xref: /linux/drivers/bluetooth/btbcm.c (revision be239684b18e1cdcafcf8c7face4a2f562c745ad)
1 // SPDX-License-Identifier: GPL-2.0-or-later
2 /*
3  *
4  *  Bluetooth support for Broadcom devices
5  *
6  *  Copyright (C) 2015  Intel Corporation
7  */
8 
9 #include <linux/efi.h>
10 #include <linux/module.h>
11 #include <linux/firmware.h>
12 #include <linux/dmi.h>
13 #include <linux/of.h>
14 #include <asm/unaligned.h>
15 
16 #include <net/bluetooth/bluetooth.h>
17 #include <net/bluetooth/hci_core.h>
18 
19 #include "btbcm.h"
20 
21 #define VERSION "0.1"
22 
23 #define BDADDR_BCM20702A0 (&(bdaddr_t) {{0x00, 0xa0, 0x02, 0x70, 0x20, 0x00}})
24 #define BDADDR_BCM20702A1 (&(bdaddr_t) {{0x00, 0x00, 0xa0, 0x02, 0x70, 0x20}})
25 #define BDADDR_BCM2076B1 (&(bdaddr_t) {{0x79, 0x56, 0x00, 0xa0, 0x76, 0x20}})
26 #define BDADDR_BCM43430A0 (&(bdaddr_t) {{0xac, 0x1f, 0x12, 0xa0, 0x43, 0x43}})
27 #define BDADDR_BCM43430A1 (&(bdaddr_t) {{0xaa, 0xaa, 0xaa, 0xaa, 0xaa, 0xaa}})
28 #define BDADDR_BCM4324B3 (&(bdaddr_t) {{0x00, 0x00, 0x00, 0xb3, 0x24, 0x43}})
29 #define BDADDR_BCM4330B1 (&(bdaddr_t) {{0x00, 0x00, 0x00, 0xb1, 0x30, 0x43}})
30 #define BDADDR_BCM4334B0 (&(bdaddr_t) {{0x00, 0x00, 0x00, 0xb0, 0x34, 0x43}})
31 #define BDADDR_BCM4345C5 (&(bdaddr_t) {{0xac, 0x1f, 0x00, 0xc5, 0x45, 0x43}})
32 #define BDADDR_BCM43341B (&(bdaddr_t) {{0xac, 0x1f, 0x00, 0x1b, 0x34, 0x43}})
33 
34 #define BCM_FW_NAME_LEN			64
35 #define BCM_FW_NAME_COUNT_MAX		4
36 /* For kmalloc-ing the fw-name array instead of putting it on the stack */
37 typedef char bcm_fw_name[BCM_FW_NAME_LEN];
38 
39 #ifdef CONFIG_EFI
40 static int btbcm_set_bdaddr_from_efi(struct hci_dev *hdev)
41 {
42 	efi_guid_t guid = EFI_GUID(0x74b00bd9, 0x805a, 0x4d61, 0xb5, 0x1f,
43 				   0x43, 0x26, 0x81, 0x23, 0xd1, 0x13);
44 	bdaddr_t efi_bdaddr, bdaddr;
45 	efi_status_t status;
46 	unsigned long len;
47 	int ret;
48 
49 	if (!efi_rt_services_supported(EFI_RT_SUPPORTED_GET_VARIABLE))
50 		return -EOPNOTSUPP;
51 
52 	len = sizeof(efi_bdaddr);
53 	status = efi.get_variable(L"BDADDR", &guid, NULL, &len, &efi_bdaddr);
54 	if (status != EFI_SUCCESS)
55 		return -ENXIO;
56 
57 	if (len != sizeof(efi_bdaddr))
58 		return -EIO;
59 
60 	baswap(&bdaddr, &efi_bdaddr);
61 
62 	ret = btbcm_set_bdaddr(hdev, &bdaddr);
63 	if (ret)
64 		return ret;
65 
66 	bt_dev_info(hdev, "BCM: Using EFI device address (%pMR)", &bdaddr);
67 	return 0;
68 }
69 #else
70 static int btbcm_set_bdaddr_from_efi(struct hci_dev *hdev)
71 {
72 	return -EOPNOTSUPP;
73 }
74 #endif
75 
76 int btbcm_check_bdaddr(struct hci_dev *hdev)
77 {
78 	struct hci_rp_read_bd_addr *bda;
79 	struct sk_buff *skb;
80 
81 	skb = __hci_cmd_sync(hdev, HCI_OP_READ_BD_ADDR, 0, NULL,
82 			     HCI_INIT_TIMEOUT);
83 	if (IS_ERR(skb)) {
84 		int err = PTR_ERR(skb);
85 
86 		bt_dev_err(hdev, "BCM: Reading device address failed (%d)", err);
87 		return err;
88 	}
89 
90 	if (skb->len != sizeof(*bda)) {
91 		bt_dev_err(hdev, "BCM: Device address length mismatch");
92 		kfree_skb(skb);
93 		return -EIO;
94 	}
95 
96 	bda = (struct hci_rp_read_bd_addr *)skb->data;
97 
98 	/* Check if the address indicates a controller with either an
99 	 * invalid or default address. In both cases the device needs
100 	 * to be marked as not having a valid address.
