btintel.c 27 KB

1234567891011121314151617181920212223242526272829303132333435363738394041424344454647484950515253545556575859606162636465666768697071727374757677787980818283848586878889909192939495969798991001011021031041051061071081091101111121131141151161171181191201211221231241251261271281291301311321331341351361371381391401411421431441451461471481491501511521531541551561571581591601611621631641651661671681691701711721731741751761771781791801811821831841851861871881891901911921931941951961971981992002012022032042052062072082092102112122132142152162172182192202212222232242252262272282292302312322332342352362372382392402412422432442452462472482492502512522532542552562572582592602612622632642652662672682692702712722732742752762772782792802812822832842852862872882892902912922932942952962972982993003013023033043053063073083093103113123133143153163173183193203213223233243253263273283293303313323333343353363373383393403413423433443453463473483493503513523533543553563573583593603613623633643653663673683693703713723733743753763773783793803813823833843853863873883893903913923933943953963973983994004014024034044054064074084094104114124134144154164174184194204214224234244254264274284294304314324334344354364374384394404414424434444454464474484494504514524534544554564574584594604614624634644654664674684694704714724734744754764774784794804814824834844854864874884894904914924934944954964974984995005015025035045055065075085095105115125135145155165175185195205215225235245255265275285295305315325335345355365375385395405415425435445455465475485495505515525535545555565575585595605615625635645655665675685695705715725735745755765775785795805815825835845855865875885895905915925935945955965975985996006016026036046056066076086096106116126136146156166176186196206216226236246256266276286296306316326336346356366376386396406416426436446456466476486496506516526536546556566576586596606616626636646656666676686696706716726736746756766776786796806816826836846856866876886896906916926936946956966976986997007017027037047057067077087097107117127137147157167177187197207217227237247257267277287297307317327337347357367377387397407417427437447457467477487497507517527537547557567577587597607617627637647657667677687697707717727737747757767777787797807817827837847857867877887897907917927937947957967977987998008018028038048058068078088098108118128138148158168178188198208218228238248258268278288298308318328338348358368378388398408418428438448458468478488498508518528538548558568578588598608618628638648658668678688698708718728738748758768778788798808818828838848858868878888898908918928938948958968978988999009019029039049059069079089099109119129139149159169179189199209219229239249259269279289299309319329339349359369379389399409419429439449459469479489499509519529539549559569579589599609619629639649659669679689699709719729739749759769779789799809819829839849859869879889899909919929939949959969979989991000100110021003100410051006100710081009101010111012101310141015101610171018101910201021102210231024102510261027102810291030103110321033103410351036103710381039104010411042104310441045104610471048104910501051105210531054105510561057105810591060106110621063106410651066106710681069107010711072107310741075107610771078107910801081108210831084108510861087108810891090109110921093109410951096109710981099110011011102
  1. // SPDX-License-Identifier: GPL-2.0-or-later
  2. /*
  3. *
  4. * Bluetooth support for Intel devices
  5. *
  6. * Copyright (C) 2015 Intel Corporation
  7. */
  8. #include <linux/module.h>
  9. #include <linux/firmware.h>
  10. #include <linux/regmap.h>
  11. #include <asm/unaligned.h>
  12. #include <net/bluetooth/bluetooth.h>
  13. #include <net/bluetooth/hci_core.h>
  14. #include "btintel.h"
  15. #define VERSION "0.1"
  16. #define BDADDR_INTEL (&(bdaddr_t){{0x00, 0x8b, 0x9e, 0x19, 0x03, 0x00}})
  17. #define RSA_HEADER_LEN 644
  18. #define CSS_HEADER_OFFSET 8
  19. #define ECDSA_OFFSET 644
  20. #define ECDSA_HEADER_LEN 320
  21. int btintel_check_bdaddr(struct hci_dev *hdev)
  22. {
  23. struct hci_rp_read_bd_addr *bda;
  24. struct sk_buff *skb;
  25. skb = __hci_cmd_sync(hdev, HCI_OP_READ_BD_ADDR, 0, NULL,
  26. HCI_INIT_TIMEOUT);
  27. if (IS_ERR(skb)) {
  28. int err = PTR_ERR(skb);
  29. bt_dev_err(hdev, "Reading Intel device address failed (%d)",
  30. err);
  31. return err;
  32. }
  33. if (skb->len != sizeof(*bda)) {
  34. bt_dev_err(hdev, "Intel device address length mismatch");
  35. kfree_skb(skb);
  36. return -EIO;
  37. }
  38. bda = (struct hci_rp_read_bd_addr *)skb->data;
  39. /* For some Intel based controllers, the default Bluetooth device
  40. * address 00:03:19:9E:8B:00 can be found. These controllers are
  41. * fully operational, but have the danger of duplicate addresses
  42. * and that in turn can cause problems with Bluetooth operation.
