1 // SPDX-License-Identifier: GPL-2.0-or-later 2 /* 3 * 4 * Bluetooth support for Broadcom devices 5 * 6 * Copyright (C) 2015 Intel Corporation 7 */ 8 9 #include <linux/module.h> 10 #include <linux/firmware.h> 11 #include <asm/unaligned.h> 12 13 #include <net/bluetooth/bluetooth.h> 14 #include <net/bluetooth/hci_core.h> 15 16 #include "btbcm.h" 17 18 #define VERSION "0.1" 19 20 #define BDADDR_BCM20702A0 (&(bdaddr_t) {{0x00, 0xa0, 0x02, 0x70, 0x20, 0x00}}) 21 #define BDADDR_BCM20702A1 (&(bdaddr_t) {{0x00, 0x00, 0xa0, 0x02, 0x70, 0x20}}) 22 #define BDADDR_BCM2076B1 (&(bdaddr_t) {{0x79, 0x56, 0x00, 0xa0, 0x76, 0x20}}) 23 #define BDADDR_BCM43430A0 (&(bdaddr_t) {{0xac, 0x1f, 0x12, 0xa0, 0x43, 0x43}}) 24 #define BDADDR_BCM4324B3 (&(bdaddr_t) {{0x00, 0x00, 0x00, 0xb3, 0x24, 0x43}}) 25 #define BDADDR_BCM4330B1 (&(bdaddr_t) {{0x00, 0x00, 0x00, 0xb1, 0x30, 0x43}}) 26 #define BDADDR_BCM4345C5 (&(bdaddr_t) {{0xac, 0x1f, 0x00, 0xc5, 0x45, 0x43}}) 27 #define BDADDR_BCM43341B (&(bdaddr_t) {{0xac, 0x1f, 0x00, 0x1b, 0x34, 0x43}}) 28 29 int btbcm_check_bdaddr(struct hci_dev *hdev) 30 { 31 struct hci_rp_read_bd_addr *bda; 32 struct sk_buff *skb; 33 34 skb = __hci_cmd_sync(hdev, HCI_OP_READ_BD_ADDR, 0, NULL, 35 HCI_INIT_TIMEOUT); 36 if (IS_ERR(skb)) { 37 int err = PTR_ERR(skb); 38 bt_dev_err(hdev, "BCM: Reading device address failed (%d)", err); 39 return err; 40 } 41 42 if (skb->len != sizeof(*bda)) { 43 bt_dev_err(hdev, "BCM: Device address length mismatch"); 44 kfree_skb(skb); 45 return -EIO; 46 } 47 48 bda = (struct hci_rp_read_bd_addr *)skb->data; 49 50 /* Check if the address indicates a controller with either an 51 * invalid or default address. In both cases the device needs 52 * to be marked as not having a valid address. 53 * 54 * The address 00:20:70:02:A0:00 indicates a BCM20702A0 controller 55 * with no configured address. 56 * 57 * The address 20:70:02:A0:00:00 indicates a BCM20702A1 controller 58 * with no configured address. 59 * 60 * The address 20:76:A0:00:56:79 indicates a BCM2076B1 controller 61 * with no configured address. 62 * 63 * The address 43:24:B3:00:00:00 indicates a BCM4324B3 controller 64 * with waiting for configuration state. 65 * 66 * The address 43:30:B1:00:00:00 indicates a BCM4330B1 controller 67 * with waiting for configuration state. 68 * 69 * The address 43:43:A0:12:1F:AC indicates a BCM43430A0 controller 70 * with no configured address. 71 */ 72 if (!bacmp(&bda->bdaddr, BDADDR_BCM20702A0) || 73 !bacmp(&bda->bdaddr, BDADDR_BCM20702A1) || 74 !bacmp(&bda->bdaddr, BDADDR_BCM2076B1) || 75 !bacmp(&bda->bdaddr, BDADDR_BCM4324B3) || 76 !bacmp(&bda->bdaddr, BDADDR_BCM4330B1) || 77 !bacmp(&bda->bdaddr, BDADDR_BCM4345C5) || 78 !bacmp(&bda->bdaddr, BDADDR_BCM43430A0) || 79 !bacmp(&bda->bdaddr, BDADDR_BCM43341B)) { 80 bt_dev_info(hdev, "BCM: Using default device address (%pMR)", 81 &bda->bdaddr); 82 set_bit(HCI_QUIRK_INVALID_BDADDR, &hdev->quirks); 