1 /* 2 * 3 * Bluetooth support for Broadcom devices 4 * 5 * Copyright (C) 2015 Intel Corporation 6 * 7 * 8 * This program is free software; you can redistribute it and/or modify 9 * it under the terms of the GNU General Public License as published by 10 * the Free Software Foundation; either version 2 of the License, or 11 * (at your option) any later version. 12 * 13 * This program is distributed in the hope that it will be useful, 14 * but WITHOUT ANY WARRANTY; without even the implied warranty of 15 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the 16 * GNU General Public License for more details. 17 * 18 * You should have received a copy of the GNU General Public License 19 * along with this program; if not, write to the Free Software 20 * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA 21 * 22 */ 23 24 #include <linux/module.h> 25 #include <linux/firmware.h> 26 #include <asm/unaligned.h> 27 28 #include <net/bluetooth/bluetooth.h> 29 #include <net/bluetooth/hci_core.h> 30 31 #include "btbcm.h" 32 33 #define VERSION "0.1" 34 35 #define BDADDR_BCM20702A0 (&(bdaddr_t) {{0x00, 0xa0, 0x02, 0x70, 0x20, 0x00}}) 36 #define BDADDR_BCM20702A1 (&(bdaddr_t) {{0x00, 0x00, 0xa0, 0x02, 0x70, 0x20}}) 37 #define BDADDR_BCM43430A0 (&(bdaddr_t) {{0xac, 0x1f, 0x12, 0xa0, 0x43, 0x43}}) 38 #define BDADDR_BCM4324B3 (&(bdaddr_t) {{0x00, 0x00, 0x00, 0xb3, 0x24, 0x43}}) 39 #define BDADDR_BCM4330B1 (&(bdaddr_t) {{0x00, 0x00, 0x00, 0xb1, 0x30, 0x43}}) 40 #define BDADDR_BCM43341B (&(bdaddr_t) {{0xac, 0x1f, 0x00, 0x1b, 0x34, 0x43}}) 41 42 int btbcm_check_bdaddr(struct hci_dev *hdev) 43 { 44 struct hci_rp_read_bd_addr *bda; 45 struct sk_buff *skb; 46 47 skb = __hci_cmd_sync(hdev, HCI_OP_READ_BD_ADDR, 0, NULL, 48 HCI_INIT_TIMEOUT); 49 if (IS_ERR(skb)) { 50 int err = PTR_ERR(skb); 51 bt_dev_err(hdev, "BCM: Reading device address failed (%d)", err); 52 return err; 53 } 54 55 if (skb->len != sizeof(*bda)) { 56 bt_dev_err(hdev, "BCM: Device address length mismatch"); 57 kfree_skb(skb); 58 return -EIO; 59 } 60 61 bda = (struct hci_rp_read_bd_addr *)skb->data; 62 63 /* Check if the address indicates a controller with either an 64 * invalid or default address. In both cases the device needs 65 * to be marked as not having a valid address. 66 * 67 * The address 00:20:70:02:A0:00 indicates a BCM20702A0 controller 68 * with no configured address. 69 * 70 * The address 20:70:02:A0:00:00 indicates a BCM20702A1 controller 71 * with no configured address. 72 * 73 * The address 43:24:B3:00:00:00 indicates a BCM4324B3 controller 74 * with waiting for configuration state. 75 * 76 * The address 43:30:B1:00:00:00 indicates a BCM4330B1 controller 77 * with waiting for configuration state. 78 * 79 * The address 43:43:A0:12:1F:AC indicates a BCM43430A0 controller 80 * with no configured address. 