1 /* 2 * 3 * Bluetooth support for Broadcom devices 4 * 5 * Copyright (C) 2015 Intel Corporation 6 * 7 * 8 * This program is free software; you can redistribute it and/or modify 9 * it under the terms of the GNU General Public License as published by 10 * the Free Software Foundation; either version 2 of the License, or 11 * (at your option) any later version. 12 * 13 * This program is distributed in the hope that it will be useful, 14 * but WITHOUT ANY WARRANTY; without even the implied warranty of 15 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the 16 * GNU General Public License for more details. 17 * 18 * You should have received a copy of the GNU General Public License 19 * along with this program; if not, write to the Free Software 20 * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA 21 * 22 */ 23 24 #include <linux/module.h> 25 #include <linux/firmware.h> 26 #include <asm/unaligned.h> 27 28 #include <net/bluetooth/bluetooth.h> 29 #include <net/bluetooth/hci_core.h> 30 31 #include "btbcm.h" 32 33 #define VERSION "0.1" 34 35 #define BDADDR_BCM20702A0 (&(bdaddr_t) {{0x00, 0xa0, 0x02, 0x70, 0x20, 0x00}}) 36 #define BDADDR_BCM20702A1 (&(bdaddr_t) {{0x00, 0x00, 0xa0, 0x02, 0x70, 0x20}}) 37 #define BDADDR_BCM43430A0 (&(bdaddr_t) {{0xac, 0x1f, 0x12, 0xa0, 0x43, 0x43}}) 38 #define BDADDR_BCM4324B3 (&(bdaddr_t) {{0x00, 0x00, 0x00, 0xb3, 0x24, 0x43}}) 39 #define BDADDR_BCM4330B1 (&(bdaddr_t) {{0x00, 0x00, 0x00, 0xb1, 0x30, 0x43}}) 40 41 int btbcm_check_bdaddr(struct hci_dev *hdev) 42 { 43 struct hci_rp_read_bd_addr *bda; 44 struct sk_buff *skb; 45 46 skb = __hci_cmd_sync(hdev, HCI_OP_READ_BD_ADDR, 0, NULL, 47 HCI_INIT_TIMEOUT); 48 if (IS_ERR(skb)) { 49 int err = PTR_ERR(skb); 50 bt_dev_err(hdev, "BCM: Reading device address failed (%d)", err); 51 return err; 52 } 53 54 if (skb->len != sizeof(*bda)) { 55 bt_dev_err(hdev, "BCM: Device address length mismatch"); 56 kfree_skb(skb); 57 return -EIO; 58 } 59 60 bda = (struct hci_rp_read_bd_addr *)skb->data; 61 62 /* Check if the address indicates a controller with either an 63 * invalid or default address. In both cases the device needs 64 * to be marked as not having a valid address. 65 * 66 * The address 00:20:70:02:A0:00 indicates a BCM20702A0 controller 67 * with no configured address. 68 * 69 * The address 20:70:02:A0:00:00 indicates a BCM20702A1 controller 70 * with no configured address. 71 * 72 * The address 43:24:B3:00:00:00 indicates a BCM4324B3 controller 73 * with waiting for configuration state. 74 * 75 * The address 43:30:B1:00:00:00 indicates a BCM4330B1 controller 76 * with waiting for configuration state. 77 * 78 * The address 43:43:A0:12:1F:AC indicates a BCM43430A0 controller 79 * with no configured address. 