1 /* 2 * 3 * Bluetooth support for Broadcom devices 4 * 5 * Copyright (C) 2015 Intel Corporation 6 * 7 * 8 * This program is free software; you can redistribute it and/or modify 9 * it under the terms of the GNU General Public License as published by 10 * the Free Software Foundation; either version 2 of the License, or 11 * (at your option) any later version. 12 * 13 * This program is distributed in the hope that it will be useful, 14 * but WITHOUT ANY WARRANTY; without even the implied warranty of 15 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the 16 * GNU General Public License for more details. 17 * 18 * You should have received a copy of the GNU General Public License 19 * along with this program; if not, write to the Free Software 20 * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA 21 * 22 */ 23 24 #include <linux/module.h> 25 #include <linux/firmware.h> 26 #include <asm/unaligned.h> 27 28 #include <net/bluetooth/bluetooth.h> 29 #include <net/bluetooth/hci_core.h> 30 31 #include "btbcm.h" 32 33 #define VERSION "0.1" 34 35 #define BDADDR_BCM20702A0 (&(bdaddr_t) {{0x00, 0xa0, 0x02, 0x70, 0x20, 0x00}}) 36 #define BDADDR_BCM20702A1 (&(bdaddr_t) {{0x00, 0x00, 0xa0, 0x02, 0x70, 0x20}}) 37 #define BDADDR_BCM2076B1 (&(bdaddr_t) {{0x79, 0x56, 0x00, 0xa0, 0x76, 0x20}}) 38 #define BDADDR_BCM43430A0 (&(bdaddr_t) {{0xac, 0x1f, 0x12, 0xa0, 0x43, 0x43}}) 39 #define BDADDR_BCM4324B3 (&(bdaddr_t) {{0x00, 0x00, 0x00, 0xb3, 0x24, 0x43}}) 40 #define BDADDR_BCM4330B1 (&(bdaddr_t) {{0x00, 0x00, 0x00, 0xb1, 0x30, 0x43}}) 41 #define BDADDR_BCM43341B (&(bdaddr_t) {{0xac, 0x1f, 0x00, 0x1b, 0x34, 0x43}}) 42 43 int btbcm_check_bdaddr(struct hci_dev *hdev) 44 { 45 struct hci_rp_read_bd_addr *bda; 46 struct sk_buff *skb; 47 48 skb = __hci_cmd_sync(hdev, HCI_OP_READ_BD_ADDR, 0, NULL, 49 HCI_INIT_TIMEOUT); 50 if (IS_ERR(skb)) { 51 int err = PTR_ERR(skb); 52 bt_dev_err(hdev, "BCM: Reading device address failed (%d)", err); 53 return err; 54 } 55 56 if (skb->len != sizeof(*bda)) { 57 bt_dev_err(hdev, "BCM: Device address length mismatch"); 58 kfree_skb(skb); 59 return -EIO; 60 } 61 62 bda = (struct hci_rp_read_bd_addr *)skb->data; 63 64 /* Check if the address indicates a controller with either an 65 * invalid or default address. In both cases the device needs 66 * to be marked as not having a valid address. 67 * 68 * The address 00:20:70:02:A0:00 indicates a BCM20702A0 controller 69 * with no configured address. 70 * 71 * The address 20:70:02:A0:00:00 indicates a BCM20702A1 controller 72 * with no configured address. 73 * 74 * The address 20:76:A0:00:56:79 indicates a BCM2076B1 controller 75 * with no configured address. 76 * 77 * The address 43:24:B3:00:00:00 indicates a BCM4324B3 controller 78 * with waiting for configuration state. 79 * 80 * The address 43:30:B1:00:00:00 indicates a BCM4330B1 controller 81 * with waiting for configuration state. 82 * 83 * The address 43:43:A0:12:1F:AC indicates a BCM43430A0 controller 84 * with no configured address. 