101 	 *
102 	 * The address 00:20:70:02:A0:00 indicates a BCM20702A0 controller
103 	 * with no configured address.
104 	 *
105 	 * The address 20:70:02:A0:00:00 indicates a BCM20702A1 controller
106 	 * with no configured address.
107 	 *
108 	 * The address 20:76:A0:00:56:79 indicates a BCM2076B1 controller
109 	 * with no configured address.
110 	 *
111 	 * The address 43:24:B3:00:00:00 indicates a BCM4324B3 controller
112 	 * with waiting for configuration state.
113 	 *
114 	 * The address 43:30:B1:00:00:00 indicates a BCM4330B1 controller
115 	 * with waiting for configuration state.
116 	 *
117 	 * The address 43:43:A0:12:1F:AC indicates a BCM43430A0 controller
118 	 * with no configured address.
119 	 *
120 	 * The address AA:AA:AA:AA:AA:AA indicates a BCM43430A1 controller
121 	 * with no configured address.
122 	 */
123 	if (!bacmp(&bda->bdaddr, BDADDR_BCM20702A0) ||
124 	    !bacmp(&bda->bdaddr, BDADDR_BCM20702A1) ||
125 	    !bacmp(&bda->bdaddr, BDADDR_BCM2076B1) ||
126 	    !bacmp(&bda->bdaddr, BDADDR_BCM4324B3) ||
127 	    !bacmp(&bda->bdaddr, BDADDR_BCM4330B1) ||
128 	    !bacmp(&bda->bdaddr, BDADDR_BCM4334B0) ||
129 	    !bacmp(&bda->bdaddr, BDADDR_BCM4345C5) ||
130 	    !bacmp(&bda->bdaddr, BDADDR_BCM43430A0) ||
131 	    !bacmp(&bda->bdaddr, BDADDR_BCM43430A1) ||
132 	    !bacmp(&bda->bdaddr, BDADDR_BCM43341B)) {
133 		/* Try falling back to BDADDR EFI variable */
134 		if (btbcm_set_bdaddr_from_efi(hdev) != 0) {
135 			bt_dev_info(hdev, "BCM: Using default device address (%pMR)",
136 				    &bda->bdaddr);
137 			set_bit(HCI_QUIRK_INVALID_BDADDR, &hdev->quirks);
138 		}
139 	}
140 
141 	kfree_skb(skb);
142 
143 	return 0;
144 }
145 EXPORT_SYMBOL_GPL(btbcm_check_bdaddr);
146 
147 int btbcm_set_bdaddr(struct hci_dev *hdev, const bdaddr_t *bdaddr)
148 {
149 	struct sk_buff *skb;
150 	int err;
151 
152 	skb = __hci_cmd_sync(hdev, 0xfc01, 6, bdaddr, HCI_INIT_TIMEOUT);
153 	if (IS_ERR(skb)) {
154 		err = PTR_ERR(skb);
155 		bt_dev_err(hdev, "BCM: Change address command failed (%d)", err);
156 		return err;
157 	}
158 	kfree_skb(skb);
159 
160 	return 0;
161 }
162 EXPORT_SYMBOL_GPL(btbcm_set_bdaddr);
163 
164 int btbcm_read_pcm_int_params(struct hci_dev *hdev,
165 			      struct bcm_set_pcm_int_params *params)
166 {
167 	struct sk_buff *skb;
168 	int err = 0;
169 
170 	skb = __hci_cmd_sync(hdev, 0xfc1d, 0, NULL, HCI_INIT_TIMEOUT);
171 	if (IS_ERR(skb)) {
172 		err = PTR_ERR(skb);
173 		bt_dev_err(hdev, "BCM: Read PCM int params failed (%d)", err);
