?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
Merge tag 'ceph-for-4.13-rc8' of git://github.com/ceph/ceph-client
[linux/fpc-iii.git] / drivers / bluetooth / btusb.c
blobfa24d693af2416bc811e2158797448bf53bd61e9
1 /*
2 *
3 * Generic Bluetooth USB driver
4 *
5 * Copyright (C) 2005-2008 Marcel Holtmann <marcel@holtmann.org>
6 *
7 *
8 * This program is free software; you can redistribute it and/or modify
9 * it under the terms of the GNU General Public License as published by
10 * the Free Software Foundation; either version 2 of the License, or
11 * (at your option) any later version.
12 *
13 * This program is distributed in the hope that it will be useful,
14 * but WITHOUT ANY WARRANTY; without even the implied warranty of
15 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
16 * GNU General Public License for more details.
17 *
18 * You should have received a copy of the GNU General Public License
19 * along with this program; if not, write to the Free Software
20 * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
21 *
22 */
23
24 #include <linux/module.h>
25 #include <linux/usb.h>
26 #include <linux/firmware.h>
27 #include <linux/of_device.h>
28 #include <linux/of_irq.h>
29 #include <linux/suspend.h>
30 #include <asm/unaligned.h>
31
32 #include <net/bluetooth/bluetooth.h>
33 #include <net/bluetooth/hci_core.h>
34
35 #include "btintel.h"
36 #include "btbcm.h"
37 #include "btrtl.h"
38
39 #define VERSION "0.8"
40
41 static bool disable_scofix;
42 static bool force_scofix;
43
44 static bool reset = true;
45
46 static struct usb_driver btusb_driver;
47
48 #define BTUSB_IGNORE 0x01
49 #define BTUSB_DIGIANSWER 0x02
50 #define BTUSB_CSR 0x04
51 #define BTUSB_SNIFFER 0x08
52 #define BTUSB_BCM92035 0x10
53 #define BTUSB_BROKEN_ISOC 0x20
54 #define BTUSB_WRONG_SCO_MTU 0x40
55 #define BTUSB_ATH3012 0x80
56 #define BTUSB_INTEL 0x100
57 #define BTUSB_INTEL_BOOT 0x200
58 #define BTUSB_BCM_PATCHRAM 0x400
59 #define BTUSB_MARVELL 0x800
60 #define BTUSB_SWAVE 0x1000
61 #define BTUSB_INTEL_NEW 0x2000
62 #define BTUSB_AMP 0x4000
63 #define BTUSB_QCA_ROME 0x8000
64 #define BTUSB_BCM_APPLE 0x10000
65 #define BTUSB_REALTEK 0x20000
66 #define BTUSB_BCM2045 0x40000
67 #define BTUSB_IFNUM_2 0x80000
68 #define BTUSB_CW6622 0x100000
69
70 static const struct usb_device_id btusb_table[] = {
71 /* Generic Bluetooth USB device */
72 { USB_DEVICE_INFO(0xe0, 0x01, 0x01) },
73
74 /* Generic Bluetooth AMP device */
75 { USB_DEVICE_INFO(0xe0, 0x01, 0x04), .driver_info = BTUSB_AMP },
76
77 /* Generic Bluetooth USB interface */
78 { USB_INTERFACE_INFO(0xe0, 0x01, 0x01) },
79
80 /* Apple-specific (Broadcom) devices */
81 { USB_VENDOR_AND_INTERFACE_INFO(0x05ac, 0xff, 0x01, 0x01),
82 .driver_info = BTUSB_BCM_APPLE | BTUSB_IFNUM_2 },
83
84 /* MediaTek MT76x0E */
85 { USB_DEVICE(0x0e8d, 0x763f) },
86
87 /* Broadcom SoftSailing reporting vendor specific */
88 { USB_DEVICE(0x0a5c, 0x21e1) },
89
90 /* Apple MacBookPro 7,1 */
91 { USB_DEVICE(0x05ac, 0x8213) },
92
93 /* Apple iMac11,1 */
94 { USB_DEVICE(0x05ac, 0x8215) },
95
96 /* Apple MacBookPro6,2 */
97 { USB_DEVICE(0x05ac, 0x8218) },
98
99 /* Apple MacBookAir3,1, MacBookAir3,2 */
100 { USB_DEVICE(0x05ac, 0x821b) },
101
102 /* Apple MacBookAir4,1 */
103 { USB_DEVICE(0x05ac, 0x821f) },
104
105 /* Apple MacBookPro8,2 */
106 { USB_DEVICE(0x05ac, 0x821a) },
107
108 /* Apple MacMini5,1 */
109 { USB_DEVICE(0x05ac, 0x8281) },
110
111 /* AVM BlueFRITZ! USB v2.0 */
112 { USB_DEVICE(0x057c, 0x3800), .driver_info = BTUSB_SWAVE },
113
114 /* Bluetooth Ultraport Module from IBM */
115 { USB_DEVICE(0x04bf, 0x030a) },
116
117 /* ALPS Modules with non-standard id */
118 { USB_DEVICE(0x044e, 0x3001) },
119 { USB_DEVICE(0x044e, 0x3002) },
120
121 /* Ericsson with non-standard id */
122 { USB_DEVICE(0x0bdb, 0x1002) },
123
124 /* Canyon CN-BTU1 with HID interfaces */
125 { USB_DEVICE(0x0c10, 0x0000) },
126
127 /* Broadcom BCM20702A0 */
128 { USB_DEVICE(0x413c, 0x8197) },
129
130 /* Broadcom BCM20702B0 (Dynex/Insignia) */
131 { USB_DEVICE(0x19ff, 0x0239), .driver_info = BTUSB_BCM_PATCHRAM },
132
133 /* Broadcom BCM43142A0 (Foxconn/Lenovo) */
134 { USB_DEVICE(0x105b, 0xe065), .driver_info = BTUSB_BCM_PATCHRAM },
135
136 /* Broadcom BCM920703 (HTC Vive) */
137 { USB_VENDOR_AND_INTERFACE_INFO(0x0bb4, 0xff, 0x01, 0x01),
138 .driver_info = BTUSB_BCM_PATCHRAM },
139
140 /* Foxconn - Hon Hai */
141 { USB_VENDOR_AND_INTERFACE_INFO(0x0489, 0xff, 0x01, 0x01),
142 .driver_info = BTUSB_BCM_PATCHRAM },
143
144 /* Lite-On Technology - Broadcom based */
145 { USB_VENDOR_AND_INTERFACE_INFO(0x04ca, 0xff, 0x01, 0x01),
146 .driver_info = BTUSB_BCM_PATCHRAM },
147
148 /* Broadcom devices with vendor specific id */
149 { USB_VENDOR_AND_INTERFACE_INFO(0x0a5c, 0xff, 0x01, 0x01),
150 .driver_info = BTUSB_BCM_PATCHRAM },
151
152 /* ASUSTek Computer - Broadcom based */
153 { USB_VENDOR_AND_INTERFACE_INFO(0x0b05, 0xff, 0x01, 0x01),
154 .driver_info = BTUSB_BCM_PATCHRAM },
155
156 /* Belkin F8065bf - Broadcom based */
157 { USB_VENDOR_AND_INTERFACE_INFO(0x050d, 0xff, 0x01, 0x01),
158 .driver_info = BTUSB_BCM_PATCHRAM },
159
160 /* IMC Networks - Broadcom based */
161 { USB_VENDOR_AND_INTERFACE_INFO(0x13d3, 0xff, 0x01, 0x01),
162 .driver_info = BTUSB_BCM_PATCHRAM },
163
164 /* Dell Computer - Broadcom based */
165 { USB_VENDOR_AND_INTERFACE_INFO(0x413c, 0xff, 0x01, 0x01),
166 .driver_info = BTUSB_BCM_PATCHRAM },
167
168 /* Toshiba Corp - Broadcom based */
169 { USB_VENDOR_AND_INTERFACE_INFO(0x0930, 0xff, 0x01, 0x01),
170 .driver_info = BTUSB_BCM_PATCHRAM },
171
172 /* Intel Bluetooth USB Bootloader (RAM module) */
173 { USB_DEVICE(0x8087, 0x0a5a),
174 .driver_info = BTUSB_INTEL_BOOT | BTUSB_BROKEN_ISOC },
175
176 { } /* Terminating entry */
177 };
178
179 MODULE_DEVICE_TABLE(usb, btusb_table);
180
181 static const struct usb_device_id blacklist_table[] = {
182 /* CSR BlueCore devices */
183 { USB_DEVICE(0x0a12, 0x0001), .driver_info = BTUSB_CSR },
184
185 /* Broadcom BCM2033 without firmware */
186 { USB_DEVICE(0x0a5c, 0x2033), .driver_info = BTUSB_IGNORE },
187
188 /* Broadcom BCM2045 devices */
189 { USB_DEVICE(0x0a5c, 0x2045), .driver_info = BTUSB_BCM2045 },
190
191 /* Atheros 3011 with sflash firmware */
192 { USB_DEVICE(0x0489, 0xe027), .driver_info = BTUSB_IGNORE },
193 { USB_DEVICE(0x0489, 0xe03d), .driver_info = BTUSB_IGNORE },
194 { USB_DEVICE(0x04f2, 0xaff1), .driver_info = BTUSB_IGNORE },
195 { USB_DEVICE(0x0930, 0x0215), .driver_info = BTUSB_IGNORE },
196 { USB_DEVICE(0x0cf3, 0x3002), .driver_info = BTUSB_IGNORE },
197 { USB_DEVICE(0x0cf3, 0xe019), .driver_info = BTUSB_IGNORE },
198 { USB_DEVICE(0x13d3, 0x3304), .driver_info = BTUSB_IGNORE },
199
200 /* Atheros AR9285 Malbec with sflash firmware */
201 { USB_DEVICE(0x03f0, 0x311d), .driver_info = BTUSB_IGNORE },
202
203 /* Atheros 3012 with sflash firmware */
204 { USB_DEVICE(0x0489, 0xe04d), .driver_info = BTUSB_ATH3012 },
205 { USB_DEVICE(0x0489, 0xe04e), .driver_info = BTUSB_ATH3012 },
206 { USB_DEVICE(0x0489, 0xe056), .driver_info = BTUSB_ATH3012 },
207 { USB_DEVICE(0x0489, 0xe057), .driver_info = BTUSB_ATH3012 },
208 { USB_DEVICE(0x0489, 0xe05f), .driver_info = BTUSB_ATH3012 },
209 { USB_DEVICE(0x0489, 0xe076), .driver_info = BTUSB_ATH3012 },
210 { USB_DEVICE(0x0489, 0xe078), .driver_info = BTUSB_ATH3012 },
211 { USB_DEVICE(0x0489, 0xe095), .driver_info = BTUSB_ATH3012 },
212 { USB_DEVICE(0x04c5, 0x1330), .driver_info = BTUSB_ATH3012 },
213 { USB_DEVICE(0x04ca, 0x3004), .driver_info = BTUSB_ATH3012 },
214 { USB_DEVICE(0x04ca, 0x3005), .driver_info = BTUSB_ATH3012 },
215 { USB_DEVICE(0x04ca, 0x3006), .driver_info = BTUSB_ATH3012 },
216 { USB_DEVICE(0x04ca, 0x3007), .driver_info = BTUSB_ATH3012 },
217 { USB_DEVICE(0x04ca, 0x3008), .driver_info = BTUSB_ATH3012 },
218 { USB_DEVICE(0x04ca, 0x300b), .driver_info = BTUSB_ATH3012 },
219 { USB_DEVICE(0x04ca, 0x300d), .driver_info = BTUSB_ATH3012 },
220 { USB_DEVICE(0x04ca, 0x300f), .driver_info = BTUSB_ATH3012 },
221 { USB_DEVICE(0x04ca, 0x3010), .driver_info = BTUSB_ATH3012 },
222 { USB_DEVICE(0x04ca, 0x3014), .driver_info = BTUSB_ATH3012 },
223 { USB_DEVICE(0x04ca, 0x3018), .driver_info = BTUSB_ATH3012 },
224 { USB_DEVICE(0x0930, 0x0219), .driver_info = BTUSB_ATH3012 },
225 { USB_DEVICE(0x0930, 0x021c), .driver_info = BTUSB_ATH3012 },
226 { USB_DEVICE(0x0930, 0x0220), .driver_info = BTUSB_ATH3012 },
227 { USB_DEVICE(0x0930, 0x0227), .driver_info = BTUSB_ATH3012 },
228 { USB_DEVICE(0x0b05, 0x17d0), .driver_info = BTUSB_ATH3012 },
229 { USB_DEVICE(0x0cf3, 0x0036), .driver_info = BTUSB_ATH3012 },
230 { USB_DEVICE(0x0cf3, 0x3004), .driver_info = BTUSB_ATH3012 },
231 { USB_DEVICE(0x0cf3, 0x3008), .driver_info = BTUSB_ATH3012 },
232 { USB_DEVICE(0x0cf3, 0x311d), .driver_info = BTUSB_ATH3012 },
233 { USB_DEVICE(0x0cf3, 0x311e), .driver_info = BTUSB_ATH3012 },
234 { USB_DEVICE(0x0cf3, 0x311f), .driver_info = BTUSB_ATH3012 },
235 { USB_DEVICE(0x0cf3, 0x3121), .driver_info = BTUSB_ATH3012 },
236 { USB_DEVICE(0x0cf3, 0x817a), .driver_info = BTUSB_ATH3012 },
237 { USB_DEVICE(0x0cf3, 0x817b), .driver_info = BTUSB_ATH3012 },
238 { USB_DEVICE(0x0cf3, 0xe003), .driver_info = BTUSB_ATH3012 },
239 { USB_DEVICE(0x0cf3, 0xe004), .driver_info = BTUSB_ATH3012 },
240 { USB_DEVICE(0x0cf3, 0xe005), .driver_info = BTUSB_ATH3012 },
241 { USB_DEVICE(0x0cf3, 0xe006), .driver_info = BTUSB_ATH3012 },
242 { USB_DEVICE(0x13d3, 0x3362), .driver_info = BTUSB_ATH3012 },
243 { USB_DEVICE(0x13d3, 0x3375), .driver_info = BTUSB_ATH3012 },
244 { USB_DEVICE(0x13d3, 0x3393), .driver_info = BTUSB_ATH3012 },
245 { USB_DEVICE(0x13d3, 0x3395), .driver_info = BTUSB_ATH3012 },
246 { USB_DEVICE(0x13d3, 0x3402), .driver_info = BTUSB_ATH3012 },
247 { USB_DEVICE(0x13d3, 0x3408), .driver_info = BTUSB_ATH3012 },
248 { USB_DEVICE(0x13d3, 0x3423), .driver_info = BTUSB_ATH3012 },
249 { USB_DEVICE(0x13d3, 0x3432), .driver_info = BTUSB_ATH3012 },
250 { USB_DEVICE(0x13d3, 0x3472), .driver_info = BTUSB_ATH3012 },
251 { USB_DEVICE(0x13d3, 0x3474), .driver_info = BTUSB_ATH3012 },
252 { USB_DEVICE(0x13d3, 0x3487), .driver_info = BTUSB_ATH3012 },
253 { USB_DEVICE(0x13d3, 0x3490), .driver_info = BTUSB_ATH3012 },
254
255 /* Atheros AR5BBU12 with sflash firmware */
256 { USB_DEVICE(0x0489, 0xe02c), .driver_info = BTUSB_IGNORE },
257
258 /* Atheros AR5BBU12 with sflash firmware */
259 { USB_DEVICE(0x0489, 0xe036), .driver_info = BTUSB_ATH3012 },
260 { USB_DEVICE(0x0489, 0xe03c), .driver_info = BTUSB_ATH3012 },
261
262 /* QCA ROME chipset */
263 { USB_DEVICE(0x0cf3, 0xe007), .driver_info = BTUSB_QCA_ROME },
264 { USB_DEVICE(0x0cf3, 0xe009), .driver_info = BTUSB_QCA_ROME },
265 { USB_DEVICE(0x0cf3, 0xe300), .driver_info = BTUSB_QCA_ROME },
266 { USB_DEVICE(0x0cf3, 0xe301), .driver_info = BTUSB_QCA_ROME },
267 { USB_DEVICE(0x0cf3, 0xe360), .driver_info = BTUSB_QCA_ROME },
268 { USB_DEVICE(0x0489, 0xe092), .driver_info = BTUSB_QCA_ROME },
269 { USB_DEVICE(0x0489, 0xe0a2), .driver_info = BTUSB_QCA_ROME },
270 { USB_DEVICE(0x04ca, 0x3011), .driver_info = BTUSB_QCA_ROME },
271
272 /* Broadcom BCM2035 */
273 { USB_DEVICE(0x0a5c, 0x2009), .driver_info = BTUSB_BCM92035 },
274 { USB_DEVICE(0x0a5c, 0x200a), .driver_info = BTUSB_WRONG_SCO_MTU },
275 { USB_DEVICE(0x0a5c, 0x2035), .driver_info = BTUSB_WRONG_SCO_MTU },
276
277 /* Broadcom BCM2045 */
278 { USB_DEVICE(0x0a5c, 0x2039), .driver_info = BTUSB_WRONG_SCO_MTU },
279 { USB_DEVICE(0x0a5c, 0x2101), .driver_info = BTUSB_WRONG_SCO_MTU },
280
281 /* IBM/Lenovo ThinkPad with Broadcom chip */
282 { USB_DEVICE(0x0a5c, 0x201e), .driver_info = BTUSB_WRONG_SCO_MTU },
283 { USB_DEVICE(0x0a5c, 0x2110), .driver_info = BTUSB_WRONG_SCO_MTU },
284
285 /* HP laptop with Broadcom chip */
286 { USB_DEVICE(0x03f0, 0x171d), .driver_info = BTUSB_WRONG_SCO_MTU },
287
288 /* Dell laptop with Broadcom chip */
289 { USB_DEVICE(0x413c, 0x8126), .driver_info = BTUSB_WRONG_SCO_MTU },
290
291 /* Dell Wireless 370 and 410 devices */
292 { USB_DEVICE(0x413c, 0x8152), .driver_info = BTUSB_WRONG_SCO_MTU },
