1 // SPDX-License-Identifier: GPL-2.0-or-later 2 /* 3 * 4 * Bluetooth support for Broadcom devices 5 * 6 * Copyright (C) 2015 Intel Corporation 7 */ 8 9 #include <linux/module.h> 10 #include <linux/firmware.h> 11 #include <asm/unaligned.h> 12 13 #include <net/bluetooth/bluetooth.h> 14 #include <net/bluetooth/hci_core.h> 15 16 #include "btbcm.h" 17 18 #define VERSION "0.1" 19 20 #define BDADDR_BCM20702A0 (&(bdaddr_t) {{0x00, 0xa0, 0x02, 0x70, 0x20, 0x00}}) 21 #define BDADDR_BCM20702A1 (&(bdaddr_t) {{0x00, 0x00, 0xa0, 0x02, 0x70, 0x20}}) 22 #define BDADDR_BCM2076B1 (&(bdaddr_t) {{0x79, 0x56, 0x00, 0xa0, 0x76, 0x20}}) 23 #define BDADDR_BCM43430A0 (&(bdaddr_t) {{0xac, 0x1f, 0x12, 0xa0, 0x43, 0x43}}) 24 #define BDADDR_BCM4324B3 (&(bdaddr_t) {{0x00, 0x00, 0x00, 0xb3, 0x24, 0x43}}) 25 #define BDADDR_BCM4330B1 (&(bdaddr_t) {{0x00, 0x00, 0x00, 0xb1, 0x30, 0x43}}) 26 #define BDADDR_BCM4334B0 (&(bdaddr_t) {{0x00, 0x00, 0x00, 0xb0, 0x34, 0x43}}) 27 #define BDADDR_BCM4345C5 (&(bdaddr_t) {{0xac, 0x1f, 0x00, 0xc5, 0x45, 0x43}}) 28 #define BDADDR_BCM43341B (&(bdaddr_t) {{0xac, 0x1f, 0x00, 0x1b, 0x34, 0x43}}) 29 30 int btbcm_check_bdaddr(struct hci_dev *hdev) 31 { 32 struct hci_rp_read_bd_addr *bda; 33 struct sk_buff *skb; 34 35 skb = __hci_cmd_sync(hdev, HCI_OP_READ_BD_ADDR, 0, NULL, 36 HCI_INIT_TIMEOUT); 37 if (IS_ERR(skb)) { 38 int err = PTR_ERR(skb); 39 bt_dev_err(hdev, "BCM: Reading device address failed (%d)", err); 40 return err; 41 } 42 43 if (skb->len != sizeof(*bda)) { 44 bt_dev_err(hdev, "BCM: Device address length mismatch"); 45 kfree_skb(skb); 46 return -EIO; 47 } 48 49 bda = (struct hci_rp_read_bd_addr *)skb->data; 50 51 /* Check if the address indicates a controller with either an 52 * invalid or default address. In both cases the device needs 53 * to be marked as not having a valid address. 54 * 55 * The address 00:20:70:02:A0:00 indicates a BCM20702A0 controller 56 * with no configured address. 57 * 58 * The address 20:70:02:A0:00:00 indicates a BCM20702A1 controller 59 * with no configured address. 60 * 61 * The address 20:76:A0:00:56:79 indicates a BCM2076B1 controller 62 * with no configured address. 63 * 64 * The address 43:24:B3:00:00:00 indicates a BCM4324B3 controller 65 * with waiting for configuration state. 66 * 67 * The address 43:30:B1:00:00:00 indicates a BCM4330B1 controller 68 * with waiting for configuration state. 69 * 70 * The address 43:43:A0:12:1F:AC indicates a BCM43430A0 controller 71 * with no configured address. 72 */ 73 if (!bacmp(&bda->bdaddr, BDADDR_BCM20702A0) || 74 !bacmp(&bda->bdaddr, BDADDR_BCM20702A1) || 75 !bacmp(&bda->bdaddr, BDADDR_BCM2076B1) || 76 !bacmp(&bda->bdaddr, BDADDR_BCM4324B3) || 77 !bacmp(&bda->bdaddr, BDADDR_BCM4330B1) || 78 !bacmp(&bda->bdaddr, BDADDR_BCM4334B0) || 79 !bacmp(&bda->bdaddr, BDADDR_BCM4345C5) || 80 !bacmp(&bda->bdaddr, BDADDR_BCM43430A0) || 81 !bacmp(&bda->bdaddr, BDADDR_BCM43341B)) { 82 bt_dev_info(hdev, "BCM: Using default device address (%pMR)", 83 &bda->bdaddr); 