projects / deliverable / linux.git / blame
? search:
summary | shortlog | log | commit | commitdiff | tree
blob | blame (incremental) | history | HEAD
Bluetooth: Enforce providing hdev->send driver callback
[deliverable/linux.git] / drivers / bluetooth / btusb.c
CommitLineData
5e23b923
MH		 1/*
2 *
3 * Generic Bluetooth USB driver
4 *
9bfa35fe 5 * Copyright (C) 2005-2008 Marcel Holtmann <marcel@holtmann.org>
5e23b923
MH		 6 *
7 *
8 * This program is free software; you can redistribute it and/or modify
9 * it under the terms of the GNU General Public License as published by
10 * the Free Software Foundation; either version 2 of the License, or
11 * (at your option) any later version.
12 *
13 * This program is distributed in the hope that it will be useful,
14 * but WITHOUT ANY WARRANTY; without even the implied warranty of
15 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
16 * GNU General Public License for more details.
17 *
18 * You should have received a copy of the GNU General Public License
19 * along with this program; if not, write to the Free Software
20 * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
21 *
22 */
23
5e23b923 24#include <linux/module.h>
5e23b923 25#include <linux/usb.h>
dffd30ee 26#include <linux/firmware.h>
5e23b923
MH		 27
28#include <net/bluetooth/bluetooth.h>
29#include <net/bluetooth/hci_core.h>
30
7bee549e 31#define VERSION "0.6"
cfeb4145 32
90ab5ee9
RR		 33static bool disable_scofix;
34static bool force_scofix;
7a9d4020 35
90ab5ee9 36static bool reset = 1;
cfeb4145
MH		 37
38static struct usb_driver btusb_driver;
39
40#define BTUSB_IGNORE 0x01
7a9d4020
MH		 41#define BTUSB_DIGIANSWER 0x02
42#define BTUSB_CSR 0x04
43#define BTUSB_SNIFFER 0x08
44#define BTUSB_BCM92035 0x10
45#define BTUSB_BROKEN_ISOC 0x20
46#define BTUSB_WRONG_SCO_MTU 0x40
2d25f8b4 47#define BTUSB_ATH3012 0x80
dffd30ee 48#define BTUSB_INTEL 0x100
40df783d
MH		 49#define BTUSB_INTEL_BOOT 0x200
50#define BTUSB_BCM_PATCHRAM 0x400
5e23b923 51
54265202 52static const struct usb_device_id btusb_table[] = {
5e23b923
MH		 53 /* Generic Bluetooth USB device */
54 { USB_DEVICE_INFO(0xe0, 0x01, 0x01) },
55
1fa6535f
HR		 56 /* Apple-specific (Broadcom) devices */
57 { USB_VENDOR_AND_INTERFACE_INFO(0x05ac, 0xff, 0x01, 0x01) },
58
178c059e
CYC		 59 /* MediaTek MT76x0E */
60 { USB_DEVICE(0x0e8d, 0x763f) },
61
c510eae3 62 /* Broadcom SoftSailing reporting vendor specific */
2e8b5063 63 { USB_DEVICE(0x0a5c, 0x21e1) },
c510eae3 64
3cd01976
NI		 65 /* Apple MacBookPro 7,1 */
66 { USB_DEVICE(0x05ac, 0x8213) },
67
0a79f674
CL		 68 /* Apple iMac11,1 */
69 { USB_DEVICE(0x05ac, 0x8215) },
70
9c047157
NI		 71 /* Apple MacBookPro6,2 */
72 { USB_DEVICE(0x05ac, 0x8218) },
73
3e3ede7d
EH		 74 /* Apple MacBookAir3,1, MacBookAir3,2 */
75 { USB_DEVICE(0x05ac, 0x821b) },
76
a63b723d
PAVM		 77 /* Apple MacBookAir4,1 */
78 { USB_DEVICE(0x05ac, 0x821f) },
79
88d377b6
MAP		 80 /* Apple MacBookPro8,2 */
81 { USB_DEVICE(0x05ac, 0x821a) },
82
f78b6826
JK		 83 /* Apple MacMini5,1 */
84 { USB_DEVICE(0x05ac, 0x8281) },
85
cfeb4145
MH		 86 /* AVM BlueFRITZ! USB v2.0 */
87 { USB_DEVICE(0x057c, 0x3800) },
88
89 /* Bluetooth Ultraport Module from IBM */
90 { USB_DEVICE(0x04bf, 0x030a) },
91
92 /* ALPS Modules with non-standard id */
93 { USB_DEVICE(0x044e, 0x3001) },
94 { USB_DEVICE(0x044e, 0x3002) },
95
96 /* Ericsson with non-standard id */
97 { USB_DEVICE(0x0bdb, 0x1002) },
98
99 /* Canyon CN-BTU1 with HID interfaces */
7a9d4020 100 { USB_DEVICE(0x0c10, 0x0000) },
cfeb4145 101
d13431ca 102 /* Broadcom BCM20702A0 */
0b880062
AS		 103 { USB_DEVICE(0x0489, 0xe042) },
104 { USB_DEVICE(0x04ca, 0x2003) },
1ee3ff61 105 { USB_DEVICE(0x0b05, 0x17b5) },
38a172be 106 { USB_DEVICE(0x0b05, 0x17cb) },
d13431ca
WJS		 107 { USB_DEVICE(0x413c, 0x8197) },
108
98514036 109 /* Foxconn - Hon Hai */
ee66401b 110 { USB_VENDOR_AND_INTERFACE_INFO(0x0489, 0xff, 0x01, 0x01) },
98514036 111
0b880062 112 /* Broadcom devices with vendor specific id */
10d4c673
PG		 113 { USB_VENDOR_AND_INTERFACE_INFO(0x0a5c, 0xff, 0x01, 0x01),
114 .driver_info = BTUSB_BCM_PATCHRAM },
92c385f4 115
5bcecf32
KB		 116 /* Belkin F8065bf - Broadcom based */
117 { USB_VENDOR_AND_INTERFACE_INFO(0x050d, 0xff, 0x01, 0x01) },
118
9113bfd8
JK		 119 /* IMC Networks - Broadcom based */
120 { USB_VENDOR_AND_INTERFACE_INFO(0x13d3, 0xff, 0x01, 0x01) },
121
40df783d 122 /* Intel Bluetooth USB Bootloader (RAM module) */
d92f2df0
MH		 123 { USB_DEVICE(0x8087, 0x0a5a),
124 .driver_info = BTUSB_INTEL_BOOT | BTUSB_BROKEN_ISOC },
40df783d 125
5e23b923
MH		 126 { } /* Terminating entry */
127};
128
129MODULE_DEVICE_TABLE(usb, btusb_table);
130
54265202 131static const struct usb_device_id blacklist_table[] = {
cfeb4145
MH		 132 /* CSR BlueCore devices */
133 { USB_DEVICE(0x0a12, 0x0001), .driver_info = BTUSB_CSR },
134
135 /* Broadcom BCM2033 without firmware */
136 { USB_DEVICE(0x0a5c, 0x2033), .driver_info = BTUSB_IGNORE },
137
be93112a 138 /* Atheros 3011 with sflash firmware */
0b880062
AS		 139 { USB_DEVICE(0x0489, 0xe027), .driver_info = BTUSB_IGNORE },
140 { USB_DEVICE(0x0489, 0xe03d), .driver_info = BTUSB_IGNORE },
141 { USB_DEVICE(0x0930, 0x0215), .driver_info = BTUSB_IGNORE },
be93112a 142 { USB_DEVICE(0x0cf3, 0x3002), .driver_info = BTUSB_IGNORE },
6eda541d 143 { USB_DEVICE(0x0cf3, 0xe019), .driver_info = BTUSB_IGNORE },
2a7bcccc 144 { USB_DEVICE(0x13d3, 0x3304), .driver_info = BTUSB_IGNORE },
be93112a 145
509e7861
CYC		 146 /* Atheros AR9285 Malbec with sflash firmware */
147 { USB_DEVICE(0x03f0, 0x311d), .driver_info = BTUSB_IGNORE },
148
d9f51b51 149 /* Atheros 3012 with sflash firmware */
0b880062
AS		 150 { USB_DEVICE(0x0489, 0xe04d), .driver_info = BTUSB_ATH3012 },
151 { USB_DEVICE(0x0489, 0xe04e), .driver_info = BTUSB_ATH3012 },
152 { USB_DEVICE(0x0489, 0xe056), .driver_info = BTUSB_ATH3012 },
153 { USB_DEVICE(0x0489, 0xe057), .driver_info = BTUSB_ATH3012 },
154 { USB_DEVICE(0x0489, 0xe05f), .driver_info = BTUSB_ATH3012 },
155 { USB_DEVICE(0x04c5, 0x1330), .driver_info = BTUSB_ATH3012 },
156 { USB_DEVICE(0x04ca, 0x3004), .driver_info = BTUSB_ATH3012 },
157 { USB_DEVICE(0x04ca, 0x3005), .driver_info = BTUSB_ATH3012 },
158 { USB_DEVICE(0x04ca, 0x3006), .driver_info = BTUSB_ATH3012 },
1fb4e09a 159 { USB_DEVICE(0x04ca, 0x3007), .driver_info = BTUSB_ATH3012 },
0b880062
AS		 160 { USB_DEVICE(0x04ca, 0x3008), .driver_info = BTUSB_ATH3012 },
161 { USB_DEVICE(0x04ca, 0x300b), .driver_info = BTUSB_ATH3012 },
162 { USB_DEVICE(0x0930, 0x0219), .driver_info = BTUSB_ATH3012 },
163 { USB_DEVICE(0x0930, 0x0220), .driver_info = BTUSB_ATH3012 },
a735f9e2 164 { USB_DEVICE(0x0b05, 0x17d0), .driver_info = BTUSB_ATH3012 },
d66629c1 165 { USB_DEVICE(0x0cf3, 0x0036), .driver_info = BTUSB_ATH3012 },
2d25f8b4 166 { USB_DEVICE(0x0cf3, 0x3004), .driver_info = BTUSB_ATH3012 },
94a32d10 167 { USB_DEVICE(0x0cf3, 0x3008), .driver_info = BTUSB_ATH3012 },
07c0ea87 168 { USB_DEVICE(0x0cf3, 0x311d), .driver_info = BTUSB_ATH3012 },
b131237c 169 { USB_DEVICE(0x0cf3, 0x311e), .driver_info = BTUSB_ATH3012 },
1e56f1eb 170 { USB_DEVICE(0x0cf3, 0x311f), .driver_info = BTUSB_ATH3012 },
0b880062 171 { USB_DEVICE(0x0cf3, 0x3121), .driver_info = BTUSB_ATH3012 },
ebaf5795 172 { USB_DEVICE(0x0cf3, 0x817a), .driver_info = BTUSB_ATH3012 },
0b880062 173 { USB_DEVICE(0x0cf3, 0xe003), .driver_info = BTUSB_ATH3012 },
ac71311e 174 { USB_DEVICE(0x0cf3, 0xe004), .driver_info = BTUSB_ATH3012 },
0a3658cc 175 { USB_DEVICE(0x0cf3, 0xe005), .driver_info = BTUSB_ATH3012 },
0b880062
AS		 176 { USB_DEVICE(0x13d3, 0x3362), .driver_info = BTUSB_ATH3012 },
177 { USB_DEVICE(0x13d3, 0x3375), .driver_info = BTUSB_ATH3012 },
eed307e2 178 { USB_DEVICE(0x13d3, 0x3393), .driver_info = BTUSB_ATH3012 },
5b77a1f3 179 { USB_DEVICE(0x13d3, 0x3402), .driver_info = BTUSB_ATH3012 },
d9f51b51 180
e9036e33
CYC		 181 /* Atheros AR5BBU12 with sflash firmware */
182 { USB_DEVICE(0x0489, 0xe02c), .driver_info = BTUSB_IGNORE },
183
85d59726 184 /* Atheros AR5BBU12 with sflash firmware */
bc21fde2 185 { USB_DEVICE(0x0489, 0xe036), .driver_info = BTUSB_ATH3012 },