  43. */
  44. if (!bacmp(&bda->bdaddr, BDADDR_INTEL)) {
  45. bt_dev_err(hdev, "Found Intel default device address (%pMR)",
  46. &bda->bdaddr);
  47. set_bit(HCI_QUIRK_INVALID_BDADDR, &hdev->quirks);
  48. }
  49. kfree_skb(skb);
  50. return 0;
  51. }
  52. EXPORT_SYMBOL_GPL(btintel_check_bdaddr);
  53. int btintel_enter_mfg(struct hci_dev *hdev)
  54. {
  55. static const u8 param[] = { 0x01, 0x00 };
  56. struct sk_buff *skb;
  57. skb = __hci_cmd_sync(hdev, 0xfc11, 2, param, HCI_CMD_TIMEOUT);
  58. if (IS_ERR(skb)) {
  59. bt_dev_err(hdev, "Entering manufacturer mode failed (%ld)",
  60. PTR_ERR(skb));
  61. return PTR_ERR(skb);
  62. }
  63. kfree_skb(skb);
  64. return 0;
  65. }
  66. EXPORT_SYMBOL_GPL(btintel_enter_mfg);
  67. int btintel_exit_mfg(struct hci_dev *hdev, bool reset, bool patched)
  68. {
  69. u8 param[] = { 0x00, 0x00 };
  70. struct sk_buff *skb;
  71. /* The 2nd command parameter specifies the manufacturing exit method:
  72. * 0x00: Just disable the manufacturing mode (0x00).
  73. * 0x01: Disable manufacturing mode and reset with patches deactivated.
  74. * 0x02: Disable manufacturing mode and reset with patches activated.
  75. */
  76. if (reset)
  77. param[1] |= patched ? 0x02 : 0x01;
  78. skb = __hci_cmd_sync(hdev, 0xfc11, 2, param, HCI_CMD_TIMEOUT);
  79. if (IS_ERR(skb)) {
  80. bt_dev_err(hdev, "Exiting manufacturer mode failed (%ld)",
  81. PTR_ERR(skb));
  82. return PTR_ERR(skb);
  83. }
  84. kfree_skb(skb);
  85. return 0;
  86. }
  87. EXPORT_SYMBOL_GPL(btintel_exit_mfg);
  88. int btintel_set_bdaddr(struct hci_dev *hdev, const bdaddr_t *bdaddr)
  89. {
  90. struct sk_buff *skb;
  91. int err;
  92. skb = __hci_cmd_sync(hdev, 0xfc31, 6, bdaddr, HCI_INIT_TIMEOUT);
  93. if (IS_ERR(skb)) {
  94. err = PTR_ERR(skb);
  95. bt_dev_err(hdev, "Changing Intel device address failed (%d)",
  96. err);
  97. return err;
  98. }
  99. kfree_skb(skb);
  100. return 0;
  101. }
  102. EXPORT_SYMBOL_GPL(btintel_set_bdaddr);
  103. int btintel_set_diag(struct hci_dev *hdev, bool enable)
  104. {
  105. struct sk_buff *skb;
  106. u8 param[3];
  107. int err;
  108. if (enable) {
  109. param[0] = 0x03;
  110. param[1] = 0x03;
  111. param[2] = 0x03;
  112. } else {
  113. param[0] = 0x00;
  114. param[1] = 0x00;
  115. param[2] = 0x00;
  116. }
  117. skb = __hci_cmd_sync(hdev, 0xfc43, 3, param, HCI_INIT_TIMEOUT);
  118. if (IS_ERR(skb)) {
  119. err = PTR_ERR(skb);
  120. if (err == -ENODATA)
  121. goto done;
  122. bt_dev_err(hdev, "Changing Intel diagnostic mode failed (%d)",
  123. err);
  124. return err;
  125. }
  126. kfree_skb(skb);
  127. done:
  128. btintel_set_event_mask(hdev, enable);
  129. return 0;
  130. }
  131. EXPORT_SYMBOL_GPL(btintel_set_diag);
  132. int btintel_set_diag_mfg(struct hci_dev *hdev, bool enable)
  133. {
  134. int err, ret;
  135. err = btintel_enter_mfg(hdev);
  136. if (err)
  137. return err;
  138. ret = btintel_set_diag(hdev, enable);
  139. err = btintel_exit_mfg(hdev, false, false);
  140. if (err)
  141. return err;
  142. return ret;
  143. }
  144. EXPORT_SYMBOL_GPL(btintel_set_diag_mfg);
  145. void btintel_hw_error(struct hci_dev *hdev, u8 code)
  146. {
  147. struct sk_buff *skb;
  148. u8 type = 0x00;
  149. bt_dev_err(hdev, "Hardware error 0x%2.2x", code);
  150. skb = __hci_cmd_sync(hdev, HCI_OP_RESET, 0, NULL, HCI_INIT_TIMEOUT);
  151. if (IS_ERR(skb)) {
  152. bt_dev_err(hdev, "Reset after hardware error failed (%ld)",
  153. PTR_ERR(skb));
  154. return;
  155. }
  156. kfree_skb(skb);
  157. skb = __hci_cmd_sync(hdev, 0xfc22, 1, &type, HCI_INIT_TIMEOUT);
  158. if (IS_ERR(skb)) {
  159. bt_dev_err(hdev, "Retrieving Intel exception info failed (%ld)",
  160. PTR_ERR(skb));
  161. return;
  162. }
  163. if (skb->len != 13) {
  164. bt_dev_err(hdev, "Exception info size mismatch");
  165. kfree_skb(skb);
  166. return;
  167. }
  168. bt_dev_err(hdev, "Exception info %s", (char *)(skb->data + 1));
  169. kfree_skb(skb);
  170. }
  171. EXPORT_SYMBOL_GPL(btintel_hw_error);
