1 // SPDX-License-Identifier: GPL-2.0-or-later 2 /* 3 * 4 * Bluetooth support for Broadcom devices 5 * 6 * Copyright (C) 2015 Intel Corporation 7 */ 8 9 #include <linux/module.h> 10 #include <linux/firmware.h> 11 #include <asm/unaligned.h> 12 13 #include <net/bluetooth/bluetooth.h> 14 #include <net/bluetooth/hci_core.h> 15 16 #include "btbcm.h" 17 18 #define VERSION "0.1" 19 20 #define BDADDR_BCM20702A0 (&(bdaddr_t) {{0x00, 0xa0, 0x02, 0x70, 0x20, 0x00}}) 21 #define BDADDR_BCM20702A1 (&(bdaddr_t) {{0x00, 0x00, 0xa0, 0x02, 0x70, 0x20}}) 22 #define BDADDR_BCM2076B1 (&(bdaddr_t) {{0x79, 0x56, 0x00, 0xa0, 0x76, 0x20}}) 23 #define BDADDR_BCM43430A0 (&(bdaddr_t) {{0xac, 0x1f, 0x12, 0xa0, 0x43, 0x43}}) 24 #define BDADDR_BCM4324B3 (&(bdaddr_t) {{0x00, 0x00, 0x00, 0xb3, 0x24, 0x43}}) 25 #define BDADDR_BCM4330B1 (&(bdaddr_t) {{0x00, 0x00, 0x00, 0xb1, 0x30, 0x43}}) 26 #define BDADDR_BCM4334B0 (&(bdaddr_t) {{0x00, 0x00, 0x00, 0xb0, 0x34, 0x43}}) 27 #define BDADDR_BCM4345C5 (&(bdaddr_t) {{0xac, 0x1f, 0x00, 0xc5, 0x45, 0x43}}) 28 #define BDADDR_BCM43341B (&(bdaddr_t) {{0xac, 0x1f, 0x00, 0x1b, 0x34, 0x43}}) 29 30 int btbcm_check_bdaddr(struct hci_dev *hdev) 31 { 32 struct hci_rp_read_bd_addr *bda; 33 struct sk_buff *skb; 34 35 skb = __hci_cmd_sync(hdev, HCI_OP_READ_BD_ADDR, 0, NULL, 36 HCI_INIT_TIMEOUT); 37 if (IS_ERR(skb)) { 38 int err = PTR_ERR(skb); 39 bt_dev_err(hdev, "BCM: Reading device address failed (%d)", err); 40 return err; 41 } 42 43 if (skb->len != sizeof(*bda)) { 44 bt_dev_err(hdev, "BCM: Device address length mismatch"); 45 kfree_skb(skb); 46 return -EIO; 47 } 48 49 bda = (struct hci_rp_read_bd_addr *)skb->data; 50 51 /* Check if the address indicates a controller with either an 52 * invalid or default address. In both cases the device needs 53 * to be marked as not having a valid address. 54 * 55 * The address 00:20:70:02:A0:00 indicates a BCM20702A0 controller 56 * with no configured address. 57 * 58 * The address 20:70:02:A0:00:00 indicates a BCM20702A1 controller 59 * with no configured address. 60 * 61 * The address 20:76:A0:00:56:79 indicates a BCM2076B1 controller 62 * with no configured address. 63 * 64 * The address 43:24:B3:00:00:00 indicates a BCM4324B3 controller 65 * with waiting for configuration state. 66 * 67 * The address 43:30:B1:00:00:00 indicates a BCM4330B1 controller 68 * with waiting for configuration state. 69 * 70 * The address 43:43:A0:12:1F:AC indicates a BCM43430A0 controller 71 * with no configured address. 