?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
Merge branch 'x86-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel...
[cris-mirror.git] / drivers / bluetooth / btusb.c
blob2a55380ad730713fa4f26807294e9a9a0b5fa1b5
1 /*
2 *
3 * Generic Bluetooth USB driver
4 *
5 * Copyright (C) 2005-2008 Marcel Holtmann <marcel@holtmann.org>
6 *
7 *
8 * This program is free software; you can redistribute it and/or modify
9 * it under the terms of the GNU General Public License as published by
10 * the Free Software Foundation; either version 2 of the License, or
11 * (at your option) any later version.
12 *
13 * This program is distributed in the hope that it will be useful,
14 * but WITHOUT ANY WARRANTY; without even the implied warranty of
15 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
16 * GNU General Public License for more details.
17 *
18 * You should have received a copy of the GNU General Public License
19 * along with this program; if not, write to the Free Software
20 * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
21 *
22 */
23
24 #include <linux/module.h>
25 #include <linux/usb.h>
26 #include <linux/usb/quirks.h>
27 #include <linux/firmware.h>
28 #include <linux/of_device.h>
29 #include <linux/of_irq.h>
30 #include <linux/suspend.h>
31 #include <asm/unaligned.h>
32
33 #include <net/bluetooth/bluetooth.h>
34 #include <net/bluetooth/hci_core.h>
35
36 #include "btintel.h"
37 #include "btbcm.h"
38 #include "btrtl.h"
39
40 #define VERSION "0.8"
41
42 static bool disable_scofix;
43 static bool force_scofix;
44 static bool enable_autosuspend = IS_ENABLED(CONFIG_BT_HCIBTUSB_AUTOSUSPEND);
45
46 static bool reset = true;
47
48 static struct usb_driver btusb_driver;
49
50 #define BTUSB_IGNORE 0x01
51 #define BTUSB_DIGIANSWER 0x02
52 #define BTUSB_CSR 0x04
53 #define BTUSB_SNIFFER 0x08
54 #define BTUSB_BCM92035 0x10
55 #define BTUSB_BROKEN_ISOC 0x20
56 #define BTUSB_WRONG_SCO_MTU 0x40
57 #define BTUSB_ATH3012 0x80
58 #define BTUSB_INTEL 0x100
59 #define BTUSB_INTEL_BOOT 0x200
60 #define BTUSB_BCM_PATCHRAM 0x400
61 #define BTUSB_MARVELL 0x800
62 #define BTUSB_SWAVE 0x1000
63 #define BTUSB_INTEL_NEW 0x2000
64 #define BTUSB_AMP 0x4000
65 #define BTUSB_QCA_ROME 0x8000
66 #define BTUSB_BCM_APPLE 0x10000
67 #define BTUSB_REALTEK 0x20000
68 #define BTUSB_BCM2045 0x40000
69 #define BTUSB_IFNUM_2 0x80000
70 #define BTUSB_CW6622 0x100000
71
72 static const struct usb_device_id btusb_table[] = {
73 /* Generic Bluetooth USB device */
74 { USB_DEVICE_INFO(0xe0, 0x01, 0x01) },
75
76 /* Generic Bluetooth AMP device */
77 { USB_DEVICE_INFO(0xe0, 0x01, 0x04), .driver_info = BTUSB_AMP },
78
79 /* Generic Bluetooth USB interface */
80 { USB_INTERFACE_INFO(0xe0, 0x01, 0x01) },
81
82 /* Apple-specific (Broadcom) devices */
83 { USB_VENDOR_AND_INTERFACE_INFO(0x05ac, 0xff, 0x01, 0x01),
84 .driver_info = BTUSB_BCM_APPLE | BTUSB_IFNUM_2 },
85
86 /* MediaTek MT76x0E */
87 { USB_DEVICE(0x0e8d, 0x763f) },
88
89 /* Broadcom SoftSailing reporting vendor specific */
90 { USB_DEVICE(0x0a5c, 0x21e1) },
91
92 /* Apple MacBookPro 7,1 */
93 { USB_DEVICE(0x05ac, 0x8213) },
94
95 /* Apple iMac11,1 */
96 { USB_DEVICE(0x05ac, 0x8215) },
97
98 /* Apple MacBookPro6,2 */
99 { USB_DEVICE(0x05ac, 0x8218) },
100
101 /* Apple MacBookAir3,1, MacBookAir3,2 */
102 { USB_DEVICE(0x05ac, 0x821b) },
103
104 /* Apple MacBookAir4,1 */
105 { USB_DEVICE(0x05ac, 0x821f) },
106
107 /* Apple MacBookPro8,2 */
108 { USB_DEVICE(0x05ac, 0x821a) },
109
110 /* Apple MacMini5,1 */
111 { USB_DEVICE(0x05ac, 0x8281) },
112
113 /* AVM BlueFRITZ! USB v2.0 */
114 { USB_DEVICE(0x057c, 0x3800), .driver_info = BTUSB_SWAVE },
115
116 /* Bluetooth Ultraport Module from IBM */
117 { USB_DEVICE(0x04bf, 0x030a) },
118
119 /* ALPS Modules with non-standard id */
120 { USB_DEVICE(0x044e, 0x3001) },
121 { USB_DEVICE(0x044e, 0x3002) },
122
123 /* Ericsson with non-standard id */
124 { USB_DEVICE(0x0bdb, 0x1002) },
125
126 /* Canyon CN-BTU1 with HID interfaces */
127 { USB_DEVICE(0x0c10, 0x0000) },
128
129 /* Broadcom BCM20702A0 */
130 { USB_DEVICE(0x413c, 0x8197) },
131
132 /* Broadcom BCM20702B0 (Dynex/Insignia) */
133 { USB_DEVICE(0x19ff, 0x0239), .driver_info = BTUSB_BCM_PATCHRAM },
134
135 /* Broadcom BCM43142A0 (Foxconn/Lenovo) */
136 { USB_VENDOR_AND_INTERFACE_INFO(0x105b, 0xff, 0x01, 0x01),
137 .driver_info = BTUSB_BCM_PATCHRAM },
138
139 /* Broadcom BCM920703 (HTC Vive) */
140 { USB_VENDOR_AND_INTERFACE_INFO(0x0bb4, 0xff, 0x01, 0x01),
141 .driver_info = BTUSB_BCM_PATCHRAM },
142
143 /* Foxconn - Hon Hai */
144 { USB_VENDOR_AND_INTERFACE_INFO(0x0489, 0xff, 0x01, 0x01),
145 .driver_info = BTUSB_BCM_PATCHRAM },
146
147 /* Lite-On Technology - Broadcom based */
148 { USB_VENDOR_AND_INTERFACE_INFO(0x04ca, 0xff, 0x01, 0x01),
149 .driver_info = BTUSB_BCM_PATCHRAM },
150
151 /* Broadcom devices with vendor specific id */
152 { USB_VENDOR_AND_INTERFACE_INFO(0x0a5c, 0xff, 0x01, 0x01),
153 .driver_info = BTUSB_BCM_PATCHRAM },
154
155 /* ASUSTek Computer - Broadcom based */
156 { USB_VENDOR_AND_INTERFACE_INFO(0x0b05, 0xff, 0x01, 0x01),
157 .driver_info = BTUSB_BCM_PATCHRAM },
158
159 /* Belkin F8065bf - Broadcom based */
160 { USB_VENDOR_AND_INTERFACE_INFO(0x050d, 0xff, 0x01, 0x01),
161 .driver_info = BTUSB_BCM_PATCHRAM },
162
163 /* IMC Networks - Broadcom based */
164 { USB_VENDOR_AND_INTERFACE_INFO(0x13d3, 0xff, 0x01, 0x01),
165 .driver_info = BTUSB_BCM_PATCHRAM },
166
167 /* Dell Computer - Broadcom based */
168 { USB_VENDOR_AND_INTERFACE_INFO(0x413c, 0xff, 0x01, 0x01),
169 .driver_info = BTUSB_BCM_PATCHRAM },
170
171 /* Toshiba Corp - Broadcom based */
172 { USB_VENDOR_AND_INTERFACE_INFO(0x0930, 0xff, 0x01, 0x01),
173 .driver_info = BTUSB_BCM_PATCHRAM },
174
175 /* Intel Bluetooth USB Bootloader (RAM module) */
176 { USB_DEVICE(0x8087, 0x0a5a),
177 .driver_info = BTUSB_INTEL_BOOT | BTUSB_BROKEN_ISOC },
178
179 { } /* Terminating entry */
180 };
181
182 MODULE_DEVICE_TABLE(usb, btusb_table);
183
184 static const struct usb_device_id blacklist_table[] = {
185 /* CSR BlueCore devices */
186 { USB_DEVICE(0x0a12, 0x0001), .driver_info = BTUSB_CSR },
187
188 /* Broadcom BCM2033 without firmware */
189 { USB_DEVICE(0x0a5c, 0x2033), .driver_info = BTUSB_IGNORE },
190
191 /* Broadcom BCM2045 devices */
192 { USB_DEVICE(0x0a5c, 0x2045), .driver_info = BTUSB_BCM2045 },
193
194 /* Atheros 3011 with sflash firmware */
195 { USB_DEVICE(0x0489, 0xe027), .driver_info = BTUSB_IGNORE },
196 { USB_DEVICE(0x0489, 0xe03d), .driver_info = BTUSB_IGNORE },
197 { USB_DEVICE(0x04f2, 0xaff1), .driver_info = BTUSB_IGNORE },
198 { USB_DEVICE(0x0930, 0x0215), .driver_info = BTUSB_IGNORE },
199 { USB_DEVICE(0x0cf3, 0x3002), .driver_info = BTUSB_IGNORE },
200 { USB_DEVICE(0x0cf3, 0xe019), .driver_info = BTUSB_IGNORE },
201 { USB_DEVICE(0x13d3, 0x3304), .driver_info = BTUSB_IGNORE },
202
203 /* Atheros AR9285 Malbec with sflash firmware */
204 { USB_DEVICE(0x03f0, 0x311d), .driver_info = BTUSB_IGNORE },
205
206 /* Atheros 3012 with sflash firmware */
207 { USB_DEVICE(0x0489, 0xe04d), .driver_info = BTUSB_ATH3012 },
208 { USB_DEVICE(0x0489, 0xe04e), .driver_info = BTUSB_ATH3012 },
209 { USB_DEVICE(0x0489, 0xe056), .driver_info = BTUSB_ATH3012 },
210 { USB_DEVICE(0x0489, 0xe057), .driver_info = BTUSB_ATH3012 },
211 { USB_DEVICE(0x0489, 0xe05f), .driver_info = BTUSB_ATH3012 },
212 { USB_DEVICE(0x0489, 0xe076), .driver_info = BTUSB_ATH3012 },
213 { USB_DEVICE(0x0489, 0xe078), .driver_info = BTUSB_ATH3012 },
214 { USB_DEVICE(0x0489, 0xe095), .driver_info = BTUSB_ATH3012 },
215 { USB_DEVICE(0x04c5, 0x1330), .driver_info = BTUSB_ATH3012 },
216 { USB_DEVICE(0x04ca, 0x3004), .driver_info = BTUSB_ATH3012 },
217 { USB_DEVICE(0x04ca, 0x3005), .driver_info = BTUSB_ATH3012 },
218 { USB_DEVICE(0x04ca, 0x3006), .driver_info = BTUSB_ATH3012 },
219 { USB_DEVICE(0x04ca, 0x3007), .driver_info = BTUSB_ATH3012 },
220 { USB_DEVICE(0x04ca, 0x3008), .driver_info = BTUSB_ATH3012 },
221 { USB_DEVICE(0x04ca, 0x300b), .driver_info = BTUSB_ATH3012 },
222 { USB_DEVICE(0x04ca, 0x300d), .driver_info = BTUSB_ATH3012 },
223 { USB_DEVICE(0x04ca, 0x300f), .driver_info = BTUSB_ATH3012 },
224 { USB_DEVICE(0x04ca, 0x3010), .driver_info = BTUSB_ATH3012 },
225 { USB_DEVICE(0x04ca, 0x3014), .driver_info = BTUSB_ATH3012 },
226 { USB_DEVICE(0x04ca, 0x3018), .driver_info = BTUSB_ATH3012 },
227 { USB_DEVICE(0x0930, 0x0219), .driver_info = BTUSB_ATH3012 },
228 { USB_DEVICE(0x0930, 0x021c), .driver_info = BTUSB_ATH3012 },
229 { USB_DEVICE(0x0930, 0x0220), .driver_info = BTUSB_ATH3012 },
230 { USB_DEVICE(0x0930, 0x0227), .driver_info = BTUSB_ATH3012 },
231 { USB_DEVICE(0x0b05, 0x17d0), .driver_info = BTUSB_ATH3012 },
232 { USB_DEVICE(0x0cf3, 0x0036), .driver_info = BTUSB_ATH3012 },
233 { USB_DEVICE(0x0cf3, 0x3004), .driver_info = BTUSB_ATH3012 },
234 { USB_DEVICE(0x0cf3, 0x3008), .driver_info = BTUSB_ATH3012 },
235 { USB_DEVICE(0x0cf3, 0x311d), .driver_info = BTUSB_ATH3012 },
236 { USB_DEVICE(0x0cf3, 0x311e), .driver_info = BTUSB_ATH3012 },
237 { USB_DEVICE(0x0cf3, 0x311f), .driver_info = BTUSB_ATH3012 },
238 { USB_DEVICE(0x0cf3, 0x3121), .driver_info = BTUSB_ATH3012 },
239 { USB_DEVICE(0x0cf3, 0x817a), .driver_info = BTUSB_ATH3012 },
240 { USB_DEVICE(0x0cf3, 0x817b), .driver_info = BTUSB_ATH3012 },
241 { USB_DEVICE(0x0cf3, 0xe003), .driver_info = BTUSB_ATH3012 },
242 { USB_DEVICE(0x0cf3, 0xe004), .driver_info = BTUSB_ATH3012 },
243 { USB_DEVICE(0x0cf3, 0xe005), .driver_info = BTUSB_ATH3012 },
244 { USB_DEVICE(0x0cf3, 0xe006), .driver_info = BTUSB_ATH3012 },
245 { USB_DEVICE(0x13d3, 0x3362), .driver_info = BTUSB_ATH3012 },
246 { USB_DEVICE(0x13d3, 0x3375), .driver_info = BTUSB_ATH3012 },
247 { USB_DEVICE(0x13d3, 0x3393), .driver_info = BTUSB_ATH3012 },
248 { USB_DEVICE(0x13d3, 0x3395), .driver_info = BTUSB_ATH3012 },
249 { USB_DEVICE(0x13d3, 0x3402), .driver_info = BTUSB_ATH3012 },
250 { USB_DEVICE(0x13d3, 0x3408), .driver_info = BTUSB_ATH3012 },
251 { USB_DEVICE(0x13d3, 0x3423), .driver_info = BTUSB_ATH3012 },
252 { USB_DEVICE(0x13d3, 0x3432), .driver_info = BTUSB_ATH3012 },
253 { USB_DEVICE(0x13d3, 0x3472), .driver_info = BTUSB_ATH3012 },
254 { USB_DEVICE(0x13d3, 0x3474), .driver_info = BTUSB_ATH3012 },
255 { USB_DEVICE(0x13d3, 0x3487), .driver_info = BTUSB_ATH3012 },
256 { USB_DEVICE(0x13d3, 0x3490), .driver_info = BTUSB_ATH3012 },
257
258 /* Atheros AR5BBU12 with sflash firmware */
259 { USB_DEVICE(0x0489, 0xe02c), .driver_info = BTUSB_IGNORE },
260
261 /* Atheros AR5BBU12 with sflash firmware */
262 { USB_DEVICE(0x0489, 0xe036), .driver_info = BTUSB_ATH3012 },
263 { USB_DEVICE(0x0489, 0xe03c), .driver_info = BTUSB_ATH3012 },
264
265 /* QCA ROME chipset */
266 { USB_DEVICE(0x0cf3, 0xe007), .driver_info = BTUSB_QCA_ROME },
267 { USB_DEVICE(0x0cf3, 0xe009), .driver_info = BTUSB_QCA_ROME },
268 { USB_DEVICE(0x0cf3, 0xe010), .driver_info = BTUSB_QCA_ROME },
269 { USB_DEVICE(0x0cf3, 0xe300), .driver_info = BTUSB_QCA_ROME },
270 { USB_DEVICE(0x0cf3, 0xe301), .driver_info = BTUSB_QCA_ROME },
271 { USB_DEVICE(0x0cf3, 0xe360), .driver_info = BTUSB_QCA_ROME },
272 { USB_DEVICE(0x0489, 0xe092), .driver_info = BTUSB_QCA_ROME },
273 { USB_DEVICE(0x0489, 0xe09f), .driver_info = BTUSB_QCA_ROME },
274 { USB_DEVICE(0x0489, 0xe0a2), .driver_info = BTUSB_QCA_ROME },
275 { USB_DEVICE(0x04ca, 0x3011), .driver_info = BTUSB_QCA_ROME },
276 { USB_DEVICE(0x04ca, 0x3015), .driver_info = BTUSB_QCA_ROME },
277 { USB_DEVICE(0x04ca, 0x3016), .driver_info = BTUSB_QCA_ROME },
278
279 /* Broadcom BCM2035 */
280 { USB_DEVICE(0x0a5c, 0x2009), .driver_info = BTUSB_BCM92035 },
281 { USB_DEVICE(0x0a5c, 0x200a), .driver_info = BTUSB_WRONG_SCO_MTU },
282 { USB_DEVICE(0x0a5c, 0x2035), .driver_info = BTUSB_WRONG_SCO_MTU },
283
284 /* Broadcom BCM2045 */
285 { USB_DEVICE(0x0a5c, 0x2039), .driver_info = BTUSB_WRONG_SCO_MTU },