293 { USB_DEVICE(0x413c, 0x8156), .driver_info = BTUSB_WRONG_SCO_MTU },
294
295 /* Belkin F8T012 and F8T013 devices */
296 { USB_DEVICE(0x050d, 0x0012), .driver_info = BTUSB_WRONG_SCO_MTU },
297 { USB_DEVICE(0x050d, 0x0013), .driver_info = BTUSB_WRONG_SCO_MTU },
298
299 /* Asus WL-BTD202 device */
300 { USB_DEVICE(0x0b05, 0x1715), .driver_info = BTUSB_WRONG_SCO_MTU },
301
302 /* Kensington Bluetooth USB adapter */
303 { USB_DEVICE(0x047d, 0x105e), .driver_info = BTUSB_WRONG_SCO_MTU },
304
305 /* RTX Telecom based adapters with buggy SCO support */
306 { USB_DEVICE(0x0400, 0x0807), .driver_info = BTUSB_BROKEN_ISOC },
307 { USB_DEVICE(0x0400, 0x080a), .driver_info = BTUSB_BROKEN_ISOC },
308
309 /* CONWISE Technology based adapters with buggy SCO support */
310 { USB_DEVICE(0x0e5e, 0x6622),
311 .driver_info = BTUSB_BROKEN_ISOC | BTUSB_CW6622},
312
313 /* Roper Class 1 Bluetooth Dongle (Silicon Wave based) */
314 { USB_DEVICE(0x1310, 0x0001), .driver_info = BTUSB_SWAVE },
315
316 /* Digianswer devices */
317 { USB_DEVICE(0x08fd, 0x0001), .driver_info = BTUSB_DIGIANSWER },
318 { USB_DEVICE(0x08fd, 0x0002), .driver_info = BTUSB_IGNORE },
319
320 /* CSR BlueCore Bluetooth Sniffer */
321 { USB_DEVICE(0x0a12, 0x0002),
322 .driver_info = BTUSB_SNIFFER | BTUSB_BROKEN_ISOC },
323
324 /* Frontline ComProbe Bluetooth Sniffer */
325 { USB_DEVICE(0x16d3, 0x0002),
326 .driver_info = BTUSB_SNIFFER | BTUSB_BROKEN_ISOC },
327
328 /* Marvell Bluetooth devices */
329 { USB_DEVICE(0x1286, 0x2044), .driver_info = BTUSB_MARVELL },
330 { USB_DEVICE(0x1286, 0x2046), .driver_info = BTUSB_MARVELL },
331 { USB_DEVICE(0x1286, 0x204e), .driver_info = BTUSB_MARVELL },
332
333 /* Intel Bluetooth devices */
334 { USB_DEVICE(0x8087, 0x0025), .driver_info = BTUSB_INTEL_NEW },
335 { USB_DEVICE(0x8087, 0x07da), .driver_info = BTUSB_CSR },
336 { USB_DEVICE(0x8087, 0x07dc), .driver_info = BTUSB_INTEL },
337 { USB_DEVICE(0x8087, 0x0a2a), .driver_info = BTUSB_INTEL },
338 { USB_DEVICE(0x8087, 0x0a2b), .driver_info = BTUSB_INTEL_NEW },
339 { USB_DEVICE(0x8087, 0x0aa7), .driver_info = BTUSB_INTEL },
340 { USB_DEVICE(0x8087, 0x0aaa), .driver_info = BTUSB_INTEL_NEW },
341
342 /* Other Intel Bluetooth devices */
343 { USB_VENDOR_AND_INTERFACE_INFO(0x8087, 0xe0, 0x01, 0x01),
344 .driver_info = BTUSB_IGNORE },
345
346 /* Realtek Bluetooth devices */
347 { USB_VENDOR_AND_INTERFACE_INFO(0x0bda, 0xe0, 0x01, 0x01),
348 .driver_info = BTUSB_REALTEK },
349
350 /* Additional Realtek 8723AE Bluetooth devices */
351 { USB_DEVICE(0x0930, 0x021d), .driver_info = BTUSB_REALTEK },
352 { USB_DEVICE(0x13d3, 0x3394), .driver_info = BTUSB_REALTEK },
353
354 /* Additional Realtek 8723BE Bluetooth devices */
355 { USB_DEVICE(0x0489, 0xe085), .driver_info = BTUSB_REALTEK },
356 { USB_DEVICE(0x0489, 0xe08b), .driver_info = BTUSB_REALTEK },
357 { USB_DEVICE(0x13d3, 0x3410), .driver_info = BTUSB_REALTEK },
358 { USB_DEVICE(0x13d3, 0x3416), .driver_info = BTUSB_REALTEK },
359 { USB_DEVICE(0x13d3, 0x3459), .driver_info = BTUSB_REALTEK },
360
361 /* Additional Realtek 8821AE Bluetooth devices */
362 { USB_DEVICE(0x0b05, 0x17dc), .driver_info = BTUSB_REALTEK },
363 { USB_DEVICE(0x13d3, 0x3414), .driver_info = BTUSB_REALTEK },
364 { USB_DEVICE(0x13d3, 0x3458), .driver_info = BTUSB_REALTEK },
365 { USB_DEVICE(0x13d3, 0x3461), .driver_info = BTUSB_REALTEK },
366 { USB_DEVICE(0x13d3, 0x3462), .driver_info = BTUSB_REALTEK },
367
368 /* Silicon Wave based devices */
369 { USB_DEVICE(0x0c10, 0x0000), .driver_info = BTUSB_SWAVE },
370
371 { } /* Terminating entry */
372 };
373
374 #define BTUSB_MAX_ISOC_FRAMES 10
375
376 #define BTUSB_INTR_RUNNING 0
377 #define BTUSB_BULK_RUNNING 1
378 #define BTUSB_ISOC_RUNNING 2
379 #define BTUSB_SUSPENDING 3
380 #define BTUSB_DID_ISO_RESUME 4
381 #define BTUSB_BOOTLOADER 5
382 #define BTUSB_DOWNLOADING 6
383 #define BTUSB_FIRMWARE_LOADED 7
384 #define BTUSB_FIRMWARE_FAILED 8
385 #define BTUSB_BOOTING 9
386 #define BTUSB_RESET_RESUME 10
387 #define BTUSB_DIAG_RUNNING 11
388 #define BTUSB_OOB_WAKE_ENABLED 12
389
390 struct btusb_data {
391 struct hci_dev *hdev;
392 struct usb_device *udev;
393 struct usb_interface *intf;
394 struct usb_interface *isoc;
395 struct usb_interface *diag;
396
397 unsigned long flags;
398
399 struct work_struct work;
400 struct work_struct waker;
401
402 struct usb_anchor deferred;
403 struct usb_anchor tx_anchor;
404 int tx_in_flight;
405 spinlock_t txlock;
406
407 struct usb_anchor intr_anchor;
408 struct usb_anchor bulk_anchor;
409 struct usb_anchor isoc_anchor;
410 struct usb_anchor diag_anchor;
411 spinlock_t rxlock;
412
413 struct sk_buff *evt_skb;
414 struct sk_buff *acl_skb;
415 struct sk_buff *sco_skb;
416
417 struct usb_endpoint_descriptor *intr_ep;
418 struct usb_endpoint_descriptor *bulk_tx_ep;
419 struct usb_endpoint_descriptor *bulk_rx_ep;
420 struct usb_endpoint_descriptor *isoc_tx_ep;
421 struct usb_endpoint_descriptor *isoc_rx_ep;
422 struct usb_endpoint_descriptor *diag_tx_ep;
423 struct usb_endpoint_descriptor *diag_rx_ep;
424
425 __u8 cmdreq_type;
426 __u8 cmdreq;
427
428 unsigned int sco_num;
429 int isoc_altsetting;
430 int suspend_count;
431
432 int (*recv_event)(struct hci_dev *hdev, struct sk_buff *skb);
433 int (*recv_bulk)(struct btusb_data *data, void *buffer, int count);
434
435 int (*setup_on_usb)(struct hci_dev *hdev);
436
437 int oob_wake_irq; /* irq for out-of-band wake-on-bt */
438 };
439
440 static inline void btusb_free_frags(struct btusb_data *data)
441 {
442 unsigned long flags;
443
444 spin_lock_irqsave(&data->rxlock, flags);
445
446 kfree_skb(data->evt_skb);
447 data->evt_skb = NULL;
448
449 kfree_skb(data->acl_skb);
450 data->acl_skb = NULL;
451
452 kfree_skb(data->sco_skb);
453 data->sco_skb = NULL;
454
455 spin_unlock_irqrestore(&data->rxlock, flags);
456 }
457
458 static int btusb_recv_intr(struct btusb_data *data, void *buffer, int count)
459 {
460 struct sk_buff *skb;
461 int err = 0;
462
463 spin_lock(&data->rxlock);
464 skb = data->evt_skb;
465
466 while (count) {
467 int len;
468
469 if (!skb) {
470 skb = bt_skb_alloc(HCI_MAX_EVENT_SIZE, GFP_ATOMIC);
471 if (!skb) {
472 err = -ENOMEM;
473 break;
474 }
475
476 hci_skb_pkt_type(skb) = HCI_EVENT_PKT;
477 hci_skb_expect(skb) = HCI_EVENT_HDR_SIZE;
478 }
479
480 len = min_t(uint, hci_skb_expect(skb), count);
481 skb_put_data(skb, buffer, len);
482
483 count -= len;
484 buffer += len;
485 hci_skb_expect(skb) -= len;
486
487 if (skb->len == HCI_EVENT_HDR_SIZE) {
488 /* Complete event header */
489 hci_skb_expect(skb) = hci_event_hdr(skb)->plen;
490
491 if (skb_tailroom(skb) < hci_skb_expect(skb)) {
492 kfree_skb(skb);
493 skb = NULL;
494
495 err = -EILSEQ;
496 break;
497 }
498 }
499
500 if (!hci_skb_expect(skb)) {
501 /* Complete frame */
502 data->recv_event(data->hdev, skb);
503 skb = NULL;
504 }
505 }
506
507 data->evt_skb = skb;
508 spin_unlock(&data->rxlock);
509
510 return err;
511 }
512
513 static int btusb_recv_bulk(struct btusb_data *data, void *buffer, int count)
514 {
515 struct sk_buff *skb;
516 int err = 0;
517
518 spin_lock(&data->rxlock);
519 skb = data->acl_skb;
520
521 while (count) {
522 int len;
523
524 if (!skb) {
525 skb = bt_skb_alloc(HCI_MAX_FRAME_SIZE, GFP_ATOMIC);
526 if (!skb) {
527 err = -ENOMEM;
528 break;
529 }
530
531 hci_skb_pkt_type(skb) = HCI_ACLDATA_PKT;
532 hci_skb_expect(skb) = HCI_ACL_HDR_SIZE;
533 }
534
535 len = min_t(uint, hci_skb_expect(skb), count);
536 skb_put_data(skb, buffer, len);
537
538 count -= len;
539 buffer += len;
540 hci_skb_expect(skb) -= len;
541
542 if (skb->len == HCI_ACL_HDR_SIZE) {
543 __le16 dlen = hci_acl_hdr(skb)->dlen;
544
545 /* Complete ACL header */
546 hci_skb_expect(skb) = __le16_to_cpu(dlen);
547
548 if (skb_tailroom(skb) < hci_skb_expect(skb)) {
549 kfree_skb(skb);
550 skb = NULL;
551
552 err = -EILSEQ;
553 break;
554 }
555 }
556
557 if (!hci_skb_expect(skb)) {
558 /* Complete frame */
559 hci_recv_frame(data->hdev, skb);
560 skb = NULL;
561 }
562 }
563
564 data->acl_skb = skb;
565 spin_unlock(&data->rxlock);
566
567 return err;
568 }
569
570 static int btusb_recv_isoc(struct btusb_data *data, void *buffer, int count)
571 {
572 struct sk_buff *skb;
573 int err = 0;
574
575 spin_lock(&data->rxlock);
576 skb = data->sco_skb;
577
578 while (count) {
579 int len;
580
581 if (!skb) {
582 skb = bt_skb_alloc(HCI_MAX_SCO_SIZE, GFP_ATOMIC);
583 if (!skb) {
584 err = -ENOMEM;
585 break;
586 }
587
588 hci_skb_pkt_type(skb) = HCI_SCODATA_PKT;
589 hci_skb_expect(skb) = HCI_SCO_HDR_SIZE;
590 }
591
592 len = min_t(uint, hci_skb_expect(skb), count);
593 skb_put_data(skb, buffer, len);
594
595 count -= len;
596 buffer += len;
597 hci_skb_expect(skb) -= len;
598
599 if (skb->len == HCI_SCO_HDR_SIZE) {
600 /* Complete SCO header */
601 hci_skb_expect(skb) = hci_sco_hdr(skb)->dlen;
602
603 if (skb_tailroom(skb) < hci_skb_expect(skb)) {
604 kfree_skb(skb);
605 skb = NULL;
606
607 err = -EILSEQ;
608 break;
609 }
610 }
611
612 if (!hci_skb_expect(skb)) {
613 /* Complete frame */
614 hci_recv_frame(data->hdev, skb);
615 skb = NULL;
616 }
617 }
618
619 data->sco_skb = skb;
620 spin_unlock(&data->rxlock);
621
622 return err;
623 }
624
625 static void btusb_intr_complete(struct urb *urb)
626 {
627 struct hci_dev *hdev = urb->context;
628 struct btusb_data *data = hci_get_drvdata(hdev);
629 int err;
630
631 BT_DBG("%s urb %p status %d count %d", hdev->name, urb, urb->status,
632 urb->actual_length);
633
634 if (!test_bit(HCI_RUNNING, &hdev->flags))
635 return;
636
637 if (urb->status == 0) {
638 hdev->stat.byte_rx += urb->actual_length;
639
640 if (btusb_recv_intr(data, urb->transfer_buffer,
641 urb->actual_length) < 0) {
642 BT_ERR("%s corrupted event packet", hdev->name);
643 hdev->stat.err_rx++;
644 }
645 } else if (urb->status == -ENOENT) {
646 /* Avoid suspend failed when usb_kill_urb */
647 return;
648 }
649
650 if (!test_bit(BTUSB_INTR_RUNNING, &data->flags))
651 return;
652
653 usb_mark_last_busy(data->udev);
654 usb_anchor_urb(urb, &data->intr_anchor);
655
656 err = usb_submit_urb(urb, GFP_ATOMIC);
657 if (err < 0) {
658 /* -EPERM: urb is being killed;
659 * -ENODEV: device got disconnected */
660 if (err != -EPERM && err != -ENODEV)
661 BT_ERR("%s urb %p failed to resubmit (%d)",
662 hdev->name, urb, -err);
663 usb_unanchor_urb(urb);
664 }
665 }
666
667 static int btusb_submit_intr_urb(struct hci_dev *hdev, gfp_t mem_flags)
668 {
669 struct btusb_data *data = hci_get_drvdata(hdev);
670 struct urb *urb;
671 unsigned char *buf;
672 unsigned int pipe;
673 int err, size;
674
675 BT_DBG("%s", hdev->name);
676
677 if (!data->intr_ep)
678 return -ENODEV;
679
680 urb = usb_alloc_urb(0, mem_flags);
681 if (!urb)
682 return -ENOMEM;
683
684 size = le16_to_cpu(data->intr_ep->wMaxPacketSize);
685
686 buf = kmalloc(size, mem_flags);
687 if (!buf) {
688 usb_free_urb(urb);
689 return -ENOMEM;
690 }
691
692 pipe = usb_rcvintpipe(data->udev, data->intr_ep->bEndpointAddress);
693
694 usb_fill_int_urb(urb, data->udev, pipe, buf, size,
695 btusb_intr_complete, hdev, data->intr_ep->bInterval);
696
697 urb->transfer_flags |= URB_FREE_BUFFER;
698
699 usb_anchor_urb(urb, &data->intr_anchor);
700
701 err = usb_submit_urb(urb, mem_flags);
702 if (err < 0) {
703 if (err != -EPERM && err != -ENODEV)
704 BT_ERR("%s urb %p submission failed (%d)",
705 hdev->name, urb, -err);
706 usb_unanchor_urb(urb);
707 }
708
709 usb_free_urb(urb);
710
711 return err;
712 }
713
714 static void btusb_bulk_complete(struct urb *urb)
715 {
716 struct hci_dev *hdev = urb->context;
717 struct btusb_data *data = hci_get_drvdata(hdev);
718 int err;
719
720 BT_DBG("%s urb %p status %d count %d", hdev->name, urb, urb->status,
721 urb->actual_length);
722
723 if (!test_bit(HCI_RUNNING, &hdev->flags))
724 return;
725
726 if (urb->status == 0) {
727 hdev->stat.byte_rx += urb->actual_length;
728
729 if (data->recv_bulk(data, urb->transfer_buffer,
730 urb->actual_length) < 0) {
731 BT_ERR("%s corrupted ACL packet", hdev->name);
732 hdev->stat.err_rx++;