  172. void btintel_version_info(struct hci_dev *hdev, struct intel_version *ver)
  173. {
  174. const char *variant;
  175. switch (ver->fw_variant) {
  176. case 0x06:
  177. variant = "Bootloader";
  178. break;
  179. case 0x23:
  180. variant = "Firmware";
  181. break;
  182. default:
  183. return;
  184. }
  185. bt_dev_info(hdev, "%s revision %u.%u build %u week %u %u",
  186. variant, ver->fw_revision >> 4, ver->fw_revision & 0x0f,
  187. ver->fw_build_num, ver->fw_build_ww,
  188. 2000 + ver->fw_build_yy);
  189. }
  190. EXPORT_SYMBOL_GPL(btintel_version_info);
  191. int btintel_secure_send(struct hci_dev *hdev, u8 fragment_type, u32 plen,
  192. const void *param)
  193. {
  194. while (plen > 0) {
  195. struct sk_buff *skb;
  196. u8 cmd_param[253], fragment_len = (plen > 252) ? 252 : plen;
  197. cmd_param[0] = fragment_type;
  198. memcpy(cmd_param + 1, param, fragment_len);
  199. skb = __hci_cmd_sync(hdev, 0xfc09, fragment_len + 1,
  200. cmd_param, HCI_INIT_TIMEOUT);
  201. if (IS_ERR(skb))
  202. return PTR_ERR(skb);
  203. kfree_skb(skb);
  204. plen -= fragment_len;
  205. param += fragment_len;
  206. }
  207. return 0;
  208. }
  209. EXPORT_SYMBOL_GPL(btintel_secure_send);
  210. int btintel_load_ddc_config(struct hci_dev *hdev, const char *ddc_name)
  211. {
  212. const struct firmware *fw;
  213. struct sk_buff *skb;
  214. const u8 *fw_ptr;
  215. int err;
  216. err = request_firmware_direct(&fw, ddc_name, &hdev->dev);
  217. if (err < 0) {
  218. bt_dev_err(hdev, "Failed to load Intel DDC file %s (%d)",
  219. ddc_name, err);
  220. return err;
  221. }
  222. bt_dev_info(hdev, "Found Intel DDC parameters: %s", ddc_name);
  223. fw_ptr = fw->data;
  224. /* DDC file contains one or more DDC structure which has
  225. * Length (1 byte), DDC ID (2 bytes), and DDC value (Length - 2).
  226. */
  227. while (fw->size > fw_ptr - fw->data) {
  228. u8 cmd_plen = fw_ptr[0] + sizeof(u8);
  229. skb = __hci_cmd_sync(hdev, 0xfc8b, cmd_plen, fw_ptr,
  230. HCI_INIT_TIMEOUT);
  231. if (IS_ERR(skb)) {
  232. bt_dev_err(hdev, "Failed to send Intel_Write_DDC (%ld)",
  233. PTR_ERR(skb));
  234. release_firmware(fw);
  235. return PTR_ERR(skb);
  236. }
  237. fw_ptr += cmd_plen;
  238. kfree_skb(skb);
  239. }
  240. release_firmware(fw);
  241. bt_dev_info(hdev, "Applying Intel DDC parameters completed");
  242. return 0;
  243. }
  244. EXPORT_SYMBOL_GPL(btintel_load_ddc_config);
  245. int btintel_set_event_mask(struct hci_dev *hdev, bool debug)
  246. {
  247. u8 mask[8] = { 0x87, 0x0c, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 };
  248. struct sk_buff *skb;
  249. int err;
  250. if (debug)
  251. mask[1] |= 0x62;
  252. skb = __hci_cmd_sync(hdev, 0xfc52, 8, mask, HCI_INIT_TIMEOUT);
  253. if (IS_ERR(skb)) {
  254. err = PTR_ERR(skb);
  255. bt_dev_err(hdev, "Setting Intel event mask failed (%d)", err);
  256. return err;
  257. }
  258. kfree_skb(skb);
  259. return 0;
  260. }
  261. EXPORT_SYMBOL_GPL(btintel_set_event_mask);
  262. int btintel_set_event_mask_mfg(struct hci_dev *hdev, bool debug)
  263. {
  264. int err, ret;
  265. err = btintel_enter_mfg(hdev);
  266. if (err)
  267. return err;
  268. ret = btintel_set_event_mask(hdev, debug);
  269. err = btintel_exit_mfg(hdev, false, false);
  270. if (err)
  271. return err;
  272. return ret;
  273. }
  274. EXPORT_SYMBOL_GPL(btintel_set_event_mask_mfg);
  275. int btintel_read_version(struct hci_dev *hdev, struct intel_version *ver)
  276. {
  277. struct sk_buff *skb;
  278. skb = __hci_cmd_sync(hdev, 0xfc05, 0, NULL, HCI_CMD_TIMEOUT);
  279. if (IS_ERR(skb)) {
  280. bt_dev_err(hdev, "Reading Intel version information failed (%ld)",
  281. PTR_ERR(skb));
  282. return PTR_ERR(skb);
  283. }
  284. if (skb->len != sizeof(*ver)) {
  285. bt_dev_err(hdev, "Intel version event size mismatch");
  286. kfree_skb(skb);
  287. return -EILSEQ;
  288. }
  289. memcpy(ver, skb->data, sizeof(*ver));
  290. kfree_skb(skb);
  291. return 0;
  292. }
  293. EXPORT_SYMBOL_GPL(btintel_read_version);