83 } 84 85 kfree_skb(skb); 86 87 return 0; 88 } 89 EXPORT_SYMBOL_GPL(btbcm_check_bdaddr); 90 91 int btbcm_set_bdaddr(struct hci_dev *hdev, const bdaddr_t *bdaddr) 92 { 93 struct sk_buff *skb; 94 int err; 95 96 skb = __hci_cmd_sync(hdev, 0xfc01, 6, bdaddr, HCI_INIT_TIMEOUT); 97 if (IS_ERR(skb)) { 98 err = PTR_ERR(skb); 99 bt_dev_err(hdev, "BCM: Change address command failed (%d)", err); 100 return err; 101 } 102 kfree_skb(skb); 103 104 return 0; 105 } 106 EXPORT_SYMBOL_GPL(btbcm_set_bdaddr); 107 108 int btbcm_patchram(struct hci_dev *hdev, const struct firmware *fw) 109 { 110 const struct hci_command_hdr *cmd; 111 const u8 *fw_ptr; 112 size_t fw_size; 113 struct sk_buff *skb; 114 u16 opcode; 115 int err = 0; 116 117 /* Start Download */ 118 skb = __hci_cmd_sync(hdev, 0xfc2e, 0, NULL, HCI_INIT_TIMEOUT); 119 if (IS_ERR(skb)) { 120 err = PTR_ERR(skb); 121 bt_dev_err(hdev, "BCM: Download Minidrv command failed (%d)", 122 err); 123 goto done; 124 } 125 kfree_skb(skb); 126 127 /* 50 msec delay after Download Minidrv completes */ 128 msleep(50); 129 130 fw_ptr = fw->data; 131 fw_size = fw->size; 132 133 while (fw_size >= sizeof(*cmd)) { 134 const u8 *cmd_param; 135 136 cmd = (struct hci_command_hdr *)fw_ptr; 137 fw_ptr += sizeof(*cmd); 138 fw_size -= sizeof(*cmd); 139 140 if (fw_size < cmd->plen) { 141 bt_dev_err(hdev, "BCM: Patch is corrupted"); 142 err = -EINVAL; 143 goto done; 144 } 145 146 cmd_param = fw_ptr; 147 fw_ptr += cmd->plen; 148 fw_size -= cmd->plen; 149 150 opcode = le16_to_cpu(cmd->opcode); 151 152 skb = __hci_cmd_sync(hdev, opcode, cmd->plen, cmd_param, 153 HCI_INIT_TIMEOUT); 154 if (IS_ERR(skb)) { 155 err = PTR_ERR(skb); 156 bt_dev_err(hdev, "BCM: Patch command %04x failed (%d)", 157 opcode, err); 158 goto done; 159 } 160 kfree_skb(skb); 161 } 162 163 /* 250 msec delay after Launch Ram completes */ 164 msleep(250); 165 166 done: 167 return err; 168 } 169 EXPORT_SYMBOL(btbcm_patchram); 170 171 static int btbcm_reset(struct hci_dev *hdev) 172 { 173 struct sk_buff *skb; 174 175 skb = __hci_cmd_sync(hdev, HCI_OP_RESET, 0, NULL, HCI_INIT_TIMEOUT); 176 if (IS_ERR(skb)) { 177 int err = PTR_ERR(skb); 178 bt_dev_err(hdev, "BCM: Reset failed (%d)", err); 179 return err; 180 } 181 kfree_skb(skb); 182 183 /* 100 msec delay for module to complete reset process */ 184 msleep(100); 185 186 return 0; 187 } 188 189 static struct sk_buff *btbcm_read_local_name(struct hci_dev *hdev) 190 { 191 struct sk_buff *skb; 192 193 skb = __hci_cmd_sync(hdev, HCI_OP_READ_LOCAL_NAME, 0, NULL, 194 HCI_INIT_TIMEOUT); 195 if (IS_ERR(skb)) { 196 bt_dev_err(hdev, "BCM: Reading local name failed (%ld)", 197 PTR_ERR(skb)); 198 return skb; 199 } 200 201 if (skb->len != sizeof(struct hci_rp_read_local_name)) { 202 bt_dev_err(hdev, "BCM: Local name length mismatch"); 203 kfree_skb(skb); 204 return ERR_PTR(-EIO); 205 } 206 207 return skb; 208 } 209 210 