286 { USB_DEVICE(0x0a5c, 0x2101), .driver_info = BTUSB_WRONG_SCO_MTU },
287
288 /* IBM/Lenovo ThinkPad with Broadcom chip */
289 { USB_DEVICE(0x0a5c, 0x201e), .driver_info = BTUSB_WRONG_SCO_MTU },
290 { USB_DEVICE(0x0a5c, 0x2110), .driver_info = BTUSB_WRONG_SCO_MTU },
291
292 /* HP laptop with Broadcom chip */
293 { USB_DEVICE(0x03f0, 0x171d), .driver_info = BTUSB_WRONG_SCO_MTU },
294
295 /* Dell laptop with Broadcom chip */
296 { USB_DEVICE(0x413c, 0x8126), .driver_info = BTUSB_WRONG_SCO_MTU },
297
298 /* Dell Wireless 370 and 410 devices */
299 { USB_DEVICE(0x413c, 0x8152), .driver_info = BTUSB_WRONG_SCO_MTU },
300 { USB_DEVICE(0x413c, 0x8156), .driver_info = BTUSB_WRONG_SCO_MTU },
301
302 /* Belkin F8T012 and F8T013 devices */
303 { USB_DEVICE(0x050d, 0x0012), .driver_info = BTUSB_WRONG_SCO_MTU },
304 { USB_DEVICE(0x050d, 0x0013), .driver_info = BTUSB_WRONG_SCO_MTU },
305
306 /* Asus WL-BTD202 device */
307 { USB_DEVICE(0x0b05, 0x1715), .driver_info = BTUSB_WRONG_SCO_MTU },
308
309 /* Kensington Bluetooth USB adapter */
310 { USB_DEVICE(0x047d, 0x105e), .driver_info = BTUSB_WRONG_SCO_MTU },
311
312 /* RTX Telecom based adapters with buggy SCO support */
313 { USB_DEVICE(0x0400, 0x0807), .driver_info = BTUSB_BROKEN_ISOC },
314 { USB_DEVICE(0x0400, 0x080a), .driver_info = BTUSB_BROKEN_ISOC },
315
316 /* CONWISE Technology based adapters with buggy SCO support */
317 { USB_DEVICE(0x0e5e, 0x6622),
318 .driver_info = BTUSB_BROKEN_ISOC | BTUSB_CW6622},
319
320 /* Roper Class 1 Bluetooth Dongle (Silicon Wave based) */
321 { USB_DEVICE(0x1310, 0x0001), .driver_info = BTUSB_SWAVE },
322
323 /* Digianswer devices */
324 { USB_DEVICE(0x08fd, 0x0001), .driver_info = BTUSB_DIGIANSWER },
325 { USB_DEVICE(0x08fd, 0x0002), .driver_info = BTUSB_IGNORE },
326
327 /* CSR BlueCore Bluetooth Sniffer */
328 { USB_DEVICE(0x0a12, 0x0002),
329 .driver_info = BTUSB_SNIFFER | BTUSB_BROKEN_ISOC },
330
331 /* Frontline ComProbe Bluetooth Sniffer */
332 { USB_DEVICE(0x16d3, 0x0002),
333 .driver_info = BTUSB_SNIFFER | BTUSB_BROKEN_ISOC },
334
335 /* Marvell Bluetooth devices */
336 { USB_DEVICE(0x1286, 0x2044), .driver_info = BTUSB_MARVELL },
337 { USB_DEVICE(0x1286, 0x2046), .driver_info = BTUSB_MARVELL },
338 { USB_DEVICE(0x1286, 0x204e), .driver_info = BTUSB_MARVELL },
339
340 /* Intel Bluetooth devices */
341 { USB_DEVICE(0x8087, 0x0025), .driver_info = BTUSB_INTEL_NEW },
342 { USB_DEVICE(0x8087, 0x07da), .driver_info = BTUSB_CSR },
343 { USB_DEVICE(0x8087, 0x07dc), .driver_info = BTUSB_INTEL },
344 { USB_DEVICE(0x8087, 0x0a2a), .driver_info = BTUSB_INTEL },
345 { USB_DEVICE(0x8087, 0x0a2b), .driver_info = BTUSB_INTEL_NEW },
346 { USB_DEVICE(0x8087, 0x0aa7), .driver_info = BTUSB_INTEL },
347 { USB_DEVICE(0x8087, 0x0aaa), .driver_info = BTUSB_INTEL_NEW },
348
349 /* Other Intel Bluetooth devices */
350 { USB_VENDOR_AND_INTERFACE_INFO(0x8087, 0xe0, 0x01, 0x01),
351 .driver_info = BTUSB_IGNORE },
352
353 /* Realtek Bluetooth devices */
354 { USB_VENDOR_AND_INTERFACE_INFO(0x0bda, 0xe0, 0x01, 0x01),
355 .driver_info = BTUSB_REALTEK },
356
357 /* Additional Realtek 8723AE Bluetooth devices */
358 { USB_DEVICE(0x0930, 0x021d), .driver_info = BTUSB_REALTEK },
359 { USB_DEVICE(0x13d3, 0x3394), .driver_info = BTUSB_REALTEK },
360
361 /* Additional Realtek 8723BE Bluetooth devices */
362 { USB_DEVICE(0x0489, 0xe085), .driver_info = BTUSB_REALTEK },
363 { USB_DEVICE(0x0489, 0xe08b), .driver_info = BTUSB_REALTEK },
364 { USB_DEVICE(0x13d3, 0x3410), .driver_info = BTUSB_REALTEK },
365 { USB_DEVICE(0x13d3, 0x3416), .driver_info = BTUSB_REALTEK },
366 { USB_DEVICE(0x13d3, 0x3459), .driver_info = BTUSB_REALTEK },
367 { USB_DEVICE(0x13d3, 0x3494), .driver_info = BTUSB_REALTEK },
368
369 /* Additional Realtek 8821AE Bluetooth devices */
370 { USB_DEVICE(0x0b05, 0x17dc), .driver_info = BTUSB_REALTEK },
371 { USB_DEVICE(0x13d3, 0x3414), .driver_info = BTUSB_REALTEK },
372 { USB_DEVICE(0x13d3, 0x3458), .driver_info = BTUSB_REALTEK },
373 { USB_DEVICE(0x13d3, 0x3461), .driver_info = BTUSB_REALTEK },
374 { USB_DEVICE(0x13d3, 0x3462), .driver_info = BTUSB_REALTEK },
375
376 /* Silicon Wave based devices */
377 { USB_DEVICE(0x0c10, 0x0000), .driver_info = BTUSB_SWAVE },
378
379 { } /* Terminating entry */
380 };
381
382 #define BTUSB_MAX_ISOC_FRAMES 10
383
384 #define BTUSB_INTR_RUNNING 0
385 #define BTUSB_BULK_RUNNING 1
386 #define BTUSB_ISOC_RUNNING 2
387 #define BTUSB_SUSPENDING 3
388 #define BTUSB_DID_ISO_RESUME 4
389 #define BTUSB_BOOTLOADER 5
390 #define BTUSB_DOWNLOADING 6
391 #define BTUSB_FIRMWARE_LOADED 7
392 #define BTUSB_FIRMWARE_FAILED 8
393 #define BTUSB_BOOTING 9
394 #define BTUSB_DIAG_RUNNING 10
395 #define BTUSB_OOB_WAKE_ENABLED 11
396
397 struct btusb_data {
398 struct hci_dev *hdev;
399 struct usb_device *udev;
400 struct usb_interface *intf;
401 struct usb_interface *isoc;
402 struct usb_interface *diag;
403 unsigned isoc_ifnum;
404
405 unsigned long flags;
406
407 struct work_struct work;
408 struct work_struct waker;
409
410 struct usb_anchor deferred;
411 struct usb_anchor tx_anchor;
412 int tx_in_flight;
413 spinlock_t txlock;
414
415 struct usb_anchor intr_anchor;
416 struct usb_anchor bulk_anchor;
417 struct usb_anchor isoc_anchor;
418 struct usb_anchor diag_anchor;
419 spinlock_t rxlock;
420
421 struct sk_buff *evt_skb;
422 struct sk_buff *acl_skb;
423 struct sk_buff *sco_skb;
424
425 struct usb_endpoint_descriptor *intr_ep;
426 struct usb_endpoint_descriptor *bulk_tx_ep;
427 struct usb_endpoint_descriptor *bulk_rx_ep;
428 struct usb_endpoint_descriptor *isoc_tx_ep;
429 struct usb_endpoint_descriptor *isoc_rx_ep;
430 struct usb_endpoint_descriptor *diag_tx_ep;
431 struct usb_endpoint_descriptor *diag_rx_ep;
432
433 __u8 cmdreq_type;
434 __u8 cmdreq;
435
436 unsigned int sco_num;
437 int isoc_altsetting;
438 int suspend_count;
439
440 int (*recv_event)(struct hci_dev *hdev, struct sk_buff *skb);
441 int (*recv_bulk)(struct btusb_data *data, void *buffer, int count);
442
443 int (*setup_on_usb)(struct hci_dev *hdev);
444
445 int oob_wake_irq; /* irq for out-of-band wake-on-bt */
446 };
447
448 static inline void btusb_free_frags(struct btusb_data *data)
449 {
450 unsigned long flags;
451
452 spin_lock_irqsave(&data->rxlock, flags);
453
454 kfree_skb(data->evt_skb);
455 data->evt_skb = NULL;
456
457 kfree_skb(data->acl_skb);
458 data->acl_skb = NULL;
459
460 kfree_skb(data->sco_skb);
461 data->sco_skb = NULL;
462
463 spin_unlock_irqrestore(&data->rxlock, flags);
464 }
465
466 static int btusb_recv_intr(struct btusb_data *data, void *buffer, int count)
467 {
468 struct sk_buff *skb;
469 int err = 0;
470
471 spin_lock(&data->rxlock);
472 skb = data->evt_skb;
473
474 while (count) {
475 int len;
476
477 if (!skb) {
478 skb = bt_skb_alloc(HCI_MAX_EVENT_SIZE, GFP_ATOMIC);
479 if (!skb) {
480 err = -ENOMEM;
481 break;
482 }
483
484 hci_skb_pkt_type(skb) = HCI_EVENT_PKT;
485 hci_skb_expect(skb) = HCI_EVENT_HDR_SIZE;
486 }
487
488 len = min_t(uint, hci_skb_expect(skb), count);
489 skb_put_data(skb, buffer, len);
490
491 count -= len;
492 buffer += len;
493 hci_skb_expect(skb) -= len;
494
495 if (skb->len == HCI_EVENT_HDR_SIZE) {
496 /* Complete event header */
497 hci_skb_expect(skb) = hci_event_hdr(skb)->plen;
498
499 if (skb_tailroom(skb) < hci_skb_expect(skb)) {
500 kfree_skb(skb);
501 skb = NULL;
502
503 err = -EILSEQ;
504 break;
505 }
506 }
507
508 if (!hci_skb_expect(skb)) {
509 /* Complete frame */
510 data->recv_event(data->hdev, skb);
511 skb = NULL;
512 }
513 }
514
515 data->evt_skb = skb;
516 spin_unlock(&data->rxlock);
517
518 return err;
519 }
520
521 static int btusb_recv_bulk(struct btusb_data *data, void *buffer, int count)
522 {
523 struct sk_buff *skb;
524 int err = 0;
525
526 spin_lock(&data->rxlock);
527 skb = data->acl_skb;
528
529 while (count) {
530 int len;
531
532 if (!skb) {
533 skb = bt_skb_alloc(HCI_MAX_FRAME_SIZE, GFP_ATOMIC);
534 if (!skb) {
535 err = -ENOMEM;
536 break;
537 }
538
539 hci_skb_pkt_type(skb) = HCI_ACLDATA_PKT;
540 hci_skb_expect(skb) = HCI_ACL_HDR_SIZE;
541 }
542
543 len = min_t(uint, hci_skb_expect(skb), count);
544 skb_put_data(skb, buffer, len);
545
546 count -= len;
547 buffer += len;
548 hci_skb_expect(skb) -= len;
549
550 if (skb->len == HCI_ACL_HDR_SIZE) {
551 __le16 dlen = hci_acl_hdr(skb)->dlen;
552
553 /* Complete ACL header */
554 hci_skb_expect(skb) = __le16_to_cpu(dlen);
555
556 if (skb_tailroom(skb) < hci_skb_expect(skb)) {
557 kfree_skb(skb);
558 skb = NULL;
559
560 err = -EILSEQ;
561 break;
562 }
563 }
564
565 if (!hci_skb_expect(skb)) {
566 /* Complete frame */
567 hci_recv_frame(data->hdev, skb);
568 skb = NULL;
569 }
570 }
571
572 data->acl_skb = skb;
573 spin_unlock(&data->rxlock);
574
575 return err;
576 }
577
578 static int btusb_recv_isoc(struct btusb_data *data, void *buffer, int count)
579 {
580 struct sk_buff *skb;
581 int err = 0;
582
583 spin_lock(&data->rxlock);
584 skb = data->sco_skb;
585
586 while (count) {
587 int len;
588
589 if (!skb) {
590 skb = bt_skb_alloc(HCI_MAX_SCO_SIZE, GFP_ATOMIC);
591 if (!skb) {
592 err = -ENOMEM;
593 break;
594 }
595
596 hci_skb_pkt_type(skb) = HCI_SCODATA_PKT;
597 hci_skb_expect(skb) = HCI_SCO_HDR_SIZE;
598 }
599
600 len = min_t(uint, hci_skb_expect(skb), count);
601 skb_put_data(skb, buffer, len);
602
603 count -= len;
604 buffer += len;
605 hci_skb_expect(skb) -= len;
606
607 if (skb->len == HCI_SCO_HDR_SIZE) {
608 /* Complete SCO header */
609 hci_skb_expect(skb) = hci_sco_hdr(skb)->dlen;
610
611 if (skb_tailroom(skb) < hci_skb_expect(skb)) {
612 kfree_skb(skb);
613 skb = NULL;
614
615 err = -EILSEQ;
616 break;
617 }
618 }
619
620 if (!hci_skb_expect(skb)) {
621 /* Complete frame */
622 hci_recv_frame(data->hdev, skb);
623 skb = NULL;
624 }
625 }
626
627 data->sco_skb = skb;
628 spin_unlock(&data->rxlock);
629
630 return err;
631 }
632
633 static void btusb_intr_complete(struct urb *urb)
634 {
635 struct hci_dev *hdev = urb->context;
636 struct btusb_data *data = hci_get_drvdata(hdev);
637 int err;
638
639 BT_DBG("%s urb %p status %d count %d", hdev->name, urb, urb->status,
640 urb->actual_length);
641
642 if (!test_bit(HCI_RUNNING, &hdev->flags))
643 return;
644
645 if (urb->status == 0) {
646 hdev->stat.byte_rx += urb->actual_length;
647
648 if (btusb_recv_intr(data, urb->transfer_buffer,
649 urb->actual_length) < 0) {
650 bt_dev_err(hdev, "corrupted event packet");
651 hdev->stat.err_rx++;
652 }
653 } else if (urb->status == -ENOENT) {
654 /* Avoid suspend failed when usb_kill_urb */
655 return;
656 }
657
658 if (!test_bit(BTUSB_INTR_RUNNING, &data->flags))
659 return;
660
661 usb_mark_last_busy(data->udev);
662 usb_anchor_urb(urb, &data->intr_anchor);
663
664 err = usb_submit_urb(urb, GFP_ATOMIC);
665 if (err < 0) {
666 /* -EPERM: urb is being killed;
667 * -ENODEV: device got disconnected
668 */
669 if (err != -EPERM && err != -ENODEV)
670 bt_dev_err(hdev, "urb %p failed to resubmit (%d)",
671 urb, -err);
672 usb_unanchor_urb(urb);
673 }
674 }
675
676 static int btusb_submit_intr_urb(struct hci_dev *hdev, gfp_t mem_flags)
677 {
678 struct btusb_data *data = hci_get_drvdata(hdev);
679 struct urb *urb;
680 unsigned char *buf;
681 unsigned int pipe;
682 int err, size;
683
684 BT_DBG("%s", hdev->name);
685
686 if (!data->intr_ep)
687 return -ENODEV;
688
689 urb = usb_alloc_urb(0, mem_flags);
690 if (!urb)
691 return -ENOMEM;
692
693 size = le16_to_cpu(data->intr_ep->wMaxPacketSize);
694
695 buf = kmalloc(size, mem_flags);
696 if (!buf) {
697 usb_free_urb(urb);
698 return -ENOMEM;
699 }
700
701 pipe = usb_rcvintpipe(data->udev, data->intr_ep->bEndpointAddress);
702
703 usb_fill_int_urb(urb, data->udev, pipe, buf, size,
704 btusb_intr_complete, hdev, data->intr_ep->bInterval);
705
706 urb->transfer_flags |= URB_FREE_BUFFER;
707
708 usb_anchor_urb(urb, &data->intr_anchor);
709
710 err = usb_submit_urb(urb, mem_flags);
