1 // SPDX-License-Identifier: GPL-2.0-or-later
2 /*
3 *
4 * Bluetooth support for Intel devices
5 *
6 * Copyright (C) 2015 Intel Corporation
7 */
8
9 #include <linux/module.h>
10 #include <linux/firmware.h>
11 #include <linux/regmap.h>
12 #include <asm/unaligned.h>
13
14 #include <net/bluetooth/bluetooth.h>
15 #include <net/bluetooth/hci_core.h>
16
17 #include "btintel.h"
18
19 #define VERSION "0.1"
20
21 #define BDADDR_INTEL (&(bdaddr_t){{0x00, 0x8b, 0x9e, 0x19, 0x03, 0x00}})
22 #define RSA_HEADER_LEN 644
23 #define CSS_HEADER_OFFSET 8
24 #define ECDSA_OFFSET 644
25 #define ECDSA_HEADER_LEN 320
26
27 #define CMD_WRITE_BOOT_PARAMS 0xfc0e
28 struct cmd_write_boot_params {
29 u32 boot_addr;
30 u8 fw_build_num;
31 u8 fw_build_ww;
32 u8 fw_build_yy;
33 } __packed;
34
btintel_check_bdaddr(struct hci_dev * hdev)35 int btintel_check_bdaddr(struct hci_dev *hdev)
36 {
37 struct hci_rp_read_bd_addr *bda;
38 struct sk_buff *skb;
39
40 skb = __hci_cmd_sync(hdev, HCI_OP_READ_BD_ADDR, 0, NULL,
41 HCI_INIT_TIMEOUT);
42 if (IS_ERR(skb)) {
43 int err = PTR_ERR(skb);
44 bt_dev_err(hdev, "Reading Intel device address failed (%d)",
45 err);
46 return err;
47 }
48
49 if (skb->len != sizeof(*bda)) {
50 bt_dev_err(hdev, "Intel device address length mismatch");
51 kfree_skb(skb);
52 return -EIO;
53 }
54
55 bda = (struct hci_rp_read_bd_addr *)skb->data;
56
57 /* For some Intel based controllers, the default Bluetooth device
58 * address 00:03:19:9E:8B:00 can be found. These controllers are
59 * fully operational, but have the danger of duplicate addresses
60 * and that in turn can cause problems with Bluetooth operation.
61 */
62 if (!bacmp(&bda->bdaddr, BDADDR_INTEL)) {
63 bt_dev_err(hdev, "Found Intel default device address (%pMR)",
64 &bda->bdaddr);
65 set_bit(HCI_QUIRK_INVALID_BDADDR, &hdev->quirks);
66 }
67
68 kfree_skb(skb);
69
70 return 0;
71 }
72 EXPORT_SYMBOL_GPL(btintel_check_bdaddr);
73
btintel_enter_mfg(struct hci_dev * hdev)74 int btintel_enter_mfg(struct hci_dev *hdev)
75 {
76 static const u8 param[] = { 0x01, 0x00 };
77 struct sk_buff *skb;
78
79 skb = __hci_cmd_sync(hdev, 0xfc11, 2, param, HCI_CMD_TIMEOUT);
80 if (IS_ERR(skb)) {
81 bt_dev_err(hdev, "Entering manufacturer mode failed (%ld)",
82 PTR_ERR(skb));
83 return PTR_ERR(skb);
84 }
85 kfree_skb(skb);
86
87 return 0;
88 }
89 EXPORT_SYMBOL_GPL(btintel_enter_mfg);
90
btintel_exit_mfg(struct hci_dev * hdev,bool reset,bool patched)91 int btintel_exit_mfg(struct hci_dev *hdev, bool reset, bool patched)
92 {
93 u8 param[] = { 0x00, 0x00 };
94 struct sk_buff *skb;
95
96 /* The 2nd command parameter specifies the manufacturing exit method:
97 * 0x00: Just disable the manufacturing mode (0x00).
98 * 0x01: Disable manufacturing mode and reset with patches deactivated.
99 * 0x02: Disable manufacturing mode and reset with patches activated.
100 */
101 if (reset)
102 param[1] |= patched ? 0x02 : 0x01;
103
104 skb = __hci_cmd_sync(hdev, 0xfc11, 2, param, HCI_CMD_TIMEOUT);
105 if (IS_ERR(skb)) {
106 bt_dev_err(hdev, "Exiting manufacturer mode failed (%ld)",
107 PTR_ERR(skb));
108 return PTR_ERR(skb);
109 }
110 kfree_skb(skb);
111
112 return 0;
113 }
114 EXPORT_SYMBOL_GPL(btintel_exit_mfg);
115
btintel_set_bdaddr(struct hci_dev * hdev,const bdaddr_t * bdaddr)116 int btintel_set_bdaddr(struct hci_dev *hdev, const bdaddr_t *bdaddr)
117 {
118 struct sk_buff *skb;
119 int err;
120
121 skb = __hci_cmd_sync(hdev, 0xfc31, 6, bdaddr, HCI_INIT_TIMEOUT);
122 if (IS_ERR(skb)) {
123 err = PTR_ERR(skb);
124 bt_dev_err(hdev, "Changing Intel device address failed (%d)",
125 err);
126 return err;
127 }
128 kfree_skb(skb);
129
130 return 0;
131 }
132 EXPORT_SYMBOL_GPL(btintel_set_bdaddr);
133
btintel_set_event_mask(struct hci_dev * hdev,bool debug)134 static int btintel_set_event_mask(struct hci_dev *hdev, bool debug)
135 {
136 u8 mask[8] = { 0x87, 0x0c, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 };
137 struct sk_buff *skb;
138 int err;
139
140 if (debug)
141 mask[1] |= 0x62;
142
143 skb = __hci_cmd_sync(hdev, 0xfc52, 8, mask, HCI_INIT_TIMEOUT);
144 if (IS_ERR(skb)) {
145 err = PTR_ERR(skb);
146 bt_dev_err(hdev, "Setting Intel event mask failed (%d)", err);
147 return err;
148 }
149 kfree_skb(skb);
150
151 return 0;
152 }
153
btintel_set_diag(struct hci_dev * hdev,bool enable)154 int btintel_set_diag(struct hci_dev *hdev, bool enable)
155 {
156 struct sk_buff *skb;
157 u8 param[3];
158 int err;
159
160 if (enable) {
161 param[0] = 0x03;
162 param[1] = 0x03;
163 param[2] = 0x03;
164 } else {
165 param[0] = 0x00;
166 param[1] = 0x00;
167 param[2] = 0x00;
168 }
169
170 skb = __hci_cmd_sync(hdev, 0xfc43, 3, param, HCI_INIT_TIMEOUT);
171 if (IS_ERR(skb)) {
172 err = PTR_ERR(skb);
173 if (err == -ENODATA)
174 goto done;
175 bt_dev_err(hdev, "Changing Intel diagnostic mode failed (%d)",
176 err);
177 return err;
178 }
179 kfree_skb(skb);
180
181 done:
182 btintel_set_event_mask(hdev, enable);
183 return 0;
184 }
185 EXPORT_SYMBOL_GPL(btintel_set_diag);
186
btintel_set_diag_mfg(struct hci_dev * hdev,bool enable)187 static int btintel_set_diag_mfg(struct hci_dev *hdev, bool enable)
188 {
189 int err, ret;
190
191 err = btintel_enter_mfg(hdev);
192 if (err)
193 return err;
194
195 ret = btintel_set_diag(hdev, enable);
196
197 err = btintel_exit_mfg(hdev, false, false);
198 if (err)
199 return err;
200
201 return ret;
202 }
203
btintel_set_diag_combined(struct hci_dev * hdev,bool enable)204 static int btintel_set_diag_combined(struct hci_dev *hdev, bool enable)
205 {
206 int ret;
207
208 /* Legacy ROM device needs to be in the manufacturer mode to apply
209 * diagnostic setting
210 *
211 * This flag is set after reading the Intel version.
212 */
213 if (btintel_test_flag(hdev, INTEL_ROM_LEGACY))
214 ret = btintel_set_diag_mfg(hdev, enable);
215 else
216 ret = btintel_set_diag(hdev, enable);
217
218 return ret;
219 }
220
btintel_hw_error(struct hci_dev * hdev,u8 code)221 static void btintel_hw_error(struct hci_dev *hdev, u8 code)
222 {
223 struct sk_buff *skb;
224 u8 type = 0x00;
225
226 bt_dev_err(hdev, "Hardware error 0x%2.2x", code);
227
228 skb = __hci_cmd_sync(hdev, HCI_OP_RESET, 0, NULL, HCI_INIT_TIMEOUT);
229 if (IS_ERR(skb)) {
230 bt_dev_err(hdev, "Reset after hardware error failed (%ld)",
231 PTR_ERR(skb));
232 return;
233 }
234 kfree_skb(skb);
235
236 skb = __hci_cmd_sync(hdev, 0xfc22, 1, &type, HCI_INIT_TIMEOUT);
237 if (IS_ERR(skb)) {
238 bt_dev_err(hdev, "Retrieving Intel exception info failed (%ld)",
239 PTR_ERR(skb));
240 return;
241 }
242
243 if (skb->len != 13) {
244 bt_dev_err(hdev, "Exception info size mismatch");
245 kfree_skb(skb);
246 return;
247 }
248
249 bt_dev_err(hdev, "Exception info %s", (char *)(skb->data + 1));
250
251 kfree_skb(skb);
252 }
253
btintel_version_info(struct hci_dev * hdev,struct intel_version * ver)254 int btintel_version_info(struct hci_dev *hdev, struct intel_version *ver)
255 {
256 const char *variant;
257
258 /* The hardware platform number has a fixed value of 0x37 and
259 * for now only accept this single value.
260 */
261 if (ver->hw_platform != 0x37) {
262 bt_dev_err(hdev, "Unsupported Intel hardware platform (%u)",
263 ver->hw_platform);
264 return -EINVAL;
265 }
266
267 /* Check for supported iBT hardware variants of this firmware
268 * loading method.
269 *
270 * This check has been put in place to ensure correct forward
271 * compatibility options when newer hardware variants come along.
272 */
273 switch (ver->hw_variant) {
274 case 0x07: /* WP - Legacy ROM */
275 case 0x08: /* StP - Legacy ROM */
276 case 0x0b: /* SfP */
277 case 0x0c: /* WsP */
278 case 0x11: /* JfP */
279 case 0x12: /* ThP */
280 case 0x13: /* HrP */
281 case 0x14: /* CcP */
282 break;
283 default:
284 bt_dev_err(hdev, "Unsupported Intel hardware variant (%u)",
285 ver->hw_variant);
286 return -EINVAL;
287 }
288
289 switch (ver->fw_variant) {
290 case 0x01:
291 variant = "Legacy ROM 2.5";
292 break;
293 case 0x06:
294 variant = "Bootloader";
295 break;
296 case 0x22:
297 variant = "Legacy ROM 2.x";
298 break;
299 case 0x23:
300 variant = "Firmware";
301 break;
302 default:
303 bt_dev_err(hdev, "Unsupported firmware variant(%02x)", ver->fw_variant);
304 return -EINVAL;
305 }
306
307 bt_dev_info(hdev, "%s revision %u.%u build %u week %u %u",
308 variant, ver->fw_revision >> 4, ver->fw_revision & 0x0f,
309 ver->fw_build_num, ver->fw_build_ww,
310 2000 + ver->fw_build_yy);
311
312 return 0;
313 }
314 EXPORT_SYMBOL_GPL(btintel_version_info);
315
btintel_secure_send(struct hci_dev * hdev,u8 fragment_type,u32 plen,const void * param)316 static int btintel_secure_send(struct hci_dev *hdev, u8 fragment_type, u32 plen,
317 const void *param)
318 {
319 while (plen > 0) {
320 struct sk_buff *skb;
321 u8 cmd_param[253], fragment_len = (plen > 252) ? 252 : plen;
322
323 cmd_param[0] = fragment_type;
324 memcpy(cmd_param + 1, param, fragment_len);
325
326 skb = __hci_cmd_sync(hdev, 0xfc09, fragment_len + 1,
327 cmd_param, HCI_INIT_TIMEOUT);
328 if (IS_ERR(skb))
329 return PTR_ERR(skb);
330
331 kfree_skb(skb);
332
333 plen -= fragment_len;
334 param += fragment_len;
335 }
336
337 return 0;
338 }
339
btintel_load_ddc_config(struct hci_dev * hdev,const char * ddc_name)340 int btintel_load_ddc_config(struct hci_dev *hdev, const char *ddc_name)
341 {
342 const struct firmware *fw;
343 struct sk_buff *skb;
344 const u8 *fw_ptr;
345 int err;
346
347 err = request_firmware_direct(&fw, ddc_name, &hdev->dev);
348 if (err < 0) {
349 bt_dev_err(hdev, "Failed to load Intel DDC file %s (%d)",
350 ddc_name, err);
351 return err;
352 }
353
354 bt_dev_info(hdev, "Found Intel DDC parameters: %s", ddc_name);
355
356 fw_ptr = fw->data;
357
358 /* DDC file contains one or more DDC structure which has
359 * Length (1 byte), DDC ID (2 bytes), and DDC value (Length - 2).
