drivers/bluetooth/btbcm.c

   1 // SPDX-License-Identifier: GPL-2.0-or-later
   2 /*
   3  *
   4  *  Bluetooth support for Broadcom devices
   5  *
   6  *  Copyright (C) 2015  Intel Corporation
   7  */
   8
   9 #include <linux/module.h>
  10 #include <linux/firmware.h>
  11 #include <asm/unaligned.h>
  12
  13 #include <net/bluetooth/bluetooth.h>
  14 #include <net/bluetooth/hci_core.h>
  15
  16 #include "btbcm.h"
  17
  18 #define VERSION "0.1"
  19
  20 #define BDADDR_BCM20702A0 (&(bdaddr_t) {{0x00, 0xa0, 0x02, 0x70, 0x20, 0x00}})
  21 #define BDADDR_BCM20702A1 (&(bdaddr_t) {{0x00, 0x00, 0xa0, 0x02, 0x70, 0x20}})
  22 #define BDADDR_BCM2076B1 (&(bdaddr_t) {{0x79, 0x56, 0x00, 0xa0, 0x76, 0x20}})
  23 #define BDADDR_BCM43430A0 (&(bdaddr_t) {{0xac, 0x1f, 0x12, 0xa0, 0x43, 0x43}})
  24 #define BDADDR_BCM4324B3 (&(bdaddr_t) {{0x00, 0x00, 0x00, 0xb3, 0x24, 0x43}})
  25 #define BDADDR_BCM4330B1 (&(bdaddr_t) {{0x00, 0x00, 0x00, 0xb1, 0x30, 0x43}})
  26 #define BDADDR_BCM4334B0 (&(bdaddr_t) {{0x00, 0x00, 0x00, 0xb0, 0x34, 0x43}})
  27 #define BDADDR_BCM4345C5 (&(bdaddr_t) {{0xac, 0x1f, 0x00, 0xc5, 0x45, 0x43}})
  28 #define BDADDR_BCM43341B (&(bdaddr_t) {{0xac, 0x1f, 0x00, 0x1b, 0x34, 0x43}})
  29
  30 int btbcm_check_bdaddr(struct hci_dev *hdev)
  31 {
  32         struct hci_rp_read_bd_addr *bda;
  33         struct sk_buff *skb;
  34
  35         skb = __hci_cmd_sync(hdev, HCI_OP_READ_BD_ADDR, 0, NULL,
  36                              HCI_INIT_TIMEOUT);
  37         if (IS_ERR(skb)) {
  38                 int err = PTR_ERR(skb);
  39                 bt_dev_err(hdev, "BCM: Reading device address failed (%d)", err);
  40                 return err;
  41         }
  42
  43         if (skb->len != sizeof(*bda)) {
  44                 bt_dev_err(hdev, "BCM: Device address length mismatch");
  45                 kfree_skb(skb);
  46                 return -EIO;
  47         }
  48
  49         bda = (struct hci_rp_read_bd_addr *)skb->data;
  50
  51         /* Check if the address indicates a controller with either an
  52          * invalid or default address. In both cases the device needs
  53          * to be marked as not having a valid address.
  54          *
  55          * The address 00:20:70:02:A0:00 indicates a BCM20702A0 controller
  56          * with no configured address.
  57          *
  58          * The address 20:70:02:A0:00:00 indicates a BCM20702A1 controller
  59          * with no configured address.
  60          *
  61          * The address 20:76:A0:00:56:79 indicates a BCM2076B1 controller
  62          * with no configured address.
  63          *
  64          * The address 43:24:B3:00:00:00 indicates a BCM4324B3 controller
  65          * with waiting for configuration state.
  66          *
  67          * The address 43:30:B1:00:00:00 indicates a BCM4330B1 controller
  68          * with waiting for configuration state.
  69          *
  70          * The address 43:43:A0:12:1F:AC indicates a BCM43430A0 controller
  71          * with no configured address.
