drivers/bluetooth/btintel.c

   1 // SPDX-License-Identifier: GPL-2.0-or-later
   2 /*
   3  *
   4  *  Bluetooth support for Intel devices
   5  *
   6  *  Copyright (C) 2015  Intel Corporation
   7  */
   8
   9 #include <linux/module.h>
  10 #include <linux/firmware.h>
  11 #include <linux/regmap.h>
  12 #include <asm/unaligned.h>
  13
  14 #include <net/bluetooth/bluetooth.h>
  15 #include <net/bluetooth/hci_core.h>
  16
  17 #include "btintel.h"
  18
  19 #define VERSION "0.1"
  20
  21 #define BDADDR_INTEL            (&(bdaddr_t){{0x00, 0x8b, 0x9e, 0x19, 0x03, 0x00}})
  22 #define RSA_HEADER_LEN          644
  23 #define CSS_HEADER_OFFSET       8
  24 #define ECDSA_OFFSET            644
  25 #define ECDSA_HEADER_LEN        320
  26
  27 #define CMD_WRITE_BOOT_PARAMS   0xfc0e
  28 struct cmd_write_boot_params {
  29         u32 boot_addr;
  30         u8  fw_build_num;
  31         u8  fw_build_ww;
  32         u8  fw_build_yy;
  33 } __packed;
  34
  35 int btintel_check_bdaddr(struct hci_dev *hdev)
  36 {
  37         struct hci_rp_read_bd_addr *bda;
  38         struct sk_buff *skb;
  39
  40         skb = __hci_cmd_sync(hdev, HCI_OP_READ_BD_ADDR, 0, NULL,
  41                              HCI_INIT_TIMEOUT);
  42         if (IS_ERR(skb)) {
  43                 int err = PTR_ERR(skb);
  44                 bt_dev_err(hdev, "Reading Intel device address failed (%d)",
  45                            err);
  46                 return err;
  47         }
  48
  49         if (skb->len != sizeof(*bda)) {
  50                 bt_dev_err(hdev, "Intel device address length mismatch");
  51                 kfree_skb(skb);
  52                 return -EIO;
  53         }
  54
  55         bda = (struct hci_rp_read_bd_addr *)skb->data;
  56
  57         /* For some Intel based controllers, the default Bluetooth device
  58          * address 00:03:19:9E:8B:00 can be found. These controllers are
  59          * fully operational, but have the danger of duplicate addresses
  60          * and that in turn can cause problems with Bluetooth operation.
  61          */
  62         if (!bacmp(&bda->bdaddr, BDADDR_INTEL)) {
  63                 bt_dev_err(hdev, "Found Intel default device address (%pMR)",
  64                            &bda->bdaddr);
  65                 set_bit(HCI_QUIRK_INVALID_BDADDR, &hdev->quirks);
  66         }
  67
  68         kfree_skb(skb);
  69
  70         return 0;
  71 }
  72 EXPORT_SYMBOL_GPL(btintel_check_bdaddr);
  73
  74 int btintel_enter_mfg(struct hci_dev *hdev)
  75 {
  76         static const u8 param[] = { 0x01, 0x00 };
  77         struct sk_buff *skb;
  78
  79         skb = __hci_cmd_sync(hdev, 0xfc11, 2, param, HCI_CMD_TIMEOUT);
  80         if (IS_ERR(skb)) {
  81                 bt_dev_err(hdev, "Entering manufacturer mode failed (%ld)",
  82                            PTR_ERR(skb));
  83                 return PTR_ERR(skb);
  84         }
  85         kfree_skb(skb);
  86
  87         return 0;
  88 }
  89 EXPORT_SYMBOL_GPL(btintel_enter_mfg);
  90
  91 int btintel_exit_mfg(struct hci_dev *hdev, bool reset, bool patched)
  92 {
  93         u8 param[] = { 0x00, 0x00 };
  94         struct sk_buff *skb;
  95
  96         /* The 2nd command parameter specifies the manufacturing exit method:
  97          * 0x00: Just disable the manufacturing mode (0x00).
  98          * 0x01: Disable manufacturing mode and reset with patches deactivated.
  99          * 0x02: Disable manufacturing mode and reset with patches activated.
 100          */
 101         if (reset)
 102                 param[1] |= patched ? 0x02 : 0x01;
 103
 104         skb = __hci_cmd_sync(hdev, 0xfc11, 2, param, HCI_CMD_TIMEOUT);
 105         if (IS_ERR(skb)) {
 106                 bt_dev_err(hdev, "Exiting manufacturer mode failed (%ld)",
 107                            PTR_ERR(skb));
 108                 return PTR_ERR(skb);
 109         }
 110         kfree_skb(skb);
 111
 112         return 0;
 113 }
 114 EXPORT_SYMBOL_GPL(btintel_exit_mfg);
 115
 116 int btintel_set_bdaddr(struct hci_dev *hdev, const bdaddr_t *bdaddr)
 117 {
 118         struct sk_buff *skb;
 119         int err;
 120
 121         skb = __hci_cmd_sync(hdev, 0xfc31, 6, bdaddr, HCI_INIT_TIMEOUT);
 122         if (IS_ERR(skb)) {
 123                 err = PTR_ERR(skb);
 124                 bt_dev_err(hdev, "Changing Intel device address failed (%d)",
 125                            err);
 126                 return err;
 127         }
 128         kfree_skb(skb);
 129
 130         return 0;
 131 }
 132 EXPORT_SYMBOL_GPL(btintel_set_bdaddr);
 133
 134 static int btintel_set_event_mask(struct hci_dev *hdev, bool debug)
 135 {
 136         u8 mask[8] = { 0x87, 0x0c, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 };
 137         struct sk_buff *skb;
 138         int err;
 139
 140         if (debug)
 141                 mask[1] |= 0x62;
 142
 143         skb = __hci_cmd_sync(hdev, 0xfc52, 8, mask, HCI_INIT_TIMEOUT);
 144         if (IS_ERR(skb)) {
 145                 err = PTR_ERR(skb);
 146                 bt_dev_err(hdev, "Setting Intel event mask failed (%d)", err);
 147                 return err;
 148         }
 149         kfree_skb(skb);
 150
 151         return 0;
 152 }
 153
 154 int btintel_set_diag(struct hci_dev *hdev, bool enable)
 155 {
 156         struct sk_buff *skb;
 157         u8 param[3];
 158         int err;
 159
 160         if (enable) {
 161                 param[0] = 0x03;
 162                 param[1] = 0x03;
 163                 param[2] = 0x03;
 164         } else {
 165                 param[0] = 0x00;
 166                 param[1] = 0x00;
 167                 param[2] = 0x00;
 168         }
 169
 170         skb = __hci_cmd_sync(hdev, 0xfc43, 3, param, HCI_INIT_TIMEOUT);
 171         if (IS_ERR(skb)) {
 172                 err = PTR_ERR(skb);
 173                 if (err == -ENODATA)
 174                         goto done;
 175                 bt_dev_err(hdev, "Changing Intel diagnostic mode failed (%d)",
 176                            err);
 177                 return err;
 178         }
 179         kfree_skb(skb);
 180
 181 done:
 182         btintel_set_event_mask(hdev, enable);
 183         return 0;
 184 }
 185 EXPORT_SYMBOL_GPL(btintel_set_diag);
 186
 187 static int btintel_set_diag_mfg(struct hci_dev *hdev, bool enable)
 188 {
 189         int err, ret;
 190
 191         err = btintel_enter_mfg(hdev);
 192         if (err)
 193                 return err;
 194
 195         ret = btintel_set_diag(hdev, enable);
 196
 197         err = btintel_exit_mfg(hdev, false, false);
 198         if (err)
 199                 return err;
 200
 201         return ret;
 202 }
 203
 204 static int btintel_set_diag_combined(struct hci_dev *hdev, bool enable)
 205 {
 206         int ret;
 207
 208         /* Legacy ROM device needs to be in the manufacturer mode to apply
 209          * diagnostic setting
 210          *
 211          * This flag is set after reading the Intel version.
 212          */
 213         if (btintel_test_flag(hdev, INTEL_ROM_LEGACY))
 214                 ret = btintel_set_diag_mfg(hdev, enable);
 215         else
 216                 ret = btintel_set_diag(hdev, enable);
 217
 218         return ret;
 219 }
 220
 221 static void btintel_hw_error(struct hci_dev *hdev, u8 code)
 222 {
 223         struct sk_buff *skb;
 224         u8 type = 0x00;
 225
 226         bt_dev_err(hdev, "Hardware error 0x%2.2x", code);
 227
 228         skb = __hci_cmd_sync(hdev, HCI_OP_RESET, 0, NULL, HCI_INIT_TIMEOUT);
 229         if (IS_ERR(skb)) {
 230                 bt_dev_err(hdev, "Reset after hardware error failed (%ld)",
 231                            PTR_ERR(skb));
 232                 return;
 233         }
 234         kfree_skb(skb);
 235
 236         skb = __hci_cmd_sync(hdev, 0xfc22, 1, &type, HCI_INIT_TIMEOUT);
 237         if (IS_ERR(skb)) {
 238                 bt_dev_err(hdev, "Retrieving Intel exception info failed (%ld)",
 239                            PTR_ERR(skb));
 240                 return;
 241         }
 242
 243         if (skb->len != 13) {
 244                 bt_dev_err(hdev, "Exception info size mismatch");
 245                 kfree_skb(skb);
 246                 return;
 247         }
 248
 249         bt_dev_err(hdev, "Exception info %s", (char *)(skb->data + 1));
 250
 251         kfree_skb(skb);
 252 }
 253
 254 int btintel_version_info(struct hci_dev *hdev, struct intel_version *ver)
 255 {
 256         const char *variant;
 257
 258         /* The hardware platform number has a fixed value of 0x37 and
 259          * for now only accept this single value.
 260          */
 261         if (ver->hw_platform != 0x37) {
 262                 bt_dev_err(hdev, "Unsupported Intel hardware platform (%u)",
 263                            ver->hw_platform);
 264                 return -EINVAL;
 265         }
 266
 267         /* Check for supported iBT hardware variants of this firmware
 268          * loading method.
 269          *
 270          * This check has been put in place to ensure correct forward
 271          * compatibility options when newer hardware variants come along.
 272          */
 273         switch (ver->hw_variant) {
 274         case 0x07:      /* WP - Legacy ROM */
 275         case 0x08:      /* StP - Legacy ROM */
 276         case 0x0b:      /* SfP */
 277         case 0x0c:      /* WsP */
 278         case 0x11:      /* JfP */
 279         case 0x12:      /* ThP */
 280         case 0x13:      /* HrP */
 281         case 0x14:      /* CcP */
 282                 break;
 283         default:
 284                 bt_dev_err(hdev, "Unsupported Intel hardware variant (%u)",
 285                            ver->hw_variant);
 286                 return -EINVAL;
 287         }
 288
 289         switch (ver->fw_variant) {
 290         case 0x01:
 291                 variant = "Legacy ROM 2.5";
 292                 break;
 293         case 0x06:
 294                 variant = "Bootloader";
 295                 break;
 296         case 0x22:
 297                 variant = "Legacy ROM 2.x";
 298                 break;
 299         case 0x23:
 300                 variant = "Firmware";
 301                 break;
 302         default:
 303                 bt_dev_err(hdev, "Unsupported firmware variant(%02x)", ver->fw_variant);
 304                 return -EINVAL;
 305         }
 306
 307         bt_dev_info(hdev, "%s revision %u.%u build %u week %u %u",
 308                     variant, ver->fw_revision >> 4, ver->fw_revision & 0x0f,
 309                     ver->fw_build_num, ver->fw_build_ww,
 310                     2000 + ver->fw_build_yy);
 311
 312         return 0;
 313 }
 314 EXPORT_SYMBOL_GPL(btintel_version_info);
 315
 316 static int btintel_secure_send(struct hci_dev *hdev, u8 fragment_type, u32 plen,
 317                                const void *param)
 318 {
 319         while (plen > 0) {
 320                 struct sk_buff *skb;
 321                 u8 cmd_param[253], fragment_len = (plen > 252) ? 252 : plen;
 322
 323                 cmd_param[0] = fragment_type;
 324                 memcpy(cmd_param + 1, param, fragment_len);
 325
 326                 skb = __hci_cmd_sync(hdev, 0xfc09, fragment_len + 1,
 327                                      cmd_param, HCI_INIT_TIMEOUT);
 328                 if (IS_ERR(skb))
 329                         return PTR_ERR(skb);
 330
 331                 kfree_skb(skb);
 332
 333                 plen -= fragment_len;
 334                 param += fragment_len;
 335         }
 336
 337         return 0;
 338 }
 339
 340 int btintel_load_ddc_config(struct hci_dev *hdev, const char *ddc_name)
 341 {
 342         const struct firmware *fw;
 343         struct sk_buff *skb;
 344         const u8 *fw_ptr;
 345         int err;
 346
 347         err = request_firmware_direct(&fw, ddc_name, &hdev->dev);
 348         if (err < 0) {
 349                 bt_dev_err(hdev, "Failed to load Intel DDC file %s (%d)",
 350                            ddc_name, err);
 351                 return err;
 352         }
 353
 354         bt_dev_info(hdev, "Found Intel DDC parameters: %s", ddc_name);
 355
 356         fw_ptr = fw->data;
 357
 358         /* DDC file contains one or more DDC structure which has
 359          * Length (1 byte), DDC ID (2 bytes), and DDC value (Length - 2).