733 }
734 } else if (urb->status == -ENOENT) {
735 /* Avoid suspend failed when usb_kill_urb */
736 return;
737 }
738
739 if (!test_bit(BTUSB_BULK_RUNNING, &data->flags))
740 return;
741
742 usb_anchor_urb(urb, &data->bulk_anchor);
743 usb_mark_last_busy(data->udev);
744
745 err = usb_submit_urb(urb, GFP_ATOMIC);
746 if (err < 0) {
747 /* -EPERM: urb is being killed;
748 * -ENODEV: device got disconnected */
749 if (err != -EPERM && err != -ENODEV)
750 BT_ERR("%s urb %p failed to resubmit (%d)",
751 hdev->name, urb, -err);
752 usb_unanchor_urb(urb);
753 }
754 }
755
756 static int btusb_submit_bulk_urb(struct hci_dev *hdev, gfp_t mem_flags)
757 {
758 struct btusb_data *data = hci_get_drvdata(hdev);
759 struct urb *urb;
760 unsigned char *buf;
761 unsigned int pipe;
762 int err, size = HCI_MAX_FRAME_SIZE;
763
764 BT_DBG("%s", hdev->name);
765
766 if (!data->bulk_rx_ep)
767 return -ENODEV;
768
769 urb = usb_alloc_urb(0, mem_flags);
770 if (!urb)
771 return -ENOMEM;
772
773 buf = kmalloc(size, mem_flags);
774 if (!buf) {
775 usb_free_urb(urb);
776 return -ENOMEM;
777 }
778
779 pipe = usb_rcvbulkpipe(data->udev, data->bulk_rx_ep->bEndpointAddress);
780
781 usb_fill_bulk_urb(urb, data->udev, pipe, buf, size,
782 btusb_bulk_complete, hdev);
783
784 urb->transfer_flags |= URB_FREE_BUFFER;
785
786 usb_mark_last_busy(data->udev);
787 usb_anchor_urb(urb, &data->bulk_anchor);
788
789 err = usb_submit_urb(urb, mem_flags);
790 if (err < 0) {
791 if (err != -EPERM && err != -ENODEV)
792 BT_ERR("%s urb %p submission failed (%d)",
793 hdev->name, urb, -err);
794 usb_unanchor_urb(urb);
795 }
796
797 usb_free_urb(urb);
798
799 return err;
800 }
801
802 static void btusb_isoc_complete(struct urb *urb)
803 {
804 struct hci_dev *hdev = urb->context;
805 struct btusb_data *data = hci_get_drvdata(hdev);
806 int i, err;
807
808 BT_DBG("%s urb %p status %d count %d", hdev->name, urb, urb->status,
809 urb->actual_length);
810
811 if (!test_bit(HCI_RUNNING, &hdev->flags))
812 return;
813
814 if (urb->status == 0) {
815 for (i = 0; i < urb->number_of_packets; i++) {
816 unsigned int offset = urb->iso_frame_desc[i].offset;
817 unsigned int length = urb->iso_frame_desc[i].actual_length;
818
819 if (urb->iso_frame_desc[i].status)
820 continue;
821
822 hdev->stat.byte_rx += length;
823
824 if (btusb_recv_isoc(data, urb->transfer_buffer + offset,
825 length) < 0) {
826 BT_ERR("%s corrupted SCO packet", hdev->name);
827 hdev->stat.err_rx++;
828 }
829 }
830 } else if (urb->status == -ENOENT) {
831 /* Avoid suspend failed when usb_kill_urb */
832 return;
833 }
834
835 if (!test_bit(BTUSB_ISOC_RUNNING, &data->flags))
836 return;
837
838 usb_anchor_urb(urb, &data->isoc_anchor);
839
840 err = usb_submit_urb(urb, GFP_ATOMIC);
841 if (err < 0) {
842 /* -EPERM: urb is being killed;
843 * -ENODEV: device got disconnected */
844 if (err != -EPERM && err != -ENODEV)
845 BT_ERR("%s urb %p failed to resubmit (%d)",
846 hdev->name, urb, -err);
847 usb_unanchor_urb(urb);
848 }
849 }
850
851 static inline void __fill_isoc_descriptor(struct urb *urb, int len, int mtu)
852 {
853 int i, offset = 0;
854
855 BT_DBG("len %d mtu %d", len, mtu);
856
857 for (i = 0; i < BTUSB_MAX_ISOC_FRAMES && len >= mtu;
858 i++, offset += mtu, len -= mtu) {
859 urb->iso_frame_desc[i].offset = offset;
860 urb->iso_frame_desc[i].length = mtu;
861 }
862
863 if (len && i < BTUSB_MAX_ISOC_FRAMES) {
864 urb->iso_frame_desc[i].offset = offset;
865 urb->iso_frame_desc[i].length = len;
866 i++;
867 }
868
869 urb->number_of_packets = i;
870 }
871
872 static int btusb_submit_isoc_urb(struct hci_dev *hdev, gfp_t mem_flags)
873 {
874 struct btusb_data *data = hci_get_drvdata(hdev);
875 struct urb *urb;
876 unsigned char *buf;
877 unsigned int pipe;
878 int err, size;
879
880 BT_DBG("%s", hdev->name);
881
882 if (!data->isoc_rx_ep)
883 return -ENODEV;
884
885 urb = usb_alloc_urb(BTUSB_MAX_ISOC_FRAMES, mem_flags);
886 if (!urb)
887 return -ENOMEM;
888
889 size = le16_to_cpu(data->isoc_rx_ep->wMaxPacketSize) *
890 BTUSB_MAX_ISOC_FRAMES;
891
892 buf = kmalloc(size, mem_flags);
893 if (!buf) {
894 usb_free_urb(urb);
895 return -ENOMEM;
896 }
897
898 pipe = usb_rcvisocpipe(data->udev, data->isoc_rx_ep->bEndpointAddress);
899
900 usb_fill_int_urb(urb, data->udev, pipe, buf, size, btusb_isoc_complete,
901 hdev, data->isoc_rx_ep->bInterval);
902
903 urb->transfer_flags = URB_FREE_BUFFER | URB_ISO_ASAP;
904
905 __fill_isoc_descriptor(urb, size,
906 le16_to_cpu(data->isoc_rx_ep->wMaxPacketSize));
907
908 usb_anchor_urb(urb, &data->isoc_anchor);
909
910 err = usb_submit_urb(urb, mem_flags);
911 if (err < 0) {
912 if (err != -EPERM && err != -ENODEV)
913 BT_ERR("%s urb %p submission failed (%d)",
914 hdev->name, urb, -err);
915 usb_unanchor_urb(urb);
916 }
917
918 usb_free_urb(urb);
919
920 return err;
921 }
922
923 static void btusb_diag_complete(struct urb *urb)
924 {
925 struct hci_dev *hdev = urb->context;
926 struct btusb_data *data = hci_get_drvdata(hdev);
927 int err;
928
929 BT_DBG("%s urb %p status %d count %d", hdev->name, urb, urb->status,
930 urb->actual_length);
931
932 if (urb->status == 0) {
933 struct sk_buff *skb;
934
935 skb = bt_skb_alloc(urb->actual_length, GFP_ATOMIC);
936 if (skb) {
937 skb_put_data(skb, urb->transfer_buffer,
938 urb->actual_length);
939 hci_recv_diag(hdev, skb);
940 }
941 } else if (urb->status == -ENOENT) {
942 /* Avoid suspend failed when usb_kill_urb */
943 return;
944 }
945
946 if (!test_bit(BTUSB_DIAG_RUNNING, &data->flags))
947 return;
948
949 usb_anchor_urb(urb, &data->diag_anchor);
950 usb_mark_last_busy(data->udev);
951
952 err = usb_submit_urb(urb, GFP_ATOMIC);
953 if (err < 0) {
954 /* -EPERM: urb is being killed;
955 * -ENODEV: device got disconnected */
956 if (err != -EPERM && err != -ENODEV)
957 BT_ERR("%s urb %p failed to resubmit (%d)",
958 hdev->name, urb, -err);
959 usb_unanchor_urb(urb);
960 }
961 }
962
963 static int btusb_submit_diag_urb(struct hci_dev *hdev, gfp_t mem_flags)
964 {
965 struct btusb_data *data = hci_get_drvdata(hdev);
966 struct urb *urb;
967 unsigned char *buf;
968 unsigned int pipe;
969 int err, size = HCI_MAX_FRAME_SIZE;
970
971 BT_DBG("%s", hdev->name);
972
973 if (!data->diag_rx_ep)
974 return -ENODEV;
975
976 urb = usb_alloc_urb(0, mem_flags);
977 if (!urb)
978 return -ENOMEM;
979
980 buf = kmalloc(size, mem_flags);
981 if (!buf) {
982 usb_free_urb(urb);
983 return -ENOMEM;
984 }
985
986 pipe = usb_rcvbulkpipe(data->udev, data->diag_rx_ep->bEndpointAddress);
987
988 usb_fill_bulk_urb(urb, data->udev, pipe, buf, size,
989 btusb_diag_complete, hdev);
990
991 urb->transfer_flags |= URB_FREE_BUFFER;
992
993 usb_mark_last_busy(data->udev);
994 usb_anchor_urb(urb, &data->diag_anchor);
995
996 err = usb_submit_urb(urb, mem_flags);
997 if (err < 0) {
998 if (err != -EPERM && err != -ENODEV)
999 BT_ERR("%s urb %p submission failed (%d)",
1000 hdev->name, urb, -err);
1001 usb_unanchor_urb(urb);
1002 }
1003
1004 usb_free_urb(urb);
1005
1006 return err;
1007 }
1008
1009 static void btusb_tx_complete(struct urb *urb)
1010 {
1011 struct sk_buff *skb = urb->context;
1012 struct hci_dev *hdev = (struct hci_dev *)skb->dev;
1013 struct btusb_data *data = hci_get_drvdata(hdev);
1014
1015 BT_DBG("%s urb %p status %d count %d", hdev->name, urb, urb->status,
1016 urb->actual_length);
1017
1018 if (!test_bit(HCI_RUNNING, &hdev->flags))
1019 goto done;
1020
1021 if (!urb->status)
1022 hdev->stat.byte_tx += urb->transfer_buffer_length;
1023 else
1024 hdev->stat.err_tx++;
1025
1026 done:
1027 spin_lock(&data->txlock);
1028 data->tx_in_flight--;
1029 spin_unlock(&data->txlock);
1030
1031 kfree(urb->setup_packet);
1032
1033 kfree_skb(skb);
1034 }
1035
1036 static void btusb_isoc_tx_complete(struct urb *urb)
1037 {
1038 struct sk_buff *skb = urb->context;
1039 struct hci_dev *hdev = (struct hci_dev *)skb->dev;
1040
1041 BT_DBG("%s urb %p status %d count %d", hdev->name, urb, urb->status,
1042 urb->actual_length);
1043
1044 if (!test_bit(HCI_RUNNING, &hdev->flags))
1045 goto done;
1046
1047 if (!urb->status)
1048 hdev->stat.byte_tx += urb->transfer_buffer_length;
1049 else
1050 hdev->stat.err_tx++;
1051
1052 done:
1053 kfree(urb->setup_packet);
1054
1055 kfree_skb(skb);
1056 }
1057
1058 static int btusb_open(struct hci_dev *hdev)
1059 {
1060 struct btusb_data *data = hci_get_drvdata(hdev);
1061 int err;
1062
1063 BT_DBG("%s", hdev->name);
1064
1065 err = usb_autopm_get_interface(data->intf);
1066 if (err < 0)
1067 return err;
1068
1069 /* Patching USB firmware files prior to starting any URBs of HCI path
1070 * It is more safe to use USB bulk channel for downloading USB patch
1071 */
1072 if (data->setup_on_usb) {
1073 err = data->setup_on_usb(hdev);
1074 if (err < 0)
1075 return err;
1076 }
1077
1078 data->intf->needs_remote_wakeup = 1;
1079
1080 if (test_and_set_bit(BTUSB_INTR_RUNNING, &data->flags))
1081 goto done;
1082
1083 err = btusb_submit_intr_urb(hdev, GFP_KERNEL);
1084 if (err < 0)
1085 goto failed;
1086
1087 err = btusb_submit_bulk_urb(hdev, GFP_KERNEL);
1088 if (err < 0) {
1089 usb_kill_anchored_urbs(&data->intr_anchor);
1090 goto failed;
1091 }
1092
1093 set_bit(BTUSB_BULK_RUNNING, &data->flags);
1094 btusb_submit_bulk_urb(hdev, GFP_KERNEL);
1095
1096 if (data->diag) {
1097 if (!btusb_submit_diag_urb(hdev, GFP_KERNEL))
1098 set_bit(BTUSB_DIAG_RUNNING, &data->flags);
1099 }
1100
1101 done:
1102 usb_autopm_put_interface(data->intf);
1103 return 0;
1104
1105 failed:
1106 clear_bit(BTUSB_INTR_RUNNING, &data->flags);
1107 usb_autopm_put_interface(data->intf);
1108 return err;
1109 }
1110
1111 static void btusb_stop_traffic(struct btusb_data *data)
1112 {
1113 usb_kill_anchored_urbs(&data->intr_anchor);
1114 usb_kill_anchored_urbs(&data->bulk_anchor);
1115 usb_kill_anchored_urbs(&data->isoc_anchor);
1116 usb_kill_anchored_urbs(&data->diag_anchor);
1117 }
1118
1119 static int btusb_close(struct hci_dev *hdev)
1120 {
1121 struct btusb_data *data = hci_get_drvdata(hdev);
1122 int err;
1123
1124 BT_DBG("%s", hdev->name);
1125
1126 cancel_work_sync(&data->work);
1127 cancel_work_sync(&data->waker);
1128
1129 clear_bit(BTUSB_ISOC_RUNNING, &data->flags);
1130 clear_bit(BTUSB_BULK_RUNNING, &data->flags);
1131 clear_bit(BTUSB_INTR_RUNNING, &data->flags);
1132 clear_bit(BTUSB_DIAG_RUNNING, &data->flags);
1133
1134 btusb_stop_traffic(data);
1135 btusb_free_frags(data);
1136
1137 err = usb_autopm_get_interface(data->intf);
1138 if (err < 0)
1139 goto failed;
1140
1141 data->intf->needs_remote_wakeup = 0;
1142 usb_autopm_put_interface(data->intf);
1143
1144 failed:
1145 usb_scuttle_anchored_urbs(&data->deferred);
1146 return 0;
1147 }
1148
1149 static int btusb_flush(struct hci_dev *hdev)
1150 {
1151 struct btusb_data *data = hci_get_drvdata(hdev);
1152
1153 BT_DBG("%s", hdev->name);
1154
1155 usb_kill_anchored_urbs(&data->tx_anchor);
1156 btusb_free_frags(data);
1157
1158 return 0;
1159 }
1160
1161 static struct urb *alloc_ctrl_urb(struct hci_dev *hdev, struct sk_buff *skb)
1162 {
1163 struct btusb_data *data = hci_get_drvdata(hdev);
1164 struct usb_ctrlrequest *dr;
1165 struct urb *urb;
1166 unsigned int pipe;
1167
1168 urb = usb_alloc_urb(0, GFP_KERNEL);
1169 if (!urb)
1170 return ERR_PTR(-ENOMEM);
1171
1172 dr = kmalloc(sizeof(*dr), GFP_KERNEL);
1173 if (!dr) {
1174 usb_free_urb(urb);
1175 return ERR_PTR(-ENOMEM);
1176 }
1177
1178 dr->bRequestType = data->cmdreq_type;
1179 dr->bRequest = data->cmdreq;
1180 dr->wIndex = 0;
1181 dr->wValue = 0;
1182 dr->wLength = __cpu_to_le16(skb->len);
1183
1184 pipe = usb_sndctrlpipe(data->udev, 0x00);
1185
1186 usb_fill_control_urb(urb, data->udev, pipe, (void *)dr,
1187 skb->data, skb->len, btusb_tx_complete, skb);
1188
1189 skb->dev = (void *)hdev;
1190
1191 return urb;
1192 }
1193
1194 static struct urb *alloc_bulk_urb(struct hci_dev *hdev, struct sk_buff *skb)
1195 {
1196 struct btusb_data *data = hci_get_drvdata(hdev);
1197 struct urb *urb;
1198 unsigned int pipe;
1199
1200 if (!data->bulk_tx_ep)
1201 return ERR_PTR(-ENODEV);