  72          */
  73         if (!bacmp(&bda->bdaddr, BDADDR_BCM20702A0) ||
  74             !bacmp(&bda->bdaddr, BDADDR_BCM20702A1) ||
  75             !bacmp(&bda->bdaddr, BDADDR_BCM2076B1) ||
  76             !bacmp(&bda->bdaddr, BDADDR_BCM4324B3) ||
  77             !bacmp(&bda->bdaddr, BDADDR_BCM4330B1) ||
  78             !bacmp(&bda->bdaddr, BDADDR_BCM4334B0) ||
  79             !bacmp(&bda->bdaddr, BDADDR_BCM4345C5) ||
  80             !bacmp(&bda->bdaddr, BDADDR_BCM43430A0) ||
  81             !bacmp(&bda->bdaddr, BDADDR_BCM43341B)) {
  82                 bt_dev_info(hdev, "BCM: Using default device address (%pMR)",
  83                             &bda->bdaddr);
  84                 set_bit(HCI_QUIRK_INVALID_BDADDR, &hdev->quirks);
  85         }
  86
  87         kfree_skb(skb);
  88
  89         return 0;
  90 }
  91 EXPORT_SYMBOL_GPL(btbcm_check_bdaddr);
  92
  93 int btbcm_set_bdaddr(struct hci_dev *hdev, const bdaddr_t *bdaddr)
  94 {
  95         struct sk_buff *skb;
  96         int err;
  97
  98         skb = __hci_cmd_sync(hdev, 0xfc01, 6, bdaddr, HCI_INIT_TIMEOUT);
  99         if (IS_ERR(skb)) {
 100                 err = PTR_ERR(skb);
 101                 bt_dev_err(hdev, "BCM: Change address command failed (%d)", err);
 102                 return err;
 103         }
 104         kfree_skb(skb);
 105
 106         return 0;
 107 }
 108 EXPORT_SYMBOL_GPL(btbcm_set_bdaddr);
 109
 110 int btbcm_patchram(struct hci_dev *hdev, const struct firmware *fw)
 111 {
 112         const struct hci_command_hdr *cmd;
 113         const u8 *fw_ptr;
 114         size_t fw_size;
 115         struct sk_buff *skb;
 116         u16 opcode;
 117         int err = 0;
 118
 119         /* Start Download */
 120         skb = __hci_cmd_sync(hdev, 0xfc2e, 0, NULL, HCI_INIT_TIMEOUT);
 121         if (IS_ERR(skb)) {
 122                 err = PTR_ERR(skb);
 123                 bt_dev_err(hdev, "BCM: Download Minidrv command failed (%d)",
 124                            err);
 125                 goto done;
 126         }
 127         kfree_skb(skb);
 128
 129         /* 50 msec delay after Download Minidrv completes */
 130         msleep(50);
 131
 132         fw_ptr = fw->data;
 133         fw_size = fw->size;
 134
 135         while (fw_size >= sizeof(*cmd)) {
 136                 const u8 *cmd_param;
 137
 138                 cmd = (struct hci_command_hdr *)fw_ptr;
 139                 fw_ptr += sizeof(*cmd);
 140                 fw_size -= sizeof(*cmd);
 141
 142                 if (fw_size < cmd->plen) {
 143                         bt_dev_err(hdev, "BCM: Patch is corrupted");
 144                         err = -EINVAL;
 145                         goto done;
 146                 }
 147
 148                 cmd_param = fw_ptr;
 149                 fw_ptr += cmd->plen;
 150                 fw_size -= cmd->plen;
 151
 152                 opcode = le16_to_cpu(cmd->opcode);
 153
 154                 skb = __hci_cmd_sync(hdev, opcode, cmd->plen, cmd_param,
 155                                      HCI_INIT_TIMEOUT);
 156                 if (IS_ERR(skb)) {
 157                         err = PTR_ERR(skb);
 158                         bt_dev_err(hdev, "BCM: Patch command %04x failed (%d)",
 159                                    opcode, err);
 160                         goto done;
 161                 }
 162                 kfree_skb(skb);