 360          */
 361         while (fw->size > fw_ptr - fw->data) {
 362                 u8 cmd_plen = fw_ptr[0] + sizeof(u8);
 363
 364                 skb = __hci_cmd_sync(hdev, 0xfc8b, cmd_plen, fw_ptr,
 365                                      HCI_INIT_TIMEOUT);
 366                 if (IS_ERR(skb)) {
 367                         bt_dev_err(hdev, "Failed to send Intel_Write_DDC (%ld)",
 368                                    PTR_ERR(skb));
 369                         release_firmware(fw);
 370                         return PTR_ERR(skb);
 371                 }
 372
 373                 fw_ptr += cmd_plen;
 374                 kfree_skb(skb);
 375         }
 376
 377         release_firmware(fw);
 378
 379         bt_dev_info(hdev, "Applying Intel DDC parameters completed");
 380
 381         return 0;
 382 }
 383 EXPORT_SYMBOL_GPL(btintel_load_ddc_config);
 384
 385 int btintel_set_event_mask_mfg(struct hci_dev *hdev, bool debug)
 386 {
 387         int err, ret;
 388
 389         err = btintel_enter_mfg(hdev);
 390         if (err)
 391                 return err;
 392
 393         ret = btintel_set_event_mask(hdev, debug);
 394
 395         err = btintel_exit_mfg(hdev, false, false);
 396         if (err)
 397                 return err;
 398
 399         return ret;
 400 }
 401 EXPORT_SYMBOL_GPL(btintel_set_event_mask_mfg);
 402
 403 int btintel_read_version(struct hci_dev *hdev, struct intel_version *ver)
 404 {
 405         struct sk_buff *skb;
 406
 407         skb = __hci_cmd_sync(hdev, 0xfc05, 0, NULL, HCI_CMD_TIMEOUT);
 408         if (IS_ERR(skb)) {
 409                 bt_dev_err(hdev, "Reading Intel version information failed (%ld)",
 410                            PTR_ERR(skb));
 411                 return PTR_ERR(skb);
 412         }
 413
 414         if (skb->len != sizeof(*ver)) {
 415                 bt_dev_err(hdev, "Intel version event size mismatch");
 416                 kfree_skb(skb);
 417                 return -EILSEQ;
 418         }
 419
 420         memcpy(ver, skb->data, sizeof(*ver));
 421
 422         kfree_skb(skb);
 423
 424         return 0;
 425 }
 426 EXPORT_SYMBOL_GPL(btintel_read_version);
 427
 428 static int btintel_version_info_tlv(struct hci_dev *hdev,
 429                                     struct intel_version_tlv *version)
 430 {
 431         const char *variant;
 432
 433         /* The hardware platform number has a fixed value of 0x37 and
 434          * for now only accept this single value.
 435          */
 436         if (INTEL_HW_PLATFORM(version->cnvi_bt) != 0x37) {
 437                 bt_dev_err(hdev, "Unsupported Intel hardware platform (0x%2x)",
 438                            INTEL_HW_PLATFORM(version->cnvi_bt));
 439                 return -EINVAL;
 440         }
 441
 442         /* Check for supported iBT hardware variants of this firmware
 443          * loading method.
 444          *
 445          * This check has been put in place to ensure correct forward
 446          * compatibility options when newer hardware variants come along.
 447          */
 448         switch (INTEL_HW_VARIANT(version->cnvi_bt)) {
 449         case 0x17:      /* TyP */
 450         case 0x18:      /* Slr */
 451         case 0x19:      /* Slr-F */
 452         case 0x1b:      /* Mgr */
 453                 break;
 454         default:
 455                 bt_dev_err(hdev, "Unsupported Intel hardware variant (0x%x)",
 456                            INTEL_HW_VARIANT(version->cnvi_bt));
 457                 return -EINVAL;
 458         }
 459
 460         switch (version->img_type) {
 461         case 0x01:
 462                 variant = "Bootloader";
 463                 /* It is required that every single firmware fragment is acknowledged
 464                  * with a command complete event. If the boot parameters indicate
 465                  * that this bootloader does not send them, then abort the setup.
 466                  */
 467                 if (version->limited_cce != 0x00) {
 468                         bt_dev_err(hdev, "Unsupported Intel firmware loading method (0x%x)",
 469                                    version->limited_cce);
 470                         return -EINVAL;
 471                 }
 472
 473                 /* Secure boot engine type should be either 1 (ECDSA) or 0 (RSA) */
 474                 if (version->sbe_type > 0x01) {
 475                         bt_dev_err(hdev, "Unsupported Intel secure boot engine type (0x%x)",
 476                                    version->sbe_type);
 477                         return -EINVAL;
 478                 }
 479
 480                 bt_dev_info(hdev, "Device revision is %u", version->dev_rev_id);
 481                 bt_dev_info(hdev, "Secure boot is %s",
 482                             version->secure_boot ? "enabled" : "disabled");
 483                 bt_dev_info(hdev, "OTP lock is %s",
 484                             version->otp_lock ? "enabled" : "disabled");
 485                 bt_dev_info(hdev, "API lock is %s",
 486                             version->api_lock ? "enabled" : "disabled");
 487                 bt_dev_info(hdev, "Debug lock is %s",
 488                             version->debug_lock ? "enabled" : "disabled");
 489                 bt_dev_info(hdev, "Minimum firmware build %u week %u %u",
 490                             version->min_fw_build_nn, version->min_fw_build_cw,
 491                             2000 + version->min_fw_build_yy);
 492                 break;
 493         case 0x03:
 494                 variant = "Firmware";
 495                 break;
 496         default:
 497                 bt_dev_err(hdev, "Unsupported image type(%02x)", version->img_type);
 498                 return -EINVAL;
 499         }
 500
 501         bt_dev_info(hdev, "%s timestamp %u.%u buildtype %u build %u", variant,
 502                     2000 + (version->timestamp >> 8), version->timestamp & 0xff,
 503                     version->build_type, version->build_num);
 504
 505         return 0;
 506 }
 507
 508 static int btintel_parse_version_tlv(struct hci_dev *hdev,
 509                                      struct intel_version_tlv *version,
 510                                      struct sk_buff *skb)
 511 {
 512         /* Consume Command Complete Status field */
 513         skb_pull(skb, 1);
 514
 515         /* Event parameters contatin multiple TLVs. Read each of them
 516          * and only keep the required data. Also, it use existing legacy
 517          * version field like hw_platform, hw_variant, and fw_variant
 518          * to keep the existing setup flow
 519          */
 520         while (skb->len) {
 521                 struct intel_tlv *tlv;
 522
 523                 /* Make sure skb has a minimum length of the header */
 524                 if (skb->len < sizeof(*tlv))
 525                         return -EINVAL;
 526
 527                 tlv = (struct intel_tlv *)skb->data;
 528
 529                 /* Make sure skb has a enough data */
 530                 if (skb->len < tlv->len + sizeof(*tlv))
 531                         return -EINVAL;
 532
 533                 switch (tlv->type) {
 534                 case INTEL_TLV_CNVI_TOP:
 535                         version->cnvi_top = get_unaligned_le32(tlv->val);
 536                         break;
 537                 case INTEL_TLV_CNVR_TOP:
 538                         version->cnvr_top = get_unaligned_le32(tlv->val);
 539                         break;
 540                 case INTEL_TLV_CNVI_BT:
 541                         version->cnvi_bt = get_unaligned_le32(tlv->val);
 542                         break;
 543                 case INTEL_TLV_CNVR_BT:
 544                         version->cnvr_bt = get_unaligned_le32(tlv->val);
 545                         break;
 546                 case INTEL_TLV_DEV_REV_ID:
 547                         version->dev_rev_id = get_unaligned_le16(tlv->val);
 548                         break;
 549                 case INTEL_TLV_IMAGE_TYPE:
 550                         version->img_type = tlv->val[0];
 551                         break;
 552                 case INTEL_TLV_TIME_STAMP:
 553                         /* If image type is Operational firmware (0x03), then
 554                          * running FW Calendar Week and Year information can
 555                          * be extracted from Timestamp information
 556                          */
 557                         version->min_fw_build_cw = tlv->val[0];
 558                         version->min_fw_build_yy = tlv->val[1];
 559                         version->timestamp = get_unaligned_le16(tlv->val);
 560                         break;
 561                 case INTEL_TLV_BUILD_TYPE:
 562                         version->build_type = tlv->val[0];
 563                         break;
 564                 case INTEL_TLV_BUILD_NUM:
 565                         /* If image type is Operational firmware (0x03), then
 566                          * running FW build number can be extracted from the
 567                          * Build information
 568                          */
 569                         version->min_fw_build_nn = tlv->val[0];
 570                         version->build_num = get_unaligned_le32(tlv->val);
 571                         break;
 572                 case INTEL_TLV_SECURE_BOOT:
 573                         version->secure_boot = tlv->val[0];
 574                         break;
 575                 case INTEL_TLV_OTP_LOCK:
 576                         version->otp_lock = tlv->val[0];
 577                         break;
 578                 case INTEL_TLV_API_LOCK:
 579                         version->api_lock = tlv->val[0];
 580                         break;
 581                 case INTEL_TLV_DEBUG_LOCK:
 582                         version->debug_lock = tlv->val[0];
 583                         break;
 584                 case INTEL_TLV_MIN_FW:
 585                         version->min_fw_build_nn = tlv->val[0];
 586                         version->min_fw_build_cw = tlv->val[1];
 587                         version->min_fw_build_yy = tlv->val[2];
 588                         break;
 589                 case INTEL_TLV_LIMITED_CCE:
 590                         version->limited_cce = tlv->val[0];
 591                         break;
 592                 case INTEL_TLV_SBE_TYPE:
 593                         version->sbe_type = tlv->val[0];
 594                         break;
 595                 case INTEL_TLV_OTP_BDADDR:
 596                         memcpy(&version->otp_bd_addr, tlv->val,
 597                                                         sizeof(bdaddr_t));
 598                         break;
 599                 default:
 600                         /* Ignore rest of information */
 601                         break;
 602                 }
 603                 /* consume the current tlv and move to next*/
 604                 skb_pull(skb, tlv->len + sizeof(*tlv));
 605         }
 606
 607         return 0;
 608 }
 609
 610 static int btintel_read_version_tlv(struct hci_dev *hdev,
 611                                     struct intel_version_tlv *version)
 612 {
 613         struct sk_buff *skb;
 614         const u8 param[1] = { 0xFF };
 615
 616         if (!version)
 617                 return -EINVAL;
 618
 619         skb = __hci_cmd_sync(hdev, 0xfc05, 1, param, HCI_CMD_TIMEOUT);
 620         if (IS_ERR(skb)) {
 621                 bt_dev_err(hdev, "Reading Intel version information failed (%ld)",
 622                            PTR_ERR(skb));
 623                 return PTR_ERR(skb);
 624         }
 625
 626         if (skb->data[0]) {
 627                 bt_dev_err(hdev, "Intel Read Version command failed (%02x)",
 628                            skb->data[0]);
 629                 kfree_skb(skb);
 630                 return -EIO;
 631         }
 632
 633         btintel_parse_version_tlv(hdev, version, skb);
 634
 635         kfree_skb(skb);
 636         return 0;
 637 }
 638
 639 /* ------- REGMAP IBT SUPPORT ------- */
 640
 641 #define IBT_REG_MODE_8BIT  0x00
 642 #define IBT_REG_MODE_16BIT 0x01
 643 #define IBT_REG_MODE_32BIT 0x02
 644
 645 struct regmap_ibt_context {
 646         struct hci_dev *hdev;
 647         __u16 op_write;
 648         __u16 op_read;
 649 };
 650
 651 struct ibt_cp_reg_access {
 652         __le32  addr;
 653         __u8    mode;
 654         __u8    len;
 655         __u8    data[];
 656 } __packed;
 657
 658 struct ibt_rp_reg_access {
 659         __u8    status;
 660         __le32  addr;
 661         __u8    data[];
 662 } __packed;
 663
 664 static int regmap_ibt_read(void *context, const void *addr, size_t reg_size,
 665                            void *val, size_t val_size)
 666 {
 667         struct regmap_ibt_context *ctx = context;
 668         struct ibt_cp_reg_access cp;
 669         struct ibt_rp_reg_access *rp;
 670         struct sk_buff *skb;
 671         int err = 0;
 672
 673         if (reg_size != sizeof(__le32))
 674                 return -EINVAL;
 675
 676         switch (val_size) {
 677         case 1:
 678                 cp.mode = IBT_REG_MODE_8BIT;