360 */
361 while (fw->size > fw_ptr - fw->data) {
362 u8 cmd_plen = fw_ptr[0] + sizeof(u8);
363
364 skb = __hci_cmd_sync(hdev, 0xfc8b, cmd_plen, fw_ptr,
365 HCI_INIT_TIMEOUT);
366 if (IS_ERR(skb)) {
367 bt_dev_err(hdev, "Failed to send Intel_Write_DDC (%ld)",
368 PTR_ERR(skb));
369 release_firmware(fw);
370 return PTR_ERR(skb);
371 }
372
373 fw_ptr += cmd_plen;
374 kfree_skb(skb);
375 }
376
377 release_firmware(fw);
378
379 bt_dev_info(hdev, "Applying Intel DDC parameters completed");
380
381 return 0;
382 }
383 EXPORT_SYMBOL_GPL(btintel_load_ddc_config);
384
btintel_set_event_mask_mfg(struct hci_dev * hdev,bool debug)385 int btintel_set_event_mask_mfg(struct hci_dev *hdev, bool debug)
386 {
387 int err, ret;
388
389 err = btintel_enter_mfg(hdev);
390 if (err)
391 return err;
392
393 ret = btintel_set_event_mask(hdev, debug);
394
395 err = btintel_exit_mfg(hdev, false, false);
396 if (err)
397 return err;
398
399 return ret;
400 }
401 EXPORT_SYMBOL_GPL(btintel_set_event_mask_mfg);
402
btintel_read_version(struct hci_dev * hdev,struct intel_version * ver)403 int btintel_read_version(struct hci_dev *hdev, struct intel_version *ver)
404 {
405 struct sk_buff *skb;
406
407 skb = __hci_cmd_sync(hdev, 0xfc05, 0, NULL, HCI_CMD_TIMEOUT);
408 if (IS_ERR(skb)) {
409 bt_dev_err(hdev, "Reading Intel version information failed (%ld)",
410 PTR_ERR(skb));
411 return PTR_ERR(skb);
412 }
413
414 if (skb->len != sizeof(*ver)) {
415 bt_dev_err(hdev, "Intel version event size mismatch");
416 kfree_skb(skb);
417 return -EILSEQ;
418 }
419
420 memcpy(ver, skb->data, sizeof(*ver));
421
422 kfree_skb(skb);
423
424 return 0;
425 }
426 EXPORT_SYMBOL_GPL(btintel_read_version);
427
btintel_version_info_tlv(struct hci_dev * hdev,struct intel_version_tlv * version)428 static int btintel_version_info_tlv(struct hci_dev *hdev,
429 struct intel_version_tlv *version)
430 {
431 const char *variant;
432
433 /* The hardware platform number has a fixed value of 0x37 and
434 * for now only accept this single value.
435 */
436 if (INTEL_HW_PLATFORM(version->cnvi_bt) != 0x37) {
437 bt_dev_err(hdev, "Unsupported Intel hardware platform (0x%2x)",
438 INTEL_HW_PLATFORM(version->cnvi_bt));
439 return -EINVAL;
440 }
441
442 /* Check for supported iBT hardware variants of this firmware
443 * loading method.
444 *
445 * This check has been put in place to ensure correct forward
446 * compatibility options when newer hardware variants come along.
447 */
448 switch (INTEL_HW_VARIANT(version->cnvi_bt)) {
449 case 0x17: /* TyP */
450 case 0x18: /* Slr */
451 case 0x19: /* Slr-F */
452 break;
453 default:
454 bt_dev_err(hdev, "Unsupported Intel hardware variant (0x%x)",
455 INTEL_HW_VARIANT(version->cnvi_bt));
456 return -EINVAL;
457 }
458
459 switch (version->img_type) {
460 case 0x01:
461 variant = "Bootloader";
462 /* It is required that every single firmware fragment is acknowledged
463 * with a command complete event. If the boot parameters indicate
464 * that this bootloader does not send them, then abort the setup.
465 */
466 if (version->limited_cce != 0x00) {
467 bt_dev_err(hdev, "Unsupported Intel firmware loading method (0x%x)",
468 version->limited_cce);
469 return -EINVAL;
470 }
471
472 /* Secure boot engine type should be either 1 (ECDSA) or 0 (RSA) */
473 if (version->sbe_type > 0x01) {
474 bt_dev_err(hdev, "Unsupported Intel secure boot engine type (0x%x)",
475 version->sbe_type);
476 return -EINVAL;
477 }
478
479 bt_dev_info(hdev, "Device revision is %u", version->dev_rev_id);
480 bt_dev_info(hdev, "Secure boot is %s",
481 version->secure_boot ? "enabled" : "disabled");
482 bt_dev_info(hdev, "OTP lock is %s",
483 version->otp_lock ? "enabled" : "disabled");
484 bt_dev_info(hdev, "API lock is %s",
485 version->api_lock ? "enabled" : "disabled");
486 bt_dev_info(hdev, "Debug lock is %s",
487 version->debug_lock ? "enabled" : "disabled");
488 bt_dev_info(hdev, "Minimum firmware build %u week %u %u",
489 version->min_fw_build_nn, version->min_fw_build_cw,
490 2000 + version->min_fw_build_yy);
491 break;
492 case 0x03:
493 variant = "Firmware";
494 break;
495 default:
496 bt_dev_err(hdev, "Unsupported image type(%02x)", version->img_type);
497 return -EINVAL;
498 }
499
500 bt_dev_info(hdev, "%s timestamp %u.%u buildtype %u build %u", variant,
501 2000 + (version->timestamp >> 8), version->timestamp & 0xff,
502 version->build_type, version->build_num);
503
504 return 0;
505 }
506
btintel_parse_version_tlv(struct hci_dev * hdev,struct intel_version_tlv * version,struct sk_buff * skb)507 static int btintel_parse_version_tlv(struct hci_dev *hdev,
508 struct intel_version_tlv *version,
509 struct sk_buff *skb)
510 {
511 /* Consume Command Complete Status field */
512 skb_pull(skb, 1);
513
514 /* Event parameters contatin multiple TLVs. Read each of them
515 * and only keep the required data. Also, it use existing legacy
516 * version field like hw_platform, hw_variant, and fw_variant
517 * to keep the existing setup flow
518 */
519 while (skb->len) {
520 struct intel_tlv *tlv;
521
522 /* Make sure skb has a minimum length of the header */
523 if (skb->len < sizeof(*tlv))
524 return -EINVAL;
525
526 tlv = (struct intel_tlv *)skb->data;
527
528 /* Make sure skb has a enough data */
529 if (skb->len < tlv->len + sizeof(*tlv))
530 return -EINVAL;
531
532 switch (tlv->type) {
533 case INTEL_TLV_CNVI_TOP:
534 version->cnvi_top = get_unaligned_le32(tlv->val);
535 break;
536 case INTEL_TLV_CNVR_TOP:
537 version->cnvr_top = get_unaligned_le32(tlv->val);
538 break;
539 case INTEL_TLV_CNVI_BT:
540 version->cnvi_bt = get_unaligned_le32(tlv->val);
541 break;
542 case INTEL_TLV_CNVR_BT:
543 version->cnvr_bt = get_unaligned_le32(tlv->val);
544 break;
545 case INTEL_TLV_DEV_REV_ID:
546 version->dev_rev_id = get_unaligned_le16(tlv->val);
547 break;
548 case INTEL_TLV_IMAGE_TYPE:
549 version->img_type = tlv->val[0];
550 break;
551 case INTEL_TLV_TIME_STAMP:
552 /* If image type is Operational firmware (0x03), then
553 * running FW Calendar Week and Year information can
554 * be extracted from Timestamp information
555 */
556 version->min_fw_build_cw = tlv->val[0];
557 version->min_fw_build_yy = tlv->val[1];
558 version->timestamp = get_unaligned_le16(tlv->val);
559 break;
560 case INTEL_TLV_BUILD_TYPE:
561 version->build_type = tlv->val[0];
562 break;
563 case INTEL_TLV_BUILD_NUM:
564 /* If image type is Operational firmware (0x03), then
565 * running FW build number can be extracted from the
566 * Build information
567 */
568 version->min_fw_build_nn = tlv->val[0];
569 version->build_num = get_unaligned_le32(tlv->val);
570 break;
571 case INTEL_TLV_SECURE_BOOT:
572 version->secure_boot = tlv->val[0];
573 break;
574 case INTEL_TLV_OTP_LOCK:
575 version->otp_lock = tlv->val[0];
576 break;
577 case INTEL_TLV_API_LOCK:
578 version->api_lock = tlv->val[0];
579 break;
580 case INTEL_TLV_DEBUG_LOCK:
581 version->debug_lock = tlv->val[0];
582 break;
583 case INTEL_TLV_MIN_FW:
584 version->min_fw_build_nn = tlv->val[0];
585 version->min_fw_build_cw = tlv->val[1];
586 version->min_fw_build_yy = tlv->val[2];
587 break;
588 case INTEL_TLV_LIMITED_CCE:
589 version->limited_cce = tlv->val[0];
590 break;
591 case INTEL_TLV_SBE_TYPE:
592 version->sbe_type = tlv->val[0];
593 break;
594 case INTEL_TLV_OTP_BDADDR:
595 memcpy(&version->otp_bd_addr, tlv->val,
596 sizeof(bdaddr_t));
597 break;
598 default:
599 /* Ignore rest of information */
600 break;
601 }
602 /* consume the current tlv and move to next*/
603 skb_pull(skb, tlv->len + sizeof(*tlv));
604 }
605
606 return 0;
607 }
608
btintel_read_version_tlv(struct hci_dev * hdev,struct intel_version_tlv * version)609 static int btintel_read_version_tlv(struct hci_dev *hdev,
610 struct intel_version_tlv *version)
611 {
612 struct sk_buff *skb;
613 const u8 param[1] = { 0xFF };
614
615 if (!version)
616 return -EINVAL;
617
618 skb = __hci_cmd_sync(hdev, 0xfc05, 1, param, HCI_CMD_TIMEOUT);
619 if (IS_ERR(skb)) {
620 bt_dev_err(hdev, "Reading Intel version information failed (%ld)",
621 PTR_ERR(skb));
622 return PTR_ERR(skb);
623 }
624
625 if (skb->data[0]) {
626 bt_dev_err(hdev, "Intel Read Version command failed (%02x)",
627 skb->data[0]);
628 kfree_skb(skb);
629 return -EIO;
630 }
631
632 btintel_parse_version_tlv(hdev, version, skb);
633
634 kfree_skb(skb);
635 return 0;
636 }
637
638 /* ------- REGMAP IBT SUPPORT ------- */
639
640 #define IBT_REG_MODE_8BIT 0x00
641 #define IBT_REG_MODE_16BIT 0x01
642 #define IBT_REG_MODE_32BIT 0x02
643
644 struct regmap_ibt_context {
645 struct hci_dev *hdev;
646 __u16 op_write;
647 __u16 op_read;
648 };
649
650 struct ibt_cp_reg_access {
651 __le32 addr;
652 __u8 mode;