72 */ 73 if (!bacmp(&bda->bdaddr, BDADDR_BCM20702A0) || 74 !bacmp(&bda->bdaddr, BDADDR_BCM20702A1) || 75 !bacmp(&bda->bdaddr, BDADDR_BCM2076B1) || 76 !bacmp(&bda->bdaddr, BDADDR_BCM4324B3) || 77 !bacmp(&bda->bdaddr, BDADDR_BCM4330B1) || 78 !bacmp(&bda->bdaddr, BDADDR_BCM4334B0) || 79 !bacmp(&bda->bdaddr, BDADDR_BCM4345C5) || 80 !bacmp(&bda->bdaddr, BDADDR_BCM43430A0) || 81 !bacmp(&bda->bdaddr, BDADDR_BCM43341B)) { 82 bt_dev_info(hdev, "BCM: Using default device address (%pMR)", 83 &bda->bdaddr); 84 set_bit(HCI_QUIRK_INVALID_BDADDR, &hdev->quirks); 85 } 86 87 kfree_skb(skb); 88 89 return 0; 90 } 91 EXPORT_SYMBOL_GPL(btbcm_check_bdaddr); 92 93 int btbcm_set_bdaddr(struct hci_dev *hdev, const bdaddr_t *bdaddr) 94 { 95 struct sk_buff *skb; 96 int err; 97 98 skb = __hci_cmd_sync(hdev, 0xfc01, 6, bdaddr, HCI_INIT_TIMEOUT); 99 if (IS_ERR(skb)) { 100 err = PTR_ERR(skb); 101 bt_dev_err(hdev, "BCM: Change address command failed (%d)", err); 102 return err; 103 } 104 kfree_skb(skb); 105 106 return 0; 107 } 108 EXPORT_SYMBOL_GPL(btbcm_set_bdaddr); 109 110 int btbcm_read_pcm_int_params(struct hci_dev *hdev, 111 struct bcm_set_pcm_int_params *params) 112 { 113 struct sk_buff *skb; 114 int err = 0; 115 116 skb = __hci_cmd_sync(hdev, 0xfc1d, 0, NULL, HCI_INIT_TIMEOUT); 117 if (IS_ERR(skb)) { 118 err = PTR_ERR(skb); 119 bt_dev_err(hdev, "BCM: Read PCM int params failed (%d)", err); 120 return err; 121 } 122 123 if (skb->len != 6 || skb->data[0]) { 124 bt_dev_err(hdev, "BCM: Read PCM int params length mismatch"); 125 kfree_skb(skb); 126 return -EIO; 127 } 128 129 if (params) 130 memcpy(params, skb->data + 1, 5); 131 132 kfree_skb(skb); 133 134 return 0; 135 } 136 EXPORT_SYMBOL_GPL(btbcm_read_pcm_int_params); 137 138 int btbcm_write_pcm_int_params(struct hci_dev *hdev, 139 const struct bcm_set_pcm_int_params *params) 140 { 141 struct sk_buff *skb; 142 int err; 143 144 skb = __hci_cmd_sync(hdev, 0xfc1c, 5, params, HCI_INIT_TIMEOUT); 145 if (IS_ERR(skb)) { 146 err = PTR_ERR(skb); 147 bt_dev_err(hdev, "BCM: Write PCM int params failed (%d)", err); 148 return err; 149 } 150 kfree_skb(skb); 151 152 return 0; 153 } 154 EXPORT_SYMBOL_GPL(btbcm_write_pcm_int_params); 155 156 int btbcm_patchram(struct hci_dev *hdev, const struct firmware *fw) 157 { 158 const struct hci_command_hdr *cmd; 159 const u8 *fw_ptr; 160 size_t fw_size; 161 struct sk_buff *skb; 162 u16 opcode; 163 int err = 0; 164 165 /* Start Download */ 166 skb = __hci_cmd_sync(hdev, 0xfc2e, 0, NULL, HCI_INIT_TIMEOUT); 167 if (IS_ERR(skb)) { 168 err = PTR_ERR(skb); 169 bt_dev_err(hdev, "BCM: Download Minidrv command failed (%d)", 170 err); 171 goto done; 172 } 173 kfree_skb(skb); 174 175 /* 50 msec delay after Download Minidrv completes */ 176 msleep(50); 177 178 fw_ptr = fw->data; 179 fw_size = fw->size; 180 181 while (fw_size >= sizeof(*cmd)) { 182 const u8 *cmd_param; 183 