 163         }
 164
 165         /* 250 msec delay after Launch Ram completes */
 166         msleep(250);
 167
 168 done:
 169         return err;
 170 }
 171 EXPORT_SYMBOL(btbcm_patchram);
 172
 173 static int btbcm_reset(struct hci_dev *hdev)
 174 {
 175         struct sk_buff *skb;
 176
 177         skb = __hci_cmd_sync(hdev, HCI_OP_RESET, 0, NULL, HCI_INIT_TIMEOUT);
 178         if (IS_ERR(skb)) {
 179                 int err = PTR_ERR(skb);
 180                 bt_dev_err(hdev, "BCM: Reset failed (%d)", err);
 181                 return err;
 182         }
 183         kfree_skb(skb);
 184
 185         /* 100 msec delay for module to complete reset process */
 186         msleep(100);
 187
 188         return 0;
 189 }
 190
 191 static struct sk_buff *btbcm_read_local_name(struct hci_dev *hdev)
 192 {
 193         struct sk_buff *skb;
 194
 195         skb = __hci_cmd_sync(hdev, HCI_OP_READ_LOCAL_NAME, 0, NULL,
 196                              HCI_INIT_TIMEOUT);
 197         if (IS_ERR(skb)) {
 198                 bt_dev_err(hdev, "BCM: Reading local name failed (%ld)",
 199                            PTR_ERR(skb));
 200                 return skb;
 201         }
 202
 203         if (skb->len != sizeof(struct hci_rp_read_local_name)) {
 204                 bt_dev_err(hdev, "BCM: Local name length mismatch");
 205                 kfree_skb(skb);
 206                 return ERR_PTR(-EIO);
 207         }
 208
 209         return skb;
 210 }
 211
 212 static struct sk_buff *btbcm_read_local_version(struct hci_dev *hdev)
 213 {
 214         struct sk_buff *skb;
 215
 216         skb = __hci_cmd_sync(hdev, HCI_OP_READ_LOCAL_VERSION, 0, NULL,
 217                              HCI_INIT_TIMEOUT);
 218         if (IS_ERR(skb)) {
 219                 bt_dev_err(hdev, "BCM: Reading local version info failed (%ld)",
 220                            PTR_ERR(skb));
 221                 return skb;
 222         }
 223
 224         if (skb->len != sizeof(struct hci_rp_read_local_version)) {
 225                 bt_dev_err(hdev, "BCM: Local version length mismatch");
 226                 kfree_skb(skb);
 227                 return ERR_PTR(-EIO);
 228         }
 229
 230         return skb;
 231 }
 232
 233 static struct sk_buff *btbcm_read_verbose_config(struct hci_dev *hdev)
 234 {
 235         struct sk_buff *skb;
 236
 237         skb = __hci_cmd_sync(hdev, 0xfc79, 0, NULL, HCI_INIT_TIMEOUT);
 238         if (IS_ERR(skb)) {
 239                 bt_dev_err(hdev, "BCM: Read verbose config info failed (%ld)",
 240                            PTR_ERR(skb));
 241                 return skb;
 242         }
 243
 244         if (skb->len != 7) {
 245                 bt_dev_err(hdev, "BCM: Verbose config length mismatch");
 246                 kfree_skb(skb);
 247                 return ERR_PTR(-EIO);
 248         }
 249
 250         return skb;
 251 }
 252
 253 static struct sk_buff *btbcm_read_controller_features(struct hci_dev *hdev)
 254 {
 255         struct sk_buff *skb;
 256
 257         skb = __hci_cmd_sync(hdev, 0xfc6e, 0, NULL, HCI_INIT_TIMEOUT);
 258         if (IS_ERR(skb)) {
 259                 bt_dev_err(hdev, "BCM: Read controller features failed (%ld)",
 260                            PTR_ERR(skb));
 261                 return skb;
 262         }
 263
 264         if (skb->len != 9) {
 265                 bt_dev_err(hdev, "BCM: Controller features length mismatch");