174 		return err;
175 	}
176 
177 	if (skb->len != 6 || skb->data[0]) {
178 		bt_dev_err(hdev, "BCM: Read PCM int params length mismatch");
179 		kfree_skb(skb);
180 		return -EIO;
181 	}
182 
183 	if (params)
184 		memcpy(params, skb->data + 1, 5);
185 
186 	kfree_skb(skb);
187 
188 	return 0;
189 }
190 EXPORT_SYMBOL_GPL(btbcm_read_pcm_int_params);
191 
192 int btbcm_write_pcm_int_params(struct hci_dev *hdev,
193 			       const struct bcm_set_pcm_int_params *params)
194 {
195 	struct sk_buff *skb;
196 	int err;
197 
198 	skb = __hci_cmd_sync(hdev, 0xfc1c, 5, params, HCI_INIT_TIMEOUT);
199 	if (IS_ERR(skb)) {
200 		err = PTR_ERR(skb);
201 		bt_dev_err(hdev, "BCM: Write PCM int params failed (%d)", err);
202 		return err;
203 	}
204 	kfree_skb(skb);
205 
206 	return 0;
207 }
208 EXPORT_SYMBOL_GPL(btbcm_write_pcm_int_params);
209 
210 int btbcm_patchram(struct hci_dev *hdev, const struct firmware *fw)
211 {
212 	const struct hci_command_hdr *cmd;
213 	const u8 *fw_ptr;
214 	size_t fw_size;
215 	struct sk_buff *skb;
216 	u16 opcode;
217 	int err = 0;
218 
219 	/* Start Download */
220 	skb = __hci_cmd_sync(hdev, 0xfc2e, 0, NULL, HCI_INIT_TIMEOUT);
221 	if (IS_ERR(skb)) {
222 		err = PTR_ERR(skb);
223 		bt_dev_err(hdev, "BCM: Download Minidrv command failed (%d)",
224 			   err);
225 		goto done;
226 	}
227 	kfree_skb(skb);
228 
229 	/* 50 msec delay after Download Minidrv completes */
230 	msleep(50);
231 
232 	fw_ptr = fw->data;
233 	fw_size = fw->size;
234 
235 	while (fw_size >= sizeof(*cmd)) {
236 		const u8 *cmd_param;
237 
238 		cmd = (struct hci_command_hdr *)fw_ptr;
239 		fw_ptr += sizeof(*cmd);
240 		fw_size -= sizeof(*cmd);
241 
242 		if (fw_size < cmd->plen) {
243 			bt_dev_err(hdev, "BCM: Patch is corrupted");
244 			err = -EINVAL;
245 			goto done;
246 		}
247 
248 		cmd_param = fw_ptr;
249 		fw_ptr += cmd->plen;
250 		fw_size -= cmd->plen;
251 
252 		opcode = le16_to_cpu(cmd->opcode);
253 
254 		skb = __hci_cmd_sync(hdev, opcode, cmd->plen, cmd_param,
255 				     HCI_INIT_TIMEOUT);
256 		if (IS_ERR(skb)) {
257 			err = PTR_ERR(skb);
258 			bt_dev_err(hdev, "BCM: Patch command %04x failed (%d)",
259 				   opcode, err);
260 			goto done;
261 		}
262 		kfree_skb(skb);
263 	}
264 
265 	/* 250 msec delay after Launch Ram completes */
266 	msleep(250);
267 
268 done:
269 	return err;
270 }
271 EXPORT_SYMBOL(btbcm_patchram);
272 
273 static int btbcm_reset(struct hci_dev *hdev)
274 {
