1 files changed, 377 insertions, 0 deletions

diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c
index 3d684d20b584..7a7e5f8ecadc 100644
--- a/drivers/bluetooth/btusb.c
+++ b/drivers/bluetooth/btusb.c
@@ -23,6 +23,7 @@
 
 #include <linux/module.h>
 #include <linux/usb.h>
+#include <linux/firmware.h>
 
 #include <net/bluetooth/bluetooth.h>
 #include <net/bluetooth/hci_core.h>
@@ -47,6 +48,7 @@ static struct usb_driver btusb_driver;
 #define BTUSB_BROKEN_ISOC       0x20
 #define BTUSB_WRONG_SCO_MTU     0x40
 #define BTUSB_ATH3012           0x80
+#define BTUSB_INTEL             0x100
 
 static struct usb_device_id btusb_table[] = {
         /* Generic Bluetooth USB device */
@@ -207,6 +209,9 @@ static struct usb_device_id blacklist_table[] = {
         /* Frontline ComProbe Bluetooth Sniffer */
         { USB_DEVICE(0x16d3, 0x0002), .driver_info = BTUSB_SNIFFER },
 
+        /* Intel Bluetooth device */
+        { USB_DEVICE(0x8087, 0x07dc), .driver_info = BTUSB_INTEL },
+
         { }     /* Terminating entry */
 };
 
@@ -943,6 +948,375 @@ static int btusb_setup_bcm92035(struct hci_dev *hdev)
         return 0;
 }
 