1202
1203 urb = usb_alloc_urb(0, GFP_KERNEL);
1204 if (!urb)
1205 return ERR_PTR(-ENOMEM);
1206
1207 pipe = usb_sndbulkpipe(data->udev, data->bulk_tx_ep->bEndpointAddress);
1208
1209 usb_fill_bulk_urb(urb, data->udev, pipe,
1210 skb->data, skb->len, btusb_tx_complete, skb);
1211
1212 skb->dev = (void *)hdev;
1213
1214 return urb;
1215 }
1216
1217 static struct urb *alloc_isoc_urb(struct hci_dev *hdev, struct sk_buff *skb)
1218 {
1219 struct btusb_data *data = hci_get_drvdata(hdev);
1220 struct urb *urb;
1221 unsigned int pipe;
1222
1223 if (!data->isoc_tx_ep)
1224 return ERR_PTR(-ENODEV);
1225
1226 urb = usb_alloc_urb(BTUSB_MAX_ISOC_FRAMES, GFP_KERNEL);
1227 if (!urb)
1228 return ERR_PTR(-ENOMEM);
1229
1230 pipe = usb_sndisocpipe(data->udev, data->isoc_tx_ep->bEndpointAddress);
1231
1232 usb_fill_int_urb(urb, data->udev, pipe,
1233 skb->data, skb->len, btusb_isoc_tx_complete,
1234 skb, data->isoc_tx_ep->bInterval);
1235
1236 urb->transfer_flags = URB_ISO_ASAP;
1237
1238 __fill_isoc_descriptor(urb, skb->len,
1239 le16_to_cpu(data->isoc_tx_ep->wMaxPacketSize));
1240
1241 skb->dev = (void *)hdev;
1242
1243 return urb;
1244 }
1245
1246 static int submit_tx_urb(struct hci_dev *hdev, struct urb *urb)
1247 {
1248 struct btusb_data *data = hci_get_drvdata(hdev);
1249 int err;
1250
1251 usb_anchor_urb(urb, &data->tx_anchor);
1252
1253 err = usb_submit_urb(urb, GFP_KERNEL);
1254 if (err < 0) {
1255 if (err != -EPERM && err != -ENODEV)
1256 BT_ERR("%s urb %p submission failed (%d)",
1257 hdev->name, urb, -err);
1258 kfree(urb->setup_packet);
1259 usb_unanchor_urb(urb);
1260 } else {
1261 usb_mark_last_busy(data->udev);
1262 }
1263
1264 usb_free_urb(urb);
1265 return err;
1266 }
1267
1268 static int submit_or_queue_tx_urb(struct hci_dev *hdev, struct urb *urb)
1269 {
1270 struct btusb_data *data = hci_get_drvdata(hdev);
1271 unsigned long flags;
1272 bool suspending;
1273
1274 spin_lock_irqsave(&data->txlock, flags);
1275 suspending = test_bit(BTUSB_SUSPENDING, &data->flags);
1276 if (!suspending)
1277 data->tx_in_flight++;
1278 spin_unlock_irqrestore(&data->txlock, flags);
1279
1280 if (!suspending)
1281 return submit_tx_urb(hdev, urb);
1282
1283 usb_anchor_urb(urb, &data->deferred);
1284 schedule_work(&data->waker);
1285
1286 usb_free_urb(urb);
1287 return 0;
1288 }
1289
1290 static int btusb_send_frame(struct hci_dev *hdev, struct sk_buff *skb)
1291 {
1292 struct urb *urb;
1293
1294 BT_DBG("%s", hdev->name);
1295
1296 switch (hci_skb_pkt_type(skb)) {
1297 case HCI_COMMAND_PKT:
1298 urb = alloc_ctrl_urb(hdev, skb);
1299 if (IS_ERR(urb))
1300 return PTR_ERR(urb);
1301
1302 hdev->stat.cmd_tx++;
1303 return submit_or_queue_tx_urb(hdev, urb);
1304
1305 case HCI_ACLDATA_PKT:
1306 urb = alloc_bulk_urb(hdev, skb);
1307 if (IS_ERR(urb))
1308 return PTR_ERR(urb);
1309
1310 hdev->stat.acl_tx++;
1311 return submit_or_queue_tx_urb(hdev, urb);
1312
1313 case HCI_SCODATA_PKT:
1314 if (hci_conn_num(hdev, SCO_LINK) < 1)
1315 return -ENODEV;
1316
1317 urb = alloc_isoc_urb(hdev, skb);
1318 if (IS_ERR(urb))
1319 return PTR_ERR(urb);
1320
1321 hdev->stat.sco_tx++;
1322 return submit_tx_urb(hdev, urb);
1323 }
1324
1325 return -EILSEQ;
1326 }
1327
1328 static void btusb_notify(struct hci_dev *hdev, unsigned int evt)
1329 {
1330 struct btusb_data *data = hci_get_drvdata(hdev);
1331
1332 BT_DBG("%s evt %d", hdev->name, evt);
1333
1334 if (hci_conn_num(hdev, SCO_LINK) != data->sco_num) {
1335 data->sco_num = hci_conn_num(hdev, SCO_LINK);
1336 schedule_work(&data->work);
1337 }
1338 }
1339
1340 static inline int __set_isoc_interface(struct hci_dev *hdev, int altsetting)
1341 {
1342 struct btusb_data *data = hci_get_drvdata(hdev);
1343 struct usb_interface *intf = data->isoc;
1344 struct usb_endpoint_descriptor *ep_desc;
1345 int i, err;
1346
1347 if (!data->isoc)
1348 return -ENODEV;
1349
1350 err = usb_set_interface(data->udev, 1, altsetting);
1351 if (err < 0) {
1352 BT_ERR("%s setting interface failed (%d)", hdev->name, -err);
1353 return err;
1354 }
1355
1356 data->isoc_altsetting = altsetting;
1357
1358 data->isoc_tx_ep = NULL;
1359 data->isoc_rx_ep = NULL;
1360
1361 for (i = 0; i < intf->cur_altsetting->desc.bNumEndpoints; i++) {
1362 ep_desc = &intf->cur_altsetting->endpoint[i].desc;
1363
1364 if (!data->isoc_tx_ep && usb_endpoint_is_isoc_out(ep_desc)) {
1365 data->isoc_tx_ep = ep_desc;
1366 continue;
1367 }
1368
1369 if (!data->isoc_rx_ep && usb_endpoint_is_isoc_in(ep_desc)) {
1370 data->isoc_rx_ep = ep_desc;
1371 continue;
1372 }
1373 }
1374
1375 if (!data->isoc_tx_ep || !data->isoc_rx_ep) {
1376 BT_ERR("%s invalid SCO descriptors", hdev->name);
1377 return -ENODEV;
1378 }
1379
1380 return 0;
1381 }
1382
1383 static void btusb_work(struct work_struct *work)
1384 {
1385 struct btusb_data *data = container_of(work, struct btusb_data, work);
1386 struct hci_dev *hdev = data->hdev;
1387 int new_alts;
1388 int err;
1389
1390 if (data->sco_num > 0) {
1391 if (!test_bit(BTUSB_DID_ISO_RESUME, &data->flags)) {
1392 err = usb_autopm_get_interface(data->isoc ? data->isoc : data->intf);
1393 if (err < 0) {
1394 clear_bit(BTUSB_ISOC_RUNNING, &data->flags);
1395 usb_kill_anchored_urbs(&data->isoc_anchor);
1396 return;
1397 }
1398
1399 set_bit(BTUSB_DID_ISO_RESUME, &data->flags);
1400 }
1401
1402 if (hdev->voice_setting & 0x0020) {
1403 static const int alts[3] = { 2, 4, 5 };
1404
1405 new_alts = alts[data->sco_num - 1];
1406 } else {
1407 new_alts = data->sco_num;
1408 }
1409
1410 if (data->isoc_altsetting != new_alts) {
1411 unsigned long flags;
1412
1413 clear_bit(BTUSB_ISOC_RUNNING, &data->flags);
1414 usb_kill_anchored_urbs(&data->isoc_anchor);
1415
1416 /* When isochronous alternate setting needs to be
1417 * changed, because SCO connection has been added
1418 * or removed, a packet fragment may be left in the
1419 * reassembling state. This could lead to wrongly
1420 * assembled fragments.
1421 *
1422 * Clear outstanding fragment when selecting a new
1423 * alternate setting.
1424 */
1425 spin_lock_irqsave(&data->rxlock, flags);
1426 kfree_skb(data->sco_skb);
1427 data->sco_skb = NULL;
1428 spin_unlock_irqrestore(&data->rxlock, flags);
1429
1430 if (__set_isoc_interface(hdev, new_alts) < 0)
1431 return;
1432 }
1433
1434 if (!test_and_set_bit(BTUSB_ISOC_RUNNING, &data->flags)) {
1435 if (btusb_submit_isoc_urb(hdev, GFP_KERNEL) < 0)
1436 clear_bit(BTUSB_ISOC_RUNNING, &data->flags);
1437 else
1438 btusb_submit_isoc_urb(hdev, GFP_KERNEL);
1439 }
1440 } else {
1441 clear_bit(BTUSB_ISOC_RUNNING, &data->flags);
1442 usb_kill_anchored_urbs(&data->isoc_anchor);
1443
1444 __set_isoc_interface(hdev, 0);
1445 if (test_and_clear_bit(BTUSB_DID_ISO_RESUME, &data->flags))
1446 usb_autopm_put_interface(data->isoc ? data->isoc : data->intf);
1447 }
1448 }
1449
1450 static void btusb_waker(struct work_struct *work)
1451 {
1452 struct btusb_data *data = container_of(work, struct btusb_data, waker);
1453 int err;
1454
1455 err = usb_autopm_get_interface(data->intf);
1456 if (err < 0)
1457 return;
1458
1459 usb_autopm_put_interface(data->intf);
1460 }
1461
1462 static int btusb_setup_bcm92035(struct hci_dev *hdev)
1463 {
1464 struct sk_buff *skb;
1465 u8 val = 0x00;
1466
1467 BT_DBG("%s", hdev->name);
1468
1469 skb = __hci_cmd_sync(hdev, 0xfc3b, 1, &val, HCI_INIT_TIMEOUT);
1470 if (IS_ERR(skb))
1471 BT_ERR("BCM92035 command failed (%ld)", -PTR_ERR(skb));
1472 else
1473 kfree_skb(skb);
1474
1475 return 0;
1476 }
1477
1478 static int btusb_setup_csr(struct hci_dev *hdev)
1479 {
1480 struct hci_rp_read_local_version *rp;
1481 struct sk_buff *skb;
1482
1483 BT_DBG("%s", hdev->name);
1484
1485 skb = __hci_cmd_sync(hdev, HCI_OP_READ_LOCAL_VERSION, 0, NULL,
1486 HCI_INIT_TIMEOUT);
1487 if (IS_ERR(skb)) {
1488 int err = PTR_ERR(skb);
1489 BT_ERR("%s: CSR: Local version failed (%d)", hdev->name, err);
1490 return err;
1491 }
1492
1493 if (skb->len != sizeof(struct hci_rp_read_local_version)) {
1494 BT_ERR("%s: CSR: Local version length mismatch", hdev->name);
1495 kfree_skb(skb);
1496 return -EIO;
1497 }
1498
1499 rp = (struct hci_rp_read_local_version *)skb->data;
1500
1501 /* Detect controllers which aren't real CSR ones. */
1502 if (le16_to_cpu(rp->manufacturer) != 10 ||
1503 le16_to_cpu(rp->lmp_subver) == 0x0c5c) {
1504 /* Clear the reset quirk since this is not an actual
1505 * early Bluetooth 1.1 device from CSR.
1506 */
1507 clear_bit(HCI_QUIRK_RESET_ON_CLOSE, &hdev->quirks);
1508
1509 /* These fake CSR controllers have all a broken
1510 * stored link key handling and so just disable it.
1511 */
1512 set_bit(HCI_QUIRK_BROKEN_STORED_LINK_KEY, &hdev->quirks);
1513 }
1514
1515 kfree_skb(skb);
1516
1517 return 0;
1518 }
1519
1520 static const struct firmware *btusb_setup_intel_get_fw(struct hci_dev *hdev,
1521 struct intel_version *ver)
1522 {
1523 const struct firmware *fw;
1524 char fwname[64];
1525 int ret;
1526
1527 snprintf(fwname, sizeof(fwname),
1528 "intel/ibt-hw-%x.%x.%x-fw-%x.%x.%x.%x.%x.bseq",
1529 ver->hw_platform, ver->hw_variant, ver->hw_revision,
1530 ver->fw_variant, ver->fw_revision, ver->fw_build_num,
1531 ver->fw_build_ww, ver->fw_build_yy);
1532
1533 ret = request_firmware(&fw, fwname, &hdev->dev);
1534 if (ret < 0) {
1535 if (ret == -EINVAL) {
1536 BT_ERR("%s Intel firmware file request failed (%d)",
1537 hdev->name, ret);
1538 return NULL;
1539 }
1540
1541 BT_ERR("%s failed to open Intel firmware file: %s(%d)",
1542 hdev->name, fwname, ret);
1543
1544 /* If the correct firmware patch file is not found, use the
1545 * default firmware patch file instead
1546 */
1547 snprintf(fwname, sizeof(fwname), "intel/ibt-hw-%x.%x.bseq",
1548 ver->hw_platform, ver->hw_variant);
1549 if (request_firmware(&fw, fwname, &hdev->dev) < 0) {
1550 BT_ERR("%s failed to open default Intel fw file: %s",
1551 hdev->name, fwname);
1552 return NULL;
1553 }
1554 }
1555
1556 BT_INFO("%s: Intel Bluetooth firmware file: %s", hdev->name, fwname);
1557
1558 return fw;
1559 }
1560
1561 static int btusb_setup_intel_patching(struct hci_dev *hdev,
1562 const struct firmware *fw,
1563 const u8 **fw_ptr, int *disable_patch)
1564 {
1565 struct sk_buff *skb;
1566 struct hci_command_hdr *cmd;
1567 const u8 *cmd_param;
1568 struct hci_event_hdr *evt = NULL;
1569 const u8 *evt_param = NULL;
1570 int remain = fw->size - (*fw_ptr - fw->data);
1571
1572 /* The first byte indicates the types of the patch command or event.
1573 * 0x01 means HCI command and 0x02 is HCI event. If the first bytes
1574 * in the current firmware buffer doesn't start with 0x01 or
1575 * the size of remain buffer is smaller than HCI command header,
1576 * the firmware file is corrupted and it should stop the patching
1577 * process.
1578 */
1579 if (remain > HCI_COMMAND_HDR_SIZE && *fw_ptr[0] != 0x01) {
1580 BT_ERR("%s Intel fw corrupted: invalid cmd read", hdev->name);
1581 return -EINVAL;
1582 }
1583 (*fw_ptr)++;
1584 remain--;
1585
1586 cmd = (struct hci_command_hdr *)(*fw_ptr);
1587 *fw_ptr += sizeof(*cmd);
1588 remain -= sizeof(*cmd);
1589
1590 /* Ensure that the remain firmware data is long enough than the length
1591 * of command parameter. If not, the firmware file is corrupted.
1592 */
1593 if (remain < cmd->plen) {
1594 BT_ERR("%s Intel fw corrupted: invalid cmd len", hdev->name);
1595 return -EFAULT;
1596 }
1597
1598 /* If there is a command that loads a patch in the firmware
1599 * file, then enable the patch upon success, otherwise just
1600 * disable the manufacturer mode, for example patch activation
1601 * is not required when the default firmware patch file is used
1602 * because there are no patch data to load.
1603 */
1604 if (*disable_patch && le16_to_cpu(cmd->opcode) == 0xfc8e)
1605 *disable_patch = 0;
1606
1607 cmd_param = *fw_ptr;
1608 *fw_ptr += cmd->plen;
1609 remain -= cmd->plen;
1610
1611 /* This reads the expected events when the above command is sent to the
1612 * device. Some vendor commands expects more than one events, for
1613 * example command status event followed by vendor specific event.
