~hc/RK356X_SDK_RELEASE.git

..	..	@@ -1,24 +1,9 @@
	1	+// SPDX-License-Identifier: GPL-2.0-or-later
1	2	/*
2	3	*
3	4	* Bluetooth support for Intel devices
4	5	*
5	6	* Copyright (C) 2015 Intel Corporation
6		- *
7		- *
8		- * This program is free software; you can redistribute it and/or modify
9		- * it under the terms of the GNU General Public License as published by
10		- * the Free Software Foundation; either version 2 of the License, or
11		- * (at your option) any later version.
12		- *
13		- * This program is distributed in the hope that it will be useful,
14		- * but WITHOUT ANY WARRANTY; without even the implied warranty of
15		- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
16		- * GNU General Public License for more details.
17		- *
18		- * You should have received a copy of the GNU General Public License
19		- * along with this program; if not, write to the Free Software
20		- * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
21		- *
22	7	*/
23	8
24	9	#include <linux/module.h>
..	..	@@ -33,7 +18,11 @@
33	18
34	19	#define VERSION "0.1"
35	20
36		-#define BDADDR_INTEL (&(bdaddr_t) {{0x00, 0x8b, 0x9e, 0x19, 0x03, 0x00}})
	21	+#define BDADDR_INTEL (&(bdaddr_t){{0x00, 0x8b, 0x9e, 0x19, 0x03, 0x00}})
	22	+#define RSA_HEADER_LEN 644
	23	+#define CSS_HEADER_OFFSET 8
	24	+#define ECDSA_OFFSET 644
	25	+#define ECDSA_HEADER_LEN 320
37	26
38	27	int btintel_check_bdaddr(struct hci_dev *hdev)
39	28	{
..	..	@@ -375,6 +364,144 @@
375	364	}
376	365	EXPORT_SYMBOL_GPL(btintel_read_version);
377	366
	367	+void btintel_version_info_tlv(struct hci_dev hdev, struct intel_version_tlv version)
	368	+{
	369	+ const char *variant;
	370	+
	371	+ switch (version->img_type) {
	372	+ case 0x01:
	373	+ variant = "Bootloader";
	374	+ bt_dev_info(hdev, "Device revision is %u", version->dev_rev_id);
	375	+ bt_dev_info(hdev, "Secure boot is %s",
	376	+ version->secure_boot ? "enabled" : "disabled");
	377	+ bt_dev_info(hdev, "OTP lock is %s",
	378	+ version->otp_lock ? "enabled" : "disabled");
	379	+ bt_dev_info(hdev, "API lock is %s",
	380	+ version->api_lock ? "enabled" : "disabled");
	381	+ bt_dev_info(hdev, "Debug lock is %s",
	382	+ version->debug_lock ? "enabled" : "disabled");
	383	+ bt_dev_info(hdev, "Minimum firmware build %u week %u %u",
	384	+ version->min_fw_build_nn, version->min_fw_build_cw,
	385	+ 2000 + version->min_fw_build_yy);
	386	+ break;
	387	+ case 0x03:
	388	+ variant = "Firmware";
	389	+ break;
	390	+ default:
	391	+ bt_dev_err(hdev, "Unsupported image type(%02x)", version->img_type);
	392	+ goto done;
	393	+ }
	394	+
	395	+ bt_dev_info(hdev, "%s timestamp %u.%u buildtype %u build %u", variant,
	396	+ 2000 + (version->timestamp >> 8), version->timestamp & 0xff,
	397	+ version->build_type, version->build_num);
	398	+
	399	+done:
	400	+ return;
	401	+}
	402	+EXPORT_SYMBOL_GPL(btintel_version_info_tlv);
	403	+
	404	+int btintel_read_version_tlv(struct hci_dev hdev, struct intel_version_tlv version)
	405	+{
	406	+ struct sk_buff *skb;
	407	+ const u8 param[1] = { 0xFF };
	408	+
	409	+ if (!version)
	410	+ return -EINVAL;
	411	+
	412	+ skb = __hci_cmd_sync(hdev, 0xfc05, 1, param, HCI_CMD_TIMEOUT);
	413	+ if (IS_ERR(skb)) {
	414	+ bt_dev_err(hdev, "Reading Intel version information failed (%ld)",
	415	+ PTR_ERR(skb));
	416	+ return PTR_ERR(skb);
	417	+ }
	418	+
	419	+ if (skb->data[0]) {
	420	+ bt_dev_err(hdev, "Intel Read Version command failed (%02x)",
	421	+ skb->data[0]);
	422	+ kfree_skb(skb);
	423	+ return -EIO;
	424	+ }
	425	+