+struct intel_version {
+        u8 status;
+        u8 hw_platform;
+        u8 hw_variant;
+        u8 hw_revision;
+        u8 fw_variant;
+        u8 fw_revision;
+        u8 fw_build_num;
+        u8 fw_build_ww;
+        u8 fw_build_yy;
+        u8 fw_patch_num;
+} __packed;
+
+static const struct firmware *btusb_setup_intel_get_fw(struct hci_dev *hdev,
+                                                struct intel_version *ver)
+{
+        const struct firmware *fw;
+        char fwname[64];
+        int ret;
+
+        snprintf(fwname, sizeof(fwname),
+                 "intel/ibt-hw-%x.%x.%x-fw-%x.%x.%x.%x.%x.bseq",
+                 ver->hw_platform, ver->hw_variant, ver->hw_revision,
+                 ver->fw_variant,  ver->fw_revision, ver->fw_build_num,
+                 ver->fw_build_ww, ver->fw_build_yy);
+
+        ret = request_firmware(&fw, fwname, &hdev->dev);
+        if (ret < 0) {
+                if (ret == -EINVAL) {
+                        BT_ERR("%s Intel firmware file request failed (%d)",
+                               hdev->name, ret);
+                        return NULL;
+                }
+
+                BT_ERR("%s failed to open Intel firmware file: %s(%d)",
+                       hdev->name, fwname, ret);
+
+                /* If the correct firmware patch file is not found, use the
+                 * default firmware patch file instead
+                 */
+                snprintf(fwname, sizeof(fwname), "intel/ibt-hw-%x.%x.bseq",
+                         ver->hw_platform, ver->hw_variant);
+                if (request_firmware(&fw, fwname, &hdev->dev) < 0) {
+                        BT_ERR("%s failed to open default Intel fw file: %s",
+                               hdev->name, fwname);
+                        return NULL;
+                }
+        }
+
+        BT_INFO("%s: Intel Bluetooth firmware file: %s", hdev->name, fwname);
+
+        return fw;
+}
+
+static int btusb_setup_intel_patching(struct hci_dev *hdev,
+                                      const struct firmware *fw,
+                                      const u8 **fw_ptr, int *disable_patch)
+{
+        struct sk_buff *skb;
+        struct hci_command_hdr *cmd;
+        const u8 *cmd_param;
+        struct hci_event_hdr *evt = NULL;
+        const u8 *evt_param = NULL;
+        int remain = fw->size - (*fw_ptr - fw->data);
+
+        /* The first byte indicates the types of the patch command or event.
+         * 0x01 means HCI command and 0x02 is HCI event. If the first bytes
+         * in the current firmware buffer doesn't start with 0x01 or
+         * the size of remain buffer is smaller than HCI command header,
+         * the firmware file is corrupted and it should stop the patching
+         * process.
+         */
+        if (remain > HCI_COMMAND_HDR_SIZE && *fw_ptr[0] != 0x01) {
+                BT_ERR("%s Intel fw corrupted: invalid cmd read", hdev->name);
+                return -EINVAL;
+        }
+        (*fw_ptr)++;
+        remain--;
+
+        cmd = (struct hci_command_hdr *)(*fw_ptr);
+        *fw_ptr += sizeof(*cmd);
+        remain -= sizeof(*cmd);
+
+        /* Ensure that the remain firmware data is long enough than the length
+         * of command parameter. If not, the firmware file is corrupted.
+         */
+        if (remain < cmd->plen) {
+                BT_ERR("%s Intel fw corrupted: invalid cmd len", hdev->name);
+                return -EFAULT;
+        }
+
+        /* If there is a command that loads a patch in the firmware
+         * file, then enable the patch upon success, otherwise just
+         * disable the manufacturer mode, for example patch activation
+         * is not required when the default firmware patch file is used
+         * because there are no patch data to load.
+         */
+        if (*disable_patch && le16_to_cpu(cmd->opcode) == 0xfc8e)
+                *disable_patch = 0;
+
+        cmd_param = *fw_ptr;
+        *fw_ptr += cmd->plen;
+        remain -= cmd->plen;
+
+        /* This reads the expected events when the above command is sent to the
+         * device. Some vendor commands expects more than one events, for
+         * example command status event followed by vendor specific event.
+         * For this case, it only keeps the last expected event. so the command
+         * can be sent with __hci_cmd_sync_ev() which returns the sk_buff of
+         * last expected event.
+         */
+        while (remain > HCI_EVENT_HDR_SIZE && *fw_ptr[0] == 0x02) {
+                (*fw_ptr)++;
+                remain--;
+
+                evt = (struct hci_event_hdr *)(*fw_ptr);
+                *fw_ptr += sizeof(*evt);
+                remain -= sizeof(*evt);
+
+                if (remain < evt->plen) {
+                        BT_ERR("%s Intel fw corrupted: invalid evt len",
+                               hdev->name);
+                        return -EFAULT;
+                }
+
+                evt_param = *fw_ptr;
+                *fw_ptr += evt->plen;
+                remain -= evt->plen;
+        }
+
+        /* Every HCI commands in the firmware file has its correspond event.
+         * If event is not found or remain is smaller than zero, the firmware
+         * file is corrupted.
+         */
+        if (!evt || !evt_param || remain < 0) {
+                BT_ERR("%s Intel fw corrupted: invalid evt read", hdev->name);
+                return -EFAULT;
+        }
+
+        skb = __hci_cmd_sync_ev(hdev, le16_to_cpu(cmd->opcode), cmd->plen,
+                                cmd_param, evt->evt, HCI_INIT_TIMEOUT);
+        if (IS_ERR(skb)) {
+                BT_ERR("%s sending Intel patch command (0x%4.4x) failed (%ld)",
+                       hdev->name, cmd->opcode, PTR_ERR(skb));
+                return -PTR_ERR(skb);
+        }
+
+        /* It ensures that the returned event matches the event data read from
+         * the firmware file. At fist, it checks the length and then
+         * the contents of the event.
+         */
+        if (skb->len != evt->plen) {
+                BT_ERR("%s mismatch event length (opcode 0x%4.4x)", hdev->name,
+                       le16_to_cpu(cmd->opcode));
+                kfree_skb(skb);
+                return -EFAULT;
+        }
+
+        if (memcmp(skb->data, evt_param, evt->plen)) {
+                BT_ERR("%s mismatch event parameter (opcode 0x%4.4x)",
+                       hdev->name, le16_to_cpu(cmd->opcode));