1614 * For this case, it only keeps the last expected event. so the command
1615 * can be sent with __hci_cmd_sync_ev() which returns the sk_buff of
1616 * last expected event.
1617 */
1618 while (remain > HCI_EVENT_HDR_SIZE && *fw_ptr[0] == 0x02) {
1619 (*fw_ptr)++;
1620 remain--;
1621
1622 evt = (struct hci_event_hdr *)(*fw_ptr);
1623 *fw_ptr += sizeof(*evt);
1624 remain -= sizeof(*evt);
1625
1626 if (remain < evt->plen) {
1627 BT_ERR("%s Intel fw corrupted: invalid evt len",
1628 hdev->name);
1629 return -EFAULT;
1630 }
1631
1632 evt_param = *fw_ptr;
1633 *fw_ptr += evt->plen;
1634 remain -= evt->plen;
1635 }
1636
1637 /* Every HCI commands in the firmware file has its correspond event.
1638 * If event is not found or remain is smaller than zero, the firmware
1639 * file is corrupted.
1640 */
1641 if (!evt || !evt_param || remain < 0) {
1642 BT_ERR("%s Intel fw corrupted: invalid evt read", hdev->name);
1643 return -EFAULT;
1644 }
1645
1646 skb = __hci_cmd_sync_ev(hdev, le16_to_cpu(cmd->opcode), cmd->plen,
1647 cmd_param, evt->evt, HCI_INIT_TIMEOUT);
1648 if (IS_ERR(skb)) {
1649 BT_ERR("%s sending Intel patch command (0x%4.4x) failed (%ld)",
1650 hdev->name, cmd->opcode, PTR_ERR(skb));
1651 return PTR_ERR(skb);
1652 }
1653
1654 /* It ensures that the returned event matches the event data read from
1655 * the firmware file. At fist, it checks the length and then
1656 * the contents of the event.
1657 */
1658 if (skb->len != evt->plen) {
1659 BT_ERR("%s mismatch event length (opcode 0x%4.4x)", hdev->name,
1660 le16_to_cpu(cmd->opcode));
1661 kfree_skb(skb);
1662 return -EFAULT;
1663 }
1664
1665 if (memcmp(skb->data, evt_param, evt->plen)) {
1666 BT_ERR("%s mismatch event parameter (opcode 0x%4.4x)",
1667 hdev->name, le16_to_cpu(cmd->opcode));
1668 kfree_skb(skb);
1669 return -EFAULT;
1670 }
1671 kfree_skb(skb);
1672
1673 return 0;
1674 }
1675
1676 static int btusb_setup_intel(struct hci_dev *hdev)
1677 {
1678 struct sk_buff *skb;
1679 const struct firmware *fw;
1680 const u8 *fw_ptr;
1681 int disable_patch, err;
1682 struct intel_version ver;
1683
1684 BT_DBG("%s", hdev->name);
1685
1686 /* The controller has a bug with the first HCI command sent to it
1687 * returning number of completed commands as zero. This would stall the
1688 * command processing in the Bluetooth core.
1689 *
1690 * As a workaround, send HCI Reset command first which will reset the
1691 * number of completed commands and allow normal command processing
1692 * from now on.
1693 */
1694 skb = __hci_cmd_sync(hdev, HCI_OP_RESET, 0, NULL, HCI_INIT_TIMEOUT);
1695 if (IS_ERR(skb)) {
1696 BT_ERR("%s sending initial HCI reset command failed (%ld)",
1697 hdev->name, PTR_ERR(skb));
1698 return PTR_ERR(skb);
1699 }
1700 kfree_skb(skb);
1701
1702 /* Read Intel specific controller version first to allow selection of
1703 * which firmware file to load.
1704 *
1705 * The returned information are hardware variant and revision plus
1706 * firmware variant, revision and build number.
1707 */
1708 err = btintel_read_version(hdev, &ver);
1709 if (err)
1710 return err;
1711
1712 BT_INFO("%s: read Intel version: %02x%02x%02x%02x%02x%02x%02x%02x%02x",
1713 hdev->name, ver.hw_platform, ver.hw_variant, ver.hw_revision,
1714 ver.fw_variant, ver.fw_revision, ver.fw_build_num,
1715 ver.fw_build_ww, ver.fw_build_yy, ver.fw_patch_num);
1716
1717 /* fw_patch_num indicates the version of patch the device currently
1718 * have. If there is no patch data in the device, it is always 0x00.
1719 * So, if it is other than 0x00, no need to patch the device again.
1720 */
1721 if (ver.fw_patch_num) {
1722 BT_INFO("%s: Intel device is already patched. patch num: %02x",
1723 hdev->name, ver.fw_patch_num);
1724 goto complete;
1725 }
1726
1727 /* Opens the firmware patch file based on the firmware version read
1728 * from the controller. If it fails to open the matching firmware
1729 * patch file, it tries to open the default firmware patch file.
1730 * If no patch file is found, allow the device to operate without
1731 * a patch.
1732 */
1733 fw = btusb_setup_intel_get_fw(hdev, &ver);
1734 if (!fw)
1735 goto complete;
1736 fw_ptr = fw->data;
1737
1738 /* Enable the manufacturer mode of the controller.
1739 * Only while this mode is enabled, the driver can download the
1740 * firmware patch data and configuration parameters.
1741 */
1742 err = btintel_enter_mfg(hdev);
1743 if (err) {
1744 release_firmware(fw);
1745 return err;
1746 }
1747
1748 disable_patch = 1;
1749
1750 /* The firmware data file consists of list of Intel specific HCI
1751 * commands and its expected events. The first byte indicates the
1752 * type of the message, either HCI command or HCI event.
1753 *
1754 * It reads the command and its expected event from the firmware file,
1755 * and send to the controller. Once __hci_cmd_sync_ev() returns,
1756 * the returned event is compared with the event read from the firmware
1757 * file and it will continue until all the messages are downloaded to
1758 * the controller.
1759 *
1760 * Once the firmware patching is completed successfully,
1761 * the manufacturer mode is disabled with reset and activating the
1762 * downloaded patch.
1763 *
1764 * If the firmware patching fails, the manufacturer mode is
1765 * disabled with reset and deactivating the patch.
1766 *
1767 * If the default patch file is used, no reset is done when disabling
1768 * the manufacturer.
1769 */
1770 while (fw->size > fw_ptr - fw->data) {
1771 int ret;
1772
1773 ret = btusb_setup_intel_patching(hdev, fw, &fw_ptr,
1774 &disable_patch);
1775 if (ret < 0)
1776 goto exit_mfg_deactivate;
1777 }
1778
1779 release_firmware(fw);
1780
1781 if (disable_patch)
1782 goto exit_mfg_disable;
1783
1784 /* Patching completed successfully and disable the manufacturer mode
1785 * with reset and activate the downloaded firmware patches.
1786 */
1787 err = btintel_exit_mfg(hdev, true, true);
1788 if (err)
1789 return err;
1790
1791 BT_INFO("%s: Intel Bluetooth firmware patch completed and activated",
1792 hdev->name);
1793
1794 goto complete;
1795
1796 exit_mfg_disable:
1797 /* Disable the manufacturer mode without reset */
1798 err = btintel_exit_mfg(hdev, false, false);
1799 if (err)
1800 return err;
1801
1802 BT_INFO("%s: Intel Bluetooth firmware patch completed", hdev->name);
1803
1804 goto complete;
1805
1806 exit_mfg_deactivate:
1807 release_firmware(fw);
1808
1809 /* Patching failed. Disable the manufacturer mode with reset and
1810 * deactivate the downloaded firmware patches.
1811 */
1812 err = btintel_exit_mfg(hdev, true, false);
1813 if (err)
1814 return err;
1815
1816 BT_INFO("%s: Intel Bluetooth firmware patch completed and deactivated",
1817 hdev->name);
1818
1819 complete:
1820 /* Set the event mask for Intel specific vendor events. This enables
1821 * a few extra events that are useful during general operation.
1822 */
1823 btintel_set_event_mask_mfg(hdev, false);
1824
1825 btintel_check_bdaddr(hdev);
1826 return 0;
1827 }
1828
1829 static int inject_cmd_complete(struct hci_dev *hdev, __u16 opcode)
1830 {
1831 struct sk_buff *skb;
1832 struct hci_event_hdr *hdr;
1833 struct hci_ev_cmd_complete *evt;
1834
1835 skb = bt_skb_alloc(sizeof(*hdr) + sizeof(*evt) + 1, GFP_ATOMIC);
1836 if (!skb)
1837 return -ENOMEM;
1838
1839 hdr = skb_put(skb, sizeof(*hdr));
1840 hdr->evt = HCI_EV_CMD_COMPLETE;
1841 hdr->plen = sizeof(*evt) + 1;
1842
1843 evt = skb_put(skb, sizeof(*evt));
1844 evt->ncmd = 0x01;
1845 evt->opcode = cpu_to_le16(opcode);
1846
1847 skb_put_u8(skb, 0x00);
1848
1849 hci_skb_pkt_type(skb) = HCI_EVENT_PKT;
1850
1851 return hci_recv_frame(hdev, skb);
1852 }
1853
1854 static int btusb_recv_bulk_intel(struct btusb_data *data, void *buffer,
1855 int count)
1856 {
1857 /* When the device is in bootloader mode, then it can send
1858 * events via the bulk endpoint. These events are treated the
1859 * same way as the ones received from the interrupt endpoint.
1860 */
1861 if (test_bit(BTUSB_BOOTLOADER, &data->flags))
1862 return btusb_recv_intr(data, buffer, count);
1863
1864 return btusb_recv_bulk(data, buffer, count);
1865 }
1866
1867 static void btusb_intel_bootup(struct btusb_data *data, const void *ptr,
1868 unsigned int len)
1869 {
1870 const struct intel_bootup *evt = ptr;
1871
1872 if (len != sizeof(*evt))
1873 return;
1874
1875 if (test_and_clear_bit(BTUSB_BOOTING, &data->flags)) {
1876 smp_mb__after_atomic();
1877 wake_up_bit(&data->flags, BTUSB_BOOTING);
1878 }
1879 }
1880
1881 static void btusb_intel_secure_send_result(struct btusb_data *data,
1882 const void *ptr, unsigned int len)
1883 {
1884 const struct intel_secure_send_result *evt = ptr;
1885
1886 if (len != sizeof(*evt))
1887 return;
1888
1889 if (evt->result)
1890 set_bit(BTUSB_FIRMWARE_FAILED, &data->flags);
1891
1892 if (test_and_clear_bit(BTUSB_DOWNLOADING, &data->flags) &&
1893 test_bit(BTUSB_FIRMWARE_LOADED, &data->flags)) {
1894 smp_mb__after_atomic();
1895 wake_up_bit(&data->flags, BTUSB_DOWNLOADING);
1896 }
1897 }
1898
1899 static int btusb_recv_event_intel(struct hci_dev *hdev, struct sk_buff *skb)
1900 {
1901 struct btusb_data *data = hci_get_drvdata(hdev);
1902
1903 if (test_bit(BTUSB_BOOTLOADER, &data->flags)) {
1904 struct hci_event_hdr *hdr = (void *)skb->data;
1905
1906 if (skb->len > HCI_EVENT_HDR_SIZE && hdr->evt == 0xff &&
1907 hdr->plen > 0) {
1908 const void *ptr = skb->data + HCI_EVENT_HDR_SIZE + 1;
1909 unsigned int len = skb->len - HCI_EVENT_HDR_SIZE - 1;
1910
1911 switch (skb->data[2]) {
1912 case 0x02:
1913 /* When switching to the operational firmware
1914 * the device sends a vendor specific event
1915 * indicating that the bootup completed.
1916 */
1917 btusb_intel_bootup(data, ptr, len);
1918 break;
1919 case 0x06:
1920 /* When the firmware loading completes the
1921 * device sends out a vendor specific event
1922 * indicating the result of the firmware
1923 * loading.
1924 */
1925 btusb_intel_secure_send_result(data, ptr, len);
1926 break;
1927 }
1928 }
1929 }
1930
1931 return hci_recv_frame(hdev, skb);
1932 }
1933
1934 static int btusb_send_frame_intel(struct hci_dev *hdev, struct sk_buff *skb)
1935 {
1936 struct btusb_data *data = hci_get_drvdata(hdev);
1937 struct urb *urb;
1938
1939 BT_DBG("%s", hdev->name);
1940
1941 switch (hci_skb_pkt_type(skb)) {
1942 case HCI_COMMAND_PKT:
1943 if (test_bit(BTUSB_BOOTLOADER, &data->flags)) {
1944 struct hci_command_hdr *cmd = (void *)skb->data;
1945 __u16 opcode = le16_to_cpu(cmd->opcode);
1946
1947 /* When in bootloader mode and the command 0xfc09
1948 * is received, it needs to be send down the
1949 * bulk endpoint. So allocate a bulk URB instead.
1950 */
1951 if (opcode == 0xfc09)
1952 urb = alloc_bulk_urb(hdev, skb);
1953 else
1954 urb = alloc_ctrl_urb(hdev, skb);
1955
1956 /* When the 0xfc01 command is issued to boot into
1957 * the operational firmware, it will actually not
1958 * send a command complete event. To keep the flow
1959 * control working inject that event here.
1960 */
1961 if (opcode == 0xfc01)
1962 inject_cmd_complete(hdev, opcode);
1963 } else {
1964 urb = alloc_ctrl_urb(hdev, skb);
1965 }
1966 if (IS_ERR(urb))
1967 return PTR_ERR(urb);
1968
1969 hdev->stat.cmd_tx++;
1970 return submit_or_queue_tx_urb(hdev, urb);
1971
1972 case HCI_ACLDATA_PKT:
1973 urb = alloc_bulk_urb(hdev, skb);
1974 if (IS_ERR(urb))
1975 return PTR_ERR(urb);
1976
1977 hdev->stat.acl_tx++;
1978 return submit_or_queue_tx_urb(hdev, urb);
1979
1980 case HCI_SCODATA_PKT:
1981 if (hci_conn_num(hdev, SCO_LINK) < 1)
1982 return -ENODEV;
1983
1984 urb = alloc_isoc_urb(hdev, skb);
1985 if (IS_ERR(urb))
1986 return PTR_ERR(urb);
1987
1988 hdev->stat.sco_tx++;
1989 return submit_tx_urb(hdev, urb);
1990 }
1991
1992 return -EILSEQ;
1993 }
1994
1995 static int btusb_setup_intel_new(struct hci_dev *hdev)
1996 {
1997 static const u8 reset_param[] = { 0x00, 0x01, 0x00, 0x01,
1998 0x00, 0x08, 0x04, 0x00 };
1999 struct btusb_data *data = hci_get_drvdata(hdev);
2000 struct sk_buff *skb;
2001 struct intel_version ver;
2002 struct intel_boot_params *params;
2003 const struct firmware *fw;
2004 const u8 *fw_ptr;
2005 u32 frag_len;
2006 char fwname[64];
2007 ktime_t calltime, delta, rettime;
2008 unsigned long long duration;
2009 int err;
2010
2011 BT_DBG("%s", hdev->name);
2012
2013 calltime = ktime_get();
2014
2015 /* Read the Intel version information to determine if the device
2016 * is in bootloader mode or if it already has operational firmware
2017 * loaded.
2018 */
2019 err = btintel_read_version(hdev, &ver);
2020 if (err)
2021 return err;
2022
2023 /* The hardware platform number has a fixed value of 0x37 and
2024 * for now only accept this single value.
2025 */
2026 if (ver.hw_platform != 0x37) {
2027 BT_ERR("%s: Unsupported Intel hardware platform (%u)",
2028 hdev->name, ver.hw_platform);
2029 return -EINVAL;
2030 }
2031
2032 /* Check for supported iBT hardware variants of this firmware
2033 * loading method.
2034 *
2035 * This check has been put in place to ensure correct forward
2036 * compatibility options when newer hardware variants come along.
2037 */
2038 switch (ver.hw_variant) {
2039 case 0x0b: /* SfP */
2040 case 0x0c: /* WsP */
2041 case 0x11: /* JfP */
2042 case 0x12: /* ThP */
2043 break;
2044 default:
2045 BT_ERR("%s: Unsupported Intel hardware variant (%u)",
2046 hdev->name, ver.hw_variant);
2047 return -EINVAL;
2048 }
2049
2050 btintel_version_info(hdev, &ver);
2051
2052 /* The firmware variant determines if the device is in bootloader
2053 * mode or is running operational firmware. The value 0x06 identifies
2054 * the bootloader and the value 0x23 identifies the operational
2055 * firmware.
2056 *
2057 * When the operational firmware is already present, then only
2058 * the check for valid Bluetooth device address is needed. This
2059 * determines if the device will be added as configured or
2060 * unconfigured controller.
2061 *
2062 * It is not possible to use the Secure Boot Parameters in this
2063 * case since that command is only available in bootloader mode.
