1 /* 2 * 3 * Bluetooth support for Broadcom devices 4 * 5 * Copyright (C) 2015 Intel Corporation 6 * 7 * 8 * This program is free software; you can redistribute it and/or modify 9 * it under the terms of the GNU General Public License as published by 10 * the Free Software Foundation; either version 2 of the License, or 11 * (at your option) any later version. 12 * 13 * This program is distributed in the hope that it will be useful, 14 * but WITHOUT ANY WARRANTY; without even the implied warranty of 15 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the 16 * GNU General Public License for more details. 17 * 18 * You should have received a copy of the GNU General Public License 19 * along with this program; if not, write to the Free Software 20 * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA 21 * 22 */ 23 24 #include <linux/module.h> 25 #include <linux/firmware.h> 26 #include <asm/unaligned.h> 27 28 #include <net/bluetooth/bluetooth.h> 29 #include <net/bluetooth/hci_core.h> 30 31 #include "btbcm.h" 32 33 #define VERSION "0.1" 34 35 #define BDADDR_BCM20702A0 (&(bdaddr_t) {{0x00, 0xa0, 0x02, 0x70, 0x20, 0x00}}) 36 #define BDADDR_BCM4324B3 (&(bdaddr_t) {{0x00, 0x00, 0x00, 0xb3, 0x24, 0x43}}) 37 #define BDADDR_BCM4330B1 (&(bdaddr_t) {{0x00, 0x00, 0x00, 0xb1, 0x30, 0x43}}) 38 39 int btbcm_check_bdaddr(struct hci_dev *hdev) 40 { 41 struct hci_rp_read_bd_addr *bda; 42 struct sk_buff *skb; 43 44 skb = __hci_cmd_sync(hdev, HCI_OP_READ_BD_ADDR, 0, NULL, 45 HCI_INIT_TIMEOUT); 46 if (IS_ERR(skb)) { 47 int err = PTR_ERR(skb); 48 bt_dev_err(hdev, "BCM: Reading device address failed (%d)", err); 49 return err; 50 } 51 52 if (skb->len != sizeof(*bda)) { 53 bt_dev_err(hdev, "BCM: Device address length mismatch"); 54 kfree_skb(skb); 55 return -EIO; 56 } 57 58 bda = (struct hci_rp_read_bd_addr *)skb->data; 59 60 /* Check if the address indicates a controller with either an 61 * invalid or default address. In both cases the device needs 62 * to be marked as not having a valid address. 63 * 64 * The address 00:20:70:02:A0:00 indicates a BCM20702A0 controller 65 * with no configured address. 66 * 67 * The address 43:24:B3:00:00:00 indicates a BCM4324B3 controller 68 * with waiting for configuration state. 69 * 70 * The address 43:30:B1:00:00:00 indicates a BCM4330B1 controller 71 * with waiting for configuration state. 72 */ 73 if (!bacmp(&bda->bdaddr, BDADDR_BCM20702A0) || 74 !bacmp(&bda->bdaddr, BDADDR_BCM4324B3) || 75 !bacmp(&bda->bdaddr, BDADDR_BCM4330B1)) { 76 bt_dev_info(hdev, "BCM: Using default device address (%pMR)", 77 &bda->bdaddr); 78 set_bit(HCI_QUIRK_INVALID_BDADDR, &hdev->quirks); 79 } 80 81 kfree_skb(skb); 82 83 return 0; 84 } 85 EXPORT_SYMBOL_GPL(btbcm_check_bdaddr); 86 87 int btbcm_set_bdaddr(struct hci_dev *hdev, const bdaddr_t *bdaddr) 88 { 89 struct sk_buff *skb; 90 int err; 91 92 skb = __hci_cmd_sync(hdev, 0xfc01, 6, bdaddr, HCI_INIT_TIMEOUT); 93 if (IS_ERR(skb)) { 94 err = PTR_ERR(skb); 95 bt_dev_err(hdev, "BCM: Change address command failed (%d)", err); 96 return err; 97 } 98 kfree_skb(skb); 99 100 return 0; 101 } 102 EXPORT_SYMBOL_GPL(btbcm_set_bdaddr); 103 104 int btbcm_patchram(struct