1 // SPDX-License-Identifier: GPL-2.0-or-later 2 /* 3 * 4 * Bluetooth support for Broadcom devices 5 * 6 * Copyright (C) 2015 Intel Corporation 7 */ 8 9 #include <linux/module.h> 10 #include <linux/firmware.h> 11 #include <asm/unaligned.h> 12 13 #include <net/bluetooth/bluetooth.h> 14 #include <net/bluetooth/hci_core.h> 15 16 #include "btbcm.h" 17 18 #define VERSION "0.1" 19 20 #define BDADDR_BCM20702A0 (&(bdaddr_t) {{0x00, 0xa0, 0x02, 0x70, 0x20, 0x00}}) 21 #define BDADDR_BCM20702A1 (&(bdaddr_t) {{0x00, 0x00, 0xa0, 0x02, 0x70, 0x20}}) 22 #define BDADDR_BCM2076B1 (&(bdaddr_t) {{0x79, 0x56, 0x00, 0xa0, 0x76, 0x20}}) 23 #define BDADDR_BCM43430A0 (&(bdaddr_t) {{0xac, 0x1f, 0x12, 0xa0, 0x43, 0x43}}) 24 #define BDADDR_BCM4324B3 (&(bdaddr_t) {{0x00, 0x00, 0x00, 0xb3, 0x24, 0x43}}) 25 #define BDADDR_BCM4330B1 (&(bdaddr_t) {{0x00, 0x00, 0x00, 0xb1, 0x30, 0x43}}) 26 #define BDADDR_BCM4334B0 (&(bdaddr_t) {{0x00, 0x00, 0x00, 0xb0, 0x34, 0x43}}) 27 #define BDADDR_BCM4345C5 (&(bdaddr_t) {{0xac, 0x1f, 0x00, 0xc5, 0x45, 0x43}}) 28 #define BDADDR_BCM43341B (&(bdaddr_t) {{0xac, 0x1f, 0x00, 0x1b, 0x34, 0x43}}) 29 30 #define BCM_FW_NAME_LEN 64 31 32 int btbcm_check_bdaddr(struct hci_dev *hdev) 33 { 34 struct hci_rp_read_bd_addr *bda; 35 struct sk_buff *skb; 36 37 skb = __hci_cmd_sync(hdev, HCI_OP_READ_BD_ADDR, 0, NULL, 38 HCI_INIT_TIMEOUT); 39 if (IS_ERR(skb)) { 40 int err = PTR_ERR(skb); 41 42 bt_dev_err(hdev, "BCM: Reading device address failed (%d)", err); 43 return err; 44 } 45 46 if (skb->len != sizeof(*bda)) { 47 bt_dev_err(hdev, "BCM: Device address length mismatch"); 48 kfree_skb(skb); 49 return -EIO; 50 } 51 52 bda = (struct hci_rp_read_bd_addr *)skb->data; 53 54 /* Check if the address indicates a controller with either an 55 * invalid or default address. In both cases the device needs 56 * to be marked as not having a valid address. 57 * 58 * The address 00:20:70:02:A0:00 indicates a BCM20702A0 controller 59 * with no configured address. 60 * 61 * The address 20:70:02:A0:00:00 indicates a BCM20702A1 controller 62 * with no configured address. 63 * 64 * The address 20:76:A0:00:56:79 indicates a BCM2076B1 controller 65 * with no configured address. 66 * 67 * The address 43:24:B3:00:00:00 indicates a BCM4324B3 controller 68 * with waiting for configuration state. 69 * 70 * The address 43:30:B1:00:00:00 indicates a BCM4330B1 controller 71 * with waiting for configuration state. 72 * 73 * The address 43:43:A0:12:1F:AC indicates a BCM43430A0 controller 74 * with no configured address. 