711 if (err < 0) {
712 if (err != -EPERM && err != -ENODEV)
713 bt_dev_err(hdev, "urb %p submission failed (%d)",
714 urb, -err);
715 usb_unanchor_urb(urb);
716 }
717
718 usb_free_urb(urb);
719
720 return err;
721 }
722
723 static void btusb_bulk_complete(struct urb *urb)
724 {
725 struct hci_dev *hdev = urb->context;
726 struct btusb_data *data = hci_get_drvdata(hdev);
727 int err;
728
729 BT_DBG("%s urb %p status %d count %d", hdev->name, urb, urb->status,
730 urb->actual_length);
731
732 if (!test_bit(HCI_RUNNING, &hdev->flags))
733 return;
734
735 if (urb->status == 0) {
736 hdev->stat.byte_rx += urb->actual_length;
737
738 if (data->recv_bulk(data, urb->transfer_buffer,
739 urb->actual_length) < 0) {
740 bt_dev_err(hdev, "corrupted ACL packet");
741 hdev->stat.err_rx++;
742 }
743 } else if (urb->status == -ENOENT) {
744 /* Avoid suspend failed when usb_kill_urb */
745 return;
746 }
747
748 if (!test_bit(BTUSB_BULK_RUNNING, &data->flags))
749 return;
750
751 usb_anchor_urb(urb, &data->bulk_anchor);
752 usb_mark_last_busy(data->udev);
753
754 err = usb_submit_urb(urb, GFP_ATOMIC);
755 if (err < 0) {
756 /* -EPERM: urb is being killed;
757 * -ENODEV: device got disconnected
758 */
759 if (err != -EPERM && err != -ENODEV)
760 bt_dev_err(hdev, "urb %p failed to resubmit (%d)",
761 urb, -err);
762 usb_unanchor_urb(urb);
763 }
764 }
765
766 static int btusb_submit_bulk_urb(struct hci_dev *hdev, gfp_t mem_flags)
767 {
768 struct btusb_data *data = hci_get_drvdata(hdev);
769 struct urb *urb;
770 unsigned char *buf;
771 unsigned int pipe;
772 int err, size = HCI_MAX_FRAME_SIZE;
773
774 BT_DBG("%s", hdev->name);
775
776 if (!data->bulk_rx_ep)
777 return -ENODEV;
778
779 urb = usb_alloc_urb(0, mem_flags);
780 if (!urb)
781 return -ENOMEM;
782
783 buf = kmalloc(size, mem_flags);
784 if (!buf) {
785 usb_free_urb(urb);
786 return -ENOMEM;
787 }
788
789 pipe = usb_rcvbulkpipe(data->udev, data->bulk_rx_ep->bEndpointAddress);
790
791 usb_fill_bulk_urb(urb, data->udev, pipe, buf, size,
792 btusb_bulk_complete, hdev);
793
794 urb->transfer_flags |= URB_FREE_BUFFER;
795
796 usb_mark_last_busy(data->udev);
797 usb_anchor_urb(urb, &data->bulk_anchor);
798
799 err = usb_submit_urb(urb, mem_flags);
800 if (err < 0) {
801 if (err != -EPERM && err != -ENODEV)
802 bt_dev_err(hdev, "urb %p submission failed (%d)",
803 urb, -err);
804 usb_unanchor_urb(urb);
805 }
806
807 usb_free_urb(urb);
808
809 return err;
810 }
811
812 static void btusb_isoc_complete(struct urb *urb)
813 {
814 struct hci_dev *hdev = urb->context;
815 struct btusb_data *data = hci_get_drvdata(hdev);
816 int i, err;
817
818 BT_DBG("%s urb %p status %d count %d", hdev->name, urb, urb->status,
819 urb->actual_length);
820
821 if (!test_bit(HCI_RUNNING, &hdev->flags))
822 return;
823
824 if (urb->status == 0) {
825 for (i = 0; i < urb->number_of_packets; i++) {
826 unsigned int offset = urb->iso_frame_desc[i].offset;
827 unsigned int length = urb->iso_frame_desc[i].actual_length;
828
829 if (urb->iso_frame_desc[i].status)
830 continue;
831
832 hdev->stat.byte_rx += length;
833
834 if (btusb_recv_isoc(data, urb->transfer_buffer + offset,
835 length) < 0) {
836 bt_dev_err(hdev, "corrupted SCO packet");
837 hdev->stat.err_rx++;
838 }
839 }
840 } else if (urb->status == -ENOENT) {
841 /* Avoid suspend failed when usb_kill_urb */
842 return;
843 }
844
845 if (!test_bit(BTUSB_ISOC_RUNNING, &data->flags))
846 return;
847
848 usb_anchor_urb(urb, &data->isoc_anchor);
849
850 err = usb_submit_urb(urb, GFP_ATOMIC);
851 if (err < 0) {
852 /* -EPERM: urb is being killed;
853 * -ENODEV: device got disconnected
854 */
855 if (err != -EPERM && err != -ENODEV)
856 bt_dev_err(hdev, "urb %p failed to resubmit (%d)",
857 urb, -err);
858 usb_unanchor_urb(urb);
859 }
860 }
861
862 static inline void __fill_isoc_descriptor(struct urb *urb, int len, int mtu)
863 {
864 int i, offset = 0;
865
866 BT_DBG("len %d mtu %d", len, mtu);
867
868 for (i = 0; i < BTUSB_MAX_ISOC_FRAMES && len >= mtu;
869 i++, offset += mtu, len -= mtu) {
870 urb->iso_frame_desc[i].offset = offset;
871 urb->iso_frame_desc[i].length = mtu;
872 }
873
874 if (len && i < BTUSB_MAX_ISOC_FRAMES) {
875 urb->iso_frame_desc[i].offset = offset;
876 urb->iso_frame_desc[i].length = len;
877 i++;
878 }
879
880 urb->number_of_packets = i;
881 }
882
883 static int btusb_submit_isoc_urb(struct hci_dev *hdev, gfp_t mem_flags)
884 {
885 struct btusb_data *data = hci_get_drvdata(hdev);
886 struct urb *urb;
887 unsigned char *buf;
888 unsigned int pipe;
889 int err, size;
890
891 BT_DBG("%s", hdev->name);
892
893 if (!data->isoc_rx_ep)
894 return -ENODEV;
895
896 urb = usb_alloc_urb(BTUSB_MAX_ISOC_FRAMES, mem_flags);
897 if (!urb)
898 return -ENOMEM;
899
900 size = le16_to_cpu(data->isoc_rx_ep->wMaxPacketSize) *
901 BTUSB_MAX_ISOC_FRAMES;
902
903 buf = kmalloc(size, mem_flags);
904 if (!buf) {
905 usb_free_urb(urb);
906 return -ENOMEM;
907 }
908
909 pipe = usb_rcvisocpipe(data->udev, data->isoc_rx_ep->bEndpointAddress);
910
911 usb_fill_int_urb(urb, data->udev, pipe, buf, size, btusb_isoc_complete,
912 hdev, data->isoc_rx_ep->bInterval);
913
914 urb->transfer_flags = URB_FREE_BUFFER | URB_ISO_ASAP;
915
916 __fill_isoc_descriptor(urb, size,
917 le16_to_cpu(data->isoc_rx_ep->wMaxPacketSize));
918
919 usb_anchor_urb(urb, &data->isoc_anchor);
920
921 err = usb_submit_urb(urb, mem_flags);
922 if (err < 0) {
923 if (err != -EPERM && err != -ENODEV)
924 bt_dev_err(hdev, "urb %p submission failed (%d)",
925 urb, -err);
926 usb_unanchor_urb(urb);
927 }
928
929 usb_free_urb(urb);
930
931 return err;
932 }
933
934 static void btusb_diag_complete(struct urb *urb)
935 {
936 struct hci_dev *hdev = urb->context;
937 struct btusb_data *data = hci_get_drvdata(hdev);
938 int err;
939
940 BT_DBG("%s urb %p status %d count %d", hdev->name, urb, urb->status,
941 urb->actual_length);
942
943 if (urb->status == 0) {
944 struct sk_buff *skb;
945
946 skb = bt_skb_alloc(urb->actual_length, GFP_ATOMIC);
947 if (skb) {
948 skb_put_data(skb, urb->transfer_buffer,
949 urb->actual_length);
950 hci_recv_diag(hdev, skb);
951 }
952 } else if (urb->status == -ENOENT) {
953 /* Avoid suspend failed when usb_kill_urb */
954 return;
955 }
956
957 if (!test_bit(BTUSB_DIAG_RUNNING, &data->flags))
958 return;
959
960 usb_anchor_urb(urb, &data->diag_anchor);
961 usb_mark_last_busy(data->udev);
962
963 err = usb_submit_urb(urb, GFP_ATOMIC);
964 if (err < 0) {
965 /* -EPERM: urb is being killed;
966 * -ENODEV: device got disconnected
967 */
968 if (err != -EPERM && err != -ENODEV)
969 bt_dev_err(hdev, "urb %p failed to resubmit (%d)",
970 urb, -err);
971 usb_unanchor_urb(urb);
972 }
973 }
974
975 static int btusb_submit_diag_urb(struct hci_dev *hdev, gfp_t mem_flags)
976 {
977 struct btusb_data *data = hci_get_drvdata(hdev);
978 struct urb *urb;
979 unsigned char *buf;
980 unsigned int pipe;
981 int err, size = HCI_MAX_FRAME_SIZE;
982
983 BT_DBG("%s", hdev->name);
984
985 if (!data->diag_rx_ep)
986 return -ENODEV;
987
988 urb = usb_alloc_urb(0, mem_flags);
989 if (!urb)
990 return -ENOMEM;
991
992 buf = kmalloc(size, mem_flags);
993 if (!buf) {
994 usb_free_urb(urb);
995 return -ENOMEM;
996 }
997
998 pipe = usb_rcvbulkpipe(data->udev, data->diag_rx_ep->bEndpointAddress);
999
1000 usb_fill_bulk_urb(urb, data->udev, pipe, buf, size,
1001 btusb_diag_complete, hdev);
1002
1003 urb->transfer_flags |= URB_FREE_BUFFER;
1004
1005 usb_mark_last_busy(data->udev);
1006 usb_anchor_urb(urb, &data->diag_anchor);
1007
1008 err = usb_submit_urb(urb, mem_flags);
1009 if (err < 0) {
1010 if (err != -EPERM && err != -ENODEV)
1011 bt_dev_err(hdev, "urb %p submission failed (%d)",
1012 urb, -err);
1013 usb_unanchor_urb(urb);
1014 }
1015
1016 usb_free_urb(urb);
1017
1018 return err;
1019 }
1020
1021 static void btusb_tx_complete(struct urb *urb)
1022 {
1023 struct sk_buff *skb = urb->context;
1024 struct hci_dev *hdev = (struct hci_dev *)skb->dev;
1025 struct btusb_data *data = hci_get_drvdata(hdev);
1026
1027 BT_DBG("%s urb %p status %d count %d", hdev->name, urb, urb->status,
1028 urb->actual_length);
1029
1030 if (!test_bit(HCI_RUNNING, &hdev->flags))
1031 goto done;
1032
1033 if (!urb->status)
1034 hdev->stat.byte_tx += urb->transfer_buffer_length;
1035 else
1036 hdev->stat.err_tx++;
1037
1038 done:
1039 spin_lock(&data->txlock);
1040 data->tx_in_flight--;
1041 spin_unlock(&data->txlock);
1042
1043 kfree(urb->setup_packet);
1044
1045 kfree_skb(skb);
1046 }
1047
1048 static void btusb_isoc_tx_complete(struct urb *urb)
1049 {
1050 struct sk_buff *skb = urb->context;
1051 struct hci_dev *hdev = (struct hci_dev *)skb->dev;
1052
1053 BT_DBG("%s urb %p status %d count %d", hdev->name, urb, urb->status,
1054 urb->actual_length);
1055
1056 if (!test_bit(HCI_RUNNING, &hdev->flags))
1057 goto done;
1058
1059 if (!urb->status)
1060 hdev->stat.byte_tx += urb->transfer_buffer_length;
1061 else
1062 hdev->stat.err_tx++;
1063
1064 done:
1065 kfree(urb->setup_packet);
1066
1067 kfree_skb(skb);
1068 }
1069
1070 static int btusb_open(struct hci_dev *hdev)
1071 {
1072 struct btusb_data *data = hci_get_drvdata(hdev);
1073 int err;
1074
1075 BT_DBG("%s", hdev->name);
1076
1077 err = usb_autopm_get_interface(data->intf);
1078 if (err < 0)
1079 return err;
1080
1081 /* Patching USB firmware files prior to starting any URBs of HCI path
1082 * It is more safe to use USB bulk channel for downloading USB patch
1083 */
1084 if (data->setup_on_usb) {
1085 err = data->setup_on_usb(hdev);
1086 if (err < 0)
1087 return err;
1088 }
1089
1090 data->intf->needs_remote_wakeup = 1;
1091 /* device specific wakeup source enabled and required for USB
1092 * remote wakeup while host is suspended
1093 */
1094 device_wakeup_enable(&data->udev->dev);
1095
1096 if (test_and_set_bit(BTUSB_INTR_RUNNING, &data->flags))
1097 goto done;
1098
1099 err = btusb_submit_intr_urb(hdev, GFP_KERNEL);
1100 if (err < 0)
1101 goto failed;
1102
1103 err = btusb_submit_bulk_urb(hdev, GFP_KERNEL);
1104 if (err < 0) {
1105 usb_kill_anchored_urbs(&data->intr_anchor);
1106 goto failed;
1107 }
1108
1109 set_bit(BTUSB_BULK_RUNNING, &data->flags);
1110 btusb_submit_bulk_urb(hdev, GFP_KERNEL);
1111
1112 if (data->diag) {
1113 if (!btusb_submit_diag_urb(hdev, GFP_KERNEL))
1114 set_bit(BTUSB_DIAG_RUNNING, &data->flags);
1115 }
1116
1117 done:
1118 usb_autopm_put_interface(data->intf);
1119 return 0;
1120
1121 failed:
1122 clear_bit(BTUSB_INTR_RUNNING, &data->flags);
1123 usb_autopm_put_interface(data->intf);
1124 return err;
1125 }
1126
1127 static void btusb_stop_traffic(struct btusb_data *data)
1128 {
1129 usb_kill_anchored_urbs(&data->intr_anchor);
1130 usb_kill_anchored_urbs(&data->bulk_anchor);
1131 usb_kill_anchored_urbs(&data->isoc_anchor);
1132 usb_kill_anchored_urbs(&data->diag_anchor);
1133 }
1134
1135 static int btusb_close(struct hci_dev *hdev)
1136 {
1137 struct btusb_data *data = hci_get_drvdata(hdev);
1138 int err;
1139
1140 BT_DBG("%s", hdev->name);
1141
1142 cancel_work_sync(&data->work);
1143 cancel_work_sync(&data->waker);
1144
1145 clear_bit(BTUSB_ISOC_RUNNING, &data->flags);
1146 clear_bit(BTUSB_BULK_RUNNING, &data->flags);
1147 clear_bit(BTUSB_INTR_RUNNING, &data->flags);
1148 clear_bit(BTUSB_DIAG_RUNNING, &data->flags);
1149
1150 btusb_stop_traffic(data);
1151 btusb_free_frags(data);
1152
1153 err = usb_autopm_get_interface(data->intf);
1154 if (err < 0)
1155 goto failed;
1156
1157 data->intf->needs_remote_wakeup = 0;
1158 device_wakeup_disable(&data->udev->dev);
1159 usb_autopm_put_interface(data->intf);
1160
1161 failed:
1162 usb_scuttle_anchored_urbs(&data->deferred);
1163 return 0;
1164 }
1165
1166 static int btusb_flush(struct hci_dev *hdev)
1167 {
1168 struct btusb_data *data = hci_get_drvdata(hdev);
1169
1170 BT_DBG("%s", hdev->name);
1171
1172 usb_kill_anchored_urbs(&data->tx_anchor);
