1 // SPDX-License-Identifier: GPL-2.0-or-later 2 /* 3 * 4 * Bluetooth support for Broadcom devices 5 * 6 * Copyright (C) 2015 Intel Corporation 7 */ 8 9 #include <linux/module.h> 10 #include <linux/firmware.h> 11 #include <asm/unaligned.h> 12 13 #include <net/bluetooth/bluetooth.h> 14 #include <net/bluetooth/hci_core.h> 15 16 #include "btbcm.h" 17 18 #define VERSION "0.1" 19 20 #define BDADDR_BCM20702A0 (&(bdaddr_t) {{0x00, 0xa0, 0x02, 0x70, 0x20, 0x00}}) 21 #define BDADDR_BCM20702A1 (&(bdaddr_t) {{0x00, 0x00, 0xa0, 0x02, 0x70, 0x20}}) 22 #define BDADDR_BCM2076B1 (&(bdaddr_t) {{0x79, 0x56, 0x00, 0xa0, 0x76, 0x20}}) 23 #define BDADDR_BCM43430A0 (&(bdaddr_t) {{0xac, 0x1f, 0x12, 0xa0, 0x43, 0x43}}) 24 #define BDADDR_BCM4324B3 (&(bdaddr_t) {{0x00, 0x00, 0x00, 0xb3, 0x24, 0x43}}) 25 #define BDADDR_BCM4330B1 (&(bdaddr_t) {{0x00, 0x00, 0x00, 0xb1, 0x30, 0x43}}) 26 #define BDADDR_BCM4334B0 (&(bdaddr_t) {{0x00, 0x00, 0x00, 0xb0, 0x34, 0x43}}) 27 #define BDADDR_BCM4345C5 (&(bdaddr_t) {{0xac, 0x1f, 0x00, 0xc5, 0x45, 0x43}}) 28 #define BDADDR_BCM43341B (&(bdaddr_t) {{0xac, 0x1f, 0x00, 0x1b, 0x34, 0x43}}) 29 30 int btbcm_check_bdaddr(struct hci_dev *hdev) 31 { 32 struct hci_rp_read_bd_addr *bda; 33 struct sk_buff *skb; 34 35 skb = __hci_cmd_sync(hdev, HCI_OP_READ_BD_ADDR, 0, NULL, 36 HCI_INIT_TIMEOUT); 37 if (IS_ERR(skb)) { 38 int err = PTR_ERR(skb); 39 40 bt_dev_err(hdev, "BCM: Reading device address failed (%d)", err); 41 return err; 42 } 43 44 if (skb->len != sizeof(*bda)) { 45 bt_dev_err(hdev, "BCM: Device address length mismatch"); 46 kfree_skb(skb); 47 return -EIO; 48 } 49 50 bda = (struct hci_rp_read_bd_addr *)skb->data; 51 52 /* Check if the address indicates a controller with either an 53 * invalid or default address. In both cases the device needs 54 * to be marked as not having a valid address. 55 * 56 * The address 00:20:70:02:A0:00 indicates a BCM20702A0 controller 57 * with no configured address. 58 * 59 * The address 20:70:02:A0:00:00 indicates a BCM20702A1 controller 60 * with no configured address. 61 * 62 * The address 20:76:A0:00:56:79 indicates a BCM2076B1 controller 63 * with no configured address. 64 * 65 * The address 43:24:B3:00:00:00 indicates a BCM4324B3 controller 66 * with waiting for configuration state. 67 * 68 * The address 43:30:B1:00:00:00 indicates a BCM4330B1 controller 69 * with waiting for configuration state. 70 * 71 * The address 43:43:A0:12:1F:AC indicates a BCM43430A0 controller 72 * with no configured address. 