  294. void btintel_version_info_tlv(struct hci_dev *hdev, struct intel_version_tlv *version)
  295. {
  296. const char *variant;
  297. switch (version->img_type) {
  298. case 0x01:
  299. variant = "Bootloader";
  300. bt_dev_info(hdev, "Device revision is %u", version->dev_rev_id);
  301. bt_dev_info(hdev, "Secure boot is %s",
  302. version->secure_boot ? "enabled" : "disabled");
  303. bt_dev_info(hdev, "OTP lock is %s",
  304. version->otp_lock ? "enabled" : "disabled");
  305. bt_dev_info(hdev, "API lock is %s",
  306. version->api_lock ? "enabled" : "disabled");
  307. bt_dev_info(hdev, "Debug lock is %s",
  308. version->debug_lock ? "enabled" : "disabled");
  309. bt_dev_info(hdev, "Minimum firmware build %u week %u %u",
  310. version->min_fw_build_nn, version->min_fw_build_cw,
  311. 2000 + version->min_fw_build_yy);
  312. break;
  313. case 0x03:
  314. variant = "Firmware";
  315. break;
  316. default:
  317. bt_dev_err(hdev, "Unsupported image type(%02x)", version->img_type);
  318. goto done;
  319. }
  320. bt_dev_info(hdev, "%s timestamp %u.%u buildtype %u build %u", variant,
  321. 2000 + (version->timestamp >> 8), version->timestamp & 0xff,
  322. version->build_type, version->build_num);
  323. done:
  324. return;
  325. }
  326. EXPORT_SYMBOL_GPL(btintel_version_info_tlv);
  327. int btintel_read_version_tlv(struct hci_dev *hdev, struct intel_version_tlv *version)
  328. {
  329. struct sk_buff *skb;
  330. const u8 param[1] = { 0xFF };
  331. if (!version)
  332. return -EINVAL;
  333. skb = __hci_cmd_sync(hdev, 0xfc05, 1, param, HCI_CMD_TIMEOUT);
  334. if (IS_ERR(skb)) {
  335. bt_dev_err(hdev, "Reading Intel version information failed (%ld)",
  336. PTR_ERR(skb));
  337. return PTR_ERR(skb);
  338. }
  339. if (skb->data[0]) {
  340. bt_dev_err(hdev, "Intel Read Version command failed (%02x)",
  341. skb->data[0]);
  342. kfree_skb(skb);
  343. return -EIO;
  344. }
  345. /* Consume Command Complete Status field */
  346. skb_pull(skb, 1);
  347. /* Event parameters contatin multiple TLVs. Read each of them
  348. * and only keep the required data. Also, it use existing legacy
  349. * version field like hw_platform, hw_variant, and fw_variant
  350. * to keep the existing setup flow
  351. */
  352. while (skb->len) {
  353. struct intel_tlv *tlv;
  354. tlv = (struct intel_tlv *)skb->data;
  355. switch (tlv->type) {
  356. case INTEL_TLV_CNVI_TOP:
  357. version->cnvi_top = get_unaligned_le32(tlv->val);
  358. break;
  359. case INTEL_TLV_CNVR_TOP:
  360. version->cnvr_top = get_unaligned_le32(tlv->val);
  361. break;
  362. case INTEL_TLV_CNVI_BT:
  363. version->cnvi_bt = get_unaligned_le32(tlv->val);
  364. break;
  365. case INTEL_TLV_CNVR_BT:
  366. version->cnvr_bt = get_unaligned_le32(tlv->val);
  367. break;
  368. case INTEL_TLV_DEV_REV_ID:
  369. version->dev_rev_id = get_unaligned_le16(tlv->val);
  370. break;
  371. case INTEL_TLV_IMAGE_TYPE:
  372. version->img_type = tlv->val[0];
  373. break;
  374. case INTEL_TLV_TIME_STAMP:
  375. version->timestamp = get_unaligned_le16(tlv->val);
  376. break;
  377. case INTEL_TLV_BUILD_TYPE:
  378. version->build_type = tlv->val[0];
  379. break;
  380. case INTEL_TLV_BUILD_NUM:
  381. version->build_num = get_unaligned_le32(tlv->val);
  382. break;
  383. case INTEL_TLV_SECURE_BOOT:
  384. version->secure_boot = tlv->val[0];
  385. break;
  386. case INTEL_TLV_OTP_LOCK:
  387. version->otp_lock = tlv->val[0];
  388. break;
  389. case INTEL_TLV_API_LOCK:
  390. version->api_lock = tlv->val[0];
  391. break;
  392. case INTEL_TLV_DEBUG_LOCK:
  393. version->debug_lock = tlv->val[0];
  394. break;
  395. case INTEL_TLV_MIN_FW:
  396. version->min_fw_build_nn = tlv->val[0];
  397. version->min_fw_build_cw = tlv->val[1];
  398. version->min_fw_build_yy = tlv->val[2];
  399. break;
  400. case INTEL_TLV_LIMITED_CCE:
  401. version->limited_cce = tlv->val[0];
  402. break;
  403. case INTEL_TLV_SBE_TYPE:
  404. version->sbe_type = tlv->val[0];
  405. break;
  406. case INTEL_TLV_OTP_BDADDR:
  407. memcpy(&version->otp_bd_addr, tlv->val, tlv->len);