80 */ 81 if (!bacmp(&bda->bdaddr, BDADDR_BCM20702A0) || 82 !bacmp(&bda->bdaddr, BDADDR_BCM20702A1) || 83 !bacmp(&bda->bdaddr, BDADDR_BCM4324B3) || 84 !bacmp(&bda->bdaddr, BDADDR_BCM4330B1) || 85 !bacmp(&bda->bdaddr, BDADDR_BCM43430A0)) { 86 bt_dev_info(hdev, "BCM: Using default device address (%pMR)", 87 &bda->bdaddr); 88 set_bit(HCI_QUIRK_INVALID_BDADDR, &hdev->quirks); 89 } 90 91 kfree_skb(skb); 92 93 return 0; 94 } 95 EXPORT_SYMBOL_GPL(btbcm_check_bdaddr); 96 97 int btbcm_set_bdaddr(struct hci_dev *hdev, const bdaddr_t *bdaddr) 98 { 99 struct sk_buff *skb; 100 int err; 101 102 skb = __hci_cmd_sync(hdev, 0xfc01, 6, bdaddr, HCI_INIT_TIMEOUT); 103 if (IS_ERR(skb)) { 104 err = PTR_ERR(skb); 105 bt_dev_err(hdev, "BCM: Change address command failed (%d)", err); 106 return err; 107 } 108 kfree_skb(skb); 109 110 return 0; 111 } 112 EXPORT_SYMBOL_GPL(btbcm_set_bdaddr); 113 114 int btbcm_patchram(struct hci_dev *hdev, const struct firmware *fw) 115 { 116 const struct hci_command_hdr *cmd; 117 const u8 *fw_ptr; 118 size_t fw_size; 119 struct sk_buff *skb; 120 u16 opcode; 121 int err = 0; 122 123 /* Start Download */ 124 skb = __hci_cmd_sync(hdev, 0xfc2e, 0, NULL, HCI_INIT_TIMEOUT); 125 if (IS_ERR(skb)) { 126 err = PTR_ERR(skb); 127 bt_dev_err(hdev, "BCM: Download Minidrv command failed (%d)", 128 err); 129 goto done; 130 } 131 kfree_skb(skb); 132 133 /* 50 msec delay after Download Minidrv completes */ 134 msleep(50); 135 136 fw_ptr = fw->data; 137 fw_size = fw->size; 138 139 while (fw_size >= sizeof(*cmd)) { 140 const u8 *cmd_param; 141 142 cmd = (struct hci_command_hdr *)fw_ptr; 143 fw_ptr += sizeof(*cmd); 144 fw_size -= sizeof(*cmd); 145 146 if (fw_size < cmd->plen) { 147 bt_dev_err(hdev, "BCM: Patch is corrupted"); 148 err = -EINVAL; 149 goto done; 150 } 151 152 cmd_param = fw_ptr; 153 fw_ptr += cmd->plen; 154 fw_size -= cmd->plen; 155 156 opcode = le16_to_cpu(cmd->opcode); 157 158 skb = __hci_cmd_sync(hdev, opcode, cmd->plen, cmd_param, 159 HCI_INIT_TIMEOUT); 160 if (IS_ERR(skb)) { 161 err = PTR_ERR(skb); 162 bt_dev_err(hdev, "BCM: Patch command %04x failed (%d)", 163 opcode, err); 164 goto done; 165 } 166 kfree_skb(skb); 167 } 168 169 /* 250 msec delay after Launch Ram completes */ 170 msleep(250); 171 172 done: 173 return err; 174 } 175 EXPORT_SYMBOL(btbcm_patchram); 176 177 static int btbcm_reset(struct hci_dev *hdev) 178 { 179 struct sk_buff *skb; 180 181 skb = __hci_cmd_sync(hdev, HCI_OP_RESET, 0, NULL, HCI_INIT_TIMEOUT); 182 if (IS_ERR(skb)) { 183 int err = PTR_ERR(skb); 184 bt_dev_err(hdev, "BCM: Reset failed (%d)", err); 185 return err; 186 } 187 kfree_skb(skb); 188 189 /* 100 msec delay for module to complete reset process */ 190 msleep(100); 191 192 return 0; 193 } 194 195 static struct sk_buff *btbcm_read_local_name(struct hci_dev *hdev) 196 { 197 struct sk_buff *skb; 198 199 skb = __hci_cmd_sync(hdev, HCI_OP_READ_LOCAL_NAME, 0, NULL, 200 HCI_INIT_TIMEOUT); 201 if (IS_ERR(skb)) { 202 bt_dev_err(hdev, "BCM: Reading local name failed (%ld)", 203 PTR_ERR(skb)); 204 return skb; 205 } 206 207 if (skb->len != sizeof(struct