projects / linux-2.6-block.git / blame
? search:
summary | shortlog | log | commit | commitdiff | tree
blob | blame (incremental) | history | HEAD
Merge branch 'for-upstream' of git://git.kernel.org/pub/scm/linux/kernel/git/bluetoot...
[linux-2.6-block.git] / drivers / bluetooth / btusb.c
CommitLineData
5e23b923
MH		 1/*
2 *
3 * Generic Bluetooth USB driver
4 *
9bfa35fe 5 * Copyright (C) 2005-2008 Marcel Holtmann <marcel@holtmann.org>
5e23b923
MH		 6 *
7 *
8 * This program is free software; you can redistribute it and/or modify
9 * it under the terms of the GNU General Public License as published by
10 * the Free Software Foundation; either version 2 of the License, or
11 * (at your option) any later version.
12 *
13 * This program is distributed in the hope that it will be useful,
14 * but WITHOUT ANY WARRANTY; without even the implied warranty of
15 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
16 * GNU General Public License for more details.
17 *
18 * You should have received a copy of the GNU General Public License
19 * along with this program; if not, write to the Free Software
20 * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
21 *
22 */
23
5e23b923 24#include <linux/module.h>
5e23b923 25#include <linux/usb.h>
dffd30ee 26#include <linux/firmware.h>
5e23b923
MH		 27
28#include <net/bluetooth/bluetooth.h>
29#include <net/bluetooth/hci_core.h>
30
7bee549e 31#define VERSION "0.6"
cfeb4145 32
90ab5ee9
RR		 33static bool ignore_dga;
34static bool ignore_csr;
35static bool ignore_sniffer;
36static bool disable_scofix;
37static bool force_scofix;
7a9d4020 38
90ab5ee9 39static bool reset = 1;
cfeb4145
MH		 40
41static struct usb_driver btusb_driver;
42
43#define BTUSB_IGNORE 0x01
7a9d4020
MH		 44#define BTUSB_DIGIANSWER 0x02
45#define BTUSB_CSR 0x04
46#define BTUSB_SNIFFER 0x08
47#define BTUSB_BCM92035 0x10
48#define BTUSB_BROKEN_ISOC 0x20
49#define BTUSB_WRONG_SCO_MTU 0x40
2d25f8b4 50#define BTUSB_ATH3012 0x80
dffd30ee 51#define BTUSB_INTEL 0x100
5e23b923 52
54265202 53static const struct usb_device_id btusb_table[] = {
5e23b923
MH		 54 /* Generic Bluetooth USB device */
55 { USB_DEVICE_INFO(0xe0, 0x01, 0x01) },
56
1fa6535f
HR		 57 /* Apple-specific (Broadcom) devices */
58 { USB_VENDOR_AND_INTERFACE_INFO(0x05ac, 0xff, 0x01, 0x01) },
59
178c059e
CYC		 60 /* MediaTek MT76x0E */
61 { USB_DEVICE(0x0e8d, 0x763f) },
62
c510eae3 63 /* Broadcom SoftSailing reporting vendor specific */
2e8b5063 64 { USB_DEVICE(0x0a5c, 0x21e1) },
c510eae3 65
3cd01976
NI		 66 /* Apple MacBookPro 7,1 */
67 { USB_DEVICE(0x05ac, 0x8213) },
68
0a79f674
CL		 69 /* Apple iMac11,1 */
70 { USB_DEVICE(0x05ac, 0x8215) },
71
9c047157
NI		 72 /* Apple MacBookPro6,2 */
73 { USB_DEVICE(0x05ac, 0x8218) },
74
3e3ede7d
EH		 75 /* Apple MacBookAir3,1, MacBookAir3,2 */
76 { USB_DEVICE(0x05ac, 0x821b) },
77
a63b723d
PAVM		 78 /* Apple MacBookAir4,1 */
79 { USB_DEVICE(0x05ac, 0x821f) },
80
88d377b6
MAP		 81 /* Apple MacBookPro8,2 */
82 { USB_DEVICE(0x05ac, 0x821a) },
83
f78b6826
JK		 84 /* Apple MacMini5,1 */
85 { USB_DEVICE(0x05ac, 0x8281) },
86
cfeb4145
MH		 87 /* AVM BlueFRITZ! USB v2.0 */
88 { USB_DEVICE(0x057c, 0x3800) },
89
90 /* Bluetooth Ultraport Module from IBM */
91 { USB_DEVICE(0x04bf, 0x030a) },
92
93 /* ALPS Modules with non-standard id */
94 { USB_DEVICE(0x044e, 0x3001) },
95 { USB_DEVICE(0x044e, 0x3002) },
96
97 /* Ericsson with non-standard id */
98 { USB_DEVICE(0x0bdb, 0x1002) },
99
100 /* Canyon CN-BTU1 with HID interfaces */
7a9d4020 101 { USB_DEVICE(0x0c10, 0x0000) },
cfeb4145 102
d13431ca 103 /* Broadcom BCM20702A0 */
1ee3ff61 104 { USB_DEVICE(0x0b05, 0x17b5) },
38a172be 105 { USB_DEVICE(0x0b05, 0x17cb) },
0c1abbd1 106 { USB_DEVICE(0x04ca, 0x2003) },
79cd7602 107 { USB_DEVICE(0x0489, 0xe042) },
d13431ca
WJS		 108 { USB_DEVICE(0x413c, 0x8197) },
109
98514036 110 /* Foxconn - Hon Hai */
ee66401b 111 { USB_VENDOR_AND_INTERFACE_INFO(0x0489, 0xff, 0x01, 0x01) },
98514036 112
92c385f4
GP		 113 /*Broadcom devices with vendor specific id */
114 { USB_VENDOR_AND_INTERFACE_INFO(0x0a5c, 0xff, 0x01, 0x01) },
115
5bcecf32
KB		 116 /* Belkin F8065bf - Broadcom based */
117 { USB_VENDOR_AND_INTERFACE_INFO(0x050d, 0xff, 0x01, 0x01) },
118
5e23b923
MH		 119 { } /* Terminating entry */
120};
121
122MODULE_DEVICE_TABLE(usb, btusb_table);
123
54265202 124static const struct usb_device_id blacklist_table[] = {
cfeb4145
MH		 125 /* CSR BlueCore devices */
126 { USB_DEVICE(0x0a12, 0x0001), .driver_info = BTUSB_CSR },
127
128 /* Broadcom BCM2033 without firmware */
129 { USB_DEVICE(0x0a5c, 0x2033), .driver_info = BTUSB_IGNORE },
130
be93112a
BS		 131 /* Atheros 3011 with sflash firmware */
132 { USB_DEVICE(0x0cf3, 0x3002), .driver_info = BTUSB_IGNORE },
6eda541d 133 { USB_DEVICE(0x0cf3, 0xe019), .driver_info = BTUSB_IGNORE },
2a7bcccc 134 { USB_DEVICE(0x13d3, 0x3304), .driver_info = BTUSB_IGNORE },
8e7c3d2e 135 { USB_DEVICE(0x0930, 0x0215), .driver_info = BTUSB_IGNORE },
6b6ba88b 136 { USB_DEVICE(0x0489, 0xe03d), .driver_info = BTUSB_IGNORE },
acd94544 137 { USB_DEVICE(0x0489, 0xe027), .driver_info = BTUSB_IGNORE },
be93112a 138
509e7861
CYC		 139 /* Atheros AR9285 Malbec with sflash firmware */
140 { USB_DEVICE(0x03f0, 0x311d), .driver_info = BTUSB_IGNORE },
141
d9f51b51 142 /* Atheros 3012 with sflash firmware */
d66629c1 143 { USB_DEVICE(0x0cf3, 0x0036), .driver_info = BTUSB_ATH3012 },
2d25f8b4 144 { USB_DEVICE(0x0cf3, 0x3004), .driver_info = BTUSB_ATH3012 },
94a32d10 145 { USB_DEVICE(0x0cf3, 0x3008), .driver_info = BTUSB_ATH3012 },
07c0ea87 146 { USB_DEVICE(0x0cf3, 0x311d), .driver_info = BTUSB_ATH3012 },
ebaf5795 147 { USB_DEVICE(0x0cf3, 0x817a), .driver_info = BTUSB_ATH3012 },
9498ba7a 148 { USB_DEVICE(0x13d3, 0x3375), .driver_info = BTUSB_ATH3012 },
3f63c340 149 { USB_DEVICE(0x04ca, 0x3004), .driver_info = BTUSB_ATH3012 },
55ed7d4d 150 { USB_DEVICE(0x04ca, 0x3005), .driver_info = BTUSB_ATH3012 },
2c262b2a 151 { USB_DEVICE(0x04ca, 0x3006), .driver_info = BTUSB_ATH3012 },
f4d6f7dc 152 { USB_DEVICE(0x04ca, 0x3008), .driver_info = BTUSB_ATH3012 },
bd0fca1b 153 { USB_DEVICE(0x04ca, 0x300b), .driver_info = BTUSB_ATH3012 },
87522a43 154 { USB_DEVICE(0x13d3, 0x3362), .driver_info = BTUSB_ATH3012 },
ac71311e 155 { USB_DEVICE(0x0cf3, 0xe004), .driver_info = BTUSB_ATH3012 },
0a3658cc 156 { USB_DEVICE(0x0cf3, 0xe005), .driver_info = BTUSB_ATH3012 },
6c4ae5c2 157 { USB_DEVICE(0x0930, 0x0219), .driver_info = BTUSB_ATH3012 },
2096ae6c 158 { USB_DEVICE(0x0489, 0xe057), .driver_info = BTUSB_ATH3012 },
eed307e2 159 { USB_DEVICE(0x13d3, 0x3393), .driver_info = BTUSB_ATH3012 },