275 	struct sk_buff *skb;
276 
277 	skb = __hci_cmd_sync(hdev, HCI_OP_RESET, 0, NULL, HCI_INIT_TIMEOUT);
278 	if (IS_ERR(skb)) {
279 		int err = PTR_ERR(skb);
280 
281 		bt_dev_err(hdev, "BCM: Reset failed (%d)", err);
282 		return err;
283 	}
284 	kfree_skb(skb);
285 
286 	/* 100 msec delay for module to complete reset process */
287 	msleep(100);
288 
289 	return 0;
290 }
291 
292 static struct sk_buff *btbcm_read_local_name(struct hci_dev *hdev)
293 {
294 	struct sk_buff *skb;
295 
296 	skb = __hci_cmd_sync(hdev, HCI_OP_READ_LOCAL_NAME, 0, NULL,
297 			     HCI_INIT_TIMEOUT);
298 	if (IS_ERR(skb)) {
299 		bt_dev_err(hdev, "BCM: Reading local name failed (%ld)",
300 			   PTR_ERR(skb));
301 		return skb;
302 	}
303 
304 	if (skb->len != sizeof(struct hci_rp_read_local_name)) {
305 		bt_dev_err(hdev, "BCM: Local name length mismatch");
306 		kfree_skb(skb);
307 		return ERR_PTR(-EIO);
308 	}
309 
310 	return skb;
311 }
312 
313 static struct sk_buff *btbcm_read_local_version(struct hci_dev *hdev)
314 {
315 	struct sk_buff *skb;
316 
317 	skb = __hci_cmd_sync(hdev, HCI_OP_READ_LOCAL_VERSION, 0, NULL,
318 			     HCI_INIT_TIMEOUT);
319 	if (IS_ERR(skb)) {
320 		bt_dev_err(hdev, "BCM: Reading local version info failed (%ld)",
321 			   PTR_ERR(skb));
322 		return skb;
323 	}
324 
325 	if (skb->len != sizeof(struct hci_rp_read_local_version)) {
326 		bt_dev_err(hdev, "BCM: Local version length mismatch");
327 		kfree_skb(skb);
328 		return ERR_PTR(-EIO);
329 	}
330 
331 	return skb;
332 }
333 
334 static struct sk_buff *btbcm_read_verbose_config(struct hci_dev *hdev)
335 {
336 	struct sk_buff *skb;
337 
338 	skb = __hci_cmd_sync(hdev, 0xfc79, 0, NULL, HCI_INIT_TIMEOUT);
339 	if (IS_ERR(skb)) {
340 		bt_dev_err(hdev, "BCM: Read verbose config info failed (%ld)",
341 			   PTR_ERR(skb));
342 		return skb;
343 	}
344 
345 	if (skb->len != 7) {
346 		bt_dev_err(hdev, "BCM: Verbose config length mismatch");
347 		kfree_skb(skb);
348 		return ERR_PTR(-EIO);
349 	}
350 
351 	return skb;
352 }
353 
354 static struct sk_buff *btbcm_read_controller_features(struct hci_dev *hdev)
355 {
356 	struct sk_buff *skb;
357 
358 	skb = __hci_cmd_sync(hdev, 0xfc6e, 0, NULL, HCI_INIT_TIMEOUT);
359 	if (IS_ERR(skb)) {
360 		bt_dev_err(hdev, "BCM: Read controller features failed (%ld)",
361 			   PTR_ERR(skb));
362 		return skb;
363 	}
364 
365 	if (skb->len != 9) {
366 		bt_dev_err(hdev, "BCM: Controller features length mismatch");
367 		kfree_skb(skb);
