1 // SPDX-License-Identifier: GPL-2.0-or-later 2 /* 3 * 4 * Bluetooth support for Broadcom devices 5 * 6 * Copyright (C) 2015 Intel Corporation 7 */ 8 9 #include <linux/module.h> 10 #include <linux/firmware.h> 11 #include <asm/unaligned.h> 12 13 #include <net/bluetooth/bluetooth.h> 14 #include <net/bluetooth/hci_core.h> 15 16 #include "btbcm.h" 17 18 #define VERSION "0.1" 19 20 #define BDADDR_BCM20702A0 (&(bdaddr_t) {{0x00, 0xa0, 0x02, 0x70, 0x20, 0x00}}) 21 #define BDADDR_BCM20702A1 (&(bdaddr_t) {{0x00, 0x00, 0xa0, 0x02, 0x70, 0x20}}) 22 #define BDADDR_BCM2076B1 (&(bdaddr_t) {{0x79, 0x56, 0x00, 0xa0, 0x76, 0x20}}) 23 #define BDADDR_BCM43430A0 (&(bdaddr_t) {{0xac, 0x1f, 0x12, 0xa0, 0x43, 0x43}}) 24 #define BDADDR_BCM4324B3 (&(bdaddr_t) {{0x00, 0x00, 0x00, 0xb3, 0x24, 0x43}}) 25 #define BDADDR_BCM4330B1 (&(bdaddr_t) {{0x00, 0x00, 0x00, 0xb1, 0x30, 0x43}}) 26 #define BDADDR_BCM4334B0 (&(bdaddr_t) {{0x00, 0x00, 0x00, 0xb0, 0x34, 0x43}}) 27 #define BDADDR_BCM4345C5 (&(bdaddr_t) {{0xac, 0x1f, 0x00, 0xc5, 0x45, 0x43}}) 28 #define BDADDR_BCM43341B (&(bdaddr_t) {{0xac, 0x1f, 0x00, 0x1b, 0x34, 0x43}}) 29 30 #define BCM_FW_NAME_LEN 64 31 32 int btbcm_check_bdaddr(struct hci_dev *hdev) 33 { 34 struct hci_rp_read_bd_addr *bda; 35 struct sk_buff *skb; 36 37 skb = __hci_cmd_sync(hdev, HCI_OP_READ_BD_ADDR, 0, NULL, 38 HCI_INIT_TIMEOUT); 39 if (IS_ERR(skb)) { 40 int err = PTR_ERR(skb); 41 42 bt_dev_err(hdev, "BCM: Reading device address failed (%d)", err); 43 return err; 44 } 45 46 if (skb->len != sizeof(*bda)) { 47 bt_dev_err(hdev, "BCM: Device address length mismatch"); 48 kfree_skb(skb); 49 return -EIO; 50 } 51 52 bda = (struct hci_rp_read_bd_addr *)skb->data; 53 54 /* Check if the address indicates a controller with either an 55 * invalid or default address. In both cases the device needs 56 * to be marked as not having a valid address. 57 * 58 * The address 00:20:70:02:A0:00 indicates a BCM20702A0 controller 59 * with no configured address. 60 * 61 * The address 20:70:02:A0:00:00 indicates a BCM20702A1 controller 62 * with no configured address. 63 * 64 * The address 20:76:A0:00:56:79 indicates a BCM2076B1 controller 65 * with no configured address. 66 * 67 * The address 43:24:B3:00:00:00 indicates a BCM4324B3 controller 68 * with waiting for configuration state. 69 * 70 * The address 43:30:B1:00:00:00 indicates a BCM4330B1 controller 71 * with waiting for configuration state. 72 * 73 * The address 43:43:A0:12:1F:AC indicates a BCM43430A0 controller 74 * with no configured address. 