static struct sk_buff *btbcm_read_local_version(struct hci_dev *hdev) 211 { 212 struct sk_buff *skb; 213 214 skb = __hci_cmd_sync(hdev, HCI_OP_READ_LOCAL_VERSION, 0, NULL, 215 HCI_INIT_TIMEOUT); 216 if (IS_ERR(skb)) { 217 bt_dev_err(hdev, "BCM: Reading local version info failed (%ld)", 218 PTR_ERR(skb)); 219 return skb; 220 } 221 222 if (skb->len != sizeof(struct hci_rp_read_local_version)) { 223 bt_dev_err(hdev, "BCM: Local version length mismatch"); 224 kfree_skb(skb); 225 return ERR_PTR(-EIO); 226 } 227 228 return skb; 229 } 230 231 static struct sk_buff *btbcm_read_verbose_config(struct hci_dev *hdev) 232 { 233 struct sk_buff *skb; 234 235 skb = __hci_cmd_sync(hdev, 0xfc79, 0, NULL, HCI_INIT_TIMEOUT); 236 if (IS_ERR(skb)) { 237 bt_dev_err(hdev, "BCM: Read verbose config info failed (%ld)", 238 PTR_ERR(skb)); 239 return skb; 240 } 241 242 if (skb->len != 7) { 243 bt_dev_err(hdev, "BCM: Verbose config length mismatch"); 244 kfree_skb(skb); 245 return ERR_PTR(-EIO); 246 } 247 248 return skb; 249 } 250 251 static struct sk_buff *btbcm_read_controller_features(struct hci_dev *hdev) 252 { 253 struct sk_buff *skb; 254 255 skb = __hci_cmd_sync(hdev, 0xfc6e, 0, NULL, HCI_INIT_TIMEOUT); 256 if (IS_ERR(skb)) { 257 bt_dev_err(hdev, "BCM: Read controller features failed (%ld)", 258 PTR_ERR(skb)); 259 return skb; 260 } 261 262 if (skb->len != 9) { 263 bt_dev_err(hdev, "BCM: Controller features length mismatch"); 264 kfree_skb(skb); 265 return ERR_PTR(-EIO); 266 } 267 268 return skb; 269 } 270 271 static struct sk_buff *btbcm_read_usb_product(struct hci_dev *hdev) 272 { 273 struct sk_buff *skb; 274 275 skb = __hci_cmd_sync(hdev, 0xfc5a, 0, NULL, HCI_INIT_TIMEOUT); 276 if (IS_ERR(skb)) { 277 bt_dev_err(hdev, "BCM: Read USB product info failed (%ld)", 278 PTR_ERR(skb)); 279 return skb; 280 } 281 282 if (skb->len != 5) { 283 bt_dev_err(hdev, "BCM: USB product length mismatch"); 284 kfree_skb(skb); 285 return ERR_PTR(-EIO); 286 } 287 288 return skb; 289 } 290 291 static int btbcm_read_info(struct hci_dev *hdev) 292 { 293 struct sk_buff *skb; 294 295 /* Read Verbose Config Version Info */ 296 skb = btbcm_read_verbose_config(hdev); 297 if (IS_ERR(skb)) 298 return PTR_ERR(skb); 299 300 bt_dev_info(hdev, "BCM: chip id %u", skb->data[1]); 301 kfree_skb(skb); 302 303 /* Read Controller Features */ 304 skb = btbcm_read_controller_features(hdev); 305 if (IS_ERR(skb)) 306 return PTR_ERR(skb); 307 308 bt_dev_info(hdev, "BCM: features 0x%2.2x", skb->data[1]); 309 kfree_skb(skb); 310 311 /* Read Local Name */ 312 skb = btbcm_read_local_name(hdev); 313 if (IS_ERR(skb)) 314 return PTR_ERR(skb); 315 316 bt_dev_info(hdev, "%s", (char *)(skb->data + 1)); 317 kfree_skb(skb); 318 319 return 0; 320 } 321 322 struct bcm_subver_table { 323 u16 subver; 324 const char *name; 325 }; 326 327 static const struct bcm_subver_table bcm_uart_subver_table[] = { 328 { 0x4103, "BCM4330B1" }, /* 