hci_dev *hdev, const struct firmware *fw) 105 { 106 const struct hci_command_hdr *cmd; 107 const u8 *fw_ptr; 108 size_t fw_size; 109 struct sk_buff *skb; 110 u16 opcode; 111 int err = 0; 112 113 /* Start Download */ 114 skb = __hci_cmd_sync(hdev, 0xfc2e, 0, NULL, HCI_INIT_TIMEOUT); 115 if (IS_ERR(skb)) { 116 err = PTR_ERR(skb); 117 bt_dev_err(hdev, "BCM: Download Minidrv command failed (%d)", 118 err); 119 goto done; 120 } 121 kfree_skb(skb); 122 123 /* 50 msec delay after Download Minidrv completes */ 124 msleep(50); 125 126 fw_ptr = fw->data; 127 fw_size = fw->size; 128 129 while (fw_size >= sizeof(*cmd)) { 130 const u8 *cmd_param; 131 132 cmd = (struct hci_command_hdr *)fw_ptr; 133 fw_ptr += sizeof(*cmd); 134 fw_size -= sizeof(*cmd); 135 136 if (fw_size < cmd->plen) { 137 bt_dev_err(hdev, "BCM: Patch is corrupted"); 138 err = -EINVAL; 139 goto done; 140 } 141 142 cmd_param = fw_ptr; 143 fw_ptr += cmd->plen; 144 fw_size -= cmd->plen; 145 146 opcode = le16_to_cpu(cmd->opcode); 147 148 skb = __hci_cmd_sync(hdev, opcode, cmd->plen, cmd_param, 149 HCI_INIT_TIMEOUT); 150 if (IS_ERR(skb)) { 151 err = PTR_ERR(skb); 152 bt_dev_err(hdev, "BCM: Patch command %04x failed (%d)", 153 opcode, err); 154 goto done; 155 } 156 kfree_skb(skb); 157 } 158 159 /* 250 msec delay after Launch Ram completes */ 160 msleep(250); 161 162 done: 163 return err; 164 } 165 EXPORT_SYMBOL(btbcm_patchram); 166 167 static int btbcm_reset(struct hci_dev *hdev) 168 { 169 struct sk_buff *skb; 170 171 skb = __hci_cmd_sync(hdev, HCI_OP_RESET, 0, NULL, HCI_INIT_TIMEOUT); 172 if (IS_ERR(skb)) { 173 int err = PTR_ERR(skb); 174 bt_dev_err(hdev, "BCM: Reset failed (%d)", err); 175 return err; 176 } 177 kfree_skb(skb); 178 179 /* 100 msec delay for module to complete reset process */ 180 msleep(100); 181 182 return 0; 183 } 184 185 static struct sk_buff *btbcm_read_local_name(struct hci_dev *hdev) 186 { 187 struct sk_buff *skb; 188 189 skb = __hci_cmd_sync(hdev, HCI_OP_READ_LOCAL_NAME, 0, NULL, 190 HCI_INIT_TIMEOUT); 191 if (IS_ERR(skb)) { 192 bt_dev_err(hdev, "BCM: Reading local name failed (%ld)", 193 PTR_ERR(skb)); 194 return skb; 195 } 196 197 if (skb->len != sizeof(struct hci_rp_read_local_name)) { 198 bt_dev_err(hdev, "BCM: Local name length mismatch"); 199 kfree_skb(skb); 200 return ERR_PTR(-EIO); 201 } 202 203 return skb; 204 } 205 206 static struct sk_buff *btbcm_read_local_version(struct hci_dev *hdev) 207 { 208 struct sk_buff *skb; 209 210 skb = __hci_cmd_sync(hdev, HCI_OP_READ_LOCAL_VERSION, 0, NULL, 211 HCI_INIT_TIMEOUT); 212 if (IS_ERR(skb)) { 213 bt_dev_err(hdev, "BCM: Reading local version info failed (%ld)", 214 PTR_ERR(skb)); 215 return skb; 216 } 217 218 if (skb->len != sizeof(struct hci_rp_read_local_version)) { 219 bt_dev_err(hdev, "BCM: Local version length mismatch"); 220 kfree_skb(skb); 221 return ERR_PTR(-EIO); 222 } 223 224 return skb; 225 } 226 227 static struct sk_buff *btbcm_read_verbose_config(struct hci_dev *hdev) 228 { 229 struct sk_buff *skb; 230 231 skb = __hci_cmd_sync(hdev, 0xfc79, 0, NULL, HCI_INIT_TIMEOUT); 232 if (IS_ERR(skb)) { 233 bt_dev_err(hdev, "BCM: Read verbose config info failed (%ld)", 234 