81 */ 82 if (!bacmp(&bda->bdaddr, BDADDR_BCM20702A0) || 83 !bacmp(&bda->bdaddr, BDADDR_BCM20702A1) || 84 !bacmp(&bda->bdaddr, BDADDR_BCM4324B3) || 85 !bacmp(&bda->bdaddr, BDADDR_BCM4330B1) || 86 !bacmp(&bda->bdaddr, BDADDR_BCM43430A0) || 87 !bacmp(&bda->bdaddr, BDADDR_BCM43341B)) { 88 bt_dev_info(hdev, "BCM: Using default device address (%pMR)", 89 &bda->bdaddr); 90 set_bit(HCI_QUIRK_INVALID_BDADDR, &hdev->quirks); 91 } 92 93 kfree_skb(skb); 94 95 return 0; 96 } 97 EXPORT_SYMBOL_GPL(btbcm_check_bdaddr); 98 99 int btbcm_set_bdaddr(struct hci_dev *hdev, const bdaddr_t *bdaddr) 100 { 101 struct sk_buff *skb; 102 int err; 103 104 skb = __hci_cmd_sync(hdev, 0xfc01, 6, bdaddr, HCI_INIT_TIMEOUT); 105 if (IS_ERR(skb)) { 106 err = PTR_ERR(skb); 107 bt_dev_err(hdev, "BCM: Change address command failed (%d)", err); 108 return err; 109 } 110 kfree_skb(skb); 111 112 return 0; 113 } 114 EXPORT_SYMBOL_GPL(btbcm_set_bdaddr); 115 116 int btbcm_patchram(struct hci_dev *hdev, const struct firmware *fw) 117 { 118 const struct hci_command_hdr *cmd; 119 const u8 *fw_ptr; 120 size_t fw_size; 121 struct sk_buff *skb; 122 u16 opcode; 123 int err = 0; 124 125 /* Start Download */ 126 skb = __hci_cmd_sync(hdev, 0xfc2e, 0, NULL, HCI_INIT_TIMEOUT); 127 if (IS_ERR(skb)) { 128 err = PTR_ERR(skb); 129 bt_dev_err(hdev, "BCM: Download Minidrv command failed (%d)", 130 err); 131 goto done; 132 } 133 kfree_skb(skb); 134 135 /* 50 msec delay after Download Minidrv completes */ 136 msleep(50); 137 138 fw_ptr = fw->data; 139 fw_size = fw->size; 140 141 while (fw_size >= sizeof(*cmd)) { 142 const u8 *cmd_param; 143 144 cmd = (struct hci_command_hdr *)fw_ptr; 145 fw_ptr += sizeof(*cmd); 146 fw_size -= sizeof(*cmd); 147 148 if (fw_size < cmd->plen) { 149 bt_dev_err(hdev, "BCM: Patch is corrupted"); 150 err = -EINVAL; 151 goto done; 152 } 153 154 cmd_param = fw_ptr; 155 fw_ptr += cmd->plen; 156 fw_size -= cmd->plen; 157 158 opcode = le16_to_cpu(cmd->opcode); 159 160 skb = __hci_cmd_sync(hdev, opcode, cmd->plen, cmd_param, 161 HCI_INIT_TIMEOUT); 162 if (IS_ERR(skb)) { 163 err = PTR_ERR(skb); 164 bt_dev_err(hdev, "BCM: Patch command %04x failed (%d)", 165 opcode, err); 166 goto done; 167 } 168 kfree_skb(skb); 169 } 170 171 /* 250 msec delay after Launch Ram completes */ 172 msleep(250); 173 174 done: 175 return err; 176 } 177 EXPORT_SYMBOL(btbcm_patchram); 178 179 static int btbcm_reset(struct hci_dev *hdev) 180 { 181 struct sk_buff *skb; 182 183 skb = __hci_cmd_sync(hdev, HCI_OP_RESET, 0, NULL, HCI_INIT_TIMEOUT); 184 if (IS_ERR(skb)) { 185 int err = PTR_ERR(skb); 186 bt_dev_err(hdev, "BCM: Reset failed (%d)", err); 187 return err; 188 } 189 kfree_skb(skb); 190 191 /* 100 msec delay for module to complete reset process */ 192 msleep(100); 193 194 return 0; 195 } 196 197 static struct sk_buff *btbcm_read_local_name(struct hci_dev *hdev) 198 { 199 struct sk_buff *skb; 200 201 skb = __hci_cmd_sync(hdev, HCI_OP_READ_LOCAL_NAME, 0, NULL, 202 HCI_INIT_TIMEOUT); 203 if (IS_ERR(skb)) { 204 bt_dev_err(hdev, "BCM: Reading local name failed (%ld)", 205 PTR_ERR(skb)); 