85 */ 86 if (!bacmp(&bda->bdaddr, BDADDR_BCM20702A0) || 87 !bacmp(&bda->bdaddr, BDADDR_BCM20702A1) || 88 !bacmp(&bda->bdaddr, BDADDR_BCM2076B1) || 89 !bacmp(&bda->bdaddr, BDADDR_BCM4324B3) || 90 !bacmp(&bda->bdaddr, BDADDR_BCM4330B1) || 91 !bacmp(&bda->bdaddr, BDADDR_BCM43430A0) || 92 !bacmp(&bda->bdaddr, BDADDR_BCM43341B)) { 93 bt_dev_info(hdev, "BCM: Using default device address (%pMR)", 94 &bda->bdaddr); 95 set_bit(HCI_QUIRK_INVALID_BDADDR, &hdev->quirks); 96 } 97 98 kfree_skb(skb); 99 100 return 0; 101 } 102 EXPORT_SYMBOL_GPL(btbcm_check_bdaddr); 103 104 int btbcm_set_bdaddr(struct hci_dev *hdev, const bdaddr_t *bdaddr) 105 { 106 struct sk_buff *skb; 107 int err; 108 109 skb = __hci_cmd_sync(hdev, 0xfc01, 6, bdaddr, HCI_INIT_TIMEOUT); 110 if (IS_ERR(skb)) { 111 err = PTR_ERR(skb); 112 bt_dev_err(hdev, "BCM: Change address command failed (%d)", err); 113 return err; 114 } 115 kfree_skb(skb); 116 117 return 0; 118 } 119 EXPORT_SYMBOL_GPL(btbcm_set_bdaddr); 120 121 int btbcm_patchram(struct hci_dev *hdev, const struct firmware *fw) 122 { 123 const struct hci_command_hdr *cmd; 124 const u8 *fw_ptr; 125 size_t fw_size; 126 struct sk_buff *skb; 127 u16 opcode; 128 int err = 0; 129 130 /* Start Download */ 131 skb = __hci_cmd_sync(hdev, 0xfc2e, 0, NULL, HCI_INIT_TIMEOUT); 132 if (IS_ERR(skb)) { 133 err = PTR_ERR(skb); 134 bt_dev_err(hdev, "BCM: Download Minidrv command failed (%d)", 135 err); 136 goto done; 137 } 138 kfree_skb(skb); 139 140 /* 50 msec delay after Download Minidrv completes */ 141 msleep(50); 142 143 fw_ptr = fw->data; 144 fw_size = fw->size; 145 146 while (fw_size >= sizeof(*cmd)) { 147 const u8 *cmd_param; 148 149 cmd = (struct hci_command_hdr *)fw_ptr; 150 fw_ptr += sizeof(*cmd); 151 fw_size -= sizeof(*cmd); 152 153 if (fw_size < cmd->plen) { 154 bt_dev_err(hdev, "BCM: Patch is corrupted"); 155 err = -EINVAL; 156 goto done; 157 } 158 159 cmd_param = fw_ptr; 160 fw_ptr += cmd->plen; 161 fw_size -= cmd->plen; 162 163 opcode = le16_to_cpu(cmd->opcode); 164 165 skb = __hci_cmd_sync(hdev, opcode, cmd->plen, cmd_param, 166 HCI_INIT_TIMEOUT); 167 if (IS_ERR(skb)) { 168 err = PTR_ERR(skb); 169 bt_dev_err(hdev, "BCM: Patch command %04x failed (%d)", 170 opcode, err); 171 goto done; 172 } 173 kfree_skb(skb); 174 } 175 176 /* 250 msec delay after Launch Ram completes */ 177 msleep(250); 178 179 done: 180 return err; 181 } 182 EXPORT_SYMBOL(btbcm_patchram); 183 184 static int btbcm_reset(struct hci_dev *hdev) 185 { 186 struct sk_buff *skb; 187 188 skb = __hci_cmd_sync(hdev, HCI_OP_RESET, 0, NULL, HCI_INIT_TIMEOUT); 189 if (IS_ERR(skb)) { 190 int err = PTR_ERR(skb); 191 bt_dev_err(hdev, "BCM: Reset failed (%d)", err); 192 return err; 193 } 194 kfree_skb(skb); 195 196 /* 100 msec delay for module to complete reset process */ 197 msleep(100); 198 199 return 0; 200 } 201 202 static struct sk_buff *btbcm_read_local_name(struct hci_dev *hdev) 203 { 204 struct sk_buff *skb; 205 206 skb = __hci_cmd_sync(hdev, HCI_OP_READ_LOCAL_NAME, 