184 cmd = (struct hci_command_hdr *)fw_ptr; 185 fw_ptr += sizeof(*cmd); 186 fw_size -= sizeof(*cmd); 187 188 if (fw_size < cmd->plen) { 189 bt_dev_err(hdev, "BCM: Patch is corrupted"); 190 err = -EINVAL; 191 goto done; 192 } 193 194 cmd_param = fw_ptr; 195 fw_ptr += cmd->plen; 196 fw_size -= cmd->plen; 197 198 opcode = le16_to_cpu(cmd->opcode); 199 200 skb = __hci_cmd_sync(hdev, opcode, cmd->plen, cmd_param, 201 HCI_INIT_TIMEOUT); 202 if (IS_ERR(skb)) { 203 err = PTR_ERR(skb); 204 bt_dev_err(hdev, "BCM: Patch command %04x failed (%d)", 205 opcode, err); 206 goto done; 207 } 208 kfree_skb(skb); 209 } 210 211 /* 250 msec delay after Launch Ram completes */ 212 msleep(250); 213 214 done: 215 return err; 216 } 217 EXPORT_SYMBOL(btbcm_patchram); 218 219 static int btbcm_reset(struct hci_dev *hdev) 220 { 221 struct sk_buff *skb; 222 223 skb = __hci_cmd_sync(hdev, HCI_OP_RESET, 0, NULL, HCI_INIT_TIMEOUT); 224 if (IS_ERR(skb)) { 225 int err = PTR_ERR(skb); 226 bt_dev_err(hdev, "BCM: Reset failed (%d)", err); 227 return err; 228 } 229 kfree_skb(skb); 230 231 /* 100 msec delay for module to complete reset process */ 232 msleep(100); 233 234 return 0; 235 } 236 237 static struct sk_buff *btbcm_read_local_name(struct hci_dev *hdev) 238 { 239 struct sk_buff *skb; 240 241 skb = __hci_cmd_sync(hdev, HCI_OP_READ_LOCAL_NAME, 0, NULL, 242 HCI_INIT_TIMEOUT); 243 if (IS_ERR(skb)) { 244 bt_dev_err(hdev, "BCM: Reading local name failed (%ld)", 245 PTR_ERR(skb)); 246 return skb; 247 } 248 249 if (skb->len != sizeof(struct hci_rp_read_local_name)) { 250 bt_dev_err(hdev, "BCM: Local name length mismatch"); 251 kfree_skb(skb); 252 return ERR_PTR(-EIO); 253 } 254 255 return skb; 256 } 257 258 static struct sk_buff *btbcm_read_local_version(struct hci_dev *hdev) 259 { 260 struct sk_buff *skb; 261 262 skb = __hci_cmd_sync(hdev, HCI_OP_READ_LOCAL_VERSION, 0, NULL, 263 HCI_INIT_TIMEOUT); 264 if (IS_ERR(skb)) { 265 bt_dev_err(hdev, "BCM: Reading local version info failed (%ld)", 266 PTR_ERR(skb)); 267 return skb; 268 } 269 270 if (skb->len != sizeof(struct hci_rp_read_local_version)) { 271 bt_dev_err(hdev, "BCM: Local version length mismatch"); 272 kfree_skb(skb); 273 return ERR_PTR(-EIO); 274 } 275 276 return skb; 277 } 278 279 static struct sk_buff *btbcm_read_verbose_config(struct hci_dev *hdev) 280 { 281 struct sk_buff *skb; 282 283 skb = __hci_cmd_sync(hdev, 0xfc79, 0, NULL, HCI_INIT_TIMEOUT); 284 if (IS_ERR(skb)) { 285 bt_dev_err(hdev, "BCM: Read verbose config info failed (%ld)", 286 PTR_ERR(skb)); 287 return skb; 288 } 289 290 if (skb->len != 7) { 291 bt_dev_err(hdev, "BCM: Verbose config length mismatch"); 292 kfree_skb(skb); 293 return