PTR_ERR(skb)); 235 return skb; 236 } 237 238 if (skb->len != 7) { 239 bt_dev_err(hdev, "BCM: Verbose config length mismatch"); 240 kfree_skb(skb); 241 return ERR_PTR(-EIO); 242 } 243 244 return skb; 245 } 246 247 static struct sk_buff *btbcm_read_controller_features(struct hci_dev *hdev) 248 { 249 struct sk_buff *skb; 250 251 skb = __hci_cmd_sync(hdev, 0xfc6e, 0, NULL, HCI_INIT_TIMEOUT); 252 if (IS_ERR(skb)) { 253 bt_dev_err(hdev, "BCM: Read controller features failed (%ld)", 254 PTR_ERR(skb)); 255 return skb; 256 } 257 258 if (skb->len != 9) { 259 bt_dev_err(hdev, "BCM: Controller features length mismatch"); 260 kfree_skb(skb); 261 return ERR_PTR(-EIO); 262 } 263 264 return skb; 265 } 266 267 static struct sk_buff *btbcm_read_usb_product(struct hci_dev *hdev) 268 { 269 struct sk_buff *skb; 270 271 skb = __hci_cmd_sync(hdev, 0xfc5a, 0, NULL, HCI_INIT_TIMEOUT); 272 if (IS_ERR(skb)) { 273 bt_dev_err(hdev, "BCM: Read USB product info failed (%ld)", 274 PTR_ERR(skb)); 275 return skb; 276 } 277 278 if (skb->len != 5) { 279 bt_dev_err(hdev, "BCM: USB product length mismatch"); 280 kfree_skb(skb); 281 return ERR_PTR(-EIO); 282 } 283 284 return skb; 285 } 286 287 static int btbcm_read_info(struct hci_dev *hdev) 288 { 289 struct sk_buff *skb; 290 291 /* Read Verbose Config Version Info */ 292 skb = btbcm_read_verbose_config(hdev); 293 if (IS_ERR(skb)) 294 return PTR_ERR(skb); 295 296 bt_dev_info(hdev, "BCM: chip id %u", skb->data[1]); 297 kfree_skb(skb); 298 299 /* Read Controller Features */ 300 skb = btbcm_read_controller_features(hdev); 301 if (IS_ERR(skb)) 302 return PTR_ERR(skb); 303 304 bt_dev_info(hdev, "BCM: features 0x%2.2x", skb->data[1]); 305 kfree_skb(skb); 306 307 /* Read Local Name */ 308 skb = btbcm_read_local_name(hdev); 309 if (IS_ERR(skb)) 310 return PTR_ERR(skb); 311 312 bt_dev_info(hdev, "%s", (char *)(skb->data + 1)); 313 kfree_skb(skb); 314 315 return 0; 316 } 317 318 static const struct { 319 u16 subver; 320 const char *name; 321 } bcm_uart_subver_table[] = { 322 { 0x4103, "BCM4330B1" }, /* 002.001.003 */ 323 { 0x410e, "BCM43341B0" }, /* 002.001.014 */ 324 { 0x4406, "BCM4324B3" }, /* 002.004.006 */ 325 { 0x610c, "BCM4354" }, /* 003.001.012 */ 326 { 0x2122, "BCM4343A0" }, /* 001.001.034 */ 327 { 0x2209, "BCM43430A1" }, /* 001.002.009 */ 328 { 0x6119, "BCM4345C0" }, /* 003.001.025 */ 329 { 0x230f, "BCM4356A2" }, /* 001.003.015 */ 330 { } 331 }; 332 333 int btbcm_initialize(struct hci_dev *hdev, char *fw_name, size_t len) 334 { 335 u16 subver, rev; 336 const char *hw_name = NULL; 337 struct sk_buff *skb; 338 struct hci_rp_read_local_version *ver; 339 int i, err; 340 341 /* Reset */ 342 err = btbcm_reset(hdev); 343 if (err) 344 return err; 345 346 /* Read Local Version Info */ 347 skb = btbcm_read_local_version(hdev); 348 if (IS_ERR(skb)) 349 return PTR_ERR(skb); 350 351 ver = (struct hci_rp_read_local_version *)skb->data; 352 rev = le16_to_cpu(ver->hci_rev); 353 subver = le16_to_cpu(ver->lmp_subver); 354 kfree_skb(skb); 355 356 /* Read controller information */ 357 err = btbcm_read_info(hdev); 358 if (err) 359 return err; 360 361 switch ((rev & 0xf000) >> 12) { 362 case 0: 363 case 1: 364 case 2: 365 case 3: 366 for (i = 0; bcm_uart_subver_table[i].name; i++) { 367 if (subver == bcm_uart_subver_table[i].subver) { 368 hw_name = bcm_uart_subver_table[i].name; 369 break; 370 } 371 } 372 373 snprintf(fw_name, len, "brcm/%s.hcd", hw_name ? : "BCM"); 374 break; 375 default: 376 return 0; 377 } 378 379 bt_dev_info(hdev, "%s (%3.3u.