 679                 break;
 680         case 2:
 681                 cp.mode = IBT_REG_MODE_16BIT;
 682                 break;
 683         case 4:
 684                 cp.mode = IBT_REG_MODE_32BIT;
 685                 break;
 686         default:
 687                 return -EINVAL;
 688         }
 689
 690         /* regmap provides a little-endian formatted addr */
 691         cp.addr = *(__le32 *)addr;
 692         cp.len = val_size;
 693
 694         bt_dev_dbg(ctx->hdev, "Register (0x%x) read", le32_to_cpu(cp.addr));
 695
 696         skb = hci_cmd_sync(ctx->hdev, ctx->op_read, sizeof(cp), &cp,
 697                            HCI_CMD_TIMEOUT);
 698         if (IS_ERR(skb)) {
 699                 err = PTR_ERR(skb);
 700                 bt_dev_err(ctx->hdev, "regmap: Register (0x%x) read error (%d)",
 701                            le32_to_cpu(cp.addr), err);
 702                 return err;
 703         }
 704
 705         if (skb->len != sizeof(*rp) + val_size) {
 706                 bt_dev_err(ctx->hdev, "regmap: Register (0x%x) read error, bad len",
 707                            le32_to_cpu(cp.addr));
 708                 err = -EINVAL;
 709                 goto done;
 710         }
 711
 712         rp = (struct ibt_rp_reg_access *)skb->data;
 713
 714         if (rp->addr != cp.addr) {
 715                 bt_dev_err(ctx->hdev, "regmap: Register (0x%x) read error, bad addr",
 716                            le32_to_cpu(rp->addr));
 717                 err = -EINVAL;
 718                 goto done;
 719         }
 720
 721         memcpy(val, rp->data, val_size);
 722
 723 done:
 724         kfree_skb(skb);
 725         return err;
 726 }
 727
 728 static int regmap_ibt_gather_write(void *context,
 729                                    const void *addr, size_t reg_size,
 730                                    const void *val, size_t val_size)
 731 {
 732         struct regmap_ibt_context *ctx = context;
 733         struct ibt_cp_reg_access *cp;
 734         struct sk_buff *skb;
 735         int plen = sizeof(*cp) + val_size;
 736         u8 mode;
 737         int err = 0;
 738
 739         if (reg_size != sizeof(__le32))
 740                 return -EINVAL;
 741
 742         switch (val_size) {
 743         case 1:
 744                 mode = IBT_REG_MODE_8BIT;
 745                 break;
 746         case 2:
 747                 mode = IBT_REG_MODE_16BIT;
 748                 break;
 749         case 4:
 750                 mode = IBT_REG_MODE_32BIT;
 751                 break;
 752         default:
 753                 return -EINVAL;
 754         }
 755
 756         cp = kmalloc(plen, GFP_KERNEL);
 757         if (!cp)
 758                 return -ENOMEM;
 759
 760         /* regmap provides a little-endian formatted addr/value */
 761         cp->addr = *(__le32 *)addr;
 762         cp->mode = mode;
 763         cp->len = val_size;
 764         memcpy(&cp->data, val, val_size);
 765
 766         bt_dev_dbg(ctx->hdev, "Register (0x%x) write", le32_to_cpu(cp->addr));
 767
 768         skb = hci_cmd_sync(ctx->hdev, ctx->op_write, plen, cp, HCI_CMD_TIMEOUT);
 769         if (IS_ERR(skb)) {
 770                 err = PTR_ERR(skb);
 771                 bt_dev_err(ctx->hdev, "regmap: Register (0x%x) write error (%d)",
 772                            le32_to_cpu(cp->addr), err);
 773                 goto done;
 774         }
 775         kfree_skb(skb);
 776
 777 done:
 778         kfree(cp);
 779         return err;
 780 }
 781
 782 static int regmap_ibt_write(void *context, const void *data, size_t count)
 783 {
 784         /* data contains register+value, since we only support 32bit addr,
 785          * minimum data size is 4 bytes.
 786          */
 787         if (WARN_ONCE(count < 4, "Invalid register access"))
 788                 return -EINVAL;
 789
 790         return regmap_ibt_gather_write(context, data, 4, data + 4, count - 4);
 791 }
 792
 793 static void regmap_ibt_free_context(void *context)
 794 {
 795         kfree(context);
 796 }
 797
 798 static const struct regmap_bus regmap_ibt = {
 799         .read = regmap_ibt_read,
 800         .write = regmap_ibt_write,
 801         .gather_write = regmap_ibt_gather_write,
 802         .free_context = regmap_ibt_free_context,
 803         .reg_format_endian_default = REGMAP_ENDIAN_LITTLE,
 804         .val_format_endian_default = REGMAP_ENDIAN_LITTLE,
 805 };
 806
 807 /* Config is the same for all register regions */
 808 static const struct regmap_config regmap_ibt_cfg = {
 809         .name      = "btintel_regmap",
 810         .reg_bits  = 32,
 811         .val_bits  = 32,
 812 };
 813
 814 struct regmap *btintel_regmap_init(struct hci_dev *hdev, u16 opcode_read,
 815                                    u16 opcode_write)
 816 {
 817         struct regmap_ibt_context *ctx;
 818
 819         bt_dev_info(hdev, "regmap: Init R%x-W%x region", opcode_read,
 820                     opcode_write);
 821
 822         ctx = kzalloc(sizeof(*ctx), GFP_KERNEL);
 823         if (!ctx)
 824                 return ERR_PTR(-ENOMEM);
 825
 826         ctx->op_read = opcode_read;
 827         ctx->op_write = opcode_write;
 828         ctx->hdev = hdev;
 829
 830         return regmap_init(&hdev->dev, &regmap_ibt, ctx, &regmap_ibt_cfg);
 831 }
 832 EXPORT_SYMBOL_GPL(btintel_regmap_init);
 833
 834 int btintel_send_intel_reset(struct hci_dev *hdev, u32 boot_param)
 835 {
 836         struct intel_reset params = { 0x00, 0x01, 0x00, 0x01, 0x00000000 };
 837         struct sk_buff *skb;
 838
 839         params.boot_param = cpu_to_le32(boot_param);
 840
 841         skb = __hci_cmd_sync(hdev, 0xfc01, sizeof(params), &params,
 842                              HCI_INIT_TIMEOUT);
 843         if (IS_ERR(skb)) {
 844                 bt_dev_err(hdev, "Failed to send Intel Reset command");
 845                 return PTR_ERR(skb);
 846         }
 847
 848         kfree_skb(skb);
 849
 850         return 0;
 851 }
 852 EXPORT_SYMBOL_GPL(btintel_send_intel_reset);
 853
 854 int btintel_read_boot_params(struct hci_dev *hdev,
 855                              struct intel_boot_params *params)
 856 {
 857         struct sk_buff *skb;
 858
 859         skb = __hci_cmd_sync(hdev, 0xfc0d, 0, NULL, HCI_INIT_TIMEOUT);
 860         if (IS_ERR(skb)) {
 861                 bt_dev_err(hdev, "Reading Intel boot parameters failed (%ld)",
 862                            PTR_ERR(skb));
 863                 return PTR_ERR(skb);
 864         }
 865
 866         if (skb->len != sizeof(*params)) {
 867                 bt_dev_err(hdev, "Intel boot parameters size mismatch");
 868                 kfree_skb(skb);
 869                 return -EILSEQ;
 870         }
 871
 872         memcpy(params, skb->data, sizeof(*params));
 873
 874         kfree_skb(skb);
 875
 876         if (params->status) {
 877                 bt_dev_err(hdev, "Intel boot parameters command failed (%02x)",
 878                            params->status);
 879                 return -bt_to_errno(params->status);
 880         }
 881
 882         bt_dev_info(hdev, "Device revision is %u",
 883                     le16_to_cpu(params->dev_revid));
 884
 885         bt_dev_info(hdev, "Secure boot is %s",
 886                     params->secure_boot ? "enabled" : "disabled");
 887
 888         bt_dev_info(hdev, "OTP lock is %s",
 889                     params->otp_lock ? "enabled" : "disabled");
 890
 891         bt_dev_info(hdev, "API lock is %s",
 892                     params->api_lock ? "enabled" : "disabled");
 893
 894         bt_dev_info(hdev, "Debug lock is %s",
 895                     params->debug_lock ? "enabled" : "disabled");
 896
 897         bt_dev_info(hdev, "Minimum firmware build %u week %u %u",
 898                     params->min_fw_build_nn, params->min_fw_build_cw,
 899                     2000 + params->min_fw_build_yy);
 900
 901         return 0;
 902 }
 903 EXPORT_SYMBOL_GPL(btintel_read_boot_params);
 904
 905 static int btintel_sfi_rsa_header_secure_send(struct hci_dev *hdev,
 906                                               const struct firmware *fw)
 907 {
 908         int err;
 909
 910         /* Start the firmware download transaction with the Init fragment
 911          * represented by the 128 bytes of CSS header.
 912          */
 913         err = btintel_secure_send(hdev, 0x00, 128, fw->data);
 914         if (err < 0) {
 915                 bt_dev_err(hdev, "Failed to send firmware header (%d)", err);
 916                 goto done;
 917         }
 918
 919         /* Send the 256 bytes of public key information from the firmware
 920          * as the PKey fragment.
 921          */
 922         err = btintel_secure_send(hdev, 0x03, 256, fw->data + 128);
 923         if (err < 0) {
 924                 bt_dev_err(hdev, "Failed to send firmware pkey (%d)", err);
 925                 goto done;
 926         }
 927
 928         /* Send the 256 bytes of signature information from the firmware
 929          * as the Sign fragment.
 930          */
 931         err = btintel_secure_send(hdev, 0x02, 256, fw->data + 388);
 932         if (err < 0) {
 933                 bt_dev_err(hdev, "Failed to send firmware signature (%d)", err);
 934                 goto done;
 935         }
 936
 937 done:
 938         return err;
 939 }
 940
 941 static int btintel_sfi_ecdsa_header_secure_send(struct hci_dev *hdev,
 942                                                 const struct firmware *fw)
 943 {
 944         int err;
 945
 946         /* Start the firmware download transaction with the Init fragment
 947          * represented by the 128 bytes of CSS header.
 948          */
 949         err = btintel_secure_send(hdev, 0x00, 128, fw->data + 644);
 950         if (err < 0) {
 951                 bt_dev_err(hdev, "Failed to send firmware header (%d)", err);
 952                 return err;
 953         }
 954
 955         /* Send the 96 bytes of public key information from the firmware
 956          * as the PKey fragment.
 957          */
 958         err = btintel_secure_send(hdev, 0x03, 96, fw->data + 644 + 128);
 959         if (err < 0) {
 960                 bt_dev_err(hdev, "Failed to send firmware pkey (%d)", err);
 961                 return err;
 962         }
 963
 964         /* Send the 96 bytes of signature information from the firmware
 965          * as the Sign fragment
 966          */
 967         err = btintel_secure_send(hdev, 0x02, 96, fw->data + 644 + 224);
 968         if (err < 0) {
 969                 bt_dev_err(hdev, "Failed to send firmware signature (%d)",
 970                            err);
 971                 return err;
 972         }
 973         return 0;
 974 }
 975
 976 static int btintel_download_firmware_payload(struct hci_dev *hdev,
 977                                              const struct firmware *fw,
 978                                              size_t offset)
 979 {
 980         int err;
 981         const u8 *fw_ptr;
 982         u32 frag_len;
 983
 984         fw_ptr = fw->data + offset;
 985         frag_len = 0;
 986         err = -EINVAL;
 987
 988         while (fw_ptr - fw->data < fw->size) {
 989                 struct hci_command_hdr *cmd = (void *)(fw_ptr + frag_len);
 990
 991                 frag_len += sizeof(*cmd) + cmd->plen;
 992
 993                 /* The parameter length of the secure send command requires
 994                  * a 4 byte alignment. It happens so that the firmware file
 995                  * contains proper Intel_NOP commands to align the fragments
 996                  * as needed.
 997                  *
 998                  * Send set of commands with 4 byte alignment from the
 999                  * firmware data buffer as a single Data fragement.
1000                  */
1001                 if (!(frag_len % 4)) {
1002                         err = btintel_secure_send(hdev, 0x01, frag_len, fw_ptr);
1003                         if (err < 0) {
1004                                 bt_dev_err(hdev,
1005                                            "Failed to send firmware data (%d)",
1006                                            err);
1007                                 goto done;
1008                         }
1009
1010                         fw_ptr += frag_len;
1011                         frag_len = 0;
1012                 }
1013         }
1014
1015 done:
1016         return err;
1017 }
1018
1019 static bool btintel_firmware_version(struct hci_dev *hdev,
1020                                      u8 num, u8 ww, u8 yy,
1021                                      const struct firmware *fw,
1022                                      u32 *boot_addr)
1023 {
1024         const u8 *fw_ptr;
1025
1026         fw_ptr = fw->data;
1027
1028         while (fw_ptr - fw->data < fw->size) {
1029                 struct hci_command_hdr *cmd = (void *)(fw_ptr);
1030
1031                 /* Each SKU has a different reset parameter to use in the
1032                  * HCI_Intel_Reset command and it is embedded in the firmware
1033                  * data. So, instead of using static value per SKU, check
1034                  * the firmware data and save it for later use.