73 */ 74 if (!bacmp(&bda->bdaddr, BDADDR_BCM20702A0) || 75 !bacmp(&bda->bdaddr, BDADDR_BCM20702A1) || 76 !bacmp(&bda->bdaddr, BDADDR_BCM2076B1) || 77 !bacmp(&bda->bdaddr, BDADDR_BCM4324B3) || 78 !bacmp(&bda->bdaddr, BDADDR_BCM4330B1) || 79 !bacmp(&bda->bdaddr, BDADDR_BCM4334B0) || 80 !bacmp(&bda->bdaddr, BDADDR_BCM4345C5) || 81 !bacmp(&bda->bdaddr, BDADDR_BCM43430A0) || 82 !bacmp(&bda->bdaddr, BDADDR_BCM43341B)) { 83 bt_dev_info(hdev, "BCM: Using default device address (%pMR)", 84 &bda->bdaddr); 85 set_bit(HCI_QUIRK_INVALID_BDADDR, &hdev->quirks); 86 } 87 88 kfree_skb(skb); 89 90 return 0; 91 } 92 EXPORT_SYMBOL_GPL(btbcm_check_bdaddr); 93 94 int btbcm_set_bdaddr(struct hci_dev *hdev, const bdaddr_t *bdaddr) 95 { 96 struct sk_buff *skb; 97 int err; 98 99 skb = __hci_cmd_sync(hdev, 0xfc01, 6, bdaddr, HCI_INIT_TIMEOUT); 100 if (IS_ERR(skb)) { 101 err = PTR_ERR(skb); 102 bt_dev_err(hdev, "BCM: Change address command failed (%d)", err); 103 return err; 104 } 105 kfree_skb(skb); 106 107 return 0; 108 } 109 EXPORT_SYMBOL_GPL(btbcm_set_bdaddr); 110 111 int btbcm_read_pcm_int_params(struct hci_dev *hdev, 112 struct bcm_set_pcm_int_params *params) 113 { 114 struct sk_buff *skb; 115 int err = 0; 116 117 skb = __hci_cmd_sync(hdev, 0xfc1d, 0, NULL, HCI_INIT_TIMEOUT); 118 if (IS_ERR(skb)) { 119 err = PTR_ERR(skb); 120 bt_dev_err(hdev, "BCM: Read PCM int params failed (%d)", err); 121 return err; 122 } 123 124 if (skb->len != 6 || skb->data[0]) { 125 bt_dev_err(hdev, "BCM: Read PCM int params length mismatch"); 126 kfree_skb(skb); 127 return -EIO; 128 } 129 130 if (params) 131 memcpy(params, skb->data + 1, 5); 132 133 kfree_skb(skb); 134 135 return 0; 136 } 137 EXPORT_SYMBOL_GPL(btbcm_read_pcm_int_params); 138 139 int btbcm_write_pcm_int_params(struct hci_dev *hdev, 140 const struct bcm_set_pcm_int_params *params) 141 { 142 struct sk_buff *skb; 143 int err; 144 145 skb = __hci_cmd_sync(hdev, 0xfc1c, 5, params, HCI_INIT_TIMEOUT); 146 if (IS_ERR(skb)) { 147 err = PTR_ERR(skb); 148 bt_dev_err(hdev, "BCM: Write PCM int params failed (%d)", err); 149 return err; 150 } 151 kfree_skb(skb); 152 153 return 0; 154 } 155 EXPORT_SYMBOL_GPL(btbcm_write_pcm_int_params); 156 157 int btbcm_patchram(struct hci_dev *hdev, const struct firmware *fw) 158 { 159 const struct hci_command_hdr *cmd; 160 const u8 *fw_ptr; 161 size_t fw_size; 162 struct sk_buff *skb; 163 u16 opcode; 164 int err = 0; 165 166 /* Start Download */ 167 skb = __hci_cmd_sync(hdev, 0xfc2e, 0, NULL, HCI_INIT_TIMEOUT); 168 if (IS_ERR(skb)) { 169 err = PTR_ERR(skb); 170 bt_dev_err(hdev, "BCM: Download Minidrv command failed (%d)", 171 err); 172 goto done; 173 } 174 kfree_skb(skb); 175 176 /* 50 msec delay after Download Minidrv completes */ 177 msleep(50); 178 179 fw_ptr = fw->data; 180 fw_size = fw->size; 181 182 while (fw_size >= sizeof(*cmd)) { 183 const u8 *cmd_param; 