%3.3u.%3.3u) build %4.4u", 380 hw_name ? : "BCM", (subver & 0xe000) >> 13, 381 (subver & 0x1f00) >> 8, (subver & 0x00ff), rev & 0x0fff); 382 383 return 0; 384 } 385 EXPORT_SYMBOL_GPL(btbcm_initialize); 386 387 int btbcm_finalize(struct hci_dev *hdev) 388 { 389 struct sk_buff *skb; 390 struct hci_rp_read_local_version *ver; 391 u16 subver, rev; 392 int err; 393 394 /* Reset */ 395 err = btbcm_reset(hdev); 396 if (err) 397 return err; 398 399 /* Read Local Version Info */ 400 skb = btbcm_read_local_version(hdev); 401 if (IS_ERR(skb)) 402 return PTR_ERR(skb); 403 404 ver = (struct hci_rp_read_local_version *)skb->data; 405 rev = le16_to_cpu(ver->hci_rev); 406 subver = le16_to_cpu(ver->lmp_subver); 407 kfree_skb(skb); 408 409 bt_dev_info(hdev, "BCM (%3.3u.%3.3u.%3.3u) build %4.4u", 410 (subver & 0xe000) >> 13, (subver & 0x1f00) >> 8, 411 (subver & 0x00ff), rev & 0x0fff); 412 413 btbcm_check_bdaddr(hdev); 414 415 set_bit(HCI_QUIRK_STRICT_DUPLICATE_FILTER, &hdev->quirks); 416 417 return 0; 418 } 419 EXPORT_SYMBOL_GPL(btbcm_finalize); 420 421 static const struct { 422 u16 subver; 423 const char *name; 424 } bcm_usb_subver_table[] = { 425 { 0x210b, "BCM43142A0" }, /* 001.001.011 */ 426 { 0x2112, "BCM4314A0" }, /* 001.001.018 */ 427 { 0x2118, "BCM20702A0" }, /* 001.001.024 */ 428 { 0x2126, "BCM4335A0" }, /* 001.001.038 */ 429 { 0x220e, "BCM20702A1" }, /* 001.002.014 */ 430 { 0x230f, "BCM4354A2" }, /* 001.003.015 */ 431 { 0x4106, "BCM4335B0" }, /* 002.001.006 */ 432 { 0x410e, "BCM20702B0" }, /* 002.001.014 */ 433 { 0x6109, "BCM4335C0" }, /* 003.001.009 */ 434 { 0x610c, "BCM4354" }, /* 003.001.012 */ 435 { } 436 }; 437 438 int btbcm_setup_patchram(struct hci_dev *hdev) 439 { 440 char fw_name[64]; 441 const struct firmware *fw; 442 u16 subver, rev, pid, vid; 443 const char *hw_name = NULL; 444 struct sk_buff *skb; 445 struct hci_rp_read_local_version *ver; 446 int i, err; 447 448 /* Reset */ 449 err = btbcm_reset(hdev); 450 if (err) 451 return err; 452 453 /* Read Local Version Info */ 454 skb = btbcm_read_local_version(hdev); 455 if (IS_ERR(skb)) 456 return PTR_ERR(skb); 457 458 ver = (struct hci_rp_read_local_version *)skb->data; 459 rev = le16_to_cpu(ver->hci_rev); 460 subver = le16_to_cpu(ver->lmp_subver); 461 kfree_skb(skb); 462 463 /* Read controller information */ 464 err = btbcm_read_info(hdev); 465 if (err) 466 return err; 467 468 switch ((rev & 0xf000) >> 12) { 469 case 0: 470 case 3: 471 for (i = 0; bcm_uart_subver_table[i].name; i++) { 472 if (subver == bcm_uart_subver_table[i].subver) { 473 hw_name = bcm_uart_subver_table[i].name; 474 break; 475 } 476 } 477 478 snprintf(fw_name, sizeof(fw_name), "brcm/%s.hcd", 479 hw_name ? : "BCM"); 480 break; 481 case 1: 482 case 2: 483 /* Read USB Product Info */ 484 skb = btbcm_read_usb_product(hdev); 485 if (IS_ERR(skb)) 