0b880062 186 { USB_DEVICE(0x0489, 0xe03c), .driver_info = BTUSB_ATH3012 },
85d59726 187
cfeb4145 188 /* Broadcom BCM2035 */
7a9d4020 189 { USB_DEVICE(0x0a5c, 0x2009), .driver_info = BTUSB_BCM92035 },
0b880062
AS		 190 { USB_DEVICE(0x0a5c, 0x200a), .driver_info = BTUSB_WRONG_SCO_MTU },
191 { USB_DEVICE(0x0a5c, 0x2035), .driver_info = BTUSB_WRONG_SCO_MTU },
cfeb4145
MH		 192
193 /* Broadcom BCM2045 */
7a9d4020
MH		 194 { USB_DEVICE(0x0a5c, 0x2039), .driver_info = BTUSB_WRONG_SCO_MTU },
195 { USB_DEVICE(0x0a5c, 0x2101), .driver_info = BTUSB_WRONG_SCO_MTU },
bdbef3d6 196
cfeb4145 197 /* IBM/Lenovo ThinkPad with Broadcom chip */
7a9d4020
MH		 198 { USB_DEVICE(0x0a5c, 0x201e), .driver_info = BTUSB_WRONG_SCO_MTU },
199 { USB_DEVICE(0x0a5c, 0x2110), .driver_info = BTUSB_WRONG_SCO_MTU },
cfeb4145
MH		 200
201 /* HP laptop with Broadcom chip */
7a9d4020 202 { USB_DEVICE(0x03f0, 0x171d), .driver_info = BTUSB_WRONG_SCO_MTU },
cfeb4145
MH		 203
204 /* Dell laptop with Broadcom chip */
7a9d4020 205 { USB_DEVICE(0x413c, 0x8126), .driver_info = BTUSB_WRONG_SCO_MTU },
cfeb4145 206
5ddd4a60 207 /* Dell Wireless 370 and 410 devices */
7a9d4020 208 { USB_DEVICE(0x413c, 0x8152), .driver_info = BTUSB_WRONG_SCO_MTU },
5ddd4a60 209 { USB_DEVICE(0x413c, 0x8156), .driver_info = BTUSB_WRONG_SCO_MTU },
cfeb4145 210
7a9d4020
MH		 211 /* Belkin F8T012 and F8T013 devices */
212 { USB_DEVICE(0x050d, 0x0012), .driver_info = BTUSB_WRONG_SCO_MTU },
213 { USB_DEVICE(0x050d, 0x0013), .driver_info = BTUSB_WRONG_SCO_MTU },
cfeb4145 214
5ddd4a60
MH		 215 /* Asus WL-BTD202 device */
216 { USB_DEVICE(0x0b05, 0x1715), .driver_info = BTUSB_WRONG_SCO_MTU },
217
218 /* Kensington Bluetooth USB adapter */
219 { USB_DEVICE(0x047d, 0x105e), .driver_info = BTUSB_WRONG_SCO_MTU },
220
cfeb4145
MH		 221 /* RTX Telecom based adapters with buggy SCO support */
222 { USB_DEVICE(0x0400, 0x0807), .driver_info = BTUSB_BROKEN_ISOC },
223 { USB_DEVICE(0x0400, 0x080a), .driver_info = BTUSB_BROKEN_ISOC },
224
225 /* CONWISE Technology based adapters with buggy SCO support */
226 { USB_DEVICE(0x0e5e, 0x6622), .driver_info = BTUSB_BROKEN_ISOC },
227
cfeb4145
MH		 228 /* Digianswer devices */
229 { USB_DEVICE(0x08fd, 0x0001), .driver_info = BTUSB_DIGIANSWER },
230 { USB_DEVICE(0x08fd, 0x0002), .driver_info = BTUSB_IGNORE },
231
232 /* CSR BlueCore Bluetooth Sniffer */
233 { USB_DEVICE(0x0a12, 0x0002), .driver_info = BTUSB_SNIFFER },
234
235 /* Frontline ComProbe Bluetooth Sniffer */
236 { USB_DEVICE(0x16d3, 0x0002), .driver_info = BTUSB_SNIFFER },
237
dffd30ee
THJA		 238 /* Intel Bluetooth device */
239 { USB_DEVICE(0x8087, 0x07dc), .driver_info = BTUSB_INTEL },
ef4e5e4a 240 { USB_DEVICE(0x8087, 0x0a2a), .driver_info = BTUSB_INTEL },
dffd30ee 241
5e23b923
MH		 242 { } /* Terminating entry */
243};
244
9bfa35fe
MH		 245#define BTUSB_MAX_ISOC_FRAMES 10
246
5e23b923
MH		 247#define BTUSB_INTR_RUNNING 0
248#define BTUSB_BULK_RUNNING 1
9bfa35fe 249#define BTUSB_ISOC_RUNNING 2
7bee549e 250#define BTUSB_SUSPENDING 3
08b8b6c4 251#define BTUSB_DID_ISO_RESUME 4
5e23b923
MH		 252
253struct btusb_data {
254 struct hci_dev *hdev;
255 struct usb_device *udev;
5fbcd260 256 struct usb_interface *intf;
9bfa35fe 257 struct usb_interface *isoc;
5e23b923
MH		 258
259 spinlock_t lock;
260
261 unsigned long flags;
262
263 struct work_struct work;
7bee549e 264 struct work_struct waker;
5e23b923
MH		 265
266 struct usb_anchor tx_anchor;
267 struct usb_anchor intr_anchor;
268 struct usb_anchor bulk_anchor;
9bfa35fe 269 struct usb_anchor isoc_anchor;
7bee549e
ON		 270 struct usb_anchor deferred;
271 int tx_in_flight;
272 spinlock_t txlock;
5e23b923
MH		 273
274 struct usb_endpoint_descriptor *intr_ep;
275 struct usb_endpoint_descriptor *bulk_tx_ep;
276 struct usb_endpoint_descriptor *bulk_rx_ep;
9bfa35fe
MH		 277 struct usb_endpoint_descriptor *isoc_tx_ep;
278 struct usb_endpoint_descriptor *isoc_rx_ep;
279
7a9d4020
MH		 280 __u8 cmdreq_type;
281
43c2e57f 282 unsigned int sco_num;
9bfa35fe 283 int isoc_altsetting;
6a88adf2 284 int suspend_count;
5e23b923
MH		 285};
286
7bee549e
ON		 287static int inc_tx(struct btusb_data *data)
288{
289 unsigned long flags;
290 int rv;
291
292 spin_lock_irqsave(&data->txlock, flags);
293 rv = test_bit(BTUSB_SUSPENDING, &data->flags);
294 if (!rv)
295 data->tx_in_flight++;
296 spin_unlock_irqrestore(&data->txlock, flags);
297
298 return rv;
299}
300
5e23b923
MH		 301static void btusb_intr_complete(struct urb *urb)
302{
303 struct hci_dev *hdev = urb->context;
155961e8 304 struct btusb_data *data = hci_get_drvdata(hdev);
5e23b923
MH		 305 int err;
306
307 BT_DBG("%s urb %p status %d count %d", hdev->name,
308 urb, urb->status, urb->actual_length);
309
310 if (!test_bit(HCI_RUNNING, &hdev->flags))
311 return;
312
313 if (urb->status == 0) {
9bfa35fe
MH		 314 hdev->stat.byte_rx += urb->actual_length;
315
5e23b923
MH		 316 if (hci_recv_fragment(hdev, HCI_EVENT_PKT,
317 urb->transfer_buffer,
318 urb->actual_length) < 0) {
319 BT_ERR("%s corrupted event packet", hdev->name);
320 hdev->stat.err_rx++;
321 }
322 }
323
324 if (!test_bit(BTUSB_INTR_RUNNING, &data->flags))
325 return;
326
7bee549e 327 usb_mark_last_busy(data->udev);
5e23b923
MH		 328 usb_anchor_urb(urb, &data->intr_anchor);
329
330 err = usb_submit_urb(urb, GFP_ATOMIC);
331 if (err < 0) {
4935f1c1
PB		 332 /* -EPERM: urb is being killed;
333 * -ENODEV: device got disconnected */
334 if (err != -EPERM && err != -ENODEV)
61faddf6 335 BT_ERR("%s urb %p failed to resubmit (%d)",
5e23b923
MH		 336 hdev->name, urb, -err);
337 usb_unanchor_urb(urb);
338 }
339}
340
2eda66f4 341static int btusb_submit_intr_urb(struct hci_dev *hdev, gfp_t mem_flags)
5e23b923 342{
155961e8 343 struct btusb_data *data = hci_get_drvdata(hdev);
5e23b923
MH		 344 struct urb *urb;
345 unsigned char *buf;
346 unsigned int pipe;
347 int err, size;
348
349 BT_DBG("%s", hdev->name);
350
9bfa35fe
MH		 351 if (!data->intr_ep)
352 return -ENODEV;
353
2eda66f4 354 urb = usb_alloc_urb(0, mem_flags);
5e23b923
MH		 355 if (!urb)
356 return -ENOMEM;
357
358 size = le16_to_cpu(data->intr_ep->wMaxPacketSize);
359
2eda66f4 360 buf = kmalloc(size, mem_flags);
5e23b923
MH		 361 if (!buf) {
362 usb_free_urb(urb);
363 return -ENOMEM;
364 }
365
366 pipe = usb_rcvintpipe(data->udev, data->intr_ep->bEndpointAddress);
367
368 usb_fill_int_urb(urb, data->udev, pipe, buf, size,
369 btusb_intr_complete, hdev,
370 data->intr_ep->bInterval);
371
372 urb->transfer_flags |= URB_FREE_BUFFER;
373
374 usb_anchor_urb(urb, &data->intr_anchor);
375
2eda66f4 376 err = usb_submit_urb(urb, mem_flags);
5e23b923 377 if (err < 0) {
d4b8d1c9
PB		 378 if (err != -EPERM && err != -ENODEV)
379 BT_ERR("%s urb %p submission failed (%d)",
5e23b923
MH		 380 hdev->name, urb, -err);
381 usb_unanchor_urb(urb);
5e23b923
MH		 382 }
383
384 usb_free_urb(urb);
385
386 return err;
387}
388
389static void btusb_bulk_complete(struct urb *urb)
390{
391 struct hci_dev *hdev = urb->context;
155961e8 392 struct btusb_data *data = hci_get_drvdata(hdev);
5e23b923
MH		 393 int err;
394
395 BT_DBG("%s urb %p status %d count %d", hdev->name,
396 urb, urb->status, urb->actual_length);
397
398 if (!test_bit(HCI_RUNNING, &hdev->flags))
399 return;
400
401 if (urb->status == 0) {
9bfa35fe
MH		 402 hdev->stat.byte_rx += urb->actual_length;
403
5e23b923
MH		 404 if (hci_recv_fragment(hdev, HCI_ACLDATA_PKT,
405 urb->transfer_buffer,
406 urb->actual_length) < 0) {
407 BT_ERR("%s corrupted ACL packet", hdev->name);
408 hdev->stat.err_rx++;
409 }
410 }
411
412 if (!test_bit(BTUSB_BULK_RUNNING, &data->flags))
413 return;
414
415 usb_anchor_urb(urb, &data->bulk_anchor);
652fd781 416 usb_mark_last_busy(data->udev);
5e23b923
MH		 417
418 err = usb_submit_urb(urb, GFP_ATOMIC);
419 if (err < 0) {
4935f1c1
PB		 420 /* -EPERM: urb is being killed;
421 * -ENODEV: device got disconnected */
422 if (err != -EPERM && err != -ENODEV)
61faddf6 423 BT_ERR("%s urb %p failed to resubmit (%d)",
5e23b923
MH		 424 hdev->name, urb, -err);
425 usb_unanchor_urb(urb);