  408. break;
  409. default:
  410. /* Ignore rest of information */
  411. break;
  412. }
  413. /* consume the current tlv and move to next*/
  414. skb_pull(skb, tlv->len + sizeof(*tlv));
  415. }
  416. kfree_skb(skb);
  417. return 0;
  418. }
  419. EXPORT_SYMBOL_GPL(btintel_read_version_tlv);
  420. /* ------- REGMAP IBT SUPPORT ------- */
  421. #define IBT_REG_MODE_8BIT 0x00
  422. #define IBT_REG_MODE_16BIT 0x01
  423. #define IBT_REG_MODE_32BIT 0x02
  424. struct regmap_ibt_context {
  425. struct hci_dev *hdev;
  426. __u16 op_write;
  427. __u16 op_read;
  428. };
  429. struct ibt_cp_reg_access {
  430. __le32 addr;
  431. __u8 mode;
  432. __u8 len;
  433. __u8 data[];
  434. } __packed;
  435. struct ibt_rp_reg_access {
  436. __u8 status;
  437. __le32 addr;
  438. __u8 data[];
  439. } __packed;
  440. static int regmap_ibt_read(void *context, const void *addr, size_t reg_size,
  441. void *val, size_t val_size)
  442. {
  443. struct regmap_ibt_context *ctx = context;
  444. struct ibt_cp_reg_access cp;
  445. struct ibt_rp_reg_access *rp;
  446. struct sk_buff *skb;
  447. int err = 0;
  448. if (reg_size != sizeof(__le32))
  449. return -EINVAL;
  450. switch (val_size) {
  451. case 1:
  452. cp.mode = IBT_REG_MODE_8BIT;
  453. break;
  454. case 2:
  455. cp.mode = IBT_REG_MODE_16BIT;
  456. break;
  457. case 4:
  458. cp.mode = IBT_REG_MODE_32BIT;
  459. break;
  460. default:
  461. return -EINVAL;
  462. }
  463. /* regmap provides a little-endian formatted addr */
  464. cp.addr = *(__le32 *)addr;
  465. cp.len = val_size;
  466. bt_dev_dbg(ctx->hdev, "Register (0x%x) read", le32_to_cpu(cp.addr));
  467. skb = hci_cmd_sync(ctx->hdev, ctx->op_read, sizeof(cp), &cp,
  468. HCI_CMD_TIMEOUT);
  469. if (IS_ERR(skb)) {
  470. err = PTR_ERR(skb);
  471. bt_dev_err(ctx->hdev, "regmap: Register (0x%x) read error (%d)",
  472. le32_to_cpu(cp.addr), err);
  473. return err;
  474. }
  475. if (skb->len != sizeof(*rp) + val_size) {
  476. bt_dev_err(ctx->hdev, "regmap: Register (0x%x) read error, bad len",
  477. le32_to_cpu(cp.addr));
  478. err = -EINVAL;
  479. goto done;
  480. }
  481. rp = (struct ibt_rp_reg_access *)skb->data;
  482. if (rp->addr != cp.addr) {
  483. bt_dev_err(ctx->hdev, "regmap: Register (0x%x) read error, bad addr",
  484. le32_to_cpu(rp->addr));
  485. err = -EINVAL;
  486. goto done;
  487. }
  488. memcpy(val, rp->data, val_size);
  489. done:
  490. kfree_skb(skb);
  491. return err;
  492. }
  493. static int regmap_ibt_gather_write(void *context,
  494. const void *addr, size_t reg_size,
  495. const void *val, size_t val_size)
  496. {
  497. struct regmap_ibt_context *ctx = context;
  498. struct ibt_cp_reg_access *cp;
  499. struct sk_buff *skb;
  500. int plen = sizeof(*cp) + val_size;
  501. u8 mode;
  502. int err = 0;
  503. if (reg_size != sizeof(__le32))
  504. return -EINVAL;
  505. switch (val_size) {
  506. case 1:
  507. mode = IBT_REG_MODE_8BIT;
  508. break;
  509. case 2:
  510. mode = IBT_REG_MODE_16BIT;
  511. break;
  512. case 4:
  513. mode = IBT_REG_MODE_32BIT;
  514. break;
  515. default:
  516. return -EINVAL;
  517. }
  518. cp = kmalloc(plen, GFP_KERNEL);
  519. if (!cp)
  520. return -ENOMEM;
  521. /* regmap provides a little-endian formatted addr/value */
  522. cp->addr = *(__le32 *)addr;
  523. cp->mode = mode;
  524. cp->len = val_size;
  525. memcpy(&cp->data, val, val_size);
  526. bt_dev_dbg(ctx->hdev, "Register (0x%x) write", le32_to_cpu(cp->addr));
  527. skb = hci_cmd_sync(ctx->hdev, ctx->op_write, plen, cp, HCI_CMD_TIMEOUT);
  528. if (IS_ERR(skb)) {
  529. err = PTR_ERR(skb);
  530. bt_dev_err(ctx->hdev, "regmap: Register (0x%x) write error (%d)",
  531. le32_to_cpu(cp->addr), err);
  532. goto done;
  533. }
  534. kfree_skb(skb);
  535. done:
  536. kfree(cp);
  537. return err;
  538. }
  539. static int regmap_ibt_write(void *context, const void *data, size_t count)
  540. {
  541. /* data contains register+value, since we only support 32bit addr,
  542. * minimum data size is 4 bytes.
