@@ -683,12 +683,14 @@ static int nxp_recv_chip_ver_v1(struct hci_dev *hdev, struct sk_buff *skb)
683
683
{
684
684
struct btnxpuart_dev * nxpdev = hci_get_drvdata (hdev );
685
685
struct v1_start_ind * req ;
686
+ __u16 chip_id ;
686
687
687
- req = ( struct v1_start_ind * ) skb_pull_data (skb , sizeof (struct v1_start_ind ));
688
+ req = skb_pull_data (skb , sizeof (* req ));
688
689
if (!req )
689
690
goto free_skb ;
690
691
691
- if ((req -> chip_id ^ req -> chip_id_comp ) == 0xffff ) {
692
+ chip_id = le16_to_cpu (req -> chip_id ^ req -> chip_id_comp );
693
+ if (chip_id == 0xffff ) {
692
694
nxpdev -> fw_dnld_v1_offset = 0 ;
693
695
nxpdev -> fw_v1_sent_bytes = 0 ;
694
696
nxpdev -> fw_v1_expected_len = HDR_LEN ;
@@ -707,29 +709,34 @@ static int nxp_recv_fw_req_v1(struct hci_dev *hdev, struct sk_buff *skb)
707
709
struct btnxpuart_dev * nxpdev = hci_get_drvdata (hdev );
708
710
struct btnxpuart_data * nxp_data = nxpdev -> nxp_data ;
709
711
struct v1_data_req * req ;
710
- u32 requested_len ;
712
+ __u16 len ;
711
713
712
714
if (!process_boot_signature (nxpdev ))
713
715
goto free_skb ;
714
716
715
- req = ( struct v1_data_req * ) skb_pull_data (skb , sizeof (struct v1_data_req ));
717
+ req = skb_pull_data (skb , sizeof (* req ));
716
718
if (!req )
717
719
goto free_skb ;
718
720
719
- if ((req -> len ^ req -> len_comp ) != 0xffff ) {
721
+ len = __le16_to_cpu (req -> len ^ req -> len_comp );
722
+ if (len != 0xffff ) {
720
723
bt_dev_dbg (hdev , "ERR: Send NAK" );
721
724
nxp_send_ack (NXP_NAK_V1 , hdev );
722
725
goto free_skb ;
723
726
}
724
727
nxp_send_ack (NXP_ACK_V1 , hdev );
725
728
729
+ len = __le16_to_cpu (req -> len );
730
+
726
731
if (!nxp_data -> helper_fw_name ) {
727
732
if (!nxpdev -> timeout_changed ) {
728
- nxpdev -> timeout_changed = nxp_fw_change_timeout (hdev , req -> len );
733
+ nxpdev -> timeout_changed = nxp_fw_change_timeout (hdev ,
734
+ len );
729
735
goto free_skb ;
730
736
}
731
737
if (!nxpdev -> baudrate_changed ) {
732
- nxpdev -> baudrate_changed = nxp_fw_change_baudrate (hdev , req -> len );
738
+ nxpdev -> baudrate_changed = nxp_fw_change_baudrate (hdev ,
739
+ len );
733
740
if (nxpdev -> baudrate_changed ) {
734
741
serdev_device_set_baudrate (nxpdev -> serdev ,
735
742
HCI_NXP_SEC_BAUDRATE );
@@ -748,26 +755,27 @@ static int nxp_recv_fw_req_v1(struct hci_dev *hdev, struct sk_buff *skb)
748
755
goto free_skb ;
749
756
}
750
757
751
- requested_len = req -> len ;
752
- if ( requested_len == 0 ) {
753
- bt_dev_dbg ( hdev , "FW Downloaded Successfully: %zu bytes" , nxpdev -> fw -> size );
758
+ if (! len ) {
759
+ bt_dev_dbg ( hdev , "FW Downloaded Successfully: %zu bytes" ,
760
+ nxpdev -> fw -> size );
754
761
if (nxp_data -> helper_fw_name && !nxpdev -> helper_downloaded ) {
755
762
nxpdev -> helper_downloaded = true;
756
763
serdev_device_wait_until_sent (nxpdev -> serdev , 0 );
757
- serdev_device_set_baudrate (nxpdev -> serdev , HCI_NXP_SEC_BAUDRATE );
764
+ serdev_device_set_baudrate (nxpdev -> serdev ,
765
+ HCI_NXP_SEC_BAUDRATE );
758
766
serdev_device_set_flow_control (nxpdev -> serdev , 1 );
759
767
} else {
760
768
clear_bit (BTNXPUART_FW_DOWNLOADING , & nxpdev -> tx_state );
761
769
wake_up_interruptible (& nxpdev -> fw_dnld_done_wait_q );
762
770
}
763
771
goto free_skb ;
764
772
}
765
- if (requested_len & 0x01 ) {
773
+ if (len & 0x01 ) {
766
774
/* The CRC did not match at the other end.