1173 btusb_free_frags(data);
1174
1175 return 0;
1176 }
1177
1178 static struct urb *alloc_ctrl_urb(struct hci_dev *hdev, struct sk_buff *skb)
1179 {
1180 struct btusb_data *data = hci_get_drvdata(hdev);
1181 struct usb_ctrlrequest *dr;
1182 struct urb *urb;
1183 unsigned int pipe;
1184
1185 urb = usb_alloc_urb(0, GFP_KERNEL);
1186 if (!urb)
1187 return ERR_PTR(-ENOMEM);
1188
1189 dr = kmalloc(sizeof(*dr), GFP_KERNEL);
1190 if (!dr) {
1191 usb_free_urb(urb);
1192 return ERR_PTR(-ENOMEM);
1193 }
1194
1195 dr->bRequestType = data->cmdreq_type;
1196 dr->bRequest = data->cmdreq;
1197 dr->wIndex = 0;
1198 dr->wValue = 0;
1199 dr->wLength = __cpu_to_le16(skb->len);
1200
1201 pipe = usb_sndctrlpipe(data->udev, 0x00);
1202
1203 usb_fill_control_urb(urb, data->udev, pipe, (void *)dr,
1204 skb->data, skb->len, btusb_tx_complete, skb);
1205
1206 skb->dev = (void *)hdev;
1207
1208 return urb;
1209 }
1210
1211 static struct urb *alloc_bulk_urb(struct hci_dev *hdev, struct sk_buff *skb)
1212 {
1213 struct btusb_data *data = hci_get_drvdata(hdev);
1214 struct urb *urb;
1215 unsigned int pipe;
1216
1217 if (!data->bulk_tx_ep)
1218 return ERR_PTR(-ENODEV);
1219
1220 urb = usb_alloc_urb(0, GFP_KERNEL);
1221 if (!urb)
1222 return ERR_PTR(-ENOMEM);
1223
1224 pipe = usb_sndbulkpipe(data->udev, data->bulk_tx_ep->bEndpointAddress);
1225
1226 usb_fill_bulk_urb(urb, data->udev, pipe,
1227 skb->data, skb->len, btusb_tx_complete, skb);
1228
1229 skb->dev = (void *)hdev;
1230
1231 return urb;
1232 }
1233
1234 static struct urb *alloc_isoc_urb(struct hci_dev *hdev, struct sk_buff *skb)
1235 {
1236 struct btusb_data *data = hci_get_drvdata(hdev);
1237 struct urb *urb;
1238 unsigned int pipe;
1239
1240 if (!data->isoc_tx_ep)
1241 return ERR_PTR(-ENODEV);
1242
1243 urb = usb_alloc_urb(BTUSB_MAX_ISOC_FRAMES, GFP_KERNEL);
1244 if (!urb)
1245 return ERR_PTR(-ENOMEM);
1246
1247 pipe = usb_sndisocpipe(data->udev, data->isoc_tx_ep->bEndpointAddress);
1248
1249 usb_fill_int_urb(urb, data->udev, pipe,
1250 skb->data, skb->len, btusb_isoc_tx_complete,
1251 skb, data->isoc_tx_ep->bInterval);
1252
1253 urb->transfer_flags = URB_ISO_ASAP;
1254
1255 __fill_isoc_descriptor(urb, skb->len,
1256 le16_to_cpu(data->isoc_tx_ep->wMaxPacketSize));
1257
1258 skb->dev = (void *)hdev;
1259
1260 return urb;
1261 }
1262
1263 static int submit_tx_urb(struct hci_dev *hdev, struct urb *urb)
1264 {
1265 struct btusb_data *data = hci_get_drvdata(hdev);
1266 int err;
1267
1268 usb_anchor_urb(urb, &data->tx_anchor);
1269
1270 err = usb_submit_urb(urb, GFP_KERNEL);
1271 if (err < 0) {
1272 if (err != -EPERM && err != -ENODEV)
1273 bt_dev_err(hdev, "urb %p submission failed (%d)",
1274 urb, -err);
1275 kfree(urb->setup_packet);
1276 usb_unanchor_urb(urb);
1277 } else {
1278 usb_mark_last_busy(data->udev);
1279 }
1280
1281 usb_free_urb(urb);
1282 return err;
1283 }
1284
1285 static int submit_or_queue_tx_urb(struct hci_dev *hdev, struct urb *urb)
1286 {
1287 struct btusb_data *data = hci_get_drvdata(hdev);
1288 unsigned long flags;
1289 bool suspending;
1290
1291 spin_lock_irqsave(&data->txlock, flags);
1292 suspending = test_bit(BTUSB_SUSPENDING, &data->flags);
1293 if (!suspending)
1294 data->tx_in_flight++;
1295 spin_unlock_irqrestore(&data->txlock, flags);
1296
1297 if (!suspending)
1298 return submit_tx_urb(hdev, urb);
1299
1300 usb_anchor_urb(urb, &data->deferred);
1301 schedule_work(&data->waker);
1302
1303 usb_free_urb(urb);
1304 return 0;
1305 }
1306
1307 static int btusb_send_frame(struct hci_dev *hdev, struct sk_buff *skb)
1308 {
1309 struct urb *urb;
1310
1311 BT_DBG("%s", hdev->name);
1312
1313 switch (hci_skb_pkt_type(skb)) {
1314 case HCI_COMMAND_PKT:
1315 urb = alloc_ctrl_urb(hdev, skb);
1316 if (IS_ERR(urb))
1317 return PTR_ERR(urb);
1318
1319 hdev->stat.cmd_tx++;
1320 return submit_or_queue_tx_urb(hdev, urb);
1321
1322 case HCI_ACLDATA_PKT:
1323 urb = alloc_bulk_urb(hdev, skb);
1324 if (IS_ERR(urb))
1325 return PTR_ERR(urb);
1326
1327 hdev->stat.acl_tx++;
1328 return submit_or_queue_tx_urb(hdev, urb);
1329
1330 case HCI_SCODATA_PKT:
1331 if (hci_conn_num(hdev, SCO_LINK) < 1)
1332 return -ENODEV;
1333
1334 urb = alloc_isoc_urb(hdev, skb);
1335 if (IS_ERR(urb))
1336 return PTR_ERR(urb);
1337
1338 hdev->stat.sco_tx++;
1339 return submit_tx_urb(hdev, urb);
1340 }
1341
1342 return -EILSEQ;
1343 }
1344
1345 static void btusb_notify(struct hci_dev *hdev, unsigned int evt)
1346 {
1347 struct btusb_data *data = hci_get_drvdata(hdev);
1348
1349 BT_DBG("%s evt %d", hdev->name, evt);
1350
1351 if (hci_conn_num(hdev, SCO_LINK) != data->sco_num) {
1352 data->sco_num = hci_conn_num(hdev, SCO_LINK);
1353 schedule_work(&data->work);
1354 }
1355 }
1356
1357 static inline int __set_isoc_interface(struct hci_dev *hdev, int altsetting)
1358 {
1359 struct btusb_data *data = hci_get_drvdata(hdev);
1360 struct usb_interface *intf = data->isoc;
1361 struct usb_endpoint_descriptor *ep_desc;
1362 int i, err;
1363
1364 if (!data->isoc)
1365 return -ENODEV;
1366
1367 err = usb_set_interface(data->udev, data->isoc_ifnum, altsetting);
1368 if (err < 0) {
1369 bt_dev_err(hdev, "setting interface failed (%d)", -err);
1370 return err;
1371 }
1372
1373 data->isoc_altsetting = altsetting;
1374
1375 data->isoc_tx_ep = NULL;
1376 data->isoc_rx_ep = NULL;
1377
1378 for (i = 0; i < intf->cur_altsetting->desc.bNumEndpoints; i++) {
1379 ep_desc = &intf->cur_altsetting->endpoint[i].desc;
1380
1381 if (!data->isoc_tx_ep && usb_endpoint_is_isoc_out(ep_desc)) {
1382 data->isoc_tx_ep = ep_desc;
1383 continue;
1384 }
1385
1386 if (!data->isoc_rx_ep && usb_endpoint_is_isoc_in(ep_desc)) {
1387 data->isoc_rx_ep = ep_desc;
1388 continue;
1389 }
1390 }
1391
1392 if (!data->isoc_tx_ep || !data->isoc_rx_ep) {
1393 bt_dev_err(hdev, "invalid SCO descriptors");
1394 return -ENODEV;
1395 }
1396
1397 return 0;
1398 }
1399
1400 static void btusb_work(struct work_struct *work)
1401 {
1402 struct btusb_data *data = container_of(work, struct btusb_data, work);
1403 struct hci_dev *hdev = data->hdev;
1404 int new_alts;
1405 int err;
1406
1407 if (data->sco_num > 0) {
1408 if (!test_bit(BTUSB_DID_ISO_RESUME, &data->flags)) {
1409 err = usb_autopm_get_interface(data->isoc ? data->isoc : data->intf);
1410 if (err < 0) {
1411 clear_bit(BTUSB_ISOC_RUNNING, &data->flags);
1412 usb_kill_anchored_urbs(&data->isoc_anchor);
1413 return;
1414 }
1415
1416 set_bit(BTUSB_DID_ISO_RESUME, &data->flags);
1417 }
1418
1419 if (hdev->voice_setting & 0x0020) {
1420 static const int alts[3] = { 2, 4, 5 };
1421
1422 new_alts = alts[data->sco_num - 1];
1423 } else {
1424 new_alts = data->sco_num;
1425 }
1426
1427 if (data->isoc_altsetting != new_alts) {
1428 unsigned long flags;
1429
1430 clear_bit(BTUSB_ISOC_RUNNING, &data->flags);
1431 usb_kill_anchored_urbs(&data->isoc_anchor);
1432
1433 /* When isochronous alternate setting needs to be
1434 * changed, because SCO connection has been added
1435 * or removed, a packet fragment may be left in the
1436 * reassembling state. This could lead to wrongly
1437 * assembled fragments.
1438 *
1439 * Clear outstanding fragment when selecting a new
1440 * alternate setting.
1441 */
1442 spin_lock_irqsave(&data->rxlock, flags);
1443 kfree_skb(data->sco_skb);
1444 data->sco_skb = NULL;
1445 spin_unlock_irqrestore(&data->rxlock, flags);
1446
1447 if (__set_isoc_interface(hdev, new_alts) < 0)
1448 return;
1449 }
1450
1451 if (!test_and_set_bit(BTUSB_ISOC_RUNNING, &data->flags)) {
1452 if (btusb_submit_isoc_urb(hdev, GFP_KERNEL) < 0)
1453 clear_bit(BTUSB_ISOC_RUNNING, &data->flags);
1454 else
1455 btusb_submit_isoc_urb(hdev, GFP_KERNEL);
1456 }
1457 } else {
1458 clear_bit(BTUSB_ISOC_RUNNING, &data->flags);
1459 usb_kill_anchored_urbs(&data->isoc_anchor);
1460
1461 __set_isoc_interface(hdev, 0);
1462 if (test_and_clear_bit(BTUSB_DID_ISO_RESUME, &data->flags))
1463 usb_autopm_put_interface(data->isoc ? data->isoc : data->intf);
1464 }
1465 }
1466
1467 static void btusb_waker(struct work_struct *work)
1468 {
1469 struct btusb_data *data = container_of(work, struct btusb_data, waker);
1470 int err;
1471
1472 err = usb_autopm_get_interface(data->intf);
1473 if (err < 0)
1474 return;
1475
1476 usb_autopm_put_interface(data->intf);
1477 }
1478
1479 static int btusb_setup_bcm92035(struct hci_dev *hdev)
1480 {
1481 struct sk_buff *skb;
1482 u8 val = 0x00;
1483
1484 BT_DBG("%s", hdev->name);
1485
1486 skb = __hci_cmd_sync(hdev, 0xfc3b, 1, &val, HCI_INIT_TIMEOUT);
1487 if (IS_ERR(skb))
1488 bt_dev_err(hdev, "BCM92035 command failed (%ld)", PTR_ERR(skb));
1489 else
1490 kfree_skb(skb);
1491
1492 return 0;
1493 }
1494
1495 static int btusb_setup_csr(struct hci_dev *hdev)
1496 {
1497 struct hci_rp_read_local_version *rp;
1498 struct sk_buff *skb;
1499
1500 BT_DBG("%s", hdev->name);
1501
1502 skb = __hci_cmd_sync(hdev, HCI_OP_READ_LOCAL_VERSION, 0, NULL,
1503 HCI_INIT_TIMEOUT);
1504 if (IS_ERR(skb)) {
1505 int err = PTR_ERR(skb);
1506 bt_dev_err(hdev, "CSR: Local version failed (%d)", err);
1507 return err;
1508 }
1509
1510 if (skb->len != sizeof(struct hci_rp_read_local_version)) {
1511 bt_dev_err(hdev, "CSR: Local version length mismatch");
1512 kfree_skb(skb);
1513 return -EIO;
1514 }
1515
1516 rp = (struct hci_rp_read_local_version *)skb->data;
1517
1518 /* Detect controllers which aren't real CSR ones. */
1519 if (le16_to_cpu(rp->manufacturer) != 10 ||
1520 le16_to_cpu(rp->lmp_subver) == 0x0c5c) {
1521 /* Clear the reset quirk since this is not an actual
1522 * early Bluetooth 1.1 device from CSR.
1523 */
1524 clear_bit(HCI_QUIRK_RESET_ON_CLOSE, &hdev->quirks);
1525
1526 /* These fake CSR controllers have all a broken
1527 * stored link key handling and so just disable it.
1528 */
1529 set_bit(HCI_QUIRK_BROKEN_STORED_LINK_KEY, &hdev->quirks);
1530 }
1531
1532 kfree_skb(skb);
1533
1534 return 0;
1535 }
1536
1537 static const struct firmware *btusb_setup_intel_get_fw(struct hci_dev *hdev,
1538 struct intel_version *ver)
1539 {
1540 const struct firmware *fw;
1541 char fwname[64];
1542 int ret;
1543
1544 snprintf(fwname, sizeof(fwname),
1545 "intel/ibt-hw-%x.%x.%x-fw-%x.%x.%x.%x.%x.bseq",
1546 ver->hw_platform, ver->hw_variant, ver->hw_revision,
1547 ver->fw_variant, ver->fw_revision, ver->fw_build_num,
1548 ver->fw_build_ww, ver->fw_build_yy);
1549
1550 ret = request_firmware(&fw, fwname, &hdev->dev);
1551 if (ret < 0) {
1552 if (ret == -EINVAL) {
1553 BT_ERR("%s Intel firmware file request failed (%d)",
1554 hdev->name, ret);
1555 return NULL;
1556 }
1557
1558 BT_ERR("%s failed to open Intel firmware file: %s(%d)",
1559 hdev->name, fwname, ret);
1560
1561 /* If the correct firmware patch file is not found, use the
1562 * default firmware patch file instead
1563 */
1564 snprintf(fwname, sizeof(fwname), "intel/ibt-hw-%x.%x.bseq",
1565 ver->hw_platform, ver->hw_variant);
1566 if (request_firmware(&fw, fwname, &hdev->dev) < 0) {
1567 BT_ERR("%s failed to open default Intel fw file: %s",
1568 hdev->name, fwname);
1569 return NULL;
1570 }
1571 }
1572
1573 bt_dev_info(hdev, "Intel Bluetooth firmware file: %s", fwname);
1574
1575 return fw;
1576 }
1577
1578 static int btusb_setup_intel_patching(struct hci_dev *hdev,
1579 const struct firmware *fw,
1580 const u8 **fw_ptr, int *disable_patch)
1581 {
1582 struct sk_buff *skb;
1583 struct hci_command_hdr *cmd;
1584 const u8 *cmd_param;
1585 struct hci_event_hdr *evt = NULL;
1586 const u8 *evt_param = NULL;
1587 int remain = fw->size - (*fw_ptr - fw->data);
1588
1589 /* The first byte indicates the types of the patch command or event.
1590 * 0x01 means HCI command and 0x02 is HCI event. If the first bytes
1591 * in the current firmware buffer doesn't start with 0x01 or
1592 * the size of remain buffer is smaller than HCI command header,
1593 * the firmware file is corrupted and it should stop the patching
1594 * process.