	426	+ /* Consume Command Complete Status field */
	427	+ skb_pull(skb, 1);
	428	+
	429	+ /* Event parameters contatin multiple TLVs. Read each of them
	430	+ * and only keep the required data. Also, it use existing legacy
	431	+ * version field like hw_platform, hw_variant, and fw_variant
	432	+ * to keep the existing setup flow
	433	+ */
	434	+ while (skb->len) {
	435	+ struct intel_tlv *tlv;
	436	+
	437	+ tlv = (struct intel_tlv *)skb->data;
	438	+ switch (tlv->type) {
	439	+ case INTEL_TLV_CNVI_TOP:
	440	+ version->cnvi_top = get_unaligned_le32(tlv->val);
	441	+ break;
	442	+ case INTEL_TLV_CNVR_TOP:
	443	+ version->cnvr_top = get_unaligned_le32(tlv->val);
	444	+ break;
	445	+ case INTEL_TLV_CNVI_BT:
	446	+ version->cnvi_bt = get_unaligned_le32(tlv->val);
	447	+ break;
	448	+ case INTEL_TLV_CNVR_BT:
	449	+ version->cnvr_bt = get_unaligned_le32(tlv->val);
	450	+ break;
	451	+ case INTEL_TLV_DEV_REV_ID:
	452	+ version->dev_rev_id = get_unaligned_le16(tlv->val);
	453	+ break;
	454	+ case INTEL_TLV_IMAGE_TYPE:
	455	+ version->img_type = tlv->val[0];
	456	+ break;
	457	+ case INTEL_TLV_TIME_STAMP:
	458	+ version->timestamp = get_unaligned_le16(tlv->val);
	459	+ break;
	460	+ case INTEL_TLV_BUILD_TYPE:
	461	+ version->build_type = tlv->val[0];
	462	+ break;
	463	+ case INTEL_TLV_BUILD_NUM:
	464	+ version->build_num = get_unaligned_le32(tlv->val);
	465	+ break;
	466	+ case INTEL_TLV_SECURE_BOOT:
	467	+ version->secure_boot = tlv->val[0];
	468	+ break;
	469	+ case INTEL_TLV_OTP_LOCK:
	470	+ version->otp_lock = tlv->val[0];
	471	+ break;
	472	+ case INTEL_TLV_API_LOCK:
	473	+ version->api_lock = tlv->val[0];
	474	+ break;
	475	+ case INTEL_TLV_DEBUG_LOCK:
	476	+ version->debug_lock = tlv->val[0];
	477	+ break;
	478	+ case INTEL_TLV_MIN_FW:
	479	+ version->min_fw_build_nn = tlv->val[0];
	480	+ version->min_fw_build_cw = tlv->val[1];
	481	+ version->min_fw_build_yy = tlv->val[2];
	482	+ break;
	483	+ case INTEL_TLV_LIMITED_CCE:
	484	+ version->limited_cce = tlv->val[0];
	485	+ break;
	486	+ case INTEL_TLV_SBE_TYPE:
	487	+ version->sbe_type = tlv->val[0];
	488	+ break;
	489	+ case INTEL_TLV_OTP_BDADDR:
	490	+ memcpy(&version->otp_bd_addr, tlv->val, tlv->len);
	491	+ break;
	492	+ default:
	493	+ /* Ignore rest of information */
	494	+ break;
	495	+ }
	496	+ /* consume the current tlv and move to next*/
	497	+ skb_pull(skb, tlv->len + sizeof(*tlv));
	498	+ }
	499	+
	500	+ kfree_skb(skb);
	501	+ return 0;
	502	+}
	503	+EXPORT_SYMBOL_GPL(btintel_read_version_tlv);
	504	+
378	505	/* ------- REGMAP IBT SUPPORT ------- */
379	506
380	507	#define IBT_REG_MODE_8BIT 0x00
..	..	@@ -391,13 +518,13 @@
391	518	__le32 addr;
392	519	__u8 mode;
393	520	__u8 len;
394		- __u8 data[0];
	521	+ __u8 data[];
395	522	} __packed;
396	523
397	524	struct ibt_rp_reg_access {
398	525	__u8 status;
399	526	__le32 addr;
400		- __u8 data[0];
	527	+ __u8 data[];
401	528	} __packed;
402	529
403	530	static int regmap_ibt_read(void context, const void addr, size_t reg_size,
..	..	@@ -641,12 +768,10 @@
641	768	}
642	769	EXPORT_SYMBOL_GPL(btintel_read_boot_params);
643	770
644		-int btintel_download_firmware(struct hci_dev hdev, const struct firmware fw,
645		- u32 *boot_param)
	771	+static int btintel_sfi_rsa_header_secure_send(struct hci_dev *hdev,
	772	+ const struct firmware *fw)
646	773	{
647	774	int err;
648		- const u8 *fw_ptr;
649		- u32 frag_len;
650	775
651	776	/* Start the firmware download transaction with the Init fragment
652	777	* represented by the 128 bytes of CSS header.
