1/*
2 *
3 * Bluetooth support for Broadcom devices
4 *
5 * Copyright (C) 2015 Intel Corporation
6 *
7 *
8 * This program is free software; you can redistribute it and/or modify
9 * it under the terms of the GNU General Public License as published by
10 * the Free Software Foundation; either version 2 of the License, or
11 * (at your option) any later version.
12 *
13 * This program is distributed in the hope that it will be useful,
14 * but WITHOUT ANY WARRANTY; without even the implied warranty of
15 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
16 * GNU General Public License for more details.
17 *
18 * You should have received a copy of the GNU General Public License
19 * along with this program; if not, write to the Free Software
20 * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
21 *
22 */
23
24#include <linux/module.h>
25#include <linux/firmware.h>
26#include <asm/unaligned.h>
27
28#include <net/bluetooth/bluetooth.h>
29#include <net/bluetooth/hci_core.h>
30
31#include "btbcm.h"
32
33#define VERSION "0.1"
34
35#define BDADDR_BCM20702A0 (&(bdaddr_t) {{0x00, 0xa0, 0x02, 0x70, 0x20, 0x00}})
36#define BDADDR_BCM20702A1 (&(bdaddr_t) {{0x00, 0x00, 0xa0, 0x02, 0x70, 0x20}})
37#define BDADDR_BCM43430A0 (&(bdaddr_t) {{0xac, 0x1f, 0x12, 0xa0, 0x43, 0x43}})
38#define BDADDR_BCM4324B3 (&(bdaddr_t) {{0x00, 0x00, 0x00, 0xb3, 0x24, 0x43}})
39#define BDADDR_BCM4330B1 (&(bdaddr_t) {{0x00, 0x00, 0x00, 0xb1, 0x30, 0x43}})
40
41int btbcm_check_bdaddr(struct hci_dev *hdev)
42{
43 struct hci_rp_read_bd_addr *bda;
44 struct sk_buff *skb;
45
46 skb = __hci_cmd_sync(hdev, HCI_OP_READ_BD_ADDR, 0, NULL,
47 HCI_INIT_TIMEOUT);
48 if (IS_ERR(skb)) {
49 int err = PTR_ERR(skb);
50 bt_dev_err(hdev, "BCM: Reading device address failed (%d)", err);
51 return err;
52 }
53
54 if (skb->len != sizeof(*bda)) {
55 bt_dev_err(hdev, "BCM: Device address length mismatch");
56 kfree_skb(skb);
57 return -EIO;
58 }
59
60 bda = (struct hci_rp_read_bd_addr *)skb->data;
61
62 /* Check if the address indicates a controller with either an
63 * invalid or default address. In both cases the device needs
64 * to be marked as not having a valid address.
65 *
66 * The address 00:20:70:02:A0:00 indicates a BCM20702A0 controller
67 * with no configured address.
68 *
69 * The address 20:70:02:A0:00:00 indicates a BCM20702A1 controller
70 * with no configured address.
71 *
72 * The address 43:24:B3:00:00:00 indicates a BCM4324B3 controller
73 * with waiting for configuration state.
74 *
75 * The address 43:30:B1:00:00:00 indicates a BCM4330B1 controller
76 * with waiting for configuration state.
77 *
78 * The address 43:43:A0:12:1F:AC indicates a BCM43430A0 controller
79 * with no configured address.