ERR_PTR(-EIO); 294 } 295 296 return skb; 297 } 298 299 static struct sk_buff *btbcm_read_controller_features(struct hci_dev *hdev) 300 { 301 struct sk_buff *skb; 302 303 skb = __hci_cmd_sync(hdev, 0xfc6e, 0, NULL, HCI_INIT_TIMEOUT); 304 if (IS_ERR(skb)) { 305 bt_dev_err(hdev, "BCM: Read controller features failed (%ld)", 306 PTR_ERR(skb)); 307 return skb; 308 } 309 310 if (skb->len != 9) { 311 bt_dev_err(hdev, "BCM: Controller features length mismatch"); 312 kfree_skb(skb); 313 return ERR_PTR(-EIO); 314 } 315 316 return skb; 317 } 318 319 static struct sk_buff *btbcm_read_usb_product(struct hci_dev *hdev) 320 { 321 struct sk_buff *skb; 322 323 skb = __hci_cmd_sync(hdev, 0xfc5a, 0, NULL, HCI_INIT_TIMEOUT); 324 if (IS_ERR(skb)) { 325 bt_dev_err(hdev, "BCM: Read USB product info failed (%ld)", 326 PTR_ERR(skb)); 327 return skb; 328 } 329 330 if (skb->len != 5) { 331 bt_dev_err(hdev, "BCM: USB product length mismatch"); 332 kfree_skb(skb); 333 return ERR_PTR(-EIO); 334 } 335 336 return skb; 337 } 338 339 static int btbcm_read_info(struct hci_dev *hdev) 340 { 341 struct sk_buff *skb; 342 343 /* Read Verbose Config Version Info */ 344 skb = btbcm_read_verbose_config(hdev); 345 if (IS_ERR(skb)) 346 return PTR_ERR(skb); 347 348 bt_dev_info(hdev, "BCM: chip id %u", skb->data[1]); 349 kfree_skb(skb); 350 351 /* Read Controller Features */ 352 skb = btbcm_read_controller_features(hdev); 353 if (IS_ERR(skb)) 354 return PTR_ERR(skb); 355 356 bt_dev_info(hdev, "BCM: features 0x%2.2x", skb->data[1]); 357 kfree_skb(skb); 358 359 /* Read Local Name */ 360 skb = btbcm_read_local_name(hdev); 361 if (IS_ERR(skb)) 362 return PTR_ERR(skb); 363 364 bt_dev_info(hdev, "%s", (char *)(skb->data + 1)); 365 kfree_skb(skb); 366 367 return 0; 368 } 369 370 struct bcm_subver_table { 371 u16 subver; 372 const char *name; 373 }; 374 375 static const struct bcm_subver_table bcm_uart_subver_table[] = { 376 { 0x4103, "BCM4330B1" }, /* 002.001.003 */ 377 { 0x410d, "BCM4334B0" }, /* 002.001.013 */ 378 { 0x410e, "BCM43341B0" }, /* 002.001.014 */ 379 { 0x4204, "BCM2076B1" }, /* 002.002.004 */ 380 { 0x4406, "BCM4324B3" }, /* 002.004.006 */ 381 { 0x6109, "BCM4335C0" }, /* 003.001.009 */ 382 { 0x610c, "BCM4354" }, /* 003.001.012 */ 383 { 0x2122, "BCM4343A0" }, /* 001.001.034 */ 384 { 0x2209, "BCM43430A1" }, /* 001.002.009 */ 385 { 0x6119, "BCM4345C0" }, /* 003.001.025 */ 386 { 0x6606, "BCM4345C5" }, /* 003.006.006 */ 387 { 0x230f, "BCM4356A2" }, /* 001.003.015 */ 388 { 0x220e, "BCM20702A1" }, /* 001.002.014 */ 389 { 0x4217, "BCM4329B1" }, /* 002.002.023 */ 390 { 0x6106, "BCM4359C0" }, /* 003.001.006 */ 391 { 0x4106, "BCM4335A0" }, /* 002.001.006 */ 392 { } 393 }; 394 395 