1035                  */
1036                 if (le16_to_cpu(cmd->opcode) == CMD_WRITE_BOOT_PARAMS) {
1037                         struct cmd_write_boot_params *params;
1038
1039                         params = (void *)(fw_ptr + sizeof(*cmd));
1040
1041                         *boot_addr = le32_to_cpu(params->boot_addr);
1042
1043                         bt_dev_info(hdev, "Boot Address: 0x%x", *boot_addr);
1044
1045                         bt_dev_info(hdev, "Firmware Version: %u-%u.%u",
1046                                     params->fw_build_num, params->fw_build_ww,
1047                                     params->fw_build_yy);
1048
1049                         return (num == params->fw_build_num &&
1050                                 ww == params->fw_build_ww &&
1051                                 yy == params->fw_build_yy);
1052                 }
1053
1054                 fw_ptr += sizeof(*cmd) + cmd->plen;
1055         }
1056
1057         return false;
1058 }
1059
1060 int btintel_download_firmware(struct hci_dev *hdev,
1061                               struct intel_version *ver,
1062                               const struct firmware *fw,
1063                               u32 *boot_param)
1064 {
1065         int err;
1066
1067         /* SfP and WsP don't seem to update the firmware version on file
1068          * so version checking is currently not possible.
1069          */
1070         switch (ver->hw_variant) {
1071         case 0x0b:      /* SfP */
1072         case 0x0c:      /* WsP */
1073                 /* Skip version checking */
1074                 break;
1075         default:
1076
1077                 /* Skip download if firmware has the same version */
1078                 if (btintel_firmware_version(hdev, ver->fw_build_num,
1079                                              ver->fw_build_ww, ver->fw_build_yy,
1080                                              fw, boot_param)) {
1081                         bt_dev_info(hdev, "Firmware already loaded");
1082                         /* Return -EALREADY to indicate that the firmware has
1083                          * already been loaded.
1084                          */
1085                         return -EALREADY;
1086                 }
1087         }
1088
1089         /* The firmware variant determines if the device is in bootloader
1090          * mode or is running operational firmware. The value 0x06 identifies
1091          * the bootloader and the value 0x23 identifies the operational
1092          * firmware.
1093          *
1094          * If the firmware version has changed that means it needs to be reset
1095          * to bootloader when operational so the new firmware can be loaded.
1096          */
1097         if (ver->fw_variant == 0x23)
1098                 return -EINVAL;
1099
1100         err = btintel_sfi_rsa_header_secure_send(hdev, fw);
1101         if (err)
1102                 return err;
1103
1104         return btintel_download_firmware_payload(hdev, fw, RSA_HEADER_LEN);
1105 }
1106 EXPORT_SYMBOL_GPL(btintel_download_firmware);
1107
1108 static int btintel_download_fw_tlv(struct hci_dev *hdev,
1109                                    struct intel_version_tlv *ver,
1110                                    const struct firmware *fw, u32 *boot_param,
1111                                    u8 hw_variant, u8 sbe_type)
1112 {
1113         int err;
1114         u32 css_header_ver;
1115
1116         /* Skip download if firmware has the same version */
1117         if (btintel_firmware_version(hdev, ver->min_fw_build_nn,
1118                                      ver->min_fw_build_cw,
1119                                      ver->min_fw_build_yy,
1120                                      fw, boot_param)) {
1121                 bt_dev_info(hdev, "Firmware already loaded");
1122                 /* Return -EALREADY to indicate that firmware has
1123                  * already been loaded.
1124                  */
1125                 return -EALREADY;
1126         }
1127
1128         /* The firmware variant determines if the device is in bootloader
1129          * mode or is running operational firmware. The value 0x01 identifies
1130          * the bootloader and the value 0x03 identifies the operational
1131          * firmware.
1132          *
1133          * If the firmware version has changed that means it needs to be reset
1134          * to bootloader when operational so the new firmware can be loaded.
1135          */
1136         if (ver->img_type == 0x03)
1137                 return -EINVAL;
1138
1139         /* iBT hardware variants 0x0b, 0x0c, 0x11, 0x12, 0x13, 0x14 support
1140          * only RSA secure boot engine. Hence, the corresponding sfi file will
1141          * have RSA header of 644 bytes followed by Command Buffer.
1142          *
1143          * iBT hardware variants 0x17, 0x18 onwards support both RSA and ECDSA
1144          * secure boot engine. As a result, the corresponding sfi file will
1145          * have RSA header of 644, ECDSA header of 320 bytes followed by
1146          * Command Buffer.
1147          *
1148          * CSS Header byte positions 0x08 to 0x0B represent the CSS Header
1149          * version: RSA(0x00010000) , ECDSA (0x00020000)
1150          */
1151         css_header_ver = get_unaligned_le32(fw->data + CSS_HEADER_OFFSET);
1152         if (css_header_ver != 0x00010000) {
1153                 bt_dev_err(hdev, "Invalid CSS Header version");
1154                 return -EINVAL;
1155         }
1156
1157         if (hw_variant <= 0x14) {
1158                 if (sbe_type != 0x00) {
1159                         bt_dev_err(hdev, "Invalid SBE type for hardware variant (%d)",
1160                                    hw_variant);
1161                         return -EINVAL;
1162                 }
1163
1164                 err = btintel_sfi_rsa_header_secure_send(hdev, fw);
1165                 if (err)
1166                         return err;
1167
1168                 err = btintel_download_firmware_payload(hdev, fw, RSA_HEADER_LEN);
1169                 if (err)
1170                         return err;
1171         } else if (hw_variant >= 0x17) {
1172                 /* Check if CSS header for ECDSA follows the RSA header */
1173                 if (fw->data[ECDSA_OFFSET] != 0x06)
1174                         return -EINVAL;
1175
1176                 /* Check if the CSS Header version is ECDSA(0x00020000) */
1177                 css_header_ver = get_unaligned_le32(fw->data + ECDSA_OFFSET + CSS_HEADER_OFFSET);
1178                 if (css_header_ver != 0x00020000) {
1179                         bt_dev_err(hdev, "Invalid CSS Header version");
1180                         return -EINVAL;
1181                 }
1182
1183                 if (sbe_type == 0x00) {
1184                         err = btintel_sfi_rsa_header_secure_send(hdev, fw);
1185                         if (err)
1186                                 return err;
1187
1188                         err = btintel_download_firmware_payload(hdev, fw,
1189                                                                 RSA_HEADER_LEN + ECDSA_HEADER_LEN);
1190                         if (err)
1191                                 return err;
1192                 } else if (sbe_type == 0x01) {
1193                         err = btintel_sfi_ecdsa_header_secure_send(hdev, fw);
1194                         if (err)
1195                                 return err;
1196
1197                         err = btintel_download_firmware_payload(hdev, fw,
1198                                                                 RSA_HEADER_LEN + ECDSA_HEADER_LEN);
1199                         if (err)
1200                                 return err;
1201                 }
1202         }
1203         return 0;
1204 }
1205
1206 static void btintel_reset_to_bootloader(struct hci_dev *hdev)
1207 {
1208         struct intel_reset params;
1209         struct sk_buff *skb;
1210
1211         /* Send Intel Reset command. This will result in
1212          * re-enumeration of BT controller.
1213          *
1214          * Intel Reset parameter description:
1215          * reset_type :   0x00 (Soft reset),
1216          *                0x01 (Hard reset)
1217          * patch_enable : 0x00 (Do not enable),
1218          *                0x01 (Enable)
1219          * ddc_reload :   0x00 (Do not reload),
1220          *                0x01 (Reload)
1221          * boot_option:   0x00 (Current image),
1222          *                0x01 (Specified boot address)
1223          * boot_param:    Boot address
1224          *
1225          */
1226         params.reset_type = 0x01;
1227         params.patch_enable = 0x01;
1228         params.ddc_reload = 0x01;
1229         params.boot_option = 0x00;
1230         params.boot_param = cpu_to_le32(0x00000000);
1231
1232         skb = __hci_cmd_sync(hdev, 0xfc01, sizeof(params),
1233                              &params, HCI_INIT_TIMEOUT);
1234         if (IS_ERR(skb)) {
1235                 bt_dev_err(hdev, "FW download error recovery failed (%ld)",
1236                            PTR_ERR(skb));
1237                 return;
1238         }
1239         bt_dev_info(hdev, "Intel reset sent to retry FW download");
1240         kfree_skb(skb);
1241
1242         /* Current Intel BT controllers(ThP/JfP) hold the USB reset
1243          * lines for 2ms when it receives Intel Reset in bootloader mode.
1244          * Whereas, the upcoming Intel BT controllers will hold USB reset
1245          * for 150ms. To keep the delay generic, 150ms is chosen here.
1246          */
1247         msleep(150);
1248 }
1249
1250 static int btintel_read_debug_features(struct hci_dev *hdev,
1251                                        struct intel_debug_features *features)
1252 {
1253         struct sk_buff *skb;
1254         u8 page_no = 1;
1255
1256         /* Intel controller supports two pages, each page is of 128-bit
1257          * feature bit mask. And each bit defines specific feature support
1258          */
1259         skb = __hci_cmd_sync(hdev, 0xfca6, sizeof(page_no), &page_no,
1260                              HCI_INIT_TIMEOUT);
1261         if (IS_ERR(skb)) {
1262                 bt_dev_err(hdev, "Reading supported features failed (%ld)",
1263                            PTR_ERR(skb));
1264                 return PTR_ERR(skb);
1265         }
1266
1267         if (skb->len != (sizeof(features->page1) + 3)) {
1268                 bt_dev_err(hdev, "Supported features event size mismatch");
1269                 kfree_skb(skb);
1270                 return -EILSEQ;
1271         }
1272
1273         memcpy(features->page1, skb->data + 3, sizeof(features->page1));
1274
1275         /* Read the supported features page2 if required in future.
1276          */
1277         kfree_skb(skb);
1278         return 0;
1279 }
1280
1281 static int btintel_set_debug_features(struct hci_dev *hdev,
1282                                const struct intel_debug_features *features)
1283 {
1284         u8 mask[11] = { 0x0a, 0x92, 0x02, 0x7f, 0x00, 0x00, 0x00, 0x00,
1285                         0x00, 0x00, 0x00 };
1286         u8 period[5] = { 0x04, 0x91, 0x02, 0x05, 0x00 };
1287         u8 trace_enable = 0x02;
1288         struct sk_buff *skb;
1289
1290         if (!features) {
1291                 bt_dev_warn(hdev, "Debug features not read");
1292                 return -EINVAL;
1293         }
1294
1295         if (!(features->page1[0] & 0x3f)) {
1296                 bt_dev_info(hdev, "Telemetry exception format not supported");
1297                 return 0;
1298         }
1299
1300         skb = __hci_cmd_sync(hdev, 0xfc8b, 11, mask, HCI_INIT_TIMEOUT);
1301         if (IS_ERR(skb)) {
1302                 bt_dev_err(hdev, "Setting Intel telemetry ddc write event mask failed (%ld)",
1303                            PTR_ERR(skb));
1304                 return PTR_ERR(skb);
1305         }
1306         kfree_skb(skb);
1307
1308         skb = __hci_cmd_sync(hdev, 0xfc8b, 5, period, HCI_INIT_TIMEOUT);
1309         if (IS_ERR(skb)) {
1310                 bt_dev_err(hdev, "Setting periodicity for link statistics traces failed (%ld)",
1311                            PTR_ERR(skb));
1312                 return PTR_ERR(skb);
1313         }
1314         kfree_skb(skb);
1315
1316         skb = __hci_cmd_sync(hdev, 0xfca1, 1, &trace_enable, HCI_INIT_TIMEOUT);
1317         if (IS_ERR(skb)) {
1318                 bt_dev_err(hdev, "Enable tracing of link statistics events failed (%ld)",
1319                            PTR_ERR(skb));
1320                 return PTR_ERR(skb);
1321         }
1322         kfree_skb(skb);
1323
1324         bt_dev_info(hdev, "set debug features: trace_enable 0x%02x mask 0x%02x",
1325                     trace_enable, mask[3]);
1326
1327         return 0;
1328 }
1329
1330 static int btintel_reset_debug_features(struct hci_dev *hdev,
1331                                  const struct intel_debug_features *features)
1332 {
1333         u8 mask[11] = { 0x0a, 0x92, 0x02, 0x00, 0x00, 0x00, 0x00, 0x00,
1334                         0x00, 0x00, 0x00 };
1335         u8 trace_enable = 0x00;
1336         struct sk_buff *skb;
1337
1338         if (!features) {
1339                 bt_dev_warn(hdev, "Debug features not read");
1340                 return -EINVAL;
1341         }
1342
1343         if (!(features->page1[0] & 0x3f)) {
1344                 bt_dev_info(hdev, "Telemetry exception format not supported");
1345                 return 0;
1346         }
1347
1348         /* Should stop the trace before writing ddc event mask. */
1349         skb = __hci_cmd_sync(hdev, 0xfca1, 1, &trace_enable, HCI_INIT_TIMEOUT);
1350         if (IS_ERR(skb)) {
1351                 bt_dev_err(hdev, "Stop tracing of link statistics events failed (%ld)",
1352                            PTR_ERR(skb));
1353                 return PTR_ERR(skb);
1354         }
1355         kfree_skb(skb);
1356
1357         skb = __hci_cmd_sync(hdev, 0xfc8b, 11, mask, HCI_INIT_TIMEOUT);
1358         if (IS_ERR(skb)) {
1359                 bt_dev_err(hdev, "Setting Intel telemetry ddc write event mask failed (%ld)",
1360                            PTR_ERR(skb));
1361                 return PTR_ERR(skb);
1362         }
1363         kfree_skb(skb);
1364
1365         bt_dev_info(hdev, "reset debug features: trace_enable 0x%02x mask 0x%02x",
1366                     trace_enable, mask[3]);
1367
1368         return 0;
1369 }
1370
1371 int btintel_set_quality_report(struct hci_dev *hdev, bool enable)
1372 {
1373         struct intel_debug_features features;
1374         int err;
1375
1376         bt_dev_dbg(hdev, "enable %d", enable);
1377
1378         /* Read the Intel supported features and if new exception formats
1379          * supported, need to load the additional DDC config to enable.