184 185 cmd = (struct hci_command_hdr *)fw_ptr; 186 fw_ptr += sizeof(*cmd); 187 fw_size -= sizeof(*cmd); 188 189 if (fw_size < cmd->plen) { 190 bt_dev_err(hdev, "BCM: Patch is corrupted"); 191 err = -EINVAL; 192 goto done; 193 } 194 195 cmd_param = fw_ptr; 196 fw_ptr += cmd->plen; 197 fw_size -= cmd->plen; 198 199 opcode = le16_to_cpu(cmd->opcode); 200 201 skb = __hci_cmd_sync(hdev, opcode, cmd->plen, cmd_param, 202 HCI_INIT_TIMEOUT); 203 if (IS_ERR(skb)) { 204 err = PTR_ERR(skb); 205 bt_dev_err(hdev, "BCM: Patch command %04x failed (%d)", 206 opcode, err); 207 goto done; 208 } 209 kfree_skb(skb); 210 } 211 212 /* 250 msec delay after Launch Ram completes */ 213 msleep(250); 214 215 done: 216 return err; 217 } 218 EXPORT_SYMBOL(btbcm_patchram); 219 220 static int btbcm_reset(struct hci_dev *hdev) 221 { 222 struct sk_buff *skb; 223 224 skb = __hci_cmd_sync(hdev, HCI_OP_RESET, 0, NULL, HCI_INIT_TIMEOUT); 225 if (IS_ERR(skb)) { 226 int err = PTR_ERR(skb); 227 228 bt_dev_err(hdev, "BCM: Reset failed (%d)", err); 229 return err; 230 } 231 kfree_skb(skb); 232 233 /* 100 msec delay for module to complete reset process */ 234 msleep(100); 235 236 return 0; 237 } 238 239 static struct sk_buff *btbcm_read_local_name(struct hci_dev *hdev) 240 { 241 struct sk_buff *skb; 242 243 skb = __hci_cmd_sync(hdev, HCI_OP_READ_LOCAL_NAME, 0, NULL, 244 HCI_INIT_TIMEOUT); 245 if (IS_ERR(skb)) { 246 bt_dev_err(hdev, "BCM: Reading local name failed (%ld)", 247 PTR_ERR(skb)); 248 return skb; 249 } 250 251 if (skb->len != sizeof(struct hci_rp_read_local_name)) { 252 bt_dev_err(hdev, "BCM: Local name length mismatch"); 253 kfree_skb(skb); 254 return ERR_PTR(-EIO); 255 } 256 257 return skb; 258 } 259 260 static struct sk_buff *btbcm_read_local_version(struct hci_dev *hdev) 261 { 262 struct sk_buff *skb; 263 264 skb = __hci_cmd_sync(hdev, HCI_OP_READ_LOCAL_VERSION, 0, NULL, 265 HCI_INIT_TIMEOUT); 266 if (IS_ERR(skb)) { 267 bt_dev_err(hdev, "BCM: Reading local version info failed (%ld)", 268 PTR_ERR(skb)); 269 return skb; 270 } 271 272 if (skb->len != sizeof(struct hci_rp_read_local_version)) { 273 bt_dev_err(hdev, "BCM: Local version length mismatch"); 274 kfree_skb(skb); 275 return ERR_PTR(-EIO); 276 } 277 278 return skb; 279 } 280 281 static struct sk_buff *btbcm_read_verbose_config(struct hci_dev *hdev) 282 { 283 struct sk_buff *skb; 284 285 skb = __hci_cmd_sync(hdev, 0xfc79, 0, NULL, HCI_INIT_TIMEOUT); 286 if (IS_ERR(skb)) { 287 bt_dev_err(hdev, "BCM: Read verbose config info failed (%ld)", 288 PTR_ERR(skb)); 289 return skb; 290 } 291 292 if (skb->len != 7) { 293 bt_dev_err(hdev, "BCM: Verbose config length mismatch"); 294 kfree_skb(skb); 295 return