75 */ 76 if (!bacmp(&bda->bdaddr, BDADDR_BCM20702A0) || 77 !bacmp(&bda->bdaddr, BDADDR_BCM20702A1) || 78 !bacmp(&bda->bdaddr, BDADDR_BCM2076B1) || 79 !bacmp(&bda->bdaddr, BDADDR_BCM4324B3) || 80 !bacmp(&bda->bdaddr, BDADDR_BCM4330B1) || 81 !bacmp(&bda->bdaddr, BDADDR_BCM4334B0) || 82 !bacmp(&bda->bdaddr, BDADDR_BCM4345C5) || 83 !bacmp(&bda->bdaddr, BDADDR_BCM43430A0) || 84 !bacmp(&bda->bdaddr, BDADDR_BCM43341B)) { 85 bt_dev_info(hdev, "BCM: Using default device address (%pMR)", 86 &bda->bdaddr); 87 set_bit(HCI_QUIRK_INVALID_BDADDR, &hdev->quirks); 88 } 89 90 kfree_skb(skb); 91 92 return 0; 93 } 94 EXPORT_SYMBOL_GPL(btbcm_check_bdaddr); 95 96 int btbcm_set_bdaddr(struct hci_dev *hdev, const bdaddr_t *bdaddr) 97 { 98 struct sk_buff *skb; 99 int err; 100 101 skb = __hci_cmd_sync(hdev, 0xfc01, 6, bdaddr, HCI_INIT_TIMEOUT); 102 if (IS_ERR(skb)) { 103 err = PTR_ERR(skb); 104 bt_dev_err(hdev, "BCM: Change address command failed (%d)", err); 105 return err; 106 } 107 kfree_skb(skb); 108 109 return 0; 110 } 111 EXPORT_SYMBOL_GPL(btbcm_set_bdaddr); 112 113 int btbcm_read_pcm_int_params(struct hci_dev *hdev, 114 struct bcm_set_pcm_int_params *params) 115 { 116 struct sk_buff *skb; 117 int err = 0; 118 119 skb = __hci_cmd_sync(hdev, 0xfc1d, 0, NULL, HCI_INIT_TIMEOUT); 120 if (IS_ERR(skb)) { 121 err = PTR_ERR(skb); 122 bt_dev_err(hdev, "BCM: Read PCM int params failed (%d)", err); 123 return err; 124 } 125 126 if (skb->len != 6 || skb->data[0]) { 127 bt_dev_err(hdev, "BCM: Read PCM int params length mismatch"); 128 kfree_skb(skb); 129 return -EIO; 130 } 131 132 if (params) 133 memcpy(params, skb->data + 1, 5); 134 135 kfree_skb(skb); 136 137 return 0; 138 } 139 EXPORT_SYMBOL_GPL(btbcm_read_pcm_int_params); 140 141 int btbcm_write_pcm_int_params(struct hci_dev *hdev, 142 const struct bcm_set_pcm_int_params *params) 143 { 144 struct sk_buff *skb; 145 int err; 146 147 skb = __hci_cmd_sync(hdev, 0xfc1c, 5, params, HCI_INIT_TIMEOUT); 148 if (IS_ERR(skb)) { 149 err = PTR_ERR(skb); 150 bt_dev_err(hdev, "BCM: Write PCM int params failed (%d)", err); 151 return err; 152 } 153 kfree_skb(skb); 154 155 return 0; 156 } 157 EXPORT_SYMBOL_GPL(btbcm_write_pcm_int_params); 158 159 int btbcm_patchram(struct hci_dev *hdev, const struct firmware *fw) 160 { 161 const struct hci_command_hdr *cmd; 162 const u8 *fw_ptr; 163 size_t fw_size; 164 struct sk_buff *skb; 165 u16 opcode; 166 int err = 0; 167 168 /* Start Download */ 169 skb = __hci_cmd_sync(hdev, 0xfc2e, 0, NULL, HCI_INIT_TIMEOUT); 170 if (IS_ERR(skb)) { 171 err = PTR_ERR(skb); 172 bt_dev_err(hdev, "BCM: Download Minidrv command failed (%d)", 173 err); 174 goto done; 175 } 176 kfree_skb(skb); 177 178 /* 50 msec delay after Download Minidrv completes */ 179 msleep(50); 180 181 fw_ptr = fw->data; 182 fw_size = fw->size; 183 