1380          */
1381         err = btintel_read_debug_features(hdev, &features);
1382         if (err)
1383                 return err;
1384
1385         /* Set or reset the debug features. */
1386         if (enable)
1387                 err = btintel_set_debug_features(hdev, &features);
1388         else
1389                 err = btintel_reset_debug_features(hdev, &features);
1390
1391         return err;
1392 }
1393 EXPORT_SYMBOL_GPL(btintel_set_quality_report);
1394
1395 static const struct firmware *btintel_legacy_rom_get_fw(struct hci_dev *hdev,
1396                                                struct intel_version *ver)
1397 {
1398         const struct firmware *fw;
1399         char fwname[64];
1400         int ret;
1401
1402         snprintf(fwname, sizeof(fwname),
1403                  "intel/ibt-hw-%x.%x.%x-fw-%x.%x.%x.%x.%x.bseq",
1404                  ver->hw_platform, ver->hw_variant, ver->hw_revision,
1405                  ver->fw_variant,  ver->fw_revision, ver->fw_build_num,
1406                  ver->fw_build_ww, ver->fw_build_yy);
1407
1408         ret = request_firmware(&fw, fwname, &hdev->dev);
1409         if (ret < 0) {
1410                 if (ret == -EINVAL) {
1411                         bt_dev_err(hdev, "Intel firmware file request failed (%d)",
1412                                    ret);
1413                         return NULL;
1414                 }
1415
1416                 bt_dev_err(hdev, "failed to open Intel firmware file: %s (%d)",
1417                            fwname, ret);
1418
1419                 /* If the correct firmware patch file is not found, use the
1420                  * default firmware patch file instead
1421                  */
1422                 snprintf(fwname, sizeof(fwname), "intel/ibt-hw-%x.%x.bseq",
1423                          ver->hw_platform, ver->hw_variant);
1424                 if (request_firmware(&fw, fwname, &hdev->dev) < 0) {
1425                         bt_dev_err(hdev, "failed to open default fw file: %s",
1426                                    fwname);
1427                         return NULL;
1428                 }
1429         }
1430
1431         bt_dev_info(hdev, "Intel Bluetooth firmware file: %s", fwname);
1432
1433         return fw;
1434 }
1435
1436 static int btintel_legacy_rom_patching(struct hci_dev *hdev,
1437                                       const struct firmware *fw,
1438                                       const u8 **fw_ptr, int *disable_patch)
1439 {
1440         struct sk_buff *skb;
1441         struct hci_command_hdr *cmd;
1442         const u8 *cmd_param;
1443         struct hci_event_hdr *evt = NULL;
1444         const u8 *evt_param = NULL;
1445         int remain = fw->size - (*fw_ptr - fw->data);
1446
1447         /* The first byte indicates the types of the patch command or event.
1448          * 0x01 means HCI command and 0x02 is HCI event. If the first bytes
1449          * in the current firmware buffer doesn't start with 0x01 or
1450          * the size of remain buffer is smaller than HCI command header,
1451          * the firmware file is corrupted and it should stop the patching
1452          * process.
1453          */
1454         if (remain > HCI_COMMAND_HDR_SIZE && *fw_ptr[0] != 0x01) {
1455                 bt_dev_err(hdev, "Intel fw corrupted: invalid cmd read");
1456                 return -EINVAL;
1457         }
1458         (*fw_ptr)++;
1459         remain--;
1460
1461         cmd = (struct hci_command_hdr *)(*fw_ptr);
1462         *fw_ptr += sizeof(*cmd);
1463         remain -= sizeof(*cmd);
1464
1465         /* Ensure that the remain firmware data is long enough than the length
1466          * of command parameter. If not, the firmware file is corrupted.
1467          */
1468         if (remain < cmd->plen) {
1469                 bt_dev_err(hdev, "Intel fw corrupted: invalid cmd len");
1470                 return -EFAULT;
1471         }
1472
1473         /* If there is a command that loads a patch in the firmware
1474          * file, then enable the patch upon success, otherwise just
1475          * disable the manufacturer mode, for example patch activation
1476          * is not required when the default firmware patch file is used
1477          * because there are no patch data to load.
1478          */
1479         if (*disable_patch && le16_to_cpu(cmd->opcode) == 0xfc8e)
1480                 *disable_patch = 0;
1481
1482         cmd_param = *fw_ptr;
1483         *fw_ptr += cmd->plen;
1484         remain -= cmd->plen;
1485
1486         /* This reads the expected events when the above command is sent to the
1487          * device. Some vendor commands expects more than one events, for
1488          * example command status event followed by vendor specific event.
1489          * For this case, it only keeps the last expected event. so the command
1490          * can be sent with __hci_cmd_sync_ev() which returns the sk_buff of
1491          * last expected event.
1492          */
1493         while (remain > HCI_EVENT_HDR_SIZE && *fw_ptr[0] == 0x02) {
1494                 (*fw_ptr)++;
1495                 remain--;
1496
1497                 evt = (struct hci_event_hdr *)(*fw_ptr);
1498                 *fw_ptr += sizeof(*evt);
1499                 remain -= sizeof(*evt);
1500
1501                 if (remain < evt->plen) {
1502                         bt_dev_err(hdev, "Intel fw corrupted: invalid evt len");
1503                         return -EFAULT;
1504                 }
1505
1506                 evt_param = *fw_ptr;
1507                 *fw_ptr += evt->plen;
1508                 remain -= evt->plen;
1509         }
1510
1511         /* Every HCI commands in the firmware file has its correspond event.
1512          * If event is not found or remain is smaller than zero, the firmware
1513          * file is corrupted.
1514          */
1515         if (!evt || !evt_param || remain < 0) {
1516                 bt_dev_err(hdev, "Intel fw corrupted: invalid evt read");
1517                 return -EFAULT;
1518         }
1519
1520         skb = __hci_cmd_sync_ev(hdev, le16_to_cpu(cmd->opcode), cmd->plen,
1521                                 cmd_param, evt->evt, HCI_INIT_TIMEOUT);
1522         if (IS_ERR(skb)) {
1523                 bt_dev_err(hdev, "sending Intel patch command (0x%4.4x) failed (%ld)",
1524                            cmd->opcode, PTR_ERR(skb));
1525                 return PTR_ERR(skb);
1526         }
1527
1528         /* It ensures that the returned event matches the event data read from
1529          * the firmware file. At fist, it checks the length and then
1530          * the contents of the event.
1531          */
1532         if (skb->len != evt->plen) {
1533                 bt_dev_err(hdev, "mismatch event length (opcode 0x%4.4x)",
1534                            le16_to_cpu(cmd->opcode));
1535                 kfree_skb(skb);
1536                 return -EFAULT;
1537         }
1538
1539         if (memcmp(skb->data, evt_param, evt->plen)) {
1540                 bt_dev_err(hdev, "mismatch event parameter (opcode 0x%4.4x)",
1541                            le16_to_cpu(cmd->opcode));
1542                 kfree_skb(skb);
1543                 return -EFAULT;
1544         }
1545         kfree_skb(skb);
1546
1547         return 0;
1548 }
1549
1550 static int btintel_legacy_rom_setup(struct hci_dev *hdev,
1551                                     struct intel_version *ver)
1552 {
1553         const struct firmware *fw;
1554         const u8 *fw_ptr;
1555         int disable_patch, err;
1556         struct intel_version new_ver;
1557
1558         BT_DBG("%s", hdev->name);
1559
1560         /* fw_patch_num indicates the version of patch the device currently
1561          * have. If there is no patch data in the device, it is always 0x00.
1562          * So, if it is other than 0x00, no need to patch the device again.
1563          */
1564         if (ver->fw_patch_num) {
1565                 bt_dev_info(hdev,
1566                             "Intel device is already patched. patch num: %02x",
1567                             ver->fw_patch_num);
1568                 goto complete;
1569         }
1570
1571         /* Opens the firmware patch file based on the firmware version read
1572          * from the controller. If it fails to open the matching firmware
1573          * patch file, it tries to open the default firmware patch file.
1574          * If no patch file is found, allow the device to operate without
1575          * a patch.
1576          */
1577         fw = btintel_legacy_rom_get_fw(hdev, ver);
1578         if (!fw)
1579                 goto complete;
1580         fw_ptr = fw->data;
1581
1582         /* Enable the manufacturer mode of the controller.
1583          * Only while this mode is enabled, the driver can download the
1584          * firmware patch data and configuration parameters.
1585          */
1586         err = btintel_enter_mfg(hdev);
1587         if (err) {
1588                 release_firmware(fw);
1589                 return err;
1590         }
1591
1592         disable_patch = 1;
1593
1594         /* The firmware data file consists of list of Intel specific HCI
1595          * commands and its expected events. The first byte indicates the
1596          * type of the message, either HCI command or HCI event.
1597          *
1598          * It reads the command and its expected event from the firmware file,
1599          * and send to the controller. Once __hci_cmd_sync_ev() returns,
1600          * the returned event is compared with the event read from the firmware
1601          * file and it will continue until all the messages are downloaded to
1602          * the controller.
1603          *
1604          * Once the firmware patching is completed successfully,
1605          * the manufacturer mode is disabled with reset and activating the
1606          * downloaded patch.
1607          *
1608          * If the firmware patching fails, the manufacturer mode is
1609          * disabled with reset and deactivating the patch.
1610          *
1611          * If the default patch file is used, no reset is done when disabling
1612          * the manufacturer.
1613          */
1614         while (fw->size > fw_ptr - fw->data) {
1615                 int ret;
1616
1617                 ret = btintel_legacy_rom_patching(hdev, fw, &fw_ptr,
1618                                                  &disable_patch);
1619                 if (ret < 0)
1620                         goto exit_mfg_deactivate;
1621         }
1622
1623         release_firmware(fw);
1624
1625         if (disable_patch)
1626                 goto exit_mfg_disable;
1627
1628         /* Patching completed successfully and disable the manufacturer mode
1629          * with reset and activate the downloaded firmware patches.
1630          */
1631         err = btintel_exit_mfg(hdev, true, true);
1632         if (err)
1633                 return err;
1634
1635         /* Need build number for downloaded fw patches in
1636          * every power-on boot
1637          */
1638         err = btintel_read_version(hdev, &new_ver);
1639         if (err)
1640                 return err;
1641
1642         bt_dev_info(hdev, "Intel BT fw patch 0x%02x completed & activated",
1643                     new_ver.fw_patch_num);
1644
1645         goto complete;
1646
1647 exit_mfg_disable:
1648         /* Disable the manufacturer mode without reset */
1649         err = btintel_exit_mfg(hdev, false, false);
1650         if (err)
1651                 return err;
1652
1653         bt_dev_info(hdev, "Intel firmware patch completed");
1654
1655         goto complete;
1656
1657 exit_mfg_deactivate:
1658         release_firmware(fw);
1659
1660         /* Patching failed. Disable the manufacturer mode with reset and
1661          * deactivate the downloaded firmware patches.
1662          */
1663         err = btintel_exit_mfg(hdev, true, false);
1664         if (err)
1665                 return err;
1666
1667         bt_dev_info(hdev, "Intel firmware patch completed and deactivated");
1668
1669 complete:
1670         /* Set the event mask for Intel specific vendor events. This enables
1671          * a few extra events that are useful during general operation.