653 __u8 len;
654 __u8 data[];
655 } __packed;
656
657 struct ibt_rp_reg_access {
658 __u8 status;
659 __le32 addr;
660 __u8 data[];
661 } __packed;
662
regmap_ibt_read(void * context,const void * addr,size_t reg_size,void * val,size_t val_size)663 static int regmap_ibt_read(void *context, const void *addr, size_t reg_size,
664 void *val, size_t val_size)
665 {
666 struct regmap_ibt_context *ctx = context;
667 struct ibt_cp_reg_access cp;
668 struct ibt_rp_reg_access *rp;
669 struct sk_buff *skb;
670 int err = 0;
671
672 if (reg_size != sizeof(__le32))
673 return -EINVAL;
674
675 switch (val_size) {
676 case 1:
677 cp.mode = IBT_REG_MODE_8BIT;
678 break;
679 case 2:
680 cp.mode = IBT_REG_MODE_16BIT;
681 break;
682 case 4:
683 cp.mode = IBT_REG_MODE_32BIT;
684 break;
685 default:
686 return -EINVAL;
687 }
688
689 /* regmap provides a little-endian formatted addr */
690 cp.addr = *(__le32 *)addr;
691 cp.len = val_size;
692
693 bt_dev_dbg(ctx->hdev, "Register (0x%x) read", le32_to_cpu(cp.addr));
694
695 skb = hci_cmd_sync(ctx->hdev, ctx->op_read, sizeof(cp), &cp,
696 HCI_CMD_TIMEOUT);
697 if (IS_ERR(skb)) {
698 err = PTR_ERR(skb);
699 bt_dev_err(ctx->hdev, "regmap: Register (0x%x) read error (%d)",
700 le32_to_cpu(cp.addr), err);
701 return err;
702 }
703
704 if (skb->len != sizeof(*rp) + val_size) {
705 bt_dev_err(ctx->hdev, "regmap: Register (0x%x) read error, bad len",
706 le32_to_cpu(cp.addr));
707 err = -EINVAL;
708 goto done;
709 }
710
711 rp = (struct ibt_rp_reg_access *)skb->data;
712
713 if (rp->addr != cp.addr) {
714 bt_dev_err(ctx->hdev, "regmap: Register (0x%x) read error, bad addr",
715 le32_to_cpu(rp->addr));
716 err = -EINVAL;
717 goto done;
718 }
719
720 memcpy(val, rp->data, val_size);
721
722 done:
723 kfree_skb(skb);
724 return err;
725 }
726
regmap_ibt_gather_write(void * context,const void * addr,size_t reg_size,const void * val,size_t val_size)727 static int regmap_ibt_gather_write(void *context,
728 const void *addr, size_t reg_size,
729 const void *val, size_t val_size)
730 {
731 struct regmap_ibt_context *ctx = context;
732 struct ibt_cp_reg_access *cp;
733 struct sk_buff *skb;
734 int plen = sizeof(*cp) + val_size;
735 u8 mode;
736 int err = 0;
737
738 if (reg_size != sizeof(__le32))
739 return -EINVAL;
740
741 switch (val_size) {
742 case 1:
743 mode = IBT_REG_MODE_8BIT;
744 break;
745 case 2:
746 mode = IBT_REG_MODE_16BIT;
747 break;
748 case 4:
749 mode = IBT_REG_MODE_32BIT;
750 break;
751 default:
752 return -EINVAL;
753 }
754
755 cp = kmalloc(plen, GFP_KERNEL);
756 if (!cp)
757 return -ENOMEM;
758
759 /* regmap provides a little-endian formatted addr/value */
760 cp->addr = *(__le32 *)addr;
761 cp->mode = mode;
762 cp->len = val_size;
763 memcpy(&cp->data, val, val_size);
764
765 bt_dev_dbg(ctx->hdev, "Register (0x%x) write", le32_to_cpu(cp->addr));
766
767 skb = hci_cmd_sync(ctx->hdev, ctx->op_write, plen, cp, HCI_CMD_TIMEOUT);
768 if (IS_ERR(skb)) {
769 err = PTR_ERR(skb);
770 bt_dev_err(ctx->hdev, "regmap: Register (0x%x) write error (%d)",
771 le32_to_cpu(cp->addr), err);
772 goto done;
773 }
774 kfree_skb(skb);
775
776 done:
777 kfree(cp);
778 return err;
779 }
780
regmap_ibt_write(void * context,const void * data,size_t count)781 static int regmap_ibt_write(void *context, const void *data, size_t count)
782 {
783 /* data contains register+value, since we only support 32bit addr,
784 * minimum data size is 4 bytes.
785 */
786 if (WARN_ONCE(count < 4, "Invalid register access"))
787 return -EINVAL;
788
789 return regmap_ibt_gather_write(context, data, 4, data + 4, count - 4);
790 }
791
regmap_ibt_free_context(void * context)792 static void regmap_ibt_free_context(void *context)
793 {
794 kfree(context);
795 }
796
797 static struct regmap_bus regmap_ibt = {
798 .read = regmap_ibt_read,
799 .write = regmap_ibt_write,
800 .gather_write = regmap_ibt_gather_write,
801 .free_context = regmap_ibt_free_context,
802 .reg_format_endian_default = REGMAP_ENDIAN_LITTLE,
803 .val_format_endian_default = REGMAP_ENDIAN_LITTLE,
804 };
805
806 /* Config is the same for all register regions */
807 static const struct regmap_config regmap_ibt_cfg = {
808 .name = "btintel_regmap",
809 .reg_bits = 32,
810 .val_bits = 32,
811 };
812
btintel_regmap_init(struct hci_dev * hdev,u16 opcode_read,u16 opcode_write)813 struct regmap *btintel_regmap_init(struct hci_dev *hdev, u16 opcode_read,
814 u16 opcode_write)
815 {
816 struct regmap_ibt_context *ctx;
817
818 bt_dev_info(hdev, "regmap: Init R%x-W%x region", opcode_read,
819 opcode_write);
820
821 ctx = kzalloc(sizeof(*ctx), GFP_KERNEL);
822 if (!ctx)
823 return ERR_PTR(-ENOMEM);
824
825 ctx->op_read = opcode_read;
826 ctx->op_write = opcode_write;
827 ctx->hdev = hdev;
828
829 return regmap_init(&hdev->dev, ®map_ibt, ctx, ®map_ibt_cfg);
830 }
831 EXPORT_SYMBOL_GPL(btintel_regmap_init);
832
btintel_send_intel_reset(struct hci_dev * hdev,u32 boot_param)833 int btintel_send_intel_reset(struct hci_dev *hdev, u32 boot_param)
834 {
835 struct intel_reset params = { 0x00, 0x01, 0x00, 0x01, 0x00000000 };
836 struct sk_buff *skb;
837
838 params.boot_param = cpu_to_le32(boot_param);
839
840 skb = __hci_cmd_sync(hdev, 0xfc01, sizeof(params), ¶ms,
841 HCI_INIT_TIMEOUT);
842 if (IS_ERR(skb)) {
843 bt_dev_err(hdev, "Failed to send Intel Reset command");
844 return PTR_ERR(skb);
845 }
846
847 kfree_skb(skb);
848
849 return 0;
850 }
851 EXPORT_SYMBOL_GPL(btintel_send_intel_reset);
852
btintel_read_boot_params(struct hci_dev * hdev,struct intel_boot_params * params)853 int btintel_read_boot_params(struct hci_dev *hdev,
854 struct intel_boot_params *params)
855 {
856 struct sk_buff *skb;
857
858 skb = __hci_cmd_sync(hdev, 0xfc0d, 0, NULL, HCI_INIT_TIMEOUT);
859 if (IS_ERR(skb)) {
860 bt_dev_err(hdev, "Reading Intel boot parameters failed (%ld)",
861 PTR_ERR(skb));
862 return PTR_ERR(skb);
863 }
864
865 if (skb->len != sizeof(*params)) {
866 bt_dev_err(hdev, "Intel boot parameters size mismatch");
867 kfree_skb(skb);
868 return -EILSEQ;
869 }
870
871 memcpy(params, skb->data, sizeof(*params));
872
873 kfree_skb(skb);
874
875 if (params->status) {
876 bt_dev_err(hdev, "Intel boot parameters command failed (%02x)",
877 params->status);
878 return -bt_to_errno(params->status);
879 }
880
881 bt_dev_info(hdev, "Device revision is %u",
882 le16_to_cpu(params->dev_revid));
883
884 bt_dev_info(hdev, "Secure boot is %s",
885 params->secure_boot ? "enabled" : "disabled");
886
887 bt_dev_info(hdev, "OTP lock is %s",
888 params->otp_lock ? "enabled" : "disabled");
889
890 bt_dev_info(hdev, "API lock is %s",
891 params->api_lock ? "enabled" : "disabled");
892
893 bt_dev_info(hdev, "Debug lock is %s",
894 params->debug_lock ? "enabled" : "disabled");
895
896 bt_dev_info(hdev, "Minimum firmware build %u week %u %u",
897 params->min_fw_build_nn, params->min_fw_build_cw,
898 2000 + params->min_fw_build_yy);
899
900 return 0;
901 }
902 EXPORT_SYMBOL_GPL(btintel_read_boot_params);
903
btintel_sfi_rsa_header_secure_send(struct hci_dev * hdev,const struct firmware * fw)904 static int btintel_sfi_rsa_header_secure_send(struct hci_dev *hdev,
905 const struct firmware *fw)
906 {
907 int err;
908
909 /* Start the firmware download transaction with the Init fragment
910 * represented by the 128 bytes of CSS header.
911 */
912 err = btintel_secure_send(hdev, 0x00, 128, fw->data);
913 if (err < 0) {
914 bt_dev_err(hdev, "Failed to send firmware header (%d)", err);
915 goto done;
916 }
917
918 /* Send the 256 bytes of public key information from the firmware
919 * as the PKey fragment.
920 */
921 err = btintel_secure_send(hdev, 0x03, 256, fw->data + 128);
922 if (err < 0) {
923 bt_dev_err(hdev, "Failed to send firmware pkey (%d)", err);
924 goto done;
925 }
926
927 /* Send the 256 bytes of signature information from the firmware
928 * as the Sign fragment.
929 */
930 err = btintel_secure_send(hdev, 0x02, 256, fw->data + 388);
931 if (err < 0) {
932 bt_dev_err(hdev, "Failed to send firmware signature (%d)", err);
933 goto done;
934 }
935
936 done:
937 return err;
938 }
939
btintel_sfi_ecdsa_header_secure_send(struct hci_dev * hdev,const struct firmware * fw)940 static int btintel_sfi_ecdsa_header_secure_send(struct hci_dev *hdev,
941 const struct firmware *fw)
942 {
943 int err;
944
945 /* Start the firmware download transaction with the Init fragment
946 * represented by the 128 bytes of CSS header.
947 */
948 err = btintel_secure_send(hdev, 0x00, 128, fw->data + 644);
949 if (err < 0) {
950 bt_dev_err(hdev, "Failed to send firmware header (%d)", err);
951 return err;
952 }
953
954 /* Send the 96 bytes of public key information from the firmware
955 * as the PKey fragment.