84 set_bit(HCI_QUIRK_INVALID_BDADDR, &hdev->quirks); 85 } 86 87 kfree_skb(skb); 88 89 return 0; 90 } 91 EXPORT_SYMBOL_GPL(btbcm_check_bdaddr); 92 93 int btbcm_set_bdaddr(struct hci_dev *hdev, const bdaddr_t *bdaddr) 94 { 95 struct sk_buff *skb; 96 int err; 97 98 skb = __hci_cmd_sync(hdev, 0xfc01, 6, bdaddr, HCI_INIT_TIMEOUT); 99 if (IS_ERR(skb)) { 100 err = PTR_ERR(skb); 101 bt_dev_err(hdev, "BCM: Change address command failed (%d)", err); 102 return err; 103 } 104 kfree_skb(skb); 105 106 return 0; 107 } 108 EXPORT_SYMBOL_GPL(btbcm_set_bdaddr); 109 110 int btbcm_patchram(struct hci_dev *hdev, const struct firmware *fw) 111 { 112 const struct hci_command_hdr *cmd; 113 const u8 *fw_ptr; 114 size_t fw_size; 115 struct sk_buff *skb; 116 u16 opcode; 117 int err = 0; 118 119 /* Start Download */ 120 skb = __hci_cmd_sync(hdev, 0xfc2e, 0, NULL, HCI_INIT_TIMEOUT); 121 if (IS_ERR(skb)) { 122 err = PTR_ERR(skb); 123 bt_dev_err(hdev, "BCM: Download Minidrv command failed (%d)", 124 err); 125 goto done; 126 } 127 kfree_skb(skb); 128 129 /* 50 msec delay after Download Minidrv completes */ 130 msleep(50); 131 132 fw_ptr = fw->data; 133 fw_size = fw->size; 134 135 while (fw_size >= sizeof(*cmd)) { 136 const u8 *cmd_param; 137 138 cmd = (struct hci_command_hdr *)fw_ptr; 139 fw_ptr += sizeof(*cmd); 140 fw_size -= sizeof(*cmd); 141 142 if (fw_size < cmd->plen) { 143 bt_dev_err(hdev, "BCM: Patch is corrupted"); 144 err = -EINVAL; 145 goto done; 146 } 147 148 cmd_param = fw_ptr; 149 fw_ptr += cmd->plen; 150 fw_size -= cmd->plen; 151 152 opcode = le16_to_cpu(cmd->opcode); 153 154 skb = __hci_cmd_sync(hdev, opcode, cmd->plen, cmd_param, 155 HCI_INIT_TIMEOUT); 156 if (IS_ERR(skb)) { 157 err = PTR_ERR(skb); 158 bt_dev_err(hdev, "BCM: Patch command %04x failed (%d)", 159 opcode, err); 160 goto done; 161 } 162 kfree_skb(skb); 163 } 164 165 /* 250 msec delay after Launch Ram completes */ 166 msleep(250); 167 168 done: 169 return err; 170 } 171 EXPORT_SYMBOL(btbcm_patchram); 172 173 static int btbcm_reset(struct hci_dev *hdev) 174 { 175 struct sk_buff *skb; 176 177 skb = __hci_cmd_sync(hdev, HCI_OP_RESET, 0, NULL, HCI_INIT_TIMEOUT); 178 if (IS_ERR(skb)) { 179 int err = PTR_ERR(skb); 180 bt_dev_err(hdev, "BCM: Reset failed (%d)", err); 181 return err; 182 } 183 kfree_skb(skb); 184 185 /* 100 msec delay for module to complete reset process */ 186 msleep(100); 187 188 return 0; 189 } 190 191 static struct sk_buff *btbcm_read_local_name(struct hci_dev *hdev) 192 { 193 struct sk_buff *skb; 194 195 skb = __hci_cmd_sync(hdev, HCI_OP_READ_LOCAL_NAME, 0, NULL, 196 HCI_INIT_TIMEOUT); 197 if (IS_ERR(skb)) { 198 bt_dev_err(hdev, "BCM: Reading local name failed (%ld)", 199 PTR_ERR(skb)); 200 return skb; 201 } 202 203 if (skb->len != sizeof(struct hci_rp_read_local_name)) { 204 bt_dev_err(hdev, "BCM: Local name length mismatch"); 205 kfree_skb(skb); 206 return ERR_PTR(-EIO); 207 } 208 209 return skb; 210 } 211 212 static struct sk_buff *btbcm_read_local_version(struct