184 while (fw_size >= sizeof(*cmd)) { 185 const u8 *cmd_param; 186 187 cmd = (struct hci_command_hdr *)fw_ptr; 188 fw_ptr += sizeof(*cmd); 189 fw_size -= sizeof(*cmd); 190 191 if (fw_size < cmd->plen) { 192 bt_dev_err(hdev, "BCM: Patch is corrupted"); 193 err = -EINVAL; 194 goto done; 195 } 196 197 cmd_param = fw_ptr; 198 fw_ptr += cmd->plen; 199 fw_size -= cmd->plen; 200 201 opcode = le16_to_cpu(cmd->opcode); 202 203 skb = __hci_cmd_sync(hdev, opcode, cmd->plen, cmd_param, 204 HCI_INIT_TIMEOUT); 205 if (IS_ERR(skb)) { 206 err = PTR_ERR(skb); 207 bt_dev_err(hdev, "BCM: Patch command %04x failed (%d)", 208 opcode, err); 209 goto done; 210 } 211 kfree_skb(skb); 212 } 213 214 /* 250 msec delay after Launch Ram completes */ 215 msleep(250); 216 217 done: 218 return err; 219 } 220 EXPORT_SYMBOL(btbcm_patchram); 221 222 static int btbcm_reset(struct hci_dev *hdev) 223 { 224 struct sk_buff *skb; 225 226 skb = __hci_cmd_sync(hdev, HCI_OP_RESET, 0, NULL, HCI_INIT_TIMEOUT); 227 if (IS_ERR(skb)) { 228 int err = PTR_ERR(skb); 229 230 bt_dev_err(hdev, "BCM: Reset failed (%d)", err); 231 return err; 232 } 233 kfree_skb(skb); 234 235 /* 100 msec delay for module to complete reset process */ 236 msleep(100); 237 238 return 0; 239 } 240 241 static struct sk_buff *btbcm_read_local_name(struct hci_dev *hdev) 242 { 243 struct sk_buff *skb; 244 245 skb = __hci_cmd_sync(hdev, HCI_OP_READ_LOCAL_NAME, 0, NULL, 246 HCI_INIT_TIMEOUT); 247 if (IS_ERR(skb)) { 248 bt_dev_err(hdev, "BCM: Reading local name failed (%ld)", 249 PTR_ERR(skb)); 250 return skb; 251 } 252 253 if (skb->len != sizeof(struct hci_rp_read_local_name)) { 254 bt_dev_err(hdev, "BCM: Local name length mismatch"); 255 kfree_skb(skb); 256 return ERR_PTR(-EIO); 257 } 258 259 return skb; 260 } 261 262 static struct sk_buff *btbcm_read_local_version(struct hci_dev *hdev) 263 { 264 struct sk_buff *skb; 265 266 skb = __hci_cmd_sync(hdev, HCI_OP_READ_LOCAL_VERSION, 0, NULL, 267 HCI_INIT_TIMEOUT); 268 if (IS_ERR(skb)) { 269 bt_dev_err(hdev, "BCM: Reading local version info failed (%ld)", 270 PTR_ERR(skb)); 271 return skb; 272 } 273 274 if (skb->len != sizeof(struct hci_rp_read_local_version)) { 275 bt_dev_err(hdev, "BCM: Local version length mismatch"); 276 kfree_skb(skb); 277 return ERR_PTR(-EIO); 278 } 279 280 return skb; 281 } 282 283 static struct sk_buff *btbcm_read_verbose_config(struct hci_dev *hdev) 284 { 285 struct sk_buff *skb; 286 287 skb = __hci_cmd_sync(hdev, 0xfc79, 0, NULL, HCI_INIT_TIMEOUT); 288 if (IS_ERR(skb)) { 289 bt_dev_err(hdev, "BCM: Read verbose config info failed (%ld)", 290 PTR_ERR(skb)); 291 return skb; 292 } 293 294 if (skb->len != 7) { 295 