80 */
81 if (!bacmp(&bda->bdaddr, BDADDR_BCM20702A0) ||
82 !bacmp(&bda->bdaddr, BDADDR_BCM20702A1) ||
83 !bacmp(&bda->bdaddr, BDADDR_BCM4324B3) ||
84 !bacmp(&bda->bdaddr, BDADDR_BCM4330B1) ||
85 !bacmp(&bda->bdaddr, BDADDR_BCM43430A0)) {
86 bt_dev_info(hdev, "BCM: Using default device address (%pMR)",
87 &bda->bdaddr);
88 set_bit(HCI_QUIRK_INVALID_BDADDR, &hdev->quirks);
89 }
90
91 kfree_skb(skb);
92
93 return 0;
94}
95EXPORT_SYMBOL_GPL(btbcm_check_bdaddr);
96
97int btbcm_set_bdaddr(struct hci_dev *hdev, const bdaddr_t *bdaddr)
98{
99 struct sk_buff *skb;
100 int err;
101
102 skb = __hci_cmd_sync(hdev, 0xfc01, 6, bdaddr, HCI_INIT_TIMEOUT);
103 if (IS_ERR(skb)) {
104 err = PTR_ERR(skb);
105 bt_dev_err(hdev, "BCM: Change address command failed (%d)", err);
106 return err;
107 }
108 kfree_skb(skb);
109
110 return 0;
111}
112EXPORT_SYMBOL_GPL(btbcm_set_bdaddr);
113
114int btbcm_patchram(struct hci_dev *hdev, const struct firmware *fw)
115{
116 const struct hci_command_hdr *cmd;
117 const u8 *fw_ptr;
118 size_t fw_size;
119 struct sk_buff *skb;
120 u16 opcode;
121 int err = 0;
122
123 /* Start Download */
124 skb = __hci_cmd_sync(hdev, 0xfc2e, 0, NULL, HCI_INIT_TIMEOUT);
125 if (IS_ERR(skb)) {
126 err = PTR_ERR(skb);
127 bt_dev_err(hdev, "BCM: Download Minidrv command failed (%d)",
128 err);
129 goto done;
130 }
131 kfree_skb(skb);
132
133 /* 50 msec delay after Download Minidrv completes */
134 msleep(50);
135
136 fw_ptr = fw->data;
137 fw_size = fw->size;
138
139 while (fw_size >= sizeof(*cmd)) {
140 const u8 *cmd_param;
141
142 cmd = (struct hci_command_hdr *)fw_ptr;
143 fw_ptr += sizeof(*cmd);
144 fw_size -= sizeof(*cmd);
145
146 if (fw_size < cmd->plen) {
147 bt_dev_err(hdev, "BCM: Patch is corrupted");
148 err = -EINVAL;
149 goto done;
150 }
151
152 cmd_param = fw_ptr;
153 fw_ptr += cmd->plen;
154 fw_size -= cmd->plen;
155
156 opcode = le16_to_cpu(cmd->opcode);
157
158 skb = __hci_cmd_sync(hdev, opcode, cmd->plen, cmd_param,
159 HCI_INIT_TIMEOUT);
160 if (IS_ERR(skb)) {
161 err = PTR_ERR(skb);
162 bt_dev_err(hdev, "BCM: Patch command %04x failed (%d)",
163 opcode, err);
164 goto done;
165 }
166 kfree_skb(skb);
167 }
168
169 /* 250 msec delay after Launch Ram completes */
170 msleep(250);
171
172done:
173 return err;
174}
175EXPORT_SYMBOL(btbcm_patchram);
176
177static int btbcm_reset(struct hci_dev *hdev)
178{
179 struct sk_buff *skb;
180
181 skb = __hci_cmd_sync(hdev, HCI_OP_RESET, 0, NULL, HCI_INIT_TIMEOUT);
182 if (IS_ERR(skb)) {
183 int err = PTR_ERR(skb);
184 bt_dev_err(hdev, "BCM: Reset failed (%d)", err);
185 return err;
186 }
187 kfree_skb(skb);
188
189 /* 100 msec delay for module to complete reset process */
190 msleep(100);
191
192 return 0;
193}
194
195static struct sk_buff *btbcm_read_local_name(struct hci_dev *hdev)
196{
197 struct sk_buff *skb;
198
199 skb = __hci_cmd_sync(hdev, HCI_OP_READ_LOCAL_NAME, 0, NULL,
200 HCI_INIT_TIMEOUT);
201 if (IS_ERR(skb)) {