75 */ 76 if (!bacmp(&bda->bdaddr, BDADDR_BCM20702A0) || 77 !bacmp(&bda->bdaddr, BDADDR_BCM20702A1) || 78 !bacmp(&bda->bdaddr, BDADDR_BCM2076B1) || 79 !bacmp(&bda->bdaddr, BDADDR_BCM4324B3) || 80 !bacmp(&bda->bdaddr, BDADDR_BCM4330B1) || 81 !bacmp(&bda->bdaddr, BDADDR_BCM4334B0) || 82 !bacmp(&bda->bdaddr, BDADDR_BCM4345C5) || 83 !bacmp(&bda->bdaddr, BDADDR_BCM43430A0) || 84 !bacmp(&bda->bdaddr, BDADDR_BCM43341B)) { 85 bt_dev_info(hdev, "BCM: Using default device address (%pMR)", 86 &bda->bdaddr); 87 set_bit(HCI_QUIRK_INVALID_BDADDR, &hdev->quirks); 88 } 89 90 kfree_skb(skb); 91 92 return 0; 93 } 94 EXPORT_SYMBOL_GPL(btbcm_check_bdaddr); 95 96 int btbcm_set_bdaddr(struct hci_dev *hdev, const bdaddr_t *bdaddr) 97 { 98 struct sk_buff *skb; 99 int err; 100 101 skb = __hci_cmd_sync(hdev, 0xfc01, 6, bdaddr, HCI_INIT_TIMEOUT); 102 if (IS_ERR(skb)) { 103 err = PTR_ERR(skb); 104 bt_dev_err(hdev, "BCM: Change address command failed (%d)", err); 105 return err; 106 } 107 kfree_skb(skb); 108 109 return 0; 110 } 111 EXPORT_SYMBOL_GPL(btbcm_set_bdaddr); 112 113 int btbcm_read_pcm_int_params(struct hci_dev *hdev, 114 struct bcm_set_pcm_int_params *params) 115 { 116 struct sk_buff *skb; 117 int err = 0; 118 119 skb = __hci_cmd_sync(hdev, 0xfc1d, 0, NULL, HCI_INIT_TIMEOUT); 120 if (IS_ERR(skb)) { 121 err = PTR_ERR(skb); 122 bt_dev_err(hdev, "BCM: Read PCM int params failed (%d)", err); 123 return err; 124 } 125 126 if (skb->len != 6 || skb->data[0]) { 127 bt_dev_err(hdev, "BCM: Read PCM int params length mismatch"); 128 kfree_skb(skb); 129 return -EIO; 130 } 131 132 if (params) 133 memcpy(params, skb->data + 1, 5); 134 135 kfree_skb(skb); 136 137 return 0; 138 } 139 EXPORT_SYMBOL_GPL(btbcm_read_pcm_int_params); 140 141 int btbcm_write_pcm_int_params(struct hci_dev *hdev, 142 const struct bcm_set_pcm_int_params *params) 143 { 144 struct sk_buff *skb; 145 int err; 146 147 skb = __hci_cmd_sync(hdev, 0xfc1c, 5, params, HCI_INIT_TIMEOUT); 148 if (IS_ERR(skb)) { 149 err = PTR_ERR(skb); 150 bt_dev_err(hdev, "BCM: Write PCM int params failed (%d)", err); 151 return err; 152 } 153 kfree_skb(skb); 154 155 return 0; 156 } 157 EXPORT_SYMBOL_GPL(btbcm_write_pcm_int_params); 158 159 int btbcm_patchram(struct hci_dev *hdev, const struct firmware *fw) 160 { 161 const struct hci_command_hdr *cmd; 162 const u8 *fw_ptr; 163 size_t fw_size; 164 struct sk_buff *skb; 165 u16 opcode; 166 int err = 0; 167 168 /* Start Download */ 169 skb = __hci_cmd_sync(hdev, 0xfc2e, 0, NULL, HCI_INIT_TIMEOUT); 170 if (IS_ERR(skb)) { 171 err = PTR_ERR(skb); 172 bt_dev_err(hdev, "BCM: Download Minidrv command failed (%d)", 173 err); 174 goto done; 175 } 176 kfree_skb(skb); 177 178 /* 50 msec delay after Download Minidrv completes */ 179 msleep(50); 180 181 fw_ptr = fw->data; 182 fw_size = fw->size; 183 184 while (fw_size >= sizeof(*cmd)) { 185 const u8 *cmd_param; 186 187 cmd = (struct hci_command_hdr *)fw_ptr; 188 fw_ptr += sizeof(*cmd); 189 fw_size -= sizeof(*cmd); 190 191 if (fw_size < cmd->plen) { 192 bt_dev_err(hdev, "BCM: Patch is corrupted"); 193 err = -EINVAL; 194 goto done; 195 } 196 197 cmd_param = fw_ptr; 198 fw_ptr += cmd->plen; 199 fw_size -= cmd->plen; 200 201 opcode = le16_to_cpu(cmd->opcode); 202 203 skb = __hci_cmd_sync(hdev, opcode, cmd->plen, cmd_param, 204 HCI_INIT_TIMEOUT); 205 if (IS_ERR(skb)) { 206 err = PTR_ERR(skb); 207 bt_dev_err(hdev, "BCM: Patch command %04x failed (%d)", 208 opcode, err); 209 goto done; 210 } 211 kfree_skb(skb); 212 } 213 214 /* 250 msec delay after Launch Ram completes */ 215 msleep(250); 216 217 done: 218 return err; 219 } 220 EXPORT_SYMBOL(btbcm_patchram); 221 222 static int btbcm_reset(struct hci_dev *hdev) 223 { 224 struct sk_buff *skb; 225 226 skb = __hci_cmd_sync(hdev, HCI_OP_RESET, 0, NULL, HCI_INIT_TIMEOUT); 227 if (IS_ERR(skb)) { 228 int err = PTR_ERR(skb); 229 230 bt_dev_err(hdev, "BCM: Reset failed (%d)", err); 231 return err; 232 } 233 kfree_skb(skb); 234 235 /* 100 msec delay for module to complete reset process */ 236 msleep(100); 237 238 return 0; 239 } 240 241 static struct sk_buff *btbcm_read_local_name(struct hci_dev *hdev) 242 { 243 struct sk_buff *skb; 244 245 skb = __hci_cmd_sync(hdev, HCI_OP_READ_LOCAL_NAME, 0, NULL, 246 HCI_INIT_TIMEOUT); 247 if (IS_ERR(skb)) { 248 bt_dev_err(hdev, "BCM: Reading local name failed (%ld)", 249 PTR_ERR(skb)); 250 return skb; 251 } 252 253 if (skb->len != sizeof(struct hci_rp_read_local_name)) { 254 bt_dev_err(hdev, "BCM: Local name length mismatch"); 255 kfree_skb(skb); 256 return ERR_PTR(-EIO); 257 } 258 259 return skb; 260 } 261 262 static struct sk_buff *btbcm_read_local_version(struct hci_dev *hdev) 263 { 264 struct sk_buff *skb; 265 266 skb = __hci_cmd_sync(hdev, HCI_OP_READ_LOCAL_VERSION, 0, NULL, 267 HCI_INIT_TIMEOUT); 268 if (IS_ERR(skb)) { 269 bt_dev_err(hdev, "BCM: Reading local version info failed (%ld)", 270 PTR_ERR(skb)); 271 return skb; 272 } 273 274 if (skb->len != sizeof(struct hci_rp_read_local_version)) { 275 bt_dev_err(hdev, "BCM: Local version length mismatch"); 276 kfree_skb(skb); 277 return ERR_PTR(-EIO); 278 } 279 280 return skb; 281 } 282 283 static struct sk_buff *btbcm_read_verbose_config(struct hci_dev *hdev) 284 { 285 struct sk_buff *skb; 286 287 skb = __hci_cmd_sync(hdev, 0xfc79, 0, NULL, HCI_INIT_TIMEOUT); 288 if (IS_ERR(skb)) { 289 bt_dev_err(hdev, "BCM: Read verbose config info failed (%ld)", 290 PTR_ERR(skb)); 291 return skb; 292 } 293 294 if (skb->len != 7) { 