 266                 kfree_skb(skb);
 267                 return ERR_PTR(-EIO);
 268         }
 269
 270         return skb;
 271 }
 272
 273 static struct sk_buff *btbcm_read_usb_product(struct hci_dev *hdev)
 274 {
 275         struct sk_buff *skb;
 276
 277         skb = __hci_cmd_sync(hdev, 0xfc5a, 0, NULL, HCI_INIT_TIMEOUT);
 278         if (IS_ERR(skb)) {
 279                 bt_dev_err(hdev, "BCM: Read USB product info failed (%ld)",
 280                            PTR_ERR(skb));
 281                 return skb;
 282         }
 283
 284         if (skb->len != 5) {
 285                 bt_dev_err(hdev, "BCM: USB product length mismatch");
 286                 kfree_skb(skb);
 287                 return ERR_PTR(-EIO);
 288         }
 289
 290         return skb;
 291 }
 292
 293 static int btbcm_read_info(struct hci_dev *hdev)
 294 {
 295         struct sk_buff *skb;
 296
 297         /* Read Verbose Config Version Info */
 298         skb = btbcm_read_verbose_config(hdev);
 299         if (IS_ERR(skb))
 300                 return PTR_ERR(skb);
 301
 302         bt_dev_info(hdev, "BCM: chip id %u", skb->data[1]);
 303         kfree_skb(skb);
 304
 305         /* Read Controller Features */
 306         skb = btbcm_read_controller_features(hdev);
 307         if (IS_ERR(skb))
 308                 return PTR_ERR(skb);
 309
 310         bt_dev_info(hdev, "BCM: features 0x%2.2x", skb->data[1]);
 311         kfree_skb(skb);
 312
 313         /* Read Local Name */
 314         skb = btbcm_read_local_name(hdev);
 315         if (IS_ERR(skb))
 316                 return PTR_ERR(skb);
 317
 318         bt_dev_info(hdev, "%s", (char *)(skb->data + 1));
 319         kfree_skb(skb);
 320
 321         return 0;
 322 }
 323
 324 struct bcm_subver_table {
 325         u16 subver;
 326         const char *name;
 327 };
 328
 329 static const struct bcm_subver_table bcm_uart_subver_table[] = {
 330         { 0x4103, "BCM4330B1"   },      /* 002.001.003 */
 331         { 0x410d, "BCM4334B0"   },      /* 002.001.013 */
 332         { 0x410e, "BCM43341B0"  },      /* 002.001.014 */
 333         { 0x4204, "BCM2076B1"   },      /* 002.002.004 */
 334         { 0x4406, "BCM4324B3"   },      /* 002.004.006 */
 335         { 0x6109, "BCM4335C0"   },      /* 003.001.009 */
 336         { 0x610c, "BCM4354"     },      /* 003.001.012 */
 337         { 0x2122, "BCM4343A0"   },      /* 001.001.034 */
 338         { 0x2209, "BCM43430A1"  },      /* 001.002.009 */
 339         { 0x6119, "BCM4345C0"   },      /* 003.001.025 */
 340         { 0x6606, "BCM4345C5"   },      /* 003.006.006 */
 341         { 0x230f, "BCM4356A2"   },      /* 001.003.015 */
 342         { 0x220e, "BCM20702A1"  },      /* 001.002.014 */
 343         { 0x4217, "BCM4329B1"   },      /* 002.002.023 */
 344         { 0x6106, "BCM4359C0"   },      /* 003.001.006 */
 345         { 0x4106, "BCM4335A0"   },      /* 002.001.006 */
 346         { }
 347 };
 348
 349 static const struct bcm_subver_table bcm_usb_subver_table[] = {
 350         { 0x210b, "BCM43142A0"  },      /* 001.001.011 */
 351         { 0x2112, "BCM4314A0"   },      /* 001.001.018 */
 352         { 0x2118, "BCM20702A0"  },      /* 001.001.024 */
 353         { 0x2126, "BCM4335A0"   },      /* 001.001.038 */
 354         { 0x220e, "BCM20702A1"  },      /* 001.002.014 */