bt_dev_err(hdev, "BCM: Verbose config length mismatch"); 296 kfree_skb(skb); 297 return ERR_PTR(-EIO); 298 } 299 300 return skb; 301 } 302 303 static struct sk_buff *btbcm_read_controller_features(struct hci_dev *hdev) 304 { 305 struct sk_buff *skb; 306 307 skb = __hci_cmd_sync(hdev, 0xfc6e, 0, NULL, HCI_INIT_TIMEOUT); 308 if (IS_ERR(skb)) { 309 bt_dev_err(hdev, "BCM: Read controller features failed (%ld)", 310 PTR_ERR(skb)); 311 return skb; 312 } 313 314 if (skb->len != 9) { 315 bt_dev_err(hdev, "BCM: Controller features length mismatch"); 316 kfree_skb(skb); 317 return ERR_PTR(-EIO); 318 } 319 320 return skb; 321 } 322 323 static struct sk_buff *btbcm_read_usb_product(struct hci_dev *hdev) 324 { 325 struct sk_buff *skb; 326 327 skb = __hci_cmd_sync(hdev, 0xfc5a, 0, NULL, HCI_INIT_TIMEOUT); 328 if (IS_ERR(skb)) { 329 bt_dev_err(hdev, "BCM: Read USB product info failed (%ld)", 330 PTR_ERR(skb)); 331 return skb; 332 } 333 334 if (skb->len != 5) { 335 bt_dev_err(hdev, "BCM: USB product length mismatch"); 336 kfree_skb(skb); 337 return ERR_PTR(-EIO); 338 } 339 340 return skb; 341 } 342 343 static int btbcm_read_info(struct hci_dev *hdev) 344 { 345 struct sk_buff *skb; 346 347 /* Read Verbose Config Version Info */ 348 skb = btbcm_read_verbose_config(hdev); 349 if (IS_ERR(skb)) 350 return PTR_ERR(skb); 351 352 bt_dev_info(hdev, "BCM: chip id %u", skb->data[1]); 353 kfree_skb(skb); 354 355 /* Read Controller Features */ 356 skb = btbcm_read_controller_features(hdev); 357 if (IS_ERR(skb)) 358 return PTR_ERR(skb); 359 360 bt_dev_info(hdev, "BCM: features 0x%2.2x", skb->data[1]); 361 kfree_skb(skb); 362 363 /* Read Local Name */ 364 skb = btbcm_read_local_name(hdev); 365 if (IS_ERR(skb)) 366 return PTR_ERR(skb); 367 368 bt_dev_info(hdev, "%s", (char *)(skb->data + 1)); 369 kfree_skb(skb); 370 371 return 0; 372 } 373 374 struct bcm_subver_table { 375 u16 subver; 376 const char *name; 377 }; 378 379 static const struct bcm_subver_table bcm_uart_subver_table[] = { 380 { 0x4103, "BCM4330B1" }, /* 002.001.003 */ 381 { 0x410d, "BCM4334B0" }, /* 002.001.013 */ 382 { 0x410e, "BCM43341B0" }, /* 002.001.014 */ 383 { 0x4204, "BCM2076B1" }, /* 002.002.004 */ 384 { 0x4406, "BCM4324B3" }, /* 002.004.006 */ 385 { 0x6109, "BCM4335C0" }, /* 003.001.009 */ 386 { 0x610c, "BCM4354" }, /* 003.001.012 */ 387 { 0x2122, "BCM4343A0" }, /* 001.001.034 */ 388 { 0x2209, "BCM43430A1" }, /* 001.002.009 */ 389 { 0x6119, "BCM4345C0" }, /* 003.001.025 */ 390 { 0x6606, "BCM4345C5" }, /* 003.006.006 */ 391 { 0x230f, "BCM4356A2" }, /* 001.003.015 */ 392 { 0x220e, "BCM20702A1" }, /* 001.002.014 */ 393 { 0x4217, "BCM4329B1" }, /* 002.002.023 */ 394 { 