0, NULL, 207 HCI_INIT_TIMEOUT); 208 if (IS_ERR(skb)) { 209 bt_dev_err(hdev, "BCM: Reading local name failed (%ld)", 210 PTR_ERR(skb)); 211 return skb; 212 } 213 214 if (skb->len != sizeof(struct hci_rp_read_local_name)) { 215 bt_dev_err(hdev, "BCM: Local name length mismatch"); 216 kfree_skb(skb); 217 return ERR_PTR(-EIO); 218 } 219 220 return skb; 221 } 222 223 static struct sk_buff *btbcm_read_local_version(struct hci_dev *hdev) 224 { 225 struct sk_buff *skb; 226 227 skb = __hci_cmd_sync(hdev, HCI_OP_READ_LOCAL_VERSION, 0, NULL, 228 HCI_INIT_TIMEOUT); 229 if (IS_ERR(skb)) { 230 bt_dev_err(hdev, "BCM: Reading local version info failed (%ld)", 231 PTR_ERR(skb)); 232 return skb; 233 } 234 235 if (skb->len != sizeof(struct hci_rp_read_local_version)) { 236 bt_dev_err(hdev, "BCM: Local version length mismatch"); 237 kfree_skb(skb); 238 return ERR_PTR(-EIO); 239 } 240 241 return skb; 242 } 243 244 static struct sk_buff *btbcm_read_verbose_config(struct hci_dev *hdev) 245 { 246 struct sk_buff *skb; 247 248 skb = __hci_cmd_sync(hdev, 0xfc79, 0, NULL, HCI_INIT_TIMEOUT); 249 if (IS_ERR(skb)) { 250 bt_dev_err(hdev, "BCM: Read verbose config info failed (%ld)", 251 PTR_ERR(skb)); 252 return skb; 253 } 254 255 if (skb->len != 7) { 256 bt_dev_err(hdev, "BCM: Verbose config length mismatch"); 257 kfree_skb(skb); 258 return ERR_PTR(-EIO); 259 } 260 261 return skb; 262 } 263 264 static struct sk_buff *btbcm_read_controller_features(struct hci_dev *hdev) 265 { 266 struct sk_buff *skb; 267 268 skb = __hci_cmd_sync(hdev, 0xfc6e, 0, NULL, HCI_INIT_TIMEOUT); 269 if (IS_ERR(skb)) { 270 bt_dev_err(hdev, "BCM: Read controller features failed (%ld)", 271 PTR_ERR(skb)); 272 return skb; 273 } 274 275 if (skb->len != 9) { 276 bt_dev_err(hdev, "BCM: Controller features length mismatch"); 277 kfree_skb(skb); 278 return ERR_PTR(-EIO); 279 } 280 281 return skb; 282 } 283 284 static struct sk_buff *btbcm_read_usb_product(struct hci_dev *hdev) 285 { 286 struct sk_buff *skb; 287 288 skb = __hci_cmd_sync(hdev, 0xfc5a, 0, NULL, HCI_INIT_TIMEOUT); 289 if (IS_ERR(skb)) { 290 bt_dev_err(hdev, "BCM: Read USB product info failed (%ld)", 291 PTR_ERR(skb)); 292 return skb; 293 } 294 295 if (skb->len != 5) { 296 bt_dev_err(hdev, "BCM: USB product length mismatch"); 297 kfree_skb(skb); 298 return ERR_PTR(-EIO); 299 } 300 301 return skb; 302 } 303 304 static int btbcm_read_info(struct hci_dev *hdev) 305 { 306 struct sk_buff *skb; 307 308 /* Read Verbose Config Version Info */ 309 skb = btbcm_read_verbose_config(hdev); 310 if (IS_ERR(skb)) 311 return PTR_ERR(skb); 312 313 bt_dev_info(hdev, "BCM: chip id %u", skb->data[1]); 314 kfree_skb(skb); 315 316 /* Read Controller Features */ 317 skb = btbcm_read_controller_features(hdev); 318 if (IS_ERR(skb)) 319 return PTR_ERR(skb); 320 321 bt_dev_info(hdev, "BCM: features 0x%2.2x", skb->data[1]); 322 kfree_skb(skb); 323 324 /* Read Local Name */ 325 skb = btbcm_read_local_name(hdev); 326 if (IS_ERR(skb)) 327 return PTR_ERR(skb); 