3a61eda8 160 { USB_DEVICE(0x0489, 0xe04e), .driver_info = BTUSB_ATH3012 },
2582d529 161 { USB_DEVICE(0x0489, 0xe056), .driver_info = BTUSB_ATH3012 },
0fc110f4 162 { USB_DEVICE(0x0489, 0xe04d), .driver_info = BTUSB_ATH3012 },
84eb2ae1 163 { USB_DEVICE(0x04c5, 0x1330), .driver_info = BTUSB_ATH3012 },
5b77a1f3 164 { USB_DEVICE(0x13d3, 0x3402), .driver_info = BTUSB_ATH3012 },
1ebd0b21 165 { USB_DEVICE(0x0cf3, 0x3121), .driver_info = BTUSB_ATH3012 },
1d5b569e 166 { USB_DEVICE(0x0cf3, 0xe003), .driver_info = BTUSB_ATH3012 },
35580d22 167 { USB_DEVICE(0x0489, 0xe05f), .driver_info = BTUSB_ATH3012 },
d9f51b51 168
e9036e33
CYC		 169 /* Atheros AR5BBU12 with sflash firmware */
170 { USB_DEVICE(0x0489, 0xe02c), .driver_info = BTUSB_IGNORE },
171
85d59726
MG		 172 /* Atheros AR5BBU12 with sflash firmware */
173 { USB_DEVICE(0x0489, 0xe03c), .driver_info = BTUSB_ATH3012 },
bc21fde2 174 { USB_DEVICE(0x0489, 0xe036), .driver_info = BTUSB_ATH3012 },
85d59726 175
cfeb4145 176 /* Broadcom BCM2035 */
7a9d4020
MH		 177 { USB_DEVICE(0x0a5c, 0x2035), .driver_info = BTUSB_WRONG_SCO_MTU },
178 { USB_DEVICE(0x0a5c, 0x200a), .driver_info = BTUSB_WRONG_SCO_MTU },
179 { USB_DEVICE(0x0a5c, 0x2009), .driver_info = BTUSB_BCM92035 },
cfeb4145
MH		 180
181 /* Broadcom BCM2045 */
7a9d4020
MH		 182 { USB_DEVICE(0x0a5c, 0x2039), .driver_info = BTUSB_WRONG_SCO_MTU },
183 { USB_DEVICE(0x0a5c, 0x2101), .driver_info = BTUSB_WRONG_SCO_MTU },
bdbef3d6 184
cfeb4145 185 /* IBM/Lenovo ThinkPad with Broadcom chip */
7a9d4020
MH		 186 { USB_DEVICE(0x0a5c, 0x201e), .driver_info = BTUSB_WRONG_SCO_MTU },
187 { USB_DEVICE(0x0a5c, 0x2110), .driver_info = BTUSB_WRONG_SCO_MTU },
cfeb4145
MH		 188
189 /* HP laptop with Broadcom chip */
7a9d4020 190 { USB_DEVICE(0x03f0, 0x171d), .driver_info = BTUSB_WRONG_SCO_MTU },
cfeb4145
MH		 191
192 /* Dell laptop with Broadcom chip */
7a9d4020 193 { USB_DEVICE(0x413c, 0x8126), .driver_info = BTUSB_WRONG_SCO_MTU },
cfeb4145 194
5ddd4a60 195 /* Dell Wireless 370 and 410 devices */
7a9d4020 196 { USB_DEVICE(0x413c, 0x8152), .driver_info = BTUSB_WRONG_SCO_MTU },
5ddd4a60 197 { USB_DEVICE(0x413c, 0x8156), .driver_info = BTUSB_WRONG_SCO_MTU },
cfeb4145 198
7a9d4020
MH		 199 /* Belkin F8T012 and F8T013 devices */
200 { USB_DEVICE(0x050d, 0x0012), .driver_info = BTUSB_WRONG_SCO_MTU },
201 { USB_DEVICE(0x050d, 0x0013), .driver_info = BTUSB_WRONG_SCO_MTU },
cfeb4145 202
5ddd4a60
MH		 203 /* Asus WL-BTD202 device */
204 { USB_DEVICE(0x0b05, 0x1715), .driver_info = BTUSB_WRONG_SCO_MTU },
205
206 /* Kensington Bluetooth USB adapter */
207 { USB_DEVICE(0x047d, 0x105e), .driver_info = BTUSB_WRONG_SCO_MTU },
208
cfeb4145
MH		 209 /* RTX Telecom based adapters with buggy SCO support */
210 { USB_DEVICE(0x0400, 0x0807), .driver_info = BTUSB_BROKEN_ISOC },
211 { USB_DEVICE(0x0400, 0x080a), .driver_info = BTUSB_BROKEN_ISOC },
212
213 /* CONWISE Technology based adapters with buggy SCO support */
214 { USB_DEVICE(0x0e5e, 0x6622), .driver_info = BTUSB_BROKEN_ISOC },
215
cfeb4145
MH		 216 /* Digianswer devices */
217 { USB_DEVICE(0x08fd, 0x0001), .driver_info = BTUSB_DIGIANSWER },
218 { USB_DEVICE(0x08fd, 0x0002), .driver_info = BTUSB_IGNORE },
219
220 /* CSR BlueCore Bluetooth Sniffer */
221 { USB_DEVICE(0x0a12, 0x0002), .driver_info = BTUSB_SNIFFER },
222
223 /* Frontline ComProbe Bluetooth Sniffer */
224 { USB_DEVICE(0x16d3, 0x0002), .driver_info = BTUSB_SNIFFER },
225
dffd30ee
THJA		 226 /* Intel Bluetooth device */
227 { USB_DEVICE(0x8087, 0x07dc), .driver_info = BTUSB_INTEL },
ef4e5e4a 228 { USB_DEVICE(0x8087, 0x0a2a), .driver_info = BTUSB_INTEL },
dffd30ee 229
5e23b923
MH		 230 { } /* Terminating entry */
231};
232
9bfa35fe
MH		 233#define BTUSB_MAX_ISOC_FRAMES 10
234
5e23b923
MH		 235#define BTUSB_INTR_RUNNING 0
236#define BTUSB_BULK_RUNNING 1
9bfa35fe 237#define BTUSB_ISOC_RUNNING 2
7bee549e 238#define BTUSB_SUSPENDING 3
08b8b6c4 239#define BTUSB_DID_ISO_RESUME 4
5e23b923
MH		 240
241struct btusb_data {
242 struct hci_dev *hdev;
243 struct usb_device *udev;
5fbcd260 244 struct usb_interface *intf;
9bfa35fe 245 struct usb_interface *isoc;
5e23b923
MH		 246
247 spinlock_t lock;
248
249 unsigned long flags;
250
251 struct work_struct work;
7bee549e 252 struct work_struct waker;
5e23b923
MH		 253
254 struct usb_anchor tx_anchor;
255 struct usb_anchor intr_anchor;
256 struct usb_anchor bulk_anchor;
9bfa35fe 257 struct usb_anchor isoc_anchor;
7bee549e
ON		 258 struct usb_anchor deferred;
259 int tx_in_flight;
260 spinlock_t txlock;
5e23b923
MH		 261
262 struct usb_endpoint_descriptor *intr_ep;
263 struct usb_endpoint_descriptor *bulk_tx_ep;
264 struct usb_endpoint_descriptor *bulk_rx_ep;
9bfa35fe
MH		 265 struct usb_endpoint_descriptor *isoc_tx_ep;
266 struct usb_endpoint_descriptor *isoc_rx_ep;
267
7a9d4020
MH		 268 __u8 cmdreq_type;
269
43c2e57f 270 unsigned int sco_num;
9bfa35fe 271 int isoc_altsetting;
6a88adf2 272 int suspend_count;
5e23b923
MH		 273};
274
7bee549e
ON		 275static int inc_tx(struct btusb_data *data)
276{
277 unsigned long flags;
278 int rv;
279
280 spin_lock_irqsave(&data->txlock, flags);
281 rv = test_bit(BTUSB_SUSPENDING, &data->flags);
282 if (!rv)
283 data->tx_in_flight++;
284 spin_unlock_irqrestore(&data->txlock, flags);
285
286 return rv;
287}
288
5e23b923
MH		 289static void btusb_intr_complete(struct urb *urb)
290{
291 struct hci_dev *hdev = urb->context;
155961e8 292 struct btusb_data *data = hci_get_drvdata(hdev);
5e23b923
MH		 293 int err;
294
295 BT_DBG("%s urb %p status %d count %d", hdev->name,
296 urb, urb->status, urb->actual_length);
297
298 if (!test_bit(HCI_RUNNING, &hdev->flags))
299 return;
300
301 if (urb->status == 0) {
9bfa35fe
MH		 302 hdev->stat.byte_rx += urb->actual_length;
303
5e23b923
MH		 304 if (hci_recv_fragment(hdev, HCI_EVENT_PKT,
305 urb->transfer_buffer,
306 urb->actual_length) < 0) {
307 BT_ERR("%s corrupted event packet", hdev->name);
308 hdev->stat.err_rx++;
309 }
310 }
311
312 if (!test_bit(BTUSB_INTR_RUNNING, &data->flags))
313 return;
314
7bee549e 315 usb_mark_last_busy(data->udev);
5e23b923
MH		 316 usb_anchor_urb(urb, &data->intr_anchor);
317
318 err = usb_submit_urb(urb, GFP_ATOMIC);
319 if (err < 0) {
4935f1c1
PB		 320 /* -EPERM: urb is being killed;
321 * -ENODEV: device got disconnected */
322 if (err != -EPERM && err != -ENODEV)
61faddf6 323 BT_ERR("%s urb %p failed to resubmit (%d)",
5e23b923
MH		 324 hdev->name, urb, -err);
325 usb_unanchor_urb(urb);
326 }
327}
328
2eda66f4 329static int btusb_submit_intr_urb(struct hci_dev *hdev, gfp_t mem_flags)
5e23b923 330{