0x6106, "BCM4359C0" }, /* 003.001.006 */ 395 { 0x4106, "BCM4335A0" }, /* 002.001.006 */ 396 { } 397 }; 398 399 static const struct bcm_subver_table bcm_usb_subver_table[] = { 400 { 0x210b, "BCM43142A0" }, /* 001.001.011 */ 401 { 0x2112, "BCM4314A0" }, /* 001.001.018 */ 402 { 0x2118, "BCM20702A0" }, /* 001.001.024 */ 403 { 0x2126, "BCM4335A0" }, /* 001.001.038 */ 404 { 0x220e, "BCM20702A1" }, /* 001.002.014 */ 405 { 0x230f, "BCM4354A2" }, /* 001.003.015 */ 406 { 0x4106, "BCM4335B0" }, /* 002.001.006 */ 407 { 0x410e, "BCM20702B0" }, /* 002.001.014 */ 408 { 0x6109, "BCM4335C0" }, /* 003.001.009 */ 409 { 0x610c, "BCM4354" }, /* 003.001.012 */ 410 { } 411 }; 412 413 int btbcm_initialize(struct hci_dev *hdev, bool *fw_load_done) 414 { 415 u16 subver, rev, pid, vid; 416 const char *hw_name = "BCM"; 417 struct sk_buff *skb; 418 struct hci_rp_read_local_version *ver; 419 const struct bcm_subver_table *bcm_subver_table; 420 char fw_name[BCM_FW_NAME_LEN]; 421 const struct firmware *fw; 422 int i, err; 423 424 /* Reset */ 425 err = btbcm_reset(hdev); 426 if (err) 427 return err; 428 429 /* Read Local Version Info */ 430 skb = btbcm_read_local_version(hdev); 431 if (IS_ERR(skb)) 432 return PTR_ERR(skb); 433 434 ver = (struct hci_rp_read_local_version *)skb->data; 435 rev = le16_to_cpu(ver->hci_rev); 436 subver = le16_to_cpu(ver->lmp_subver); 437 kfree_skb(skb); 438 439 /* Read controller information */ 440 if (!(*fw_load_done)) { 441 err = btbcm_read_info(hdev); 442 if (err) 443 return err; 444 } 445 446 bcm_subver_table = (hdev->bus == HCI_USB) ? bcm_usb_subver_table : 447 bcm_uart_subver_table; 448 449 for (i = 0; bcm_subver_table[i].name; i++) { 450 if (subver == bcm_subver_table[i].subver) { 451 hw_name = bcm_subver_table[i].name; 452 break; 453 } 454 } 455 456 if (hdev->bus == HCI_USB) { 457 /* Read USB Product Info */ 458 skb = btbcm_read_usb_product(hdev); 459 if (IS_ERR(skb)) 460 return PTR_ERR(skb); 461 462 vid = get_unaligned_le16(skb->data + 1); 463 pid = get_unaligned_le16(skb->data + 3); 464 kfree_skb(skb); 465 466 snprintf(fw_name, BCM_FW_NAME_LEN, "brcm/%s-%4.4x-%4.4x.hcd", 467 hw_name, vid, pid); 468 } else { 469 snprintf(fw_name, BCM_FW_NAME_LEN, "brcm/%s.hcd", hw_name); 470 } 471 472 bt_dev_info(hdev, "%s (%3.3u.%3.3u.%3.3u) build %4.4u", 473 hw_name, (subver & 0xe000) >> 13, 474 (subver & 0x1f00) >> 8, (subver & 0x00ff), rev & 0x0fff); 475 476 if (*fw_load_done) 477 return 0; 478 479 err = request_firmware(&fw, fw_name, &hdev->dev); 480 if (err) { 481 bt_dev_info(hdev, "BCM: Patch %s not found", fw_name); 482 return 0; 483 } 484 485 err = btbcm_patchram(hdev, fw); 486 if (err) 487 bt_dev_info(hdev, "BCM: Patch failed (%d)", err); 488 489 release_firmware(fw); 490 *fw_load_done = true; 491 return 0; 492 } 493 EXPORT_SYMBOL_GPL(btbcm_initialize); 494 495 int btbcm_finalize(struct hci_dev *hdev) 496 { 497 bool fw_load_done = true; 498 int err; 499 500 /* Re-initialize */ 501 err = btbcm_initialize(hdev, &fw_load_done); 502 if (err) 503 return err; 504 505 btbcm_check_bdaddr(hdev); 506 507 set_bit(HCI_QUIRK_STRICT_DUPLICATE_FILTER, &hdev->quirks); 508 509 return 0; 510 } 511 EXPORT_SYMBOL_GPL(btbcm_finalize); 512 513 int btbcm_setup_patchram(struct hci_dev *hdev) 514 { 515 bool fw_load_done = false; 516 struct sk_buff *skb; 517 int err; 518 519 /* Initialize */ 520 err = btbcm_initialize(hdev, &fw_load_done); 521 if (err) 522 return err; 523 524 if (!fw_load_done) 525 goto done; 526 527 /* Re-initialize after loading Patch */ 528 err = btbcm_initialize(hdev, &fw_load_done); 529 if (err) 530 return err; 531 532 /* Read Local Name */ 533 skb = btbcm_read_local_name(hdev); 534 if (IS_ERR(skb)) 535 return PTR_ERR(skb); 536 537 bt_dev_info(hdev, "%s", (char *)(skb->data + 1)); 538 kfree_skb(skb); 539 540 done: 541 btbcm_check_bdaddr(hdev); 542 543 set_bit(HCI_QUIRK_STRICT_DUPLICATE_FILTER, &hdev->quirks); 544 545 return 0; 546 } 547 EXPORT_SYMBOL_GPL(btbcm_setup_patchram); 548 549 int btbcm_setup_apple(struct hci_dev *hdev) 550 { 551 struct sk_buff *skb; 552 int err; 553 554 /* Reset */ 555 err = btbcm_reset(hdev); 556 if (err) 557 return err; 558 559 /* Read Verbose Config Version Info */ 560 skb = btbcm_read_verbose_config(hdev); 561 if (!IS_ERR(skb)) { 562 bt_dev_info(hdev, "BCM: chip id %u build %4.4u", 563 skb->data[1], get_unaligned_le16(skb->data + 5)); 564 kfree_skb(skb); 565 } 566 567 /* Read USB Product Info */ 568 skb = btbcm_read_usb_product(hdev); 569 if (!IS_ERR(skb)) { 570 bt_dev_info(hdev, "BCM: product %4.4x:%4.4x", 571 get_unaligned_le16(skb->data + 1), 572 get_unaligned_le16(skb->data + 3)); 573 kfree_skb(skb); 574 } 575 576 /* Read Controller Features */ 577 skb = btbcm_read_controller_features(hdev); 578 if (!IS_ERR(skb)) { 579 bt_dev_info(hdev, "BCM: features 0x%2.2x", skb->data[1]); 580 kfree_skb(skb); 581 } 582 583 /* Read Local Name */ 584 skb = btbcm_read_local_name(hdev); 585 if (!IS_ERR(skb)) { 586 bt_dev_info(hdev, "%s", (char *)(skb->data + 1)); 587 kfree_skb(skb); 588 } 589 590 set_bit(HCI_QUIRK_STRICT_DUPLICATE_FILTER, &hdev->quirks); 591 592 return 0; 593 } 594 EXPORT_SYMBOL_GPL(btbcm_setup_apple); 595 596 MODULE_AUTHOR("Marcel Holtmann <[email protected]>"); 597 MODULE_DESCRIPTION("Bluetooth support for Broadcom devices ver " VERSION); 598 MODULE_VERSION(VERSION); 599 MODULE_LICENSE("GPL"); 600