ERR_PTR(-EIO); 296 } 297 298 return skb; 299 } 300 301 static struct sk_buff *btbcm_read_controller_features(struct hci_dev *hdev) 302 { 303 struct sk_buff *skb; 304 305 skb = __hci_cmd_sync(hdev, 0xfc6e, 0, NULL, HCI_INIT_TIMEOUT); 306 if (IS_ERR(skb)) { 307 bt_dev_err(hdev, "BCM: Read controller features failed (%ld)", 308 PTR_ERR(skb)); 309 return skb; 310 } 311 312 if (skb->len != 9) { 313 bt_dev_err(hdev, "BCM: Controller features length mismatch"); 314 kfree_skb(skb); 315 return ERR_PTR(-EIO); 316 } 317 318 return skb; 319 } 320 321 static struct sk_buff *btbcm_read_usb_product(struct hci_dev *hdev) 322 { 323 struct sk_buff *skb; 324 325 skb = __hci_cmd_sync(hdev, 0xfc5a, 0, NULL, HCI_INIT_TIMEOUT); 326 if (IS_ERR(skb)) { 327 bt_dev_err(hdev, "BCM: Read USB product info failed (%ld)", 328 PTR_ERR(skb)); 329 return skb; 330 } 331 332 if (skb->len != 5) { 333 bt_dev_err(hdev, "BCM: USB product length mismatch"); 334 kfree_skb(skb); 335 return ERR_PTR(-EIO); 336 } 337 338 return skb; 339 } 340 341 static int btbcm_read_info(struct hci_dev *hdev) 342 { 343 struct sk_buff *skb; 344 345 /* Read Verbose Config Version Info */ 346 skb = btbcm_read_verbose_config(hdev); 347 if (IS_ERR(skb)) 348 return PTR_ERR(skb); 349 350 bt_dev_info(hdev, "BCM: chip id %u", skb->data[1]); 351 kfree_skb(skb); 352 353 /* Read Controller Features */ 354 skb = btbcm_read_controller_features(hdev); 355 if (IS_ERR(skb)) 356 return PTR_ERR(skb); 357 358 bt_dev_info(hdev, "BCM: features 0x%2.2x", skb->data[1]); 359 kfree_skb(skb); 360 361 /* Read Local Name */ 362 skb = btbcm_read_local_name(hdev); 363 if (IS_ERR(skb)) 364 return PTR_ERR(skb); 365 366 bt_dev_info(hdev, "%s", (char *)(skb->data + 1)); 367 kfree_skb(skb); 368 369 return 0; 370 } 371 372 struct bcm_subver_table { 373 u16 subver; 374 const char *name; 375 }; 376 377 static const struct bcm_subver_table bcm_uart_subver_table[] = { 378 { 0x4103, "BCM4330B1" }, /* 002.001.003 */ 379 { 0x410d, "BCM4334B0" }, /* 002.001.013 */ 380 { 0x410e, "BCM43341B0" }, /* 002.001.014 */ 381 { 0x4204, "BCM2076B1" }, /* 002.002.004 */ 382 { 0x4406, "BCM4324B3" }, /* 002.004.006 */ 383 { 0x6109, "BCM4335C0" }, /* 003.001.009 */ 384 { 0x610c, "BCM4354" }, /* 003.001.012 */ 385 { 0x2122, "BCM4343A0" }, /* 001.001.034 */ 386 { 0x2209, "BCM43430A1" }, /* 001.002.009 */ 387 { 0x6119, "BCM4345C0" }, /* 003.001.025 */ 388 { 0x6606, "BCM4345C5" }, /* 003.006.006 */ 389 { 0x230f, "BCM4356A2" }, /* 001.003.015 */ 390 { 0x220e, "BCM20702A1" }, /* 001.002.014 */ 391 { 0x4217, "BCM4329B1" }, /* 002.002.023 */ 392 { 0x6106, "BCM4359C0" }, /* 003.001.006 */ 393 { 0x4106, "BCM4335A0" }, /* 002.001.006 */ 394 { } 395 }; 396 