155961e8 331 struct btusb_data *data = hci_get_drvdata(hdev);
5e23b923
MH		 332 struct urb *urb;
333 unsigned char *buf;
334 unsigned int pipe;
335 int err, size;
336
337 BT_DBG("%s", hdev->name);
338
9bfa35fe
MH		 339 if (!data->intr_ep)
340 return -ENODEV;
341
2eda66f4 342 urb = usb_alloc_urb(0, mem_flags);
5e23b923
MH		 343 if (!urb)
344 return -ENOMEM;
345
346 size = le16_to_cpu(data->intr_ep->wMaxPacketSize);
347
2eda66f4 348 buf = kmalloc(size, mem_flags);
5e23b923
MH		 349 if (!buf) {
350 usb_free_urb(urb);
351 return -ENOMEM;
352 }
353
354 pipe = usb_rcvintpipe(data->udev, data->intr_ep->bEndpointAddress);
355
356 usb_fill_int_urb(urb, data->udev, pipe, buf, size,
357 btusb_intr_complete, hdev,
358 data->intr_ep->bInterval);
359
360 urb->transfer_flags |= URB_FREE_BUFFER;
361
362 usb_anchor_urb(urb, &data->intr_anchor);
363
2eda66f4 364 err = usb_submit_urb(urb, mem_flags);
5e23b923 365 if (err < 0) {
d4b8d1c9
PB		 366 if (err != -EPERM && err != -ENODEV)
367 BT_ERR("%s urb %p submission failed (%d)",
5e23b923
MH		 368 hdev->name, urb, -err);
369 usb_unanchor_urb(urb);
5e23b923
MH		 370 }
371
372 usb_free_urb(urb);
373
374 return err;
375}
376
377static void btusb_bulk_complete(struct urb *urb)
378{
379 struct hci_dev *hdev = urb->context;
155961e8 380 struct btusb_data *data = hci_get_drvdata(hdev);
5e23b923
MH		 381 int err;
382
383 BT_DBG("%s urb %p status %d count %d", hdev->name,
384 urb, urb->status, urb->actual_length);
385
386 if (!test_bit(HCI_RUNNING, &hdev->flags))
387 return;
388
389 if (urb->status == 0) {
9bfa35fe
MH		 390 hdev->stat.byte_rx += urb->actual_length;
391
5e23b923
MH		 392 if (hci_recv_fragment(hdev, HCI_ACLDATA_PKT,
393 urb->transfer_buffer,
394 urb->actual_length) < 0) {
395 BT_ERR("%s corrupted ACL packet", hdev->name);
396 hdev->stat.err_rx++;
397 }
398 }
399
400 if (!test_bit(BTUSB_BULK_RUNNING, &data->flags))
401 return;
402
403 usb_anchor_urb(urb, &data->bulk_anchor);
652fd781 404 usb_mark_last_busy(data->udev);
5e23b923
MH		 405
406 err = usb_submit_urb(urb, GFP_ATOMIC);
407 if (err < 0) {
4935f1c1
PB		 408 /* -EPERM: urb is being killed;
409 * -ENODEV: device got disconnected */
410 if (err != -EPERM && err != -ENODEV)
61faddf6 411 BT_ERR("%s urb %p failed to resubmit (%d)",
5e23b923
MH		 412 hdev->name, urb, -err);
413 usb_unanchor_urb(urb);
414 }
415}
416
2eda66f4 417static int btusb_submit_bulk_urb(struct hci_dev *hdev, gfp_t mem_flags)
5e23b923 418{
155961e8 419 struct btusb_data *data = hci_get_drvdata(hdev);
5e23b923
MH		 420 struct urb *urb;
421 unsigned char *buf;
422 unsigned int pipe;
290ba200 423 int err, size = HCI_MAX_FRAME_SIZE;
5e23b923
MH		 424
425 BT_DBG("%s", hdev->name);
426
9bfa35fe
MH		 427 if (!data->bulk_rx_ep)
428 return -ENODEV;
429
2eda66f4 430 urb = usb_alloc_urb(0, mem_flags);
5e23b923
MH		 431 if (!urb)
432 return -ENOMEM;
433
2eda66f4 434 buf = kmalloc(size, mem_flags);
5e23b923
MH		 435 if (!buf) {
436 usb_free_urb(urb);
437 return -ENOMEM;
438 }
439
440 pipe = usb_rcvbulkpipe(data->udev, data->bulk_rx_ep->bEndpointAddress);
441
442 usb_fill_bulk_urb(urb, data->udev, pipe,
443 buf, size, btusb_bulk_complete, hdev);
444
445 urb->transfer_flags |= URB_FREE_BUFFER;
446
7bee549e 447 usb_mark_last_busy(data->udev);
5e23b923
MH		 448 usb_anchor_urb(urb, &data->bulk_anchor);
449
2eda66f4 450 err = usb_submit_urb(urb, mem_flags);
5e23b923 451 if (err < 0) {
d4b8d1c9
PB		 452 if (err != -EPERM && err != -ENODEV)
453 BT_ERR("%s urb %p submission failed (%d)",
5e23b923
MH		 454 hdev->name, urb, -err);
455 usb_unanchor_urb(urb);
5e23b923
MH		 456 }
457
458 usb_free_urb(urb);
459
460 return err;
461}
462
9bfa35fe
MH		 463static void btusb_isoc_complete(struct urb *urb)
464{
465 struct hci_dev *hdev = urb->context;
155961e8 466 struct btusb_data *data = hci_get_drvdata(hdev);
9bfa35fe
MH		 467 int i, err;
468
469 BT_DBG("%s urb %p status %d count %d", hdev->name,
470 urb, urb->status, urb->actual_length);
471
472 if (!test_bit(HCI_RUNNING, &hdev->flags))
473 return;
474
475 if (urb->status == 0) {
476 for (i = 0; i < urb->number_of_packets; i++) {
477 unsigned int offset = urb->iso_frame_desc[i].offset;
478 unsigned int length = urb->iso_frame_desc[i].actual_length;
479
480 if (urb->iso_frame_desc[i].status)
481 continue;
482
483 hdev->stat.byte_rx += length;
484
485 if (hci_recv_fragment(hdev, HCI_SCODATA_PKT,
486 urb->transfer_buffer + offset,
487 length) < 0) {
488 BT_ERR("%s corrupted SCO packet", hdev->name);
489 hdev->stat.err_rx++;
490 }
491 }
492 }
493
494 if (!test_bit(BTUSB_ISOC_RUNNING, &data->flags))
495 return;
496
497 usb_anchor_urb(urb, &data->isoc_anchor);
498
499 err = usb_submit_urb(urb, GFP_ATOMIC);
500 if (err < 0) {
4935f1c1
PB		 501 /* -EPERM: urb is being killed;
502 * -ENODEV: device got disconnected */
503 if (err != -EPERM && err != -ENODEV)
61faddf6 504 BT_ERR("%s urb %p failed to resubmit (%d)",
9bfa35fe
MH		 505 hdev->name, urb, -err);
506 usb_unanchor_urb(urb);
507 }
508}
509
42b16b3f 510static inline void __fill_isoc_descriptor(struct urb *urb, int len, int mtu)
9bfa35fe
MH		 511{
512 int i, offset = 0;
513
514 BT_DBG("len %d mtu %d", len, mtu);
515
516 for (i = 0; i < BTUSB_MAX_ISOC_FRAMES && len >= mtu;
517 i++, offset += mtu, len -= mtu) {
518 urb->iso_frame_desc[i].offset = offset;
519 urb->iso_frame_desc[i].length = mtu;
520 }
521
522 if (len && i < BTUSB_MAX_ISOC_FRAMES) {
523 urb->iso_frame_desc[i].offset = offset;
524 urb->iso_frame_desc[i].length = len;
525 i++;
526 }
527
528 urb->number_of_packets = i;
529}
530
2eda66f4 531static int btusb_submit_isoc_urb(struct hci_dev *hdev, gfp_t mem_flags)
9bfa35fe 532{
155961e8 533 struct btusb_data *data = hci_get_drvdata(hdev);
9bfa35fe
MH		 534 struct urb *urb;
535 unsigned char *buf;
536 unsigned int pipe;
537 int err, size;
538
539 BT_DBG("%s", hdev->name);
540
541 if (!data->isoc_rx_ep)
542 return -ENODEV;
543
2eda66f4 544 urb = usb_alloc_urb(BTUSB_MAX_ISOC_FRAMES, mem_flags);
9bfa35fe
MH		 545 if (!urb)
546 return -ENOMEM;
547
548 size = le16_to_cpu(data->isoc_rx_ep->wMaxPacketSize) *
549 BTUSB_MAX_ISOC_FRAMES;
550
2eda66f4 551 buf = kmalloc(size, mem_flags);
9bfa35fe
MH		 552 if (!buf) {
553 usb_free_urb(urb);
554 return -ENOMEM;
555 }
556
557 pipe = usb_rcvisocpipe(data->udev, data->isoc_rx_ep->bEndpointAddress);
558
fa0fb93f
BZ		 559 usb_fill_int_urb(urb, data->udev, pipe, buf, size, btusb_isoc_complete,
560 hdev, data->isoc_rx_ep->bInterval);
9bfa35fe
MH		 561
562 urb->transfer_flags = URB_FREE_BUFFER | URB_ISO_ASAP;
9bfa35fe
MH		 563
564 __fill_isoc_descriptor(urb, size,