956 */
957 err = btintel_secure_send(hdev, 0x03, 96, fw->data + 644 + 128);
958 if (err < 0) {
959 bt_dev_err(hdev, "Failed to send firmware pkey (%d)", err);
960 return err;
961 }
962
963 /* Send the 96 bytes of signature information from the firmware
964 * as the Sign fragment
965 */
966 err = btintel_secure_send(hdev, 0x02, 96, fw->data + 644 + 224);
967 if (err < 0) {
968 bt_dev_err(hdev, "Failed to send firmware signature (%d)",
969 err);
970 return err;
971 }
972 return 0;
973 }
974
btintel_download_firmware_payload(struct hci_dev * hdev,const struct firmware * fw,size_t offset)975 static int btintel_download_firmware_payload(struct hci_dev *hdev,
976 const struct firmware *fw,
977 size_t offset)
978 {
979 int err;
980 const u8 *fw_ptr;
981 u32 frag_len;
982
983 fw_ptr = fw->data + offset;
984 frag_len = 0;
985 err = -EINVAL;
986
987 while (fw_ptr - fw->data < fw->size) {
988 struct hci_command_hdr *cmd = (void *)(fw_ptr + frag_len);
989
990 frag_len += sizeof(*cmd) + cmd->plen;
991
992 /* The parameter length of the secure send command requires
993 * a 4 byte alignment. It happens so that the firmware file
994 * contains proper Intel_NOP commands to align the fragments
995 * as needed.
996 *
997 * Send set of commands with 4 byte alignment from the
998 * firmware data buffer as a single Data fragement.
999 */
1000 if (!(frag_len % 4)) {
1001 err = btintel_secure_send(hdev, 0x01, frag_len, fw_ptr);
1002 if (err < 0) {
1003 bt_dev_err(hdev,
1004 "Failed to send firmware data (%d)",
1005 err);
1006 goto done;
1007 }
1008
1009 fw_ptr += frag_len;
1010 frag_len = 0;
1011 }
1012 }
1013
1014 done:
1015 return err;
1016 }
1017
btintel_firmware_version(struct hci_dev * hdev,u8 num,u8 ww,u8 yy,const struct firmware * fw,u32 * boot_addr)1018 static bool btintel_firmware_version(struct hci_dev *hdev,
1019 u8 num, u8 ww, u8 yy,
1020 const struct firmware *fw,
1021 u32 *boot_addr)
1022 {
1023 const u8 *fw_ptr;
1024
1025 fw_ptr = fw->data;
1026
1027 while (fw_ptr - fw->data < fw->size) {
1028 struct hci_command_hdr *cmd = (void *)(fw_ptr);
1029
1030 /* Each SKU has a different reset parameter to use in the
1031 * HCI_Intel_Reset command and it is embedded in the firmware
1032 * data. So, instead of using static value per SKU, check
1033 * the firmware data and save it for later use.
1034 */
1035 if (le16_to_cpu(cmd->opcode) == CMD_WRITE_BOOT_PARAMS) {
1036 struct cmd_write_boot_params *params;
1037
1038 params = (void *)(fw_ptr + sizeof(*cmd));
1039
1040 bt_dev_info(hdev, "Boot Address: 0x%x",
1041 le32_to_cpu(params->boot_addr));
1042
1043 bt_dev_info(hdev, "Firmware Version: %u-%u.%u",
1044 params->fw_build_num, params->fw_build_ww,
1045 params->fw_build_yy);
1046
1047 return (num == params->fw_build_num &&
1048 ww == params->fw_build_ww &&
1049 yy == params->fw_build_yy);
1050 }
1051
1052 fw_ptr += sizeof(*cmd) + cmd->plen;
1053 }
1054
1055 return false;
1056 }
1057
btintel_download_firmware(struct hci_dev * hdev,struct intel_version * ver,const struct firmware * fw,u32 * boot_param)1058 int btintel_download_firmware(struct hci_dev *hdev,
1059 struct intel_version *ver,
1060 const struct firmware *fw,
1061 u32 *boot_param)
1062 {
1063 int err;
1064
1065 /* SfP and WsP don't seem to update the firmware version on file
1066 * so version checking is currently not possible.
1067 */
1068 switch (ver->hw_variant) {
1069 case 0x0b: /* SfP */
1070 case 0x0c: /* WsP */
1071 /* Skip version checking */
1072 break;
1073 default:
1074 /* Skip reading firmware file version in bootloader mode */
1075 if (ver->fw_variant == 0x06)
1076 break;
1077
1078 /* Skip download if firmware has the same version */
1079 if (btintel_firmware_version(hdev, ver->fw_build_num,
1080 ver->fw_build_ww, ver->fw_build_yy,
1081 fw, boot_param)) {
1082 bt_dev_info(hdev, "Firmware already loaded");
1083 /* Return -EALREADY to indicate that the firmware has
1084 * already been loaded.
1085 */
1086 return -EALREADY;
1087 }
1088 }
1089
1090 /* The firmware variant determines if the device is in bootloader
1091 * mode or is running operational firmware. The value 0x06 identifies
1092 * the bootloader and the value 0x23 identifies the operational
1093 * firmware.
1094 *
1095 * If the firmware version has changed that means it needs to be reset
1096 * to bootloader when operational so the new firmware can be loaded.
1097 */
1098 if (ver->fw_variant == 0x23)
1099 return -EINVAL;
1100
1101 err = btintel_sfi_rsa_header_secure_send(hdev, fw);
1102 if (err)
1103 return err;
1104
1105 return btintel_download_firmware_payload(hdev, fw, RSA_HEADER_LEN);
1106 }
1107 EXPORT_SYMBOL_GPL(btintel_download_firmware);
1108
btintel_download_fw_tlv(struct hci_dev * hdev,struct intel_version_tlv * ver,const struct firmware * fw,u32 * boot_param,u8 hw_variant,u8 sbe_type)1109 static int btintel_download_fw_tlv(struct hci_dev *hdev,
1110 struct intel_version_tlv *ver,
1111 const struct firmware *fw, u32 *boot_param,
1112 u8 hw_variant, u8 sbe_type)
1113 {
1114 int err;
1115 u32 css_header_ver;
1116
1117 /* Skip reading firmware file version in bootloader mode */
1118 if (ver->img_type != 0x01) {
1119 /* Skip download if firmware has the same version */
1120 if (btintel_firmware_version(hdev, ver->min_fw_build_nn,
1121 ver->min_fw_build_cw,
1122 ver->min_fw_build_yy,
1123 fw, boot_param)) {
1124 bt_dev_info(hdev, "Firmware already loaded");
1125 /* Return -EALREADY to indicate that firmware has
1126 * already been loaded.
1127 */
1128 return -EALREADY;
1129 }
1130 }
1131
1132 /* The firmware variant determines if the device is in bootloader
1133 * mode or is running operational firmware. The value 0x01 identifies
1134 * the bootloader and the value 0x03 identifies the operational
1135 * firmware.
1136 *
1137 * If the firmware version has changed that means it needs to be reset
1138 * to bootloader when operational so the new firmware can be loaded.
1139 */
1140 if (ver->img_type == 0x03)
1141 return -EINVAL;
1142
1143 /* iBT hardware variants 0x0b, 0x0c, 0x11, 0x12, 0x13, 0x14 support
1144 * only RSA secure boot engine. Hence, the corresponding sfi file will
1145 * have RSA header of 644 bytes followed by Command Buffer.
1146 *
1147 * iBT hardware variants 0x17, 0x18 onwards support both RSA and ECDSA
1148 * secure boot engine. As a result, the corresponding sfi file will
1149 * have RSA header of 644, ECDSA header of 320 bytes followed by
1150 * Command Buffer.
1151 *
1152 * CSS Header byte positions 0x08 to 0x0B represent the CSS Header
1153 * version: RSA(0x00010000) , ECDSA (0x00020000)
1154 */
1155 css_header_ver = get_unaligned_le32(fw->data + CSS_HEADER_OFFSET);
1156 if (css_header_ver != 0x00010000) {
1157 bt_dev_err(hdev, "Invalid CSS Header version");
1158 return -EINVAL;
1159 }
1160
1161 if (hw_variant <= 0x14) {
1162 if (sbe_type != 0x00) {
1163 bt_dev_err(hdev, "Invalid SBE type for hardware variant (%d)",
1164 hw_variant);
1165 return -EINVAL;
1166 }
1167
1168 err = btintel_sfi_rsa_header_secure_send(hdev, fw);
1169 if (err)
1170 return err;
1171
1172 err = btintel_download_firmware_payload(hdev, fw, RSA_HEADER_LEN);
1173 if (err)
1174 return err;
1175 } else if (hw_variant >= 0x17) {
1176 /* Check if CSS header for ECDSA follows the RSA header */
1177 if (fw->data[ECDSA_OFFSET] != 0x06)
1178 return -EINVAL;
1179
1180 /* Check if the CSS Header version is ECDSA(0x00020000) */
1181 css_header_ver = get_unaligned_le32(fw->data + ECDSA_OFFSET + CSS_HEADER_OFFSET);
1182 if (css_header_ver != 0x00020000) {
1183 bt_dev_err(hdev, "Invalid CSS Header version");
1184 return -EINVAL;
1185 }
1186
1187 if (sbe_type == 0x00) {
1188 err = btintel_sfi_rsa_header_secure_send(hdev, fw);
1189 if (err)
1190 return err;
1191
1192 err = btintel_download_firmware_payload(hdev, fw,
1193 RSA_HEADER_LEN + ECDSA_HEADER_LEN);
1194 if (err)
1195 return err;
1196 } else if (sbe_type == 0x01) {
1197 err = btintel_sfi_ecdsa_header_secure_send(hdev, fw);
1198 if (err)
1199 return err;
1200
1201 err = btintel_download_firmware_payload(hdev, fw,
1202 RSA_HEADER_LEN + ECDSA_HEADER_LEN);
1203 if (err)
1204 return err;
1205 }
1206 }
1207 return 0;
1208 }
1209
btintel_reset_to_bootloader(struct hci_dev * hdev)1210 static void btintel_reset_to_bootloader(struct hci_dev *hdev)
1211 {
1212 struct intel_reset params;
1213 struct sk_buff *skb;
1214
1215 /* Send Intel Reset command. This will result in
1216 * re-enumeration of BT controller.
1217 *
1218 * Intel Reset parameter description:
1219 * reset_type : 0x00 (Soft reset),
1220 * 0x01 (Hard reset)
1221 * patch_enable : 0x00 (Do not enable),
1222 * 0x01 (Enable)
1223 * ddc_reload : 0x00 (Do not reload),
1224 * 0x01 (Reload)
1225 * boot_option: 0x00 (Current image),
1226 * 0x01 (Specified boot address)
1227 * boot_param: Boot address
1228 *
1229 */
1230 params.reset_type = 0x01;
1231 params.patch_enable = 0x01;
1232 params.ddc_reload = 0x01;
1233 params.boot_option = 0x00;
1234 params.boot_param = cpu_to_le32(0x00000000);
1235
1236 skb = __hci_cmd_sync(hdev, 0xfc01, sizeof(params),
1237 ¶ms, HCI_INIT_TIMEOUT);
1238 if (IS_ERR(skb)) {
1239 bt_dev_err(hdev, "FW download error recovery failed (%ld)",
1240 PTR_ERR(skb));
1241 return;
1242 }
1243 bt_dev_info(hdev, "Intel reset sent to retry FW download");
1244 kfree_skb(skb);
1245
1246 /* Current Intel BT controllers(ThP/JfP) hold the USB reset
1247 * lines for 2ms when it receives Intel Reset in bootloader mode.
1248 * Whereas, the upcoming Intel BT controllers will hold USB reset
1249 * for 150ms. To keep the delay generic, 150ms is chosen here.