426 }
427}
428
2eda66f4 429static int btusb_submit_bulk_urb(struct hci_dev *hdev, gfp_t mem_flags)
5e23b923 430{
155961e8 431 struct btusb_data *data = hci_get_drvdata(hdev);
5e23b923
MH		 432 struct urb *urb;
433 unsigned char *buf;
434 unsigned int pipe;
290ba200 435 int err, size = HCI_MAX_FRAME_SIZE;
5e23b923
MH		 436
437 BT_DBG("%s", hdev->name);
438
9bfa35fe
MH		 439 if (!data->bulk_rx_ep)
440 return -ENODEV;
441
2eda66f4 442 urb = usb_alloc_urb(0, mem_flags);
5e23b923
MH		 443 if (!urb)
444 return -ENOMEM;
445
2eda66f4 446 buf = kmalloc(size, mem_flags);
5e23b923
MH		 447 if (!buf) {
448 usb_free_urb(urb);
449 return -ENOMEM;
450 }
451
452 pipe = usb_rcvbulkpipe(data->udev, data->bulk_rx_ep->bEndpointAddress);
453
454 usb_fill_bulk_urb(urb, data->udev, pipe,
455 buf, size, btusb_bulk_complete, hdev);
456
457 urb->transfer_flags |= URB_FREE_BUFFER;
458
7bee549e 459 usb_mark_last_busy(data->udev);
5e23b923
MH		 460 usb_anchor_urb(urb, &data->bulk_anchor);
461
2eda66f4 462 err = usb_submit_urb(urb, mem_flags);
5e23b923 463 if (err < 0) {
d4b8d1c9
PB		 464 if (err != -EPERM && err != -ENODEV)
465 BT_ERR("%s urb %p submission failed (%d)",
5e23b923
MH		 466 hdev->name, urb, -err);
467 usb_unanchor_urb(urb);
5e23b923
MH		 468 }
469
470 usb_free_urb(urb);
471
472 return err;
473}
474
9bfa35fe
MH		 475static void btusb_isoc_complete(struct urb *urb)
476{
477 struct hci_dev *hdev = urb->context;
155961e8 478 struct btusb_data *data = hci_get_drvdata(hdev);
9bfa35fe
MH		 479 int i, err;
480
481 BT_DBG("%s urb %p status %d count %d", hdev->name,
482 urb, urb->status, urb->actual_length);
483
484 if (!test_bit(HCI_RUNNING, &hdev->flags))
485 return;
486
487 if (urb->status == 0) {
488 for (i = 0; i < urb->number_of_packets; i++) {
489 unsigned int offset = urb->iso_frame_desc[i].offset;
490 unsigned int length = urb->iso_frame_desc[i].actual_length;
491
492 if (urb->iso_frame_desc[i].status)
493 continue;
494
495 hdev->stat.byte_rx += length;
496
497 if (hci_recv_fragment(hdev, HCI_SCODATA_PKT,
498 urb->transfer_buffer + offset,
499 length) < 0) {
500 BT_ERR("%s corrupted SCO packet", hdev->name);
501 hdev->stat.err_rx++;
502 }
503 }
504 }
505
506 if (!test_bit(BTUSB_ISOC_RUNNING, &data->flags))
507 return;
508
509 usb_anchor_urb(urb, &data->isoc_anchor);
510
511 err = usb_submit_urb(urb, GFP_ATOMIC);
512 if (err < 0) {
4935f1c1
PB		 513 /* -EPERM: urb is being killed;
514 * -ENODEV: device got disconnected */
515 if (err != -EPERM && err != -ENODEV)
61faddf6 516 BT_ERR("%s urb %p failed to resubmit (%d)",
9bfa35fe
MH		 517 hdev->name, urb, -err);
518 usb_unanchor_urb(urb);
519 }
520}
521
42b16b3f 522static inline void __fill_isoc_descriptor(struct urb *urb, int len, int mtu)
9bfa35fe
MH		 523{
524 int i, offset = 0;
525
526 BT_DBG("len %d mtu %d", len, mtu);
527
528 for (i = 0; i < BTUSB_MAX_ISOC_FRAMES && len >= mtu;
529 i++, offset += mtu, len -= mtu) {
530 urb->iso_frame_desc[i].offset = offset;
531 urb->iso_frame_desc[i].length = mtu;
532 }
533
534 if (len && i < BTUSB_MAX_ISOC_FRAMES) {
535 urb->iso_frame_desc[i].offset = offset;
536 urb->iso_frame_desc[i].length = len;
537 i++;
538 }
539
540 urb->number_of_packets = i;
541}
542
2eda66f4 543static int btusb_submit_isoc_urb(struct hci_dev *hdev, gfp_t mem_flags)
9bfa35fe 544{
155961e8 545 struct btusb_data *data = hci_get_drvdata(hdev);
9bfa35fe
MH		 546 struct urb *urb;
547 unsigned char *buf;
548 unsigned int pipe;
549 int err, size;
550
551 BT_DBG("%s", hdev->name);
552
553 if (!data->isoc_rx_ep)
554 return -ENODEV;
555
2eda66f4 556 urb = usb_alloc_urb(BTUSB_MAX_ISOC_FRAMES, mem_flags);
9bfa35fe
MH		 557 if (!urb)
558 return -ENOMEM;
559
560 size = le16_to_cpu(data->isoc_rx_ep->wMaxPacketSize) *
561 BTUSB_MAX_ISOC_FRAMES;
562
2eda66f4 563 buf = kmalloc(size, mem_flags);
9bfa35fe
MH		 564 if (!buf) {
565 usb_free_urb(urb);
566 return -ENOMEM;
567 }
568
569 pipe = usb_rcvisocpipe(data->udev, data->isoc_rx_ep->bEndpointAddress);
570
fa0fb93f
BZ		 571 usb_fill_int_urb(urb, data->udev, pipe, buf, size, btusb_isoc_complete,
572 hdev, data->isoc_rx_ep->bInterval);
9bfa35fe
MH		 573
574 urb->transfer_flags = URB_FREE_BUFFER | URB_ISO_ASAP;
9bfa35fe
MH		 575
576 __fill_isoc_descriptor(urb, size,
577 le16_to_cpu(data->isoc_rx_ep->wMaxPacketSize));
578
579 usb_anchor_urb(urb, &data->isoc_anchor);
580
2eda66f4 581 err = usb_submit_urb(urb, mem_flags);
9bfa35fe 582 if (err < 0) {
d4b8d1c9
PB		 583 if (err != -EPERM && err != -ENODEV)
584 BT_ERR("%s urb %p submission failed (%d)",
9bfa35fe
MH		 585 hdev->name, urb, -err);
586 usb_unanchor_urb(urb);
9bfa35fe
MH		 587 }
588
589 usb_free_urb(urb);
590
591 return err;
592}
593
5e23b923 594static void btusb_tx_complete(struct urb *urb)
7bee549e
ON		 595{
596 struct sk_buff *skb = urb->context;
597 struct hci_dev *hdev = (struct hci_dev *) skb->dev;
155961e8 598 struct btusb_data *data = hci_get_drvdata(hdev);
7bee549e
ON		 599
600 BT_DBG("%s urb %p status %d count %d", hdev->name,
601 urb, urb->status, urb->actual_length);
602
603 if (!test_bit(HCI_RUNNING, &hdev->flags))
604 goto done;
605
606 if (!urb->status)
607 hdev->stat.byte_tx += urb->transfer_buffer_length;
608 else
609 hdev->stat.err_tx++;
610
611done:
612 spin_lock(&data->txlock);
613 data->tx_in_flight--;
614 spin_unlock(&data->txlock);
615
616 kfree(urb->setup_packet);
617
618 kfree_skb(skb);
619}
620
621static void btusb_isoc_tx_complete(struct urb *urb)
5e23b923
MH		 622{
623 struct sk_buff *skb = urb->context;
624 struct hci_dev *hdev = (struct hci_dev *) skb->dev;
625
626 BT_DBG("%s urb %p status %d count %d", hdev->name,
627 urb, urb->status, urb->actual_length);
628
629 if (!test_bit(HCI_RUNNING, &hdev->flags))
630 goto done;
631
632 if (!urb->status)
633 hdev->stat.byte_tx += urb->transfer_buffer_length;
634 else
635 hdev->stat.err_tx++;
636
637done:
638 kfree(urb->setup_packet);
639
640 kfree_skb(skb);
641}
642
643static int btusb_open(struct hci_dev *hdev)
644{
155961e8 645 struct btusb_data *data = hci_get_drvdata(hdev);
5e23b923
MH		 646 int err;
647
648 BT_DBG("%s", hdev->name);
649
7bee549e
ON		 650 err = usb_autopm_get_interface(data->intf);
651 if (err < 0)
652 return err;
653
654 data->intf->needs_remote_wakeup = 1;
655
5e23b923 656 if (test_and_set_bit(HCI_RUNNING, &hdev->flags))
7bee549e 657 goto done;
5e23b923
MH		 658
659 if (test_and_set_bit(BTUSB_INTR_RUNNING, &data->flags))
7bee549e 660 goto done;
5e23b923 661
2eda66f4 662 err = btusb_submit_intr_urb(hdev, GFP_KERNEL);
43c2e57f
MH		 663 if (err < 0)
664 goto failed;
665
666 err = btusb_submit_bulk_urb(hdev, GFP_KERNEL);
5e23b923 667 if (err < 0) {
43c2e57f
MH		 668 usb_kill_anchored_urbs(&data->intr_anchor);
669 goto failed;
5e23b923
MH		 670 }
671
43c2e57f
MH		 672 set_bit(BTUSB_BULK_RUNNING, &data->flags);
673 btusb_submit_bulk_urb(hdev, GFP_KERNEL);
674
7bee549e
ON		 675done:
676 usb_autopm_put_interface(data->intf);
43c2e57f
MH		 677 return 0;
678
679failed:
680 clear_bit(BTUSB_INTR_RUNNING, &data->flags);
681 clear_bit(HCI_RUNNING, &hdev->flags);
7bee549e 682 usb_autopm_put_interface(data->intf);
5e23b923
MH		 683 return err;
684}
685
7bee549e
ON		 686static void btusb_stop_traffic(struct btusb_data *data)
687{
688 usb_kill_anchored_urbs(&data->intr_anchor);
689 usb_kill_anchored_urbs(&data->bulk_anchor);
690 usb_kill_anchored_urbs(&data->isoc_anchor);
691}
692
5e23b923
MH		 693static int btusb_close(struct hci_dev *hdev)
694{
155961e8 695 struct btusb_data *data = hci_get_drvdata(hdev);
7bee549e 696 int err;
5e23b923
MH		 697
698 BT_DBG("%s", hdev->name);
699
700 if (!test_and_clear_bit(HCI_RUNNING, &hdev->flags))
701 return 0;
702
e8c3c3d2 703 cancel_work_sync(&data->work);
404291ac 704 cancel_work_sync(&data->waker);
e8c3c3d2 705
9bfa35fe 706 clear_bit(BTUSB_ISOC_RUNNING, &data->flags);
5e23b923 707 clear_bit(BTUSB_BULK_RUNNING, &data->flags);
5e23b923 708 clear_bit(BTUSB_INTR_RUNNING, &data->flags);
7bee549e
ON		 709
710 btusb_stop_traffic(data);
711 err = usb_autopm_get_interface(data->intf);
712 if (err < 0)