1595 */
1596 if (remain > HCI_COMMAND_HDR_SIZE && *fw_ptr[0] != 0x01) {
1597 BT_ERR("%s Intel fw corrupted: invalid cmd read", hdev->name);
1598 return -EINVAL;
1599 }
1600 (*fw_ptr)++;
1601 remain--;
1602
1603 cmd = (struct hci_command_hdr *)(*fw_ptr);
1604 *fw_ptr += sizeof(*cmd);
1605 remain -= sizeof(*cmd);
1606
1607 /* Ensure that the remain firmware data is long enough than the length
1608 * of command parameter. If not, the firmware file is corrupted.
1609 */
1610 if (remain < cmd->plen) {
1611 BT_ERR("%s Intel fw corrupted: invalid cmd len", hdev->name);
1612 return -EFAULT;
1613 }
1614
1615 /* If there is a command that loads a patch in the firmware
1616 * file, then enable the patch upon success, otherwise just
1617 * disable the manufacturer mode, for example patch activation
1618 * is not required when the default firmware patch file is used
1619 * because there are no patch data to load.
1620 */
1621 if (*disable_patch && le16_to_cpu(cmd->opcode) == 0xfc8e)
1622 *disable_patch = 0;
1623
1624 cmd_param = *fw_ptr;
1625 *fw_ptr += cmd->plen;
1626 remain -= cmd->plen;
1627
1628 /* This reads the expected events when the above command is sent to the
1629 * device. Some vendor commands expects more than one events, for
1630 * example command status event followed by vendor specific event.
1631 * For this case, it only keeps the last expected event. so the command
1632 * can be sent with __hci_cmd_sync_ev() which returns the sk_buff of
1633 * last expected event.
1634 */
1635 while (remain > HCI_EVENT_HDR_SIZE && *fw_ptr[0] == 0x02) {
1636 (*fw_ptr)++;
1637 remain--;
1638
1639 evt = (struct hci_event_hdr *)(*fw_ptr);
1640 *fw_ptr += sizeof(*evt);
1641 remain -= sizeof(*evt);
1642
1643 if (remain < evt->plen) {
1644 BT_ERR("%s Intel fw corrupted: invalid evt len",
1645 hdev->name);
1646 return -EFAULT;
1647 }
1648
1649 evt_param = *fw_ptr;
1650 *fw_ptr += evt->plen;
1651 remain -= evt->plen;
1652 }
1653
1654 /* Every HCI commands in the firmware file has its correspond event.
1655 * If event is not found or remain is smaller than zero, the firmware
1656 * file is corrupted.
1657 */
1658 if (!evt || !evt_param || remain < 0) {
1659 BT_ERR("%s Intel fw corrupted: invalid evt read", hdev->name);
1660 return -EFAULT;
1661 }
1662
1663 skb = __hci_cmd_sync_ev(hdev, le16_to_cpu(cmd->opcode), cmd->plen,
1664 cmd_param, evt->evt, HCI_INIT_TIMEOUT);
1665 if (IS_ERR(skb)) {
1666 BT_ERR("%s sending Intel patch command (0x%4.4x) failed (%ld)",
1667 hdev->name, cmd->opcode, PTR_ERR(skb));
1668 return PTR_ERR(skb);
1669 }
1670
1671 /* It ensures that the returned event matches the event data read from
1672 * the firmware file. At fist, it checks the length and then
1673 * the contents of the event.
1674 */
1675 if (skb->len != evt->plen) {
1676 BT_ERR("%s mismatch event length (opcode 0x%4.4x)", hdev->name,
1677 le16_to_cpu(cmd->opcode));
1678 kfree_skb(skb);
1679 return -EFAULT;
1680 }
1681
1682 if (memcmp(skb->data, evt_param, evt->plen)) {
1683 BT_ERR("%s mismatch event parameter (opcode 0x%4.4x)",
1684 hdev->name, le16_to_cpu(cmd->opcode));
1685 kfree_skb(skb);
1686 return -EFAULT;
1687 }
1688 kfree_skb(skb);
1689
1690 return 0;
1691 }
1692
1693 static int btusb_setup_intel(struct hci_dev *hdev)
1694 {
1695 struct sk_buff *skb;
1696 const struct firmware *fw;
1697 const u8 *fw_ptr;
1698 int disable_patch, err;
1699 struct intel_version ver;
1700
1701 BT_DBG("%s", hdev->name);
1702
1703 /* The controller has a bug with the first HCI command sent to it
1704 * returning number of completed commands as zero. This would stall the
1705 * command processing in the Bluetooth core.
1706 *
1707 * As a workaround, send HCI Reset command first which will reset the
1708 * number of completed commands and allow normal command processing
1709 * from now on.
1710 */
1711 skb = __hci_cmd_sync(hdev, HCI_OP_RESET, 0, NULL, HCI_INIT_TIMEOUT);
1712 if (IS_ERR(skb)) {
1713 BT_ERR("%s sending initial HCI reset command failed (%ld)",
1714 hdev->name, PTR_ERR(skb));
1715 return PTR_ERR(skb);
1716 }
1717 kfree_skb(skb);
1718
1719 /* Read Intel specific controller version first to allow selection of
1720 * which firmware file to load.
1721 *
1722 * The returned information are hardware variant and revision plus
1723 * firmware variant, revision and build number.
1724 */
1725 err = btintel_read_version(hdev, &ver);
1726 if (err)
1727 return err;
1728
1729 bt_dev_info(hdev, "read Intel version: %02x%02x%02x%02x%02x%02x%02x%02x%02x",
1730 ver.hw_platform, ver.hw_variant, ver.hw_revision,
1731 ver.fw_variant, ver.fw_revision, ver.fw_build_num,
1732 ver.fw_build_ww, ver.fw_build_yy, ver.fw_patch_num);
1733
1734 /* fw_patch_num indicates the version of patch the device currently
1735 * have. If there is no patch data in the device, it is always 0x00.
1736 * So, if it is other than 0x00, no need to patch the device again.
1737 */
1738 if (ver.fw_patch_num) {
1739 bt_dev_info(hdev, "Intel device is already patched. "
1740 "patch num: %02x", ver.fw_patch_num);
1741 goto complete;
1742 }
1743
1744 /* Opens the firmware patch file based on the firmware version read
1745 * from the controller. If it fails to open the matching firmware
1746 * patch file, it tries to open the default firmware patch file.
1747 * If no patch file is found, allow the device to operate without
1748 * a patch.
1749 */
1750 fw = btusb_setup_intel_get_fw(hdev, &ver);
1751 if (!fw)
1752 goto complete;
1753 fw_ptr = fw->data;
1754
1755 /* Enable the manufacturer mode of the controller.
1756 * Only while this mode is enabled, the driver can download the
1757 * firmware patch data and configuration parameters.
1758 */
1759 err = btintel_enter_mfg(hdev);
1760 if (err) {
1761 release_firmware(fw);
1762 return err;
1763 }
1764
1765 disable_patch = 1;
1766
1767 /* The firmware data file consists of list of Intel specific HCI
1768 * commands and its expected events. The first byte indicates the
1769 * type of the message, either HCI command or HCI event.
1770 *
1771 * It reads the command and its expected event from the firmware file,
1772 * and send to the controller. Once __hci_cmd_sync_ev() returns,
1773 * the returned event is compared with the event read from the firmware
1774 * file and it will continue until all the messages are downloaded to
1775 * the controller.
1776 *
1777 * Once the firmware patching is completed successfully,
1778 * the manufacturer mode is disabled with reset and activating the
1779 * downloaded patch.
1780 *
1781 * If the firmware patching fails, the manufacturer mode is
1782 * disabled with reset and deactivating the patch.
1783 *
1784 * If the default patch file is used, no reset is done when disabling
1785 * the manufacturer.
1786 */
1787 while (fw->size > fw_ptr - fw->data) {
1788 int ret;
1789
1790 ret = btusb_setup_intel_patching(hdev, fw, &fw_ptr,
1791 &disable_patch);
1792 if (ret < 0)
1793 goto exit_mfg_deactivate;
1794 }
1795
1796 release_firmware(fw);
1797
1798 if (disable_patch)
1799 goto exit_mfg_disable;
1800
1801 /* Patching completed successfully and disable the manufacturer mode
1802 * with reset and activate the downloaded firmware patches.
1803 */
1804 err = btintel_exit_mfg(hdev, true, true);
1805 if (err)
1806 return err;
1807
1808 bt_dev_info(hdev, "Intel firmware patch completed and activated");
1809
1810 goto complete;
1811
1812 exit_mfg_disable:
1813 /* Disable the manufacturer mode without reset */
1814 err = btintel_exit_mfg(hdev, false, false);
1815 if (err)
1816 return err;
1817
1818 bt_dev_info(hdev, "Intel firmware patch completed");
1819
1820 goto complete;
1821
1822 exit_mfg_deactivate:
1823 release_firmware(fw);
1824
1825 /* Patching failed. Disable the manufacturer mode with reset and
1826 * deactivate the downloaded firmware patches.
1827 */
1828 err = btintel_exit_mfg(hdev, true, false);
1829 if (err)
1830 return err;
1831
1832 bt_dev_info(hdev, "Intel firmware patch completed and deactivated");
1833
1834 complete:
1835 /* Set the event mask for Intel specific vendor events. This enables
1836 * a few extra events that are useful during general operation.
1837 */
1838 btintel_set_event_mask_mfg(hdev, false);
1839
1840 btintel_check_bdaddr(hdev);
1841 return 0;
1842 }
1843
1844 static int inject_cmd_complete(struct hci_dev *hdev, __u16 opcode)
1845 {
1846 struct sk_buff *skb;
1847 struct hci_event_hdr *hdr;
1848 struct hci_ev_cmd_complete *evt;
1849
1850 skb = bt_skb_alloc(sizeof(*hdr) + sizeof(*evt) + 1, GFP_ATOMIC);
1851 if (!skb)
1852 return -ENOMEM;
1853
1854 hdr = skb_put(skb, sizeof(*hdr));
1855 hdr->evt = HCI_EV_CMD_COMPLETE;
1856 hdr->plen = sizeof(*evt) + 1;
1857
1858 evt = skb_put(skb, sizeof(*evt));
1859 evt->ncmd = 0x01;
1860 evt->opcode = cpu_to_le16(opcode);
1861
1862 skb_put_u8(skb, 0x00);
1863
1864 hci_skb_pkt_type(skb) = HCI_EVENT_PKT;
1865
1866 return hci_recv_frame(hdev, skb);
1867 }
1868
1869 static int btusb_recv_bulk_intel(struct btusb_data *data, void *buffer,
1870 int count)
1871 {
1872 /* When the device is in bootloader mode, then it can send
1873 * events via the bulk endpoint. These events are treated the
1874 * same way as the ones received from the interrupt endpoint.
1875 */
1876 if (test_bit(BTUSB_BOOTLOADER, &data->flags))
1877 return btusb_recv_intr(data, buffer, count);
1878
1879 return btusb_recv_bulk(data, buffer, count);
1880 }
1881
1882 static void btusb_intel_bootup(struct btusb_data *data, const void *ptr,
1883 unsigned int len)
1884 {
1885 const struct intel_bootup *evt = ptr;
1886
1887 if (len != sizeof(*evt))
1888 return;
1889
1890 if (test_and_clear_bit(BTUSB_BOOTING, &data->flags)) {
1891 smp_mb__after_atomic();
1892 wake_up_bit(&data->flags, BTUSB_BOOTING);
1893 }
1894 }
1895
1896 static void btusb_intel_secure_send_result(struct btusb_data *data,
1897 const void *ptr, unsigned int len)
1898 {
1899 const struct intel_secure_send_result *evt = ptr;
1900
1901 if (len != sizeof(*evt))
1902 return;
1903
1904 if (evt->result)
1905 set_bit(BTUSB_FIRMWARE_FAILED, &data->flags);
1906
1907 if (test_and_clear_bit(BTUSB_DOWNLOADING, &data->flags) &&
1908 test_bit(BTUSB_FIRMWARE_LOADED, &data->flags)) {
1909 smp_mb__after_atomic();
1910 wake_up_bit(&data->flags, BTUSB_DOWNLOADING);
1911 }
1912 }
1913
1914 static int btusb_recv_event_intel(struct hci_dev *hdev, struct sk_buff *skb)
1915 {
1916 struct btusb_data *data = hci_get_drvdata(hdev);
1917
1918 if (test_bit(BTUSB_BOOTLOADER, &data->flags)) {
1919 struct hci_event_hdr *hdr = (void *)skb->data;
1920
1921 if (skb->len > HCI_EVENT_HDR_SIZE && hdr->evt == 0xff &&
1922 hdr->plen > 0) {
1923 const void *ptr = skb->data + HCI_EVENT_HDR_SIZE + 1;
1924 unsigned int len = skb->len - HCI_EVENT_HDR_SIZE - 1;
1925
1926 switch (skb->data[2]) {
1927 case 0x02:
1928 /* When switching to the operational firmware
1929 * the device sends a vendor specific event
1930 * indicating that the bootup completed.
1931 */
1932 btusb_intel_bootup(data, ptr, len);
1933 break;
1934 case 0x06:
1935 /* When the firmware loading completes the
1936 * device sends out a vendor specific event
1937 * indicating the result of the firmware
1938 * loading.
1939 */
1940 btusb_intel_secure_send_result(data, ptr, len);
1941 break;
1942 }
1943 }
1944 }
1945
1946 return hci_recv_frame(hdev, skb);
1947 }
1948
1949 static int btusb_send_frame_intel(struct hci_dev *hdev, struct sk_buff *skb)
1950 {
1951 struct btusb_data *data = hci_get_drvdata(hdev);
1952 struct urb *urb;
1953
1954 BT_DBG("%s", hdev->name);
1955
1956 switch (hci_skb_pkt_type(skb)) {
1957 case HCI_COMMAND_PKT:
1958 if (test_bit(BTUSB_BOOTLOADER, &data->flags)) {
1959 struct hci_command_hdr *cmd = (void *)skb->data;
1960 __u16 opcode = le16_to_cpu(cmd->opcode);
1961
1962 /* When in bootloader mode and the command 0xfc09
1963 * is received, it needs to be send down the
1964 * bulk endpoint. So allocate a bulk URB instead.
1965 */
1966 if (opcode == 0xfc09)
1967 urb = alloc_bulk_urb(hdev, skb);
1968 else
1969 urb = alloc_ctrl_urb(hdev, skb);
1970
1971 /* When the 0xfc01 command is issued to boot into
1972 * the operational firmware, it will actually not
1973 * send a command complete event. To keep the flow
1974 * control working inject that event here.
1975 */
1976 if (opcode == 0xfc01)
1977 inject_cmd_complete(hdev, opcode);
1978 } else {
1979 urb = alloc_ctrl_urb(hdev, skb);
1980 }
1981 if (IS_ERR(urb))
1982 return PTR_ERR(urb);
1983
1984 hdev->stat.cmd_tx++;
1985 return submit_or_queue_tx_urb(hdev, urb);
1986
1987 case HCI_ACLDATA_PKT:
1988 urb = alloc_bulk_urb(hdev, skb);
1989 if (IS_ERR(urb))
1990 return PTR_ERR(urb);
1991
1992 hdev->stat.acl_tx++;
1993 return submit_or_queue_tx_urb(hdev, urb);
1994
1995 case HCI_SCODATA_PKT:
1996 if (hci_conn_num(hdev, SCO_LINK) < 1)
1997 return -ENODEV;
1998
1999 urb = alloc_isoc_urb(hdev, skb);
2000 if (IS_ERR(urb))
2001 return PTR_ERR(urb);
2002
2003 hdev->stat.sco_tx++;
2004 return submit_tx_urb(hdev, urb);
2005 }
2006
2007 return -EILSEQ;
2008 }
2009
2010 static int btusb_setup_intel_new(struct hci_dev *hdev)
2011 {
2012 struct btusb_data *data = hci_get_drvdata(hdev);
2013 struct intel_version ver;
2014 struct intel_boot_params params;
2015 const struct firmware *fw;
2016 u32 boot_param;
2017 char fwname[64];
2018 ktime_t calltime, delta, rettime;
2019 unsigned long long duration;
2020 int err;
2021
2022 BT_DBG("%s", hdev->name);
2023
2024 /* Set the default boot parameter to 0x0 and it is updated to
2025 * SKU specific boot parameter after reading Intel_Write_Boot_Params
2026 * command while downloading the firmware.
2027 */
2028 boot_param = 0x00000000;
2029
2030 calltime = ktime_get();
2031
2032 /* Read the Intel version information to determine if the device
2033 * is in bootloader mode or if it already has operational firmware
2034 * loaded.
2035 */
2036 err = btintel_read_version(hdev, &ver);
2037 if (err)
2038 return err;
2039
2040 /* The hardware platform number has a fixed value of 0x37 and
2041 * for now only accept this single value.
2042 */
2043 if (ver.hw_platform != 0x37) {
2044 BT_ERR("%s: Unsupported Intel hardware platform (%u)",
2045 hdev->name, ver.hw_platform);
2046 return -EINVAL;
2047 }
2048
2049 /* Check for supported iBT hardware variants of this firmware
2050 * loading method.