1250 */
1251 msleep(150);
1252 }
1253
btintel_read_debug_features(struct hci_dev * hdev,struct intel_debug_features * features)1254 static int btintel_read_debug_features(struct hci_dev *hdev,
1255 struct intel_debug_features *features)
1256 {
1257 struct sk_buff *skb;
1258 u8 page_no = 1;
1259
1260 /* Intel controller supports two pages, each page is of 128-bit
1261 * feature bit mask. And each bit defines specific feature support
1262 */
1263 skb = __hci_cmd_sync(hdev, 0xfca6, sizeof(page_no), &page_no,
1264 HCI_INIT_TIMEOUT);
1265 if (IS_ERR(skb)) {
1266 bt_dev_err(hdev, "Reading supported features failed (%ld)",
1267 PTR_ERR(skb));
1268 return PTR_ERR(skb);
1269 }
1270
1271 if (skb->len != (sizeof(features->page1) + 3)) {
1272 bt_dev_err(hdev, "Supported features event size mismatch");
1273 kfree_skb(skb);
1274 return -EILSEQ;
1275 }
1276
1277 memcpy(features->page1, skb->data + 3, sizeof(features->page1));
1278
1279 /* Read the supported features page2 if required in future.
1280 */
1281 kfree_skb(skb);
1282 return 0;
1283 }
1284
btintel_set_debug_features(struct hci_dev * hdev,const struct intel_debug_features * features)1285 static int btintel_set_debug_features(struct hci_dev *hdev,
1286 const struct intel_debug_features *features)
1287 {
1288 u8 mask[11] = { 0x0a, 0x92, 0x02, 0x07, 0x00, 0x00, 0x00, 0x00,
1289 0x00, 0x00, 0x00 };
1290 struct sk_buff *skb;
1291
1292 if (!features)
1293 return -EINVAL;
1294
1295 if (!(features->page1[0] & 0x3f)) {
1296 bt_dev_info(hdev, "Telemetry exception format not supported");
1297 return 0;
1298 }
1299
1300 skb = __hci_cmd_sync(hdev, 0xfc8b, 11, mask, HCI_INIT_TIMEOUT);
1301 if (IS_ERR(skb)) {
1302 bt_dev_err(hdev, "Setting Intel telemetry ddc write event mask failed (%ld)",
1303 PTR_ERR(skb));
1304 return PTR_ERR(skb);
1305 }
1306
1307 kfree_skb(skb);
1308 return 0;
1309 }
1310
btintel_legacy_rom_get_fw(struct hci_dev * hdev,struct intel_version * ver)1311 static const struct firmware *btintel_legacy_rom_get_fw(struct hci_dev *hdev,
1312 struct intel_version *ver)
1313 {
1314 const struct firmware *fw;
1315 char fwname[64];
1316 int ret;
1317
1318 snprintf(fwname, sizeof(fwname),
1319 "intel/ibt-hw-%x.%x.%x-fw-%x.%x.%x.%x.%x.bseq",
1320 ver->hw_platform, ver->hw_variant, ver->hw_revision,
1321 ver->fw_variant, ver->fw_revision, ver->fw_build_num,
1322 ver->fw_build_ww, ver->fw_build_yy);
1323
1324 ret = request_firmware(&fw, fwname, &hdev->dev);
1325 if (ret < 0) {
1326 if (ret == -EINVAL) {
1327 bt_dev_err(hdev, "Intel firmware file request failed (%d)",
1328 ret);
1329 return NULL;
1330 }
1331
1332 bt_dev_err(hdev, "failed to open Intel firmware file: %s (%d)",
1333 fwname, ret);
1334
1335 /* If the correct firmware patch file is not found, use the
1336 * default firmware patch file instead
1337 */
1338 snprintf(fwname, sizeof(fwname), "intel/ibt-hw-%x.%x.bseq",
1339 ver->hw_platform, ver->hw_variant);
1340 if (request_firmware(&fw, fwname, &hdev->dev) < 0) {
1341 bt_dev_err(hdev, "failed to open default fw file: %s",
1342 fwname);
1343 return NULL;
1344 }
1345 }
1346
1347 bt_dev_info(hdev, "Intel Bluetooth firmware file: %s", fwname);
1348
1349 return fw;
1350 }
1351
btintel_legacy_rom_patching(struct hci_dev * hdev,const struct firmware * fw,const u8 ** fw_ptr,int * disable_patch)1352 static int btintel_legacy_rom_patching(struct hci_dev *hdev,
1353 const struct firmware *fw,
1354 const u8 **fw_ptr, int *disable_patch)
1355 {
1356 struct sk_buff *skb;
1357 struct hci_command_hdr *cmd;
1358 const u8 *cmd_param;
1359 struct hci_event_hdr *evt = NULL;
1360 const u8 *evt_param = NULL;
1361 int remain = fw->size - (*fw_ptr - fw->data);
1362
1363 /* The first byte indicates the types of the patch command or event.
1364 * 0x01 means HCI command and 0x02 is HCI event. If the first bytes
1365 * in the current firmware buffer doesn't start with 0x01 or
1366 * the size of remain buffer is smaller than HCI command header,
1367 * the firmware file is corrupted and it should stop the patching
1368 * process.
1369 */
1370 if (remain > HCI_COMMAND_HDR_SIZE && *fw_ptr[0] != 0x01) {
1371 bt_dev_err(hdev, "Intel fw corrupted: invalid cmd read");
1372 return -EINVAL;
1373 }
1374 (*fw_ptr)++;
1375 remain--;
1376
1377 cmd = (struct hci_command_hdr *)(*fw_ptr);
1378 *fw_ptr += sizeof(*cmd);
1379 remain -= sizeof(*cmd);
1380
1381 /* Ensure that the remain firmware data is long enough than the length
1382 * of command parameter. If not, the firmware file is corrupted.
1383 */
1384 if (remain < cmd->plen) {
1385 bt_dev_err(hdev, "Intel fw corrupted: invalid cmd len");
1386 return -EFAULT;
1387 }
1388
1389 /* If there is a command that loads a patch in the firmware
1390 * file, then enable the patch upon success, otherwise just
1391 * disable the manufacturer mode, for example patch activation
1392 * is not required when the default firmware patch file is used
1393 * because there are no patch data to load.
1394 */
1395 if (*disable_patch && le16_to_cpu(cmd->opcode) == 0xfc8e)
1396 *disable_patch = 0;
1397
1398 cmd_param = *fw_ptr;
1399 *fw_ptr += cmd->plen;
1400 remain -= cmd->plen;
1401
1402 /* This reads the expected events when the above command is sent to the
1403 * device. Some vendor commands expects more than one events, for
1404 * example command status event followed by vendor specific event.
1405 * For this case, it only keeps the last expected event. so the command
1406 * can be sent with __hci_cmd_sync_ev() which returns the sk_buff of
1407 * last expected event.
1408 */
1409 while (remain > HCI_EVENT_HDR_SIZE && *fw_ptr[0] == 0x02) {
1410 (*fw_ptr)++;
1411 remain--;
1412
1413 evt = (struct hci_event_hdr *)(*fw_ptr);
1414 *fw_ptr += sizeof(*evt);
1415 remain -= sizeof(*evt);
1416
1417 if (remain < evt->plen) {
1418 bt_dev_err(hdev, "Intel fw corrupted: invalid evt len");
1419 return -EFAULT;
1420 }
1421
1422 evt_param = *fw_ptr;
1423 *fw_ptr += evt->plen;
1424 remain -= evt->plen;
1425 }
1426
1427 /* Every HCI commands in the firmware file has its correspond event.
1428 * If event is not found or remain is smaller than zero, the firmware
1429 * file is corrupted.
1430 */
1431 if (!evt || !evt_param || remain < 0) {
1432 bt_dev_err(hdev, "Intel fw corrupted: invalid evt read");
1433 return -EFAULT;
1434 }
1435
1436 skb = __hci_cmd_sync_ev(hdev, le16_to_cpu(cmd->opcode), cmd->plen,
1437 cmd_param, evt->evt, HCI_INIT_TIMEOUT);
1438 if (IS_ERR(skb)) {
1439 bt_dev_err(hdev, "sending Intel patch command (0x%4.4x) failed (%ld)",
1440 cmd->opcode, PTR_ERR(skb));
1441 return PTR_ERR(skb);
1442 }
1443
1444 /* It ensures that the returned event matches the event data read from
1445 * the firmware file. At fist, it checks the length and then
1446 * the contents of the event.
1447 */
1448 if (skb->len != evt->plen) {
1449 bt_dev_err(hdev, "mismatch event length (opcode 0x%4.4x)",
1450 le16_to_cpu(cmd->opcode));
1451 kfree_skb(skb);
1452 return -EFAULT;
1453 }
1454
1455 if (memcmp(skb->data, evt_param, evt->plen)) {
1456 bt_dev_err(hdev, "mismatch event parameter (opcode 0x%4.4x)",
1457 le16_to_cpu(cmd->opcode));
1458 kfree_skb(skb);
1459 return -EFAULT;
1460 }
1461 kfree_skb(skb);
1462
1463 return 0;
1464 }
1465
btintel_legacy_rom_setup(struct hci_dev * hdev,struct intel_version * ver)1466 static int btintel_legacy_rom_setup(struct hci_dev *hdev,
1467 struct intel_version *ver)
1468 {
1469 const struct firmware *fw;
1470 const u8 *fw_ptr;
1471 int disable_patch, err;
1472 struct intel_version new_ver;
1473
1474 BT_DBG("%s", hdev->name);
1475
1476 /* fw_patch_num indicates the version of patch the device currently
1477 * have. If there is no patch data in the device, it is always 0x00.
1478 * So, if it is other than 0x00, no need to patch the device again.
1479 */
1480 if (ver->fw_patch_num) {
1481 bt_dev_info(hdev,
1482 "Intel device is already patched. patch num: %02x",
1483 ver->fw_patch_num);
1484 goto complete;
1485 }
1486
1487 /* Opens the firmware patch file based on the firmware version read
1488 * from the controller. If it fails to open the matching firmware
1489 * patch file, it tries to open the default firmware patch file.
1490 * If no patch file is found, allow the device to operate without
1491 * a patch.
1492 */
1493 fw = btintel_legacy_rom_get_fw(hdev, ver);
1494 if (!fw)
1495 goto complete;
1496 fw_ptr = fw->data;
1497
1498 /* Enable the manufacturer mode of the controller.
1499 * Only while this mode is enabled, the driver can download the
1500 * firmware patch data and configuration parameters.
1501 */
1502 err = btintel_enter_mfg(hdev);
1503 if (err) {
1504 release_firmware(fw);
1505 return err;
1506 }
1507
1508 disable_patch = 1;
1509
1510 /* The firmware data file consists of list of Intel specific HCI
1511 * commands and its expected events. The first byte indicates the
1512 * type of the message, either HCI command or HCI event.
1513 *
1514 * It reads the command and its expected event from the firmware file,
1515 * and send to the controller. Once __hci_cmd_sync_ev() returns,
1516 * the returned event is compared with the event read from the firmware
1517 * file and it will continue until all the messages are downloaded to
1518 * the controller.
1519 *
1520 * Once the firmware patching is completed successfully,
1521 * the manufacturer mode is disabled with reset and activating the
1522 * downloaded patch.
1523 *
1524 * If the firmware patching fails, the manufacturer mode is
1525 * disabled with reset and deactivating the patch.
1526 *
1527 * If the default patch file is used, no reset is done when disabling
1528 * the manufacturer.
1529 */
1530 while (fw->size > fw_ptr - fw->data) {
1531 int ret;
1532
1533 ret = btintel_legacy_rom_patching(hdev, fw, &fw_ptr,
1534 &disable_patch);
1535 if (ret < 0)
1536 goto exit_mfg_deactivate;
1537 }
1538
1539 release_firmware(fw);
1540
1541 if (disable_patch)
1542 goto exit_mfg_disable;
1543
1544 /* Patching completed successfully and disable the manufacturer mode
1545 * with reset and activate the downloaded firmware patches.