295 bt_dev_err(hdev, "BCM: Verbose config length mismatch"); 296 kfree_skb(skb); 297 return ERR_PTR(-EIO); 298 } 299 300 return skb; 301 } 302 303 static struct sk_buff *btbcm_read_controller_features(struct hci_dev *hdev) 304 { 305 struct sk_buff *skb; 306 307 skb = __hci_cmd_sync(hdev, 0xfc6e, 0, NULL, HCI_INIT_TIMEOUT); 308 if (IS_ERR(skb)) { 309 bt_dev_err(hdev, "BCM: Read controller features failed (%ld)", 310 PTR_ERR(skb)); 311 return skb; 312 } 313 314 if (skb->len != 9) { 315 bt_dev_err(hdev, "BCM: Controller features length mismatch"); 316 kfree_skb(skb); 317 return ERR_PTR(-EIO); 318 } 319 320 return skb; 321 } 322 323 static struct sk_buff *btbcm_read_usb_product(struct hci_dev *hdev) 324 { 325 struct sk_buff *skb; 326 327 skb = __hci_cmd_sync(hdev, 0xfc5a, 0, NULL, HCI_INIT_TIMEOUT); 328 if (IS_ERR(skb)) { 329 bt_dev_err(hdev, "BCM: Read USB product info failed (%ld)", 330 PTR_ERR(skb)); 331 return skb; 332 } 333 334 if (skb->len != 5) { 335 bt_dev_err(hdev, "BCM: USB product length mismatch"); 336 kfree_skb(skb); 337 return ERR_PTR(-EIO); 338 } 339 340 return skb; 341 } 342 343 static int btbcm_read_info(struct hci_dev *hdev) 344 { 345 struct sk_buff *skb; 346 347 /* Read Verbose Config Version Info */ 348 skb = btbcm_read_verbose_config(hdev); 349 if (IS_ERR(skb)) 350 return PTR_ERR(skb); 351 352 bt_dev_info(hdev, "BCM: chip id %u", skb->data[1]); 353 kfree_skb(skb); 354 355 /* Read Controller Features */ 356 skb = btbcm_read_controller_features(hdev); 357 if (IS_ERR(skb)) 358 return PTR_ERR(skb); 359 360 bt_dev_info(hdev, "BCM: features 0x%2.2x", skb->data[1]); 361 kfree_skb(skb); 362 363 return 0; 364 } 365 366 static int btbcm_print_local_name(struct hci_dev *hdev) 367 { 368 struct sk_buff *skb; 369 370 /* Read Local Name */ 371 skb = btbcm_read_local_name(hdev); 372 if (IS_ERR(skb)) 373 return PTR_ERR(skb); 374 375 bt_dev_info(hdev, "%s", (char *)(skb->data + 1)); 376 kfree_skb(skb); 377 378 return 0; 379 } 380 381 struct bcm_subver_table { 382 u16 subver; 383 const char *name; 384 }; 385 386 static const struct bcm_subver_table bcm_uart_subver_table[] = { 387 { 0x4103, "BCM4330B1" }, /* 002.001.003 */ 388 { 0x410d, "BCM4334B0" }, /* 002.001.013 */ 389 { 0x410e, "BCM43341B0" }, /* 002.001.014 */ 390 { 0x4204, "BCM2076B1" }, /* 002.002.004 */ 391 { 0x4406, "BCM4324B3" }, /* 002.004.006 */ 392 { 0x6109, "BCM4335C0" }, /* 003.001.009 */ 393 { 0x610c, "BCM4354" }, /* 003.001.012 */ 394 { 0x2122, "BCM4343A0" }, /* 001.001.034 */ 395 { 0x2209, "BCM43430A1" }, /* 001.002.009 */ 396 { 0x6119, "BCM4345C0" }, /* 003.001.025 */ 397 { 0x6606, "BCM4345C5" }, /* 003.006.006 */ 398 { 0x230f, "BCM4356A2" }, /* 