202 bt_dev_err(hdev, "BCM: Reading local name failed (%ld)",
203 PTR_ERR(skb));
204 return skb;
205 }
206
207 if (skb->len != sizeof(struct hci_rp_read_local_name)) {
208 bt_dev_err(hdev, "BCM: Local name length mismatch");
209 kfree_skb(skb);
210 return ERR_PTR(-EIO);
211 }
212
213 return skb;
214}
215
216static struct sk_buff *btbcm_read_local_version(struct hci_dev *hdev)
217{
218 struct sk_buff *skb;
219
220 skb = __hci_cmd_sync(hdev, HCI_OP_READ_LOCAL_VERSION, 0, NULL,
221 HCI_INIT_TIMEOUT);
222 if (IS_ERR(skb)) {
223 bt_dev_err(hdev, "BCM: Reading local version info failed (%ld)",
224 PTR_ERR(skb));
225 return skb;
226 }
227
228 if (skb->len != sizeof(struct hci_rp_read_local_version)) {
229 bt_dev_err(hdev, "BCM: Local version length mismatch");
230 kfree_skb(skb);
231 return ERR_PTR(-EIO);
232 }
233
234 return skb;
235}
236
237static struct sk_buff *btbcm_read_verbose_config(struct hci_dev *hdev)
238{
239 struct sk_buff *skb;
240
241 skb = __hci_cmd_sync(hdev, 0xfc79, 0, NULL, HCI_INIT_TIMEOUT);
242 if (IS_ERR(skb)) {
243 bt_dev_err(hdev, "BCM: Read verbose config info failed (%ld)",
244 PTR_ERR(skb));
245 return skb;
246 }
247
248 if (skb->len != 7) {
249 bt_dev_err(hdev, "BCM: Verbose config length mismatch");
250 kfree_skb(skb);
251 return ERR_PTR(-EIO);
252 }
253
254 return skb;
255}
256
257static struct sk_buff *btbcm_read_controller_features(struct hci_dev *hdev)
258{
259 struct sk_buff *skb;
260
261 skb = __hci_cmd_sync(hdev, 0xfc6e, 0, NULL, HCI_INIT_TIMEOUT);
262 if (IS_ERR(skb)) {
263 bt_dev_err(hdev, "BCM: Read controller features failed (%ld)",
264 PTR_ERR(skb));
265 return skb;
266 }
267
268 if (skb->len != 9) {
269 bt_dev_err(hdev, "BCM: Controller features length mismatch");
270 kfree_skb(skb);
271 return ERR_PTR(-EIO);
272 }
273
274 return skb;
275}
276
277static struct sk_buff *btbcm_read_usb_product(struct hci_dev *hdev)
278{
279 struct sk_buff *skb;
280
281 skb = __hci_cmd_sync(hdev, 0xfc5a, 0, NULL, HCI_INIT_TIMEOUT);
282 if (IS_ERR(skb)) {
283 bt_dev_err(hdev, "BCM: Read USB product info failed (%ld)",
284 PTR_ERR(skb));
285 return skb;
286 }
287
288 if (skb->len != 5) {
289 bt_dev_err(hdev, "BCM: USB product length mismatch");
290 kfree_skb(skb);
291 return ERR_PTR(-EIO);
292 }
293
294 return skb;
295}
296
297static int btbcm_read_info(struct hci_dev *hdev)
298{
299 struct sk_buff *skb;
300
301 /* Read Verbose Config Version Info */
302 skb = btbcm_read_verbose_config(hdev);
303 if (IS_ERR(skb))
304 return PTR_ERR(skb);
305
306 bt_dev_info(hdev, "BCM: chip id %u", skb->data[1]);
307 kfree_skb(skb);
308
309 /* Read Controller Features */
310 skb = btbcm_read_controller_features(hdev);
311 if (IS_ERR(skb))
312 return PTR_ERR(skb);
313
314 bt_dev_info(hdev, "BCM: features 0x%2.2x", skb->data[1]);
315 kfree_skb(skb);
316
317 /* Read Local Name */
318 skb = btbcm_read_local_name(hdev);
319 if (IS_ERR(skb))
320 return PTR_ERR(skb);
321