7b8e2c1d 713 goto failed;
7bee549e
ON		 714
715 data->intf->needs_remote_wakeup = 0;
716 usb_autopm_put_interface(data->intf);
5e23b923 717
7b8e2c1d
ON		 718failed:
719 usb_scuttle_anchored_urbs(&data->deferred);
5e23b923
MH		 720 return 0;
721}
722
723static int btusb_flush(struct hci_dev *hdev)
724{
155961e8 725 struct btusb_data *data = hci_get_drvdata(hdev);
5e23b923
MH		 726
727 BT_DBG("%s", hdev->name);
728
729 usb_kill_anchored_urbs(&data->tx_anchor);
730
731 return 0;
732}
733
7bd8f09f 734static int btusb_send_frame(struct hci_dev *hdev, struct sk_buff *skb)
5e23b923 735{
155961e8 736 struct btusb_data *data = hci_get_drvdata(hdev);
5e23b923
MH		 737 struct usb_ctrlrequest *dr;
738 struct urb *urb;
739 unsigned int pipe;
740 int err;
741
742 BT_DBG("%s", hdev->name);
743
744 if (!test_bit(HCI_RUNNING, &hdev->flags))
745 return -EBUSY;
746
7bd8f09f
MH		 747 skb->dev = (void *) hdev;
748
5e23b923
MH		 749 switch (bt_cb(skb)->pkt_type) {
750 case HCI_COMMAND_PKT:
751 urb = usb_alloc_urb(0, GFP_ATOMIC);
752 if (!urb)
753 return -ENOMEM;
754
755 dr = kmalloc(sizeof(*dr), GFP_ATOMIC);
756 if (!dr) {
757 usb_free_urb(urb);
758 return -ENOMEM;
759 }
760
7a9d4020 761 dr->bRequestType = data->cmdreq_type;
5e23b923
MH		 762 dr->bRequest = 0;
763 dr->wIndex = 0;
764 dr->wValue = 0;
765 dr->wLength = __cpu_to_le16(skb->len);
766
767 pipe = usb_sndctrlpipe(data->udev, 0x00);
768
769 usb_fill_control_urb(urb, data->udev, pipe, (void *) dr,
770 skb->data, skb->len, btusb_tx_complete, skb);
771
772 hdev->stat.cmd_tx++;
773 break;
774
775 case HCI_ACLDATA_PKT:
9fd481e0 776 if (!data->bulk_tx_ep)
9bfa35fe
MH		 777 return -ENODEV;
778
5e23b923
MH		 779 urb = usb_alloc_urb(0, GFP_ATOMIC);
780 if (!urb)
781 return -ENOMEM;
782
783 pipe = usb_sndbulkpipe(data->udev,
784 data->bulk_tx_ep->bEndpointAddress);
785
786 usb_fill_bulk_urb(urb, data->udev, pipe,
787 skb->data, skb->len, btusb_tx_complete, skb);
788
789 hdev->stat.acl_tx++;
790 break;
791
792 case HCI_SCODATA_PKT:
014f7bc7 793 if (!data->isoc_tx_ep || hci_conn_num(hdev, SCO_LINK) < 1)
9bfa35fe
MH		 794 return -ENODEV;
795
796 urb = usb_alloc_urb(BTUSB_MAX_ISOC_FRAMES, GFP_ATOMIC);
797 if (!urb)
798 return -ENOMEM;
799
800 pipe = usb_sndisocpipe(data->udev,
801 data->isoc_tx_ep->bEndpointAddress);
802
03c2d0e8
GP		 803 usb_fill_int_urb(urb, data->udev, pipe,
804 skb->data, skb->len, btusb_isoc_tx_complete,
805 skb, data->isoc_tx_ep->bInterval);
9bfa35fe
MH		 806
807 urb->transfer_flags = URB_ISO_ASAP;
9bfa35fe
MH		 808
809 __fill_isoc_descriptor(urb, skb->len,
810 le16_to_cpu(data->isoc_tx_ep->wMaxPacketSize));
811
5e23b923 812 hdev->stat.sco_tx++;
7bee549e 813 goto skip_waking;
5e23b923
MH		 814
815 default:
816 return -EILSEQ;
817 }
818
7bee549e
ON		 819 err = inc_tx(data);
820 if (err) {
821 usb_anchor_urb(urb, &data->deferred);
822 schedule_work(&data->waker);
823 err = 0;
824 goto done;
825 }
826
827skip_waking:
5e23b923
MH		 828 usb_anchor_urb(urb, &data->tx_anchor);
829
830 err = usb_submit_urb(urb, GFP_ATOMIC);
831 if (err < 0) {
5a9b80e2
PB		 832 if (err != -EPERM && err != -ENODEV)
833 BT_ERR("%s urb %p submission failed (%d)",
834 hdev->name, urb, -err);
5e23b923
MH		 835 kfree(urb->setup_packet);
836 usb_unanchor_urb(urb);
7bee549e
ON		 837 } else {
838 usb_mark_last_busy(data->udev);
5e23b923
MH		 839 }
840
7bee549e 841done:
54a8a79c 842 usb_free_urb(urb);
5e23b923
MH		 843 return err;
844}
845
5e23b923
MH		 846static void btusb_notify(struct hci_dev *hdev, unsigned int evt)
847{
155961e8 848 struct btusb_data *data = hci_get_drvdata(hdev);
5e23b923
MH		 849
850 BT_DBG("%s evt %d", hdev->name, evt);
851
014f7bc7
MH		 852 if (hci_conn_num(hdev, SCO_LINK) != data->sco_num) {
853 data->sco_num = hci_conn_num(hdev, SCO_LINK);
43c2e57f 854 schedule_work(&data->work);
a780efa8 855 }
5e23b923
MH		 856}
857
42b16b3f 858static inline int __set_isoc_interface(struct hci_dev *hdev, int altsetting)
9bfa35fe 859{
155961e8 860 struct btusb_data *data = hci_get_drvdata(hdev);
9bfa35fe
MH		 861 struct usb_interface *intf = data->isoc;
862 struct usb_endpoint_descriptor *ep_desc;
863 int i, err;
864
865 if (!data->isoc)
866 return -ENODEV;
867
868 err = usb_set_interface(data->udev, 1, altsetting);
869 if (err < 0) {
870 BT_ERR("%s setting interface failed (%d)", hdev->name, -err);
871 return err;
872 }
873
874 data->isoc_altsetting = altsetting;
875
876 data->isoc_tx_ep = NULL;
877 data->isoc_rx_ep = NULL;
878
879 for (i = 0; i < intf->cur_altsetting->desc.bNumEndpoints; i++) {
880 ep_desc = &intf->cur_altsetting->endpoint[i].desc;
881
882 if (!data->isoc_tx_ep && usb_endpoint_is_isoc_out(ep_desc)) {
883 data->isoc_tx_ep = ep_desc;
884 continue;
885 }
886
887 if (!data->isoc_rx_ep && usb_endpoint_is_isoc_in(ep_desc)) {
888 data->isoc_rx_ep = ep_desc;
889 continue;
890 }
891 }
892
893 if (!data->isoc_tx_ep || !data->isoc_rx_ep) {
894 BT_ERR("%s invalid SCO descriptors", hdev->name);
895 return -ENODEV;
896 }
897
898 return 0;
899}
900
5e23b923
MH		 901static void btusb_work(struct work_struct *work)
902{
903 struct btusb_data *data = container_of(work, struct btusb_data, work);
904 struct hci_dev *hdev = data->hdev;
f4001d28 905 int new_alts;
7bee549e 906 int err;
5e23b923 907
014f7bc7 908 if (data->sco_num > 0) {
08b8b6c4 909 if (!test_bit(BTUSB_DID_ISO_RESUME, &data->flags)) {
8efdd0cd 910 err = usb_autopm_get_interface(data->isoc ? data->isoc : data->intf);
7bee549e
ON		 911 if (err < 0) {
912 clear_bit(BTUSB_ISOC_RUNNING, &data->flags);
913 usb_kill_anchored_urbs(&data->isoc_anchor);
914 return;
915 }
916
08b8b6c4 917 set_bit(BTUSB_DID_ISO_RESUME, &data->flags);
7bee549e 918 }
f4001d28
MA		 919
920 if (hdev->voice_setting & 0x0020) {
921 static const int alts[3] = { 2, 4, 5 };
014f7bc7 922 new_alts = alts[data->sco_num - 1];
f4001d28 923 } else {
014f7bc7 924 new_alts = data->sco_num;
f4001d28
MA		 925 }
926
927 if (data->isoc_altsetting != new_alts) {
9bfa35fe
MH		 928 clear_bit(BTUSB_ISOC_RUNNING, &data->flags);
929 usb_kill_anchored_urbs(&data->isoc_anchor);
930
f4001d28 931 if (__set_isoc_interface(hdev, new_alts) < 0)
9bfa35fe
MH		 932 return;
933 }
934
935 if (!test_and_set_bit(BTUSB_ISOC_RUNNING, &data->flags)) {
2eda66f4 936 if (btusb_submit_isoc_urb(hdev, GFP_KERNEL) < 0)
9bfa35fe
MH		 937 clear_bit(BTUSB_ISOC_RUNNING, &data->flags);
938 else
2eda66f4 939 btusb_submit_isoc_urb(hdev, GFP_KERNEL);
9bfa35fe
MH		 940 }
941 } else {
942 clear_bit(BTUSB_ISOC_RUNNING, &data->flags);
943 usb_kill_anchored_urbs(&data->isoc_anchor);
944
945 __set_isoc_interface(hdev, 0);
08b8b6c4 946 if (test_and_clear_bit(BTUSB_DID_ISO_RESUME, &data->flags))
8efdd0cd 947 usb_autopm_put_interface(data->isoc ? data->isoc : data->intf);
5e23b923
MH		 948 }
949}
950
7bee549e
ON		 951static void btusb_waker(struct work_struct *work)
952{
953 struct btusb_data *data = container_of(work, struct btusb_data, waker);
954 int err;
955
956 err = usb_autopm_get_interface(data->intf);
957 if (err < 0)
958 return;
959
960 usb_autopm_put_interface(data->intf);
961}
962
9f8f962c
MH		 963static int btusb_setup_bcm92035(struct hci_dev *hdev)
964{
965 struct sk_buff *skb;
966 u8 val = 0x00;
967
968 BT_DBG("%s", hdev->name);
969
970 skb = __hci_cmd_sync(hdev, 0xfc3b, 1, &val, HCI_INIT_TIMEOUT);
971 if (IS_ERR(skb))
972 BT_ERR("BCM92035 command failed (%ld)", -PTR_ERR(skb));
973 else
974 kfree_skb(skb);
975
976 return 0;
977}
978
81cac64b
MH		 979static int btusb_setup_csr(struct hci_dev *hdev)
980{
981 struct hci_rp_read_local_version *rp;
982 struct sk_buff *skb;
983 int ret;
984
985 BT_DBG("%s", hdev->name);
986
987 skb = __hci_cmd_sync(hdev, HCI_OP_READ_LOCAL_VERSION, 0, NULL,
988 HCI_INIT_TIMEOUT);
989 if (IS_ERR(skb)) {
990 BT_ERR("Reading local version failed (%ld)", -PTR_ERR(skb));
991 return -PTR_ERR(skb);
992 }
993
994 rp = (struct hci_rp_read_local_version *) skb->data;
995
996 if (!rp->status) {
997 if (le16_to_cpu(rp->manufacturer) != 10) {
998 /* Clear the reset quirk since this is not an actual
999 * early Bluetooth 1.1 device from CSR.