..	..	@@ -675,8 +800,56 @@
675	800	goto done;
676	801	}
677	802
678		- fw_ptr = fw->data + 644;
	803	+done:
	804	+ return err;
	805	+}
	806	+
	807	+static int btintel_sfi_ecdsa_header_secure_send(struct hci_dev *hdev,
	808	+ const struct firmware *fw)
	809	+{
	810	+ int err;
	811	+
	812	+ /* Start the firmware download transaction with the Init fragment
	813	+ * represented by the 128 bytes of CSS header.
	814	+ */
	815	+ err = btintel_secure_send(hdev, 0x00, 128, fw->data + 644);
	816	+ if (err < 0) {
	817	+ bt_dev_err(hdev, "Failed to send firmware header (%d)", err);
	818	+ return err;
	819	+ }
	820	+
	821	+ /* Send the 96 bytes of public key information from the firmware
	822	+ * as the PKey fragment.
	823	+ */
	824	+ err = btintel_secure_send(hdev, 0x03, 96, fw->data + 644 + 128);
	825	+ if (err < 0) {
	826	+ bt_dev_err(hdev, "Failed to send firmware pkey (%d)", err);
	827	+ return err;
	828	+ }
	829	+
	830	+ /* Send the 96 bytes of signature information from the firmware
	831	+ * as the Sign fragment
	832	+ */
	833	+ err = btintel_secure_send(hdev, 0x02, 96, fw->data + 644 + 224);
	834	+ if (err < 0) {
	835	+ bt_dev_err(hdev, "Failed to send firmware signature (%d)",
	836	+ err);
	837	+ return err;
	838	+ }
	839	+ return 0;
	840	+}
	841	+
	842	+static int btintel_download_firmware_payload(struct hci_dev *hdev,
	843	+ const struct firmware *fw,
	844	+ u32 *boot_param, size_t offset)
	845	+{
	846	+ int err;
	847	+ const u8 *fw_ptr;
	848	+ u32 frag_len;
	849	+
	850	+ fw_ptr = fw->data + offset;
679	851	frag_len = 0;
	852	+ err = -EINVAL;
680	853
681	854	while (fw_ptr - fw->data < fw->size) {
682	855	struct hci_command_hdr cmd = (void )(fw_ptr + frag_len);
..	..	@@ -722,8 +895,203 @@
722	895	done:
723	896	return err;
724	897	}
	898	+
	899	+int btintel_download_firmware(struct hci_dev *hdev,
	900	+ const struct firmware *fw,
	901	+ u32 *boot_param)
	902	+{
	903	+ int err;
	904	+
	905	+ err = btintel_sfi_rsa_header_secure_send(hdev, fw);
	906	+ if (err)
	907	+ return err;
	908	+
	909	+ return btintel_download_firmware_payload(hdev, fw, boot_param,
	910	+ RSA_HEADER_LEN);
	911	+}
725	912	EXPORT_SYMBOL_GPL(btintel_download_firmware);
726	913
	914	+int btintel_download_firmware_newgen(struct hci_dev *hdev,
	915	+ const struct firmware fw, u32 boot_param,
	916	+ u8 hw_variant, u8 sbe_type)
	917	+{
	918	+ int err;
	919	+ u32 css_header_ver;
	920	+
	921	+ /* iBT hardware variants 0x0b, 0x0c, 0x11, 0x12, 0x13, 0x14 support
	922	+ * only RSA secure boot engine. Hence, the corresponding sfi file will
	923	+ * have RSA header of 644 bytes followed by Command Buffer.