 355         { 0x230f, "BCM4354A2"   },      /* 001.003.015 */
 356         { 0x4106, "BCM4335B0"   },      /* 002.001.006 */
 357         { 0x410e, "BCM20702B0"  },      /* 002.001.014 */
 358         { 0x6109, "BCM4335C0"   },      /* 003.001.009 */
 359         { 0x610c, "BCM4354"     },      /* 003.001.012 */
 360         { }
 361 };
 362
 363 int btbcm_initialize(struct hci_dev *hdev, char *fw_name, size_t len,
 364                      bool reinit)
 365 {
 366         u16 subver, rev, pid, vid;
 367         const char *hw_name = "BCM";
 368         struct sk_buff *skb;
 369         struct hci_rp_read_local_version *ver;
 370         const struct bcm_subver_table *bcm_subver_table;
 371         int i, err;
 372
 373         /* Reset */
 374         err = btbcm_reset(hdev);
 375         if (err)
 376                 return err;
 377
 378         /* Read Local Version Info */
 379         skb = btbcm_read_local_version(hdev);
 380         if (IS_ERR(skb))
 381                 return PTR_ERR(skb);
 382
 383         ver = (struct hci_rp_read_local_version *)skb->data;
 384         rev = le16_to_cpu(ver->hci_rev);
 385         subver = le16_to_cpu(ver->lmp_subver);
 386         kfree_skb(skb);
 387
 388         /* Read controller information */
 389         if (!reinit) {
 390                 err = btbcm_read_info(hdev);
 391                 if (err)
 392                         return err;
 393         }
 394
 395         /* Upper nibble of rev should be between 0 and 3? */
 396         if (((rev & 0xf000) >> 12) > 3)
 397                 return 0;
 398
 399         bcm_subver_table = (hdev->bus == HCI_USB) ? bcm_usb_subver_table :
 400                                                     bcm_uart_subver_table;
 401
 402         for (i = 0; bcm_subver_table[i].name; i++) {
 403                 if (subver == bcm_subver_table[i].subver) {
 404                         hw_name = bcm_subver_table[i].name;
 405                         break;
 406                 }
 407         }
 408
 409         if (hdev->bus == HCI_USB) {
 410                 /* Read USB Product Info */
 411                 skb = btbcm_read_usb_product(hdev);
 412                 if (IS_ERR(skb))
 413                         return PTR_ERR(skb);
 414
 415                 vid = get_unaligned_le16(skb->data + 1);
 416                 pid = get_unaligned_le16(skb->data + 3);
 417                 kfree_skb(skb);
 418
 419                 snprintf(fw_name, len, "brcm/%s-%4.4x-%4.4x.hcd",
 420                          hw_name, vid, pid);
 421         } else {
 422                 snprintf(fw_name, len, "brcm/%s.hcd", hw_name);
 423         }
 424
 425         bt_dev_info(hdev, "%s (%3.3u.%3.3u.%3.3u) build %4.4u",
 426                     hw_name, (subver & 0xe000) >> 13,
 427                     (subver & 0x1f00) >> 8, (subver & 0x00ff), rev & 0x0fff);
 428
 429         return 0;
 430 }
 431 EXPORT_SYMBOL_GPL(btbcm_initialize);
 432
 433 int btbcm_finalize(struct hci_dev *hdev)
 434 {
 435         char fw_name[64];
 436         int err;
 437
 438         /* Re-initialize */
 439         err = btbcm_initialize(hdev, fw_name, sizeof(fw_name), true);
 440         if (err)
 441                 return err;
 442
 443         btbcm_check_bdaddr(hdev);
 444
 445         set_bit(HCI_QUIRK_STRICT_DUPLICATE_FILTER, &hdev->quirks);
 446
 447         /* Some devices ship with the controller default address.