  543. */
  544. if (WARN_ONCE(count < 4, "Invalid register access"))
  545. return -EINVAL;
  546. return regmap_ibt_gather_write(context, data, 4, data + 4, count - 4);
  547. }
  548. static void regmap_ibt_free_context(void *context)
  549. {
  550. kfree(context);
  551. }
  552. static struct regmap_bus regmap_ibt = {
  553. .read = regmap_ibt_read,
  554. .write = regmap_ibt_write,
  555. .gather_write = regmap_ibt_gather_write,
  556. .free_context = regmap_ibt_free_context,
  557. .reg_format_endian_default = REGMAP_ENDIAN_LITTLE,
  558. .val_format_endian_default = REGMAP_ENDIAN_LITTLE,
  559. };
  560. /* Config is the same for all register regions */
  561. static const struct regmap_config regmap_ibt_cfg = {
  562. .name = "btintel_regmap",
  563. .reg_bits = 32,
  564. .val_bits = 32,
  565. };
  566. struct regmap *btintel_regmap_init(struct hci_dev *hdev, u16 opcode_read,
  567. u16 opcode_write)
  568. {
  569. struct regmap_ibt_context *ctx;
  570. bt_dev_info(hdev, "regmap: Init R%x-W%x region", opcode_read,
  571. opcode_write);
  572. ctx = kzalloc(sizeof(*ctx), GFP_KERNEL);
  573. if (!ctx)
  574. return ERR_PTR(-ENOMEM);
  575. ctx->op_read = opcode_read;
  576. ctx->op_write = opcode_write;
  577. ctx->hdev = hdev;
  578. return regmap_init(&hdev->dev, &regmap_ibt, ctx, &regmap_ibt_cfg);
  579. }
  580. EXPORT_SYMBOL_GPL(btintel_regmap_init);
  581. int btintel_send_intel_reset(struct hci_dev *hdev, u32 boot_param)
  582. {
  583. struct intel_reset params = { 0x00, 0x01, 0x00, 0x01, 0x00000000 };
  584. struct sk_buff *skb;
  585. params.boot_param = cpu_to_le32(boot_param);
  586. skb = __hci_cmd_sync(hdev, 0xfc01, sizeof(params), &params,
  587. HCI_INIT_TIMEOUT);
  588. if (IS_ERR(skb)) {
  589. bt_dev_err(hdev, "Failed to send Intel Reset command");
  590. return PTR_ERR(skb);
  591. }
  592. kfree_skb(skb);
  593. return 0;
  594. }
  595. EXPORT_SYMBOL_GPL(btintel_send_intel_reset);
  596. int btintel_read_boot_params(struct hci_dev *hdev,
  597. struct intel_boot_params *params)
  598. {
  599. struct sk_buff *skb;
  600. skb = __hci_cmd_sync(hdev, 0xfc0d, 0, NULL, HCI_INIT_TIMEOUT);
  601. if (IS_ERR(skb)) {
  602. bt_dev_err(hdev, "Reading Intel boot parameters failed (%ld)",
  603. PTR_ERR(skb));
  604. return PTR_ERR(skb);
  605. }
  606. if (skb->len != sizeof(*params)) {
  607. bt_dev_err(hdev, "Intel boot parameters size mismatch");
  608. kfree_skb(skb);
  609. return -EILSEQ;
  610. }
  611. memcpy(params, skb->data, sizeof(*params));
  612. kfree_skb(skb);
  613. if (params->status) {
  614. bt_dev_err(hdev, "Intel boot parameters command failed (%02x)",
  615. params->status);
  616. return -bt_to_errno(params->status);
  617. }
  618. bt_dev_info(hdev, "Device revision is %u",
  619. le16_to_cpu(params->dev_revid));
  620. bt_dev_info(hdev, "Secure boot is %s",
  621. params->secure_boot ? "enabled" : "disabled");
  622. bt_dev_info(hdev, "OTP lock is %s",
  623. params->otp_lock ? "enabled" : "disabled");
  624. bt_dev_info(hdev, "API lock is %s",
  625. params->api_lock ? "enabled" : "disabled");
  626. bt_dev_info(hdev, "Debug lock is %s",
  627. params->debug_lock ? "enabled" : "disabled");
  628. bt_dev_info(hdev, "Minimum firmware build %u week %u %u",
  629. params->min_fw_build_nn, params->min_fw_build_cw,
  630. 2000 + params->min_fw_build_yy);
  631. return 0;
  632. }
  633. EXPORT_SYMBOL_GPL(btintel_read_boot_params);
  634. static int btintel_sfi_rsa_header_secure_send(struct hci_dev *hdev,
  635. const struct firmware *fw)
  636. {
  637. int err;
  638. /* Start the firmware download transaction with the Init fragment
  639. * represented by the 128 bytes of CSS header.
  640. */
  641. err = btintel_secure_send(hdev, 0x00, 128, fw->data);
  642. if (err < 0) {
  643. bt_dev_err(hdev, "Failed to send firmware header (%d)", err);
  644. goto done;
  645. }
  646. /* Send the 256 bytes of public key information from the firmware
  647. * as the PKey fragment.
  648. */
  649. err = btintel_secure_send(hdev, 0x03, 256, fw->data + 128);
  650. if (err < 0) {
  651. bt_dev_err(hdev, "Failed to send firmware pkey (%d)", err);
  652. goto done;
  653. }
  654. /* Send the 256 bytes of signature information from the firmware
  655. * as the Sign fragment.
  656. */
  657. err = btintel_secure_send(hdev, 0x02, 256, fw->data + 388);
  658. if (err < 0) {
  659. bt_dev_err(hdev, "Failed to send firmware signature (%d)", err);
  660. goto done;
  661. }
  662. done:
  663. return err;
  664. }
  665. static int btintel_sfi_ecdsa_header_secure_send(struct hci_dev *hdev,
  666. const struct firmware *fw)
  667. {
  668. int err;
  669. /* Start the firmware download transaction with the Init fragment
  670. * represented by the 128 bytes of CSS header.
  671. */
  672. err = btintel_secure_send(hdev, 0x00, 128, fw->data + 644);
  673. if (err < 0) {
  674. bt_dev_err(hdev, "Failed to send firmware header (%d)", err);
  675. return err;
  676. }
  677. /* Send the 96 bytes of public key information from the firmware
  678. * as the PKey fragment.