	924	+ *
	925	+ * iBT hardware variants 0x17, 0x18 onwards support both RSA and ECDSA
	926	+ * secure boot engine. As a result, the corresponding sfi file will
	927	+ * have RSA header of 644, ECDSA header of 320 bytes followed by
	928	+ * Command Buffer.
	929	+ *
	930	+ * CSS Header byte positions 0x08 to 0x0B represent the CSS Header
	931	+ * version: RSA(0x00010000) , ECDSA (0x00020000)
	932	+ */
	933	+ css_header_ver = get_unaligned_le32(fw->data + CSS_HEADER_OFFSET);
	934	+ if (css_header_ver != 0x00010000) {
	935	+ bt_dev_err(hdev, "Invalid CSS Header version");
	936	+ return -EINVAL;
	937	+ }
	938	+
	939	+ if (hw_variant <= 0x14) {
	940	+ if (sbe_type != 0x00) {
	941	+ bt_dev_err(hdev, "Invalid SBE type for hardware variant (%d)",
	942	+ hw_variant);
	943	+ return -EINVAL;
	944	+ }
	945	+
	946	+ err = btintel_sfi_rsa_header_secure_send(hdev, fw);
	947	+ if (err)
	948	+ return err;
	949	+
	950	+ err = btintel_download_firmware_payload(hdev, fw, boot_param, RSA_HEADER_LEN);
	951	+ if (err)
	952	+ return err;
	953	+ } else if (hw_variant >= 0x17) {
	954	+ /* Check if CSS header for ECDSA follows the RSA header */
	955	+ if (fw->data[ECDSA_OFFSET] != 0x06)
	956	+ return -EINVAL;
	957	+
	958	+ /* Check if the CSS Header version is ECDSA(0x00020000) */
	959	+ css_header_ver = get_unaligned_le32(fw->data + ECDSA_OFFSET + CSS_HEADER_OFFSET);
	960	+ if (css_header_ver != 0x00020000) {
	961	+ bt_dev_err(hdev, "Invalid CSS Header version");
	962	+ return -EINVAL;
	963	+ }
	964	+
	965	+ if (sbe_type == 0x00) {
	966	+ err = btintel_sfi_rsa_header_secure_send(hdev, fw);
	967	+ if (err)
	968	+ return err;
	969	+
	970	+ err = btintel_download_firmware_payload(hdev, fw,
	971	+ boot_param,
	972	+ RSA_HEADER_LEN + ECDSA_HEADER_LEN);
	973	+ if (err)
	974	+ return err;
	975	+ } else if (sbe_type == 0x01) {
	976	+ err = btintel_sfi_ecdsa_header_secure_send(hdev, fw);
	977	+ if (err)
	978	+ return err;
	979	+
	980	+ err = btintel_download_firmware_payload(hdev, fw,
	981	+ boot_param,
	982	+ RSA_HEADER_LEN + ECDSA_HEADER_LEN);
	983	+ if (err)
	984	+ return err;
	985	+ }
	986	+ }
	987	+ return 0;
	988	+}
	989	+EXPORT_SYMBOL_GPL(btintel_download_firmware_newgen);
	990	+
	991	+void btintel_reset_to_bootloader(struct hci_dev *hdev)
	992	+{
	993	+ struct intel_reset params;
	994	+ struct sk_buff *skb;
	995	+
	996	+ /* Send Intel Reset command. This will result in
	997	+ * re-enumeration of BT controller.