1672          */
1673         btintel_set_event_mask_mfg(hdev, false);
1674
1675         btintel_check_bdaddr(hdev);
1676
1677         return 0;
1678 }
1679
1680 static int btintel_download_wait(struct hci_dev *hdev, ktime_t calltime, int msec)
1681 {
1682         ktime_t delta, rettime;
1683         unsigned long long duration;
1684         int err;
1685
1686         btintel_set_flag(hdev, INTEL_FIRMWARE_LOADED);
1687
1688         bt_dev_info(hdev, "Waiting for firmware download to complete");
1689
1690         err = btintel_wait_on_flag_timeout(hdev, INTEL_DOWNLOADING,
1691                                            TASK_INTERRUPTIBLE,
1692                                            msecs_to_jiffies(msec));
1693         if (err == -EINTR) {
1694                 bt_dev_err(hdev, "Firmware loading interrupted");
1695                 return err;
1696         }
1697
1698         if (err) {
1699                 bt_dev_err(hdev, "Firmware loading timeout");
1700                 return -ETIMEDOUT;
1701         }
1702
1703         if (btintel_test_flag(hdev, INTEL_FIRMWARE_FAILED)) {
1704                 bt_dev_err(hdev, "Firmware loading failed");
1705                 return -ENOEXEC;
1706         }
1707
1708         rettime = ktime_get();
1709         delta = ktime_sub(rettime, calltime);
1710         duration = (unsigned long long)ktime_to_ns(delta) >> 10;
1711
1712         bt_dev_info(hdev, "Firmware loaded in %llu usecs", duration);
1713
1714         return 0;
1715 }
1716
1717 static int btintel_boot_wait(struct hci_dev *hdev, ktime_t calltime, int msec)
1718 {
1719         ktime_t delta, rettime;
1720         unsigned long long duration;
1721         int err;
1722
1723         bt_dev_info(hdev, "Waiting for device to boot");
1724
1725         err = btintel_wait_on_flag_timeout(hdev, INTEL_BOOTING,
1726                                            TASK_INTERRUPTIBLE,
1727                                            msecs_to_jiffies(msec));
1728         if (err == -EINTR) {
1729                 bt_dev_err(hdev, "Device boot interrupted");
1730                 return -EINTR;
1731         }
1732
1733         if (err) {
1734                 bt_dev_err(hdev, "Device boot timeout");
1735                 return -ETIMEDOUT;
1736         }
1737
1738         rettime = ktime_get();
1739         delta = ktime_sub(rettime, calltime);
1740         duration = (unsigned long long) ktime_to_ns(delta) >> 10;
1741
1742         bt_dev_info(hdev, "Device booted in %llu usecs", duration);
1743
1744         return 0;
1745 }
1746
1747 static int btintel_boot(struct hci_dev *hdev, u32 boot_addr)
1748 {
1749         ktime_t calltime;
1750         int err;
1751
1752         calltime = ktime_get();
1753
1754         btintel_set_flag(hdev, INTEL_BOOTING);
1755
1756         err = btintel_send_intel_reset(hdev, boot_addr);
1757         if (err) {
1758                 bt_dev_err(hdev, "Intel Soft Reset failed (%d)", err);
1759                 btintel_reset_to_bootloader(hdev);
1760                 return err;
1761         }
1762
1763         /* The bootloader will not indicate when the device is ready. This
1764          * is done by the operational firmware sending bootup notification.
1765          *
1766          * Booting into operational firmware should not take longer than
1767          * 1 second. However if that happens, then just fail the setup
1768          * since something went wrong.
1769          */
1770         err = btintel_boot_wait(hdev, calltime, 1000);
1771         if (err == -ETIMEDOUT)
1772                 btintel_reset_to_bootloader(hdev);
1773
1774         return err;
1775 }
1776
1777 static int btintel_get_fw_name(struct intel_version *ver,
1778                                              struct intel_boot_params *params,
1779                                              char *fw_name, size_t len,
1780                                              const char *suffix)
1781 {
1782         switch (ver->hw_variant) {
1783         case 0x0b:      /* SfP */
1784         case 0x0c:      /* WsP */
1785                 snprintf(fw_name, len, "intel/ibt-%u-%u.%s",
1786                         le16_to_cpu(ver->hw_variant),
1787                         le16_to_cpu(params->dev_revid),
1788                         suffix);
1789                 break;
1790         case 0x11:      /* JfP */
1791         case 0x12:      /* ThP */
1792         case 0x13:      /* HrP */
1793         case 0x14:      /* CcP */
1794                 snprintf(fw_name, len, "intel/ibt-%u-%u-%u.%s",
1795                         le16_to_cpu(ver->hw_variant),
1796                         le16_to_cpu(ver->hw_revision),
1797                         le16_to_cpu(ver->fw_revision),
1798                         suffix);
1799                 break;
1800         default:
1801                 return -EINVAL;
1802         }
1803
1804         return 0;
1805 }
1806
1807 static int btintel_download_fw(struct hci_dev *hdev,
1808                                          struct intel_version *ver,
1809                                          struct intel_boot_params *params,
1810                                          u32 *boot_param)
1811 {
1812         const struct firmware *fw;
1813         char fwname[64];
1814         int err;
1815         ktime_t calltime;
1816
1817         if (!ver || !params)
1818                 return -EINVAL;
1819
1820         /* The firmware variant determines if the device is in bootloader
1821          * mode or is running operational firmware. The value 0x06 identifies
1822          * the bootloader and the value 0x23 identifies the operational
1823          * firmware.
1824          *
1825          * When the operational firmware is already present, then only
1826          * the check for valid Bluetooth device address is needed. This
1827          * determines if the device will be added as configured or
1828          * unconfigured controller.
1829          *
1830          * It is not possible to use the Secure Boot Parameters in this
1831          * case since that command is only available in bootloader mode.
1832          */
1833         if (ver->fw_variant == 0x23) {
1834                 btintel_clear_flag(hdev, INTEL_BOOTLOADER);
1835                 btintel_check_bdaddr(hdev);
1836
1837                 /* SfP and WsP don't seem to update the firmware version on file
1838                  * so version checking is currently possible.
1839                  */
1840                 switch (ver->hw_variant) {
1841                 case 0x0b:      /* SfP */
1842                 case 0x0c:      /* WsP */
1843                         return 0;
1844                 }
1845
1846                 /* Proceed to download to check if the version matches */
1847                 goto download;
1848         }
1849
1850         /* Read the secure boot parameters to identify the operating
1851          * details of the bootloader.
1852          */
1853         err = btintel_read_boot_params(hdev, params);
1854         if (err)
1855                 return err;
1856
1857         /* It is required that every single firmware fragment is acknowledged
1858          * with a command complete event. If the boot parameters indicate
1859          * that this bootloader does not send them, then abort the setup.
1860          */
1861         if (params->limited_cce != 0x00) {
1862                 bt_dev_err(hdev, "Unsupported Intel firmware loading method (%u)",
1863                            params->limited_cce);
1864                 return -EINVAL;
1865         }
1866
1867         /* If the OTP has no valid Bluetooth device address, then there will
1868          * also be no valid address for the operational firmware.
1869          */
1870         if (!bacmp(&params->otp_bdaddr, BDADDR_ANY)) {
1871                 bt_dev_info(hdev, "No device address configured");
1872                 set_bit(HCI_QUIRK_INVALID_BDADDR, &hdev->quirks);
1873         }
1874
1875 download:
1876         /* With this Intel bootloader only the hardware variant and device
1877          * revision information are used to select the right firmware for SfP
1878          * and WsP.
1879          *
1880          * The firmware filename is ibt-<hw_variant>-<dev_revid>.sfi.
1881          *
1882          * Currently the supported hardware variants are:
1883          *   11 (0x0b) for iBT3.0 (LnP/SfP)
1884          *   12 (0x0c) for iBT3.5 (WsP)
1885          *
1886          * For ThP/JfP and for future SKU's, the FW name varies based on HW
1887          * variant, HW revision and FW revision, as these are dependent on CNVi
1888          * and RF Combination.
1889          *
1890          *   17 (0x11) for iBT3.5 (JfP)
1891          *   18 (0x12) for iBT3.5 (ThP)
1892          *
1893          * The firmware file name for these will be
1894          * ibt-<hw_variant>-<hw_revision>-<fw_revision>.sfi.
1895          *
1896          */
1897         err = btintel_get_fw_name(ver, params, fwname, sizeof(fwname), "sfi");
1898         if (err < 0) {
1899                 if (!btintel_test_flag(hdev, INTEL_BOOTLOADER)) {
1900                         /* Firmware has already been loaded */
1901                         btintel_set_flag(hdev, INTEL_FIRMWARE_LOADED);
1902                         return 0;
1903                 }
1904
1905                 bt_dev_err(hdev, "Unsupported Intel firmware naming");
1906                 return -EINVAL;
1907         }
1908
1909         err = firmware_request_nowarn(&fw, fwname, &hdev->dev);
1910         if (err < 0) {
1911                 if (!btintel_test_flag(hdev, INTEL_BOOTLOADER)) {
1912                         /* Firmware has already been loaded */
1913                         btintel_set_flag(hdev, INTEL_FIRMWARE_LOADED);
1914                         return 0;
1915                 }
1916
1917                 bt_dev_err(hdev, "Failed to load Intel firmware file %s (%d)",
1918                            fwname, err);
1919                 return err;
1920         }
1921
1922         bt_dev_info(hdev, "Found device firmware: %s", fwname);
1923
1924         if (fw->size < 644) {
1925                 bt_dev_err(hdev, "Invalid size of firmware file (%zu)",
1926                            fw->size);
1927                 err = -EBADF;
1928                 goto done;
1929         }
1930
1931         calltime = ktime_get();
1932
1933         btintel_set_flag(hdev, INTEL_DOWNLOADING);
1934
1935         /* Start firmware downloading and get boot parameter */
1936         err = btintel_download_firmware(hdev, ver, fw, boot_param);
1937         if (err < 0) {
1938                 if (err == -EALREADY) {
1939                         /* Firmware has already been loaded */
1940                         btintel_set_flag(hdev, INTEL_FIRMWARE_LOADED);
1941                         err = 0;
1942                         goto done;
1943                 }
1944
1945                 /* When FW download fails, send Intel Reset to retry
1946                  * FW download.
1947                  */
1948                 btintel_reset_to_bootloader(hdev);
1949                 goto done;
1950         }
1951
1952         /* Before switching the device into operational mode and with that
1953          * booting the loaded firmware, wait for the bootloader notification
1954          * that all fragments have been successfully received.
1955          *
1956          * When the event processing receives the notification, then the
1957          * INTEL_DOWNLOADING flag will be cleared.
1958          *
1959          * The firmware loading should not take longer than 5 seconds
1960          * and thus just timeout if that happens and fail the setup
1961          * of this device.
1962          */
1963         err = btintel_download_wait(hdev, calltime, 5000);
1964         if (err == -ETIMEDOUT)
1965                 btintel_reset_to_bootloader(hdev);
1966
1967 done:
1968         release_firmware(fw);
1969         return err;
1970 }
1971
1972 static int btintel_bootloader_setup(struct hci_dev *hdev,
1973                                     struct intel_version *ver)
1974 {
1975         struct intel_version new_ver;
1976         struct intel_boot_params params;
1977         u32 boot_param;
1978         char ddcname[64];
1979         int err;
1980
1981         BT_DBG("%s", hdev->name);
1982
1983         /* Set the default boot parameter to 0x0 and it is updated to
1984          * SKU specific boot parameter after reading Intel_Write_Boot_Params
1985          * command while downloading the firmware.
1986          */
1987         boot_param = 0x00000000;
1988
1989         btintel_set_flag(hdev, INTEL_BOOTLOADER);
1990
1991         err = btintel_download_fw(hdev, ver, &params, &boot_param);
1992         if (err)
1993                 return err;
1994
1995         /* controller is already having an operational firmware */
1996         if (ver->fw_variant == 0x23)
1997                 goto finish;
1998
1999         err = btintel_boot(hdev, boot_param);
2000         if (err)
2001                 return err;
2002
2003         btintel_clear_flag(hdev, INTEL_BOOTLOADER);
2004
2005         err = btintel_get_fw_name(ver, &params, ddcname,
2006                                                 sizeof(ddcname), "ddc");
2007
2008         if (err < 0) {
2009                 bt_dev_err(hdev, "Unsupported Intel firmware naming");
2010         } else {
2011                 /* Once the device is running in operational mode, it needs to
2012                  * apply the device configuration (DDC) parameters.
2013                  *
2014                  * The device can work without DDC parameters, so even if it
2015                  * fails to load the file, no need to fail the setup.