  679. */
  680. err = btintel_secure_send(hdev, 0x03, 96, fw->data + 644 + 128);
  681. if (err < 0) {
  682. bt_dev_err(hdev, "Failed to send firmware pkey (%d)", err);
  683. return err;
  684. }
  685. /* Send the 96 bytes of signature information from the firmware
  686. * as the Sign fragment
  687. */
  688. err = btintel_secure_send(hdev, 0x02, 96, fw->data + 644 + 224);
  689. if (err < 0) {
  690. bt_dev_err(hdev, "Failed to send firmware signature (%d)",
  691. err);
  692. return err;
  693. }
  694. return 0;
  695. }
  696. static int btintel_download_firmware_payload(struct hci_dev *hdev,
  697. const struct firmware *fw,
  698. u32 *boot_param, size_t offset)
  699. {
  700. int err;
  701. const u8 *fw_ptr;
  702. u32 frag_len;
  703. fw_ptr = fw->data + offset;
  704. frag_len = 0;
  705. err = -EINVAL;
  706. while (fw_ptr - fw->data < fw->size) {
  707. struct hci_command_hdr *cmd = (void *)(fw_ptr + frag_len);
  708. /* Each SKU has a different reset parameter to use in the
  709. * HCI_Intel_Reset command and it is embedded in the firmware
  710. * data. So, instead of using static value per SKU, check
  711. * the firmware data and save it for later use.
  712. */
  713. if (le16_to_cpu(cmd->opcode) == 0xfc0e) {
  714. /* The boot parameter is the first 32-bit value
  715. * and rest of 3 octets are reserved.
  716. */
  717. *boot_param = get_unaligned_le32(fw_ptr + sizeof(*cmd));
  718. bt_dev_dbg(hdev, "boot_param=0x%x", *boot_param);
  719. }
  720. frag_len += sizeof(*cmd) + cmd->plen;
  721. /* The parameter length of the secure send command requires
  722. * a 4 byte alignment. It happens so that the firmware file
  723. * contains proper Intel_NOP commands to align the fragments
  724. * as needed.
  725. *
  726. * Send set of commands with 4 byte alignment from the
  727. * firmware data buffer as a single Data fragement.
  728. */
  729. if (!(frag_len % 4)) {
  730. err = btintel_secure_send(hdev, 0x01, frag_len, fw_ptr);
  731. if (err < 0) {
  732. bt_dev_err(hdev,
  733. "Failed to send firmware data (%d)",
  734. err);
  735. goto done;
  736. }
  737. fw_ptr += frag_len;
  738. frag_len = 0;
  739. }
  740. }
  741. done:
  742. return err;
  743. }
  744. int btintel_download_firmware(struct hci_dev *hdev,
  745. const struct firmware *fw,
  746. u32 *boot_param)
  747. {
  748. int err;
  749. err = btintel_sfi_rsa_header_secure_send(hdev, fw);
  750. if (err)
  751. return err;
  752. return btintel_download_firmware_payload(hdev, fw, boot_param,
  753. RSA_HEADER_LEN);
  754. }
  755. EXPORT_SYMBOL_GPL(btintel_download_firmware);
  756. int btintel_download_firmware_newgen(struct hci_dev *hdev,
  757. const struct firmware *fw, u32 *boot_param,
  758. u8 hw_variant, u8 sbe_type)
  759. {
  760. int err;
  761. u32 css_header_ver;
  762. /* iBT hardware variants 0x0b, 0x0c, 0x11, 0x12, 0x13, 0x14 support
  763. * only RSA secure boot engine. Hence, the corresponding sfi file will
  764. * have RSA header of 644 bytes followed by Command Buffer.
  765. *
  766. * iBT hardware variants 0x17, 0x18 onwards support both RSA and ECDSA
  767. * secure boot engine. As a result, the corresponding sfi file will
  768. * have RSA header of 644, ECDSA header of 320 bytes followed by
  769. * Command Buffer.
  770. *
  771. * CSS Header byte positions 0x08 to 0x0B represent the CSS Header
  772. * version: RSA(0x00010000) , ECDSA (0x00020000)
  773. */
  774. css_header_ver = get_unaligned_le32(fw->data + CSS_HEADER_OFFSET);
  775. if (css_header_ver != 0x00010000) {
  776. bt_dev_err(hdev, "Invalid CSS Header version");
  777. return -EINVAL;
  778. }
  779. if (hw_variant <= 0x14) {
  780. if (sbe_type != 0x00) {
  781. bt_dev_err(hdev, "Invalid SBE type for hardware variant (%d)",
  782. hw_variant);
  783. return -EINVAL;
  784. }
  785. err = btintel_sfi_rsa_header_secure_send(hdev, fw);
  786. if (err)
  787. return err;
  788. err = btintel_download_firmware_payload(hdev, fw, boot_param, RSA_HEADER_LEN);
  789. if (err)
  790. return err;
  791. } else if (hw_variant >= 0x17) {
  792. /* Check if CSS header for ECDSA follows the RSA header */
  793. if (fw->data[ECDSA_OFFSET] != 0x06)
  794. return -EINVAL;
  795. /* Check if the CSS Header version is ECDSA(0x00020000) */
  796. css_header_ver = get_unaligned_le32(fw->data + ECDSA_OFFSET + CSS_HEADER_OFFSET);
  797. if (css_header_ver != 0x00020000) {
  798. bt_dev_err(hdev, "Invalid CSS Header version");
  799. return -EINVAL;
  800. }
  801. if (sbe_type == 0x00) {
  802. err = btintel_sfi_rsa_header_secure_send(hdev, fw);
  803. if (err)
  804. return err;
  805. err = btintel_download_firmware_payload(hdev, fw,
  806. boot_param,
  807. RSA_HEADER_LEN + ECDSA_HEADER_LEN);
  808. if (err)
  809. return err;
  810. } else if (sbe_type == 0x01) {
  811. err = btintel_sfi_ecdsa_header_secure_send(hdev, fw);
  812. if (err)
  813. return err;
  814. err = btintel_download_firmware_payload(hdev, fw,
  815. boot_param,
  816. RSA_HEADER_LEN + ECDSA_HEADER_LEN);
  817. if (err)
  818. return err;
  819. }
  820. }
  821. return 0;
  822. }
  823. EXPORT_SYMBOL_GPL(btintel_download_firmware_newgen);
  824. void btintel_reset_to_bootloader(struct hci_dev *hdev)
  825. {
  826. struct intel_reset params;
  827. struct sk_buff *skb;
  828. /* Send Intel Reset command. This will result in
  829. * re-enumeration of BT controller.