1546 */
1547 err = btintel_exit_mfg(hdev, true, true);
1548 if (err)
1549 return err;
1550
1551 /* Need build number for downloaded fw patches in
1552 * every power-on boot
1553 */
1554 err = btintel_read_version(hdev, &new_ver);
1555 if (err)
1556 return err;
1557
1558 bt_dev_info(hdev, "Intel BT fw patch 0x%02x completed & activated",
1559 new_ver.fw_patch_num);
1560
1561 goto complete;
1562
1563 exit_mfg_disable:
1564 /* Disable the manufacturer mode without reset */
1565 err = btintel_exit_mfg(hdev, false, false);
1566 if (err)
1567 return err;
1568
1569 bt_dev_info(hdev, "Intel firmware patch completed");
1570
1571 goto complete;
1572
1573 exit_mfg_deactivate:
1574 release_firmware(fw);
1575
1576 /* Patching failed. Disable the manufacturer mode with reset and
1577 * deactivate the downloaded firmware patches.
1578 */
1579 err = btintel_exit_mfg(hdev, true, false);
1580 if (err)
1581 return err;
1582
1583 bt_dev_info(hdev, "Intel firmware patch completed and deactivated");
1584
1585 complete:
1586 /* Set the event mask for Intel specific vendor events. This enables
1587 * a few extra events that are useful during general operation.
1588 */
1589 btintel_set_event_mask_mfg(hdev, false);
1590
1591 btintel_check_bdaddr(hdev);
1592
1593 return 0;
1594 }
1595
btintel_download_wait(struct hci_dev * hdev,ktime_t calltime,int msec)1596 static int btintel_download_wait(struct hci_dev *hdev, ktime_t calltime, int msec)
1597 {
1598 ktime_t delta, rettime;
1599 unsigned long long duration;
1600 int err;
1601
1602 btintel_set_flag(hdev, INTEL_FIRMWARE_LOADED);
1603
1604 bt_dev_info(hdev, "Waiting for firmware download to complete");
1605
1606 err = btintel_wait_on_flag_timeout(hdev, INTEL_DOWNLOADING,
1607 TASK_INTERRUPTIBLE,
1608 msecs_to_jiffies(msec));
1609 if (err == -EINTR) {
1610 bt_dev_err(hdev, "Firmware loading interrupted");
1611 return err;
1612 }
1613
1614 if (err) {
1615 bt_dev_err(hdev, "Firmware loading timeout");
1616 return -ETIMEDOUT;
1617 }
1618
1619 if (btintel_test_flag(hdev, INTEL_FIRMWARE_FAILED)) {
1620 bt_dev_err(hdev, "Firmware loading failed");
1621 return -ENOEXEC;
1622 }
1623
1624 rettime = ktime_get();
1625 delta = ktime_sub(rettime, calltime);
1626 duration = (unsigned long long)ktime_to_ns(delta) >> 10;
1627
1628 bt_dev_info(hdev, "Firmware loaded in %llu usecs", duration);
1629
1630 return 0;
1631 }
1632
btintel_boot_wait(struct hci_dev * hdev,ktime_t calltime,int msec)1633 static int btintel_boot_wait(struct hci_dev *hdev, ktime_t calltime, int msec)
1634 {
1635 ktime_t delta, rettime;
1636 unsigned long long duration;
1637 int err;
1638
1639 bt_dev_info(hdev, "Waiting for device to boot");
1640
1641 err = btintel_wait_on_flag_timeout(hdev, INTEL_BOOTING,
1642 TASK_INTERRUPTIBLE,
1643 msecs_to_jiffies(msec));
1644 if (err == -EINTR) {
1645 bt_dev_err(hdev, "Device boot interrupted");
1646 return -EINTR;
1647 }
1648
1649 if (err) {
1650 bt_dev_err(hdev, "Device boot timeout");
1651 return -ETIMEDOUT;
1652 }
1653
1654 rettime = ktime_get();
1655 delta = ktime_sub(rettime, calltime);
1656 duration = (unsigned long long) ktime_to_ns(delta) >> 10;
1657
1658 bt_dev_info(hdev, "Device booted in %llu usecs", duration);
1659
1660 return 0;
1661 }
1662
btintel_boot(struct hci_dev * hdev,u32 boot_addr)1663 static int btintel_boot(struct hci_dev *hdev, u32 boot_addr)
1664 {
1665 ktime_t calltime;
1666 int err;
1667
1668 calltime = ktime_get();
1669
1670 btintel_set_flag(hdev, INTEL_BOOTING);
1671
1672 err = btintel_send_intel_reset(hdev, boot_addr);
1673 if (err) {
1674 bt_dev_err(hdev, "Intel Soft Reset failed (%d)", err);
1675 btintel_reset_to_bootloader(hdev);
1676 return err;
1677 }
1678
1679 /* The bootloader will not indicate when the device is ready. This
1680 * is done by the operational firmware sending bootup notification.
1681 *
1682 * Booting into operational firmware should not take longer than
1683 * 1 second. However if that happens, then just fail the setup
1684 * since something went wrong.
1685 */
1686 err = btintel_boot_wait(hdev, calltime, 1000);
1687 if (err == -ETIMEDOUT)
1688 btintel_reset_to_bootloader(hdev);
1689
1690 return err;
1691 }
1692
btintel_get_fw_name(struct intel_version * ver,struct intel_boot_params * params,char * fw_name,size_t len,const char * suffix)1693 static int btintel_get_fw_name(struct intel_version *ver,
1694 struct intel_boot_params *params,
1695 char *fw_name, size_t len,
1696 const char *suffix)
1697 {
1698 switch (ver->hw_variant) {
1699 case 0x0b: /* SfP */
1700 case 0x0c: /* WsP */
1701 snprintf(fw_name, len, "intel/ibt-%u-%u.%s",
1702 le16_to_cpu(ver->hw_variant),
1703 le16_to_cpu(params->dev_revid),
1704 suffix);
1705 break;
1706 case 0x11: /* JfP */
1707 case 0x12: /* ThP */
1708 case 0x13: /* HrP */
1709 case 0x14: /* CcP */
1710 snprintf(fw_name, len, "intel/ibt-%u-%u-%u.%s",
1711 le16_to_cpu(ver->hw_variant),
1712 le16_to_cpu(ver->hw_revision),
1713 le16_to_cpu(ver->fw_revision),
1714 suffix);
1715 break;
1716 default:
1717 return -EINVAL;
1718 }
1719
1720 return 0;
1721 }
1722
btintel_download_fw(struct hci_dev * hdev,struct intel_version * ver,struct intel_boot_params * params,u32 * boot_param)1723 static int btintel_download_fw(struct hci_dev *hdev,
1724 struct intel_version *ver,
1725 struct intel_boot_params *params,
1726 u32 *boot_param)
1727 {
1728 const struct firmware *fw;
1729 char fwname[64];
1730 int err;
1731 ktime_t calltime;
1732
1733 if (!ver || !params)
1734 return -EINVAL;
1735
1736 /* The firmware variant determines if the device is in bootloader
1737 * mode or is running operational firmware. The value 0x06 identifies
1738 * the bootloader and the value 0x23 identifies the operational
1739 * firmware.
1740 *
1741 * When the operational firmware is already present, then only
1742 * the check for valid Bluetooth device address is needed. This
1743 * determines if the device will be added as configured or
1744 * unconfigured controller.
1745 *
1746 * It is not possible to use the Secure Boot Parameters in this
1747 * case since that command is only available in bootloader mode.
1748 */
1749 if (ver->fw_variant == 0x23) {
1750 btintel_clear_flag(hdev, INTEL_BOOTLOADER);
1751 btintel_check_bdaddr(hdev);
1752
1753 /* SfP and WsP don't seem to update the firmware version on file
1754 * so version checking is currently possible.
1755 */
1756 switch (ver->hw_variant) {
1757 case 0x0b: /* SfP */
1758 case 0x0c: /* WsP */
1759 return 0;
1760 }
1761
1762 /* Proceed to download to check if the version matches */
1763 goto download;
1764 }
1765
1766 /* Read the secure boot parameters to identify the operating
1767 * details of the bootloader.
1768 */
1769 err = btintel_read_boot_params(hdev, params);
1770 if (err)
1771 return err;
1772
1773 /* It is required that every single firmware fragment is acknowledged
1774 * with a command complete event. If the boot parameters indicate
1775 * that this bootloader does not send them, then abort the setup.
1776 */
1777 if (params->limited_cce != 0x00) {
1778 bt_dev_err(hdev, "Unsupported Intel firmware loading method (%u)",
1779 params->limited_cce);
1780 return -EINVAL;
1781 }
1782
1783 /* If the OTP has no valid Bluetooth device address, then there will
1784 * also be no valid address for the operational firmware.
1785 */
1786 if (!bacmp(¶ms->otp_bdaddr, BDADDR_ANY)) {
1787 bt_dev_info(hdev, "No device address configured");
1788 set_bit(HCI_QUIRK_INVALID_BDADDR, &hdev->quirks);
1789 }
1790
1791 download:
1792 /* With this Intel bootloader only the hardware variant and device
1793 * revision information are used to select the right firmware for SfP
1794 * and WsP.
1795 *
1796 * The firmware filename is ibt-<hw_variant>-<dev_revid>.sfi.
1797 *
1798 * Currently the supported hardware variants are:
1799 * 11 (0x0b) for iBT3.0 (LnP/SfP)
1800 * 12 (0x0c) for iBT3.5 (WsP)
1801 *
1802 * For ThP/JfP and for future SKU's, the FW name varies based on HW
1803 * variant, HW revision and FW revision, as these are dependent on CNVi
1804 * and RF Combination.
1805 *
1806 * 17 (0x11) for iBT3.5 (JfP)
1807 * 18 (0x12) for iBT3.5 (ThP)
1808 *
1809 * The firmware file name for these will be
1810 * ibt-<hw_variant>-<hw_revision>-<fw_revision>.sfi.
1811 *
1812 */
1813 err = btintel_get_fw_name(ver, params, fwname, sizeof(fwname), "sfi");
1814 if (err < 0) {
1815 if (!btintel_test_flag(hdev, INTEL_BOOTLOADER)) {
1816 /* Firmware has already been loaded */
1817 btintel_set_flag(hdev, INTEL_FIRMWARE_LOADED);
1818 return 0;
1819 }
1820
1821 bt_dev_err(hdev, "Unsupported Intel firmware naming");
1822 return -EINVAL;
1823 }
1824
1825 err = firmware_request_nowarn(&fw, fwname, &hdev->dev);
1826 if (err < 0) {
1827 if (!btintel_test_flag(hdev, INTEL_BOOTLOADER)) {
1828 /* Firmware has already been loaded */
1829 btintel_set_flag(hdev, INTEL_FIRMWARE_LOADED);
1830 return 0;
1831 }
1832
1833 bt_dev_err(hdev, "Failed to load Intel firmware file %s (%d)",
1834 fwname, err);
1835 return err;
1836 }
1837
1838 bt_dev_info(hdev, "Found device firmware: %s", fwname);
1839
1840 if (fw->size < 644) {
1841 bt_dev_err(hdev, "Invalid size of firmware file (%zu)",
1842 fw->size);
1843 err = -EBADF;
1844 goto done;
1845 }
1846
1847 calltime = ktime_get();
1848
1849 btintel_set_flag(hdev, INTEL_DOWNLOADING);
1850
1851 /* Start firmware downloading and get boot parameter */
1852 err = btintel_download_firmware(hdev, ver, fw, boot_param);
1853 if (err < 0) {
1854 if (err == -EALREADY) {
1855 /* Firmware has already been loaded */
1856 btintel_set_flag(hdev, INTEL_FIRMWARE_LOADED);
1857 err = 0;
1858 goto done;
1859 }
1860
1861 /* When FW download fails, send Intel Reset to retry
1862 * FW download.
1863 */
1864 btintel_reset_to_bootloader(hdev);
1865 goto done;
1866 }
1867
1868 /* Before switching the device into operational mode and with that
1869 * booting the loaded firmware, wait for the bootloader notification
1870 * that all fragments have been successfully received.
1871 *
1872 * When the event processing receives the notification, then the
1873 * INTEL_DOWNLOADING flag will be cleared.
1874 *
1875 * The firmware loading should not take longer than 5 seconds
1876 * and thus just timeout if that happens and fail the setup
1877 * of this device.