2064 */
2065 if (ver.fw_variant == 0x23) {
2066 clear_bit(BTUSB_BOOTLOADER, &data->flags);
2067 btintel_check_bdaddr(hdev);
2068 return 0;
2069 }
2070
2071 /* If the device is not in bootloader mode, then the only possible
2072 * choice is to return an error and abort the device initialization.
2073 */
2074 if (ver.fw_variant != 0x06) {
2075 BT_ERR("%s: Unsupported Intel firmware variant (%u)",
2076 hdev->name, ver.fw_variant);
2077 return -ENODEV;
2078 }
2079
2080 /* Read the secure boot parameters to identify the operating
2081 * details of the bootloader.
2082 */
2083 skb = __hci_cmd_sync(hdev, 0xfc0d, 0, NULL, HCI_INIT_TIMEOUT);
2084 if (IS_ERR(skb)) {
2085 BT_ERR("%s: Reading Intel boot parameters failed (%ld)",
2086 hdev->name, PTR_ERR(skb));
2087 return PTR_ERR(skb);
2088 }
2089
2090 if (skb->len != sizeof(*params)) {
2091 BT_ERR("%s: Intel boot parameters size mismatch", hdev->name);
2092 kfree_skb(skb);
2093 return -EILSEQ;
2094 }
2095
2096 params = (struct intel_boot_params *)skb->data;
2097
2098 BT_INFO("%s: Device revision is %u", hdev->name,
2099 le16_to_cpu(params->dev_revid));
2100
2101 BT_INFO("%s: Secure boot is %s", hdev->name,
2102 params->secure_boot ? "enabled" : "disabled");
2103
2104 BT_INFO("%s: OTP lock is %s", hdev->name,
2105 params->otp_lock ? "enabled" : "disabled");
2106
2107 BT_INFO("%s: API lock is %s", hdev->name,
2108 params->api_lock ? "enabled" : "disabled");
2109
2110 BT_INFO("%s: Debug lock is %s", hdev->name,
2111 params->debug_lock ? "enabled" : "disabled");
2112
2113 BT_INFO("%s: Minimum firmware build %u week %u %u", hdev->name,
2114 params->min_fw_build_nn, params->min_fw_build_cw,
2115 2000 + params->min_fw_build_yy);
2116
2117 /* It is required that every single firmware fragment is acknowledged
2118 * with a command complete event. If the boot parameters indicate
2119 * that this bootloader does not send them, then abort the setup.
2120 */
2121 if (params->limited_cce != 0x00) {
2122 BT_ERR("%s: Unsupported Intel firmware loading method (%u)",
2123 hdev->name, params->limited_cce);
2124 kfree_skb(skb);
2125 return -EINVAL;
2126 }
2127
2128 /* If the OTP has no valid Bluetooth device address, then there will
2129 * also be no valid address for the operational firmware.
2130 */
2131 if (!bacmp(&params->otp_bdaddr, BDADDR_ANY)) {
2132 BT_INFO("%s: No device address configured", hdev->name);
2133 set_bit(HCI_QUIRK_INVALID_BDADDR, &hdev->quirks);
2134 }
2135
2136 /* With this Intel bootloader only the hardware variant and device
2137 * revision information are used to select the right firmware.
2138 *
2139 * The firmware filename is ibt-<hw_variant>-<dev_revid>.sfi.
2140 *
2141 * Currently the supported hardware variants are:
2142 * 11 (0x0b) for iBT3.0 (LnP/SfP)
2143 * 12 (0x0c) for iBT3.5 (WsP)
2144 * 17 (0x11) for iBT3.5 (JfP)
2145 * 18 (0x12) for iBT3.5 (ThP)
2146 */
2147 snprintf(fwname, sizeof(fwname), "intel/ibt-%u-%u.sfi",
2148 le16_to_cpu(ver.hw_variant),
2149 le16_to_cpu(params->dev_revid));
2150
2151 err = request_firmware(&fw, fwname, &hdev->dev);
2152 if (err < 0) {
2153 BT_ERR("%s: Failed to load Intel firmware file (%d)",
2154 hdev->name, err);
2155 kfree_skb(skb);
2156 return err;
2157 }
2158
2159 BT_INFO("%s: Found device firmware: %s", hdev->name, fwname);
2160
2161 /* Save the DDC file name for later use to apply once the firmware
2162 * downloading is done.
2163 */
2164 snprintf(fwname, sizeof(fwname), "intel/ibt-%u-%u.ddc",
2165 le16_to_cpu(ver.hw_variant),
2166 le16_to_cpu(params->dev_revid));
2167
2168 kfree_skb(skb);
2169
2170 if (fw->size < 644) {
2171 BT_ERR("%s: Invalid size of firmware file (%zu)",
2172 hdev->name, fw->size);
2173 err = -EBADF;
2174 goto done;
2175 }
2176
2177 set_bit(BTUSB_DOWNLOADING, &data->flags);
2178
2179 /* Start the firmware download transaction with the Init fragment
2180 * represented by the 128 bytes of CSS header.
2181 */
2182 err = btintel_secure_send(hdev, 0x00, 128, fw->data);
2183 if (err < 0) {
2184 BT_ERR("%s: Failed to send firmware header (%d)",
2185 hdev->name, err);
2186 goto done;
2187 }
2188
2189 /* Send the 256 bytes of public key information from the firmware
2190 * as the PKey fragment.
2191 */
2192 err = btintel_secure_send(hdev, 0x03, 256, fw->data + 128);
2193 if (err < 0) {
2194 BT_ERR("%s: Failed to send firmware public key (%d)",
2195 hdev->name, err);
2196 goto done;
2197 }
2198
2199 /* Send the 256 bytes of signature information from the firmware
2200 * as the Sign fragment.
2201 */
2202 err = btintel_secure_send(hdev, 0x02, 256, fw->data + 388);
2203 if (err < 0) {
2204 BT_ERR("%s: Failed to send firmware signature (%d)",
2205 hdev->name, err);
2206 goto done;
2207 }
2208
2209 fw_ptr = fw->data + 644;
2210 frag_len = 0;
2211
2212 while (fw_ptr - fw->data < fw->size) {
2213 struct hci_command_hdr *cmd = (void *)(fw_ptr + frag_len);
2214
2215 frag_len += sizeof(*cmd) + cmd->plen;
2216
2217 /* The parameter length of the secure send command requires
2218 * a 4 byte alignment. It happens so that the firmware file
2219 * contains proper Intel_NOP commands to align the fragments
2220 * as needed.
2221 *
2222 * Send set of commands with 4 byte alignment from the
2223 * firmware data buffer as a single Data fragement.
2224 */
2225 if (!(frag_len % 4)) {
2226 err = btintel_secure_send(hdev, 0x01, frag_len, fw_ptr);
2227 if (err < 0) {
2228 BT_ERR("%s: Failed to send firmware data (%d)",
2229 hdev->name, err);
2230 goto done;
2231 }
2232
2233 fw_ptr += frag_len;
2234 frag_len = 0;
2235 }
2236 }
2237
2238 set_bit(BTUSB_FIRMWARE_LOADED, &data->flags);
2239
2240 BT_INFO("%s: Waiting for firmware download to complete", hdev->name);
2241
2242 /* Before switching the device into operational mode and with that
2243 * booting the loaded firmware, wait for the bootloader notification
2244 * that all fragments have been successfully received.
2245 *
2246 * When the event processing receives the notification, then the
2247 * BTUSB_DOWNLOADING flag will be cleared.
2248 *
2249 * The firmware loading should not take longer than 5 seconds
2250 * and thus just timeout if that happens and fail the setup
2251 * of this device.
2252 */
2253 err = wait_on_bit_timeout(&data->flags, BTUSB_DOWNLOADING,
2254 TASK_INTERRUPTIBLE,
2255 msecs_to_jiffies(5000));
2256 if (err == -EINTR) {
2257 BT_ERR("%s: Firmware loading interrupted", hdev->name);
2258 goto done;
2259 }
2260
2261 if (err) {
2262 BT_ERR("%s: Firmware loading timeout", hdev->name);
2263 err = -ETIMEDOUT;
2264 goto done;
2265 }
2266
2267 if (test_bit(BTUSB_FIRMWARE_FAILED, &data->flags)) {
2268 BT_ERR("%s: Firmware loading failed", hdev->name);
2269 err = -ENOEXEC;
2270 goto done;
2271 }
2272
2273 rettime = ktime_get();
2274 delta = ktime_sub(rettime, calltime);
2275 duration = (unsigned long long) ktime_to_ns(delta) >> 10;
2276
2277 BT_INFO("%s: Firmware loaded in %llu usecs", hdev->name, duration);
2278
2279 done:
2280 release_firmware(fw);
2281
2282 if (err < 0)
2283 return err;
2284
2285 calltime = ktime_get();
2286
2287 set_bit(BTUSB_BOOTING, &data->flags);
2288
2289 skb = __hci_cmd_sync(hdev, 0xfc01, sizeof(reset_param), reset_param,
2290 HCI_INIT_TIMEOUT);
2291 if (IS_ERR(skb))
2292 return PTR_ERR(skb);
2293
2294 kfree_skb(skb);
2295
2296 /* The bootloader will not indicate when the device is ready. This
2297 * is done by the operational firmware sending bootup notification.
2298 *
2299 * Booting into operational firmware should not take longer than
2300 * 1 second. However if that happens, then just fail the setup
2301 * since something went wrong.
2302 */
2303 BT_INFO("%s: Waiting for device to boot", hdev->name);
2304
2305 err = wait_on_bit_timeout(&data->flags, BTUSB_BOOTING,
2306 TASK_INTERRUPTIBLE,
2307 msecs_to_jiffies(1000));
2308
2309 if (err == -EINTR) {
2310 BT_ERR("%s: Device boot interrupted", hdev->name);
2311 return -EINTR;
2312 }
2313
2314 if (err) {
2315 BT_ERR("%s: Device boot timeout", hdev->name);
2316 return -ETIMEDOUT;
2317 }
2318
2319 rettime = ktime_get();
2320 delta = ktime_sub(rettime, calltime);
2321 duration = (unsigned long long) ktime_to_ns(delta) >> 10;
2322
2323 BT_INFO("%s: Device booted in %llu usecs", hdev->name, duration);
2324
2325 clear_bit(BTUSB_BOOTLOADER, &data->flags);
2326
2327 /* Once the device is running in operational mode, it needs to apply
2328 * the device configuration (DDC) parameters.
2329 *
2330 * The device can work without DDC parameters, so even if it fails
2331 * to load the file, no need to fail the setup.
2332 */
2333 btintel_load_ddc_config(hdev, fwname);
2334
2335 /* Set the event mask for Intel specific vendor events. This enables
2336 * a few extra events that are useful during general operation. It
2337 * does not enable any debugging related events.
2338 *
2339 * The device will function correctly without these events enabled
2340 * and thus no need to fail the setup.
2341 */
2342 btintel_set_event_mask(hdev, false);
2343
2344 return 0;
2345 }
2346
2347 static int btusb_shutdown_intel(struct hci_dev *hdev)
2348 {
2349 struct sk_buff *skb;
2350 long ret;
2351
2352 /* Some platforms have an issue with BT LED when the interface is
2353 * down or BT radio is turned off, which takes 5 seconds to BT LED
2354 * goes off. This command turns off the BT LED immediately.
2355 */
2356 skb = __hci_cmd_sync(hdev, 0xfc3f, 0, NULL, HCI_INIT_TIMEOUT);
2357 if (IS_ERR(skb)) {
2358 ret = PTR_ERR(skb);
2359 BT_ERR("%s: turning off Intel device LED failed (%ld)",
2360 hdev->name, ret);
2361 return ret;
2362 }
2363 kfree_skb(skb);
2364
2365 return 0;
2366 }
2367
2368 #ifdef CONFIG_PM
2369 /* Configure an out-of-band gpio as wake-up pin, if specified in device tree */
2370 static int marvell_config_oob_wake(struct hci_dev *hdev)
2371 {
2372 struct sk_buff *skb;
2373 struct btusb_data *data = hci_get_drvdata(hdev);
2374 struct device *dev = &data->udev->dev;
2375 u16 pin, gap, opcode;
2376 int ret;
2377 u8 cmd[5];
2378
2379 /* Move on if no wakeup pin specified */
2380 if (of_property_read_u16(dev->of_node, "marvell,wakeup-pin", &pin) ||
2381 of_property_read_u16(dev->of_node, "marvell,wakeup-gap-ms", &gap))
2382 return 0;
2383
2384 /* Vendor specific command to configure a GPIO as wake-up pin */
2385 opcode = hci_opcode_pack(0x3F, 0x59);
2386 cmd[0] = opcode & 0xFF;
2387 cmd[1] = opcode >> 8;
2388 cmd[2] = 2; /* length of parameters that follow */
2389 cmd[3] = pin;
2390 cmd[4] = gap; /* time in ms, for which wakeup pin should be asserted */
2391
2392 skb = bt_skb_alloc(sizeof(cmd), GFP_KERNEL);
2393 if (!skb) {
2394 bt_dev_err(hdev, "%s: No memory\n", __func__);
2395 return -ENOMEM;
2396 }
2397
2398 skb_put_data(skb, cmd, sizeof(cmd));
2399 hci_skb_pkt_type(skb) = HCI_COMMAND_PKT;
2400
2401 ret = btusb_send_frame(hdev, skb);
2402 if (ret) {
2403 bt_dev_err(hdev, "%s: configuration failed\n", __func__);
2404 kfree_skb(skb);
2405 return ret;
2406 }
2407
2408 return 0;
2409 }
2410 #endif
2411
2412 static int btusb_set_bdaddr_marvell(struct hci_dev *hdev,
2413 const bdaddr_t *bdaddr)
2414 {
2415 struct sk_buff *skb;
2416 u8 buf[8];
2417 long ret;
2418
2419 buf[0] = 0xfe;
2420 buf[1] = sizeof(bdaddr_t);
2421 memcpy(buf + 2, bdaddr, sizeof(bdaddr_t));
2422
2423 skb = __hci_cmd_sync(hdev, 0xfc22, sizeof(buf), buf, HCI_INIT_TIMEOUT);
2424 if (IS_ERR(skb)) {
2425 ret = PTR_ERR(skb);
2426 BT_ERR("%s: changing Marvell device address failed (%ld)",
2427 hdev->name, ret);
2428 return ret;
2429 }
2430 kfree_skb(skb);
2431
2432 return 0;
2433 }
2434
2435 static int btusb_set_bdaddr_ath3012(struct hci_dev *hdev,
2436 const bdaddr_t *bdaddr)
2437 {
2438 struct sk_buff *skb;
2439 u8 buf[10];
2440 long ret;
2441
2442 buf[0] = 0x01;
2443 buf[1] = 0x01;
2444 buf[2] = 0x00;
2445 buf[3] = sizeof(bdaddr_t);
2446 memcpy(buf + 4, bdaddr, sizeof(bdaddr_t));
2447
2448 skb = __hci_cmd_sync(hdev, 0xfc0b, sizeof(buf), buf, HCI_INIT_TIMEOUT);
2449 if (IS_ERR(skb)) {
2450 ret = PTR_ERR(skb);
2451 BT_ERR("%s: Change address command failed (%ld)",
2452 hdev->name, ret);
2453 return ret;
2454 }
2455 kfree_skb(skb);
2456
2457 return 0;
2458 }
2459
2460 #define QCA_DFU_PACKET_LEN 4096
2461
2462 #define QCA_GET_TARGET_VERSION 0x09
2463 #define QCA_CHECK_STATUS 0x05
2464 #define QCA_DFU_DOWNLOAD 0x01
2465
2466 #define QCA_SYSCFG_UPDATED 0x40
2467 #define QCA_PATCH_UPDATED 0x80
2468 #define QCA_DFU_TIMEOUT 3000
2469
2470 struct qca_version {
2471 __le32 rom_version;
2472 __le32 patch_version;
2473 __le32 ram_version;
2474 __le32 ref_clock;
2475 __u8 reserved[4];
2476 } __packed;
2477
2478 struct qca_rampatch_version {
2479 __le16 rom_version;
2480 __le16 patch_version;
2481 } __packed;
2482
2483 struct qca_device_info {
2484 u32 rom_version;
2485 u8 rampatch_hdr; /* length of header in rampatch */
2486 u8 nvm_hdr; /* length of header in NVM */
2487 u8 ver_offset; /* offset of version structure in rampatch */
2488 };
2489
2490 static const struct qca_device_info qca_devices_table[] = {
2491 { 0x00000100, 20, 4, 10 }, /* Rome 1.0 */
2492 { 0x00000101, 20, 4, 10 }, /* Rome 1.1 */
2493 { 0x00000200, 28, 4, 18 }, /* Rome 2.0 */
2494 { 0x00000201, 28, 4, 18 }, /* Rome 2.1 */
2495 { 0x00000300, 28, 4, 18 }, /* Rome 3.0 */
2496 { 0x00000302, 28, 4, 18 }, /* Rome 3.2 */
2497 };
2498
2499 static int btusb_qca_send_vendor_req(struct hci_dev *hdev, u8 request,
2500 void *data, u16 size)
2501 {
2502 struct btusb_data *btdata = hci_get_drvdata(hdev);
2503 struct usb_device *udev = btdata->udev;
2504 int pipe, err;
2505 u8 *buf;
2506
2507 buf = kmalloc(size, GFP_KERNEL);
2508 if (!buf)
2509 return -ENOMEM;
2510
2511 /* Found some of USB hosts have IOT issues with ours so that we should
2512 * not wait until HCI layer is ready.