565 le16_to_cpu(data->isoc_rx_ep->wMaxPacketSize));
566
567 usb_anchor_urb(urb, &data->isoc_anchor);
568
2eda66f4 569 err = usb_submit_urb(urb, mem_flags);
9bfa35fe 570 if (err < 0) {
d4b8d1c9
PB		 571 if (err != -EPERM && err != -ENODEV)
572 BT_ERR("%s urb %p submission failed (%d)",
9bfa35fe
MH		 573 hdev->name, urb, -err);
574 usb_unanchor_urb(urb);
9bfa35fe
MH		 575 }
576
577 usb_free_urb(urb);
578
579 return err;
580}
581
5e23b923 582static void btusb_tx_complete(struct urb *urb)
7bee549e
ON		 583{
584 struct sk_buff *skb = urb->context;
585 struct hci_dev *hdev = (struct hci_dev *) skb->dev;
155961e8 586 struct btusb_data *data = hci_get_drvdata(hdev);
7bee549e
ON		 587
588 BT_DBG("%s urb %p status %d count %d", hdev->name,
589 urb, urb->status, urb->actual_length);
590
591 if (!test_bit(HCI_RUNNING, &hdev->flags))
592 goto done;
593
594 if (!urb->status)
595 hdev->stat.byte_tx += urb->transfer_buffer_length;
596 else
597 hdev->stat.err_tx++;
598
599done:
600 spin_lock(&data->txlock);
601 data->tx_in_flight--;
602 spin_unlock(&data->txlock);
603
604 kfree(urb->setup_packet);
605
606 kfree_skb(skb);
607}
608
609static void btusb_isoc_tx_complete(struct urb *urb)
5e23b923
MH		 610{
611 struct sk_buff *skb = urb->context;
612 struct hci_dev *hdev = (struct hci_dev *) skb->dev;
613
614 BT_DBG("%s urb %p status %d count %d", hdev->name,
615 urb, urb->status, urb->actual_length);
616
617 if (!test_bit(HCI_RUNNING, &hdev->flags))
618 goto done;
619
620 if (!urb->status)
621 hdev->stat.byte_tx += urb->transfer_buffer_length;
622 else
623 hdev->stat.err_tx++;
624
625done:
626 kfree(urb->setup_packet);
627
628 kfree_skb(skb);
629}
630
631static int btusb_open(struct hci_dev *hdev)
632{
155961e8 633 struct btusb_data *data = hci_get_drvdata(hdev);
5e23b923
MH		 634 int err;
635
636 BT_DBG("%s", hdev->name);
637
7bee549e
ON		 638 err = usb_autopm_get_interface(data->intf);
639 if (err < 0)
640 return err;
641
642 data->intf->needs_remote_wakeup = 1;
643
5e23b923 644 if (test_and_set_bit(HCI_RUNNING, &hdev->flags))
7bee549e 645 goto done;
5e23b923
MH		 646
647 if (test_and_set_bit(BTUSB_INTR_RUNNING, &data->flags))
7bee549e 648 goto done;
5e23b923 649
2eda66f4 650 err = btusb_submit_intr_urb(hdev, GFP_KERNEL);
43c2e57f
MH		 651 if (err < 0)
652 goto failed;
653
654 err = btusb_submit_bulk_urb(hdev, GFP_KERNEL);
5e23b923 655 if (err < 0) {
43c2e57f
MH		 656 usb_kill_anchored_urbs(&data->intr_anchor);
657 goto failed;
5e23b923
MH		 658 }
659
43c2e57f
MH		 660 set_bit(BTUSB_BULK_RUNNING, &data->flags);
661 btusb_submit_bulk_urb(hdev, GFP_KERNEL);
662
7bee549e
ON		 663done:
664 usb_autopm_put_interface(data->intf);
43c2e57f
MH		 665 return 0;
666
667failed:
668 clear_bit(BTUSB_INTR_RUNNING, &data->flags);
669 clear_bit(HCI_RUNNING, &hdev->flags);
7bee549e 670 usb_autopm_put_interface(data->intf);
5e23b923
MH		 671 return err;
672}
673
7bee549e
ON		 674static void btusb_stop_traffic(struct btusb_data *data)
675{
676 usb_kill_anchored_urbs(&data->intr_anchor);
677 usb_kill_anchored_urbs(&data->bulk_anchor);
678 usb_kill_anchored_urbs(&data->isoc_anchor);
679}
680
5e23b923
MH		 681static int btusb_close(struct hci_dev *hdev)
682{
155961e8 683 struct btusb_data *data = hci_get_drvdata(hdev);
7bee549e 684 int err;
5e23b923
MH		 685
686 BT_DBG("%s", hdev->name);
687
688 if (!test_and_clear_bit(HCI_RUNNING, &hdev->flags))
689 return 0;
690
e8c3c3d2 691 cancel_work_sync(&data->work);
404291ac 692 cancel_work_sync(&data->waker);
e8c3c3d2 693
9bfa35fe 694 clear_bit(BTUSB_ISOC_RUNNING, &data->flags);
5e23b923 695 clear_bit(BTUSB_BULK_RUNNING, &data->flags);
5e23b923 696 clear_bit(BTUSB_INTR_RUNNING, &data->flags);
7bee549e
ON		 697
698 btusb_stop_traffic(data);
699 err = usb_autopm_get_interface(data->intf);
700 if (err < 0)
7b8e2c1d 701 goto failed;
7bee549e
ON		 702
703 data->intf->needs_remote_wakeup = 0;
704 usb_autopm_put_interface(data->intf);
5e23b923 705
7b8e2c1d
ON		 706failed:
707 usb_scuttle_anchored_urbs(&data->deferred);
5e23b923
MH		 708 return 0;
709}
710
711static int btusb_flush(struct hci_dev *hdev)
712{
155961e8 713 struct btusb_data *data = hci_get_drvdata(hdev);
5e23b923
MH		 714
715 BT_DBG("%s", hdev->name);
716
717 usb_kill_anchored_urbs(&data->tx_anchor);
718
719 return 0;
720}
721
7bd8f09f 722static int btusb_send_frame(struct hci_dev *hdev, struct sk_buff *skb)
5e23b923 723{
155961e8 724 struct btusb_data *data = hci_get_drvdata(hdev);
5e23b923
MH		 725 struct usb_ctrlrequest *dr;
726 struct urb *urb;
727 unsigned int pipe;
728 int err;
729
730 BT_DBG("%s", hdev->name);
731
732 if (!test_bit(HCI_RUNNING, &hdev->flags))
733 return -EBUSY;
734
7bd8f09f
MH		 735 skb->dev = (void *) hdev;
736
5e23b923
MH		 737 switch (bt_cb(skb)->pkt_type) {
738 case HCI_COMMAND_PKT:
739 urb = usb_alloc_urb(0, GFP_ATOMIC);
740 if (!urb)
741 return -ENOMEM;
742
743 dr = kmalloc(sizeof(*dr), GFP_ATOMIC);
744 if (!dr) {
745 usb_free_urb(urb);
746 return -ENOMEM;
747 }
748
7a9d4020 749 dr->bRequestType = data->cmdreq_type;
5e23b923
MH		 750 dr->bRequest = 0;
751 dr->wIndex = 0;
752 dr->wValue = 0;
753 dr->wLength = __cpu_to_le16(skb->len);
754
755 pipe = usb_sndctrlpipe(data->udev, 0x00);
756
757 usb_fill_control_urb(urb, data->udev, pipe, (void *) dr,
758 skb->data, skb->len, btusb_tx_complete, skb);
759
760 hdev->stat.cmd_tx++;
761 break;
762
763 case HCI_ACLDATA_PKT:
9fd481e0 764 if (!data->bulk_tx_ep)
9bfa35fe
MH		 765 return -ENODEV;
766
5e23b923
MH		 767 urb = usb_alloc_urb(0, GFP_ATOMIC);
768 if (!urb)
769 return -ENOMEM;
770
771 pipe = usb_sndbulkpipe(data->udev,
772 data->bulk_tx_ep->bEndpointAddress);
773
774 usb_fill_bulk_urb(urb, data->udev, pipe,
775 skb->data, skb->len, btusb_tx_complete, skb);
776
777 hdev->stat.acl_tx++;
778 break;
779
780 case HCI_SCODATA_PKT:
014f7bc7 781 if (!data->isoc_tx_ep || hci_conn_num(hdev, SCO_LINK) < 1)
9bfa35fe
MH		 782 return -ENODEV;
783
784 urb = usb_alloc_urb(BTUSB_MAX_ISOC_FRAMES, GFP_ATOMIC);
785 if (!urb)
786 return -ENOMEM;
787
788 pipe = usb_sndisocpipe(data->udev,
789 data->isoc_tx_ep->bEndpointAddress);
790
03c2d0e8
GP		 791 usb_fill_int_urb(urb, data->udev, pipe,
792 skb->data, skb->len, btusb_isoc_tx_complete,
793 skb, data->isoc_tx_ep->bInterval);
9bfa35fe
MH		 794
795 urb->transfer_flags = URB_ISO_ASAP;
9bfa35fe
MH		 796
797 __fill_isoc_descriptor(urb, skb->len,
798 le16_to_cpu(data->isoc_tx_ep->wMaxPacketSize));
799
5e23b923 800 hdev->stat.sco_tx++;
7bee549e 801 goto skip_waking;
5e23b923
MH		 802
803 default:
804 return -EILSEQ;
805 }
806
7bee549e
ON		 807 err = inc_tx(data);