322 bt_dev_info(hdev, "%s", (char *)(skb->data + 1));
323 kfree_skb(skb);
324
325 return 0;
326}
327
328struct bcm_subver_table {
329 u16 subver;
330 const char *name;
331};
332
333static const struct bcm_subver_table bcm_uart_subver_table[] = {
334 { 0x4103, "BCM4330B1" }, /* 002.001.003 */
335 { 0x410e, "BCM43341B0" }, /* 002.001.014 */
336 { 0x4406, "BCM4324B3" }, /* 002.004.006 */
337 { 0x6109, "BCM4335C0" }, /* 003.001.009 */
338 { 0x610c, "BCM4354" }, /* 003.001.012 */
339 { 0x2122, "BCM4343A0" }, /* 001.001.034 */
340 { 0x2209, "BCM43430A1" }, /* 001.002.009 */
341 { 0x6119, "BCM4345C0" }, /* 003.001.025 */
342 { 0x230f, "BCM4356A2" }, /* 001.003.015 */
343 { 0x220e, "BCM20702A1" }, /* 001.002.014 */
344 { 0x4217, "BCM4329B1" }, /* 002.002.023 */
345 { }
346};
347
348static const struct bcm_subver_table bcm_usb_subver_table[] = {
349 { 0x210b, "BCM43142A0" }, /* 001.001.011 */
350 { 0x2112, "BCM4314A0" }, /* 001.001.018 */
351 { 0x2118, "BCM20702A0" }, /* 001.001.024 */
352 { 0x2126, "BCM4335A0" }, /* 001.001.038 */
353 { 0x220e, "BCM20702A1" }, /* 001.002.014 */
354 { 0x230f, "BCM4354A2" }, /* 001.003.015 */
355 { 0x4106, "BCM4335B0" }, /* 002.001.006 */
356 { 0x410e, "BCM20702B0" }, /* 002.001.014 */
357 { 0x6109, "BCM4335C0" }, /* 003.001.009 */
358 { 0x610c, "BCM4354" }, /* 003.001.012 */
359 { }
360};
361
362int btbcm_initialize(struct hci_dev *hdev, char *fw_name, size_t len,
363 bool reinit)
364{
365 u16 subver, rev, pid, vid;
366 const char *hw_name = "BCM";
367 struct sk_buff *skb;
368 struct hci_rp_read_local_version *ver;
369 const struct bcm_subver_table *bcm_subver_table;
370 int i, err;
371
372 /* Reset */
373 err = btbcm_reset(hdev);
374 if (err)
375 return err;
376
377 /* Read Local Version Info */
378 skb = btbcm_read_local_version(hdev);
379 if (IS_ERR(skb))
380 return PTR_ERR(skb);
381
382 ver = (struct hci_rp_read_local_version *)skb->data;
383 rev = le16_to_cpu(ver->hci_rev);
384 subver = le16_to_cpu(ver->lmp_subver);
385 kfree_skb(skb);
386
387 /* Read controller information */
388 if (!reinit) {
389 err = btbcm_read_info(hdev);
390 if (err)
391 return err;
392 }
393
394 /* Upper nibble of rev should be between 0 and 3? */
395 if (((rev & 0xf000) >> 12) > 3)
396 return 0;
397
398 bcm_subver_table = (hdev->bus == HCI_USB) ? bcm_usb_subver_table :
399 bcm_uart_subver_table;
400
401 for (i = 0; bcm_subver_table[i].name; i++) {
402 if (subver == bcm_subver_table[i].subver) {
403 hw_name = bcm_subver_table[i].name;
404 break;
405 }
406 }
407
408 if (hdev->bus == HCI_USB) {
409 /* Read USB Product Info */
410 skb = btbcm_read_usb_product(hdev);
411 if (IS_ERR(skb))
412 return PTR_ERR(skb);
413
414 vid = get_unaligned_le16(skb->data + 1);
415 pid = get_unaligned_le16(skb->data + 3);
416 kfree_skb(skb);
417
418 snprintf(fw_name, len, "brcm/%s-%4.4x-%4.4x.hcd",
419 hw_name, vid, pid);
420 } else {
421 snprintf(fw_name, len, "brcm/%s.hcd", hw_name);
422 }
423