2051 *
2052 * This check has been put in place to ensure correct forward
2053 * compatibility options when newer hardware variants come along.
2054 */
2055 switch (ver.hw_variant) {
2056 case 0x0b: /* SfP */
2057 case 0x0c: /* WsP */
2058 case 0x11: /* JfP */
2059 case 0x12: /* ThP */
2060 break;
2061 default:
2062 BT_ERR("%s: Unsupported Intel hardware variant (%u)",
2063 hdev->name, ver.hw_variant);
2064 return -EINVAL;
2065 }
2066
2067 btintel_version_info(hdev, &ver);
2068
2069 /* The firmware variant determines if the device is in bootloader
2070 * mode or is running operational firmware. The value 0x06 identifies
2071 * the bootloader and the value 0x23 identifies the operational
2072 * firmware.
2073 *
2074 * When the operational firmware is already present, then only
2075 * the check for valid Bluetooth device address is needed. This
2076 * determines if the device will be added as configured or
2077 * unconfigured controller.
2078 *
2079 * It is not possible to use the Secure Boot Parameters in this
2080 * case since that command is only available in bootloader mode.
2081 */
2082 if (ver.fw_variant == 0x23) {
2083 clear_bit(BTUSB_BOOTLOADER, &data->flags);
2084 btintel_check_bdaddr(hdev);
2085 return 0;
2086 }
2087
2088 /* If the device is not in bootloader mode, then the only possible
2089 * choice is to return an error and abort the device initialization.
2090 */
2091 if (ver.fw_variant != 0x06) {
2092 BT_ERR("%s: Unsupported Intel firmware variant (%u)",
2093 hdev->name, ver.fw_variant);
2094 return -ENODEV;
2095 }
2096
2097 /* Read the secure boot parameters to identify the operating
2098 * details of the bootloader.
2099 */
2100 err = btintel_read_boot_params(hdev, &params);
2101 if (err)
2102 return err;
2103
2104 /* It is required that every single firmware fragment is acknowledged
2105 * with a command complete event. If the boot parameters indicate
2106 * that this bootloader does not send them, then abort the setup.
2107 */
2108 if (params.limited_cce != 0x00) {
2109 BT_ERR("%s: Unsupported Intel firmware loading method (%u)",
2110 hdev->name, params.limited_cce);
2111 return -EINVAL;
2112 }
2113
2114 /* If the OTP has no valid Bluetooth device address, then there will
2115 * also be no valid address for the operational firmware.
2116 */
2117 if (!bacmp(&params.otp_bdaddr, BDADDR_ANY)) {
2118 bt_dev_info(hdev, "No device address configured");
2119 set_bit(HCI_QUIRK_INVALID_BDADDR, &hdev->quirks);
2120 }
2121
2122 /* With this Intel bootloader only the hardware variant and device
2123 * revision information are used to select the right firmware for SfP
2124 * and WsP.
2125 *
2126 * The firmware filename is ibt-<hw_variant>-<dev_revid>.sfi.
2127 *
2128 * Currently the supported hardware variants are:
2129 * 11 (0x0b) for iBT3.0 (LnP/SfP)
2130 * 12 (0x0c) for iBT3.5 (WsP)
2131 *
2132 * For ThP/JfP and for future SKU's, the FW name varies based on HW
2133 * variant, HW revision and FW revision, as these are dependent on CNVi
2134 * and RF Combination.
2135 *
2136 * 17 (0x11) for iBT3.5 (JfP)
2137 * 18 (0x12) for iBT3.5 (ThP)
2138 *
2139 * The firmware file name for these will be
2140 * ibt-<hw_variant>-<hw_revision>-<fw_revision>.sfi.
2141 *
2142 */
2143 switch (ver.hw_variant) {
2144 case 0x0b: /* SfP */
2145 case 0x0c: /* WsP */
2146 snprintf(fwname, sizeof(fwname), "intel/ibt-%u-%u.sfi",
2147 le16_to_cpu(ver.hw_variant),
2148 le16_to_cpu(params.dev_revid));
2149 break;
2150 case 0x11: /* JfP */
2151 case 0x12: /* ThP */
2152 snprintf(fwname, sizeof(fwname), "intel/ibt-%u-%u-%u.sfi",
2153 le16_to_cpu(ver.hw_variant),
2154 le16_to_cpu(ver.hw_revision),
2155 le16_to_cpu(ver.fw_revision));
2156 break;
2157 default:
2158 BT_ERR("%s: Unsupported Intel firmware naming", hdev->name);
2159 return -EINVAL;
2160 }
2161
2162 err = request_firmware(&fw, fwname, &hdev->dev);
2163 if (err < 0) {
2164 BT_ERR("%s: Failed to load Intel firmware file (%d)",
2165 hdev->name, err);
2166 return err;
2167 }
2168
2169 bt_dev_info(hdev, "Found device firmware: %s", fwname);
2170
2171 /* Save the DDC file name for later use to apply once the firmware
2172 * downloading is done.
2173 */
2174 switch (ver.hw_variant) {
2175 case 0x0b: /* SfP */
2176 case 0x0c: /* WsP */
2177 snprintf(fwname, sizeof(fwname), "intel/ibt-%u-%u.ddc",
2178 le16_to_cpu(ver.hw_variant),
2179 le16_to_cpu(params.dev_revid));
2180 break;
2181 case 0x11: /* JfP */
2182 case 0x12: /* ThP */
2183 snprintf(fwname, sizeof(fwname), "intel/ibt-%u-%u-%u.ddc",
2184 le16_to_cpu(ver.hw_variant),
2185 le16_to_cpu(ver.hw_revision),
2186 le16_to_cpu(ver.fw_revision));
2187 break;
2188 default:
2189 BT_ERR("%s: Unsupported Intel firmware naming", hdev->name);
2190 return -EINVAL;
2191 }
2192
2193 if (fw->size < 644) {
2194 BT_ERR("%s: Invalid size of firmware file (%zu)",
2195 hdev->name, fw->size);
2196 err = -EBADF;
2197 goto done;
2198 }
2199
2200 set_bit(BTUSB_DOWNLOADING, &data->flags);
2201
2202 /* Start firmware downloading and get boot parameter */
2203 err = btintel_download_firmware(hdev, fw, &boot_param);
2204 if (err < 0)
2205 goto done;
2206
2207 set_bit(BTUSB_FIRMWARE_LOADED, &data->flags);
2208
2209 bt_dev_info(hdev, "Waiting for firmware download to complete");
2210
2211 /* Before switching the device into operational mode and with that
2212 * booting the loaded firmware, wait for the bootloader notification
2213 * that all fragments have been successfully received.
2214 *
2215 * When the event processing receives the notification, then the
2216 * BTUSB_DOWNLOADING flag will be cleared.
2217 *
2218 * The firmware loading should not take longer than 5 seconds
2219 * and thus just timeout if that happens and fail the setup
2220 * of this device.
2221 */
2222 err = wait_on_bit_timeout(&data->flags, BTUSB_DOWNLOADING,
2223 TASK_INTERRUPTIBLE,
2224 msecs_to_jiffies(5000));
2225 if (err == -EINTR) {
2226 BT_ERR("%s: Firmware loading interrupted", hdev->name);
2227 goto done;
2228 }
2229
2230 if (err) {
2231 BT_ERR("%s: Firmware loading timeout", hdev->name);
2232 err = -ETIMEDOUT;
2233 goto done;
2234 }
2235
2236 if (test_bit(BTUSB_FIRMWARE_FAILED, &data->flags)) {
2237 BT_ERR("%s: Firmware loading failed", hdev->name);
2238 err = -ENOEXEC;
2239 goto done;
2240 }
2241
2242 rettime = ktime_get();
2243 delta = ktime_sub(rettime, calltime);
2244 duration = (unsigned long long) ktime_to_ns(delta) >> 10;
2245
2246 bt_dev_info(hdev, "Firmware loaded in %llu usecs", duration);
2247
2248 done:
2249 release_firmware(fw);
2250
2251 if (err < 0)
2252 return err;
2253
2254 calltime = ktime_get();
2255
2256 set_bit(BTUSB_BOOTING, &data->flags);
2257
2258 err = btintel_send_intel_reset(hdev, boot_param);
2259 if (err)
2260 return err;
2261
2262 /* The bootloader will not indicate when the device is ready. This
2263 * is done by the operational firmware sending bootup notification.
2264 *
2265 * Booting into operational firmware should not take longer than
2266 * 1 second. However if that happens, then just fail the setup
2267 * since something went wrong.
2268 */
2269 bt_dev_info(hdev, "Waiting for device to boot");
2270
2271 err = wait_on_bit_timeout(&data->flags, BTUSB_BOOTING,
2272 TASK_INTERRUPTIBLE,
2273 msecs_to_jiffies(1000));
2274
2275 if (err == -EINTR) {
2276 BT_ERR("%s: Device boot interrupted", hdev->name);
2277 return -EINTR;
2278 }
2279
2280 if (err) {
2281 BT_ERR("%s: Device boot timeout", hdev->name);
2282 return -ETIMEDOUT;
2283 }
2284
2285 rettime = ktime_get();
2286 delta = ktime_sub(rettime, calltime);
2287 duration = (unsigned long long) ktime_to_ns(delta) >> 10;
2288
2289 bt_dev_info(hdev, "Device booted in %llu usecs", duration);
2290
2291 clear_bit(BTUSB_BOOTLOADER, &data->flags);
2292
2293 /* Once the device is running in operational mode, it needs to apply
2294 * the device configuration (DDC) parameters.
2295 *
2296 * The device can work without DDC parameters, so even if it fails
2297 * to load the file, no need to fail the setup.
2298 */
2299 btintel_load_ddc_config(hdev, fwname);
2300
2301 /* Set the event mask for Intel specific vendor events. This enables
2302 * a few extra events that are useful during general operation. It
2303 * does not enable any debugging related events.
2304 *
2305 * The device will function correctly without these events enabled
2306 * and thus no need to fail the setup.
2307 */
2308 btintel_set_event_mask(hdev, false);
2309
2310 return 0;
2311 }
2312
2313 static int btusb_shutdown_intel(struct hci_dev *hdev)
2314 {
2315 struct sk_buff *skb;
2316 long ret;
2317
2318 /* Some platforms have an issue with BT LED when the interface is
2319 * down or BT radio is turned off, which takes 5 seconds to BT LED
2320 * goes off. This command turns off the BT LED immediately.
2321 */
2322 skb = __hci_cmd_sync(hdev, 0xfc3f, 0, NULL, HCI_INIT_TIMEOUT);
2323 if (IS_ERR(skb)) {
2324 ret = PTR_ERR(skb);
2325 BT_ERR("%s: turning off Intel device LED failed (%ld)",
2326 hdev->name, ret);
2327 return ret;
2328 }
2329 kfree_skb(skb);
2330
2331 return 0;
2332 }
2333
2334 #ifdef CONFIG_PM
2335 /* Configure an out-of-band gpio as wake-up pin, if specified in device tree */
2336 static int marvell_config_oob_wake(struct hci_dev *hdev)
2337 {
2338 struct sk_buff *skb;
2339 struct btusb_data *data = hci_get_drvdata(hdev);
2340 struct device *dev = &data->udev->dev;
2341 u16 pin, gap, opcode;
2342 int ret;
2343 u8 cmd[5];
2344
2345 /* Move on if no wakeup pin specified */
2346 if (of_property_read_u16(dev->of_node, "marvell,wakeup-pin", &pin) ||
2347 of_property_read_u16(dev->of_node, "marvell,wakeup-gap-ms", &gap))
2348 return 0;
2349
2350 /* Vendor specific command to configure a GPIO as wake-up pin */
2351 opcode = hci_opcode_pack(0x3F, 0x59);
2352 cmd[0] = opcode & 0xFF;
2353 cmd[1] = opcode >> 8;
2354 cmd[2] = 2; /* length of parameters that follow */
2355 cmd[3] = pin;
2356 cmd[4] = gap; /* time in ms, for which wakeup pin should be asserted */
2357
2358 skb = bt_skb_alloc(sizeof(cmd), GFP_KERNEL);
2359 if (!skb) {
2360 bt_dev_err(hdev, "%s: No memory\n", __func__);
2361 return -ENOMEM;
2362 }
2363
2364 skb_put_data(skb, cmd, sizeof(cmd));
2365 hci_skb_pkt_type(skb) = HCI_COMMAND_PKT;
2366
2367 ret = btusb_send_frame(hdev, skb);
2368 if (ret) {
2369 bt_dev_err(hdev, "%s: configuration failed\n", __func__);
2370 kfree_skb(skb);
2371 return ret;
2372 }
2373
2374 return 0;
2375 }
2376 #endif
2377
2378 static int btusb_set_bdaddr_marvell(struct hci_dev *hdev,
2379 const bdaddr_t *bdaddr)
2380 {
2381 struct sk_buff *skb;
2382 u8 buf[8];
2383 long ret;
2384
2385 buf[0] = 0xfe;
2386 buf[1] = sizeof(bdaddr_t);
2387 memcpy(buf + 2, bdaddr, sizeof(bdaddr_t));
2388
2389 skb = __hci_cmd_sync(hdev, 0xfc22, sizeof(buf), buf, HCI_INIT_TIMEOUT);
2390 if (IS_ERR(skb)) {
2391 ret = PTR_ERR(skb);
2392 bt_dev_err(hdev, "changing Marvell device address failed (%ld)",
2393 ret);
2394 return ret;
2395 }
2396 kfree_skb(skb);
2397
2398 return 0;
2399 }
2400
2401 static int btusb_set_bdaddr_ath3012(struct hci_dev *hdev,
2402 const bdaddr_t *bdaddr)
2403 {
2404 struct sk_buff *skb;
2405 u8 buf[10];
2406 long ret;
2407
2408 buf[0] = 0x01;
2409 buf[1] = 0x01;
2410 buf[2] = 0x00;
2411 buf[3] = sizeof(bdaddr_t);
2412 memcpy(buf + 4, bdaddr, sizeof(bdaddr_t));
2413
2414 skb = __hci_cmd_sync(hdev, 0xfc0b, sizeof(buf), buf, HCI_INIT_TIMEOUT);
2415 if (IS_ERR(skb)) {
2416 ret = PTR_ERR(skb);
2417 bt_dev_err(hdev, "Change address command failed (%ld)", ret);
2418 return ret;
2419 }
2420 kfree_skb(skb);
2421
2422 return 0;
2423 }
2424
2425 #define QCA_DFU_PACKET_LEN 4096
2426
2427 #define QCA_GET_TARGET_VERSION 0x09
2428 #define QCA_CHECK_STATUS 0x05
2429 #define QCA_DFU_DOWNLOAD 0x01
2430
2431 #define QCA_SYSCFG_UPDATED 0x40
2432 #define QCA_PATCH_UPDATED 0x80
2433 #define QCA_DFU_TIMEOUT 3000
2434
2435 struct qca_version {
2436 __le32 rom_version;
2437 __le32 patch_version;
2438 __le32 ram_version;
2439 __le32 ref_clock;
2440 __u8 reserved[4];
2441 } __packed;
2442
2443 struct qca_rampatch_version {
2444 __le16 rom_version;
2445 __le16 patch_version;
2446 } __packed;
2447
2448 struct qca_device_info {
2449 u32 rom_version;
2450 u8 rampatch_hdr; /* length of header in rampatch */
2451 u8 nvm_hdr; /* length of header in NVM */
2452 u8 ver_offset; /* offset of version structure in rampatch */
2453 };
2454
2455 static const struct qca_device_info qca_devices_table[] = {
2456 { 0x00000100, 20, 4, 10 }, /* Rome 1.0 */
2457 { 0x00000101, 20, 4, 10 }, /* Rome 1.1 */
2458 { 0x00000200, 28, 4, 18 }, /* Rome 2.0 */
2459 { 0x00000201, 28, 4, 18 }, /* Rome 2.1 */
2460 { 0x00000300, 28, 4, 18 }, /* Rome 3.0 */
2461 { 0x00000302, 28, 4, 18 }, /* Rome 3.2 */
2462 };
2463
2464 static int btusb_qca_send_vendor_req(struct hci_dev *hdev, u8 request,
2465 void *data, u16 size)
2466 {
2467 struct btusb_data *btdata = hci_get_drvdata(hdev);
2468 struct usb_device *udev = btdata->udev;
2469 int pipe, err;
2470 u8 *buf;
2471
2472 buf = kmalloc(size, GFP_KERNEL);
2473 if (!buf)
2474 return -ENOMEM;
2475
2476 /* Found some of USB hosts have IOT issues with ours so that we should
2477 * not wait until HCI layer is ready.