static const struct bcm_subver_table bcm_usb_subver_table[] = { 396 { 0x210b, "BCM43142A0" }, /* 001.001.011 */ 397 { 0x2112, "BCM4314A0" }, /* 001.001.018 */ 398 { 0x2118, "BCM20702A0" }, /* 001.001.024 */ 399 { 0x2126, "BCM4335A0" }, /* 001.001.038 */ 400 { 0x220e, "BCM20702A1" }, /* 001.002.014 */ 401 { 0x230f, "BCM4354A2" }, /* 001.003.015 */ 402 { 0x4106, "BCM4335B0" }, /* 002.001.006 */ 403 { 0x410e, "BCM20702B0" }, /* 002.001.014 */ 404 { 0x6109, "BCM4335C0" }, /* 003.001.009 */ 405 { 0x610c, "BCM4354" }, /* 003.001.012 */ 406 { } 407 }; 408 409 int btbcm_initialize(struct hci_dev *hdev, char *fw_name, size_t len, 410 bool reinit) 411 { 412 u16 subver, rev, pid, vid; 413 const char *hw_name = "BCM"; 414 struct sk_buff *skb; 415 struct hci_rp_read_local_version *ver; 416 const struct bcm_subver_table *bcm_subver_table; 417 int i, err; 418 419 /* Reset */ 420 err = btbcm_reset(hdev); 421 if (err) 422 return err; 423 424 /* Read Local Version Info */ 425 skb = btbcm_read_local_version(hdev); 426 if (IS_ERR(skb)) 427 return PTR_ERR(skb); 428 429 ver = (struct hci_rp_read_local_version *)skb->data; 430 rev = le16_to_cpu(ver->hci_rev); 431 subver = le16_to_cpu(ver->lmp_subver); 432 kfree_skb(skb); 433 434 /* Read controller information */ 435 if (!reinit) { 436 err = btbcm_read_info(hdev); 437 if (err) 438 return err; 439 } 440 441 /* Upper nibble of rev should be between 0 and 3? */ 442 if (((rev & 0xf000) >> 12) > 3) 443 return 0; 444 445 bcm_subver_table = (hdev->bus == HCI_USB) ? bcm_usb_subver_table : 446 bcm_uart_subver_table; 447 448 for (i = 0; bcm_subver_table[i].name; i++) { 449 if (subver == bcm_subver_table[i].subver) { 450 hw_name = bcm_subver_table[i].name; 451 break; 452 } 453 } 454 455 if (hdev->bus == HCI_USB) { 456 /* Read USB Product Info */ 457 skb = btbcm_read_usb_product(hdev); 458 if (IS_ERR(skb)) 459 return PTR_ERR(skb); 460 461 vid = get_unaligned_le16(skb->data + 1); 462 pid = get_unaligned_le16(skb->data + 3); 463 kfree_skb(skb); 464 465 snprintf(fw_name, len, "brcm/%s-%4.4x-%4.4x.hcd", 466 hw_name, vid, pid); 467 } else { 468 snprintf(fw_name, len, "brcm/%s.hcd", hw_name); 469 } 470 471 bt_dev_info(hdev, "%s (%3.3u.%3.3u.%3.3u) build %4.4u", 472 hw_name, (subver & 0xe000) >> 13, 473 (subver & 0x1f00) >> 8, (subver & 0x00ff), rev & 0x0fff); 474 475 return 0; 476 } 477 EXPORT_SYMBOL_GPL(btbcm_initialize); 478 479 int btbcm_finalize(struct hci_dev *hdev) 480 { 481 char fw_name[64]; 482 int err; 483 484 /* Re-initialize */ 485 err = btbcm_initialize(hdev, fw_name, sizeof(fw_name), true); 486 if (err) 487 return err; 488 489 btbcm_check_bdaddr(hdev); 490 491 set_bit(HCI_QUIRK_STRICT_DUPLICATE_FILTER, &hdev->quirks); 492 493 /* Some devices ship with the controller default address. 