424 bt_dev_info(hdev, "%s (%3.3u.%3.3u.%3.3u) build %4.4u",
425 hw_name, (subver & 0xe000) >> 13,
426 (subver & 0x1f00) >> 8, (subver & 0x00ff), rev & 0x0fff);
427
428 return 0;
429}
430EXPORT_SYMBOL_GPL(btbcm_initialize);
431
432int btbcm_finalize(struct hci_dev *hdev)
433{
434 char fw_name[64];
435 int err;
436
437 /* Re-initialize */
438 err = btbcm_initialize(hdev, fw_name, sizeof(fw_name), true);
439 if (err)
440 return err;
441
442 btbcm_check_bdaddr(hdev);
443
444 set_bit(HCI_QUIRK_STRICT_DUPLICATE_FILTER, &hdev->quirks);
445
446 return 0;
447}
448EXPORT_SYMBOL_GPL(btbcm_finalize);
449
450int btbcm_setup_patchram(struct hci_dev *hdev)
451{
452 char fw_name[64];
453 const struct firmware *fw;
454 struct sk_buff *skb;
455 int err;
456
457 /* Initialize */
458 err = btbcm_initialize(hdev, fw_name, sizeof(fw_name), false);
459 if (err)
460 return err;
461
462 err = request_firmware(&fw, fw_name, &hdev->dev);
463 if (err < 0) {
464 bt_dev_info(hdev, "BCM: Patch %s not found", fw_name);
465 goto done;
466 }
467
468 btbcm_patchram(hdev, fw);
469
470 release_firmware(fw);
471
472 /* Re-initialize */
473 err = btbcm_initialize(hdev, fw_name, sizeof(fw_name), true);
474 if (err)
475 return err;
476
477 /* Read Local Name */
478 skb = btbcm_read_local_name(hdev);
479 if (IS_ERR(skb))
480 return PTR_ERR(skb);
481
482 bt_dev_info(hdev, "%s", (char *)(skb->data + 1));
483 kfree_skb(skb);
484
485done:
486 btbcm_check_bdaddr(hdev);
487
488 set_bit(HCI_QUIRK_STRICT_DUPLICATE_FILTER, &hdev->quirks);
489
490 return 0;
491}
492EXPORT_SYMBOL_GPL(btbcm_setup_patchram);
493
494int btbcm_setup_apple(struct hci_dev *hdev)
495{
496 struct sk_buff *skb;
497 int err;
498
499 /* Reset */
500 err = btbcm_reset(hdev);
501 if (err)
502 return err;
503
504 /* Read Verbose Config Version Info */
505 skb = btbcm_read_verbose_config(hdev);
506 if (!IS_ERR(skb)) {
507 bt_dev_info(hdev, "BCM: chip id %u build %4.4u",
508 skb->data[1], get_unaligned_le16(skb->data + 5));
509 kfree_skb(skb);
510 }
511
512 /* Read USB Product Info */
513 skb = btbcm_read_usb_product(hdev);
514 if (!IS_ERR(skb)) {
515 bt_dev_info(hdev, "BCM: product %4.4x:%4.4x",
516 get_unaligned_le16(skb->data + 1),
517 get_unaligned_le16(skb->data + 3));
518 kfree_skb(skb);
519 }
520
521 /* Read Controller Features */
522 skb = btbcm_read_controller_features(hdev);
523 if (!IS_ERR(skb)) {
524 bt_dev_info(hdev, "BCM: features 0x%2.2x", skb->data[1]);
525 kfree_skb(skb);
526 }
527
528 /* Read Local Name */
529 skb = btbcm_read_local_name(hdev);
530 if (!IS_ERR(skb)) {
531 bt_dev_info(hdev, "%s", (char *)(skb->data + 1));
532 kfree_skb(skb);
533 }
534
535 set_bit(HCI_QUIRK_STRICT_DUPLICATE_FILTER, &hdev->quirks);
536
537 return 0;
538}
539EXPORT_SYMBOL_GPL(btbcm_setup_apple);
540
541MODULE_AUTHOR("Marcel Holtmann <marcel@holtmann.org>");
542MODULE_DESCRIPTION("Bluetooth support for Broadcom devices ver " VERSION);
543MODULE_VERSION(VERSION);
544MODULE_LICENSE("GPL");
545