206 return skb; 207 } 208 209 if (skb->len != sizeof(struct hci_rp_read_local_name)) { 210 bt_dev_err(hdev, "BCM: Local name length mismatch"); 211 kfree_skb(skb); 212 return ERR_PTR(-EIO); 213 } 214 215 return skb; 216 } 217 218 static struct sk_buff *btbcm_read_local_version(struct hci_dev *hdev) 219 { 220 struct sk_buff *skb; 221 222 skb = __hci_cmd_sync(hdev, HCI_OP_READ_LOCAL_VERSION, 0, NULL, 223 HCI_INIT_TIMEOUT); 224 if (IS_ERR(skb)) { 225 bt_dev_err(hdev, "BCM: Reading local version info failed (%ld)", 226 PTR_ERR(skb)); 227 return skb; 228 } 229 230 if (skb->len != sizeof(struct hci_rp_read_local_version)) { 231 bt_dev_err(hdev, "BCM: Local version length mismatch"); 232 kfree_skb(skb); 233 return ERR_PTR(-EIO); 234 } 235 236 return skb; 237 } 238 239 static struct sk_buff *btbcm_read_verbose_config(struct hci_dev *hdev) 240 { 241 struct sk_buff *skb; 242 243 skb = __hci_cmd_sync(hdev, 0xfc79, 0, NULL, HCI_INIT_TIMEOUT); 244 if (IS_ERR(skb)) { 245 bt_dev_err(hdev, "BCM: Read verbose config info failed (%ld)", 246 PTR_ERR(skb)); 247 return skb; 248 } 249 250 if (skb->len != 7) { 251 bt_dev_err(hdev, "BCM: Verbose config length mismatch"); 252 kfree_skb(skb); 253 return ERR_PTR(-EIO); 254 } 255 256 return skb; 257 } 258 259 static struct sk_buff *btbcm_read_controller_features(struct hci_dev *hdev) 260 { 261 struct sk_buff *skb; 262 263 skb = __hci_cmd_sync(hdev, 0xfc6e, 0, NULL, HCI_INIT_TIMEOUT); 264 if (IS_ERR(skb)) { 265 bt_dev_err(hdev, "BCM: Read controller features failed (%ld)", 266 PTR_ERR(skb)); 267 return skb; 268 } 269 270 if (skb->len != 9) { 271 bt_dev_err(hdev, "BCM: Controller features length mismatch"); 272 kfree_skb(skb); 273 return ERR_PTR(-EIO); 274 } 275 276 return skb; 277 } 278 279 static struct sk_buff *btbcm_read_usb_product(struct hci_dev *hdev) 280 { 281 struct sk_buff *skb; 282 283 skb = __hci_cmd_sync(hdev, 0xfc5a, 0, NULL, HCI_INIT_TIMEOUT); 284 if (IS_ERR(skb)) { 285 bt_dev_err(hdev, "BCM: Read USB product info failed (%ld)", 286 PTR_ERR(skb)); 287 return skb; 288 } 289 290 if (skb->len != 5) { 291 bt_dev_err(hdev, "BCM: USB product length mismatch"); 292 kfree_skb(skb); 293 return ERR_PTR(-EIO); 294 } 295 296 return skb; 297 } 298 299 static int btbcm_read_info(struct hci_dev *hdev) 300 { 301 struct sk_buff *skb; 302 303 /* Read Verbose Config Version Info */ 304 skb = btbcm_read_verbose_config(hdev); 305 if (IS_ERR(skb)) 306 return PTR_ERR(skb); 307 308 bt_dev_info(hdev, "BCM: chip id %u", skb->data[1]); 309 kfree_skb(skb); 310 311 /* Read Controller Features */ 312 skb = btbcm_read_controller_features(hdev); 313 if (IS_ERR(skb)) 314 return PTR_ERR(skb); 315 316 bt_dev_info(hdev, "BCM: features 0x%2.2x", skb->data[1]); 317 kfree_skb(skb); 318 319 /* Read Local Name */ 320 skb = btbcm_read_local_name(hdev); 321 if (IS_ERR(skb)) 322 return PTR_ERR(skb); 323 324 bt_dev_info(hdev, "%s", (char *)(skb->data + 1)); 325 kfree_skb(skb); 326 327 return 