808 if (err) {
809 usb_anchor_urb(urb, &data->deferred);
810 schedule_work(&data->waker);
811 err = 0;
812 goto done;
813 }
814
815skip_waking:
5e23b923
MH		 816 usb_anchor_urb(urb, &data->tx_anchor);
817
818 err = usb_submit_urb(urb, GFP_ATOMIC);
819 if (err < 0) {
5a9b80e2
PB		 820 if (err != -EPERM && err != -ENODEV)
821 BT_ERR("%s urb %p submission failed (%d)",
822 hdev->name, urb, -err);
5e23b923
MH		 823 kfree(urb->setup_packet);
824 usb_unanchor_urb(urb);
7bee549e
ON		 825 } else {
826 usb_mark_last_busy(data->udev);
5e23b923
MH		 827 }
828
7bee549e 829done:
54a8a79c 830 usb_free_urb(urb);
5e23b923
MH		 831 return err;
832}
833
5e23b923
MH		 834static void btusb_notify(struct hci_dev *hdev, unsigned int evt)
835{
155961e8 836 struct btusb_data *data = hci_get_drvdata(hdev);
5e23b923
MH		 837
838 BT_DBG("%s evt %d", hdev->name, evt);
839
014f7bc7
MH		 840 if (hci_conn_num(hdev, SCO_LINK) != data->sco_num) {
841 data->sco_num = hci_conn_num(hdev, SCO_LINK);
43c2e57f 842 schedule_work(&data->work);
a780efa8 843 }
5e23b923
MH		 844}
845
42b16b3f 846static inline int __set_isoc_interface(struct hci_dev *hdev, int altsetting)
9bfa35fe 847{
155961e8 848 struct btusb_data *data = hci_get_drvdata(hdev);
9bfa35fe
MH		 849 struct usb_interface *intf = data->isoc;
850 struct usb_endpoint_descriptor *ep_desc;
851 int i, err;
852
853 if (!data->isoc)
854 return -ENODEV;
855
856 err = usb_set_interface(data->udev, 1, altsetting);
857 if (err < 0) {
858 BT_ERR("%s setting interface failed (%d)", hdev->name, -err);
859 return err;
860 }
861
862 data->isoc_altsetting = altsetting;
863
864 data->isoc_tx_ep = NULL;
865 data->isoc_rx_ep = NULL;
866
867 for (i = 0; i < intf->cur_altsetting->desc.bNumEndpoints; i++) {
868 ep_desc = &intf->cur_altsetting->endpoint[i].desc;
869
870 if (!data->isoc_tx_ep && usb_endpoint_is_isoc_out(ep_desc)) {
871 data->isoc_tx_ep = ep_desc;
872 continue;
873 }
874
875 if (!data->isoc_rx_ep && usb_endpoint_is_isoc_in(ep_desc)) {
876 data->isoc_rx_ep = ep_desc;
877 continue;
878 }
879 }
880
881 if (!data->isoc_tx_ep || !data->isoc_rx_ep) {
882 BT_ERR("%s invalid SCO descriptors", hdev->name);
883 return -ENODEV;
884 }
885
886 return 0;
887}
888
5e23b923
MH		 889static void btusb_work(struct work_struct *work)
890{
891 struct btusb_data *data = container_of(work, struct btusb_data, work);
892 struct hci_dev *hdev = data->hdev;
f4001d28 893 int new_alts;
7bee549e 894 int err;
5e23b923 895
014f7bc7 896 if (data->sco_num > 0) {
08b8b6c4 897 if (!test_bit(BTUSB_DID_ISO_RESUME, &data->flags)) {
8efdd0cd 898 err = usb_autopm_get_interface(data->isoc ? data->isoc : data->intf);
7bee549e
ON		 899 if (err < 0) {
900 clear_bit(BTUSB_ISOC_RUNNING, &data->flags);
901 usb_kill_anchored_urbs(&data->isoc_anchor);
902 return;
903 }
904
08b8b6c4 905 set_bit(BTUSB_DID_ISO_RESUME, &data->flags);
7bee549e 906 }
f4001d28
MA		 907
908 if (hdev->voice_setting & 0x0020) {
909 static const int alts[3] = { 2, 4, 5 };
014f7bc7 910 new_alts = alts[data->sco_num - 1];
f4001d28 911 } else {
014f7bc7 912 new_alts = data->sco_num;
f4001d28
MA		 913 }
914
915 if (data->isoc_altsetting != new_alts) {
9bfa35fe
MH		 916 clear_bit(BTUSB_ISOC_RUNNING, &data->flags);
917 usb_kill_anchored_urbs(&data->isoc_anchor);
918
f4001d28 919 if (__set_isoc_interface(hdev, new_alts) < 0)
9bfa35fe
MH		 920 return;
921 }
922
923 if (!test_and_set_bit(BTUSB_ISOC_RUNNING, &data->flags)) {
2eda66f4 924 if (btusb_submit_isoc_urb(hdev, GFP_KERNEL) < 0)
9bfa35fe
MH		 925 clear_bit(BTUSB_ISOC_RUNNING, &data->flags);
926 else
2eda66f4 927 btusb_submit_isoc_urb(hdev, GFP_KERNEL);
9bfa35fe
MH		 928 }
929 } else {
930 clear_bit(BTUSB_ISOC_RUNNING, &data->flags);
931 usb_kill_anchored_urbs(&data->isoc_anchor);
932
933 __set_isoc_interface(hdev, 0);
08b8b6c4 934 if (test_and_clear_bit(BTUSB_DID_ISO_RESUME, &data->flags))
8efdd0cd 935 usb_autopm_put_interface(data->isoc ? data->isoc : data->intf);
5e23b923
MH		 936 }
937}
938
7bee549e
ON		 939static void btusb_waker(struct work_struct *work)
940{
941 struct btusb_data *data = container_of(work, struct btusb_data, waker);
942 int err;
943
944 err = usb_autopm_get_interface(data->intf);
945 if (err < 0)
946 return;
947
948 usb_autopm_put_interface(data->intf);
949}
950
9f8f962c
MH		 951static int btusb_setup_bcm92035(struct hci_dev *hdev)
952{
953 struct sk_buff *skb;
954 u8 val = 0x00;
955
956 BT_DBG("%s", hdev->name);
957
958 skb = __hci_cmd_sync(hdev, 0xfc3b, 1, &val, HCI_INIT_TIMEOUT);
959 if (IS_ERR(skb))
960 BT_ERR("BCM92035 command failed (%ld)", -PTR_ERR(skb));
961 else
962 kfree_skb(skb);
963
964 return 0;
965}
966
dffd30ee
THJA		 967struct intel_version {
968 u8 status;
969 u8 hw_platform;
970 u8 hw_variant;
971 u8 hw_revision;
972 u8 fw_variant;
973 u8 fw_revision;
974 u8 fw_build_num;
975 u8 fw_build_ww;
976 u8 fw_build_yy;
977 u8 fw_patch_num;
978} __packed;
979
980static const struct firmware *btusb_setup_intel_get_fw(struct hci_dev *hdev,
981 struct intel_version *ver)
982{
983 const struct firmware *fw;
984 char fwname[64];
985 int ret;
986
987 snprintf(fwname, sizeof(fwname),
988 "intel/ibt-hw-%x.%x.%x-fw-%x.%x.%x.%x.%x.bseq",
989 ver->hw_platform, ver->hw_variant, ver->hw_revision,
990 ver->fw_variant, ver->fw_revision, ver->fw_build_num,
991 ver->fw_build_ww, ver->fw_build_yy);
992
993 ret = request_firmware(&fw, fwname, &hdev->dev);
994 if (ret < 0) {
995 if (ret == -EINVAL) {
996 BT_ERR("%s Intel firmware file request failed (%d)",
997 hdev->name, ret);
998 return NULL;
999 }
1000
1001 BT_ERR("%s failed to open Intel firmware file: %s(%d)",
1002 hdev->name, fwname, ret);
1003
1004 /* If the correct firmware patch file is not found, use the
1005 * default firmware patch file instead
1006 */
1007 snprintf(fwname, sizeof(fwname), "intel/ibt-hw-%x.%x.bseq",
1008 ver->hw_platform, ver->hw_variant);
1009 if (request_firmware(&fw, fwname, &hdev->dev) < 0) {
1010 BT_ERR("%s failed to open default Intel fw file: %s",
1011 hdev->name, fwname);
1012 return NULL;
1013 }
1014 }
1015
1016 BT_INFO("%s: Intel Bluetooth firmware file: %s", hdev->name, fwname);
1017
1018 return fw;
1019}
1020
1021static int btusb_setup_intel_patching(struct hci_dev *hdev,
1022 const struct firmware *fw,
1023 const u8 **fw_ptr, int *disable_patch)
1024{
1025 struct sk_buff *skb;
1026 struct hci_command_hdr *cmd;
1027 const u8 *cmd_param;
1028 struct hci_event_hdr *evt = NULL;
1029 const u8 *evt_param = NULL;
1030 int remain = fw->size - (*fw_ptr - fw->data);
1031
1032 /* The first byte indicates the types of the patch command or event.