2478 */
2479 pipe = usb_rcvctrlpipe(udev, 0);
2480 err = usb_control_msg(udev, pipe, request, USB_TYPE_VENDOR | USB_DIR_IN,
2481 0, 0, buf, size, USB_CTRL_SET_TIMEOUT);
2482 if (err < 0) {
2483 bt_dev_err(hdev, "Failed to access otp area (%d)", err);
2484 goto done;
2485 }
2486
2487 memcpy(data, buf, size);
2488
2489 done:
2490 kfree(buf);
2491
2492 return err;
2493 }
2494
2495 static int btusb_setup_qca_download_fw(struct hci_dev *hdev,
2496 const struct firmware *firmware,
2497 size_t hdr_size)
2498 {
2499 struct btusb_data *btdata = hci_get_drvdata(hdev);
2500 struct usb_device *udev = btdata->udev;
2501 size_t count, size, sent = 0;
2502 int pipe, len, err;
2503 u8 *buf;
2504
2505 buf = kmalloc(QCA_DFU_PACKET_LEN, GFP_KERNEL);
2506 if (!buf)
2507 return -ENOMEM;
2508
2509 count = firmware->size;
2510
2511 size = min_t(size_t, count, hdr_size);
2512 memcpy(buf, firmware->data, size);
2513
2514 /* USB patches should go down to controller through USB path
2515 * because binary format fits to go down through USB channel.
2516 * USB control path is for patching headers and USB bulk is for
2517 * patch body.
2518 */
2519 pipe = usb_sndctrlpipe(udev, 0);
2520 err = usb_control_msg(udev, pipe, QCA_DFU_DOWNLOAD, USB_TYPE_VENDOR,
2521 0, 0, buf, size, USB_CTRL_SET_TIMEOUT);
2522 if (err < 0) {
2523 bt_dev_err(hdev, "Failed to send headers (%d)", err);
2524 goto done;
2525 }
2526
2527 sent += size;
2528 count -= size;
2529
2530 while (count) {
2531 size = min_t(size_t, count, QCA_DFU_PACKET_LEN);
2532
2533 memcpy(buf, firmware->data + sent, size);
2534
2535 pipe = usb_sndbulkpipe(udev, 0x02);
2536 err = usb_bulk_msg(udev, pipe, buf, size, &len,
2537 QCA_DFU_TIMEOUT);
2538 if (err < 0) {
2539 bt_dev_err(hdev, "Failed to send body at %zd of %zd (%d)",
2540 sent, firmware->size, err);
2541 break;
2542 }
2543
2544 if (size != len) {
2545 bt_dev_err(hdev, "Failed to get bulk buffer");
2546 err = -EILSEQ;
2547 break;
2548 }
2549
2550 sent += size;
2551 count -= size;
2552 }
2553
2554 done:
2555 kfree(buf);
2556 return err;
2557 }
2558
2559 static int btusb_setup_qca_load_rampatch(struct hci_dev *hdev,
2560 struct qca_version *ver,
2561 const struct qca_device_info *info)
2562 {
2563 struct qca_rampatch_version *rver;
2564 const struct firmware *fw;
2565 u32 ver_rom, ver_patch;
2566 u16 rver_rom, rver_patch;
2567 char fwname[64];
2568 int err;
2569
2570 ver_rom = le32_to_cpu(ver->rom_version);
2571 ver_patch = le32_to_cpu(ver->patch_version);
2572
2573 snprintf(fwname, sizeof(fwname), "qca/rampatch_usb_%08x.bin", ver_rom);
2574
2575 err = request_firmware(&fw, fwname, &hdev->dev);
2576 if (err) {
2577 bt_dev_err(hdev, "failed to request rampatch file: %s (%d)",
2578 fwname, err);
2579 return err;
2580 }
2581
2582 bt_dev_info(hdev, "using rampatch file: %s", fwname);
2583
2584 rver = (struct qca_rampatch_version *)(fw->data + info->ver_offset);
2585 rver_rom = le16_to_cpu(rver->rom_version);
2586 rver_patch = le16_to_cpu(rver->patch_version);
2587
2588 bt_dev_info(hdev, "QCA: patch rome 0x%x build 0x%x, "
2589 "firmware rome 0x%x build 0x%x",
2590 rver_rom, rver_patch, ver_rom, ver_patch);
2591
2592 if (rver_rom != ver_rom || rver_patch <= ver_patch) {
2593 bt_dev_err(hdev, "rampatch file version did not match with firmware");
2594 err = -EINVAL;
2595 goto done;
2596 }
2597
2598 err = btusb_setup_qca_download_fw(hdev, fw, info->rampatch_hdr);
2599
2600 done:
2601 release_firmware(fw);
2602
2603 return err;
2604 }
2605
2606 static int btusb_setup_qca_load_nvm(struct hci_dev *hdev,
2607 struct qca_version *ver,
2608 const struct qca_device_info *info)
2609 {
2610 const struct firmware *fw;
2611 char fwname[64];
2612 int err;
2613
2614 snprintf(fwname, sizeof(fwname), "qca/nvm_usb_%08x.bin",
2615 le32_to_cpu(ver->rom_version));
2616
2617 err = request_firmware(&fw, fwname, &hdev->dev);
2618 if (err) {
2619 bt_dev_err(hdev, "failed to request NVM file: %s (%d)",
2620 fwname, err);
2621 return err;
2622 }
2623
2624 bt_dev_info(hdev, "using NVM file: %s", fwname);
2625
2626 err = btusb_setup_qca_download_fw(hdev, fw, info->nvm_hdr);
2627
2628 release_firmware(fw);
2629
2630 return err;
2631 }
2632
2633 static int btusb_setup_qca(struct hci_dev *hdev)
2634 {
2635 const struct qca_device_info *info = NULL;
2636 struct qca_version ver;
2637 u32 ver_rom;
2638 u8 status;
2639 int i, err;
2640
2641 err = btusb_qca_send_vendor_req(hdev, QCA_GET_TARGET_VERSION, &ver,
2642 sizeof(ver));
2643 if (err < 0)
2644 return err;
2645
2646 ver_rom = le32_to_cpu(ver.rom_version);
2647 for (i = 0; i < ARRAY_SIZE(qca_devices_table); i++) {
2648 if (ver_rom == qca_devices_table[i].rom_version)
2649 info = &qca_devices_table[i];
2650 }
2651 if (!info) {
2652 bt_dev_err(hdev, "don't support firmware rome 0x%x", ver_rom);
2653 return -ENODEV;
2654 }
2655
2656 err = btusb_qca_send_vendor_req(hdev, QCA_CHECK_STATUS, &status,
2657 sizeof(status));
2658 if (err < 0)
2659 return err;
2660
2661 if (!(status & QCA_PATCH_UPDATED)) {
2662 err = btusb_setup_qca_load_rampatch(hdev, &ver, info);
2663 if (err < 0)
2664 return err;
2665 }
2666
2667 if (!(status & QCA_SYSCFG_UPDATED)) {
2668 err = btusb_setup_qca_load_nvm(hdev, &ver, info);
2669 if (err < 0)
2670 return err;
2671 }
2672
2673 return 0;
2674 }
2675
2676 #ifdef CONFIG_BT_HCIBTUSB_BCM
2677 static inline int __set_diag_interface(struct hci_dev *hdev)
2678 {
2679 struct btusb_data *data = hci_get_drvdata(hdev);
2680 struct usb_interface *intf = data->diag;
2681 int i;
2682
2683 if (!data->diag)
2684 return -ENODEV;
2685
2686 data->diag_tx_ep = NULL;
2687 data->diag_rx_ep = NULL;
2688
2689 for (i = 0; i < intf->cur_altsetting->desc.bNumEndpoints; i++) {
2690 struct usb_endpoint_descriptor *ep_desc;
2691
2692 ep_desc = &intf->cur_altsetting->endpoint[i].desc;
2693
2694 if (!data->diag_tx_ep && usb_endpoint_is_bulk_out(ep_desc)) {
2695 data->diag_tx_ep = ep_desc;
2696 continue;
2697 }
2698
2699 if (!data->diag_rx_ep && usb_endpoint_is_bulk_in(ep_desc)) {
2700 data->diag_rx_ep = ep_desc;
2701 continue;
2702 }
2703 }
2704
2705 if (!data->diag_tx_ep || !data->diag_rx_ep) {
2706 bt_dev_err(hdev, "invalid diagnostic descriptors");
2707 return -ENODEV;
2708 }
2709
2710 return 0;
2711 }
2712
2713 static struct urb *alloc_diag_urb(struct hci_dev *hdev, bool enable)
2714 {
2715 struct btusb_data *data = hci_get_drvdata(hdev);
2716 struct sk_buff *skb;
2717 struct urb *urb;
2718 unsigned int pipe;
2719
2720 if (!data->diag_tx_ep)
2721 return ERR_PTR(-ENODEV);
2722
2723 urb = usb_alloc_urb(0, GFP_KERNEL);
2724 if (!urb)
2725 return ERR_PTR(-ENOMEM);
2726
2727 skb = bt_skb_alloc(2, GFP_KERNEL);
2728 if (!skb) {
2729 usb_free_urb(urb);
2730 return ERR_PTR(-ENOMEM);
2731 }
2732
2733 skb_put_u8(skb, 0xf0);
2734 skb_put_u8(skb, enable);
2735
2736 pipe = usb_sndbulkpipe(data->udev, data->diag_tx_ep->bEndpointAddress);
2737
2738 usb_fill_bulk_urb(urb, data->udev, pipe,
2739 skb->data, skb->len, btusb_tx_complete, skb);
2740
2741 skb->dev = (void *)hdev;
2742
2743 return urb;
2744 }
2745
2746 static int btusb_bcm_set_diag(struct hci_dev *hdev, bool enable)
2747 {
2748 struct btusb_data *data = hci_get_drvdata(hdev);
2749 struct urb *urb;
2750
2751 if (!data->diag)
2752 return -ENODEV;
2753
2754 if (!test_bit(HCI_RUNNING, &hdev->flags))
2755 return -ENETDOWN;
2756
2757 urb = alloc_diag_urb(hdev, enable);
2758 if (IS_ERR(urb))
2759 return PTR_ERR(urb);
2760
2761 return submit_or_queue_tx_urb(hdev, urb);
2762 }
2763 #endif
2764
2765 #ifdef CONFIG_PM
2766 static irqreturn_t btusb_oob_wake_handler(int irq, void *priv)
2767 {
2768 struct btusb_data *data = priv;
2769
2770 pm_wakeup_event(&data->udev->dev, 0);
2771 pm_system_wakeup();
2772
2773 /* Disable only if not already disabled (keep it balanced) */
2774 if (test_and_clear_bit(BTUSB_OOB_WAKE_ENABLED, &data->flags)) {
2775 disable_irq_nosync(irq);
2776 disable_irq_wake(irq);
2777 }
2778 return IRQ_HANDLED;
2779 }
2780
2781 static const struct of_device_id btusb_match_table[] = {
2782 { .compatible = "usb1286,204e" },
2783 { }
2784 };
2785 MODULE_DEVICE_TABLE(of, btusb_match_table);
2786
2787 /* Use an oob wakeup pin? */
2788 static int btusb_config_oob_wake(struct hci_dev *hdev)
2789 {
2790 struct btusb_data *data = hci_get_drvdata(hdev);
2791 struct device *dev = &data->udev->dev;
2792 int irq, ret;
2793
2794 clear_bit(BTUSB_OOB_WAKE_ENABLED, &data->flags);
2795
2796 if (!of_match_device(btusb_match_table, dev))
2797 return 0;
2798
2799 /* Move on if no IRQ specified */
2800 irq = of_irq_get_byname(dev->of_node, "wakeup");
2801 if (irq <= 0) {
2802 bt_dev_dbg(hdev, "%s: no OOB Wakeup IRQ in DT", __func__);
2803 return 0;
2804 }
2805
2806 ret = devm_request_irq(&hdev->dev, irq, btusb_oob_wake_handler,
2807 0, "OOB Wake-on-BT", data);
2808 if (ret) {
2809 bt_dev_err(hdev, "%s: IRQ request failed", __func__);
2810 return ret;
2811 }
2812
2813 ret = device_init_wakeup(dev, true);
2814 if (ret) {
2815 bt_dev_err(hdev, "%s: failed to init_wakeup", __func__);
2816 return ret;
2817 }
2818
2819 data->oob_wake_irq = irq;
2820 disable_irq(irq);
2821 bt_dev_info(hdev, "OOB Wake-on-BT configured at IRQ %u", irq);
2822 return 0;
2823 }
2824 #endif
2825
2826 static int btusb_probe(struct usb_interface *intf,
2827 const struct usb_device_id *id)
2828 {
2829 struct usb_endpoint_descriptor *ep_desc;
2830 struct btusb_data *data;
2831 struct hci_dev *hdev;
2832 unsigned ifnum_base;
2833 int i, err;
2834
2835 BT_DBG("intf %p id %p", intf, id);
2836
2837 /* interface numbers are hardcoded in the spec */
2838 if (intf->cur_altsetting->desc.bInterfaceNumber != 0) {
2839 if (!(id->driver_info & BTUSB_IFNUM_2))
2840 return -ENODEV;
2841 if (intf->cur_altsetting->desc.bInterfaceNumber != 2)
2842 return -ENODEV;
2843 }
2844
2845 ifnum_base = intf->cur_altsetting->desc.bInterfaceNumber;
2846
2847 if (!id->driver_info) {
2848 const struct usb_device_id *match;
2849
2850 match = usb_match_id(intf, blacklist_table);
2851 if (match)
2852 id = match;
2853 }
2854
2855 if (id->driver_info == BTUSB_IGNORE)
2856 return -ENODEV;
2857
2858 if (id->driver_info & BTUSB_ATH3012) {
2859 struct usb_device *udev = interface_to_usbdev(intf);
2860
2861 /* Old firmware would otherwise let ath3k driver load
2862 * patch and sysconfig files
2863 */
2864 if (le16_to_cpu(udev->descriptor.bcdDevice) <= 0x0001)
2865 return -ENODEV;
2866 }
2867
2868 data = devm_kzalloc(&intf->dev, sizeof(*data), GFP_KERNEL);
2869 if (!data)
2870 return -ENOMEM;
2871
2872 for (i = 0; i < intf->cur_altsetting->desc.bNumEndpoints; i++) {
2873 ep_desc = &intf->cur_altsetting->endpoint[i].desc;
2874
2875 if (!data->intr_ep && usb_endpoint_is_int_in(ep_desc)) {
2876 data->intr_ep = ep_desc;
2877 continue;
2878 }
2879
2880 if (!data->bulk_tx_ep && usb_endpoint_is_bulk_out(ep_desc)) {
2881 data->bulk_tx_ep = ep_desc;
2882 continue;
2883 }
2884
2885 if (!data->bulk_rx_ep && usb_endpoint_is_bulk_in(ep_desc)) {
2886 data->bulk_rx_ep = ep_desc;
2887 continue;
2888 }
2889 }
2890
2891 if (!data->intr_ep || !data->bulk_tx_ep || !data->bulk_rx_ep)
2892 return -ENODEV;
2893
2894 if (id->driver_info & BTUSB_AMP) {
2895 data->cmdreq_type = USB_TYPE_CLASS | 0x01;
2896 data->cmdreq = 0x2b;
2897 } else {
2898 data->cmdreq_type = USB_TYPE_CLASS;
2899 data->cmdreq = 0x00;
2900 }
2901
2902 data->udev = interface_to_usbdev(intf);
2903 data->intf = intf;
2904
2905 INIT_WORK(&data->work, btusb_work);
2906 INIT_WORK(&data->waker, btusb_waker);
2907 init_usb_anchor(&data->deferred);
2908 init_usb_anchor(&data->tx_anchor);
2909 spin_lock_init(&data->txlock);
2910
2911 init_usb_anchor(&data->intr_anchor);
2912 init_usb_anchor(&data->bulk_anchor);
2913 init_usb_anchor(&data->isoc_anchor);
2914 init_usb_anchor(&data->diag_anchor);
2915 spin_lock_init(&data->rxlock);
2916
2917 if (id->driver_info & BTUSB_INTEL_NEW) {
2918 data->recv_event = btusb_recv_event_intel;
2919 data->recv_bulk = btusb_recv_bulk_intel;
2920 set_bit(BTUSB_BOOTLOADER, &data->flags);
2921 } else {
2922 data->recv_event = hci_recv_frame;
2923 data->recv_bulk = btusb_recv_bulk;
2924 }
2925
2926 hdev = hci_alloc_dev();
2927 if (!hdev)
2928 return -ENOMEM;
2929
2930 hdev->bus = HCI_USB;
2931 hci_set_drvdata(hdev, data);
2932
2933 if (id->driver_info & BTUSB_AMP)
2934 hdev->dev_type = HCI_AMP;
2935 else
2936 hdev->dev_type = HCI_PRIMARY;
2937
2938 data->hdev = hdev;
2939
2940 SET_HCIDEV_DEV(hdev, &intf->dev);
2941
2942 hdev->open = btusb_open;
2943 hdev->close = btusb_close;
2944 hdev->flush = btusb_flush;
2945 hdev->send = btusb_send_frame;
2946 hdev->notify = btusb_notify;
2947
2948 #ifdef CONFIG_PM
2949 err = btusb_config_oob_wake(hdev);
2950 if (err)
2951 goto out_free_dev;
2952
2953 /* Marvell devices may need a specific chip configuration */
2954 if (id->driver_info & BTUSB_MARVELL && data->oob_wake_irq) {
2955 err = marvell_config_oob_wake(hdev);
2956 if (err)
2957 goto out_free_dev;
2958 }
2959 #endif
2960 if (id->driver_info & BTUSB_CW6622)
2961 set_bit(HCI_QUIRK_BROKEN_STORED_LINK_KEY, &hdev->quirks);
2962
2963 if (id->driver_info & BTUSB_BCM2045)
2964 set_bit(HCI_QUIRK_BROKEN_STORED_LINK_KEY, &hdev->quirks);
2965
2966 if (id->driver_info & BTUSB_BCM92035)
2967 hdev->setup = btusb_setup_bcm92035;
2968
2969 #ifdef CONFIG_BT_HCIBTUSB_BCM
2970 if (id->driver_info & BTUSB_BCM_PATCHRAM) {
2971 hdev->manufacturer = 15;
2972 hdev->setup = btbcm_setup_patchram;
2973 hdev->set_diag = btusb_bcm_set_diag;
2974 hdev->set_bdaddr = btbcm_set_bdaddr;
2975
2976 /* Broadcom LM_DIAG Interface numbers are hardcoded */
2977 data->diag = usb_ifnum_to_if(data->udev, ifnum_base + 2);
2978 }
2979
2980 if (id->driver_info & BTUSB_BCM_APPLE) {
2981 hdev->manufacturer = 15;
2982 hdev->setup = btbcm_setup_apple;
2983 hdev->set_diag = btusb_bcm_set_diag;
2984
2985 /* Broadcom LM_DIAG Interface numbers are hardcoded */
2986 data->diag = usb_ifnum_to_if(data->udev, ifnum_base + 2);
2987 }
2988 #endif
2989
2990 if (id->driver_info & BTUSB_INTEL) {
2991 hdev->manufacturer = 2;
2992 hdev->setup = btusb_setup_intel;
2993 hdev->shutdown = btusb_shutdown_intel;
2994 hdev->set_diag = btintel_set_diag_mfg;
2995 hdev->set_bdaddr = btintel_set_bdaddr;
2996 set_bit(HCI_QUIRK_STRICT_DUPLICATE_FILTER, &hdev->quirks);
2997 set_bit(HCI_QUIRK_SIMULTANEOUS_DISCOVERY, &hdev->quirks);
2998 set_bit(HCI_QUIRK_NON_PERSISTENT_DIAG, &hdev->quirks);
2999 }
3000
3001 if (id->driver_info & BTUSB_INTEL_NEW) {
3002 hdev->manufacturer = 2;
3003 hdev->send = btusb_send_frame_intel;
3004 hdev->setup = btusb_setup_intel_new;
3005 hdev->hw_error = btintel_hw_error;
3006 hdev->set_diag = btintel_set_diag;
3007 hdev->set_bdaddr = btintel_set_bdaddr;
3008 set_bit(HCI_QUIRK_STRICT_DUPLICATE_FILTER, &hdev->quirks);
3009 set_bit(HCI_QUIRK_NON_PERSISTENT_DIAG, &hdev->quirks);
3010 }
3011
3012 if (id->driver_info & BTUSB_MARVELL)
3013 hdev->set_bdaddr = btusb_set_bdaddr_marvell;
3014
3015 if (id->driver_info & BTUSB_SWAVE) {
3016 set_bit(HCI_QUIRK_FIXUP_INQUIRY_MODE, &hdev->quirks);
3017 set_bit(HCI_QUIRK_BROKEN_LOCAL_COMMANDS, &hdev->quirks);
3018 }
3019
3020 if (id->driver_info & BTUSB_INTEL_BOOT) {
3021 hdev->manufacturer = 2;
3022 set_bit(HCI_QUIRK_RAW_DEVICE, &hdev->quirks);
3023 }
3024
3025 if (id->driver_info & BTUSB_ATH3012) {
3026 hdev->set_bdaddr = btusb_set_bdaddr_ath3012;
3027 set_bit(HCI_QUIRK_SIMULTANEOUS_DISCOVERY, &hdev->quirks);
3028 set_bit(HCI_QUIRK_STRICT_DUPLICATE_FILTER, &hdev->quirks);
3029 }
3030
3031 if (id->driver_info & BTUSB_QCA_ROME) {
3032 data->setup_on_usb = btusb_setup_qca;
3033 hdev->set_bdaddr = btusb_set_bdaddr_ath3012;
3034
3035 /* QCA Rome devices lose their updated firmware over suspend,
3036 * but the USB hub doesn't notice any status change.