1000 */
1001 clear_bit(HCI_QUIRK_RESET_ON_CLOSE, &hdev->quirks);
1002
1003 /* These fake CSR controllers have all a broken
1004 * stored link key handling and so just disable it.
1005 */
1006 set_bit(HCI_QUIRK_BROKEN_STORED_LINK_KEY,
1007 &hdev->quirks);
1008 }
1009 }
1010
1011 ret = -bt_to_errno(rp->status);
1012
1013 kfree_skb(skb);
1014
1015 return ret;
1016}
1017
dffd30ee
THJA		 1018struct intel_version {
1019 u8 status;
1020 u8 hw_platform;
1021 u8 hw_variant;
1022 u8 hw_revision;
1023 u8 fw_variant;
1024 u8 fw_revision;
1025 u8 fw_build_num;
1026 u8 fw_build_ww;
1027 u8 fw_build_yy;
1028 u8 fw_patch_num;
1029} __packed;
1030
1031static const struct firmware *btusb_setup_intel_get_fw(struct hci_dev *hdev,
1032 struct intel_version *ver)
1033{
1034 const struct firmware *fw;
1035 char fwname[64];
1036 int ret;
1037
1038 snprintf(fwname, sizeof(fwname),
1039 "intel/ibt-hw-%x.%x.%x-fw-%x.%x.%x.%x.%x.bseq",
1040 ver->hw_platform, ver->hw_variant, ver->hw_revision,
1041 ver->fw_variant, ver->fw_revision, ver->fw_build_num,
1042 ver->fw_build_ww, ver->fw_build_yy);
1043
1044 ret = request_firmware(&fw, fwname, &hdev->dev);
1045 if (ret < 0) {
1046 if (ret == -EINVAL) {
1047 BT_ERR("%s Intel firmware file request failed (%d)",
1048 hdev->name, ret);
1049 return NULL;
1050 }
1051
1052 BT_ERR("%s failed to open Intel firmware file: %s(%d)",
1053 hdev->name, fwname, ret);
1054
1055 /* If the correct firmware patch file is not found, use the
1056 * default firmware patch file instead
1057 */
1058 snprintf(fwname, sizeof(fwname), "intel/ibt-hw-%x.%x.bseq",
1059 ver->hw_platform, ver->hw_variant);
1060 if (request_firmware(&fw, fwname, &hdev->dev) < 0) {
1061 BT_ERR("%s failed to open default Intel fw file: %s",
1062 hdev->name, fwname);
1063 return NULL;
1064 }
1065 }
1066
1067 BT_INFO("%s: Intel Bluetooth firmware file: %s", hdev->name, fwname);
1068
1069 return fw;
1070}
1071
1072static int btusb_setup_intel_patching(struct hci_dev *hdev,
1073 const struct firmware *fw,
1074 const u8 **fw_ptr, int *disable_patch)
1075{
1076 struct sk_buff *skb;
1077 struct hci_command_hdr *cmd;
1078 const u8 *cmd_param;
1079 struct hci_event_hdr *evt = NULL;
1080 const u8 *evt_param = NULL;
1081 int remain = fw->size - (*fw_ptr - fw->data);
1082
1083 /* The first byte indicates the types of the patch command or event.
1084 * 0x01 means HCI command and 0x02 is HCI event. If the first bytes
1085 * in the current firmware buffer doesn't start with 0x01 or
1086 * the size of remain buffer is smaller than HCI command header,
1087 * the firmware file is corrupted and it should stop the patching
1088 * process.
1089 */
1090 if (remain > HCI_COMMAND_HDR_SIZE && *fw_ptr[0] != 0x01) {
1091 BT_ERR("%s Intel fw corrupted: invalid cmd read", hdev->name);
1092 return -EINVAL;
1093 }
1094 (*fw_ptr)++;
1095 remain--;
1096
1097 cmd = (struct hci_command_hdr *)(*fw_ptr);
1098 *fw_ptr += sizeof(*cmd);
1099 remain -= sizeof(*cmd);
1100
1101 /* Ensure that the remain firmware data is long enough than the length
1102 * of command parameter. If not, the firmware file is corrupted.
1103 */
1104 if (remain < cmd->plen) {
1105 BT_ERR("%s Intel fw corrupted: invalid cmd len", hdev->name);
1106 return -EFAULT;
1107 }
1108
1109 /* If there is a command that loads a patch in the firmware
1110 * file, then enable the patch upon success, otherwise just
1111 * disable the manufacturer mode, for example patch activation
1112 * is not required when the default firmware patch file is used
1113 * because there are no patch data to load.
1114 */
1115 if (*disable_patch && le16_to_cpu(cmd->opcode) == 0xfc8e)
1116 *disable_patch = 0;
1117
1118 cmd_param = *fw_ptr;
1119 *fw_ptr += cmd->plen;
1120 remain -= cmd->plen;
1121
1122 /* This reads the expected events when the above command is sent to the
1123 * device. Some vendor commands expects more than one events, for
1124 * example command status event followed by vendor specific event.
1125 * For this case, it only keeps the last expected event. so the command
1126 * can be sent with __hci_cmd_sync_ev() which returns the sk_buff of
1127 * last expected event.
1128 */
1129 while (remain > HCI_EVENT_HDR_SIZE && *fw_ptr[0] == 0x02) {
1130 (*fw_ptr)++;
1131 remain--;
1132
1133 evt = (struct hci_event_hdr *)(*fw_ptr);
1134 *fw_ptr += sizeof(*evt);
1135 remain -= sizeof(*evt);
1136
1137 if (remain < evt->plen) {
1138 BT_ERR("%s Intel fw corrupted: invalid evt len",
1139 hdev->name);
1140 return -EFAULT;
1141 }
1142
1143 evt_param = *fw_ptr;
1144 *fw_ptr += evt->plen;
1145 remain -= evt->plen;
1146 }
1147
1148 /* Every HCI commands in the firmware file has its correspond event.
1149 * If event is not found or remain is smaller than zero, the firmware
1150 * file is corrupted.
1151 */
1152 if (!evt || !evt_param || remain < 0) {
1153 BT_ERR("%s Intel fw corrupted: invalid evt read", hdev->name);
1154 return -EFAULT;
1155 }
1156
1157 skb = __hci_cmd_sync_ev(hdev, le16_to_cpu(cmd->opcode), cmd->plen,
1158 cmd_param, evt->evt, HCI_INIT_TIMEOUT);
1159 if (IS_ERR(skb)) {
1160 BT_ERR("%s sending Intel patch command (0x%4.4x) failed (%ld)",
1161 hdev->name, cmd->opcode, PTR_ERR(skb));
d9c78e97 1162 return PTR_ERR(skb);
dffd30ee
THJA		 1163 }
1164
1165 /* It ensures that the returned event matches the event data read from
1166 * the firmware file. At fist, it checks the length and then
1167 * the contents of the event.
1168 */
1169 if (skb->len != evt->plen) {
1170 BT_ERR("%s mismatch event length (opcode 0x%4.4x)", hdev->name,
1171 le16_to_cpu(cmd->opcode));
1172 kfree_skb(skb);
1173 return -EFAULT;
1174 }
1175
1176 if (memcmp(skb->data, evt_param, evt->plen)) {
1177 BT_ERR("%s mismatch event parameter (opcode 0x%4.4x)",
1178 hdev->name, le16_to_cpu(cmd->opcode));
1179 kfree_skb(skb);
1180 return -EFAULT;
1181 }
1182 kfree_skb(skb);
1183
1184 return 0;
1185}
1186
40cb0984
MH		 1187#define BDADDR_INTEL (&(bdaddr_t) {{0x00, 0x8b, 0x9e, 0x19, 0x03, 0x00}})
1188
1189static int btusb_check_bdaddr_intel(struct hci_dev *hdev)
1190{
1191 struct sk_buff *skb;
1192 struct hci_rp_read_bd_addr *rp;
1193
1194 skb = __hci_cmd_sync(hdev, HCI_OP_READ_BD_ADDR, 0, NULL,
1195 HCI_INIT_TIMEOUT);
1196 if (IS_ERR(skb)) {
1197 BT_ERR("%s reading Intel device address failed (%ld)",
1198 hdev->name, PTR_ERR(skb));
1199 return PTR_ERR(skb);
1200 }
1201
1202 if (skb->len != sizeof(*rp)) {
1203 BT_ERR("%s Intel device address length mismatch", hdev->name);
1204 kfree_skb(skb);
1205 return -EIO;
1206 }
1207
1208 rp = (struct hci_rp_read_bd_addr *) skb->data;
1209 if (rp->status) {
1210 BT_ERR("%s Intel device address result failed (%02x)",
1211 hdev->name, rp->status);
1212 kfree_skb(skb);
1213 return -bt_to_errno(rp->status);
1214 }
1215
1216 /* For some Intel based controllers, the default Bluetooth device
1217 * address 00:03:19:9E:8B:00 can be found. These controllers are
1218 * fully operational, but have the danger of duplicate addresses
1219 * and that in turn can cause problems with Bluetooth operation.