1033 * 0x01 means HCI command and 0x02 is HCI event. If the first bytes
1034 * in the current firmware buffer doesn't start with 0x01 or
1035 * the size of remain buffer is smaller than HCI command header,
1036 * the firmware file is corrupted and it should stop the patching
1037 * process.
1038 */
1039 if (remain > HCI_COMMAND_HDR_SIZE && *fw_ptr[0] != 0x01) {
1040 BT_ERR("%s Intel fw corrupted: invalid cmd read", hdev->name);
1041 return -EINVAL;
1042 }
1043 (*fw_ptr)++;
1044 remain--;
1045
1046 cmd = (struct hci_command_hdr *)(*fw_ptr);
1047 *fw_ptr += sizeof(*cmd);
1048 remain -= sizeof(*cmd);
1049
1050 /* Ensure that the remain firmware data is long enough than the length
1051 * of command parameter. If not, the firmware file is corrupted.
1052 */
1053 if (remain < cmd->plen) {
1054 BT_ERR("%s Intel fw corrupted: invalid cmd len", hdev->name);
1055 return -EFAULT;
1056 }
1057
1058 /* If there is a command that loads a patch in the firmware
1059 * file, then enable the patch upon success, otherwise just
1060 * disable the manufacturer mode, for example patch activation
1061 * is not required when the default firmware patch file is used
1062 * because there are no patch data to load.
1063 */
1064 if (*disable_patch && le16_to_cpu(cmd->opcode) == 0xfc8e)
1065 *disable_patch = 0;
1066
1067 cmd_param = *fw_ptr;
1068 *fw_ptr += cmd->plen;
1069 remain -= cmd->plen;
1070
1071 /* This reads the expected events when the above command is sent to the
1072 * device. Some vendor commands expects more than one events, for
1073 * example command status event followed by vendor specific event.
1074 * For this case, it only keeps the last expected event. so the command
1075 * can be sent with __hci_cmd_sync_ev() which returns the sk_buff of
1076 * last expected event.
1077 */
1078 while (remain > HCI_EVENT_HDR_SIZE && *fw_ptr[0] == 0x02) {
1079 (*fw_ptr)++;
1080 remain--;
1081
1082 evt = (struct hci_event_hdr *)(*fw_ptr);
1083 *fw_ptr += sizeof(*evt);
1084 remain -= sizeof(*evt);
1085
1086 if (remain < evt->plen) {
1087 BT_ERR("%s Intel fw corrupted: invalid evt len",
1088 hdev->name);
1089 return -EFAULT;
1090 }
1091
1092 evt_param = *fw_ptr;
1093 *fw_ptr += evt->plen;
1094 remain -= evt->plen;
1095 }
1096
1097 /* Every HCI commands in the firmware file has its correspond event.
1098 * If event is not found or remain is smaller than zero, the firmware
1099 * file is corrupted.
1100 */
1101 if (!evt || !evt_param || remain < 0) {
1102 BT_ERR("%s Intel fw corrupted: invalid evt read", hdev->name);
1103 return -EFAULT;
1104 }
1105
1106 skb = __hci_cmd_sync_ev(hdev, le16_to_cpu(cmd->opcode), cmd->plen,
1107 cmd_param, evt->evt, HCI_INIT_TIMEOUT);
1108 if (IS_ERR(skb)) {
1109 BT_ERR("%s sending Intel patch command (0x%4.4x) failed (%ld)",
1110 hdev->name, cmd->opcode, PTR_ERR(skb));
d9c78e97 1111 return PTR_ERR(skb);
dffd30ee
THJA		 1112 }
1113
1114 /* It ensures that the returned event matches the event data read from
1115 * the firmware file. At fist, it checks the length and then
1116 * the contents of the event.
1117 */
1118 if (skb->len != evt->plen) {
1119 BT_ERR("%s mismatch event length (opcode 0x%4.4x)", hdev->name,
1120 le16_to_cpu(cmd->opcode));
1121 kfree_skb(skb);
1122 return -EFAULT;
1123 }
1124
1125 if (memcmp(skb->data, evt_param, evt->plen)) {
1126 BT_ERR("%s mismatch event parameter (opcode 0x%4.4x)",
1127 hdev->name, le16_to_cpu(cmd->opcode));
1128 kfree_skb(skb);
1129 return -EFAULT;
1130 }
1131 kfree_skb(skb);
1132
1133 return 0;
1134}
1135
1136static int btusb_setup_intel(struct hci_dev *hdev)
1137{
1138 struct sk_buff *skb;
1139 const struct firmware *fw;
1140 const u8 *fw_ptr;
1141 int disable_patch;
1142 struct intel_version *ver;
1143
1144 const u8 mfg_enable[] = { 0x01, 0x00 };
1145 const u8 mfg_disable[] = { 0x00, 0x00 };
1146 const u8 mfg_reset_deactivate[] = { 0x00, 0x01 };
1147 const u8 mfg_reset_activate[] = { 0x00, 0x02 };
1148
1149 BT_DBG("%s", hdev->name);
1150
1151 /* The controller has a bug with the first HCI command sent to it
1152 * returning number of completed commands as zero. This would stall the
1153 * command processing in the Bluetooth core.
1154 *
1155 * As a workaround, send HCI Reset command first which will reset the
1156 * number of completed commands and allow normal command processing
1157 * from now on.
1158 */
1159 skb = __hci_cmd_sync(hdev, HCI_OP_RESET, 0, NULL, HCI_INIT_TIMEOUT);
1160 if (IS_ERR(skb)) {
1161 BT_ERR("%s sending initial HCI reset command failed (%ld)",
1162 hdev->name, PTR_ERR(skb));
d9c78e97 1163 return PTR_ERR(skb);
dffd30ee
THJA		 1164 }
1165 kfree_skb(skb);
1166
1167 /* Read Intel specific controller version first to allow selection of
1168 * which firmware file to load.
1169 *
1170 * The returned information are hardware variant and revision plus
1171 * firmware variant, revision and build number.
1172 */
1173 skb = __hci_cmd_sync(hdev, 0xfc05, 0, NULL, HCI_INIT_TIMEOUT);
1174 if (IS_ERR(skb)) {
1175 BT_ERR("%s reading Intel fw version command failed (%ld)",
1176 hdev->name, PTR_ERR(skb));
d9c78e97 1177 return PTR_ERR(skb);
dffd30ee
THJA		 1178 }
1179
1180 if (skb->len != sizeof(*ver)) {
1181 BT_ERR("%s Intel version event length mismatch", hdev->name);
1182 kfree_skb(skb);
1183 return -EIO;
1184 }
1185
1186 ver = (struct intel_version *)skb->data;
1187 if (ver->status) {
1188 BT_ERR("%s Intel fw version event failed (%02x)", hdev->name,
1189 ver->status);
1190 kfree_skb(skb);
1191 return -bt_to_errno(ver->status);
1192 }
1193
1194 BT_INFO("%s: read Intel version: %02x%02x%02x%02x%02x%02x%02x%02x%02x",
1195 hdev->name, ver->hw_platform, ver->hw_variant,
1196 ver->hw_revision, ver->fw_variant, ver->fw_revision,
1197 ver->fw_build_num, ver->fw_build_ww, ver->fw_build_yy,
1198 ver->fw_patch_num);
1199
1200 /* fw_patch_num indicates the version of patch the device currently
1201 * have. If there is no patch data in the device, it is always 0x00.
1202 * So, if it is other than 0x00, no need to patch the deivce again.
1203 */
1204 if (ver->fw_patch_num) {
1205 BT_INFO("%s: Intel device is already patched. patch num: %02x",
1206 hdev->name, ver->fw_patch_num);
1207 kfree_skb(skb);
1208 return 0;
1209 }
1210
1211 /* Opens the firmware patch file based on the firmware version read
1212 * from the controller. If it fails to open the matching firmware
1213 * patch file, it tries to open the default firmware patch file.
1214 * If no patch file is found, allow the device to operate without
1215 * a patch.
1216 */
1217 fw = btusb_setup_intel_get_fw(hdev, ver);
1218 if (!fw) {
1219 kfree_skb(skb);
1220 return 0;
1221 }
1222 fw_ptr = fw->data;
1223
1224 /* This Intel specific command enables the manufacturer mode of the
1225 * controller.
1226 *
1227 * Only while this mode is enabled, the driver can download the
1228 * firmware patch data and configuration parameters.