1878 */
1879 err = btintel_download_wait(hdev, calltime, 5000);
1880 if (err == -ETIMEDOUT)
1881 btintel_reset_to_bootloader(hdev);
1882
1883 done:
1884 release_firmware(fw);
1885 return err;
1886 }
1887
btintel_bootloader_setup(struct hci_dev * hdev,struct intel_version * ver)1888 static int btintel_bootloader_setup(struct hci_dev *hdev,
1889 struct intel_version *ver)
1890 {
1891 struct intel_version new_ver;
1892 struct intel_boot_params params;
1893 u32 boot_param;
1894 char ddcname[64];
1895 int err;
1896 struct intel_debug_features features;
1897
1898 BT_DBG("%s", hdev->name);
1899
1900 /* Set the default boot parameter to 0x0 and it is updated to
1901 * SKU specific boot parameter after reading Intel_Write_Boot_Params
1902 * command while downloading the firmware.
1903 */
1904 boot_param = 0x00000000;
1905
1906 btintel_set_flag(hdev, INTEL_BOOTLOADER);
1907
1908 err = btintel_download_fw(hdev, ver, ¶ms, &boot_param);
1909 if (err)
1910 return err;
1911
1912 /* controller is already having an operational firmware */
1913 if (ver->fw_variant == 0x23)
1914 goto finish;
1915
1916 err = btintel_boot(hdev, boot_param);
1917 if (err)
1918 return err;
1919
1920 btintel_clear_flag(hdev, INTEL_BOOTLOADER);
1921
1922 err = btintel_get_fw_name(ver, ¶ms, ddcname,
1923 sizeof(ddcname), "ddc");
1924
1925 if (err < 0) {
1926 bt_dev_err(hdev, "Unsupported Intel firmware naming");
1927 } else {
1928 /* Once the device is running in operational mode, it needs to
1929 * apply the device configuration (DDC) parameters.
1930 *
1931 * The device can work without DDC parameters, so even if it
1932 * fails to load the file, no need to fail the setup.
1933 */
1934 btintel_load_ddc_config(hdev, ddcname);
1935 }
1936
1937 /* Read the Intel supported features and if new exception formats
1938 * supported, need to load the additional DDC config to enable.
1939 */
1940 err = btintel_read_debug_features(hdev, &features);
1941 if (!err) {
1942 /* Set DDC mask for available debug features */
1943 btintel_set_debug_features(hdev, &features);
1944 }
1945
1946 /* Read the Intel version information after loading the FW */
1947 err = btintel_read_version(hdev, &new_ver);
1948 if (err)
1949 return err;
1950
1951 btintel_version_info(hdev, &new_ver);
1952
1953 finish:
1954 /* Set the event mask for Intel specific vendor events. This enables
1955 * a few extra events that are useful during general operation. It
1956 * does not enable any debugging related events.
1957 *
1958 * The device will function correctly without these events enabled
1959 * and thus no need to fail the setup.
1960 */
1961 btintel_set_event_mask(hdev, false);
1962
1963 return 0;
1964 }
1965
btintel_get_fw_name_tlv(const struct intel_version_tlv * ver,char * fw_name,size_t len,const char * suffix)1966 static void btintel_get_fw_name_tlv(const struct intel_version_tlv *ver,
1967 char *fw_name, size_t len,
1968 const char *suffix)
1969 {
1970 /* The firmware file name for new generation controllers will be
1971 * ibt-<cnvi_top type+cnvi_top step>-<cnvr_top type+cnvr_top step>
1972 */
1973 snprintf(fw_name, len, "intel/ibt-%04x-%04x.%s",
1974 INTEL_CNVX_TOP_PACK_SWAB(INTEL_CNVX_TOP_TYPE(ver->cnvi_top),
1975 INTEL_CNVX_TOP_STEP(ver->cnvi_top)),
1976 INTEL_CNVX_TOP_PACK_SWAB(INTEL_CNVX_TOP_TYPE(ver->cnvr_top),
1977 INTEL_CNVX_TOP_STEP(ver->cnvr_top)),
1978 suffix);
1979 }
1980
btintel_prepare_fw_download_tlv(struct hci_dev * hdev,struct intel_version_tlv * ver,u32 * boot_param)1981 static int btintel_prepare_fw_download_tlv(struct hci_dev *hdev,
1982 struct intel_version_tlv *ver,
1983 u32 *boot_param)
1984 {
1985 const struct firmware *fw;
1986 char fwname[64];
1987 int err;
1988 ktime_t calltime;
1989
1990 if (!ver || !boot_param)
1991 return -EINVAL;
1992
1993 /* The firmware variant determines if the device is in bootloader
1994 * mode or is running operational firmware. The value 0x03 identifies
1995 * the bootloader and the value 0x23 identifies the operational
1996 * firmware.
1997 *
1998 * When the operational firmware is already present, then only
1999 * the check for valid Bluetooth device address is needed. This
2000 * determines if the device will be added as configured or
2001 * unconfigured controller.
2002 *
2003 * It is not possible to use the Secure Boot Parameters in this
2004 * case since that command is only available in bootloader mode.
2005 */
2006 if (ver->img_type == 0x03) {
2007 btintel_clear_flag(hdev, INTEL_BOOTLOADER);
2008 btintel_check_bdaddr(hdev);
2009 }
2010
2011 /* If the OTP has no valid Bluetooth device address, then there will
2012 * also be no valid address for the operational firmware.
2013 */
2014 if (!bacmp(&ver->otp_bd_addr, BDADDR_ANY)) {
2015 bt_dev_info(hdev, "No device address configured");
2016 set_bit(HCI_QUIRK_INVALID_BDADDR, &hdev->quirks);
2017 }
2018
2019 btintel_get_fw_name_tlv(ver, fwname, sizeof(fwname), "sfi");
2020 err = firmware_request_nowarn(&fw, fwname, &hdev->dev);
2021 if (err < 0) {
2022 if (!btintel_test_flag(hdev, INTEL_BOOTLOADER)) {
2023 /* Firmware has already been loaded */
2024 btintel_set_flag(hdev, INTEL_FIRMWARE_LOADED);
2025 return 0;
2026 }
2027
2028 bt_dev_err(hdev, "Failed to load Intel firmware file %s (%d)",
2029 fwname, err);
2030
2031 return err;
2032 }
2033
2034 bt_dev_info(hdev, "Found device firmware: %s", fwname);
2035
2036 if (fw->size < 644) {
2037 bt_dev_err(hdev, "Invalid size of firmware file (%zu)",
2038 fw->size);
2039 err = -EBADF;
2040 goto done;
2041 }
2042
2043 calltime = ktime_get();
2044
2045 btintel_set_flag(hdev, INTEL_DOWNLOADING);
2046
2047 /* Start firmware downloading and get boot parameter */
2048 err = btintel_download_fw_tlv(hdev, ver, fw, boot_param,
2049 INTEL_HW_VARIANT(ver->cnvi_bt),
2050 ver->sbe_type);
2051 if (err < 0) {
2052 if (err == -EALREADY) {
2053 /* Firmware has already been loaded */
2054 btintel_set_flag(hdev, INTEL_FIRMWARE_LOADED);
2055 err = 0;
2056 goto done;
2057 }
2058
2059 /* When FW download fails, send Intel Reset to retry
2060 * FW download.
2061 */
2062 btintel_reset_to_bootloader(hdev);
2063 goto done;
2064 }
2065
2066 /* Before switching the device into operational mode and with that
2067 * booting the loaded firmware, wait for the bootloader notification
2068 * that all fragments have been successfully received.
2069 *
2070 * When the event processing receives the notification, then the
2071 * BTUSB_DOWNLOADING flag will be cleared.
2072 *
2073 * The firmware loading should not take longer than 5 seconds
2074 * and thus just timeout if that happens and fail the setup
2075 * of this device.
2076 */
2077 err = btintel_download_wait(hdev, calltime, 5000);
2078 if (err == -ETIMEDOUT)
2079 btintel_reset_to_bootloader(hdev);
2080
2081 done:
2082 release_firmware(fw);
2083 return err;
2084 }
2085
btintel_bootloader_setup_tlv(struct hci_dev * hdev,struct intel_version_tlv * ver)2086 static int btintel_bootloader_setup_tlv(struct hci_dev *hdev,
2087 struct intel_version_tlv *ver)
2088 {
2089 u32 boot_param;
2090 char ddcname[64];
2091 int err;
2092 struct intel_debug_features features;
2093 struct intel_version_tlv new_ver;
2094
2095 bt_dev_dbg(hdev, "");
2096
2097 /* Set the default boot parameter to 0x0 and it is updated to
2098 * SKU specific boot parameter after reading Intel_Write_Boot_Params
2099 * command while downloading the firmware.
2100 */
2101 boot_param = 0x00000000;
2102
2103 btintel_set_flag(hdev, INTEL_BOOTLOADER);
2104
2105 err = btintel_prepare_fw_download_tlv(hdev, ver, &boot_param);
2106 if (err)
2107 return err;
2108
2109 /* check if controller is already having an operational firmware */
2110 if (ver->img_type == 0x03)
2111 goto finish;
2112
2113 err = btintel_boot(hdev, boot_param);
2114 if (err)
2115 return err;
2116
2117 btintel_clear_flag(hdev, INTEL_BOOTLOADER);
2118
2119 btintel_get_fw_name_tlv(ver, ddcname, sizeof(ddcname), "ddc");
2120 /* Once the device is running in operational mode, it needs to
2121 * apply the device configuration (DDC) parameters.
2122 *
2123 * The device can work without DDC parameters, so even if it
2124 * fails to load the file, no need to fail the setup.
2125 */
2126 btintel_load_ddc_config(hdev, ddcname);
2127
2128 /* Read the Intel supported features and if new exception formats
2129 * supported, need to load the additional DDC config to enable.
2130 */
2131 err = btintel_read_debug_features(hdev, &features);
2132 if (!err) {
2133 /* Set DDC mask for available debug features */
2134 btintel_set_debug_features(hdev, &features);
2135 }
2136
2137 /* Read the Intel version information after loading the FW */
2138 err = btintel_read_version_tlv(hdev, &new_ver);
2139 if (err)
2140 return err;
2141
2142 btintel_version_info_tlv(hdev, &new_ver);
2143
2144 finish:
2145 /* Set the event mask for Intel specific vendor events. This enables
2146 * a few extra events that are useful during general operation. It
2147 * does not enable any debugging related events.
2148 *
2149 * The device will function correctly without these events enabled
2150 * and thus no need to fail the setup.
2151 */
2152 btintel_set_event_mask(hdev, false);
2153
2154 return 0;
2155 }
2156
btintel_set_msft_opcode(struct hci_dev * hdev,u8 hw_variant)2157 static void btintel_set_msft_opcode(struct hci_dev *hdev, u8 hw_variant)
2158 {
2159 switch (hw_variant) {
2160 /* Legacy bootloader devices that supports MSFT Extension */
2161 case 0x11: /* JfP */
2162 case 0x12: /* ThP */
2163 case 0x13: /* HrP */
2164 case 0x14: /* CcP */
2165 /* All Intel new genration controllers support the Microsoft vendor
2166 * extension are using 0xFC1E for VsMsftOpCode.
2167 */
2168 case 0x17:
2169 case 0x18:
2170 case 0x19:
2171 hci_set_msft_opcode(hdev, 0xFC1E);
2172 break;
2173 default:
2174 /* Not supported */
2175 break;
2176 }
2177 }
2178
btintel_setup_combined(struct hci_dev * hdev)2179 static int btintel_setup_combined(struct hci_dev *hdev)
2180 {
2181 const u8 param[1] = { 0xFF };
2182 struct intel_version ver;
2183 struct intel_version_tlv ver_tlv;
2184 struct sk_buff *skb;
2185 int err;
2186
2187 BT_DBG("%s", hdev->name);
2188
2189 /* The some controllers have a bug with the first HCI command sent to it
2190 * returning number of completed commands as zero. This would stall the
2191 * command processing in the Bluetooth core.