hci_rp_read_local_name)) { 208 bt_dev_err(hdev, "BCM: Local name length mismatch"); 209 kfree_skb(skb); 210 return ERR_PTR(-EIO); 211 } 212 213 return skb; 214 } 215 216 static struct sk_buff *btbcm_read_local_version(struct hci_dev *hdev) 217 { 218 struct sk_buff *skb; 219 220 skb = __hci_cmd_sync(hdev, HCI_OP_READ_LOCAL_VERSION, 0, NULL, 221 HCI_INIT_TIMEOUT); 222 if (IS_ERR(skb)) { 223 bt_dev_err(hdev, "BCM: Reading local version info failed (%ld)", 224 PTR_ERR(skb)); 225 return skb; 226 } 227 228 if (skb->len != sizeof(struct hci_rp_read_local_version)) { 229 bt_dev_err(hdev, "BCM: Local version length mismatch"); 230 kfree_skb(skb); 231 return ERR_PTR(-EIO); 232 } 233 234 return skb; 235 } 236 237 static struct sk_buff *btbcm_read_verbose_config(struct hci_dev *hdev) 238 { 239 struct sk_buff *skb; 240 241 skb = __hci_cmd_sync(hdev, 0xfc79, 0, NULL, HCI_INIT_TIMEOUT); 242 if (IS_ERR(skb)) { 243 bt_dev_err(hdev, "BCM: Read verbose config info failed (%ld)", 244 PTR_ERR(skb)); 245 return skb; 246 } 247 248 if (skb->len != 7) { 249 bt_dev_err(hdev, "BCM: Verbose config length mismatch"); 250 kfree_skb(skb); 251 return ERR_PTR(-EIO); 252 } 253 254 return skb; 255 } 256 257 static struct sk_buff *btbcm_read_controller_features(struct hci_dev *hdev) 258 { 259 struct sk_buff *skb; 260 261 skb = __hci_cmd_sync(hdev, 0xfc6e, 0, NULL, HCI_INIT_TIMEOUT); 262 if (IS_ERR(skb)) { 263 bt_dev_err(hdev, "BCM: Read controller features failed (%ld)", 264 PTR_ERR(skb)); 265 return skb; 266 } 267 268 if (skb->len != 9) { 269 bt_dev_err(hdev, "BCM: Controller features length mismatch"); 270 kfree_skb(skb); 271 return ERR_PTR(-EIO); 272 } 273 274 return skb; 275 } 276 277 static struct sk_buff *btbcm_read_usb_product(struct hci_dev *hdev) 278 { 279 struct sk_buff *skb; 280 281 skb = __hci_cmd_sync(hdev, 0xfc5a, 0, NULL, HCI_INIT_TIMEOUT); 282 if (IS_ERR(skb)) { 283 bt_dev_err(hdev, "BCM: Read USB product info failed (%ld)", 284 PTR_ERR(skb)); 285 return skb; 286 } 287 288 if (skb->len != 5) { 289 bt_dev_err(hdev, "BCM: USB product length mismatch"); 290 kfree_skb(skb); 291 return ERR_PTR(-EIO); 292 } 293 294 return skb; 295 } 296 297 static int btbcm_read_info(struct hci_dev *hdev) 298 { 299 struct sk_buff *skb; 300 301 /* Read Verbose Config Version Info */ 302 skb = btbcm_read_verbose_config(hdev); 303 if (IS_ERR(skb)) 304 return PTR_ERR(skb); 305 306 bt_dev_info(hdev, "BCM: chip id %u", skb->data[1]); 307 kfree_skb(skb); 308 309 /* Read Controller Features */ 310 skb = btbcm_read_controller_features(hdev); 311 if (IS_ERR(skb)) 312 return PTR_ERR(skb); 313 314 bt_dev_info(hdev, "BCM: features 0x%2.2x", skb->data[1]); 315 kfree_skb(skb); 316 317 /* Read Local Name */ 318 skb = btbcm_read_local_name(hdev); 319 if (IS_ERR(skb)) 320 return PTR_ERR(skb); 321 322 bt_dev_info(hdev, "%s", (char *)(skb->data + 1)); 323 kfree_skb(skb); 324 325 return 0; 326 } 327 328 struct