2016                  */
2017                 btintel_load_ddc_config(hdev, ddcname);
2018         }
2019
2020         hci_dev_clear_flag(hdev, HCI_QUALITY_REPORT);
2021
2022         /* Read the Intel version information after loading the FW  */
2023         err = btintel_read_version(hdev, &new_ver);
2024         if (err)
2025                 return err;
2026
2027         btintel_version_info(hdev, &new_ver);
2028
2029 finish:
2030         /* Set the event mask for Intel specific vendor events. This enables
2031          * a few extra events that are useful during general operation. It
2032          * does not enable any debugging related events.
2033          *
2034          * The device will function correctly without these events enabled
2035          * and thus no need to fail the setup.
2036          */
2037         btintel_set_event_mask(hdev, false);
2038
2039         return 0;
2040 }
2041
2042 static void btintel_get_fw_name_tlv(const struct intel_version_tlv *ver,
2043                                     char *fw_name, size_t len,
2044                                     const char *suffix)
2045 {
2046         /* The firmware file name for new generation controllers will be
2047          * ibt-<cnvi_top type+cnvi_top step>-<cnvr_top type+cnvr_top step>
2048          */
2049         snprintf(fw_name, len, "intel/ibt-%04x-%04x.%s",
2050                  INTEL_CNVX_TOP_PACK_SWAB(INTEL_CNVX_TOP_TYPE(ver->cnvi_top),
2051                                           INTEL_CNVX_TOP_STEP(ver->cnvi_top)),
2052                  INTEL_CNVX_TOP_PACK_SWAB(INTEL_CNVX_TOP_TYPE(ver->cnvr_top),
2053                                           INTEL_CNVX_TOP_STEP(ver->cnvr_top)),
2054                  suffix);
2055 }
2056
2057 static int btintel_prepare_fw_download_tlv(struct hci_dev *hdev,
2058                                            struct intel_version_tlv *ver,
2059                                            u32 *boot_param)
2060 {
2061         const struct firmware *fw;
2062         char fwname[64];
2063         int err;
2064         ktime_t calltime;
2065
2066         if (!ver || !boot_param)
2067                 return -EINVAL;
2068
2069         /* The firmware variant determines if the device is in bootloader
2070          * mode or is running operational firmware. The value 0x03 identifies
2071          * the bootloader and the value 0x23 identifies the operational
2072          * firmware.
2073          *
2074          * When the operational firmware is already present, then only
2075          * the check for valid Bluetooth device address is needed. This
2076          * determines if the device will be added as configured or
2077          * unconfigured controller.
2078          *
2079          * It is not possible to use the Secure Boot Parameters in this
2080          * case since that command is only available in bootloader mode.
2081          */
2082         if (ver->img_type == 0x03) {
2083                 btintel_clear_flag(hdev, INTEL_BOOTLOADER);
2084                 btintel_check_bdaddr(hdev);
2085         } else {
2086                 /*
2087                  * Check for valid bd address in boot loader mode. Device
2088                  * will be marked as unconfigured if empty bd address is
2089                  * found.
2090                  */
2091                 if (!bacmp(&ver->otp_bd_addr, BDADDR_ANY)) {
2092                         bt_dev_info(hdev, "No device address configured");
2093                         set_bit(HCI_QUIRK_INVALID_BDADDR, &hdev->quirks);
2094                 }
2095         }
2096
2097         btintel_get_fw_name_tlv(ver, fwname, sizeof(fwname), "sfi");
2098         err = firmware_request_nowarn(&fw, fwname, &hdev->dev);
2099         if (err < 0) {
2100                 if (!btintel_test_flag(hdev, INTEL_BOOTLOADER)) {
2101                         /* Firmware has already been loaded */
2102                         btintel_set_flag(hdev, INTEL_FIRMWARE_LOADED);
2103                         return 0;
2104                 }
2105
2106                 bt_dev_err(hdev, "Failed to load Intel firmware file %s (%d)",
2107                            fwname, err);
2108
2109                 return err;
2110         }
2111
2112         bt_dev_info(hdev, "Found device firmware: %s", fwname);
2113
2114         if (fw->size < 644) {
2115                 bt_dev_err(hdev, "Invalid size of firmware file (%zu)",
2116                            fw->size);
2117                 err = -EBADF;
2118                 goto done;
2119         }
2120
2121         calltime = ktime_get();
2122
2123         btintel_set_flag(hdev, INTEL_DOWNLOADING);
2124
2125         /* Start firmware downloading and get boot parameter */
2126         err = btintel_download_fw_tlv(hdev, ver, fw, boot_param,
2127                                                INTEL_HW_VARIANT(ver->cnvi_bt),
2128                                                ver->sbe_type);
2129         if (err < 0) {
2130                 if (err == -EALREADY) {
2131                         /* Firmware has already been loaded */
2132                         btintel_set_flag(hdev, INTEL_FIRMWARE_LOADED);
2133                         err = 0;
2134                         goto done;
2135                 }
2136
2137                 /* When FW download fails, send Intel Reset to retry
2138                  * FW download.
2139                  */
2140                 btintel_reset_to_bootloader(hdev);
2141                 goto done;
2142         }
2143
2144         /* Before switching the device into operational mode and with that
2145          * booting the loaded firmware, wait for the bootloader notification
2146          * that all fragments have been successfully received.
2147          *
2148          * When the event processing receives the notification, then the
2149          * BTUSB_DOWNLOADING flag will be cleared.
2150          *
2151          * The firmware loading should not take longer than 5 seconds
2152          * and thus just timeout if that happens and fail the setup
2153          * of this device.
2154          */
2155         err = btintel_download_wait(hdev, calltime, 5000);
2156         if (err == -ETIMEDOUT)
2157                 btintel_reset_to_bootloader(hdev);
2158
2159 done:
2160         release_firmware(fw);
2161         return err;
2162 }
2163
2164 static int btintel_get_codec_config_data(struct hci_dev *hdev,
2165                                          __u8 link, struct bt_codec *codec,
2166                                          __u8 *ven_len, __u8 **ven_data)
2167 {
2168         int err = 0;
2169
2170         if (!ven_data || !ven_len)
2171                 return -EINVAL;
2172
2173         *ven_len = 0;
2174         *ven_data = NULL;
2175
2176         if (link != ESCO_LINK) {
2177                 bt_dev_err(hdev, "Invalid link type(%u)", link);
2178                 return -EINVAL;
2179         }
2180
2181         *ven_data = kmalloc(sizeof(__u8), GFP_KERNEL);
2182         if (!*ven_data) {
2183                 err = -ENOMEM;
2184                 goto error;
2185         }
2186
2187         /* supports only CVSD and mSBC offload codecs */
2188         switch (codec->id) {
2189         case 0x02:
2190                 **ven_data = 0x00;
2191                 break;
2192         case 0x05:
2193                 **ven_data = 0x01;
2194                 break;
2195         default:
2196                 err = -EINVAL;
2197                 bt_dev_err(hdev, "Invalid codec id(%u)", codec->id);
2198                 goto error;
2199         }
2200         /* codec and its capabilities are pre-defined to ids
2201          * preset id = 0x00 represents CVSD codec with sampling rate 8K
2202          * preset id = 0x01 represents mSBC codec with sampling rate 16K
2203          */
2204         *ven_len = sizeof(__u8);
2205         return err;
2206
2207 error:
2208         kfree(*ven_data);
2209         *ven_data = NULL;
2210         return err;
2211 }
2212
2213 static int btintel_get_data_path_id(struct hci_dev *hdev, __u8 *data_path_id)
2214 {
2215         /* Intel uses 1 as data path id for all the usecases */
2216         *data_path_id = 1;
2217         return 0;
2218 }
2219
2220 static int btintel_configure_offload(struct hci_dev *hdev)
2221 {
2222         struct sk_buff *skb;
2223         int err = 0;
2224         struct intel_offload_use_cases *use_cases;
2225
2226         skb = __hci_cmd_sync(hdev, 0xfc86, 0, NULL, HCI_INIT_TIMEOUT);
2227         if (IS_ERR(skb)) {
2228                 bt_dev_err(hdev, "Reading offload use cases failed (%ld)",
2229                            PTR_ERR(skb));
2230                 return PTR_ERR(skb);
2231         }
2232
2233         if (skb->len < sizeof(*use_cases)) {
2234                 err = -EIO;
2235                 goto error;
2236         }
2237
2238         use_cases = (void *)skb->data;
2239
2240         if (use_cases->status) {
2241                 err = -bt_to_errno(skb->data[0]);
2242                 goto error;
2243         }
2244
2245         if (use_cases->preset[0] & 0x03) {
2246                 hdev->get_data_path_id = btintel_get_data_path_id;
2247                 hdev->get_codec_config_data = btintel_get_codec_config_data;
2248         }
2249 error:
2250         kfree_skb(skb);
2251         return err;
2252 }
2253
2254 static int btintel_bootloader_setup_tlv(struct hci_dev *hdev,
2255                                         struct intel_version_tlv *ver)
2256 {
2257         u32 boot_param;
2258         char ddcname[64];
2259         int err;
2260         struct intel_version_tlv new_ver;
2261
2262         bt_dev_dbg(hdev, "");
2263
2264         /* Set the default boot parameter to 0x0 and it is updated to
2265          * SKU specific boot parameter after reading Intel_Write_Boot_Params
2266          * command while downloading the firmware.
2267          */
2268         boot_param = 0x00000000;
2269
2270         btintel_set_flag(hdev, INTEL_BOOTLOADER);
2271
2272         err = btintel_prepare_fw_download_tlv(hdev, ver, &boot_param);
2273         if (err)
2274                 return err;
2275
2276         /* check if controller is already having an operational firmware */
2277         if (ver->img_type == 0x03)
2278                 goto finish;
2279
2280         err = btintel_boot(hdev, boot_param);
2281         if (err)
2282                 return err;
2283
2284         btintel_clear_flag(hdev, INTEL_BOOTLOADER);
2285
2286         btintel_get_fw_name_tlv(ver, ddcname, sizeof(ddcname), "ddc");
2287         /* Once the device is running in operational mode, it needs to
2288          * apply the device configuration (DDC) parameters.
2289          *
2290          * The device can work without DDC parameters, so even if it
2291          * fails to load the file, no need to fail the setup.
2292          */
2293         btintel_load_ddc_config(hdev, ddcname);
2294
2295         /* Read supported use cases and set callbacks to fetch datapath id */
2296         btintel_configure_offload(hdev);
2297
2298         hci_dev_clear_flag(hdev, HCI_QUALITY_REPORT);
2299
2300         /* Read the Intel version information after loading the FW  */
2301         err = btintel_read_version_tlv(hdev, &new_ver);
2302         if (err)
2303                 return err;
2304
2305         btintel_version_info_tlv(hdev, &new_ver);
2306
2307 finish:
2308         /* Set the event mask for Intel specific vendor events. This enables
2309          * a few extra events that are useful during general operation. It
2310          * does not enable any debugging related events.
2311          *
2312          * The device will function correctly without these events enabled
2313          * and thus no need to fail the setup.
2314          */
2315         btintel_set_event_mask(hdev, false);
2316
2317         return 0;
2318 }
2319
2320 static void btintel_set_msft_opcode(struct hci_dev *hdev, u8 hw_variant)
2321 {
2322         switch (hw_variant) {
2323         /* Legacy bootloader devices that supports MSFT Extension */
2324         case 0x11:      /* JfP */
2325         case 0x12:      /* ThP */
2326         case 0x13:      /* HrP */
2327         case 0x14:      /* CcP */
2328         /* All Intel new genration controllers support the Microsoft vendor
2329          * extension are using 0xFC1E for VsMsftOpCode.
2330          */
2331         case 0x17:
2332         case 0x18:
2333         case 0x19:
2334         case 0x1b:
2335                 hci_set_msft_opcode(hdev, 0xFC1E);
2336                 break;
2337         default:
2338                 /* Not supported */
2339                 break;
2340         }
2341 }
2342
2343 static int btintel_setup_combined(struct hci_dev *hdev)
2344 {
2345         const u8 param[1] = { 0xFF };
2346         struct intel_version ver;
2347         struct intel_version_tlv ver_tlv;
2348         struct sk_buff *skb;
2349         int err;
2350
2351         BT_DBG("%s", hdev->name);
2352
2353         /* The some controllers have a bug with the first HCI command sent to it
2354          * returning number of completed commands as zero. This would stall the
2355          * command processing in the Bluetooth core.
2356          *
2357          * As a workaround, send HCI Reset command first which will reset the
2358          * number of completed commands and allow normal command processing
2359          * from now on.
2360          *
2361          * Regarding the INTEL_BROKEN_SHUTDOWN_LED flag, these devices maybe
2362          * in the SW_RFKILL ON state as a workaround of fixing LED issue during
2363          * the shutdown() procedure, and once the device is in SW_RFKILL ON
2364          * state, the only way to exit out of it is sending the HCI_Reset
2365          * command.