001.003.015 */ 399 { 0x220e, "BCM20702A1" }, /* 001.002.014 */ 400 { 0x4217, "BCM4329B1" }, /* 002.002.023 */ 401 { 0x6106, "BCM4359C0" }, /* 003.001.006 */ 402 { 0x4106, "BCM4335A0" }, /* 002.001.006 */ 403 { } 404 }; 405 406 static const struct bcm_subver_table bcm_usb_subver_table[] = { 407 { 0x210b, "BCM43142A0" }, /* 001.001.011 */ 408 { 0x2112, "BCM4314A0" }, /* 001.001.018 */ 409 { 0x2118, "BCM20702A0" }, /* 001.001.024 */ 410 { 0x2126, "BCM4335A0" }, /* 001.001.038 */ 411 { 0x220e, "BCM20702A1" }, /* 001.002.014 */ 412 { 0x230f, "BCM4354A2" }, /* 001.003.015 */ 413 { 0x4106, "BCM4335B0" }, /* 002.001.006 */ 414 { 0x410e, "BCM20702B0" }, /* 002.001.014 */ 415 { 0x6109, "BCM4335C0" }, /* 003.001.009 */ 416 { 0x610c, "BCM4354" }, /* 003.001.012 */ 417 { } 418 }; 419 420 int btbcm_initialize(struct hci_dev *hdev, bool *fw_load_done) 421 { 422 u16 subver, rev, pid, vid; 423 const char *hw_name = "BCM"; 424 struct sk_buff *skb; 425 struct hci_rp_read_local_version *ver; 426 const struct bcm_subver_table *bcm_subver_table; 427 char fw_name[BCM_FW_NAME_LEN]; 428 const struct firmware *fw; 429 int i, err; 430 431 /* Reset */ 432 err = btbcm_reset(hdev); 433 if (err) 434 return err; 435 436 /* Read Local Version Info */ 437 skb = btbcm_read_local_version(hdev); 438 if (IS_ERR(skb)) 439 return PTR_ERR(skb); 440 441 ver = (struct hci_rp_read_local_version *)skb->data; 442 rev = le16_to_cpu(ver->hci_rev); 443 subver = le16_to_cpu(ver->lmp_subver); 444 kfree_skb(skb); 445 446 /* Read controller information */ 447 if (!(*fw_load_done)) { 448 err = btbcm_read_info(hdev); 449 if (err) 450 return err; 451 } 452 err = btbcm_print_local_name(hdev); 453 if (err) 454 return err; 455 456 bcm_subver_table = (hdev->bus == HCI_USB) ? bcm_usb_subver_table : 457 bcm_uart_subver_table; 458 459 for (i = 0; bcm_subver_table[i].name; i++) { 460 if (subver == bcm_subver_table[i].subver) { 461 hw_name = bcm_subver_table[i].name; 462 break; 463 } 464 } 465 466 if (hdev->bus == HCI_USB) { 467 /* Read USB Product Info */ 468 skb = btbcm_read_usb_product(hdev); 469 if (IS_ERR(skb)) 470 return PTR_ERR(skb); 471 472 vid = get_unaligned_le16(skb->data + 1); 473 pid = get_unaligned_le16(skb->data + 3); 474 kfree_skb(skb); 475 476 snprintf(fw_name, BCM_FW_NAME_LEN, "brcm/%s-%4.4x-%4.4x.hcd", 477 hw_name, vid, pid); 478 } else { 479 snprintf(fw_name, BCM_FW_NAME_LEN, "brcm/%s.hcd", hw_name); 480 } 481 482 bt_dev_info(hdev, "%s (%3.3u.%3.3u.