bcm_subver_table { 329 u16 subver; 330 const char *name; 331 }; 332 333 static const struct bcm_subver_table bcm_uart_subver_table[] = { 334 { 0x4103, "BCM4330B1" }, /* 002.001.003 */ 335 { 0x410e, "BCM43341B0" }, /* 002.001.014 */ 336 { 0x4406, "BCM4324B3" }, /* 002.004.006 */ 337 { 0x6109, "BCM4335C0" }, /* 003.001.009 */ 338 { 0x610c, "BCM4354" }, /* 003.001.012 */ 339 { 0x2122, "BCM4343A0" }, /* 001.001.034 */ 340 { 0x2209, "BCM43430A1" }, /* 001.002.009 */ 341 { 0x6119, "BCM4345C0" }, /* 003.001.025 */ 342 { 0x230f, "BCM4356A2" }, /* 001.003.015 */ 343 { 0x220e, "BCM20702A1" }, /* 001.002.014 */ 344 { 0x4217, "BCM4329B1" }, /* 002.002.023 */ 345 { } 346 }; 347 348 static const struct bcm_subver_table bcm_usb_subver_table[] = { 349 { 0x210b, "BCM43142A0" }, /* 001.001.011 */ 350 { 0x2112, "BCM4314A0" }, /* 001.001.018 */ 351 { 0x2118, "BCM20702A0" }, /* 001.001.024 */ 352 { 0x2126, "BCM4335A0" }, /* 001.001.038 */ 353 { 0x220e, "BCM20702A1" }, /* 001.002.014 */ 354 { 0x230f, "BCM4354A2" }, /* 001.003.015 */ 355 { 0x4106, "BCM4335B0" }, /* 002.001.006 */ 356 { 0x410e, "BCM20702B0" }, /* 002.001.014 */ 357 { 0x6109, "BCM4335C0" }, /* 003.001.009 */ 358 { 0x610c, "BCM4354" }, /* 003.001.012 */ 359 { } 360 }; 361 362 int btbcm_initialize(struct hci_dev *hdev, char *fw_name, size_t len, 363 bool reinit) 364 { 365 u16 subver, rev, pid, vid; 366 const char *hw_name = "BCM"; 367 struct sk_buff *skb; 368 struct hci_rp_read_local_version *ver; 369 const struct bcm_subver_table *bcm_subver_table; 370 int i, err; 371 372 /* Reset */ 373 err = btbcm_reset(hdev); 374 if (err) 375 return err; 376 377 /* Read Local Version Info */ 378 skb = btbcm_read_local_version(hdev); 379 if (IS_ERR(skb)) 380 return PTR_ERR(skb); 381 382 ver = (struct hci_rp_read_local_version *)skb->data; 383 rev = le16_to_cpu(ver->hci_rev); 384 subver = le16_to_cpu(ver->lmp_subver); 385 kfree_skb(skb); 386 387 /* Read controller information */ 388 if (!reinit) { 389 err = btbcm_read_info(hdev); 390 if (err) 391 return err; 392 } 393 394 /* Upper nibble of rev should be between 0 and 3? */ 395 if (((rev & 0xf000) >> 12) > 3) 396 return 0; 397 398 bcm_subver_table = (hdev->bus == HCI_USB) ? bcm_usb_subver_table : 399 bcm_uart_subver_table; 400 401 for (i = 0; bcm_subver_table[i].name; i++) { 402 if (subver == bcm_subver_table[i].subver) { 403 hw_name = bcm_subver_table[i].name; 404 break; 405 } 406 } 407 408 if (hdev->bus == HCI_USB) { 409 /* Read USB Product Info */ 410 skb = btbcm_read_usb_product(hdev); 411 if (IS_ERR(skb)) 412 return PTR_ERR(skb); 413 414 vid = get_unaligned_le16(skb->data + 1); 415 pid = get_unaligned_le16(skb->data + 3); 416 kfree_skb(skb); 417 418 snprintf(fw_name, len, "brcm/%s-%4.4x-%4.4x.hcd", 419 hw_name, vid, pid); 420 } else { 421 snprintf(fw_name, len, "brcm/%s.hcd", hw_name); 422 } 423 424 bt_dev_info(hdev, "%s (%3.3u.%3.3u.