hci_dev *hdev) 213 { 214 struct sk_buff *skb; 215 216 skb = __hci_cmd_sync(hdev, HCI_OP_READ_LOCAL_VERSION, 0, NULL, 217 HCI_INIT_TIMEOUT); 218 if (IS_ERR(skb)) { 219 bt_dev_err(hdev, "BCM: Reading local version info failed (%ld)", 220 PTR_ERR(skb)); 221 return skb; 222 } 223 224 if (skb->len != sizeof(struct hci_rp_read_local_version)) { 225 bt_dev_err(hdev, "BCM: Local version length mismatch"); 226 kfree_skb(skb); 227 return ERR_PTR(-EIO); 228 } 229 230 return skb; 231 } 232 233 static struct sk_buff *btbcm_read_verbose_config(struct hci_dev *hdev) 234 { 235 struct sk_buff *skb; 236 237 skb = __hci_cmd_sync(hdev, 0xfc79, 0, NULL, HCI_INIT_TIMEOUT); 238 if (IS_ERR(skb)) { 239 bt_dev_err(hdev, "BCM: Read verbose config info failed (%ld)", 240 PTR_ERR(skb)); 241 return skb; 242 } 243 244 if (skb->len != 7) { 245 bt_dev_err(hdev, "BCM: Verbose config length mismatch"); 246 kfree_skb(skb); 247 return ERR_PTR(-EIO); 248 } 249 250 return skb; 251 } 252 253 static struct sk_buff *btbcm_read_controller_features(struct hci_dev *hdev) 254 { 255 struct sk_buff *skb; 256 257 skb = __hci_cmd_sync(hdev, 0xfc6e, 0, NULL, HCI_INIT_TIMEOUT); 258 if (IS_ERR(skb)) { 259 bt_dev_err(hdev, "BCM: Read controller features failed (%ld)", 260 PTR_ERR(skb)); 261 return skb; 262 } 263 264 if (skb->len != 9) { 265 bt_dev_err(hdev, "BCM: Controller features length mismatch"); 266 kfree_skb(skb); 267 return ERR_PTR(-EIO); 268 } 269 270 return skb; 271 } 272 273 static struct sk_buff *btbcm_read_usb_product(struct hci_dev *hdev) 274 { 275 struct sk_buff *skb; 276 277 skb = __hci_cmd_sync(hdev, 0xfc5a, 0, NULL, HCI_INIT_TIMEOUT); 278 if (IS_ERR(skb)) { 279 bt_dev_err(hdev, "BCM: Read USB product info failed (%ld)", 280 PTR_ERR(skb)); 281 return skb; 282 } 283 284 if (skb->len != 5) { 285 bt_dev_err(hdev, "BCM: USB product length mismatch"); 286 kfree_skb(skb); 287 return ERR_PTR(-EIO); 288 } 289 290 return skb; 291 } 292 293 static int btbcm_read_info(struct hci_dev *hdev) 294 { 295 struct sk_buff *skb; 296 297 /* Read Verbose Config Version Info */ 298 skb = btbcm_read_verbose_config(hdev); 299 if (IS_ERR(skb)) 300 return PTR_ERR(skb); 301 302 bt_dev_info(hdev, "BCM: chip id %u", skb->data[1]); 303 kfree_skb(skb); 304 305 /* Read Controller Features */ 306 skb = btbcm_read_controller_features(hdev); 307 if (IS_ERR(skb)) 308 return PTR_ERR(skb); 309 310 bt_dev_info(hdev, "BCM: features 0x%2.2x", skb->data[1]); 311 kfree_skb(skb); 312 313 /* Read Local Name */ 314 skb = btbcm_read_local_name(hdev); 315 if (IS_ERR(skb)) 316 return PTR_ERR(skb); 317 318 bt_dev_info(hdev, "%s", (char *)(skb->data + 1)); 319 kfree_skb(skb); 320 321 return 0; 322 } 323 324 struct bcm_subver_table { 325 u16 subver; 326 const char *name; 327 }; 328 329 static const struct bcm_subver_table bcm_uart_subver_table[] = { 330 { 0x4103, "BCM4330B1" }, /* 002.001.003 */ 331 { 0x410d, "BCM4334B0" }, /* 002.001.013 */ 332 { 0x410e, "BCM43341B0" }, /* 002.001.014 */ 333 { 