2366          */
2367         if (btintel_test_flag(hdev, INTEL_BROKEN_INITIAL_NCMD) ||
2368             btintel_test_flag(hdev, INTEL_BROKEN_SHUTDOWN_LED)) {
2369                 skb = __hci_cmd_sync(hdev, HCI_OP_RESET, 0, NULL,
2370                                      HCI_INIT_TIMEOUT);
2371                 if (IS_ERR(skb)) {
2372                         bt_dev_err(hdev,
2373                                    "sending initial HCI reset failed (%ld)",
2374                                    PTR_ERR(skb));
2375                         return PTR_ERR(skb);
2376                 }
2377                 kfree_skb(skb);
2378         }
2379
2380         /* Starting from TyP device, the command parameter and response are
2381          * changed even though the OCF for HCI_Intel_Read_Version command
2382          * remains same. The legacy devices can handle even if the
2383          * command has a parameter and returns a correct version information.
2384          * So, it uses new format to support both legacy and new format.
2385          */
2386         skb = __hci_cmd_sync(hdev, 0xfc05, 1, param, HCI_CMD_TIMEOUT);
2387         if (IS_ERR(skb)) {
2388                 bt_dev_err(hdev, "Reading Intel version command failed (%ld)",
2389                            PTR_ERR(skb));
2390                 return PTR_ERR(skb);
2391         }
2392
2393         /* Check the status */
2394         if (skb->data[0]) {
2395                 bt_dev_err(hdev, "Intel Read Version command failed (%02x)",
2396                            skb->data[0]);
2397                 err = -EIO;
2398                 goto exit_error;
2399         }
2400
2401         /* Apply the common HCI quirks for Intel device */
2402         set_bit(HCI_QUIRK_STRICT_DUPLICATE_FILTER, &hdev->quirks);
2403         set_bit(HCI_QUIRK_SIMULTANEOUS_DISCOVERY, &hdev->quirks);
2404         set_bit(HCI_QUIRK_NON_PERSISTENT_DIAG, &hdev->quirks);
2405
2406         /* Set up the quality report callback for Intel devices */
2407         hdev->set_quality_report = btintel_set_quality_report;
2408
2409         /* For Legacy device, check the HW platform value and size */
2410         if (skb->len == sizeof(ver) && skb->data[1] == 0x37) {
2411                 bt_dev_dbg(hdev, "Read the legacy Intel version information");
2412
2413                 memcpy(&ver, skb->data, sizeof(ver));
2414
2415                 /* Display version information */
2416                 btintel_version_info(hdev, &ver);
2417
2418                 /* Check for supported iBT hardware variants of this firmware
2419                  * loading method.
2420                  *
2421                  * This check has been put in place to ensure correct forward
2422                  * compatibility options when newer hardware variants come
2423                  * along.
2424                  */
2425                 switch (ver.hw_variant) {
2426                 case 0x07:      /* WP */
2427                 case 0x08:      /* StP */
2428                         /* Legacy ROM product */
2429                         btintel_set_flag(hdev, INTEL_ROM_LEGACY);
2430
2431                         /* Apply the device specific HCI quirks
2432                          *
2433                          * WBS for SdP - For the Legacy ROM products, only SdP
2434                          * supports the WBS. But the version information is not
2435                          * enough to use here because the StP2 and SdP have same
2436                          * hw_variant and fw_variant. So, this flag is set by
2437                          * the transport driver (btusb) based on the HW info
2438                          * (idProduct)
2439                          */
2440                         if (!btintel_test_flag(hdev,
2441                                                INTEL_ROM_LEGACY_NO_WBS_SUPPORT))
2442                                 set_bit(HCI_QUIRK_WIDEBAND_SPEECH_SUPPORTED,
2443                                         &hdev->quirks);
2444                         if (ver.hw_variant == 0x08 && ver.fw_variant == 0x22)
2445                                 set_bit(HCI_QUIRK_VALID_LE_STATES,
2446                                         &hdev->quirks);
2447
2448                         err = btintel_legacy_rom_setup(hdev, &ver);
2449                         break;
2450                 case 0x0b:      /* SfP */
2451                 case 0x11:      /* JfP */
2452                 case 0x12:      /* ThP */
2453                 case 0x13:      /* HrP */
2454                 case 0x14:      /* CcP */
2455                         set_bit(HCI_QUIRK_VALID_LE_STATES, &hdev->quirks);
2456                         fallthrough;
2457                 case 0x0c:      /* WsP */
2458                         /* Apply the device specific HCI quirks
2459                          *
2460                          * All Legacy bootloader devices support WBS
2461                          */
2462                         set_bit(HCI_QUIRK_WIDEBAND_SPEECH_SUPPORTED,
2463                                 &hdev->quirks);
2464
2465                         /* Setup MSFT Extension support */
2466                         btintel_set_msft_opcode(hdev, ver.hw_variant);
2467
2468                         err = btintel_bootloader_setup(hdev, &ver);
2469                         break;
2470                 default:
2471                         bt_dev_err(hdev, "Unsupported Intel hw variant (%u)",
2472                                    ver.hw_variant);
2473                         err = -EINVAL;
2474                 }
2475
2476                 goto exit_error;
2477         }
2478
2479         /* memset ver_tlv to start with clean state as few fields are exclusive
2480          * to bootloader mode and are not populated in operational mode
2481          */
2482         memset(&ver_tlv, 0, sizeof(ver_tlv));
2483         /* For TLV type device, parse the tlv data */
2484         err = btintel_parse_version_tlv(hdev, &ver_tlv, skb);
2485         if (err) {
2486                 bt_dev_err(hdev, "Failed to parse TLV version information");
2487                 goto exit_error;
2488         }
2489
2490         if (INTEL_HW_PLATFORM(ver_tlv.cnvi_bt) != 0x37) {
2491                 bt_dev_err(hdev, "Unsupported Intel hardware platform (0x%2x)",
2492                            INTEL_HW_PLATFORM(ver_tlv.cnvi_bt));
2493                 err = -EINVAL;
2494                 goto exit_error;
2495         }
2496
2497         /* Check for supported iBT hardware variants of this firmware
2498          * loading method.
2499          *
2500          * This check has been put in place to ensure correct forward
2501          * compatibility options when newer hardware variants come
2502          * along.
2503          */
2504         switch (INTEL_HW_VARIANT(ver_tlv.cnvi_bt)) {
2505         case 0x11:      /* JfP */
2506         case 0x12:      /* ThP */
2507         case 0x13:      /* HrP */
2508         case 0x14:      /* CcP */
2509                 /* Some legacy bootloader devices starting from JfP,
2510                  * the operational firmware supports both old and TLV based
2511                  * HCI_Intel_Read_Version command based on the command
2512                  * parameter.
2513                  *
2514                  * For upgrading firmware case, the TLV based version cannot
2515                  * be used because the firmware filename for legacy bootloader
2516                  * is based on the old format.
2517                  *
2518                  * Also, it is not easy to convert TLV based version from the
2519                  * legacy version format.
2520                  *
2521                  * So, as a workaround for those devices, use the legacy
2522                  * HCI_Intel_Read_Version to get the version information and
2523                  * run the legacy bootloader setup.
2524                  */
2525                 err = btintel_read_version(hdev, &ver);
2526                 if (err)
2527                         break;
2528
2529                 /* Apply the device specific HCI quirks
2530                  *
2531                  * All Legacy bootloader devices support WBS
2532                  */
2533                 set_bit(HCI_QUIRK_WIDEBAND_SPEECH_SUPPORTED, &hdev->quirks);
2534
2535                 /* Set Valid LE States quirk */
2536                 set_bit(HCI_QUIRK_VALID_LE_STATES, &hdev->quirks);
2537
2538                 /* Setup MSFT Extension support */
2539                 btintel_set_msft_opcode(hdev, ver.hw_variant);
2540
2541                 err = btintel_bootloader_setup(hdev, &ver);
2542                 break;
2543         case 0x17:
2544         case 0x18:
2545         case 0x19:
2546         case 0x1b:
2547                 /* Display version information of TLV type */
2548                 btintel_version_info_tlv(hdev, &ver_tlv);
2549
2550                 /* Apply the device specific HCI quirks for TLV based devices
2551                  *
2552                  * All TLV based devices support WBS
2553                  */
2554                 set_bit(HCI_QUIRK_WIDEBAND_SPEECH_SUPPORTED, &hdev->quirks);
2555
2556                 /* Valid LE States quirk for GfP */
2557                 if (INTEL_HW_VARIANT(ver_tlv.cnvi_bt) == 0x18)
2558                         set_bit(HCI_QUIRK_VALID_LE_STATES, &hdev->quirks);
2559
2560                 /* Setup MSFT Extension support */
2561                 btintel_set_msft_opcode(hdev,
2562                                         INTEL_HW_VARIANT(ver_tlv.cnvi_bt));
2563
2564                 err = btintel_bootloader_setup_tlv(hdev, &ver_tlv);
2565                 break;
2566         default:
2567                 bt_dev_err(hdev, "Unsupported Intel hw variant (%u)",
2568                            INTEL_HW_VARIANT(ver_tlv.cnvi_bt));
2569                 err = -EINVAL;
2570                 break;
2571         }
2572
2573 exit_error:
2574         kfree_skb(skb);
2575
2576         return err;
2577 }
2578
2579 static int btintel_shutdown_combined(struct hci_dev *hdev)
2580 {
2581         struct sk_buff *skb;
2582         int ret;
2583
2584         /* Send HCI Reset to the controller to stop any BT activity which
2585          * were triggered. This will help to save power and maintain the
2586          * sync b/w Host and controller
2587          */
2588         skb = __hci_cmd_sync(hdev, HCI_OP_RESET, 0, NULL, HCI_INIT_TIMEOUT);
2589         if (IS_ERR(skb)) {
2590                 bt_dev_err(hdev, "HCI reset during shutdown failed");
2591                 return PTR_ERR(skb);
2592         }
2593         kfree_skb(skb);
2594
2595
2596         /* Some platforms have an issue with BT LED when the interface is
2597          * down or BT radio is turned off, which takes 5 seconds to BT LED
2598          * goes off. As a workaround, sends HCI_Intel_SW_RFKILL to put the
2599          * device in the RFKILL ON state which turns off the BT LED immediately.
2600          */
2601         if (btintel_test_flag(hdev, INTEL_BROKEN_SHUTDOWN_LED)) {
2602                 skb = __hci_cmd_sync(hdev, 0xfc3f, 0, NULL, HCI_INIT_TIMEOUT);
2603                 if (IS_ERR(skb)) {
2604                         ret = PTR_ERR(skb);
2605                         bt_dev_err(hdev, "turning off Intel device LED failed");
2606                         return ret;
2607                 }
2608                 kfree_skb(skb);
2609         }
2610
2611         return 0;
2612 }
2613
2614 int btintel_configure_setup(struct hci_dev *hdev)
2615 {
2616         hdev->manufacturer = 2;
2617         hdev->setup = btintel_setup_combined;
2618         hdev->shutdown = btintel_shutdown_combined;
2619         hdev->hw_error = btintel_hw_error;
2620         hdev->set_diag = btintel_set_diag_combined;
2621         hdev->set_bdaddr = btintel_set_bdaddr;
2622
2623         return 0;
2624 }
2625 EXPORT_SYMBOL_GPL(btintel_configure_setup);
2626
2627 void btintel_bootup(struct hci_dev *hdev, const void *ptr, unsigned int len)
2628 {
2629         const struct intel_bootup *evt = ptr;
2630
2631         if (len != sizeof(*evt))
2632                 return;
2633
2634         if (btintel_test_and_clear_flag(hdev, INTEL_BOOTING))
2635                 btintel_wake_up_flag(hdev, INTEL_BOOTING);
2636 }
2637 EXPORT_SYMBOL_GPL(btintel_bootup);
2638
2639 void btintel_secure_send_result(struct hci_dev *hdev,
2640                                 const void *ptr, unsigned int len)
2641 {
2642         const struct intel_secure_send_result *evt = ptr;
2643
2644         if (len != sizeof(*evt))
2645                 return;
2646
2647         if (evt->result)
2648                 btintel_set_flag(hdev, INTEL_FIRMWARE_FAILED);
2649
2650         if (btintel_test_and_clear_flag(hdev, INTEL_DOWNLOADING) &&
2651             btintel_test_flag(hdev, INTEL_FIRMWARE_LOADED))
2652                 btintel_wake_up_flag(hdev, INTEL_DOWNLOADING);
2653 }
2654 EXPORT_SYMBOL_GPL(btintel_secure_send_result);
2655
2656 MODULE_AUTHOR("Marcel Holtmann <marcel@holtmann.org>");
2657 MODULE_DESCRIPTION("Bluetooth support for Intel devices ver " VERSION);
2658 MODULE_VERSION(VERSION);
2659 MODULE_LICENSE("GPL");
2660 MODULE_FIRMWARE("intel/ibt-11-5.sfi");
2661 MODULE_FIRMWARE("intel/ibt-11-5.ddc");
2662 MODULE_FIRMWARE("intel/ibt-12-16.sfi");
2663 MODULE_FIRMWARE("intel/ibt-12-16.ddc");