397 static const struct bcm_subver_table bcm_usb_subver_table[] = { 398 { 0x210b, "BCM43142A0" }, /* 001.001.011 */ 399 { 0x2112, "BCM4314A0" }, /* 001.001.018 */ 400 { 0x2118, "BCM20702A0" }, /* 001.001.024 */ 401 { 0x2126, "BCM4335A0" }, /* 001.001.038 */ 402 { 0x220e, "BCM20702A1" }, /* 001.002.014 */ 403 { 0x230f, "BCM4354A2" }, /* 001.003.015 */ 404 { 0x4106, "BCM4335B0" }, /* 002.001.006 */ 405 { 0x410e, "BCM20702B0" }, /* 002.001.014 */ 406 { 0x6109, "BCM4335C0" }, /* 003.001.009 */ 407 { 0x610c, "BCM4354" }, /* 003.001.012 */ 408 { } 409 }; 410 411 int btbcm_initialize(struct hci_dev *hdev, char *fw_name, size_t len, 412 bool reinit) 413 { 414 u16 subver, rev, pid, vid; 415 const char *hw_name = "BCM"; 416 struct sk_buff *skb; 417 struct hci_rp_read_local_version *ver; 418 const struct bcm_subver_table *bcm_subver_table; 419 int i, err; 420 421 /* Reset */ 422 err = btbcm_reset(hdev); 423 if (err) 424 return err; 425 426 /* Read Local Version Info */ 427 skb = btbcm_read_local_version(hdev); 428 if (IS_ERR(skb)) 429 return PTR_ERR(skb); 430 431 ver = (struct hci_rp_read_local_version *)skb->data; 432 rev = le16_to_cpu(ver->hci_rev); 433 subver = le16_to_cpu(ver->lmp_subver); 434 kfree_skb(skb); 435 436 /* Read controller information */ 437 if (!reinit) { 438 err = btbcm_read_info(hdev); 439 if (err) 440 return err; 441 } 442 443 /* Upper nibble of rev should be between 0 and 3? */ 444 if (((rev & 0xf000) >> 12) > 3) 445 return 0; 446 447 bcm_subver_table = (hdev->bus == HCI_USB) ? bcm_usb_subver_table : 448 bcm_uart_subver_table; 449 450 for (i = 0; bcm_subver_table[i].name; i++) { 451 if (subver == bcm_subver_table[i].subver) { 452 hw_name = bcm_subver_table[i].name; 453 break; 454 } 455 } 456 457 if (hdev->bus == HCI_USB) { 458 /* Read USB Product Info */ 459 skb = btbcm_read_usb_product(hdev); 460 if (IS_ERR(skb)) 461 return PTR_ERR(skb); 462 463 vid = get_unaligned_le16(skb->data + 1); 464 pid = get_unaligned_le16(skb->data + 3); 465 kfree_skb(skb); 466 467 snprintf(fw_name, len, "brcm/%s-%4.4x-%4.4x.hcd", 468 hw_name, vid, pid); 469 } else { 470 snprintf(fw_name, len, "brcm/%s.hcd", hw_name); 471 } 472 473 bt_dev_info(hdev, "%s (%3.3u.%3.3u.%3.3u) build %4.4u", 474 hw_name, (subver & 0xe000) >> 13, 475 (subver & 0x1f00) >> 8, (subver & 0x00ff), rev & 0x0fff); 476 477 return 0; 478 } 479 EXPORT_SYMBOL_GPL(btbcm_initialize); 480 481 int btbcm_finalize(struct hci_dev *hdev) 482 { 483 char fw_name[64]; 484 int err; 485 486 /* Re-initialize */ 487 err = btbcm_initialize(hdev, fw_name, sizeof(fw_name), true); 488 if (err) 489 return err; 490 491 btbcm_check_bdaddr(hdev); 492 493 set_bit(HCI_QUIRK_STRICT_DUPLICATE_FILTER, &hdev->quirks); 494 495 /* Some devices ship with the controller default address. 