767
775
* Simply send the same bytes again.
768
776
*/
769
- requested_len = nxpdev -> fw_v1_sent_bytes ;
770
- bt_dev_dbg (hdev , "CRC error. Resend %d bytes of FW." , requested_len );
777
+ len = nxpdev -> fw_v1_sent_bytes ;
778
+ bt_dev_dbg (hdev , "CRC error. Resend %d bytes of FW." , len );
771
779
} else {
772
780
nxpdev -> fw_dnld_v1_offset += nxpdev -> fw_v1_sent_bytes ;
773
781
@@ -781,24 +789,23 @@ static int nxp_recv_fw_req_v1(struct hci_dev *hdev, struct sk_buff *skb)
781
789
* mismatch, clearly the driver and FW are out of sync,
782
790
* and we need to re-send the previous header again.
783
791
*/
784
- if (requested_len == nxpdev -> fw_v1_expected_len ) {
785
- if (requested_len == HDR_LEN )
792
+ if (len == nxpdev -> fw_v1_expected_len ) {
793
+ if (len == HDR_LEN )
786
794
nxpdev -> fw_v1_expected_len = nxp_get_data_len (nxpdev -> fw -> data +
787
795
nxpdev -> fw_dnld_v1_offset );
788
796
else
789
797
nxpdev -> fw_v1_expected_len = HDR_LEN ;
790
- } else if (requested_len == HDR_LEN ) {
798
+ } else if (len == HDR_LEN ) {
791
799
/* FW download out of sync. Send previous chunk again */
792
800
nxpdev -> fw_dnld_v1_offset -= nxpdev -> fw_v1_sent_bytes ;
793
801
nxpdev -> fw_v1_expected_len = HDR_LEN ;
794
802
}
795
803
}
796
804
797
- if (nxpdev -> fw_dnld_v1_offset + requested_len <= nxpdev -> fw -> size )
798
- serdev_device_write_buf (nxpdev -> serdev ,
799
- nxpdev -> fw -> data + nxpdev -> fw_dnld_v1_offset ,
800
- requested_len );
801
- nxpdev -> fw_v1_sent_bytes = requested_len ;
805
+ if (nxpdev -> fw_dnld_v1_offset + len <= nxpdev -> fw -> size )
806
+ serdev_device_write_buf (nxpdev -> serdev , nxpdev -> fw -> data +
807
+ nxpdev -> fw_dnld_v1_offset , len );
808
+ nxpdev -> fw_v1_sent_bytes = len ;
802
809
803
810
free_skb :
804
811
kfree_skb (skb );
@@ -828,13 +835,16 @@ static char *nxp_get_fw_name_from_chipid(struct hci_dev *hdev, u16 chipid)
828
835
829
836
static int nxp_recv_chip_ver_v3 (struct hci_dev * hdev , struct sk_buff * skb )
830
837
{
831
- struct v3_start_ind * req = skb_pull_data (skb , sizeof (struct v3_start_ind ));
838
+ struct v3_start_ind * req = skb_pull_data (skb , sizeof (* req ));
832
839
struct btnxpuart_dev * nxpdev = hci_get_drvdata (hdev );
840
+ u16 chip_id ;
833
841
834
842
if (!process_boot_signature (nxpdev ))
835
843
goto free_skb ;
836
844
837
- if (!nxp_request_firmware (hdev , nxp_get_fw_name_from_chipid (hdev , req -> chip_id )))
845
+ chip_id = le16_to_cpu (req -> chip_id );
846
+ if (!nxp_request_firmware (hdev , nxp_get_fw_name_from_chipid (hdev ,
847
+ chip_id )))
838
848
nxp_send_ack (NXP_ACK_V3 , hdev );
839
849
840
850
free_skb :
@@ -846,23 +856,27 @@ static int nxp_recv_fw_req_v3(struct hci_dev *hdev, struct sk_buff *skb)
846
856