328 329 bt_dev_info(hdev, "%s", (char *)(skb->data + 1)); 330 kfree_skb(skb); 331 332 return 0; 333 } 334 335 struct bcm_subver_table { 336 u16 subver; 337 const char *name; 338 }; 339 340 static const struct bcm_subver_table bcm_uart_subver_table[] = { 341 { 0x4103, "BCM4330B1" }, /* 002.001.003 */ 342 { 0x410e, "BCM43341B0" }, /* 002.001.014 */ 343 { 0x4204, "BCM2076B1" }, /* 002.002.004 */ 344 { 0x4406, "BCM4324B3" }, /* 002.004.006 */ 345 { 0x6109, "BCM4335C0" }, /* 003.001.009 */ 346 { 0x610c, "BCM4354" }, /* 003.001.012 */ 347 { 0x2122, "BCM4343A0" }, /* 001.001.034 */ 348 { 0x2209, "BCM43430A1" }, /* 001.002.009 */ 349 { 0x6119, "BCM4345C0" }, /* 003.001.025 */ 350 { 0x230f, "BCM4356A2" }, /* 001.003.015 */ 351 { 0x220e, "BCM20702A1" }, /* 001.002.014 */ 352 { 0x4217, "BCM4329B1" }, /* 002.002.023 */ 353 { } 354 }; 355 356 static const struct bcm_subver_table bcm_usb_subver_table[] = { 357 { 0x210b, "BCM43142A0" }, /* 001.001.011 */ 358 { 0x2112, "BCM4314A0" }, /* 001.001.018 */ 359 { 0x2118, "BCM20702A0" }, /* 001.001.024 */ 360 { 0x2126, "BCM4335A0" }, /* 001.001.038 */ 361 { 0x220e, "BCM20702A1" }, /* 001.002.014 */ 362 { 0x230f, "BCM4354A2" }, /* 001.003.015 */ 363 { 0x4106, "BCM4335B0" }, /* 002.001.006 */ 364 { 0x410e, "BCM20702B0" }, /* 002.001.014 */ 365 { 0x6109, "BCM4335C0" }, /* 003.001.009 */ 366 { 0x610c, "BCM4354" }, /* 003.001.012 */ 367 { } 368 }; 369 370 int btbcm_initialize(struct hci_dev *hdev, char *fw_name, size_t len, 371 bool reinit) 372 { 373 u16 subver, rev, pid, vid; 374 const char *hw_name = "BCM"; 375 struct sk_buff *skb; 376 struct hci_rp_read_local_version *ver; 377 const struct bcm_subver_table *bcm_subver_table; 378 int i, err; 379 380 /* Reset */ 381 err = btbcm_reset(hdev); 382 if (err) 383 return err; 384 385 /* Read Local Version Info */ 386 skb = btbcm_read_local_version(hdev); 387 if (IS_ERR(skb)) 388 return PTR_ERR(skb); 389 390 ver = (struct hci_rp_read_local_version *)skb->data; 391 rev = le16_to_cpu(ver->hci_rev); 392 subver = le16_to_cpu(ver->lmp_subver); 393 kfree_skb(skb); 394 395 /* Read controller information */ 396 if (!reinit) { 397 err = btbcm_read_info(hdev); 398 if (err) 399 return err; 400 } 401 402 /* Upper nibble of rev should be between 0 and 3? */ 403 if (((rev & 0xf000) >> 12) > 3) 404 return 0; 405 406 bcm_subver_table = (hdev->bus == HCI_USB) ? bcm_usb_subver_table : 407 bcm_uart_subver_table; 408 409 for (i = 0; bcm_subver_table[i].name; i++) { 410 if (subver == bcm_subver_table[i].subver) { 411 hw_name = bcm_subver_table[i].name; 412 break; 413 } 414 } 415 416 if (hdev->bus == HCI_USB) { 417 /* Read USB Product Info */ 418 skb = btbcm_read_usb_product(hdev); 419 if (IS_ERR(skb)) 420 return PTR_ERR(skb); 421 422 vid = get_unaligned_le16(skb->data + 1); 423 pid = get_unaligned_le16(skb->data + 3); 424 kfree_skb(skb); 425 426 snprintf(fw_name, len, "brcm/%s-%4.4x-%4.4x.hcd", 427 hw_name, vid, pid); 428 } else { 429 snprintf(fw_name, len, "brcm/%s.hcd", hw_name); 430 } 431 432 bt_dev_info(hdev, "%s (%3.3u.