486 return PTR_ERR(skb); 487 488 vid = get_unaligned_le16(skb->data + 1); 489 pid = get_unaligned_le16(skb->data + 3); 490 kfree_skb(skb); 491 492 for (i = 0; bcm_usb_subver_table[i].name; i++) { 493 if (subver == bcm_usb_subver_table[i].subver) { 494 hw_name = bcm_usb_subver_table[i].name; 495 break; 496 } 497 } 498 499 snprintf(fw_name, sizeof(fw_name), "brcm/%s-%4.4x-%4.4x.hcd", 500 hw_name ? : "BCM", vid, pid); 501 break; 502 default: 503 return 0; 504 } 505 506 bt_dev_info(hdev, "%s (%3.3u.%3.3u.%3.3u) build %4.4u", 507 hw_name ? : "BCM", (subver & 0xe000) >> 13, 508 (subver & 0x1f00) >> 8, (subver & 0x00ff), rev & 0x0fff); 509 510 err = request_firmware(&fw, fw_name, &hdev->dev); 511 if (err < 0) { 512 bt_dev_info(hdev, "BCM: Patch %s not found", fw_name); 513 goto done; 514 } 515 516 btbcm_patchram(hdev, fw); 517 518 release_firmware(fw); 519 520 /* Reset */ 521 err = btbcm_reset(hdev); 522 if (err) 523 return err; 524 525 /* Read Local Version Info */ 526 skb = btbcm_read_local_version(hdev); 527 if (IS_ERR(skb)) 528 return PTR_ERR(skb); 529 530 ver = (struct hci_rp_read_local_version *)skb->data; 531 rev = le16_to_cpu(ver->hci_rev); 532 subver = le16_to_cpu(ver->lmp_subver); 533 kfree_skb(skb); 534 535 bt_dev_info(hdev, "%s (%3.3u.%3.3u.%3.3u) build %4.4u", 536 hw_name ? : "BCM", (subver & 0xe000) >> 13, 537 (subver & 0x1f00) >> 8, (subver & 0x00ff), rev & 0x0fff); 538 539 /* Read Local Name */ 540 skb = btbcm_read_local_name(hdev); 541 if (IS_ERR(skb)) 542 return PTR_ERR(skb); 543 544 bt_dev_info(hdev, "%s", (char *)(skb->data + 1)); 545 kfree_skb(skb); 546 547 done: 548 btbcm_check_bdaddr(hdev); 549 550 set_bit(HCI_QUIRK_STRICT_DUPLICATE_FILTER, &hdev->quirks); 551 552 return 0; 553 } 554 EXPORT_SYMBOL_GPL(btbcm_setup_patchram); 555 556 int btbcm_setup_apple(struct hci_dev *hdev) 557 { 558 struct sk_buff *skb; 559 int err; 560 561 /* Reset */ 562 err = btbcm_reset(hdev); 563 if (err) 564 return err; 565 566 /* Read Verbose Config Version Info */ 567 skb = btbcm_read_verbose_config(hdev); 568 if (!IS_ERR(skb)) { 569 bt_dev_info(hdev, "BCM: chip id %u build %4.4u", 570 skb->data[1], get_unaligned_le16(skb->data + 5)); 571 kfree_skb(skb); 572 } 573 574 /* Read USB Product Info */ 575 skb = btbcm_read_usb_product(hdev); 576 if (!IS_ERR(skb)) { 577 bt_dev_info(hdev, "BCM: product %4.4x:%4.4x", 578 get_unaligned_le16(skb->data + 1), 579 get_unaligned_le16(skb->data + 3)); 580 kfree_skb(skb); 581 } 582 583 /* Read Controller Features */ 584 skb = btbcm_read_controller_features(hdev); 585 if (!IS_ERR(skb)) { 586 bt_dev_info(hdev, "BCM: features 0x%2.2x", skb->data[1]); 587 kfree_skb(skb); 588 } 589 590 /* Read Local Name */ 591 skb = btbcm_read_local_name(hdev); 592 if (!IS_ERR(skb)) { 593 bt_dev_info(hdev, "%s", (char *)(skb->data + 1)); 594 kfree_skb(skb); 595 } 596 597 set_bit(HCI_QUIRK_STRICT_DUPLICATE_FILTER, &hdev->quirks); 598 599 return 0; 600 } 601 EXPORT_SYMBOL_GPL(btbcm_setup_apple); 602 603 MODULE_AUTHOR("Marcel Holtmann <marcel@holtmann.org>"); 604 MODULE_DESCRIPTION("Bluetooth support for Broadcom devices ver " VERSION); 605 MODULE_VERSION(VERSION); 606 MODULE_LICENSE("GPL"); 607