1220 */
4739b5b1 1221 if (!bacmp(&rp->bdaddr, BDADDR_INTEL)) {
40cb0984
MH		 1222 BT_ERR("%s found Intel default device address (%pMR)",
1223 hdev->name, &rp->bdaddr);
4739b5b1
MH		 1224 set_bit(HCI_QUIRK_INVALID_BDADDR, &hdev->quirks);
1225 }
40cb0984
MH		 1226
1227 kfree_skb(skb);
1228
1229 return 0;
1230}
1231
dffd30ee
THJA		 1232static int btusb_setup_intel(struct hci_dev *hdev)
1233{
1234 struct sk_buff *skb;
1235 const struct firmware *fw;
1236 const u8 *fw_ptr;
1237 int disable_patch;
1238 struct intel_version *ver;
1239
1240 const u8 mfg_enable[] = { 0x01, 0x00 };
1241 const u8 mfg_disable[] = { 0x00, 0x00 };
1242 const u8 mfg_reset_deactivate[] = { 0x00, 0x01 };
1243 const u8 mfg_reset_activate[] = { 0x00, 0x02 };
1244
1245 BT_DBG("%s", hdev->name);
1246
1247 /* The controller has a bug with the first HCI command sent to it
1248 * returning number of completed commands as zero. This would stall the
1249 * command processing in the Bluetooth core.
1250 *
1251 * As a workaround, send HCI Reset command first which will reset the
1252 * number of completed commands and allow normal command processing
1253 * from now on.
1254 */
1255 skb = __hci_cmd_sync(hdev, HCI_OP_RESET, 0, NULL, HCI_INIT_TIMEOUT);
1256 if (IS_ERR(skb)) {
1257 BT_ERR("%s sending initial HCI reset command failed (%ld)",
1258 hdev->name, PTR_ERR(skb));
d9c78e97 1259 return PTR_ERR(skb);
dffd30ee
THJA		 1260 }
1261 kfree_skb(skb);
1262
1263 /* Read Intel specific controller version first to allow selection of
1264 * which firmware file to load.
1265 *
1266 * The returned information are hardware variant and revision plus
1267 * firmware variant, revision and build number.
1268 */
1269 skb = __hci_cmd_sync(hdev, 0xfc05, 0, NULL, HCI_INIT_TIMEOUT);
1270 if (IS_ERR(skb)) {
1271 BT_ERR("%s reading Intel fw version command failed (%ld)",
1272 hdev->name, PTR_ERR(skb));
d9c78e97 1273 return PTR_ERR(skb);
dffd30ee
THJA		 1274 }
1275
1276 if (skb->len != sizeof(*ver)) {
1277 BT_ERR("%s Intel version event length mismatch", hdev->name);
1278 kfree_skb(skb);
1279 return -EIO;
1280 }
1281
1282 ver = (struct intel_version *)skb->data;
1283 if (ver->status) {
1284 BT_ERR("%s Intel fw version event failed (%02x)", hdev->name,
1285 ver->status);
1286 kfree_skb(skb);
1287 return -bt_to_errno(ver->status);
1288 }
1289
1290 BT_INFO("%s: read Intel version: %02x%02x%02x%02x%02x%02x%02x%02x%02x",
1291 hdev->name, ver->hw_platform, ver->hw_variant,
1292 ver->hw_revision, ver->fw_variant, ver->fw_revision,
1293 ver->fw_build_num, ver->fw_build_ww, ver->fw_build_yy,
1294 ver->fw_patch_num);
1295
1296 /* fw_patch_num indicates the version of patch the device currently
1297 * have. If there is no patch data in the device, it is always 0x00.
1298 * So, if it is other than 0x00, no need to patch the deivce again.
1299 */
1300 if (ver->fw_patch_num) {
1301 BT_INFO("%s: Intel device is already patched. patch num: %02x",
1302 hdev->name, ver->fw_patch_num);
1303 kfree_skb(skb);
40cb0984 1304 btusb_check_bdaddr_intel(hdev);
dffd30ee
THJA		 1305 return 0;
1306 }
1307
1308 /* Opens the firmware patch file based on the firmware version read
1309 * from the controller. If it fails to open the matching firmware
1310 * patch file, it tries to open the default firmware patch file.
1311 * If no patch file is found, allow the device to operate without
1312 * a patch.
1313 */
1314 fw = btusb_setup_intel_get_fw(hdev, ver);
1315 if (!fw) {
1316 kfree_skb(skb);
40cb0984 1317 btusb_check_bdaddr_intel(hdev);
dffd30ee
THJA		 1318 return 0;
1319 }
1320 fw_ptr = fw->data;
1321
1322 /* This Intel specific command enables the manufacturer mode of the
1323 * controller.
1324 *
1325 * Only while this mode is enabled, the driver can download the
1326 * firmware patch data and configuration parameters.
1327 */
1328 skb = __hci_cmd_sync(hdev, 0xfc11, 2, mfg_enable, HCI_INIT_TIMEOUT);
1329 if (IS_ERR(skb)) {
1330 BT_ERR("%s entering Intel manufacturer mode failed (%ld)",
1331 hdev->name, PTR_ERR(skb));
1332 release_firmware(fw);
d9c78e97 1333 return PTR_ERR(skb);
dffd30ee
THJA		 1334 }
1335
1336 if (skb->data[0]) {
1337 u8 evt_status = skb->data[0];
1338 BT_ERR("%s enable Intel manufacturer mode event failed (%02x)",
1339 hdev->name, evt_status);
1340 kfree_skb(skb);
1341 release_firmware(fw);
1342 return -bt_to_errno(evt_status);
1343 }
1344 kfree_skb(skb);
1345
1346 disable_patch = 1;
1347
1348 /* The firmware data file consists of list of Intel specific HCI
1349 * commands and its expected events. The first byte indicates the
1350 * type of the message, either HCI command or HCI event.
1351 *
1352 * It reads the command and its expected event from the firmware file,
1353 * and send to the controller. Once __hci_cmd_sync_ev() returns,
1354 * the returned event is compared with the event read from the firmware
1355 * file and it will continue until all the messages are downloaded to
1356 * the controller.
1357 *
1358 * Once the firmware patching is completed successfully,
1359 * the manufacturer mode is disabled with reset and activating the
1360 * downloaded patch.
1361 *
1362 * If the firmware patching fails, the manufacturer mode is
1363 * disabled with reset and deactivating the patch.
1364 *
1365 * If the default patch file is used, no reset is done when disabling
1366 * the manufacturer.
1367 */
1368 while (fw->size > fw_ptr - fw->data) {
1369 int ret;
1370
1371 ret = btusb_setup_intel_patching(hdev, fw, &fw_ptr,
1372 &disable_patch);
1373 if (ret < 0)
1374 goto exit_mfg_deactivate;
1375 }
1376
1377 release_firmware(fw);
1378
1379 if (disable_patch)
1380 goto exit_mfg_disable;
1381
1382 /* Patching completed successfully and disable the manufacturer mode
1383 * with reset and activate the downloaded firmware patches.
1384 */
1385 skb = __hci_cmd_sync(hdev, 0xfc11, sizeof(mfg_reset_activate),
1386 mfg_reset_activate, HCI_INIT_TIMEOUT);
1387 if (IS_ERR(skb)) {
1388 BT_ERR("%s exiting Intel manufacturer mode failed (%ld)",
1389 hdev->name, PTR_ERR(skb));
d9c78e97 1390 return PTR_ERR(skb);
dffd30ee
THJA		 1391 }
1392 kfree_skb(skb);
1393
1394 BT_INFO("%s: Intel Bluetooth firmware patch completed and activated",
1395 hdev->name);
1396
40cb0984 1397 btusb_check_bdaddr_intel(hdev);
dffd30ee
THJA		 1398 return 0;
1399
1400exit_mfg_disable:
1401 /* Disable the manufacturer mode without reset */
1402 skb = __hci_cmd_sync(hdev, 0xfc11, sizeof(mfg_disable), mfg_disable,
1403 HCI_INIT_TIMEOUT);
1404 if (IS_ERR(skb)) {
1405 BT_ERR("%s exiting Intel manufacturer mode failed (%ld)",
1406 hdev->name, PTR_ERR(skb));
d9c78e97 1407 return PTR_ERR(skb);
dffd30ee
THJA		 1408 }
1409 kfree_skb(skb);
1410
1411 BT_INFO("%s: Intel Bluetooth firmware patch completed", hdev->name);
40cb0984
MH		 1412
1413 btusb_check_bdaddr_intel(hdev);
dffd30ee
THJA		 1414 return 0;
1415
1416exit_mfg_deactivate:
1417 release_firmware(fw);
1418
1419 /* Patching failed. Disable the manufacturer mode with reset and
1420 * deactivate the downloaded firmware patches.