3037 * explicitly request a device reset on resume.
3038 */
3039 interface_to_usbdev(intf)->quirks |= USB_QUIRK_RESET_RESUME;
3040 }
3041
3042 #ifdef CONFIG_BT_HCIBTUSB_RTL
3043 if (id->driver_info & BTUSB_REALTEK) {
3044 hdev->setup = btrtl_setup_realtek;
3045
3046 /* Realtek devices lose their updated firmware over suspend,
3047 * but the USB hub doesn't notice any status change.
3048 * Explicitly request a device reset on resume.
3049 */
3050 interface_to_usbdev(intf)->quirks |= USB_QUIRK_RESET_RESUME;
3051 }
3052 #endif
3053
3054 if (id->driver_info & BTUSB_AMP) {
3055 /* AMP controllers do not support SCO packets */
3056 data->isoc = NULL;
3057 } else {
3058 /* Interface orders are hardcoded in the specification */
3059 data->isoc = usb_ifnum_to_if(data->udev, ifnum_base + 1);
3060 data->isoc_ifnum = ifnum_base + 1;
3061 }
3062
3063 if (!reset)
3064 set_bit(HCI_QUIRK_RESET_ON_CLOSE, &hdev->quirks);
3065
3066 if (force_scofix || id->driver_info & BTUSB_WRONG_SCO_MTU) {
3067 if (!disable_scofix)
3068 set_bit(HCI_QUIRK_FIXUP_BUFFER_SIZE, &hdev->quirks);
3069 }
3070
3071 if (id->driver_info & BTUSB_BROKEN_ISOC)
3072 data->isoc = NULL;
3073
3074 if (id->driver_info & BTUSB_DIGIANSWER) {
3075 data->cmdreq_type = USB_TYPE_VENDOR;
3076 set_bit(HCI_QUIRK_RESET_ON_CLOSE, &hdev->quirks);
3077 }
3078
3079 if (id->driver_info & BTUSB_CSR) {
3080 struct usb_device *udev = data->udev;
3081 u16 bcdDevice = le16_to_cpu(udev->descriptor.bcdDevice);
3082
3083 /* Old firmware would otherwise execute USB reset */
3084 if (bcdDevice < 0x117)
3085 set_bit(HCI_QUIRK_RESET_ON_CLOSE, &hdev->quirks);
3086
3087 /* Fake CSR devices with broken commands */
3088 if (bcdDevice <= 0x100 || bcdDevice == 0x134)
3089 hdev->setup = btusb_setup_csr;
3090
3091 set_bit(HCI_QUIRK_SIMULTANEOUS_DISCOVERY, &hdev->quirks);
3092 }
3093
3094 if (id->driver_info & BTUSB_SNIFFER) {
3095 struct usb_device *udev = data->udev;
3096
3097 /* New sniffer firmware has crippled HCI interface */
3098 if (le16_to_cpu(udev->descriptor.bcdDevice) > 0x997)
3099 set_bit(HCI_QUIRK_RAW_DEVICE, &hdev->quirks);
3100 }
3101
3102 if (id->driver_info & BTUSB_INTEL_BOOT) {
3103 /* A bug in the bootloader causes that interrupt interface is
3104 * only enabled after receiving SetInterface(0, AltSetting=0).
3105 */
3106 err = usb_set_interface(data->udev, 0, 0);
3107 if (err < 0) {
3108 BT_ERR("failed to set interface 0, alt 0 %d", err);
3109 goto out_free_dev;
3110 }
3111 }
3112
3113 if (data->isoc) {
3114 err = usb_driver_claim_interface(&btusb_driver,
3115 data->isoc, data);
3116 if (err < 0)
3117 goto out_free_dev;
3118 }
3119
3120 #ifdef CONFIG_BT_HCIBTUSB_BCM
3121 if (data->diag) {
3122 if (!usb_driver_claim_interface(&btusb_driver,
3123 data->diag, data))
3124 __set_diag_interface(hdev);
3125 else
3126 data->diag = NULL;
3127 }
3128 #endif
3129
3130 if (enable_autosuspend)
3131 usb_enable_autosuspend(data->udev);
3132
3133 err = hci_register_dev(hdev);
3134 if (err < 0)
3135 goto out_free_dev;
3136
3137 usb_set_intfdata(intf, data);
3138
3139 return 0;
3140
3141 out_free_dev:
3142 hci_free_dev(hdev);
3143 return err;
3144 }
3145
3146 static void btusb_disconnect(struct usb_interface *intf)
3147 {
3148 struct btusb_data *data = usb_get_intfdata(intf);
3149 struct hci_dev *hdev;
3150
3151 BT_DBG("intf %p", intf);
3152
3153 if (!data)
3154 return;
3155
3156 hdev = data->hdev;
3157 usb_set_intfdata(data->intf, NULL);
3158
3159 if (data->isoc)
3160 usb_set_intfdata(data->isoc, NULL);
3161
3162 if (data->diag)
3163 usb_set_intfdata(data->diag, NULL);
3164
3165 hci_unregister_dev(hdev);
3166
3167 if (intf == data->intf) {
3168 if (data->isoc)
3169 usb_driver_release_interface(&btusb_driver, data->isoc);
3170 if (data->diag)
3171 usb_driver_release_interface(&btusb_driver, data->diag);
3172 } else if (intf == data->isoc) {
3173 if (data->diag)
3174 usb_driver_release_interface(&btusb_driver, data->diag);
3175 usb_driver_release_interface(&btusb_driver, data->intf);
3176 } else if (intf == data->diag) {
3177 usb_driver_release_interface(&btusb_driver, data->intf);
3178 if (data->isoc)
3179 usb_driver_release_interface(&btusb_driver, data->isoc);
3180 }
3181
3182 if (data->oob_wake_irq)
3183 device_init_wakeup(&data->udev->dev, false);
3184
3185 hci_free_dev(hdev);
3186 }
3187
3188 #ifdef CONFIG_PM
3189 static int btusb_suspend(struct usb_interface *intf, pm_message_t message)
3190 {
3191 struct btusb_data *data = usb_get_intfdata(intf);
3192
3193 BT_DBG("intf %p", intf);
3194
3195 if (data->suspend_count++)
3196 return 0;
3197
3198 spin_lock_irq(&data->txlock);
3199 if (!(PMSG_IS_AUTO(message) && data->tx_in_flight)) {
3200 set_bit(BTUSB_SUSPENDING, &data->flags);
3201 spin_unlock_irq(&data->txlock);
3202 } else {
3203 spin_unlock_irq(&data->txlock);
3204 data->suspend_count--;
3205 return -EBUSY;
3206 }
3207
3208 cancel_work_sync(&data->work);
3209
3210 btusb_stop_traffic(data);
3211 usb_kill_anchored_urbs(&data->tx_anchor);
3212
3213 if (data->oob_wake_irq && device_may_wakeup(&data->udev->dev)) {
3214 set_bit(BTUSB_OOB_WAKE_ENABLED, &data->flags);
3215 enable_irq_wake(data->oob_wake_irq);
3216 enable_irq(data->oob_wake_irq);
3217 }
3218
3219 return 0;
3220 }
3221
3222 static void play_deferred(struct btusb_data *data)
3223 {
3224 struct urb *urb;
3225 int err;
3226
3227 while ((urb = usb_get_from_anchor(&data->deferred))) {
3228 usb_anchor_urb(urb, &data->tx_anchor);
3229
3230 err = usb_submit_urb(urb, GFP_ATOMIC);
3231 if (err < 0) {
3232 if (err != -EPERM && err != -ENODEV)
3233 BT_ERR("%s urb %p submission failed (%d)",
3234 data->hdev->name, urb, -err);
3235 kfree(urb->setup_packet);
3236 usb_unanchor_urb(urb);
3237 usb_free_urb(urb);
3238 break;
3239 }
3240
3241 data->tx_in_flight++;
3242 usb_free_urb(urb);
3243 }
3244
3245 /* Cleanup the rest deferred urbs. */
3246 while ((urb = usb_get_from_anchor(&data->deferred))) {
3247 kfree(urb->setup_packet);
3248 usb_free_urb(urb);
3249 }
3250 }
3251
3252 static int btusb_resume(struct usb_interface *intf)
3253 {
3254 struct btusb_data *data = usb_get_intfdata(intf);
3255 struct hci_dev *hdev = data->hdev;
3256 int err = 0;
3257
3258 BT_DBG("intf %p", intf);
3259
3260 if (--data->suspend_count)
3261 return 0;
3262
3263 /* Disable only if not already disabled (keep it balanced) */
3264 if (test_and_clear_bit(BTUSB_OOB_WAKE_ENABLED, &data->flags)) {
3265 disable_irq(data->oob_wake_irq);
3266 disable_irq_wake(data->oob_wake_irq);
3267 }
3268
3269 if (!test_bit(HCI_RUNNING, &hdev->flags))
3270 goto done;
3271
3272 if (test_bit(BTUSB_INTR_RUNNING, &data->flags)) {
3273 err = btusb_submit_intr_urb(hdev, GFP_NOIO);
3274 if (err < 0) {
3275 clear_bit(BTUSB_INTR_RUNNING, &data->flags);
3276 goto failed;
3277 }
3278 }
3279
3280 if (test_bit(BTUSB_BULK_RUNNING, &data->flags)) {
3281 err = btusb_submit_bulk_urb(hdev, GFP_NOIO);
3282 if (err < 0) {
3283 clear_bit(BTUSB_BULK_RUNNING, &data->flags);
3284 goto failed;
3285 }
3286
3287 btusb_submit_bulk_urb(hdev, GFP_NOIO);
3288 }
3289
3290 if (test_bit(BTUSB_ISOC_RUNNING, &data->flags)) {
3291 if (btusb_submit_isoc_urb(hdev, GFP_NOIO) < 0)
3292 clear_bit(BTUSB_ISOC_RUNNING, &data->flags);
3293 else
3294 btusb_submit_isoc_urb(hdev, GFP_NOIO);
3295 }
3296
3297 spin_lock_irq(&data->txlock);
3298 play_deferred(data);
3299 clear_bit(BTUSB_SUSPENDING, &data->flags);
3300 spin_unlock_irq(&data->txlock);
3301 schedule_work(&data->work);
3302
3303 return 0;
3304
3305 failed:
3306 usb_scuttle_anchored_urbs(&data->deferred);
3307 done:
3308 spin_lock_irq(&data->txlock);
3309 clear_bit(BTUSB_SUSPENDING, &data->flags);
3310 spin_unlock_irq(&data->txlock);
3311
3312 return err;
3313 }
3314 #endif
3315
3316 static struct usb_driver btusb_driver = {
3317 .name = "btusb",
3318 .probe = btusb_probe,
3319 .disconnect = btusb_disconnect,
3320 #ifdef CONFIG_PM
3321 .suspend = btusb_suspend,
3322 .resume = btusb_resume,
3323 #endif
3324 .id_table = btusb_table,
3325 .supports_autosuspend = 1,
3326 .disable_hub_initiated_lpm = 1,
3327 };
3328
3329 module_usb_driver(btusb_driver);
3330
3331 module_param(disable_scofix, bool, 0644);
3332 MODULE_PARM_DESC(disable_scofix, "Disable fixup of wrong SCO buffer size");
3333
3334 module_param(force_scofix, bool, 0644);
3335 MODULE_PARM_DESC(force_scofix, "Force fixup of wrong SCO buffers size");
3336
3337 module_param(enable_autosuspend, bool, 0644);
3338 MODULE_PARM_DESC(enable_autosuspend, "Enable USB autosuspend by default");
3339
3340 module_param(reset, bool, 0644);
3341 MODULE_PARM_DESC(reset, "Send HCI reset command on initialization");
3342
3343 MODULE_AUTHOR("Marcel Holtmann <marcel@holtmann.org>");
3344 MODULE_DESCRIPTION("Generic Bluetooth USB driver ver " VERSION);
3345 MODULE_VERSION(VERSION);
3346 MODULE_LICENSE("GPL");
CRIS linux kernel tree