{
847
857
struct btnxpuart_dev * nxpdev = hci_get_drvdata (hdev );
848
858
struct v3_data_req * req ;
859
+ __u16 len ;
860
+ __u32 offset ;
849
861
850
862
if (!process_boot_signature (nxpdev ))
851
863
goto free_skb ;
852
864
853
- req = ( struct v3_data_req * ) skb_pull_data (skb , sizeof (struct v3_data_req ));
865
+ req = skb_pull_data (skb , sizeof (* req ));
854
866
if (!req || !nxpdev -> fw )
855
867
goto free_skb ;
856
868
857
869
nxp_send_ack (NXP_ACK_V3 , hdev );
858
870
871
+ len = __le16_to_cpu (req -> len );
872
+
859
873
if (!nxpdev -> timeout_changed ) {
860
- nxpdev -> timeout_changed = nxp_fw_change_timeout (hdev , req -> len );
874
+ nxpdev -> timeout_changed = nxp_fw_change_timeout (hdev , len );
861
875
goto free_skb ;
862
876
}
863
877
864
878
if (!nxpdev -> baudrate_changed ) {
865
- nxpdev -> baudrate_changed = nxp_fw_change_baudrate (hdev , req -> len );
879
+ nxpdev -> baudrate_changed = nxp_fw_change_baudrate (hdev , len );
866
880
if (nxpdev -> baudrate_changed ) {
867
881
serdev_device_set_baudrate (nxpdev -> serdev ,
868
882
HCI_NXP_SEC_BAUDRATE );
@@ -873,25 +887,28 @@ static int nxp_recv_fw_req_v3(struct hci_dev *hdev, struct sk_buff *skb)
873
887
}
874
888
875
889
if (req -> len == 0 ) {
876
- bt_dev_dbg (hdev , "FW Downloaded Successfully: %zu bytes" , nxpdev -> fw -> size );
890
+ bt_dev_dbg (hdev , "FW Downloaded Successfully: %zu bytes" ,
891
+ nxpdev -> fw -> size );
877
892
clear_bit (BTNXPUART_FW_DOWNLOADING , & nxpdev -> tx_state );
878
893
wake_up_interruptible (& nxpdev -> fw_dnld_done_wait_q );
879
894
goto free_skb ;
880
895
}
881
896
if (req -> error )
882
- bt_dev_dbg (hdev , "FW Download received err 0x%02x from chip" , req -> error );
897
+ bt_dev_dbg (hdev , "FW Download received err 0x%02x from chip" ,
898
+ req -> error );
883
899
884
- if (req -> offset < nxpdev -> fw_v3_offset_correction ) {
900
+ offset = __le32_to_cpu (req -> offset );
901
+ if (offset < nxpdev -> fw_v3_offset_correction ) {
885
902
/* This scenario should ideally never occur. But if it ever does,
886
903
* FW is out of sync and needs a power cycle.
887
904
*/
888
- bt_dev_err (hdev , "Something went wrong during FW download. Please power cycle and try again" );
905
+ bt_dev_err (hdev , "Something went wrong during FW download" );
906
+ bt_dev_err (hdev , "Please power cycle and try again" );
889
907
goto free_skb ;
890
908
}
891
909
892
- serdev_device_write_buf (nxpdev -> serdev ,
893
- nxpdev -> fw -> data + req -> offset - nxpdev -> fw_v3_offset_correction ,
894
- req -> len );
910
+ serdev_device_write_buf (nxpdev -> serdev , nxpdev -> fw -> data + offset -
911
+ nxpdev -> fw_v3_offset_correction , len );
895
912
896
913
free_skb :
897
914
kfree_skb (skb );
0 commit comments