);
2364
2365
2366 btintel_set_msft_opcode(hdev,
2367 INTEL_HW_VARIANT(ver_tlv.cnvi_bt));
2368
2369 err = btintel_bootloader_setup_tlv(hdev, &ver_tlv);
2370 break;
2371 default:
2372 bt_dev_err(hdev, "Unsupported Intel hw variant (%u)",
2373 INTEL_HW_VARIANT(ver_tlv.cnvi_bt));
2374 return -EINVAL;
2375 }
2376
2377exit_error:
2378 kfree_skb(skb);
2379
2380 return err;
2381}
2382
2383static int btintel_shutdown_combined(struct hci_dev *hdev)
2384{
2385 struct sk_buff *skb;
2386 int ret;
2387
2388
2389
2390
2391
2392 skb = __hci_cmd_sync(hdev, HCI_OP_RESET, 0, NULL, HCI_INIT_TIMEOUT);
2393 if (IS_ERR(skb)) {
2394 bt_dev_err(hdev, "HCI reset during shutdown failed");
2395 return PTR_ERR(skb);
2396 }
2397 kfree_skb(skb);
2398
2399
2400
2401
2402
2403
2404 if (btintel_test_flag(hdev, INTEL_BROKEN_LED)) {
2405 skb = __hci_cmd_sync(hdev, 0xfc3f, 0, NULL, HCI_INIT_TIMEOUT);
2406 if (IS_ERR(skb)) {
2407 ret = PTR_ERR(skb);
2408 bt_dev_err(hdev, "turning off Intel device LED failed");
2409 return ret;
2410 }
2411 kfree_skb(skb);
2412 }
2413
2414 return 0;
2415}
2416
2417int btintel_configure_setup(struct hci_dev *hdev)
2418{
2419 hdev->manufacturer = 2;
2420 hdev->setup = btintel_setup_combined;
2421 hdev->shutdown = btintel_shutdown_combined;
2422 hdev->hw_error = btintel_hw_error;
2423 hdev->set_diag = btintel_set_diag_combined;
2424 hdev->set_bdaddr = btintel_set_bdaddr;
2425
2426 return 0;
2427}
2428EXPORT_SYMBOL_GPL(btintel_configure_setup);
2429
2430void btintel_bootup(struct hci_dev *hdev, const void *ptr, unsigned int len)
2431{
2432 const struct intel_bootup *evt = ptr;
2433
2434 if (len != sizeof(*evt))
2435 return;
2436
2437 if (btintel_test_and_clear_flag(hdev, INTEL_BOOTING))
2438 btintel_wake_up_flag(hdev, INTEL_BOOTING);
2439}
2440EXPORT_SYMBOL_GPL(btintel_bootup);
2441
2442void btintel_secure_send_result(struct hci_dev *hdev,
2443 const void *ptr, unsigned int len)
2444{
2445 const struct intel_secure_send_result *evt = ptr;
2446
2447 if (len != sizeof(*evt))
2448 return;
2449
2450 if (evt->result)
2451 btintel_set_flag(hdev, INTEL_FIRMWARE_FAILED);
2452
2453 if (btintel_test_and_clear_flag(hdev, INTEL_DOWNLOADING) &&
2454 btintel_test_flag(hdev, INTEL_FIRMWARE_LOADED))
2455 btintel_wake_up_flag(hdev, INTEL_DOWNLOADING);
2456}
2457EXPORT_SYMBOL_GPL(btintel_secure_send_result);
2458
2459MODULE_AUTHOR("Marcel Holtmann <marcel@holtmann.org>");
2460MODULE_DESCRIPTION("Bluetooth support for Intel devices ver " VERSION);
2461MODULE_VERSION(VERSION);
2462MODULE_LICENSE("GPL");
2463MODULE_FIRMWARE("intel/ibt-11-5.sfi");
2464MODULE_FIRMWARE("intel/ibt-11-5.ddc");
2465MODULE_FIRMWARE("intel/ibt-12-16.sfi");
2466MODULE_FIRMWARE("intel/ibt-12-16.ddc");
2467