1229 */
1230 skb = __hci_cmd_sync(hdev, 0xfc11, 2, mfg_enable, HCI_INIT_TIMEOUT);
1231 if (IS_ERR(skb)) {
1232 BT_ERR("%s entering Intel manufacturer mode failed (%ld)",
1233 hdev->name, PTR_ERR(skb));
1234 release_firmware(fw);
d9c78e97 1235 return PTR_ERR(skb);
dffd30ee
THJA		 1236 }
1237
1238 if (skb->data[0]) {
1239 u8 evt_status = skb->data[0];
1240 BT_ERR("%s enable Intel manufacturer mode event failed (%02x)",
1241 hdev->name, evt_status);
1242 kfree_skb(skb);
1243 release_firmware(fw);
1244 return -bt_to_errno(evt_status);
1245 }
1246 kfree_skb(skb);
1247
1248 disable_patch = 1;
1249
1250 /* The firmware data file consists of list of Intel specific HCI
1251 * commands and its expected events. The first byte indicates the
1252 * type of the message, either HCI command or HCI event.
1253 *
1254 * It reads the command and its expected event from the firmware file,
1255 * and send to the controller. Once __hci_cmd_sync_ev() returns,
1256 * the returned event is compared with the event read from the firmware
1257 * file and it will continue until all the messages are downloaded to
1258 * the controller.
1259 *
1260 * Once the firmware patching is completed successfully,
1261 * the manufacturer mode is disabled with reset and activating the
1262 * downloaded patch.
1263 *
1264 * If the firmware patching fails, the manufacturer mode is
1265 * disabled with reset and deactivating the patch.
1266 *
1267 * If the default patch file is used, no reset is done when disabling
1268 * the manufacturer.
1269 */
1270 while (fw->size > fw_ptr - fw->data) {
1271 int ret;
1272
1273 ret = btusb_setup_intel_patching(hdev, fw, &fw_ptr,
1274 &disable_patch);
1275 if (ret < 0)
1276 goto exit_mfg_deactivate;
1277 }
1278
1279 release_firmware(fw);
1280
1281 if (disable_patch)
1282 goto exit_mfg_disable;
1283
1284 /* Patching completed successfully and disable the manufacturer mode
1285 * with reset and activate the downloaded firmware patches.
1286 */
1287 skb = __hci_cmd_sync(hdev, 0xfc11, sizeof(mfg_reset_activate),
1288 mfg_reset_activate, HCI_INIT_TIMEOUT);
1289 if (IS_ERR(skb)) {
1290 BT_ERR("%s exiting Intel manufacturer mode failed (%ld)",
1291 hdev->name, PTR_ERR(skb));
d9c78e97 1292 return PTR_ERR(skb);
dffd30ee
THJA		 1293 }
1294 kfree_skb(skb);
1295
1296 BT_INFO("%s: Intel Bluetooth firmware patch completed and activated",
1297 hdev->name);
1298
1299 return 0;
1300
1301exit_mfg_disable:
1302 /* Disable the manufacturer mode without reset */
1303 skb = __hci_cmd_sync(hdev, 0xfc11, sizeof(mfg_disable), mfg_disable,
1304 HCI_INIT_TIMEOUT);
1305 if (IS_ERR(skb)) {
1306 BT_ERR("%s exiting Intel manufacturer mode failed (%ld)",
1307 hdev->name, PTR_ERR(skb));
d9c78e97 1308 return PTR_ERR(skb);
dffd30ee
THJA		 1309 }
1310 kfree_skb(skb);
1311
1312 BT_INFO("%s: Intel Bluetooth firmware patch completed", hdev->name);
1313 return 0;
1314
1315exit_mfg_deactivate:
1316 release_firmware(fw);
1317
1318 /* Patching failed. Disable the manufacturer mode with reset and
1319 * deactivate the downloaded firmware patches.
1320 */
1321 skb = __hci_cmd_sync(hdev, 0xfc11, sizeof(mfg_reset_deactivate),
1322 mfg_reset_deactivate, HCI_INIT_TIMEOUT);
1323 if (IS_ERR(skb)) {
1324 BT_ERR("%s exiting Intel manufacturer mode failed (%ld)",
1325 hdev->name, PTR_ERR(skb));
d9c78e97 1326 return PTR_ERR(skb);
dffd30ee
THJA		 1327 }
1328 kfree_skb(skb);
1329
1330 BT_INFO("%s: Intel Bluetooth firmware patch completed and deactivated",
1331 hdev->name);
1332
1333 return 0;
1334}
1335
5e23b923
MH		 1336static int btusb_probe(struct usb_interface *intf,
1337 const struct usb_device_id *id)
1338{
1339 struct usb_endpoint_descriptor *ep_desc;
1340 struct btusb_data *data;
1341 struct hci_dev *hdev;
1342 int i, err;
1343
1344 BT_DBG("intf %p id %p", intf, id);
1345
cfeb4145 1346 /* interface numbers are hardcoded in the spec */
5e23b923
MH		 1347 if (intf->cur_altsetting->desc.bInterfaceNumber != 0)
1348 return -ENODEV;
1349
1350 if (!id->driver_info) {
1351 const struct usb_device_id *match;
1352 match = usb_match_id(intf, blacklist_table);
1353 if (match)
1354 id = match;
1355 }
1356
cfeb4145
MH		 1357 if (id->driver_info == BTUSB_IGNORE)
1358 return -ENODEV;
1359
1360 if (ignore_dga && id->driver_info & BTUSB_DIGIANSWER)
1361 return -ENODEV;
1362
1363 if (ignore_csr && id->driver_info & BTUSB_CSR)
1364 return -ENODEV;
1365
1366 if (ignore_sniffer && id->driver_info & BTUSB_SNIFFER)
1367 return -ENODEV;
1368
2d25f8b4
SL		 1369 if (id->driver_info & BTUSB_ATH3012) {
1370 struct usb_device *udev = interface_to_usbdev(intf);
1371
1372 /* Old firmware would otherwise let ath3k driver load
1373 * patch and sysconfig files */
1374 if (le16_to_cpu(udev->descriptor.bcdDevice) <= 0x0001)
1375 return -ENODEV;
1376 }
1377
98921dbd 1378 data = devm_kzalloc(&intf->dev, sizeof(*data), GFP_KERNEL);
5e23b923
MH		 1379 if (!data)
1380 return -ENOMEM;
1381
1382 for (i = 0; i < intf->cur_altsetting->desc.bNumEndpoints; i++) {
1383 ep_desc = &intf->cur_altsetting->endpoint[i].desc;
1384
1385 if (!data->intr_ep && usb_endpoint_is_int_in(ep_desc)) {
1386 data->intr_ep = ep_desc;
1387 continue;
1388 }
1389
1390 if (!data->bulk_tx_ep && usb_endpoint_is_bulk_out(ep_desc)) {
1391 data->bulk_tx_ep = ep_desc;
1392 continue;
1393 }
1394
1395 if (!data->bulk_rx_ep && usb_endpoint_is_bulk_in(ep_desc)) {
1396 data->bulk_rx_ep = ep_desc;
1397 continue;
1398 }
1399 }
1400
98921dbd 1401 if (!data->intr_ep || !data->bulk_tx_ep || !data->bulk_rx_ep)
5e23b923 1402 return -ENODEV;
5e23b923 1403
7a9d4020
MH		 1404 data->cmdreq_type = USB_TYPE_CLASS;
1405
5e23b923 1406 data->udev = interface_to_usbdev(intf);
5fbcd260 1407 data->intf = intf;
5e23b923
MH		 1408
1409 spin_lock_init(&data->lock);
1410
1411 INIT_WORK(&data->work, btusb_work);
7bee549e
ON		 1412 INIT_WORK(&data->waker, btusb_waker);
1413 spin_lock_init(&data->txlock);
5e23b923
MH		 1414
1415 init_usb_anchor(&data->tx_anchor);
1416 init_usb_anchor(&data->intr_anchor);
1417 init_usb_anchor(&data->bulk_anchor);
9bfa35fe 1418 init_usb_anchor(&data->isoc_anchor);
7bee549e 1419 init_usb_anchor(&data->deferred);
5e23b923
MH		 1420
1421 hdev = hci_alloc_dev();
98921dbd 1422 if (!hdev)
5e23b923 1423 return -ENOMEM;
5e23b923 1424
c13854ce 1425 hdev->bus = HCI_USB;
155961e8 1426 hci_set_drvdata(hdev, data);
5e23b923
MH		 1427
1428 data->hdev = hdev;
1429
1430 SET_HCIDEV_DEV(hdev, &intf->dev);
1431
9f8f962c
MH		 1432 hdev->open = btusb_open;
1433 hdev->close = btusb_close;
1434 hdev->flush = btusb_flush;
1435 hdev->send = btusb_send_frame;
1436 hdev->notify = btusb_notify;
1437
1438 if (id->driver_info & BTUSB_BCM92035)
1439 hdev->setup = btusb_setup_bcm92035;
5e23b923 1440
d2bee8fb
THJA		 1441 if (id->driver_info & BTUSB_INTEL) {
1442 usb_enable_autosuspend(data->udev);
dffd30ee 1443 hdev->setup = btusb_setup_intel;