%3.3u) build %4.4u", 425 hw_name, (subver & 0xe000) >> 13, 426 (subver & 0x1f00) >> 8, (subver & 0x00ff), rev & 0x0fff); 427 428 return 0; 429 } 430 EXPORT_SYMBOL_GPL(btbcm_initialize); 431 432 int btbcm_finalize(struct hci_dev *hdev) 433 { 434 char fw_name[64]; 435 int err; 436 437 /* Re-initialize */ 438 err = btbcm_initialize(hdev, fw_name, sizeof(fw_name), true); 439 if (err) 440 return err; 441 442 btbcm_check_bdaddr(hdev); 443 444 set_bit(HCI_QUIRK_STRICT_DUPLICATE_FILTER, &hdev->quirks); 445 446 return 0; 447 } 448 EXPORT_SYMBOL_GPL(btbcm_finalize); 449 450 int btbcm_setup_patchram(struct hci_dev *hdev) 451 { 452 char fw_name[64]; 453 const struct firmware *fw; 454 struct sk_buff *skb; 455 int err; 456 457 /* Initialize */ 458 err = btbcm_initialize(hdev, fw_name, sizeof(fw_name), false); 459 if (err) 460 return err; 461 462 err = request_firmware(&fw, fw_name, &hdev->dev); 463 if (err < 0) { 464 bt_dev_info(hdev, "BCM: Patch %s not found", fw_name); 465 goto done; 466 } 467 468 btbcm_patchram(hdev, fw); 469 470 release_firmware(fw); 471 472 /* Re-initialize */ 473 err = btbcm_initialize(hdev, fw_name, sizeof(fw_name), true); 474 if (err) 475 return err; 476 477 /* Read Local Name */ 478 skb = btbcm_read_local_name(hdev); 479 if (IS_ERR(skb)) 480 return PTR_ERR(skb); 481 482 bt_dev_info(hdev, "%s", (char *)(skb->data + 1)); 483 kfree_skb(skb); 484 485 done: 486 btbcm_check_bdaddr(hdev); 487 488 set_bit(HCI_QUIRK_STRICT_DUPLICATE_FILTER, &hdev->quirks); 489 490 return 0; 491 } 492 EXPORT_SYMBOL_GPL(btbcm_setup_patchram); 493 494 int btbcm_setup_apple(struct hci_dev *hdev) 495 { 496 struct sk_buff *skb; 497 int err; 498 499 /* Reset */ 500 err = btbcm_reset(hdev); 501 if (err) 502 return err; 503 504 /* Read Verbose Config Version Info */ 505 skb = btbcm_read_verbose_config(hdev); 506 if (!IS_ERR(skb)) { 507 bt_dev_info(hdev, "BCM: chip id %u build %4.4u", 508 skb->data[1], get_unaligned_le16(skb->data + 5)); 509 kfree_skb(skb); 510 } 511 512 /* Read USB Product Info */ 513 skb = btbcm_read_usb_product(hdev); 514 if (!IS_ERR(skb)) { 515 bt_dev_info(hdev, "BCM: product %4.4x:%4.4x", 516 get_unaligned_le16(skb->data + 1), 517 get_unaligned_le16(skb->data + 3)); 518 kfree_skb(skb); 519 } 520 521 /* Read Controller Features */ 522 skb = btbcm_read_controller_features(hdev); 523 if (!IS_ERR(skb)) { 524 bt_dev_info(hdev, "BCM: features 0x%2.2x", skb->data[1]); 525 kfree_skb(skb); 526 } 527 528 /* Read Local Name */ 529 skb = btbcm_read_local_name(hdev); 530 if (!IS_ERR(skb)) { 531 bt_dev_info(hdev, "%s", (char *)(skb->data + 1)); 532 kfree_skb(skb); 533 } 534 535 set_bit(HCI_QUIRK_STRICT_DUPLICATE_FILTER, &hdev->quirks); 536 537 return 0; 538 } 539 EXPORT_SYMBOL_GPL(btbcm_setup_apple); 540 541 MODULE_AUTHOR("Marcel Holtmann <marcel@holtmann.org>"); 542 MODULE_DESCRIPTION("Bluetooth support for Broadcom devices ver " VERSION); 543 MODULE_VERSION(VERSION); 544 MODULE_LICENSE("GPL"); 545