368 		return ERR_PTR(-EIO);
369 	}
370 
371 	return skb;
372 }
373 
374 static struct sk_buff *btbcm_read_usb_product(struct hci_dev *hdev)
375 {
376 	struct sk_buff *skb;
377 
378 	skb = __hci_cmd_sync(hdev, 0xfc5a, 0, NULL, HCI_INIT_TIMEOUT);
379 	if (IS_ERR(skb)) {
380 		bt_dev_err(hdev, "BCM: Read USB product info failed (%ld)",
381 			   PTR_ERR(skb));
382 		return skb;
383 	}
384 
385 	if (skb->len != 5) {
386 		bt_dev_err(hdev, "BCM: USB product length mismatch");
387 		kfree_skb(skb);
388 		return ERR_PTR(-EIO);
389 	}
390 
391 	return skb;
392 }
393 
394 static const struct dmi_system_id disable_broken_read_transmit_power[] = {
395 	{
396 		 .matches = {
397 			DMI_MATCH(DMI_BOARD_VENDOR, "Apple Inc."),
398 			DMI_MATCH(DMI_PRODUCT_NAME, "MacBookPro16,1"),
399 		},
400 	},
401 	{
402 		 .matches = {
403 			DMI_MATCH(DMI_BOARD_VENDOR, "Apple Inc."),
404 			DMI_MATCH(DMI_PRODUCT_NAME, "MacBookPro16,2"),
405 		},
406 	},
407 	{
408 		 .matches = {
409 			DMI_MATCH(DMI_BOARD_VENDOR, "Apple Inc."),
410 			DMI_MATCH(DMI_PRODUCT_NAME, "MacBookPro16,4"),
411 		},
412 	},
413 	{
414 		 .matches = {
415 			DMI_MATCH(DMI_BOARD_VENDOR, "Apple Inc."),
416 			DMI_MATCH(DMI_PRODUCT_NAME, "MacBookAir8,1"),
417 		},
418 	},
419 	{
420 		 .matches = {
421 			DMI_MATCH(DMI_BOARD_VENDOR, "Apple Inc."),
422 			DMI_MATCH(DMI_PRODUCT_NAME, "MacBookAir8,2"),
423 		},
424 	},
425 	{
426 		 .matches = {
427 			DMI_MATCH(DMI_BOARD_VENDOR, "Apple Inc."),
428 			DMI_MATCH(DMI_PRODUCT_NAME, "iMac20,1"),
429 		},
430 	},
431 	{
432 		 .matches = {
433 			DMI_MATCH(DMI_BOARD_VENDOR, "Apple Inc."),
434 			DMI_MATCH(DMI_PRODUCT_NAME, "iMac20,2"),
435 		},
436 	},
437 	{ }
438 };
439 
440 static int btbcm_read_info(struct hci_dev *hdev)
441 {
442 	struct sk_buff *skb;
443 
444 	/* Read Verbose Config Version Info */
445 	skb = btbcm_read_verbose_config(hdev);
446 	if (IS_ERR(skb))
447 		return PTR_ERR(skb);
448 
449 	bt_dev_info(hdev, "BCM: chip id %u", skb->data[1]);
450 	kfree_skb(skb);
451 
452 	return 0;
453 }
454 
455 static int btbcm_print_controller_features(struct hci_dev *hdev)
456 {
457 	struct sk_buff *skb;
458 
459 	/* Read Controller Features */
460 	skb = btbcm_read_controller_features(hdev);
461 	if (IS_ERR(skb))
462 		return PTR_ERR(skb);
463 
464 	bt_dev_info(hdev, "BCM: features 0x%2.2x", skb->data[1]);
465 	kfree_skb(skb);
466 
467 	/* Read DMI and disable broken Read LE Min/Max Tx Power */
468 	if (dmi_first_match(disable_broken_read_transmit_power))