%3.3u) build %4.4u", 483 hw_name, (subver & 0xe000) >> 13, 484 (subver & 0x1f00) >> 8, (subver & 0x00ff), rev & 0x0fff); 485 486 if (*fw_load_done) 487 return 0; 488 489 err = request_firmware(&fw, fw_name, &hdev->dev); 490 if (err) { 491 bt_dev_info(hdev, "BCM: Patch %s not found", fw_name); 492 return 0; 493 } 494 495 err = btbcm_patchram(hdev, fw); 496 if (err) 497 bt_dev_info(hdev, "BCM: Patch failed (%d)", err); 498 499 release_firmware(fw); 500 *fw_load_done = true; 501 return 0; 502 } 503 EXPORT_SYMBOL_GPL(btbcm_initialize); 504 505 int btbcm_finalize(struct hci_dev *hdev) 506 { 507 bool fw_load_done = true; 508 int err; 509 510 /* Re-initialize */ 511 err = btbcm_initialize(hdev, &fw_load_done); 512 if (err) 513 return err; 514 515 btbcm_check_bdaddr(hdev); 516 517 set_bit(HCI_QUIRK_STRICT_DUPLICATE_FILTER, &hdev->quirks); 518 519 return 0; 520 } 521 EXPORT_SYMBOL_GPL(btbcm_finalize); 522 523 int btbcm_setup_patchram(struct hci_dev *hdev) 524 { 525 bool fw_load_done = false; 526 int err; 527 528 /* Initialize */ 529 err = btbcm_initialize(hdev, &fw_load_done); 530 if (err) 531 return err; 532 533 if (!fw_load_done) 534 goto done; 535 536 /* Re-initialize after loading Patch */ 537 err = btbcm_initialize(hdev, &fw_load_done); 538 if (err) 539 return err; 540 541 done: 542 btbcm_check_bdaddr(hdev); 543 544 set_bit(HCI_QUIRK_STRICT_DUPLICATE_FILTER, &hdev->quirks); 545 546 return 0; 547 } 548 EXPORT_SYMBOL_GPL(btbcm_setup_patchram); 549 550 int btbcm_setup_apple(struct hci_dev *hdev) 551 { 552 struct sk_buff *skb; 553 int err; 554 555 /* Reset */ 556 err = btbcm_reset(hdev); 557 if (err) 558 return err; 559 560 /* Read Verbose Config Version Info */ 561 skb = btbcm_read_verbose_config(hdev); 562 if (!IS_ERR(skb)) { 563 bt_dev_info(hdev, "BCM: chip id %u build %4.4u", 564 skb->data[1], get_unaligned_le16(skb->data + 5)); 565 kfree_skb(skb); 566 } 567 568 /* Read USB Product Info */ 569 skb = btbcm_read_usb_product(hdev); 570 if (!IS_ERR(skb)) { 571 bt_dev_info(hdev, "BCM: product %4.4x:%4.4x", 572 get_unaligned_le16(skb->data + 1), 573 get_unaligned_le16(skb->data + 3)); 574 kfree_skb(skb); 575 } 576 577 /* Read Controller Features */ 578 skb = btbcm_read_controller_features(hdev); 579 if (!IS_ERR(skb)) { 580 bt_dev_info(hdev, "BCM: features 0x%2.2x", skb->data[1]); 581 kfree_skb(skb); 582 } 583 584 /* Read Local Name */ 585 skb = btbcm_read_local_name(hdev); 586 if (!IS_ERR(skb)) { 587 bt_dev_info(hdev, "%s", (char *)(skb->data + 1)); 588 kfree_skb(skb); 589 } 590 591 set_bit(HCI_QUIRK_STRICT_DUPLICATE_FILTER, &hdev->quirks); 592 593 return 0; 594 } 595 EXPORT_SYMBOL_GPL(btbcm_setup_apple); 596 597 MODULE_AUTHOR("Marcel Holtmann <[email protected]>"); 598 MODULE_DESCRIPTION("Bluetooth support for Broadcom devices ver " VERSION); 599 MODULE_VERSION(VERSION); 600 MODULE_LICENSE("GPL"); 601