 448          * Allow the bootloader to set a valid address through the
 449          * device tree.
 450          */
 451         set_bit(HCI_QUIRK_USE_BDADDR_PROPERTY, &hdev->quirks);
 452
 453         return 0;
 454 }
 455 EXPORT_SYMBOL_GPL(btbcm_finalize);
 456
 457 int btbcm_setup_patchram(struct hci_dev *hdev)
 458 {
 459         char fw_name[64];
 460         const struct firmware *fw;
 461         struct sk_buff *skb;
 462         int err;
 463
 464         /* Initialize */
 465         err = btbcm_initialize(hdev, fw_name, sizeof(fw_name), false);
 466         if (err)
 467                 return err;
 468
 469         err = request_firmware(&fw, fw_name, &hdev->dev);
 470         if (err < 0) {
 471                 bt_dev_info(hdev, "BCM: Patch %s not found", fw_name);
 472                 goto done;
 473         }
 474
 475         btbcm_patchram(hdev, fw);
 476
 477         release_firmware(fw);
 478
 479         /* Re-initialize */
 480         err = btbcm_initialize(hdev, fw_name, sizeof(fw_name), true);
 481         if (err)
 482                 return err;
 483
 484         /* Read Local Name */
 485         skb = btbcm_read_local_name(hdev);
 486         if (IS_ERR(skb))
 487                 return PTR_ERR(skb);
 488
 489         bt_dev_info(hdev, "%s", (char *)(skb->data + 1));
 490         kfree_skb(skb);
 491
 492 done:
 493         btbcm_check_bdaddr(hdev);
 494
 495         set_bit(HCI_QUIRK_STRICT_DUPLICATE_FILTER, &hdev->quirks);
 496
 497         return 0;
 498 }
 499 EXPORT_SYMBOL_GPL(btbcm_setup_patchram);
 500
 501 int btbcm_setup_apple(struct hci_dev *hdev)
 502 {
 503         struct sk_buff *skb;
 504         int err;
 505
 506         /* Reset */
 507         err = btbcm_reset(hdev);
 508         if (err)
 509                 return err;
 510
 511         /* Read Verbose Config Version Info */
 512         skb = btbcm_read_verbose_config(hdev);
 513         if (!IS_ERR(skb)) {
 514                 bt_dev_info(hdev, "BCM: chip id %u build %4.4u",
 515                             skb->data[1], get_unaligned_le16(skb->data + 5));
 516                 kfree_skb(skb);
 517         }
 518
 519         /* Read USB Product Info */
 520         skb = btbcm_read_usb_product(hdev);
 521         if (!IS_ERR(skb)) {
 522                 bt_dev_info(hdev, "BCM: product %4.4x:%4.4x",
 523                             get_unaligned_le16(skb->data + 1),
 524                             get_unaligned_le16(skb->data + 3));
 525                 kfree_skb(skb);
 526         }
 527
 528         /* Read Controller Features */
 529         skb = btbcm_read_controller_features(hdev);
 530         if (!IS_ERR(skb)) {
 531                 bt_dev_info(hdev, "BCM: features 0x%2.2x", skb->data[1]);
 532                 kfree_skb(skb);
 533         }
 534
 535         /* Read Local Name */
 536         skb = btbcm_read_local_name(hdev);
 537         if (!IS_ERR(skb)) {
 538                 bt_dev_info(hdev, "%s", (char *)(skb->data + 1));
 539                 kfree_skb(skb);
 540         }
 541
 542         set_bit(HCI_QUIRK_STRICT_DUPLICATE_FILTER, &hdev->quirks);
 543
 544         return 0;
 545 }
 546 EXPORT_SYMBOL_GPL(btbcm_setup_apple);
 547
 548 MODULE_AUTHOR("Marcel Holtmann <[email protected]>");
 549 MODULE_DESCRIPTION("Bluetooth support for Broadcom devices ver " VERSION);
 550 MODULE_VERSION(VERSION);
 551 MODULE_LICENSE("GPL");