2513 */
2514 pipe = usb_rcvctrlpipe(udev, 0);
2515 err = usb_control_msg(udev, pipe, request, USB_TYPE_VENDOR | USB_DIR_IN,
2516 0, 0, buf, size, USB_CTRL_SET_TIMEOUT);
2517 if (err < 0) {
2518 BT_ERR("%s: Failed to access otp area (%d)", hdev->name, err);
2519 goto done;
2520 }
2521
2522 memcpy(data, buf, size);
2523
2524 done:
2525 kfree(buf);
2526
2527 return err;
2528 }
2529
2530 static int btusb_setup_qca_download_fw(struct hci_dev *hdev,
2531 const struct firmware *firmware,
2532 size_t hdr_size)
2533 {
2534 struct btusb_data *btdata = hci_get_drvdata(hdev);
2535 struct usb_device *udev = btdata->udev;
2536 size_t count, size, sent = 0;
2537 int pipe, len, err;
2538 u8 *buf;
2539
2540 buf = kmalloc(QCA_DFU_PACKET_LEN, GFP_KERNEL);
2541 if (!buf)
2542 return -ENOMEM;
2543
2544 count = firmware->size;
2545
2546 size = min_t(size_t, count, hdr_size);
2547 memcpy(buf, firmware->data, size);
2548
2549 /* USB patches should go down to controller through USB path
2550 * because binary format fits to go down through USB channel.
2551 * USB control path is for patching headers and USB bulk is for
2552 * patch body.
2553 */
2554 pipe = usb_sndctrlpipe(udev, 0);
2555 err = usb_control_msg(udev, pipe, QCA_DFU_DOWNLOAD, USB_TYPE_VENDOR,
2556 0, 0, buf, size, USB_CTRL_SET_TIMEOUT);
2557 if (err < 0) {
2558 BT_ERR("%s: Failed to send headers (%d)", hdev->name, err);
2559 goto done;
2560 }
2561
2562 sent += size;
2563 count -= size;
2564
2565 while (count) {
2566 size = min_t(size_t, count, QCA_DFU_PACKET_LEN);
2567
2568 memcpy(buf, firmware->data + sent, size);
2569
2570 pipe = usb_sndbulkpipe(udev, 0x02);
2571 err = usb_bulk_msg(udev, pipe, buf, size, &len,
2572 QCA_DFU_TIMEOUT);
2573 if (err < 0) {
2574 BT_ERR("%s: Failed to send body at %zd of %zd (%d)",
2575 hdev->name, sent, firmware->size, err);
2576 break;
2577 }
2578
2579 if (size != len) {
2580 BT_ERR("%s: Failed to get bulk buffer", hdev->name);
2581 err = -EILSEQ;
2582 break;
2583 }
2584
2585 sent += size;
2586 count -= size;
2587 }
2588
2589 done:
2590 kfree(buf);
2591 return err;
2592 }
2593
2594 static int btusb_setup_qca_load_rampatch(struct hci_dev *hdev,
2595 struct qca_version *ver,
2596 const struct qca_device_info *info)
2597 {
2598 struct qca_rampatch_version *rver;
2599 const struct firmware *fw;
2600 u32 ver_rom, ver_patch;
2601 u16 rver_rom, rver_patch;
2602 char fwname[64];
2603 int err;
2604
2605 ver_rom = le32_to_cpu(ver->rom_version);
2606 ver_patch = le32_to_cpu(ver->patch_version);
2607
2608 snprintf(fwname, sizeof(fwname), "qca/rampatch_usb_%08x.bin", ver_rom);
2609
2610 err = request_firmware(&fw, fwname, &hdev->dev);
2611 if (err) {
2612 BT_ERR("%s: failed to request rampatch file: %s (%d)",
2613 hdev->name, fwname, err);
2614 return err;
2615 }
2616
2617 BT_INFO("%s: using rampatch file: %s", hdev->name, fwname);
2618
2619 rver = (struct qca_rampatch_version *)(fw->data + info->ver_offset);
2620 rver_rom = le16_to_cpu(rver->rom_version);
2621 rver_patch = le16_to_cpu(rver->patch_version);
2622
2623 BT_INFO("%s: QCA: patch rome 0x%x build 0x%x, firmware rome 0x%x "
2624 "build 0x%x", hdev->name, rver_rom, rver_patch, ver_rom,
2625 ver_patch);
2626
2627 if (rver_rom != ver_rom || rver_patch <= ver_patch) {
2628 BT_ERR("%s: rampatch file version did not match with firmware",
2629 hdev->name);
2630 err = -EINVAL;
2631 goto done;
2632 }
2633
2634 err = btusb_setup_qca_download_fw(hdev, fw, info->rampatch_hdr);
2635
2636 done:
2637 release_firmware(fw);
2638
2639 return err;
2640 }
2641
2642 static int btusb_setup_qca_load_nvm(struct hci_dev *hdev,
2643 struct qca_version *ver,
2644 const struct qca_device_info *info)
2645 {
2646 const struct firmware *fw;
2647 char fwname[64];
2648 int err;
2649
2650 snprintf(fwname, sizeof(fwname), "qca/nvm_usb_%08x.bin",
2651 le32_to_cpu(ver->rom_version));
2652
2653 err = request_firmware(&fw, fwname, &hdev->dev);
2654 if (err) {
2655 BT_ERR("%s: failed to request NVM file: %s (%d)",
2656 hdev->name, fwname, err);
2657 return err;
2658 }
2659
2660 BT_INFO("%s: using NVM file: %s", hdev->name, fwname);
2661
2662 err = btusb_setup_qca_download_fw(hdev, fw, info->nvm_hdr);
2663
2664 release_firmware(fw);
2665
2666 return err;
2667 }
2668
2669 static int btusb_setup_qca(struct hci_dev *hdev)
2670 {
2671 const struct qca_device_info *info = NULL;
2672 struct qca_version ver;
2673 u32 ver_rom;
2674 u8 status;
2675 int i, err;
2676
2677 err = btusb_qca_send_vendor_req(hdev, QCA_GET_TARGET_VERSION, &ver,
2678 sizeof(ver));
2679 if (err < 0)
2680 return err;
2681
2682 ver_rom = le32_to_cpu(ver.rom_version);
2683 for (i = 0; i < ARRAY_SIZE(qca_devices_table); i++) {
2684 if (ver_rom == qca_devices_table[i].rom_version)
2685 info = &qca_devices_table[i];
2686 }
2687 if (!info) {
2688 BT_ERR("%s: don't support firmware rome 0x%x", hdev->name,
2689 ver_rom);
2690 return -ENODEV;
2691 }
2692
2693 err = btusb_qca_send_vendor_req(hdev, QCA_CHECK_STATUS, &status,
2694 sizeof(status));
2695 if (err < 0)
2696 return err;
2697
2698 if (!(status & QCA_PATCH_UPDATED)) {
2699 err = btusb_setup_qca_load_rampatch(hdev, &ver, info);
2700 if (err < 0)
2701 return err;
2702 }
2703
2704 if (!(status & QCA_SYSCFG_UPDATED)) {
2705 err = btusb_setup_qca_load_nvm(hdev, &ver, info);
2706 if (err < 0)
2707 return err;
2708 }
2709
2710 return 0;
2711 }
2712
2713 #ifdef CONFIG_BT_HCIBTUSB_BCM
2714 static inline int __set_diag_interface(struct hci_dev *hdev)
2715 {
2716 struct btusb_data *data = hci_get_drvdata(hdev);
2717 struct usb_interface *intf = data->diag;
2718 int i;
2719
2720 if (!data->diag)
2721 return -ENODEV;
2722
2723 data->diag_tx_ep = NULL;
2724 data->diag_rx_ep = NULL;
2725
2726 for (i = 0; i < intf->cur_altsetting->desc.bNumEndpoints; i++) {
2727 struct usb_endpoint_descriptor *ep_desc;
2728
2729 ep_desc = &intf->cur_altsetting->endpoint[i].desc;
2730
2731 if (!data->diag_tx_ep && usb_endpoint_is_bulk_out(ep_desc)) {
2732 data->diag_tx_ep = ep_desc;
2733 continue;
2734 }
2735
2736 if (!data->diag_rx_ep && usb_endpoint_is_bulk_in(ep_desc)) {
2737 data->diag_rx_ep = ep_desc;
2738 continue;
2739 }
2740 }
2741
2742 if (!data->diag_tx_ep || !data->diag_rx_ep) {
2743 BT_ERR("%s invalid diagnostic descriptors", hdev->name);
2744 return -ENODEV;
2745 }
2746
2747 return 0;
2748 }
2749
2750 static struct urb *alloc_diag_urb(struct hci_dev *hdev, bool enable)
2751 {
2752 struct btusb_data *data = hci_get_drvdata(hdev);
2753 struct sk_buff *skb;
2754 struct urb *urb;
2755 unsigned int pipe;
2756
2757 if (!data->diag_tx_ep)
2758 return ERR_PTR(-ENODEV);
2759
2760 urb = usb_alloc_urb(0, GFP_KERNEL);
2761 if (!urb)
2762 return ERR_PTR(-ENOMEM);
2763
2764 skb = bt_skb_alloc(2, GFP_KERNEL);
2765 if (!skb) {
2766 usb_free_urb(urb);
2767 return ERR_PTR(-ENOMEM);
2768 }
2769
2770 skb_put_u8(skb, 0xf0);
2771 skb_put_u8(skb, enable);
2772
2773 pipe = usb_sndbulkpipe(data->udev, data->diag_tx_ep->bEndpointAddress);
2774
2775 usb_fill_bulk_urb(urb, data->udev, pipe,
2776 skb->data, skb->len, btusb_tx_complete, skb);
2777
2778 skb->dev = (void *)hdev;
2779
2780 return urb;
2781 }
2782
2783 static int btusb_bcm_set_diag(struct hci_dev *hdev, bool enable)
2784 {
2785 struct btusb_data *data = hci_get_drvdata(hdev);
2786 struct urb *urb;
2787
2788 if (!data->diag)
2789 return -ENODEV;
2790
2791 if (!test_bit(HCI_RUNNING, &hdev->flags))
2792 return -ENETDOWN;
2793
2794 urb = alloc_diag_urb(hdev, enable);
2795 if (IS_ERR(urb))
2796 return PTR_ERR(urb);
2797
2798 return submit_or_queue_tx_urb(hdev, urb);
2799 }
2800 #endif
2801
2802 #ifdef CONFIG_PM
2803 static irqreturn_t btusb_oob_wake_handler(int irq, void *priv)
2804 {
2805 struct btusb_data *data = priv;
2806
2807 pm_wakeup_event(&data->udev->dev, 0);
2808 pm_system_wakeup();
2809
2810 /* Disable only if not already disabled (keep it balanced) */
2811 if (test_and_clear_bit(BTUSB_OOB_WAKE_ENABLED, &data->flags)) {
2812 disable_irq_nosync(irq);
2813 disable_irq_wake(irq);
2814 }
2815 return IRQ_HANDLED;
2816 }
2817
2818 static const struct of_device_id btusb_match_table[] = {
2819 { .compatible = "usb1286,204e" },
2820 { }
2821 };
2822 MODULE_DEVICE_TABLE(of, btusb_match_table);
2823
2824 /* Use an oob wakeup pin? */
2825 static int btusb_config_oob_wake(struct hci_dev *hdev)
2826 {
2827 struct btusb_data *data = hci_get_drvdata(hdev);
2828 struct device *dev = &data->udev->dev;
2829 int irq, ret;
2830
2831 clear_bit(BTUSB_OOB_WAKE_ENABLED, &data->flags);
2832
2833 if (!of_match_device(btusb_match_table, dev))
2834 return 0;
2835
2836 /* Move on if no IRQ specified */
2837 irq = of_irq_get_byname(dev->of_node, "wakeup");
2838 if (irq <= 0) {
2839 bt_dev_dbg(hdev, "%s: no OOB Wakeup IRQ in DT", __func__);
2840 return 0;
2841 }
2842
2843 ret = devm_request_irq(&hdev->dev, irq, btusb_oob_wake_handler,
2844 0, "OOB Wake-on-BT", data);
2845 if (ret) {
2846 bt_dev_err(hdev, "%s: IRQ request failed", __func__);
2847 return ret;
2848 }
2849
2850 ret = device_init_wakeup(dev, true);
2851 if (ret) {
2852 bt_dev_err(hdev, "%s: failed to init_wakeup", __func__);
2853 return ret;
2854 }
2855
2856 data->oob_wake_irq = irq;
2857 disable_irq(irq);
2858 bt_dev_info(hdev, "OOB Wake-on-BT configured at IRQ %u", irq);
2859 return 0;
2860 }
2861 #endif
2862
2863 static int btusb_probe(struct usb_interface *intf,
2864 const struct usb_device_id *id)
2865 {
2866 struct usb_endpoint_descriptor *ep_desc;
2867 struct btusb_data *data;
2868 struct hci_dev *hdev;
2869 unsigned ifnum_base;
2870 int i, err;
2871
2872 BT_DBG("intf %p id %p", intf, id);
2873
2874 /* interface numbers are hardcoded in the spec */
2875 if (intf->cur_altsetting->desc.bInterfaceNumber != 0) {
2876 if (!(id->driver_info & BTUSB_IFNUM_2))
2877 return -ENODEV;
2878 if (intf->cur_altsetting->desc.bInterfaceNumber != 2)
2879 return -ENODEV;
2880 }
2881
2882 ifnum_base = intf->cur_altsetting->desc.bInterfaceNumber;
2883
2884 if (!id->driver_info) {
2885 const struct usb_device_id *match;
2886
2887 match = usb_match_id(intf, blacklist_table);
2888 if (match)
2889 id = match;
2890 }
2891
2892 if (id->driver_info == BTUSB_IGNORE)
2893 return -ENODEV;
2894
2895 if (id->driver_info & BTUSB_ATH3012) {
2896 struct usb_device *udev = interface_to_usbdev(intf);
2897
2898 /* Old firmware would otherwise let ath3k driver load
2899 * patch and sysconfig files */
2900 if (le16_to_cpu(udev->descriptor.bcdDevice) <= 0x0001)
2901 return -ENODEV;
2902 }
2903
2904 data = devm_kzalloc(&intf->dev, sizeof(*data), GFP_KERNEL);
2905 if (!data)
2906 return -ENOMEM;
2907
2908 for (i = 0; i < intf->cur_altsetting->desc.bNumEndpoints; i++) {
2909 ep_desc = &intf->cur_altsetting->endpoint[i].desc;
2910
2911 if (!data->intr_ep && usb_endpoint_is_int_in(ep_desc)) {
2912 data->intr_ep = ep_desc;
2913 continue;
2914 }
2915
2916 if (!data->bulk_tx_ep && usb_endpoint_is_bulk_out(ep_desc)) {
2917 data->bulk_tx_ep = ep_desc;
2918 continue;
2919 }
2920
2921 if (!data->bulk_rx_ep && usb_endpoint_is_bulk_in(ep_desc)) {
2922 data->bulk_rx_ep = ep_desc;
2923 continue;
2924 }
2925 }
2926
2927 if (!data->intr_ep || !data->bulk_tx_ep || !data->bulk_rx_ep)
2928 return -ENODEV;
2929
2930 if (id->driver_info & BTUSB_AMP) {
2931 data->cmdreq_type = USB_TYPE_CLASS | 0x01;
2932 data->cmdreq = 0x2b;
2933 } else {
2934 data->cmdreq_type = USB_TYPE_CLASS;
2935 data->cmdreq = 0x00;
2936 }
2937
2938 data->udev = interface_to_usbdev(intf);
2939 data->intf = intf;
2940
2941 INIT_WORK(&data->work, btusb_work);
2942 INIT_WORK(&data->waker, btusb_waker);
2943 init_usb_anchor(&data->deferred);
2944 init_usb_anchor(&data->tx_anchor);
2945 spin_lock_init(&data->txlock);
2946
2947 init_usb_anchor(&data->intr_anchor);
2948 init_usb_anchor(&data->bulk_anchor);
2949 init_usb_anchor(&data->isoc_anchor);
2950 init_usb_anchor(&data->diag_anchor);
2951 spin_lock_init(&data->rxlock);
2952
2953 if (id->driver_info & BTUSB_INTEL_NEW) {
2954 data->recv_event = btusb_recv_event_intel;
2955 data->recv_bulk = btusb_recv_bulk_intel;