  830. *
  831. * Intel Reset parameter description:
  832. * reset_type : 0x00 (Soft reset),
  833. * 0x01 (Hard reset)
  834. * patch_enable : 0x00 (Do not enable),
  835. * 0x01 (Enable)
  836. * ddc_reload : 0x00 (Do not reload),
  837. * 0x01 (Reload)
  838. * boot_option: 0x00 (Current image),
  839. * 0x01 (Specified boot address)
  840. * boot_param: Boot address
  841. *
  842. */
  843. params.reset_type = 0x01;
  844. params.patch_enable = 0x01;
  845. params.ddc_reload = 0x01;
  846. params.boot_option = 0x00;
  847. params.boot_param = cpu_to_le32(0x00000000);
  848. skb = __hci_cmd_sync(hdev, 0xfc01, sizeof(params),
  849. &params, HCI_INIT_TIMEOUT);
  850. if (IS_ERR(skb)) {
  851. bt_dev_err(hdev, "FW download error recovery failed (%ld)",
  852. PTR_ERR(skb));
  853. return;
  854. }
  855. bt_dev_info(hdev, "Intel reset sent to retry FW download");
  856. kfree_skb(skb);
  857. /* Current Intel BT controllers(ThP/JfP) hold the USB reset
  858. * lines for 2ms when it receives Intel Reset in bootloader mode.
  859. * Whereas, the upcoming Intel BT controllers will hold USB reset
  860. * for 150ms. To keep the delay generic, 150ms is chosen here.
  861. */
  862. msleep(150);
  863. }
  864. EXPORT_SYMBOL_GPL(btintel_reset_to_bootloader);
  865. int btintel_read_debug_features(struct hci_dev *hdev,
  866. struct intel_debug_features *features)
  867. {
  868. struct sk_buff *skb;
  869. u8 page_no = 1;
  870. /* Intel controller supports two pages, each page is of 128-bit
  871. * feature bit mask. And each bit defines specific feature support
  872. */
  873. skb = __hci_cmd_sync(hdev, 0xfca6, sizeof(page_no), &page_no,
  874. HCI_INIT_TIMEOUT);
  875. if (IS_ERR(skb)) {
  876. bt_dev_err(hdev, "Reading supported features failed (%ld)",
  877. PTR_ERR(skb));
  878. return PTR_ERR(skb);
  879. }
  880. if (skb->len != (sizeof(features->page1) + 3)) {
  881. bt_dev_err(hdev, "Supported features event size mismatch");
  882. kfree_skb(skb);
  883. return -EILSEQ;
  884. }
  885. memcpy(features->page1, skb->data + 3, sizeof(features->page1));
  886. /* Read the supported features page2 if required in future.
  887. */
  888. kfree_skb(skb);
  889. return 0;
  890. }
  891. EXPORT_SYMBOL_GPL(btintel_read_debug_features);
  892. int btintel_set_debug_features(struct hci_dev *hdev,
  893. const struct intel_debug_features *features)
  894. {
  895. u8 mask[11] = { 0x0a, 0x92, 0x02, 0x07, 0x00, 0x00, 0x00, 0x00,
  896. 0x00, 0x00, 0x00 };
  897. struct sk_buff *skb;
  898. if (!features)
  899. return -EINVAL;
  900. if (!(features->page1[0] & 0x3f)) {
  901. bt_dev_info(hdev, "Telemetry exception format not supported");
  902. return 0;
  903. }
  904. skb = __hci_cmd_sync(hdev, 0xfc8b, 11, mask, HCI_INIT_TIMEOUT);
  905. if (IS_ERR(skb)) {
  906. bt_dev_err(hdev, "Setting Intel telemetry ddc write event mask failed (%ld)",
  907. PTR_ERR(skb));
  908. return PTR_ERR(skb);
  909. }
  910. kfree_skb(skb);
  911. return 0;
  912. }
  913. EXPORT_SYMBOL_GPL(btintel_set_debug_features);
  914. MODULE_AUTHOR("Marcel Holtmann <marcel@holtmann.org>");
  915. MODULE_DESCRIPTION("Bluetooth support for Intel devices ver " VERSION);
  916. MODULE_VERSION(VERSION);
  917. MODULE_LICENSE("GPL");
  918. MODULE_FIRMWARE("intel/ibt-11-5.sfi");
  919. MODULE_FIRMWARE("intel/ibt-11-5.ddc");
  920. MODULE_FIRMWARE("intel/ibt-12-16.sfi");
  921. MODULE_FIRMWARE("intel/ibt-12-16.ddc");