469 		set_bit(HCI_QUIRK_BROKEN_READ_TRANSMIT_POWER, &hdev->quirks);
470 
471 	return 0;
472 }
473 
474 static int btbcm_print_local_name(struct hci_dev *hdev)
475 {
476 	struct sk_buff *skb;
477 
478 	/* Read Local Name */
479 	skb = btbcm_read_local_name(hdev);
480 	if (IS_ERR(skb))
481 		return PTR_ERR(skb);
482 
483 	bt_dev_info(hdev, "%s", (char *)(skb->data + 1));
484 	kfree_skb(skb);
485 
486 	return 0;
487 }
488 
489 struct bcm_subver_table {
490 	u16 subver;
491 	const char *name;
492 };
493 
494 static const struct bcm_subver_table bcm_uart_subver_table[] = {
495 	{ 0x1111, "BCM4362A2"	},	/* 000.017.017 */
496 	{ 0x4103, "BCM4330B1"	},	/* 002.001.003 */
497 	{ 0x410d, "BCM4334B0"	},	/* 002.001.013 */
498 	{ 0x410e, "BCM43341B0"	},	/* 002.001.014 */
499 	{ 0x4204, "BCM2076B1"	},	/* 002.002.004 */
500 	{ 0x4406, "BCM4324B3"	},	/* 002.004.006 */
501 	{ 0x4606, "BCM4324B5"	},	/* 002.006.006 */
502 	{ 0x6109, "BCM4335C0"	},	/* 003.001.009 */
503 	{ 0x610c, "BCM4354"	},	/* 003.001.012 */
504 	{ 0x2122, "BCM4343A0"	},	/* 001.001.034 */
505 	{ 0x2209, "BCM43430A1"  },	/* 001.002.009 */
506 	{ 0x6119, "BCM4345C0"	},	/* 003.001.025 */
507 	{ 0x6606, "BCM4345C5"	},	/* 003.006.006 */
508 	{ 0x230f, "BCM4356A2"	},	/* 001.003.015 */
509 	{ 0x220e, "BCM20702A1"  },	/* 001.002.014 */
510 	{ 0x420d, "BCM4349B1"	},	/* 002.002.013 */
511 	{ 0x420e, "BCM4349B1"	},	/* 002.002.014 */
512 	{ 0x4217, "BCM4329B1"   },	/* 002.002.023 */
513 	{ 0x6106, "BCM4359C0"	},	/* 003.001.006 */
514 	{ 0x4106, "BCM4335A0"	},	/* 002.001.006 */
515 	{ 0x410c, "BCM43430B0"	},	/* 002.001.012 */
516 	{ 0x2119, "BCM4373A0"	},	/* 001.001.025 */
517 	{ }
518 };
519 
520 static const struct bcm_subver_table bcm_usb_subver_table[] = {
521 	{ 0x2105, "BCM20703A1"	},	/* 001.001.005 */
522 	{ 0x210b, "BCM43142A0"	},	/* 001.001.011 */
523 	{ 0x2112, "BCM4314A0"	},	/* 001.001.018 */
524 	{ 0x2118, "BCM20702A0"	},	/* 001.001.024 */
525 	{ 0x2126, "BCM4335A0"	},	/* 001.001.038 */
526 	{ 0x220e, "BCM20702A1"	},	/* 001.002.014 */
527 	{ 0x230f, "BCM4356A2"	},	/* 001.003.015 */
528 	{ 0x4106, "BCM4335B0"	},	/* 002.001.006 */
529 	{ 0x410e, "BCM20702B0"	},	/* 002.001.014 */
530 	{ 0x6109, "BCM4335C0"	},	/* 003.001.009 */
531 	{ 0x610c, "BCM4354"	},	/* 003.001.012 */
532 	{ 0x6607, "BCM4350C5"	},	/* 003.006.007 */
533 	{ }
534 };
535 
536 /*
537  * This currently only looks up the device tree board appendix,
538  * but can be expanded to other mechanisms.