0; 328 } 329 330 struct bcm_subver_table { 331 u16 subver; 332 const char *name; 333 }; 334 335 static const struct bcm_subver_table bcm_uart_subver_table[] = { 336 { 0x4103, "BCM4330B1" }, /* 002.001.003 */ 337 { 0x410e, "BCM43341B0" }, /* 002.001.014 */ 338 { 0x4204, "BCM2076B1" }, /* 002.002.004 */ 339 { 0x4406, "BCM4324B3" }, /* 002.004.006 */ 340 { 0x6109, "BCM4335C0" }, /* 003.001.009 */ 341 { 0x610c, "BCM4354" }, /* 003.001.012 */ 342 { 0x2122, "BCM4343A0" }, /* 001.001.034 */ 343 { 0x2209, "BCM43430A1" }, /* 001.002.009 */ 344 { 0x6119, "BCM4345C0" }, /* 003.001.025 */ 345 { 0x230f, "BCM4356A2" }, /* 001.003.015 */ 346 { 0x220e, "BCM20702A1" }, /* 001.002.014 */ 347 { 0x4217, "BCM4329B1" }, /* 002.002.023 */ 348 { } 349 }; 350 351 static const struct bcm_subver_table bcm_usb_subver_table[] = { 352 { 0x210b, "BCM43142A0" }, /* 001.001.011 */ 353 { 0x2112, "BCM4314A0" }, /* 001.001.018 */ 354 { 0x2118, "BCM20702A0" }, /* 001.001.024 */ 355 { 0x2126, "BCM4335A0" }, /* 001.001.038 */ 356 { 0x220e, "BCM20702A1" }, /* 001.002.014 */ 357 { 0x230f, "BCM4354A2" }, /* 001.003.015 */ 358 { 0x4106, "BCM4335B0" }, /* 002.001.006 */ 359 { 0x410e, "BCM20702B0" }, /* 002.001.014 */ 360 { 0x6109, "BCM4335C0" }, /* 003.001.009 */ 361 { 0x610c, "BCM4354" }, /* 003.001.012 */ 362 { } 363 }; 364 365 int btbcm_initialize(struct hci_dev *hdev, char *fw_name, size_t len, 366 bool reinit) 367 { 368 u16 subver, rev, pid, vid; 369 const char *hw_name = "BCM"; 370 struct sk_buff *skb; 371 struct hci_rp_read_local_version *ver; 372 const struct bcm_subver_table *bcm_subver_table; 373 int i, err; 374 375 /* Reset */ 376 err = btbcm_reset(hdev); 377 if (err) 378 return err; 379 380 /* Read Local Version Info */ 381 skb = btbcm_read_local_version(hdev); 382 if (IS_ERR(skb)) 383 return PTR_ERR(skb); 384 385 ver = (struct hci_rp_read_local_version *)skb->data; 386 rev = le16_to_cpu(ver->hci_rev); 387 subver = le16_to_cpu(ver->lmp_subver); 388 kfree_skb(skb); 389 390 /* Read controller information */ 391 if (!reinit) { 392 err = btbcm_read_info(hdev); 393 if (err) 394 return err; 395 } 396 397 /* Upper nibble of rev should be between 0 and 3? */ 398 if (((rev & 0xf000) >> 12) > 3) 399 return 0; 400 401 bcm_subver_table = (hdev->bus == HCI_USB) ? bcm_usb_subver_table : 402 bcm_uart_subver_table; 403 404 for (i = 0; bcm_subver_table[i].name; i++) { 405 if (subver == bcm_subver_table[i].subver) { 406 hw_name = bcm_subver_table[i].name; 407 break; 408 } 409 } 410 411 if (hdev->bus == HCI_USB) { 412 /* Read USB Product Info */ 413 skb = btbcm_read_usb_product(hdev); 414 if (IS_ERR(skb)) 415 return PTR_ERR(skb); 416 417 vid = get_unaligned_le16(skb->data + 1); 418 pid = get_unaligned_le16(skb->data + 3); 419 kfree_skb(skb); 420 421 snprintf(fw_name, len, "brcm/%s-%4.4x-%4.4x.hcd", 422 hw_name, vid, pid); 423 } else { 424 snprintf(fw_name, len, "brcm/%s.hcd", hw_name); 425 } 426 427 bt_dev_info(hdev, "%s (%3.3u.%3.3u.