0x4204, "BCM2076B1" }, /* 002.002.004 */ 334 { 0x4406, "BCM4324B3" }, /* 002.004.006 */ 335 { 0x6109, "BCM4335C0" }, /* 003.001.009 */ 336 { 0x610c, "BCM4354" }, /* 003.001.012 */ 337 { 0x2122, "BCM4343A0" }, /* 001.001.034 */ 338 { 0x2209, "BCM43430A1" }, /* 001.002.009 */ 339 { 0x6119, "BCM4345C0" }, /* 003.001.025 */ 340 { 0x6606, "BCM4345C5" }, /* 003.006.006 */ 341 { 0x230f, "BCM4356A2" }, /* 001.003.015 */ 342 { 0x220e, "BCM20702A1" }, /* 001.002.014 */ 343 { 0x4217, "BCM4329B1" }, /* 002.002.023 */ 344 { 0x6106, "BCM4359C0" }, /* 003.001.006 */ 345 { 0x4106, "BCM4335A0" }, /* 002.001.006 */ 346 { } 347 }; 348 349 static const struct bcm_subver_table bcm_usb_subver_table[] = { 350 { 0x210b, "BCM43142A0" }, /* 001.001.011 */ 351 { 0x2112, "BCM4314A0" }, /* 001.001.018 */ 352 { 0x2118, "BCM20702A0" }, /* 001.001.024 */ 353 { 0x2126, "BCM4335A0" }, /* 001.001.038 */ 354 { 0x220e, "BCM20702A1" }, /* 001.002.014 */ 355 { 0x230f, "BCM4354A2" }, /* 001.003.015 */ 356 { 0x4106, "BCM4335B0" }, /* 002.001.006 */ 357 { 0x410e, "BCM20702B0" }, /* 002.001.014 */ 358 { 0x6109, "BCM4335C0" }, /* 003.001.009 */ 359 { 0x610c, "BCM4354" }, /* 003.001.012 */ 360 { } 361 }; 362 363 int btbcm_initialize(struct hci_dev *hdev, char *fw_name, size_t len, 364 bool reinit) 365 { 366 u16 subver, rev, pid, vid; 367 const char *hw_name = "BCM"; 368 struct sk_buff *skb; 369 struct hci_rp_read_local_version *ver; 370 const struct bcm_subver_table *bcm_subver_table; 371 int i, err; 372 373 /* Reset */ 374 err = btbcm_reset(hdev); 375 if (err) 376 return err; 377 378 /* Read Local Version Info */ 379 skb = btbcm_read_local_version(hdev); 380 if (IS_ERR(skb)) 381 return PTR_ERR(skb); 382 383 ver = (struct hci_rp_read_local_version *)skb->data; 384 rev = le16_to_cpu(ver->hci_rev); 385 subver = le16_to_cpu(ver->lmp_subver); 386 kfree_skb(skb); 387 388 /* Read controller information */ 389 if (!reinit) { 390 err = btbcm_read_info(hdev); 391 if (err) 392 return err; 393 } 394 395 /* Upper nibble of rev should be between 0 and 3? */ 396 if (((rev & 0xf000) >> 12) > 3) 397 return 0; 398 399 bcm_subver_table = (hdev->bus == HCI_USB) ? bcm_usb_subver_table : 400 bcm_uart_subver_table; 401 402 for (i = 0; bcm_subver_table[i].name; i++) { 403 if (subver == bcm_subver_table[i].subver) { 404 hw_name = bcm_subver_table[i].name; 405 break; 406 } 407 } 408 409 if (hdev->bus == HCI_USB) { 410 /* Read USB Product Info */ 411 skb = btbcm_read_usb_product(hdev); 412 if (IS_ERR(skb)) 413 return PTR_ERR(skb); 414 415 vid = get_unaligned_le16(skb->data + 1); 416 pid = get_unaligned_le16(skb->data + 3); 417 kfree_skb(skb); 418 419 snprintf(fw_name, len, "brcm/%s-%4.4x-%4.4x.hcd", 420 hw_name, vid, pid); 421 } else { 422 snprintf(fw_name, len, "brcm/%s.hcd", hw_name); 423 } 424 425 bt_dev_info(hdev, "%s (%3.3u.%3.3u.