1421 */
1422 skb = __hci_cmd_sync(hdev, 0xfc11, sizeof(mfg_reset_deactivate),
1423 mfg_reset_deactivate, HCI_INIT_TIMEOUT);
1424 if (IS_ERR(skb)) {
1425 BT_ERR("%s exiting Intel manufacturer mode failed (%ld)",
1426 hdev->name, PTR_ERR(skb));
d9c78e97 1427 return PTR_ERR(skb);
dffd30ee
THJA		 1428 }
1429 kfree_skb(skb);
1430
1431 BT_INFO("%s: Intel Bluetooth firmware patch completed and deactivated",
1432 hdev->name);
1433
40cb0984 1434 btusb_check_bdaddr_intel(hdev);
dffd30ee
THJA		 1435 return 0;
1436}
1437
cb8d6597
MH		 1438static int btusb_set_bdaddr_intel(struct hci_dev *hdev, const bdaddr_t *bdaddr)
1439{
1440 struct sk_buff *skb;
1441 long ret;
1442
1443 skb = __hci_cmd_sync(hdev, 0xfc31, 6, bdaddr, HCI_INIT_TIMEOUT);
1444 if (IS_ERR(skb)) {
1445 ret = PTR_ERR(skb);
1446 BT_ERR("%s: changing Intel device address failed (%ld)",
1447 hdev->name, ret);
1448 return ret;
1449 }
1450 kfree_skb(skb);
1451
1452 return 0;
1453}
1454
c8abb73f
MH		 1455#define BDADDR_BCM20702A0 (&(bdaddr_t) {{0x00, 0xa0, 0x02, 0x70, 0x20, 0x00}})
1456
10d4c673
PG		 1457static int btusb_setup_bcm_patchram(struct hci_dev *hdev)
1458{
1459 struct btusb_data *data = hci_get_drvdata(hdev);
1460 struct usb_device *udev = data->udev;
1461 char fw_name[64];
1462 const struct firmware *fw;
1463 const u8 *fw_ptr;
1464 size_t fw_size;
1465 const struct hci_command_hdr *cmd;
1466 const u8 *cmd_param;
1467 u16 opcode;
1468 struct sk_buff *skb;
1469 struct hci_rp_read_local_version *ver;
c8abb73f 1470 struct hci_rp_read_bd_addr *bda;
10d4c673
PG		 1471 long ret;
1472
1473 snprintf(fw_name, sizeof(fw_name), "brcm/%s-%04x-%04x.hcd",
1474 udev->product ? udev->product : "BCM",
1475 le16_to_cpu(udev->descriptor.idVendor),
1476 le16_to_cpu(udev->descriptor.idProduct));
1477
1478 ret = request_firmware(&fw, fw_name, &hdev->dev);
1479 if (ret < 0) {
c8abb73f 1480 BT_INFO("%s: BCM: patch %s not found", hdev->name, fw_name);
10d4c673
PG		 1481 return 0;
1482 }
1483
1484 /* Reset */
1485 skb = __hci_cmd_sync(hdev, HCI_OP_RESET, 0, NULL, HCI_INIT_TIMEOUT);
1486 if (IS_ERR(skb)) {
1487 ret = PTR_ERR(skb);
1488 BT_ERR("%s: HCI_OP_RESET failed (%ld)", hdev->name, ret);
1489 goto done;
1490 }
1491 kfree_skb(skb);
1492
1493 /* Read Local Version Info */
1494 skb = __hci_cmd_sync(hdev, HCI_OP_READ_LOCAL_VERSION, 0, NULL,
1495 HCI_INIT_TIMEOUT);
1496 if (IS_ERR(skb)) {
1497 ret = PTR_ERR(skb);
1498 BT_ERR("%s: HCI_OP_READ_LOCAL_VERSION failed (%ld)",
1499 hdev->name, ret);
1500 goto done;
1501 }
1502
1503 if (skb->len != sizeof(*ver)) {
1504 BT_ERR("%s: HCI_OP_READ_LOCAL_VERSION event length mismatch",
1505 hdev->name);
1506 kfree_skb(skb);
1507 ret = -EIO;
1508 goto done;
1509 }
1510
1511 ver = (struct hci_rp_read_local_version *) skb->data;
1512 BT_INFO("%s: BCM: patching hci_ver=%02x hci_rev=%04x lmp_ver=%02x "
1513 "lmp_subver=%04x", hdev->name, ver->hci_ver, ver->hci_rev,
1514 ver->lmp_ver, ver->lmp_subver);
1515 kfree_skb(skb);
1516
1517 /* Start Download */
1518 skb = __hci_cmd_sync(hdev, 0xfc2e, 0, NULL, HCI_INIT_TIMEOUT);
1519 if (IS_ERR(skb)) {
1520 ret = PTR_ERR(skb);
1521 BT_ERR("%s: BCM: Download Minidrv command failed (%ld)",
1522 hdev->name, ret);
1523 goto reset_fw;
1524 }
1525 kfree_skb(skb);
1526
1527 /* 50 msec delay after Download Minidrv completes */
1528 msleep(50);
1529
1530 fw_ptr = fw->data;
1531 fw_size = fw->size;
1532
1533 while (fw_size >= sizeof(*cmd)) {
1534 cmd = (struct hci_command_hdr *) fw_ptr;
1535 fw_ptr += sizeof(*cmd);
1536 fw_size -= sizeof(*cmd);
1537
1538 if (fw_size < cmd->plen) {
1539 BT_ERR("%s: BCM: patch %s is corrupted",
1540 hdev->name, fw_name);
1541 ret = -EINVAL;
1542 goto reset_fw;
1543 }
1544
1545 cmd_param = fw_ptr;
1546 fw_ptr += cmd->plen;
1547 fw_size -= cmd->plen;
1548
1549 opcode = le16_to_cpu(cmd->opcode);
1550
1551 skb = __hci_cmd_sync(hdev, opcode, cmd->plen, cmd_param,
1552 HCI_INIT_TIMEOUT);
1553 if (IS_ERR(skb)) {
1554 ret = PTR_ERR(skb);
1555 BT_ERR("%s: BCM: patch command %04x failed (%ld)",
1556 hdev->name, opcode, ret);
1557 goto reset_fw;
1558 }
1559 kfree_skb(skb);
1560 }
1561
1562 /* 250 msec delay after Launch Ram completes */
1563 msleep(250);
1564
1565reset_fw:
1566 /* Reset */
1567 skb = __hci_cmd_sync(hdev, HCI_OP_RESET, 0, NULL, HCI_INIT_TIMEOUT);
1568 if (IS_ERR(skb)) {
1569 ret = PTR_ERR(skb);
1570 BT_ERR("%s: HCI_OP_RESET failed (%ld)", hdev->name, ret);
1571 goto done;
1572 }
1573 kfree_skb(skb);
1574
1575 /* Read Local Version Info */
1576 skb = __hci_cmd_sync(hdev, HCI_OP_READ_LOCAL_VERSION, 0, NULL,
1577 HCI_INIT_TIMEOUT);
1578 if (IS_ERR(skb)) {
1579 ret = PTR_ERR(skb);
1580 BT_ERR("%s: HCI_OP_READ_LOCAL_VERSION failed (%ld)",
1581 hdev->name, ret);
1582 goto done;
1583 }
1584
1585 if (skb->len != sizeof(*ver)) {
1586 BT_ERR("%s: HCI_OP_READ_LOCAL_VERSION event length mismatch",
1587 hdev->name);
1588 kfree_skb(skb);
1589 ret = -EIO;
1590 goto done;
1591 }
1592
1593 ver = (struct hci_rp_read_local_version *) skb->data;
1594 BT_INFO("%s: BCM: firmware hci_ver=%02x hci_rev=%04x lmp_ver=%02x "
1595 "lmp_subver=%04x", hdev->name, ver->hci_ver, ver->hci_rev,
1596 ver->lmp_ver, ver->lmp_subver);
1597 kfree_skb(skb);
1598
c8abb73f
MH		 1599 /* Read BD Address */
1600 skb = __hci_cmd_sync(hdev, HCI_OP_READ_BD_ADDR, 0, NULL,
1601 HCI_INIT_TIMEOUT);
1602 if (IS_ERR(skb)) {
1603 ret = PTR_ERR(skb);
1604 BT_ERR("%s: HCI_OP_READ_BD_ADDR failed (%ld)",
1605 hdev->name, ret);
1606 goto done;
1607 }
1608
1609 if (skb->len != sizeof(*bda)) {
1610 BT_ERR("%s: HCI_OP_READ_BD_ADDR event length mismatch",
1611 hdev->name);
1612 kfree_skb(skb);
1613 ret = -EIO;
1614 goto done;
1615 }
1616
1617 bda = (struct hci_rp_read_bd_addr *) skb->data;
1618 if (bda->status) {
1619 BT_ERR("%s: HCI_OP_READ_BD_ADDR error status (%02x)",
1620 hdev->name, bda->status);
1621 kfree_skb(skb);
1622 ret = -bt_to_errno(bda->status);
1623 goto done;
1624 }
1625
1626 /* The address 00:20:70:02:A0:00 indicates a BCM20702A0 controller
1627 * with no configured address.
1628 */
849e5086 1629 if (!bacmp(&bda->bdaddr, BDADDR_BCM20702A0)) {
c8abb73f
MH		 1630 BT_INFO("%s: BCM: using default device address (%pMR)",
1631 hdev->name, &bda->bdaddr);
849e5086
MH		 1632 set_bit(HCI_QUIRK_INVALID_BDADDR, &hdev->quirks);
1633 }
c8abb73f
MH		 1634
1635 kfree_skb(skb);
1636
10d4c673
PG		 1637done:
1638 release_firmware(fw);
1639
1640 return ret;
1641}
1642
abbaf50e
MH		 1643static int btusb_set_bdaddr_bcm(struct hci_dev *hdev, const bdaddr_t *bdaddr)
1644{
1645 struct sk_buff *skb;
1646 long ret;
1647
1648 skb = __hci_cmd_sync(hdev, 0xfc01, 6, bdaddr, HCI_INIT_TIMEOUT);
1649 if (IS_ERR(skb)) {
1650 ret = PTR_ERR(skb);
1651 BT_ERR("%s: BCM: Change address command failed (%ld)",
1652 hdev->name, ret);
1653 return ret;
1654 }
1655 kfree_skb(skb);
1656
1657 return 0;
1658}
1659
5e23b923
MH		 1660static int btusb_probe(struct usb_interface *intf,
1661 const struct usb_device_id *id)
1662{
1663 struct usb_endpoint_descriptor *ep_desc;
1664 struct btusb_data *data;
1665 struct hci_dev *hdev;
1666 int i, err;
1667
1668 BT_DBG("intf %p id %p", intf, id);
1669
cfeb4145 1670 /* interface numbers are hardcoded in the spec */
5e23b923
MH		 1671 if (intf->cur_altsetting->desc.bInterfaceNumber != 0)
1672 return -ENODEV;
1673
1674 if (!id->driver_info) {
1675 const struct usb_device_id *match;
1676 match = usb_match_id(intf, blacklist_table);
1677 if (match)
1678 id = match;
1679 }
1680
cfeb4145
MH		 1681 if (id->driver_info == BTUSB_IGNORE)
1682 return -ENODEV;
1683
2d25f8b4
SL		 1684 if (id->driver_info & BTUSB_ATH3012) {
1685 struct usb_device *udev = interface_to_usbdev(intf);
1686
1687 /* Old firmware would otherwise let ath3k driver load
1688 * patch and sysconfig files */
1689 if (le16_to_cpu(udev->descriptor.bcdDevice) <= 0x0001)
1690 return -ENODEV;
1691 }
1692
98921dbd 1693 data = devm_kzalloc(&intf->dev, sizeof(*data), GFP_KERNEL);
5e23b923
MH		 1694 if (!data)
1695 return -ENOMEM;
1696
1697 for (i = 0; i < intf->cur_altsetting->desc.bNumEndpoints; i++) {
1698 ep_desc = &intf->cur_altsetting->endpoint[i].desc;
1699
1700 if (!data->intr_ep && usb_endpoint_is_int_in(ep_desc)) {
1701 data->intr_ep = ep_desc;
1702 continue;
1703 }
1704
1705 if (!data->bulk_tx_ep && usb_endpoint_is_bulk_out(ep_desc)) {
1706 data->bulk_tx_ep = ep_desc;
1707 continue;
1708 }
1709
1710 if (!data->bulk_rx_ep && usb_endpoint_is_bulk_in(ep_desc)) {
1711 data->bulk_rx_ep = ep_desc;
1712 continue;
1713 }
1714 }
1715
98921dbd 1716 if (!data->intr_ep || !data->bulk_tx_ep || !data->bulk_rx_ep)
5e23b923 1717 return -ENODEV;
5e23b923 1718
7a9d4020
MH		 1719 data->cmdreq_type = USB_TYPE_CLASS;
1720