%3.3u) build %4.4u", 428 hw_name, (subver & 0xe000) >> 13, 429 (subver & 0x1f00) >> 8, (subver & 0x00ff), rev & 0x0fff); 430 431 return 0; 432 } 433 EXPORT_SYMBOL_GPL(btbcm_initialize); 434 435 int btbcm_finalize(struct hci_dev *hdev) 436 { 437 char fw_name[64]; 438 int err; 439 440 /* Re-initialize */ 441 err = btbcm_initialize(hdev, fw_name, sizeof(fw_name), true); 442 if (err) 443 return err; 444 445 btbcm_check_bdaddr(hdev); 446 447 set_bit(HCI_QUIRK_STRICT_DUPLICATE_FILTER, &hdev->quirks); 448 449 return 0; 450 } 451 EXPORT_SYMBOL_GPL(btbcm_finalize); 452 453 int btbcm_setup_patchram(struct hci_dev *hdev) 454 { 455 char fw_name[64]; 456 const struct firmware *fw; 457 struct sk_buff *skb; 458 int err; 459 460 /* Initialize */ 461 err = btbcm_initialize(hdev, fw_name, sizeof(fw_name), false); 462 if (err) 463 return err; 464 465 err = request_firmware(&fw, fw_name, &hdev->dev); 466 if (err < 0) { 467 bt_dev_info(hdev, "BCM: Patch %s not found", fw_name); 468 goto done; 469 } 470 471 btbcm_patchram(hdev, fw); 472 473 release_firmware(fw); 474 475 /* Re-initialize */ 476 err = btbcm_initialize(hdev, fw_name, sizeof(fw_name), true); 477 if (err) 478 return err; 479 480 /* Read Local Name */ 481 skb = btbcm_read_local_name(hdev); 482 if (IS_ERR(skb)) 483 return PTR_ERR(skb); 484 485 bt_dev_info(hdev, "%s", (char *)(skb->data + 1)); 486 kfree_skb(skb); 487 488 done: 489 btbcm_check_bdaddr(hdev); 490 491 set_bit(HCI_QUIRK_STRICT_DUPLICATE_FILTER, &hdev->quirks); 492 493 return 0; 494 } 495 EXPORT_SYMBOL_GPL(btbcm_setup_patchram); 496 497 int btbcm_setup_apple(struct hci_dev *hdev) 498 { 499 struct sk_buff *skb; 500 int err; 501 502 /* Reset */ 503 err = btbcm_reset(hdev); 504 if (err) 505 return err; 506 507 /* Read Verbose Config Version Info */ 508 skb = btbcm_read_verbose_config(hdev); 509 if (!IS_ERR(skb)) { 510 bt_dev_info(hdev, "BCM: chip id %u build %4.4u", 511 skb->data[1], get_unaligned_le16(skb->data + 5)); 512 kfree_skb(skb); 513 } 514 515 /* Read USB Product Info */ 516 skb = btbcm_read_usb_product(hdev); 517 if (!IS_ERR(skb)) { 518 bt_dev_info(hdev, "BCM: product %4.4x:%4.4x", 519 get_unaligned_le16(skb->data + 1), 520 get_unaligned_le16(skb->data + 3)); 521 kfree_skb(skb); 522 } 523 524 /* Read Controller Features */ 525 skb = btbcm_read_controller_features(hdev); 526 if (!IS_ERR(skb)) { 527 bt_dev_info(hdev, "BCM: features 0x%2.2x", skb->data[1]); 528 kfree_skb(skb); 529 } 530 531 /* Read Local Name */ 532 skb = btbcm_read_local_name(hdev); 533 if (!IS_ERR(skb)) { 534 bt_dev_info(hdev, "%s", (char *)(skb->data + 1)); 535 kfree_skb(skb); 536 } 537 538 set_bit(HCI_QUIRK_STRICT_DUPLICATE_FILTER, &hdev->quirks); 539 540 return 0; 541 } 542 EXPORT_SYMBOL_GPL(btbcm_setup_apple); 543 544 MODULE_AUTHOR("Marcel Holtmann <marcel@holtmann.org>"); 545 MODULE_DESCRIPTION("Bluetooth support for Broadcom devices ver " VERSION); 546 MODULE_VERSION(VERSION); 547 MODULE_LICENSE("GPL"); 548