%3.3u) build %4.4u", 426 hw_name, (subver & 0xe000) >> 13, 427 (subver & 0x1f00) >> 8, (subver & 0x00ff), rev & 0x0fff); 428 429 return 0; 430 } 431 EXPORT_SYMBOL_GPL(btbcm_initialize); 432 433 int btbcm_finalize(struct hci_dev *hdev) 434 { 435 char fw_name[64]; 436 int err; 437 438 /* Re-initialize */ 439 err = btbcm_initialize(hdev, fw_name, sizeof(fw_name), true); 440 if (err) 441 return err; 442 443 btbcm_check_bdaddr(hdev); 444 445 set_bit(HCI_QUIRK_STRICT_DUPLICATE_FILTER, &hdev->quirks); 446 447 /* Some devices ship with the controller default address. 448 * Allow the bootloader to set a valid address through the 449 * device tree. 450 */ 451 set_bit(HCI_QUIRK_USE_BDADDR_PROPERTY, &hdev->quirks); 452 453 return 0; 454 } 455 EXPORT_SYMBOL_GPL(btbcm_finalize); 456 457 int btbcm_setup_patchram(struct hci_dev *hdev) 458 { 459 char fw_name[64]; 460 const struct firmware *fw; 461 struct sk_buff *skb; 462 int err; 463 464 /* Initialize */ 465 err = btbcm_initialize(hdev, fw_name, sizeof(fw_name), false); 466 if (err) 467 return err; 468 469 err = request_firmware(&fw, fw_name, &hdev->dev); 470 if (err < 0) { 471 bt_dev_info(hdev, "BCM: Patch %s not found", fw_name); 472 goto done; 473 } 474 475 btbcm_patchram(hdev, fw); 476 477 release_firmware(fw); 478 479 /* Re-initialize */ 480 err = btbcm_initialize(hdev, fw_name, sizeof(fw_name), true); 481 if (err) 482 return err; 483 484 /* Read Local Name */ 485 skb = btbcm_read_local_name(hdev); 486 if (IS_ERR(skb)) 487 return PTR_ERR(skb); 488 489 bt_dev_info(hdev, "%s", (char *)(skb->data + 1)); 490 kfree_skb(skb); 491 492 done: 493 btbcm_check_bdaddr(hdev); 494 495 set_bit(HCI_QUIRK_STRICT_DUPLICATE_FILTER, &hdev->quirks); 496 497 return 0; 498 } 499 EXPORT_SYMBOL_GPL(btbcm_setup_patchram); 500 501 int btbcm_setup_apple(struct hci_dev *hdev) 502 { 503 struct sk_buff *skb; 504 int err; 505 506 /* Reset */ 507 err = btbcm_reset(hdev); 508 if (err) 509 return err; 510 511 /* Read Verbose Config Version Info */ 512 skb = btbcm_read_verbose_config(hdev); 513 if (!IS_ERR(skb)) { 514 bt_dev_info(hdev, "BCM: chip id %u build %4.4u", 515 skb->data[1], get_unaligned_le16(skb->data + 5)); 516 kfree_skb(skb); 517 } 518 519 /* Read USB Product Info */ 520 skb = btbcm_read_usb_product(hdev); 521 if (!IS_ERR(skb)) { 522 bt_dev_info(hdev, "BCM: product %4.4x:%4.4x", 523 get_unaligned_le16(skb->data + 1), 524 get_unaligned_le16(skb->data + 3)); 525 kfree_skb(skb); 526 } 527 528 /* Read Controller Features */ 529 skb = btbcm_read_controller_features(hdev); 530 if (!IS_ERR(skb)) { 531 bt_dev_info(hdev, "BCM: features 0x%2.2x", skb->data[1]); 532 kfree_skb(skb); 533 } 534 535 /* Read Local Name */ 536 skb = btbcm_read_local_name(hdev); 537 if (!IS_ERR(skb)) { 538 bt_dev_info(hdev, "%s", (char *)(skb->data + 1)); 539 kfree_skb(skb); 540 } 541 542 set_bit(HCI_QUIRK_STRICT_DUPLICATE_FILTER, &hdev->quirks); 543 544 return 0; 545 } 546 EXPORT_SYMBOL_GPL(btbcm_setup_apple); 547 548 MODULE_AUTHOR("Marcel Holtmann <marcel@holtmann.org>"); 549 MODULE_DESCRIPTION("Bluetooth support for Broadcom devices ver " VERSION); 550 MODULE_VERSION(VERSION); 551 MODULE_LICENSE("GPL"); 552