494 * Allow the bootloader to set a valid address through the 495 * device tree. 496 */ 497 set_bit(HCI_QUIRK_USE_BDADDR_PROPERTY, &hdev->quirks); 498 499 return 0; 500 } 501 EXPORT_SYMBOL_GPL(btbcm_finalize); 502 503 int btbcm_setup_patchram(struct hci_dev *hdev) 504 { 505 char fw_name[64]; 506 const struct firmware *fw; 507 struct sk_buff *skb; 508 int err; 509 510 /* Initialize */ 511 err = btbcm_initialize(hdev, fw_name, sizeof(fw_name), false); 512 if (err) 513 return err; 514 515 err = request_firmware(&fw, fw_name, &hdev->dev); 516 if (err < 0) { 517 bt_dev_info(hdev, "BCM: Patch %s not found", fw_name); 518 goto done; 519 } 520 521 btbcm_patchram(hdev, fw); 522 523 release_firmware(fw); 524 525 /* Re-initialize */ 526 err = btbcm_initialize(hdev, fw_name, sizeof(fw_name), true); 527 if (err) 528 return err; 529 530 /* Read Local Name */ 531 skb = btbcm_read_local_name(hdev); 532 if (IS_ERR(skb)) 533 return PTR_ERR(skb); 534 535 bt_dev_info(hdev, "%s", (char *)(skb->data + 1)); 536 kfree_skb(skb); 537 538 done: 539 btbcm_check_bdaddr(hdev); 540 541 set_bit(HCI_QUIRK_STRICT_DUPLICATE_FILTER, &hdev->quirks); 542 543 return 0; 544 } 545 EXPORT_SYMBOL_GPL(btbcm_setup_patchram); 546 547 int btbcm_setup_apple(struct hci_dev *hdev) 548 { 549 struct sk_buff *skb; 550 int err; 551 552 /* Reset */ 553 err = btbcm_reset(hdev); 554 if (err) 555 return err; 556 557 /* Read Verbose Config Version Info */ 558 skb = btbcm_read_verbose_config(hdev); 559 if (!IS_ERR(skb)) { 560 bt_dev_info(hdev, "BCM: chip id %u build %4.4u", 561 skb->data[1], get_unaligned_le16(skb->data + 5)); 562 kfree_skb(skb); 563 } 564 565 /* Read USB Product Info */ 566 skb = btbcm_read_usb_product(hdev); 567 if (!IS_ERR(skb)) { 568 bt_dev_info(hdev, "BCM: product %4.4x:%4.4x", 569 get_unaligned_le16(skb->data + 1), 570 get_unaligned_le16(skb->data + 3)); 571 kfree_skb(skb); 572 } 573 574 /* Read Controller Features */ 575 skb = btbcm_read_controller_features(hdev); 576 if (!IS_ERR(skb)) { 577 bt_dev_info(hdev, "BCM: features 0x%2.2x", skb->data[1]); 578 kfree_skb(skb); 579 } 580 581 /* Read Local Name */ 582 skb = btbcm_read_local_name(hdev); 583 if (!IS_ERR(skb)) { 584 bt_dev_info(hdev, "%s", (char *)(skb->data + 1)); 585 kfree_skb(skb); 586 } 587 588 set_bit(HCI_QUIRK_STRICT_DUPLICATE_FILTER, &hdev->quirks); 589 590 return 0; 591 } 592 EXPORT_SYMBOL_GPL(btbcm_setup_apple); 593 594 MODULE_AUTHOR("Marcel Holtmann <marcel@holtmann.org>"); 595 MODULE_DESCRIPTION("Bluetooth support for Broadcom devices ver " VERSION); 596 MODULE_VERSION(VERSION); 597 MODULE_LICENSE("GPL"); 598