%3.3u.%3.3u) build %4.4u", 433 hw_name, (subver & 0xe000) >> 13, 434 (subver & 0x1f00) >> 8, (subver & 0x00ff), rev & 0x0fff); 435 436 return 0; 437 } 438 EXPORT_SYMBOL_GPL(btbcm_initialize); 439 440 int btbcm_finalize(struct hci_dev *hdev) 441 { 442 char fw_name[64]; 443 int err; 444 445 /* Re-initialize */ 446 err = btbcm_initialize(hdev, fw_name, sizeof(fw_name), true); 447 if (err) 448 return err; 449 450 btbcm_check_bdaddr(hdev); 451 452 set_bit(HCI_QUIRK_STRICT_DUPLICATE_FILTER, &hdev->quirks); 453 454 return 0; 455 } 456 EXPORT_SYMBOL_GPL(btbcm_finalize); 457 458 int btbcm_setup_patchram(struct hci_dev *hdev) 459 { 460 char fw_name[64]; 461 const struct firmware *fw; 462 struct sk_buff *skb; 463 int err; 464 465 /* Initialize */ 466 err = btbcm_initialize(hdev, fw_name, sizeof(fw_name), false); 467 if (err) 468 return err; 469 470 err = request_firmware(&fw, fw_name, &hdev->dev); 471 if (err < 0) { 472 bt_dev_info(hdev, "BCM: Patch %s not found", fw_name); 473 goto done; 474 } 475 476 btbcm_patchram(hdev, fw); 477 478 release_firmware(fw); 479 480 /* Re-initialize */ 481 err = btbcm_initialize(hdev, fw_name, sizeof(fw_name), true); 482 if (err) 483 return err; 484 485 /* Read Local Name */ 486 skb = btbcm_read_local_name(hdev); 487 if (IS_ERR(skb)) 488 return PTR_ERR(skb); 489 490 bt_dev_info(hdev, "%s", (char *)(skb->data + 1)); 491 kfree_skb(skb); 492 493 done: 494 btbcm_check_bdaddr(hdev); 495 496 set_bit(HCI_QUIRK_STRICT_DUPLICATE_FILTER, &hdev->quirks); 497 498 return 0; 499 } 500 EXPORT_SYMBOL_GPL(btbcm_setup_patchram); 501 502 int btbcm_setup_apple(struct hci_dev *hdev) 503 { 504 struct sk_buff *skb; 505 int err; 506 507 /* Reset */ 508 err = btbcm_reset(hdev); 509 if (err) 510 return err; 511 512 /* Read Verbose Config Version Info */ 513 skb = btbcm_read_verbose_config(hdev); 514 if (!IS_ERR(skb)) { 515 bt_dev_info(hdev, "BCM: chip id %u build %4.4u", 516 skb->data[1], get_unaligned_le16(skb->data + 5)); 517 kfree_skb(skb); 518 } 519 520 /* Read USB Product Info */ 521 skb = btbcm_read_usb_product(hdev); 522 if (!IS_ERR(skb)) { 523 bt_dev_info(hdev, "BCM: product %4.4x:%4.4x", 524 get_unaligned_le16(skb->data + 1), 525 get_unaligned_le16(skb->data + 3)); 526 kfree_skb(skb); 527 } 528 529 /* Read Controller Features */ 530 skb = btbcm_read_controller_features(hdev); 531 if (!IS_ERR(skb)) { 532 bt_dev_info(hdev, "BCM: features 0x%2.2x", skb->data[1]); 533 kfree_skb(skb); 534 } 535 536 /* Read Local Name */ 537 skb = btbcm_read_local_name(hdev); 538 if (!IS_ERR(skb)) { 539 bt_dev_info(hdev, "%s", (char *)(skb->data + 1)); 540 kfree_skb(skb); 541 } 542 543 set_bit(HCI_QUIRK_STRICT_DUPLICATE_FILTER, &hdev->quirks); 544 545 return 0; 546 } 547 EXPORT_SYMBOL_GPL(btbcm_setup_apple); 548 549 MODULE_AUTHOR("Marcel Holtmann <marcel@holtmann.org>"); 550 MODULE_DESCRIPTION("Bluetooth support for Broadcom devices ver " VERSION); 551 MODULE_VERSION(VERSION); 552 MODULE_LICENSE("GPL"); 553