d2bee8fb 1444 }
dffd30ee 1445
7a9d4020 1446 /* Interface numbers are hardcoded in the specification */
9bfa35fe
MH		 1447 data->isoc = usb_ifnum_to_if(data->udev, 1);
1448
7a9d4020 1449 if (!reset)
a6c511c6 1450 set_bit(HCI_QUIRK_RESET_ON_CLOSE, &hdev->quirks);
cfeb4145
MH		 1451
1452 if (force_scofix || id->driver_info & BTUSB_WRONG_SCO_MTU) {
1453 if (!disable_scofix)
1454 set_bit(HCI_QUIRK_FIXUP_BUFFER_SIZE, &hdev->quirks);
1455 }
1456
9bfa35fe
MH		 1457 if (id->driver_info & BTUSB_BROKEN_ISOC)
1458 data->isoc = NULL;
1459
7a9d4020
MH		 1460 if (id->driver_info & BTUSB_DIGIANSWER) {
1461 data->cmdreq_type = USB_TYPE_VENDOR;
a6c511c6 1462 set_bit(HCI_QUIRK_RESET_ON_CLOSE, &hdev->quirks);
7a9d4020
MH		 1463 }
1464
1465 if (id->driver_info & BTUSB_CSR) {
1466 struct usb_device *udev = data->udev;
1467
1468 /* Old firmware would otherwise execute USB reset */
1469 if (le16_to_cpu(udev->descriptor.bcdDevice) < 0x117)
a6c511c6 1470 set_bit(HCI_QUIRK_RESET_ON_CLOSE, &hdev->quirks);
7a9d4020
MH		 1471 }
1472
cfeb4145 1473 if (id->driver_info & BTUSB_SNIFFER) {
9bfa35fe 1474 struct usb_device *udev = data->udev;
cfeb4145 1475
7a9d4020 1476 /* New sniffer firmware has crippled HCI interface */
cfeb4145
MH		 1477 if (le16_to_cpu(udev->descriptor.bcdDevice) > 0x997)
1478 set_bit(HCI_QUIRK_RAW_DEVICE, &hdev->quirks);
9bfa35fe
MH		 1479
1480 data->isoc = NULL;
cfeb4145
MH		 1481 }
1482
9bfa35fe
MH		 1483 if (data->isoc) {
1484 err = usb_driver_claim_interface(&btusb_driver,
5fbcd260 1485 data->isoc, data);
9bfa35fe
MH		 1486 if (err < 0) {
1487 hci_free_dev(hdev);
9bfa35fe
MH		 1488 return err;
1489 }
1490 }
1491
5e23b923
MH		 1492 err = hci_register_dev(hdev);
1493 if (err < 0) {
1494 hci_free_dev(hdev);
5e23b923
MH		 1495 return err;
1496 }
1497
1498 usb_set_intfdata(intf, data);
1499
1500 return 0;
1501}
1502
1503static void btusb_disconnect(struct usb_interface *intf)
1504{
1505 struct btusb_data *data = usb_get_intfdata(intf);
1506 struct hci_dev *hdev;
1507
1508 BT_DBG("intf %p", intf);
1509
1510 if (!data)
1511 return;
1512
1513 hdev = data->hdev;
5fbcd260
MH		 1514 usb_set_intfdata(data->intf, NULL);
1515
1516 if (data->isoc)
1517 usb_set_intfdata(data->isoc, NULL);
5e23b923
MH		 1518
1519 hci_unregister_dev(hdev);
1520
5fbcd260
MH		 1521 if (intf == data->isoc)
1522 usb_driver_release_interface(&btusb_driver, data->intf);
1523 else if (data->isoc)
1524 usb_driver_release_interface(&btusb_driver, data->isoc);
1525
5e23b923
MH		 1526 hci_free_dev(hdev);
1527}
1528
7bee549e 1529#ifdef CONFIG_PM
6a88adf2
MH		 1530static int btusb_suspend(struct usb_interface *intf, pm_message_t message)
1531{
1532 struct btusb_data *data = usb_get_intfdata(intf);
1533
1534 BT_DBG("intf %p", intf);
1535
1536 if (data->suspend_count++)
1537 return 0;
1538
7bee549e 1539 spin_lock_irq(&data->txlock);
5b1b0b81 1540 if (!(PMSG_IS_AUTO(message) && data->tx_in_flight)) {
7bee549e
ON		 1541 set_bit(BTUSB_SUSPENDING, &data->flags);
1542 spin_unlock_irq(&data->txlock);
1543 } else {
1544 spin_unlock_irq(&data->txlock);
1545 data->suspend_count--;
1546 return -EBUSY;
1547 }
1548
6a88adf2
MH		 1549 cancel_work_sync(&data->work);
1550
7bee549e 1551 btusb_stop_traffic(data);
6a88adf2
MH		 1552 usb_kill_anchored_urbs(&data->tx_anchor);
1553
6a88adf2
MH		 1554 return 0;
1555}
1556
7bee549e
ON		 1557static void play_deferred(struct btusb_data *data)
1558{
1559 struct urb *urb;
1560 int err;
1561
1562 while ((urb = usb_get_from_anchor(&data->deferred))) {
1563 err = usb_submit_urb(urb, GFP_ATOMIC);
1564 if (err < 0)
1565 break;
1566
1567 data->tx_in_flight++;
1568 }
1569 usb_scuttle_anchored_urbs(&data->deferred);
1570}
1571
6a88adf2
MH		 1572static int btusb_resume(struct usb_interface *intf)
1573{
1574 struct btusb_data *data = usb_get_intfdata(intf);
1575 struct hci_dev *hdev = data->hdev;
7bee549e 1576 int err = 0;
6a88adf2
MH		 1577
1578 BT_DBG("intf %p", intf);
1579
1580 if (--data->suspend_count)
1581 return 0;
1582
1583 if (!test_bit(HCI_RUNNING, &hdev->flags))
7bee549e 1584 goto done;
6a88adf2
MH		 1585
1586 if (test_bit(BTUSB_INTR_RUNNING, &data->flags)) {
1587 err = btusb_submit_intr_urb(hdev, GFP_NOIO);
1588 if (err < 0) {
1589 clear_bit(BTUSB_INTR_RUNNING, &data->flags);
7bee549e 1590 goto failed;
6a88adf2
MH		 1591 }
1592 }
1593
1594 if (test_bit(BTUSB_BULK_RUNNING, &data->flags)) {
43c2e57f
MH		 1595 err = btusb_submit_bulk_urb(hdev, GFP_NOIO);
1596 if (err < 0) {
6a88adf2 1597 clear_bit(BTUSB_BULK_RUNNING, &data->flags);
7bee549e
ON		 1598 goto failed;
1599 }
1600
1601 btusb_submit_bulk_urb(hdev, GFP_NOIO);
6a88adf2
MH		 1602 }
1603
1604 if (test_bit(BTUSB_ISOC_RUNNING, &data->flags)) {
1605 if (btusb_submit_isoc_urb(hdev, GFP_NOIO) < 0)
1606 clear_bit(BTUSB_ISOC_RUNNING, &data->flags);
1607 else
1608 btusb_submit_isoc_urb(hdev, GFP_NOIO);
1609 }
1610
7bee549e
ON		 1611 spin_lock_irq(&data->txlock);
1612 play_deferred(data);
1613 clear_bit(BTUSB_SUSPENDING, &data->flags);
1614 spin_unlock_irq(&data->txlock);
1615 schedule_work(&data->work);
1616
6a88adf2 1617 return 0;
7bee549e
ON		 1618
1619failed:
1620 usb_scuttle_anchored_urbs(&data->deferred);
1621done:
1622 spin_lock_irq(&data->txlock);
1623 clear_bit(BTUSB_SUSPENDING, &data->flags);
1624 spin_unlock_irq(&data->txlock);
1625
1626 return err;
6a88adf2 1627}
7bee549e 1628#endif
6a88adf2 1629
5e23b923
MH		 1630static struct usb_driver btusb_driver = {
1631 .name = "btusb",
1632 .probe = btusb_probe,
1633 .disconnect = btusb_disconnect,
7bee549e 1634#ifdef CONFIG_PM
6a88adf2
MH		 1635 .suspend = btusb_suspend,
1636 .resume = btusb_resume,
7bee549e 1637#endif
5e23b923 1638 .id_table = btusb_table,
7bee549e 1639 .supports_autosuspend = 1,
e1f12eb6 1640 .disable_hub_initiated_lpm = 1,
5e23b923
MH		 1641};
1642
93f1508c 1643module_usb_driver(btusb_driver);
5e23b923 1644
cfeb4145
MH		 1645module_param(ignore_dga, bool, 0644);
1646MODULE_PARM_DESC(ignore_dga, "Ignore devices with id 08fd:0001");
1647
1648module_param(ignore_csr, bool, 0644);
1649MODULE_PARM_DESC(ignore_csr, "Ignore devices with id 0a12:0001");
1650
1651module_param(ignore_sniffer, bool, 0644);
1652MODULE_PARM_DESC(ignore_sniffer, "Ignore devices with id 0a12:0002");
1653
1654module_param(disable_scofix, bool, 0644);
1655MODULE_PARM_DESC(disable_scofix, "Disable fixup of wrong SCO buffer size");
1656
1657module_param(force_scofix, bool, 0644);
1658MODULE_PARM_DESC(force_scofix, "Force fixup of wrong SCO buffers size");
1659
1660module_param(reset, bool, 0644);
1661MODULE_PARM_DESC(reset, "Send HCI reset command on initialization");
1662
5e23b923
MH		 1663MODULE_AUTHOR("Marcel Holtmann <marcel@holtmann.org>");
1664MODULE_DESCRIPTION("Generic Bluetooth USB driver ver " VERSION);
1665MODULE_VERSION(VERSION);
1666MODULE_LICENSE("GPL");
Linux 6.x block layer and io_uring tree(s)