002.001.003 */ 329 { 0x410e, "BCM43341B0" }, /* 002.001.014 */ 330 { 0x4204, "BCM2076B1" }, /* 002.002.004 */ 331 { 0x4406, "BCM4324B3" }, /* 002.004.006 */ 332 { 0x6109, "BCM4335C0" }, /* 003.001.009 */ 333 { 0x610c, "BCM4354" }, /* 003.001.012 */ 334 { 0x2122, "BCM4343A0" }, /* 001.001.034 */ 335 { 0x2209, "BCM43430A1" }, /* 001.002.009 */ 336 { 0x6119, "BCM4345C0" }, /* 003.001.025 */ 337 { 0x6606, "BCM4345C5" }, /* 003.006.006 */ 338 { 0x230f, "BCM4356A2" }, /* 001.003.015 */ 339 { 0x220e, "BCM20702A1" }, /* 001.002.014 */ 340 { 0x4217, "BCM4329B1" }, /* 002.002.023 */ 341 { 0x6106, "BCM4359C0" }, /* 003.001.006 */ 342 { } 343 }; 344 345 static const struct bcm_subver_table bcm_usb_subver_table[] = { 346 { 0x210b, "BCM43142A0" }, /* 001.001.011 */ 347 { 0x2112, "BCM4314A0" }, /* 001.001.018 */ 348 { 0x2118, "BCM20702A0" }, /* 001.001.024 */ 349 { 0x2126, "BCM4335A0" }, /* 001.001.038 */ 350 { 0x220e, "BCM20702A1" }, /* 001.002.014 */ 351 { 0x230f, "BCM4354A2" }, /* 001.003.015 */ 352 { 0x4106, "BCM4335B0" }, /* 002.001.006 */ 353 { 0x410e, "BCM20702B0" }, /* 002.001.014 */ 354 { 0x6109, "BCM4335C0" }, /* 003.001.009 */ 355 { 0x610c, "BCM4354" }, /* 003.001.012 */ 356 { } 357 }; 358 359 int btbcm_initialize(struct hci_dev *hdev, char *fw_name, size_t len, 360 bool reinit) 361 { 362 u16 subver, rev, pid, vid; 363 const char *hw_name = "BCM"; 364 struct sk_buff *skb; 365 struct hci_rp_read_local_version *ver; 366 const struct bcm_subver_table *bcm_subver_table; 367 int i, err; 368 369 /* Reset */ 370 err = btbcm_reset(hdev); 371 if (err) 372 return err; 373 374 /* Read Local Version Info */ 375 skb = btbcm_read_local_version(hdev); 376 if (IS_ERR(skb)) 377 return PTR_ERR(skb); 378 379 ver = (struct hci_rp_read_local_version *)skb->data; 380 rev = le16_to_cpu(ver->hci_rev); 381 subver = le16_to_cpu(ver->lmp_subver); 382 kfree_skb(skb); 383 384 /* Read controller information */ 385 if (!reinit) { 386 err = btbcm_read_info(hdev); 387 if (err) 388 return err; 389 } 390 391 /* Upper nibble of rev should be between 0 and 3? */ 392 if (((rev & 0xf000) >> 12) > 3) 393 return 0; 394 395 bcm_subver_table = (hdev->bus == HCI_USB) ? bcm_usb_subver_table : 396 bcm_uart_subver_table; 397 398 for (i = 0; bcm_subver_table[i].name; i++) { 399 if (subver == bcm_subver_table[i].subver) { 400 hw_name = bcm_subver_table[i].name; 401 break; 402 } 403 } 404 405 if (hdev->bus == HCI_USB) { 406 /* Read USB Product Info */ 407 skb = btbcm_read_usb_product(hdev); 408 if (IS_ERR(skb)) 409 return PTR_ERR(skb); 410 411 vid = get_unaligned_le16(skb->data + 1); 412 pid = get_unaligned_le16(skb->data + 3); 413 kfree_skb(skb); 414 415 snprintf(fw_name, len, "brcm/%s-%4.4x-%4.4x.hcd", 416 hw_name, vid, pid); 417 } else { 418 snprintf(fw_name, len, "brcm/%s.hcd", hw_name); 419 } 420 421 bt_dev_info(hdev, "%s (%3.3u.%3.3u.