539  */
540 static const char *btbcm_get_board_name(struct device *dev)
541 {
542 #ifdef CONFIG_OF
543 	struct device_node *root;
544 	char *board_type;
545 	const char *tmp;
546 	int len;
547 	int i;
548 
549 	root = of_find_node_by_path("/");
550 	if (!root)
551 		return NULL;
552 
553 	if (of_property_read_string_index(root, "compatible", 0, &tmp))
554 		return NULL;
555 
556 	/* get rid of any '/' in the compatible string */
557 	len = strlen(tmp) + 1;
558 	board_type = devm_kzalloc(dev, len, GFP_KERNEL);
559 	strscpy(board_type, tmp, len);
560 	for (i = 0; i < len; i++) {
561 		if (board_type[i] == '/')
562 			board_type[i] = '-';
563 	}
564 	of_node_put(root);
565 
566 	return board_type;
567 #else
568 	return NULL;
569 #endif
570 }
571 
572 int btbcm_initialize(struct hci_dev *hdev, bool *fw_load_done, bool use_autobaud_mode)
573 {
574 	u16 subver, rev, pid, vid;
575 	struct sk_buff *skb;
576 	struct hci_rp_read_local_version *ver;
577 	const struct bcm_subver_table *bcm_subver_table;
578 	const char *hw_name = NULL;
579 	const char *board_name;
580 	char postfix[16] = "";
581 	int fw_name_count = 0;
582 	bcm_fw_name *fw_name;
583 	const struct firmware *fw;
584 	int i, err;
585 
586 	board_name = btbcm_get_board_name(&hdev->dev);
587 
588 	/* Reset */
589 	err = btbcm_reset(hdev);
590 	if (err)
591 		return err;
592 
593 	/* Read Local Version Info */
594 	skb = btbcm_read_local_version(hdev);
595 	if (IS_ERR(skb))
596 		return PTR_ERR(skb);
597 
598 	ver = (struct hci_rp_read_local_version *)skb->data;
599 	rev = le16_to_cpu(ver->hci_rev);
600 	subver = le16_to_cpu(ver->lmp_subver);
601 	kfree_skb(skb);
602 
603 	/* Read controller information */
604 	if (!(*fw_load_done)) {
605 		err = btbcm_read_info(hdev);
606 		if (err)
607 			return err;
608 	}
609 
610 	if (!use_autobaud_mode) {
611 		err = btbcm_print_controller_features(hdev);
612 		if (err)
613 			return err;
614 
615 		err = btbcm_print_local_name(hdev);
616 		if (err)
617 			return err;
618 	}
619 
620 	bcm_subver_table = (hdev->bus == HCI_USB) ? bcm_usb_subver_table :
621 						    bcm_uart_subver_table;
622 
623 	for (i = 0; bcm_subver_table[i].name; i++) {
624 		if (subver == bcm_subver_table[i].subver) {
625 			hw_name = bcm_subver_table[i].name;
626 			break;
627 		}
628 	}
629 
630 	bt_dev_info(hdev, "%s (%3.3u.%3.3u.%3.3u) build %4.4u",
631 		    hw_name ? hw_name : "BCM", (subver & 0xe000) >> 13,
632 		    (subver & 0x1f00) >> 8, (subver & 0x00ff), rev & 0x0fff);
633 
634 	if (*fw_load_done)
635 		return 0;
636 
637 	if (hdev->bus == HCI_USB) {
638 		/* Read USB Product Info */
639 		skb = btbcm_read_usb_product(hdev);
640 		if (IS_ERR(skb))
641 			return PTR_ERR(skb);
642 
643 		vid = get_unaligned_le16(skb->data + 1);
644 		pid = get_unaligned_le16(skb->data + 3);
645 		kfree_skb(skb);
646 
647 		snprintf(postfix, sizeof(postfix), "-%4.4x-%4.4x", vid, pid);
648 	}
649 
650 	fw_name = kmalloc(BCM_FW_NAME_COUNT_MAX * BCM_FW_NAME_LEN, GFP_KERNEL);
651 	if (!fw_name)
652 		return -ENOMEM;
653 
654 	if (hw_name) {
655 		if (board_name) {
656 			snprintf(fw_name[fw_name_count], BCM_FW_NAME_LEN,
657 				 "brcm/%s%s.%s.hcd", hw_name, postfix, board_name);
658 			fw_name_count++;
659 		}
660 		snprintf(fw_name[fw_name_count], BCM_FW_NAME_LEN,
661 			 "brcm/%s%s.hcd", hw_name, postfix);
662 		fw_name_count++;
663 	}
664 