2192 *
2193 * As a workaround, send HCI Reset command first which will reset the
2194 * number of completed commands and allow normal command processing
2195 * from now on.
2196 */
2197 if (btintel_test_flag(hdev, INTEL_BROKEN_INITIAL_NCMD)) {
2198 skb = __hci_cmd_sync(hdev, HCI_OP_RESET, 0, NULL,
2199 HCI_INIT_TIMEOUT);
2200 if (IS_ERR(skb)) {
2201 bt_dev_err(hdev,
2202 "sending initial HCI reset failed (%ld)",
2203 PTR_ERR(skb));
2204 return PTR_ERR(skb);
2205 }
2206 kfree_skb(skb);
2207 }
2208
2209 /* Starting from TyP device, the command parameter and response are
2210 * changed even though the OCF for HCI_Intel_Read_Version command
2211 * remains same. The legacy devices can handle even if the
2212 * command has a parameter and returns a correct version information.
2213 * So, it uses new format to support both legacy and new format.
2214 */
2215 skb = __hci_cmd_sync(hdev, 0xfc05, 1, param, HCI_CMD_TIMEOUT);
2216 if (IS_ERR(skb)) {
2217 bt_dev_err(hdev, "Reading Intel version command failed (%ld)",
2218 PTR_ERR(skb));
2219 return PTR_ERR(skb);
2220 }
2221
2222 /* Check the status */
2223 if (skb->data[0]) {
2224 bt_dev_err(hdev, "Intel Read Version command failed (%02x)",
2225 skb->data[0]);
2226 err = -EIO;
2227 goto exit_error;
2228 }
2229
2230 /* Apply the common HCI quirks for Intel device */
2231 set_bit(HCI_QUIRK_STRICT_DUPLICATE_FILTER, &hdev->quirks);
2232 set_bit(HCI_QUIRK_SIMULTANEOUS_DISCOVERY, &hdev->quirks);
2233 set_bit(HCI_QUIRK_NON_PERSISTENT_DIAG, &hdev->quirks);
2234
2235 /* For Legacy device, check the HW platform value and size */
2236 if (skb->len == sizeof(ver) && skb->data[1] == 0x37) {
2237 bt_dev_dbg(hdev, "Read the legacy Intel version information");
2238
2239 memcpy(&ver, skb->data, sizeof(ver));
2240
2241 /* Display version information */
2242 btintel_version_info(hdev, &ver);
2243
2244 /* Check for supported iBT hardware variants of this firmware
2245 * loading method.
2246 *
2247 * This check has been put in place to ensure correct forward
2248 * compatibility options when newer hardware variants come
2249 * along.
2250 */
2251 switch (ver.hw_variant) {
2252 case 0x07: /* WP */
2253 case 0x08: /* StP */
2254 /* Legacy ROM product */
2255 btintel_set_flag(hdev, INTEL_ROM_LEGACY);
2256
2257 /* Apply the device specific HCI quirks
2258 *
2259 * WBS for SdP - SdP and Stp have a same hw_varaint but
2260 * different fw_variant
2261 */
2262 if (ver.hw_variant == 0x08 && ver.fw_variant == 0x22)
2263 set_bit(HCI_QUIRK_WIDEBAND_SPEECH_SUPPORTED,
2264 &hdev->quirks);
2265
2266 /* These devices have an issue with LED which doesn't
2267 * go off immediately during shutdown. Set the flag
2268 * here to send the LED OFF command during shutdown.
2269 */
2270 btintel_set_flag(hdev, INTEL_BROKEN_LED);
2271
2272 err = btintel_legacy_rom_setup(hdev, &ver);
2273 break;
2274 case 0x0b: /* SfP */
2275 case 0x0c: /* WsP */
2276 case 0x11: /* JfP */
2277 case 0x12: /* ThP */
2278 case 0x13: /* HrP */
2279 case 0x14: /* CcP */
2280 /* Apply the device specific HCI quirks
2281 *
2282 * All Legacy bootloader devices support WBS
2283 */
2284 set_bit(HCI_QUIRK_WIDEBAND_SPEECH_SUPPORTED,
2285 &hdev->quirks);
2286
2287 /* Valid LE States quirk for JfP/ThP familiy */
2288 if (ver.hw_variant == 0x11 || ver.hw_variant == 0x12)
2289 set_bit(HCI_QUIRK_VALID_LE_STATES,
2290 &hdev->quirks);
2291
2292 /* Setup MSFT Extension support */
2293 btintel_set_msft_opcode(hdev, ver.hw_variant);
2294
2295 err = btintel_bootloader_setup(hdev, &ver);
2296 break;
2297 default:
2298 bt_dev_err(hdev, "Unsupported Intel hw variant (%u)",
2299 ver.hw_variant);
2300 err = -EINVAL;
2301 }
2302
2303 goto exit_error;
2304 }
2305
2306 /* For TLV type device, parse the tlv data */
2307 err = btintel_parse_version_tlv(hdev, &ver_tlv, skb);
2308 if (err) {
2309 bt_dev_err(hdev, "Failed to parse TLV version information");
2310 goto exit_error;
2311 }
2312
2313 if (INTEL_HW_PLATFORM(ver_tlv.cnvi_bt) != 0x37) {
2314 bt_dev_err(hdev, "Unsupported Intel hardware platform (0x%2x)",
2315 INTEL_HW_PLATFORM(ver_tlv.cnvi_bt));
2316 err = -EINVAL;
2317 goto exit_error;
2318 }
2319
2320 /* Check for supported iBT hardware variants of this firmware
2321 * loading method.
2322 *
2323 * This check has been put in place to ensure correct forward
2324 * compatibility options when newer hardware variants come
2325 * along.
2326 */
2327 switch (INTEL_HW_VARIANT(ver_tlv.cnvi_bt)) {
2328 case 0x11: /* JfP */
2329 case 0x12: /* ThP */
2330 case 0x13: /* HrP */
2331 case 0x14: /* CcP */
2332 /* Some legacy bootloader devices from JfP supports both old
2333 * and TLV based HCI_Intel_Read_Version command. But we don't
2334 * want to use the TLV based setup routines for those legacy
2335 * bootloader device.
2336 *
2337 * Also, it is not easy to convert TLV based version from the
2338 * legacy version format.
2339 *
2340 * So, as a workaround for those devices, use the legacy
2341 * HCI_Intel_Read_Version to get the version information and
2342 * run the legacy bootloader setup.
2343 */
2344 err = btintel_read_version(hdev, &ver);
2345 if (err)
2346 return err;
2347 err = btintel_bootloader_setup(hdev, &ver);
2348 break;
2349 case 0x17:
2350 case 0x18:
2351 case 0x19:
2352 /* Display version information of TLV type */
2353 btintel_version_info_tlv(hdev, &ver_tlv);
2354
2355 /* Apply the device specific HCI quirks for TLV based devices
2356 *
2357 * All TLV based devices support WBS
2358 */
2359 set_bit(HCI_QUIRK_WIDEBAND_SPEECH_SUPPORTED, &hdev->quirks);
2360
2361 /* Valid LE States quirk for GfP */
2362 if (INTEL_HW_VARIANT(ver_tlv.cnvi_bt) == 0x18)
2363 set_bit(HCI_QUIRK_VALID_LE_STATES, &hdev->quirks);
2364
2365 /* Setup MSFT Extension support */
2366 btintel_set_msft_opcode(hdev,
2367 INTEL_HW_VARIANT(ver_tlv.cnvi_bt));
2368
2369 err = btintel_bootloader_setup_tlv(hdev, &ver_tlv);
2370 break;
2371 default:
2372 bt_dev_err(hdev, "Unsupported Intel hw variant (%u)",
2373 INTEL_HW_VARIANT(ver_tlv.cnvi_bt));
2374 return -EINVAL;
2375 }
2376
2377 exit_error:
2378 kfree_skb(skb);
2379
2380 return err;
2381 }
2382
btintel_shutdown_combined(struct hci_dev * hdev)2383 static int btintel_shutdown_combined(struct hci_dev *hdev)
2384 {
2385 struct sk_buff *skb;
2386 int ret;
2387
2388 /* Send HCI Reset to the controller to stop any BT activity which
2389 * were triggered. This will help to save power and maintain the
2390 * sync b/w Host and controller
2391 */
2392 skb = __hci_cmd_sync(hdev, HCI_OP_RESET, 0, NULL, HCI_INIT_TIMEOUT);
2393 if (IS_ERR(skb)) {
2394 bt_dev_err(hdev, "HCI reset during shutdown failed");
2395 return PTR_ERR(skb);
2396 }
2397 kfree_skb(skb);
2398
2399
2400 /* Some platforms have an issue with BT LED when the interface is
2401 * down or BT radio is turned off, which takes 5 seconds to BT LED
2402 * goes off. This command turns off the BT LED immediately.
2403 */
2404 if (btintel_test_flag(hdev, INTEL_BROKEN_LED)) {
2405 skb = __hci_cmd_sync(hdev, 0xfc3f, 0, NULL, HCI_INIT_TIMEOUT);
2406 if (IS_ERR(skb)) {
2407 ret = PTR_ERR(skb);
2408 bt_dev_err(hdev, "turning off Intel device LED failed");
2409 return ret;
2410 }
2411 kfree_skb(skb);
2412 }
2413
2414 return 0;
2415 }
2416
btintel_configure_setup(struct hci_dev * hdev)2417 int btintel_configure_setup(struct hci_dev *hdev)
2418 {
2419 hdev->manufacturer = 2;
2420 hdev->setup = btintel_setup_combined;
2421 hdev->shutdown = btintel_shutdown_combined;
2422 hdev->hw_error = btintel_hw_error;
2423 hdev->set_diag = btintel_set_diag_combined;
2424 hdev->set_bdaddr = btintel_set_bdaddr;
2425
2426 return 0;
2427 }
2428 EXPORT_SYMBOL_GPL(btintel_configure_setup);
2429
btintel_bootup(struct hci_dev * hdev,const void * ptr,unsigned int len)2430 void btintel_bootup(struct hci_dev *hdev, const void *ptr, unsigned int len)
2431 {
2432 const struct intel_bootup *evt = ptr;
2433
2434 if (len != sizeof(*evt))
2435 return;
2436
2437 if (btintel_test_and_clear_flag(hdev, INTEL_BOOTING))
2438 btintel_wake_up_flag(hdev, INTEL_BOOTING);
2439 }
2440 EXPORT_SYMBOL_GPL(btintel_bootup);
2441
btintel_secure_send_result(struct hci_dev * hdev,const void * ptr,unsigned int len)2442 void btintel_secure_send_result(struct hci_dev *hdev,
2443 const void *ptr, unsigned int len)
2444 {
2445 const struct intel_secure_send_result *evt = ptr;
2446
2447 if (len != sizeof(*evt))
2448 return;
2449
2450 if (evt->result)
2451 btintel_set_flag(hdev, INTEL_FIRMWARE_FAILED);
2452
2453 if (btintel_test_and_clear_flag(hdev, INTEL_DOWNLOADING) &&
2454 btintel_test_flag(hdev, INTEL_FIRMWARE_LOADED))
2455 btintel_wake_up_flag(hdev, INTEL_DOWNLOADING);
2456 }
2457 EXPORT_SYMBOL_GPL(btintel_secure_send_result);
2458
2459 MODULE_AUTHOR("Marcel Holtmann <marcel@holtmann.org>");
2460 MODULE_DESCRIPTION("Bluetooth support for Intel devices ver " VERSION);
2461 MODULE_VERSION(VERSION);
2462 MODULE_LICENSE("GPL");
2463 MODULE_FIRMWARE("intel/ibt-11-5.sfi");
2464 MODULE_FIRMWARE("intel/ibt-11-5.ddc");
2465 MODULE_FIRMWARE("intel/ibt-12-16.sfi");
2466 MODULE_FIRMWARE("intel/ibt-12-16.ddc");
2467