%3.3u) build %4.4u", 422 hw_name, (subver & 0xe000) >> 13, 423 (subver & 0x1f00) >> 8, (subver & 0x00ff), rev & 0x0fff); 424 425 return 0; 426 } 427 EXPORT_SYMBOL_GPL(btbcm_initialize); 428 429 int btbcm_finalize(struct hci_dev *hdev) 430 { 431 char fw_name[64]; 432 int err; 433 434 /* Re-initialize */ 435 err = btbcm_initialize(hdev, fw_name, sizeof(fw_name), true); 436 if (err) 437 return err; 438 439 btbcm_check_bdaddr(hdev); 440 441 set_bit(HCI_QUIRK_STRICT_DUPLICATE_FILTER, &hdev->quirks); 442 443 return 0; 444 } 445 EXPORT_SYMBOL_GPL(btbcm_finalize); 446 447 int btbcm_setup_patchram(struct hci_dev *hdev) 448 { 449 char fw_name[64]; 450 const struct firmware *fw; 451 struct sk_buff *skb; 452 int err; 453 454 /* Initialize */ 455 err = btbcm_initialize(hdev, fw_name, sizeof(fw_name), false); 456 if (err) 457 return err; 458 459 err = request_firmware(&fw, fw_name, &hdev->dev); 460 if (err < 0) { 461 bt_dev_info(hdev, "BCM: Patch %s not found", fw_name); 462 goto done; 463 } 464 465 btbcm_patchram(hdev, fw); 466 467 release_firmware(fw); 468 469 /* Re-initialize */ 470 err = btbcm_initialize(hdev, fw_name, sizeof(fw_name), true); 471 if (err) 472 return err; 473 474 /* Read Local Name */ 475 skb = btbcm_read_local_name(hdev); 476 if (IS_ERR(skb)) 477 return PTR_ERR(skb); 478 479 bt_dev_info(hdev, "%s", (char *)(skb->data + 1)); 480 kfree_skb(skb); 481 482 done: 483 btbcm_check_bdaddr(hdev); 484 485 set_bit(HCI_QUIRK_STRICT_DUPLICATE_FILTER, &hdev->quirks); 486 487 return 0; 488 } 489 EXPORT_SYMBOL_GPL(btbcm_setup_patchram); 490 491 int btbcm_setup_apple(struct hci_dev *hdev) 492 { 493 struct sk_buff *skb; 494 int err; 495 496 /* Reset */ 497 err = btbcm_reset(hdev); 498 if (err) 499 return err; 500 501 /* Read Verbose Config Version Info */ 502 skb = btbcm_read_verbose_config(hdev); 503 if (!IS_ERR(skb)) { 504 bt_dev_info(hdev, "BCM: chip id %u build %4.4u", 505 skb->data[1], get_unaligned_le16(skb->data + 5)); 506 kfree_skb(skb); 507 } 508 509 /* Read USB Product Info */ 510 skb = btbcm_read_usb_product(hdev); 511 if (!IS_ERR(skb)) { 512 bt_dev_info(hdev, "BCM: product %4.4x:%4.4x", 513 get_unaligned_le16(skb->data + 1), 514 get_unaligned_le16(skb->data + 3)); 515 kfree_skb(skb); 516 } 517 518 /* Read Controller Features */ 519 skb = btbcm_read_controller_features(hdev); 520 if (!IS_ERR(skb)) { 521 bt_dev_info(hdev, "BCM: features 0x%2.2x", skb->data[1]); 522 kfree_skb(skb); 523 } 524 525 /* Read Local Name */ 526 skb = btbcm_read_local_name(hdev); 527 if (!IS_ERR(skb)) { 528 bt_dev_info(hdev, "%s", (char *)(skb->data + 1)); 529 kfree_skb(skb); 530 } 531 532 set_bit(HCI_QUIRK_STRICT_DUPLICATE_FILTER, &hdev->quirks); 533 534 return 0; 535 } 536 EXPORT_SYMBOL_GPL(btbcm_setup_apple); 537 538 MODULE_AUTHOR("Marcel Holtmann <marcel@holtmann.org>"); 539 MODULE_DESCRIPTION("Bluetooth support for Broadcom devices ver " VERSION); 540 MODULE_VERSION(VERSION); 541 MODULE_LICENSE("GPL"); 542