2956 set_bit(BTUSB_BOOTLOADER, &data->flags);
2957 } else {
2958 data->recv_event = hci_recv_frame;
2959 data->recv_bulk = btusb_recv_bulk;
2960 }
2961
2962 hdev = hci_alloc_dev();
2963 if (!hdev)
2964 return -ENOMEM;
2965
2966 hdev->bus = HCI_USB;
2967 hci_set_drvdata(hdev, data);
2968
2969 if (id->driver_info & BTUSB_AMP)
2970 hdev->dev_type = HCI_AMP;
2971 else
2972 hdev->dev_type = HCI_PRIMARY;
2973
2974 data->hdev = hdev;
2975
2976 SET_HCIDEV_DEV(hdev, &intf->dev);
2977
2978 hdev->open = btusb_open;
2979 hdev->close = btusb_close;
2980 hdev->flush = btusb_flush;
2981 hdev->send = btusb_send_frame;
2982 hdev->notify = btusb_notify;
2983
2984 #ifdef CONFIG_PM
2985 err = btusb_config_oob_wake(hdev);
2986 if (err)
2987 goto out_free_dev;
2988
2989 /* Marvell devices may need a specific chip configuration */
2990 if (id->driver_info & BTUSB_MARVELL && data->oob_wake_irq) {
2991 err = marvell_config_oob_wake(hdev);
2992 if (err)
2993 goto out_free_dev;
2994 }
2995 #endif
2996 if (id->driver_info & BTUSB_CW6622)
2997 set_bit(HCI_QUIRK_BROKEN_STORED_LINK_KEY, &hdev->quirks);
2998
2999 if (id->driver_info & BTUSB_BCM2045)
3000 set_bit(HCI_QUIRK_BROKEN_STORED_LINK_KEY, &hdev->quirks);
3001
3002 if (id->driver_info & BTUSB_BCM92035)
3003 hdev->setup = btusb_setup_bcm92035;
3004
3005 #ifdef CONFIG_BT_HCIBTUSB_BCM
3006 if (id->driver_info & BTUSB_BCM_PATCHRAM) {
3007 hdev->manufacturer = 15;
3008 hdev->setup = btbcm_setup_patchram;
3009 hdev->set_diag = btusb_bcm_set_diag;
3010 hdev->set_bdaddr = btbcm_set_bdaddr;
3011
3012 /* Broadcom LM_DIAG Interface numbers are hardcoded */
3013 data->diag = usb_ifnum_to_if(data->udev, ifnum_base + 2);
3014 }
3015
3016 if (id->driver_info & BTUSB_BCM_APPLE) {
3017 hdev->manufacturer = 15;
3018 hdev->setup = btbcm_setup_apple;
3019 hdev->set_diag = btusb_bcm_set_diag;
3020
3021 /* Broadcom LM_DIAG Interface numbers are hardcoded */
3022 data->diag = usb_ifnum_to_if(data->udev, ifnum_base + 2);
3023 }
3024 #endif
3025
3026 if (id->driver_info & BTUSB_INTEL) {
3027 hdev->manufacturer = 2;
3028 hdev->setup = btusb_setup_intel;
3029 hdev->shutdown = btusb_shutdown_intel;
3030 hdev->set_diag = btintel_set_diag_mfg;
3031 hdev->set_bdaddr = btintel_set_bdaddr;
3032 set_bit(HCI_QUIRK_STRICT_DUPLICATE_FILTER, &hdev->quirks);
3033 set_bit(HCI_QUIRK_SIMULTANEOUS_DISCOVERY, &hdev->quirks);
3034 set_bit(HCI_QUIRK_NON_PERSISTENT_DIAG, &hdev->quirks);
3035 }
3036
3037 if (id->driver_info & BTUSB_INTEL_NEW) {
3038 hdev->manufacturer = 2;
3039 hdev->send = btusb_send_frame_intel;
3040 hdev->setup = btusb_setup_intel_new;
3041 hdev->hw_error = btintel_hw_error;
3042 hdev->set_diag = btintel_set_diag;
3043 hdev->set_bdaddr = btintel_set_bdaddr;
3044 set_bit(HCI_QUIRK_STRICT_DUPLICATE_FILTER, &hdev->quirks);
3045 set_bit(HCI_QUIRK_NON_PERSISTENT_DIAG, &hdev->quirks);
3046 }
3047
3048 if (id->driver_info & BTUSB_MARVELL)
3049 hdev->set_bdaddr = btusb_set_bdaddr_marvell;
3050
3051 if (id->driver_info & BTUSB_SWAVE) {
3052 set_bit(HCI_QUIRK_FIXUP_INQUIRY_MODE, &hdev->quirks);
3053 set_bit(HCI_QUIRK_BROKEN_LOCAL_COMMANDS, &hdev->quirks);
3054 }
3055
3056 if (id->driver_info & BTUSB_INTEL_BOOT) {
3057 hdev->manufacturer = 2;
3058 set_bit(HCI_QUIRK_RAW_DEVICE, &hdev->quirks);
3059 }
3060
3061 if (id->driver_info & BTUSB_ATH3012) {
3062 hdev->set_bdaddr = btusb_set_bdaddr_ath3012;
3063 set_bit(HCI_QUIRK_SIMULTANEOUS_DISCOVERY, &hdev->quirks);
3064 set_bit(HCI_QUIRK_STRICT_DUPLICATE_FILTER, &hdev->quirks);
3065 }
3066
3067 if (id->driver_info & BTUSB_QCA_ROME) {
3068 data->setup_on_usb = btusb_setup_qca;
3069 hdev->set_bdaddr = btusb_set_bdaddr_ath3012;
3070 }
3071
3072 #ifdef CONFIG_BT_HCIBTUSB_RTL
3073 if (id->driver_info & BTUSB_REALTEK) {
3074 hdev->setup = btrtl_setup_realtek;
3075
3076 /* Realtek devices lose their updated firmware over suspend,
3077 * but the USB hub doesn't notice any status change.
3078 * Explicitly request a device reset on resume.
3079 */
3080 set_bit(BTUSB_RESET_RESUME, &data->flags);
3081 }
3082 #endif
3083
3084 if (id->driver_info & BTUSB_AMP) {
3085 /* AMP controllers do not support SCO packets */
3086 data->isoc = NULL;
3087 } else {
3088 /* Interface orders are hardcoded in the specification */
3089 data->isoc = usb_ifnum_to_if(data->udev, ifnum_base + 1);
3090 }
3091
3092 if (!reset)
3093 set_bit(HCI_QUIRK_RESET_ON_CLOSE, &hdev->quirks);
3094
3095 if (force_scofix || id->driver_info & BTUSB_WRONG_SCO_MTU) {
3096 if (!disable_scofix)
3097 set_bit(HCI_QUIRK_FIXUP_BUFFER_SIZE, &hdev->quirks);
3098 }
3099
3100 if (id->driver_info & BTUSB_BROKEN_ISOC)
3101 data->isoc = NULL;
3102
3103 if (id->driver_info & BTUSB_DIGIANSWER) {
3104 data->cmdreq_type = USB_TYPE_VENDOR;
3105 set_bit(HCI_QUIRK_RESET_ON_CLOSE, &hdev->quirks);
3106 }
3107
3108 if (id->driver_info & BTUSB_CSR) {
3109 struct usb_device *udev = data->udev;
3110 u16 bcdDevice = le16_to_cpu(udev->descriptor.bcdDevice);
3111
3112 /* Old firmware would otherwise execute USB reset */
3113 if (bcdDevice < 0x117)
3114 set_bit(HCI_QUIRK_RESET_ON_CLOSE, &hdev->quirks);
3115
3116 /* Fake CSR devices with broken commands */
3117 if (bcdDevice <= 0x100 || bcdDevice == 0x134)
3118 hdev->setup = btusb_setup_csr;
3119
3120 set_bit(HCI_QUIRK_SIMULTANEOUS_DISCOVERY, &hdev->quirks);
3121 }
3122
3123 if (id->driver_info & BTUSB_SNIFFER) {
3124 struct usb_device *udev = data->udev;
3125
3126 /* New sniffer firmware has crippled HCI interface */
3127 if (le16_to_cpu(udev->descriptor.bcdDevice) > 0x997)
3128 set_bit(HCI_QUIRK_RAW_DEVICE, &hdev->quirks);
3129 }
3130
3131 if (id->driver_info & BTUSB_INTEL_BOOT) {
3132 /* A bug in the bootloader causes that interrupt interface is
3133 * only enabled after receiving SetInterface(0, AltSetting=0).
3134 */
3135 err = usb_set_interface(data->udev, 0, 0);
3136 if (err < 0) {
3137 BT_ERR("failed to set interface 0, alt 0 %d", err);
3138 goto out_free_dev;
3139 }
3140 }
3141
3142 if (data->isoc) {
3143 err = usb_driver_claim_interface(&btusb_driver,
3144 data->isoc, data);
3145 if (err < 0)
3146 goto out_free_dev;
3147 }
3148
3149 #ifdef CONFIG_BT_HCIBTUSB_BCM
3150 if (data->diag) {
3151 if (!usb_driver_claim_interface(&btusb_driver,
3152 data->diag, data))
3153 __set_diag_interface(hdev);
3154 else
3155 data->diag = NULL;
3156 }
3157 #endif
3158
3159 err = hci_register_dev(hdev);
3160 if (err < 0)
3161 goto out_free_dev;
3162
3163 usb_set_intfdata(intf, data);
3164
3165 return 0;
3166
3167 out_free_dev:
3168 hci_free_dev(hdev);
3169 return err;
3170 }
3171
3172 static void btusb_disconnect(struct usb_interface *intf)
3173 {
3174 struct btusb_data *data = usb_get_intfdata(intf);
3175 struct hci_dev *hdev;
3176
3177 BT_DBG("intf %p", intf);
3178
3179 if (!data)
3180 return;
3181
3182 hdev = data->hdev;
3183 usb_set_intfdata(data->intf, NULL);
3184
3185 if (data->isoc)
3186 usb_set_intfdata(data->isoc, NULL);
3187
3188 if (data->diag)
3189 usb_set_intfdata(data->diag, NULL);
3190
3191 hci_unregister_dev(hdev);
3192
3193 if (intf == data->intf) {
3194 if (data->isoc)
3195 usb_driver_release_interface(&btusb_driver, data->isoc);
3196 if (data->diag)
3197 usb_driver_release_interface(&btusb_driver, data->diag);
3198 } else if (intf == data->isoc) {
3199 if (data->diag)
3200 usb_driver_release_interface(&btusb_driver, data->diag);
3201 usb_driver_release_interface(&btusb_driver, data->intf);
3202 } else if (intf == data->diag) {
3203 usb_driver_release_interface(&btusb_driver, data->intf);
3204 if (data->isoc)
3205 usb_driver_release_interface(&btusb_driver, data->isoc);
3206 }
3207
3208 if (data->oob_wake_irq)
3209 device_init_wakeup(&data->udev->dev, false);
3210
3211 hci_free_dev(hdev);
3212 }
3213
3214 #ifdef CONFIG_PM
3215 static int btusb_suspend(struct usb_interface *intf, pm_message_t message)
3216 {
3217 struct btusb_data *data = usb_get_intfdata(intf);
3218
3219 BT_DBG("intf %p", intf);
3220
3221 if (data->suspend_count++)
3222 return 0;
3223
3224 spin_lock_irq(&data->txlock);
3225 if (!(PMSG_IS_AUTO(message) && data->tx_in_flight)) {
3226 set_bit(BTUSB_SUSPENDING, &data->flags);
3227 spin_unlock_irq(&data->txlock);
3228 } else {
3229 spin_unlock_irq(&data->txlock);
3230 data->suspend_count--;
3231 return -EBUSY;
3232 }
3233
3234 cancel_work_sync(&data->work);
3235
3236 btusb_stop_traffic(data);
3237 usb_kill_anchored_urbs(&data->tx_anchor);
3238
3239 if (data->oob_wake_irq && device_may_wakeup(&data->udev->dev)) {
3240 set_bit(BTUSB_OOB_WAKE_ENABLED, &data->flags);
3241 enable_irq_wake(data->oob_wake_irq);
3242 enable_irq(data->oob_wake_irq);
3243 }
3244
3245 /* Optionally request a device reset on resume, but only when
3246 * wakeups are disabled. If wakeups are enabled we assume the
3247 * device will stay powered up throughout suspend.
3248 */
3249 if (test_bit(BTUSB_RESET_RESUME, &data->flags) &&
3250 !device_may_wakeup(&data->udev->dev))
3251 data->udev->reset_resume = 1;
3252
3253 return 0;
3254 }
3255
3256 static void play_deferred(struct btusb_data *data)
3257 {
3258 struct urb *urb;
3259 int err;
3260
3261 while ((urb = usb_get_from_anchor(&data->deferred))) {
3262 err = usb_submit_urb(urb, GFP_ATOMIC);
3263 if (err < 0)
3264 break;
3265
3266 data->tx_in_flight++;
3267 }
3268 usb_scuttle_anchored_urbs(&data->deferred);
3269 }
3270
3271 static int btusb_resume(struct usb_interface *intf)
3272 {
3273 struct btusb_data *data = usb_get_intfdata(intf);
3274 struct hci_dev *hdev = data->hdev;
3275 int err = 0;
3276
3277 BT_DBG("intf %p", intf);
3278
3279 if (--data->suspend_count)
3280 return 0;
3281
3282 /* Disable only if not already disabled (keep it balanced) */
3283 if (test_and_clear_bit(BTUSB_OOB_WAKE_ENABLED, &data->flags)) {
3284 disable_irq(data->oob_wake_irq);
3285 disable_irq_wake(data->oob_wake_irq);
3286 }
3287
3288 if (!test_bit(HCI_RUNNING, &hdev->flags))
3289 goto done;
3290
3291 if (test_bit(BTUSB_INTR_RUNNING, &data->flags)) {
3292 err = btusb_submit_intr_urb(hdev, GFP_NOIO);
3293 if (err < 0) {
3294 clear_bit(BTUSB_INTR_RUNNING, &data->flags);
3295 goto failed;
3296 }
3297 }
3298
3299 if (test_bit(BTUSB_BULK_RUNNING, &data->flags)) {
3300 err = btusb_submit_bulk_urb(hdev, GFP_NOIO);
3301 if (err < 0) {
3302 clear_bit(BTUSB_BULK_RUNNING, &data->flags);
3303 goto failed;
3304 }
3305
3306 btusb_submit_bulk_urb(hdev, GFP_NOIO);
3307 }
3308
3309 if (test_bit(BTUSB_ISOC_RUNNING, &data->flags)) {
3310 if (btusb_submit_isoc_urb(hdev, GFP_NOIO) < 0)
3311 clear_bit(BTUSB_ISOC_RUNNING, &data->flags);
3312 else
3313 btusb_submit_isoc_urb(hdev, GFP_NOIO);
3314 }
3315
3316 spin_lock_irq(&data->txlock);
3317 play_deferred(data);
3318 clear_bit(BTUSB_SUSPENDING, &data->flags);
3319 spin_unlock_irq(&data->txlock);
3320 schedule_work(&data->work);
3321
3322 return 0;
3323
3324 failed:
3325 usb_scuttle_anchored_urbs(&data->deferred);
3326 done:
3327 spin_lock_irq(&data->txlock);
3328 clear_bit(BTUSB_SUSPENDING, &data->flags);
3329 spin_unlock_irq(&data->txlock);
3330
3331 return err;
3332 }
3333 #endif
3334
3335 static struct usb_driver btusb_driver = {
3336 .name = "btusb",
3337 .probe = btusb_probe,
3338 .disconnect = btusb_disconnect,
3339 #ifdef CONFIG_PM
3340 .suspend = btusb_suspend,
3341 .resume = btusb_resume,
3342 #endif
3343 .id_table = btusb_table,
3344 .supports_autosuspend = 1,
3345 .disable_hub_initiated_lpm = 1,
3346 };
3347
3348 module_usb_driver(btusb_driver);
3349
3350 module_param(disable_scofix, bool, 0644);
3351 MODULE_PARM_DESC(disable_scofix, "Disable fixup of wrong SCO buffer size");
3352
3353 module_param(force_scofix, bool, 0644);
3354 MODULE_PARM_DESC(force_scofix, "Force fixup of wrong SCO buffers size");
3355
3356 module_param(reset, bool, 0644);
3357 MODULE_PARM_DESC(reset, "Send HCI reset command on initialization");
3358
3359 MODULE_AUTHOR("Marcel Holtmann <marcel@holtmann.org>");
3360 MODULE_DESCRIPTION("Generic Bluetooth USB driver ver " VERSION);
3361 MODULE_VERSION(VERSION);
3362 MODULE_LICENSE("GPL");
Linux with added FPC-III support