665 	if (board_name) {
666 		snprintf(fw_name[fw_name_count], BCM_FW_NAME_LEN,
667 			 "brcm/BCM%s.%s.hcd", postfix, board_name);
668 		fw_name_count++;
669 	}
670 	snprintf(fw_name[fw_name_count], BCM_FW_NAME_LEN,
671 		 "brcm/BCM%s.hcd", postfix);
672 	fw_name_count++;
673 
674 	for (i = 0; i < fw_name_count; i++) {
675 		err = firmware_request_nowarn(&fw, fw_name[i], &hdev->dev);
676 		if (err == 0) {
677 			bt_dev_info(hdev, "%s '%s' Patch",
678 				    hw_name ? hw_name : "BCM", fw_name[i]);
679 			*fw_load_done = true;
680 			break;
681 		}
682 	}
683 
684 	if (*fw_load_done) {
685 		err = btbcm_patchram(hdev, fw);
686 		if (err)
687 			bt_dev_info(hdev, "BCM: Patch failed (%d)", err);
688 
689 		release_firmware(fw);
690 	} else {
691 		bt_dev_err(hdev, "BCM: firmware Patch file not found, tried:");
692 		for (i = 0; i < fw_name_count; i++)
693 			bt_dev_err(hdev, "BCM: '%s'", fw_name[i]);
694 	}
695 
696 	kfree(fw_name);
697 	return 0;
698 }
699 EXPORT_SYMBOL_GPL(btbcm_initialize);
700 
701 int btbcm_finalize(struct hci_dev *hdev, bool *fw_load_done, bool use_autobaud_mode)
702 {
703 	int err;
704 
705 	/* Re-initialize if necessary */
706 	if (*fw_load_done) {
707 		err = btbcm_initialize(hdev, fw_load_done, use_autobaud_mode);
708 		if (err)
709 			return err;
710 	}
711 
712 	btbcm_check_bdaddr(hdev);
713 
714 	set_bit(HCI_QUIRK_STRICT_DUPLICATE_FILTER, &hdev->quirks);
715 
716 	return 0;
717 }
718 EXPORT_SYMBOL_GPL(btbcm_finalize);
719 
720 int btbcm_setup_patchram(struct hci_dev *hdev)
721 {
722 	bool fw_load_done = false;
723 	bool use_autobaud_mode = false;
724 	int err;
725 
726 	/* Initialize */
727 	err = btbcm_initialize(hdev, &fw_load_done, use_autobaud_mode);
728 	if (err)
729 		return err;
730 
731 	/* Re-initialize after loading Patch */
732 	return btbcm_finalize(hdev, &fw_load_done, use_autobaud_mode);
733 }
734 EXPORT_SYMBOL_GPL(btbcm_setup_patchram);
735 
736 int btbcm_setup_apple(struct hci_dev *hdev)
737 {
738 	struct sk_buff *skb;
739 	int err;
740 
741 	/* Reset */
742 	err = btbcm_reset(hdev);
743 	if (err)
744 		return err;
745 
746 	/* Read Verbose Config Version Info */
747 	skb = btbcm_read_verbose_config(hdev);
748 	if (!IS_ERR(skb)) {
749 		bt_dev_info(hdev, "BCM: chip id %u build %4.4u",
750 			    skb->data[1], get_unaligned_le16(skb->data + 5));
751 		kfree_skb(skb);
752 	}
753 
754 	/* Read USB Product Info */
755 	skb = btbcm_read_usb_product(hdev);
756 	if (!IS_ERR(skb)) {
757 		bt_dev_info(hdev, "BCM: product %4.4x:%4.4x",
758 			    get_unaligned_le16(skb->data + 1),
759 			    get_unaligned_le16(skb->data + 3));
760 		kfree_skb(skb);
761 	}
762 
763 	/* Read Controller Features */
764 	skb = btbcm_read_controller_features(hdev);
765 	if (!IS_ERR(skb)) {
766 		bt_dev_info(hdev, "BCM: features 0x%2.2x", skb->data[1]);
767 		kfree_skb(skb);
768 	}
769 
770 	/* Read Local Name */
771 	skb = btbcm_read_local_name(hdev);
772 	if (!IS_ERR(skb)) {
773 		bt_dev_info(hdev, "%s", (char *)(skb->data + 1));
774 		kfree_skb(skb);
775 	}
776 
777 	set_bit(HCI_QUIRK_STRICT_DUPLICATE_FILTER, &hdev->quirks);
778 
779 	return 0;
780 }
781 EXPORT_SYMBOL_GPL(btbcm_setup_apple);
782 
783 MODULE_AUTHOR("Marcel Holtmann <marcel@holtmann.org>");
784 MODULE_DESCRIPTION("Bluetooth support for Broadcom devices ver " VERSION);
785 MODULE_VERSION(VERSION);
786 MODULE_LICENSE("GPL");
787