5e23b923 1721 data->udev = interface_to_usbdev(intf);
5fbcd260 1722 data->intf = intf;
5e23b923
MH		 1723
1724 spin_lock_init(&data->lock);
1725
1726 INIT_WORK(&data->work, btusb_work);
7bee549e
ON		 1727 INIT_WORK(&data->waker, btusb_waker);
1728 spin_lock_init(&data->txlock);
5e23b923
MH		 1729
1730 init_usb_anchor(&data->tx_anchor);
1731 init_usb_anchor(&data->intr_anchor);
1732 init_usb_anchor(&data->bulk_anchor);
9bfa35fe 1733 init_usb_anchor(&data->isoc_anchor);
7bee549e 1734 init_usb_anchor(&data->deferred);
5e23b923
MH		 1735
1736 hdev = hci_alloc_dev();
98921dbd 1737 if (!hdev)
5e23b923 1738 return -ENOMEM;
5e23b923 1739
c13854ce 1740 hdev->bus = HCI_USB;
155961e8 1741 hci_set_drvdata(hdev, data);
5e23b923
MH		 1742
1743 data->hdev = hdev;
1744
1745 SET_HCIDEV_DEV(hdev, &intf->dev);
1746
9f8f962c
MH		 1747 hdev->open = btusb_open;
1748 hdev->close = btusb_close;
1749 hdev->flush = btusb_flush;
1750 hdev->send = btusb_send_frame;
1751 hdev->notify = btusb_notify;
1752
1753 if (id->driver_info & BTUSB_BCM92035)
1754 hdev->setup = btusb_setup_bcm92035;
5e23b923 1755
abbaf50e 1756 if (id->driver_info & BTUSB_BCM_PATCHRAM) {
10d4c673 1757 hdev->setup = btusb_setup_bcm_patchram;
abbaf50e
MH		 1758 hdev->set_bdaddr = btusb_set_bdaddr_bcm;
1759 }
10d4c673 1760
cb8d6597 1761 if (id->driver_info & BTUSB_INTEL) {
dffd30ee 1762 hdev->setup = btusb_setup_intel;
cb8d6597
MH		 1763 hdev->set_bdaddr = btusb_set_bdaddr_intel;
1764 }
dffd30ee 1765
40df783d
MH		 1766 if (id->driver_info & BTUSB_INTEL_BOOT)
1767 set_bit(HCI_QUIRK_RAW_DEVICE, &hdev->quirks);
1768
7a9d4020 1769 /* Interface numbers are hardcoded in the specification */
9bfa35fe
MH		 1770 data->isoc = usb_ifnum_to_if(data->udev, 1);
1771
7a9d4020 1772 if (!reset)
a6c511c6 1773 set_bit(HCI_QUIRK_RESET_ON_CLOSE, &hdev->quirks);
cfeb4145
MH		 1774
1775 if (force_scofix || id->driver_info & BTUSB_WRONG_SCO_MTU) {
1776 if (!disable_scofix)
1777 set_bit(HCI_QUIRK_FIXUP_BUFFER_SIZE, &hdev->quirks);
1778 }
1779
9bfa35fe
MH		 1780 if (id->driver_info & BTUSB_BROKEN_ISOC)
1781 data->isoc = NULL;
1782
7a9d4020
MH		 1783 if (id->driver_info & BTUSB_DIGIANSWER) {
1784 data->cmdreq_type = USB_TYPE_VENDOR;
a6c511c6 1785 set_bit(HCI_QUIRK_RESET_ON_CLOSE, &hdev->quirks);
7a9d4020
MH		 1786 }
1787
1788 if (id->driver_info & BTUSB_CSR) {
1789 struct usb_device *udev = data->udev;
81cac64b 1790 u16 bcdDevice = le16_to_cpu(udev->descriptor.bcdDevice);
7a9d4020
MH		 1791
1792 /* Old firmware would otherwise execute USB reset */
81cac64b 1793 if (bcdDevice < 0x117)
a6c511c6 1794 set_bit(HCI_QUIRK_RESET_ON_CLOSE, &hdev->quirks);
81cac64b
MH		 1795
1796 /* Fake CSR devices with broken commands */
1797 if (bcdDevice <= 0x100)
1798 hdev->setup = btusb_setup_csr;
7a9d4020
MH		 1799 }
1800
cfeb4145 1801 if (id->driver_info & BTUSB_SNIFFER) {
9bfa35fe 1802 struct usb_device *udev = data->udev;
cfeb4145 1803
7a9d4020 1804 /* New sniffer firmware has crippled HCI interface */
cfeb4145
MH		 1805 if (le16_to_cpu(udev->descriptor.bcdDevice) > 0x997)
1806 set_bit(HCI_QUIRK_RAW_DEVICE, &hdev->quirks);
9bfa35fe
MH		 1807
1808 data->isoc = NULL;
cfeb4145
MH		 1809 }
1810
3a5ef20c
MH		 1811 if (id->driver_info & BTUSB_INTEL_BOOT) {
1812 /* A bug in the bootloader causes that interrupt interface is
1813 * only enabled after receiving SetInterface(0, AltSetting=0).
1814 */
1815 err = usb_set_interface(data->udev, 0, 0);
1816 if (err < 0) {
1817 BT_ERR("failed to set interface 0, alt 0 %d", err);
1818 hci_free_dev(hdev);
1819 return err;
1820 }
1821 }
1822
9bfa35fe
MH		 1823 if (data->isoc) {
1824 err = usb_driver_claim_interface(&btusb_driver,
5fbcd260 1825 data->isoc, data);
9bfa35fe
MH		 1826 if (err < 0) {
1827 hci_free_dev(hdev);
9bfa35fe
MH		 1828 return err;
1829 }
1830 }
1831
5e23b923
MH		 1832 err = hci_register_dev(hdev);
1833 if (err < 0) {
1834 hci_free_dev(hdev);
5e23b923
MH		 1835 return err;
1836 }
1837
1838 usb_set_intfdata(intf, data);
1839
1840 return 0;
1841}
1842
1843static void btusb_disconnect(struct usb_interface *intf)
1844{
1845 struct btusb_data *data = usb_get_intfdata(intf);
1846 struct hci_dev *hdev;
1847
1848 BT_DBG("intf %p", intf);
1849
1850 if (!data)
1851 return;
1852
1853 hdev = data->hdev;
5fbcd260
MH		 1854 usb_set_intfdata(data->intf, NULL);
1855
1856 if (data->isoc)
1857 usb_set_intfdata(data->isoc, NULL);
5e23b923
MH		 1858
1859 hci_unregister_dev(hdev);
1860
5fbcd260
MH		 1861 if (intf == data->isoc)
1862 usb_driver_release_interface(&btusb_driver, data->intf);
1863 else if (data->isoc)
1864 usb_driver_release_interface(&btusb_driver, data->isoc);
1865
5e23b923
MH		 1866 hci_free_dev(hdev);
1867}
1868
7bee549e 1869#ifdef CONFIG_PM
6a88adf2
MH		 1870static int btusb_suspend(struct usb_interface *intf, pm_message_t message)
1871{
1872 struct btusb_data *data = usb_get_intfdata(intf);
1873
1874 BT_DBG("intf %p", intf);
1875
1876 if (data->suspend_count++)
1877 return 0;
1878
7bee549e 1879 spin_lock_irq(&data->txlock);
5b1b0b81 1880 if (!(PMSG_IS_AUTO(message) && data->tx_in_flight)) {
7bee549e
ON		 1881 set_bit(BTUSB_SUSPENDING, &data->flags);
1882 spin_unlock_irq(&data->txlock);
1883 } else {
1884 spin_unlock_irq(&data->txlock);
1885 data->suspend_count--;
1886 return -EBUSY;
1887 }
1888
6a88adf2
MH		 1889 cancel_work_sync(&data->work);
1890
7bee549e 1891 btusb_stop_traffic(data);
6a88adf2
MH		 1892 usb_kill_anchored_urbs(&data->tx_anchor);
1893
6a88adf2
MH		 1894 return 0;
1895}
1896
7bee549e
ON		 1897static void play_deferred(struct btusb_data *data)
1898{
1899 struct urb *urb;
1900 int err;
1901
1902 while ((urb = usb_get_from_anchor(&data->deferred))) {
1903 err = usb_submit_urb(urb, GFP_ATOMIC);
1904 if (err < 0)
1905 break;
1906
1907 data->tx_in_flight++;
1908 }
1909 usb_scuttle_anchored_urbs(&data->deferred);
1910}
1911
6a88adf2
MH		 1912static int btusb_resume(struct usb_interface *intf)
1913{
1914 struct btusb_data *data = usb_get_intfdata(intf);
1915 struct hci_dev *hdev = data->hdev;
7bee549e 1916 int err = 0;
6a88adf2
MH		 1917
1918 BT_DBG("intf %p", intf);
1919
1920 if (--data->suspend_count)
1921 return 0;
1922
1923 if (!test_bit(HCI_RUNNING, &hdev->flags))
7bee549e 1924 goto done;
6a88adf2
MH		 1925
1926 if (test_bit(BTUSB_INTR_RUNNING, &data->flags)) {
1927 err = btusb_submit_intr_urb(hdev, GFP_NOIO);
1928 if (err < 0) {
1929 clear_bit(BTUSB_INTR_RUNNING, &data->flags);
7bee549e 1930 goto failed;
6a88adf2
MH		 1931 }
1932 }
1933
1934 if (test_bit(BTUSB_BULK_RUNNING, &data->flags)) {
43c2e57f
MH		 1935 err = btusb_submit_bulk_urb(hdev, GFP_NOIO);
1936 if (err < 0) {
6a88adf2 1937 clear_bit(BTUSB_BULK_RUNNING, &data->flags);
7bee549e
ON		 1938 goto failed;
1939 }
1940
1941 btusb_submit_bulk_urb(hdev, GFP_NOIO);
6a88adf2
MH		 1942 }
1943
1944 if (test_bit(BTUSB_ISOC_RUNNING, &data->flags)) {
1945 if (btusb_submit_isoc_urb(hdev, GFP_NOIO) < 0)
1946 clear_bit(BTUSB_ISOC_RUNNING, &data->flags);
1947 else
1948 btusb_submit_isoc_urb(hdev, GFP_NOIO);
1949 }
1950
7bee549e
ON		 1951 spin_lock_irq(&data->txlock);
1952 play_deferred(data);
1953 clear_bit(BTUSB_SUSPENDING, &data->flags);
1954 spin_unlock_irq(&data->txlock);
1955 schedule_work(&data->work);
1956
6a88adf2 1957 return 0;
7bee549e
ON		 1958
1959failed:
1960 usb_scuttle_anchored_urbs(&data->deferred);
1961done:
1962 spin_lock_irq(&data->txlock);
1963 clear_bit(BTUSB_SUSPENDING, &data->flags);
1964 spin_unlock_irq(&data->txlock);
1965
1966 return err;
6a88adf2 1967}
7bee549e 1968#endif
6a88adf2 1969
5e23b923
MH		 1970static struct usb_driver btusb_driver = {
1971 .name = "btusb",
1972 .probe = btusb_probe,
1973 .disconnect = btusb_disconnect,
7bee549e 1974#ifdef CONFIG_PM
6a88adf2
MH		 1975 .suspend = btusb_suspend,
1976 .resume = btusb_resume,
7bee549e 1977#endif
5e23b923 1978 .id_table = btusb_table,
7bee549e 1979 .supports_autosuspend = 1,
e1f12eb6 1980 .disable_hub_initiated_lpm = 1,
5e23b923
MH		 1981};
1982
93f1508c 1983module_usb_driver(btusb_driver);
5e23b923 1984
cfeb4145
MH		 1985module_param(disable_scofix, bool, 0644);
1986MODULE_PARM_DESC(disable_scofix, "Disable fixup of wrong SCO buffer size");
1987
1988module_param(force_scofix, bool, 0644);
1989MODULE_PARM_DESC(force_scofix, "Force fixup of wrong SCO buffers size");
1990
1991module_param(reset, bool, 0644);
1992MODULE_PARM_DESC(reset, "Send HCI reset command on initialization");
1993
5e23b923
MH		 1994MODULE_AUTHOR("Marcel Holtmann <marcel@holtmann.org>");
1995MODULE_DESCRIPTION("Generic Bluetooth USB driver ver " VERSION);
1996MODULE_VERSION(VERSION);
1997MODULE_LICENSE("GPL");
Linux kernel - Deliverables
This page took 0.580498 seconds and 5 git commands to generate.