	998	+ *
	999	+ * Intel Reset parameter description:
	1000	+ * reset_type : 0x00 (Soft reset),
	1001	+ * 0x01 (Hard reset)
	1002	+ * patch_enable : 0x00 (Do not enable),
	1003	+ * 0x01 (Enable)
	1004	+ * ddc_reload : 0x00 (Do not reload),
	1005	+ * 0x01 (Reload)
	1006	+ * boot_option: 0x00 (Current image),
	1007	+ * 0x01 (Specified boot address)
	1008	+ * boot_param: Boot address
	1009	+ *
	1010	+ */
	1011	+ params.reset_type = 0x01;
	1012	+ params.patch_enable = 0x01;
	1013	+ params.ddc_reload = 0x01;
	1014	+ params.boot_option = 0x00;
	1015	+ params.boot_param = cpu_to_le32(0x00000000);
	1016	+
	1017	+ skb = __hci_cmd_sync(hdev, 0xfc01, sizeof(params),
	1018	+ &params, HCI_INIT_TIMEOUT);
	1019	+ if (IS_ERR(skb)) {
	1020	+ bt_dev_err(hdev, "FW download error recovery failed (%ld)",
	1021	+ PTR_ERR(skb));
	1022	+ return;
	1023	+ }
	1024	+ bt_dev_info(hdev, "Intel reset sent to retry FW download");
	1025	+ kfree_skb(skb);
	1026	+
	1027	+ /* Current Intel BT controllers(ThP/JfP) hold the USB reset
	1028	+ * lines for 2ms when it receives Intel Reset in bootloader mode.
	1029	+ * Whereas, the upcoming Intel BT controllers will hold USB reset
	1030	+ * for 150ms. To keep the delay generic, 150ms is chosen here.
	1031	+ */
	1032	+ msleep(150);
	1033	+}
	1034	+EXPORT_SYMBOL_GPL(btintel_reset_to_bootloader);
	1035	+
	1036	+int btintel_read_debug_features(struct hci_dev *hdev,
	1037	+ struct intel_debug_features *features)
	1038	+{
	1039	+ struct sk_buff *skb;
	1040	+ u8 page_no = 1;
	1041	+
	1042	+ /* Intel controller supports two pages, each page is of 128-bit
	1043	+ * feature bit mask. And each bit defines specific feature support
	1044	+ */
	1045	+ skb = __hci_cmd_sync(hdev, 0xfca6, sizeof(page_no), &page_no,
	1046	+ HCI_INIT_TIMEOUT);
	1047	+ if (IS_ERR(skb)) {
	1048	+ bt_dev_err(hdev, "Reading supported features failed (%ld)",
	1049	+ PTR_ERR(skb));
	1050	+ return PTR_ERR(skb);
	1051	+ }
	1052	+
	1053	+ if (skb->len != (sizeof(features->page1) + 3)) {
	1054	+ bt_dev_err(hdev, "Supported features event size mismatch");
	1055	+ kfree_skb(skb);
	1056	+ return -EILSEQ;
	1057	+ }
	1058	+
	1059	+ memcpy(features->page1, skb->data + 3, sizeof(features->page1));
	1060	+
	1061	+ /* Read the supported features page2 if required in future.
	1062	+ */
	1063	+ kfree_skb(skb);
	1064	+ return 0;
	1065	+}
	1066	+EXPORT_SYMBOL_GPL(btintel_read_debug_features);
	1067	+
	1068	+int btintel_set_debug_features(struct hci_dev *hdev,
	1069	+ const struct intel_debug_features *features)
	1070	+{
	1071	+ u8 mask[11] = { 0x0a, 0x92, 0x02, 0x07, 0x00, 0x00, 0x00, 0x00,
	1072	+ 0x00, 0x00, 0x00 };
	1073	+ struct sk_buff *skb;
	1074	+
	1075	+ if (!features)
	1076	+ return -EINVAL;
	1077	+
	1078	+ if (!(features->page1[0] & 0x3f)) {
	1079	+ bt_dev_info(hdev, "Telemetry exception format not supported");
	1080	+ return 0;
	1081	+ }
	1082	+
	1083	+ skb = __hci_cmd_sync(hdev, 0xfc8b, 11, mask, HCI_INIT_TIMEOUT);
	1084	+ if (IS_ERR(skb)) {
	1085	+ bt_dev_err(hdev, "Setting Intel telemetry ddc write event mask failed (%ld)",
	1086	+ PTR_ERR(skb));
	1087	+ return PTR_ERR(skb);
	1088	+ }
	1089	+
	1090	+ kfree_skb(skb);
	1091	+ return 0;
	1092	+}
	1093	+EXPORT_SYMBOL_GPL(btintel_set_debug_features);
	1094	+
727	1095	MODULE_AUTHOR("Marcel Holtmann <marcel@holtmann.org>");
728	1096	MODULE_DESCRIPTION("Bluetooth support for Intel devices ver " VERSION);
729	1097	MODULE_VERSION(VERSION);