496 * Allow the bootloader to set a valid address through the 497 * device tree. 498 */ 499 set_bit(HCI_QUIRK_USE_BDADDR_PROPERTY, &hdev->quirks); 500 501 return 0; 502 } 503 EXPORT_SYMBOL_GPL(btbcm_finalize); 504 505 int btbcm_setup_patchram(struct hci_dev *hdev) 506 { 507 char fw_name[64]; 508 const struct firmware *fw; 509 struct sk_buff *skb; 510 int err; 511 512 /* Initialize */ 513 err = btbcm_initialize(hdev, fw_name, sizeof(fw_name), false); 514 if (err) 515 return err; 516 517 err = request_firmware(&fw, fw_name, &hdev->dev); 518 if (err < 0) { 519 bt_dev_info(hdev, "BCM: Patch %s not found", fw_name); 520 goto done; 521 } 522 523 btbcm_patchram(hdev, fw); 524 525 release_firmware(fw); 526 527 /* Re-initialize */ 528 err = btbcm_initialize(hdev, fw_name, sizeof(fw_name), true); 529 if (err) 530 return err; 531 532 /* Read Local Name */ 533 skb = btbcm_read_local_name(hdev); 534 if (IS_ERR(skb)) 535 return PTR_ERR(skb); 536 537 bt_dev_info(hdev, "%s", (char *)(skb->data + 1)); 538 kfree_skb(skb); 539 540 done: 541 btbcm_check_bdaddr(hdev); 542 543 set_bit(HCI_QUIRK_STRICT_DUPLICATE_FILTER, &hdev->quirks); 544 545 return 0; 546 } 547 EXPORT_SYMBOL_GPL(btbcm_setup_patchram); 548 549 int btbcm_setup_apple(struct hci_dev *hdev) 550 { 551 struct sk_buff *skb; 552 int err; 553 554 /* Reset */ 555 err = btbcm_reset(hdev); 556 if (err) 557 return err; 558 559 /* Read Verbose Config Version Info */ 560 skb = btbcm_read_verbose_config(hdev); 561 if (!IS_ERR(skb)) { 562 bt_dev_info(hdev, "BCM: chip id %u build %4.4u", 563 skb->data[1], get_unaligned_le16(skb->data + 5)); 564 kfree_skb(skb); 565 } 566 567 /* Read USB Product Info */ 568 skb = btbcm_read_usb_product(hdev); 569 if (!IS_ERR(skb)) { 570 bt_dev_info(hdev, "BCM: product %4.4x:%4.4x", 571 get_unaligned_le16(skb->data + 1), 572 get_unaligned_le16(skb->data + 3)); 573 kfree_skb(skb); 574 } 575 576 /* Read Controller Features */ 577 skb = btbcm_read_controller_features(hdev); 578 if (!IS_ERR(skb)) { 579 bt_dev_info(hdev, "BCM: features 0x%2.2x", skb->data[1]); 580 kfree_skb(skb); 581 } 582 583 /* Read Local Name */ 584 skb = btbcm_read_local_name(hdev); 585 if (!IS_ERR(skb)) { 586 bt_dev_info(hdev, "%s", (char *)(skb->data + 1)); 587 kfree_skb(skb); 588 } 589 590 set_bit(HCI_QUIRK_STRICT_DUPLICATE_FILTER, &hdev->quirks); 591 592 return 0; 593 } 594 EXPORT_SYMBOL_GPL(btbcm_setup_apple); 595 596 MODULE_AUTHOR("Marcel Holtmann <marcel@holtmann.org>"); 597 MODULE_DESCRIPTION("Bluetooth support for Broadcom devices ver " VERSION); 598 MODULE_VERSION(VERSION); 599 MODULE_LICENSE("GPL"); 600