projects / deliverable / linux.git / blame
? search:
summary | shortlog | log | commit | commitdiff | tree
blob | blame (incremental) | history | HEAD
Bluetooth: btusb: Provide hardware error handler for Intel devices
[deliverable/linux.git] / drivers / bluetooth / btusb.c
CommitLineData
5e23b923
MH		 1/*
2 *
3 * Generic Bluetooth USB driver
4 *
9bfa35fe 5 * Copyright (C) 2005-2008 Marcel Holtmann <marcel@holtmann.org>
5e23b923
MH		 6 *
7 *
8 * This program is free software; you can redistribute it and/or modify
9 * it under the terms of the GNU General Public License as published by
10 * the Free Software Foundation; either version 2 of the License, or
11 * (at your option) any later version.
12 *
13 * This program is distributed in the hope that it will be useful,
14 * but WITHOUT ANY WARRANTY; without even the implied warranty of
15 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
16 * GNU General Public License for more details.
17 *
18 * You should have received a copy of the GNU General Public License
19 * along with this program; if not, write to the Free Software
20 * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
21 *
22 */
23
5e23b923 24#include <linux/module.h>
5e23b923 25#include <linux/usb.h>
dffd30ee 26#include <linux/firmware.h>
5e23b923
MH		 27
28#include <net/bluetooth/bluetooth.h>
29#include <net/bluetooth/hci_core.h>
30
cda0dd78 31#define VERSION "0.7"
cfeb4145 32
90ab5ee9
RR		 33static bool disable_scofix;
34static bool force_scofix;
7a9d4020 35
90ab5ee9 36static bool reset = 1;
cfeb4145
MH		 37
38static struct usb_driver btusb_driver;
39
40#define BTUSB_IGNORE 0x01
7a9d4020
MH		 41#define BTUSB_DIGIANSWER 0x02
42#define BTUSB_CSR 0x04
43#define BTUSB_SNIFFER 0x08
44#define BTUSB_BCM92035 0x10
45#define BTUSB_BROKEN_ISOC 0x20
46#define BTUSB_WRONG_SCO_MTU 0x40
2d25f8b4 47#define BTUSB_ATH3012 0x80
dffd30ee 48#define BTUSB_INTEL 0x100
40df783d
MH		 49#define BTUSB_INTEL_BOOT 0x200
50#define BTUSB_BCM_PATCHRAM 0x400
ae8df494 51#define BTUSB_MARVELL 0x800
4fcef8ed 52#define BTUSB_SWAVE 0x1000
cda0dd78 53#define BTUSB_INTEL_NEW 0x2000
5e23b923 54
54265202 55static const struct usb_device_id btusb_table[] = {
5e23b923
MH		 56 /* Generic Bluetooth USB device */
57 { USB_DEVICE_INFO(0xe0, 0x01, 0x01) },
58
1fa6535f
HR		 59 /* Apple-specific (Broadcom) devices */
60 { USB_VENDOR_AND_INTERFACE_INFO(0x05ac, 0xff, 0x01, 0x01) },
61
178c059e
CYC		 62 /* MediaTek MT76x0E */
63 { USB_DEVICE(0x0e8d, 0x763f) },
64
c510eae3 65 /* Broadcom SoftSailing reporting vendor specific */
2e8b5063 66 { USB_DEVICE(0x0a5c, 0x21e1) },
c510eae3 67
3cd01976
NI		 68 /* Apple MacBookPro 7,1 */
69 { USB_DEVICE(0x05ac, 0x8213) },
70
0a79f674
CL		 71 /* Apple iMac11,1 */
72 { USB_DEVICE(0x05ac, 0x8215) },
73
9c047157
NI		 74 /* Apple MacBookPro6,2 */
75 { USB_DEVICE(0x05ac, 0x8218) },
76
3e3ede7d
EH		 77 /* Apple MacBookAir3,1, MacBookAir3,2 */
78 { USB_DEVICE(0x05ac, 0x821b) },
79
a63b723d
PAVM		 80 /* Apple MacBookAir4,1 */
81 { USB_DEVICE(0x05ac, 0x821f) },
82
88d377b6
MAP		 83 /* Apple MacBookPro8,2 */
84 { USB_DEVICE(0x05ac, 0x821a) },
85
f78b6826
JK		 86 /* Apple MacMini5,1 */
87 { USB_DEVICE(0x05ac, 0x8281) },
88
cfeb4145 89 /* AVM BlueFRITZ! USB v2.0 */
4fcef8ed 90 { USB_DEVICE(0x057c, 0x3800), .driver_info = BTUSB_SWAVE },
cfeb4145
MH		 91
92 /* Bluetooth Ultraport Module from IBM */
93 { USB_DEVICE(0x04bf, 0x030a) },
94
95 /* ALPS Modules with non-standard id */
96 { USB_DEVICE(0x044e, 0x3001) },
97 { USB_DEVICE(0x044e, 0x3002) },
98
99 /* Ericsson with non-standard id */
100 { USB_DEVICE(0x0bdb, 0x1002) },
101
102 /* Canyon CN-BTU1 with HID interfaces */
7a9d4020 103 { USB_DEVICE(0x0c10, 0x0000) },
cfeb4145 104
d13431ca 105 /* Broadcom BCM20702A0 */
0b880062
AS		 106 { USB_DEVICE(0x0489, 0xe042) },
107 { USB_DEVICE(0x04ca, 0x2003) },
1ee3ff61 108 { USB_DEVICE(0x0b05, 0x17b5) },
38a172be 109 { USB_DEVICE(0x0b05, 0x17cb) },
d13431ca 110 { USB_DEVICE(0x413c, 0x8197) },
a86c02ea
F		 111 { USB_DEVICE(0x13d3, 0x3404),
112 .driver_info = BTUSB_BCM_PATCHRAM },
d13431ca 113
d049f4e5
MH		 114 /* Broadcom BCM20702B0 (Dynex/Insignia) */
115 { USB_DEVICE(0x19ff, 0x0239), .driver_info = BTUSB_BCM_PATCHRAM },
116
98514036 117 /* Foxconn - Hon Hai */
6029ddc2
HS		 118 { USB_VENDOR_AND_INTERFACE_INFO(0x0489, 0xff, 0x01, 0x01),
119 .driver_info = BTUSB_BCM_PATCHRAM },
98514036 120
0b880062 121 /* Broadcom devices with vendor specific id */
10d4c673
PG		 122 { USB_VENDOR_AND_INTERFACE_INFO(0x0a5c, 0xff, 0x01, 0x01),
123 .driver_info = BTUSB_BCM_PATCHRAM },
92c385f4 124
c2aef6e8 125 /* ASUSTek Computer - Broadcom based */
9a5abdaa
RD		 126 { USB_VENDOR_AND_INTERFACE_INFO(0x0b05, 0xff, 0x01, 0x01),
127 .driver_info = BTUSB_BCM_PATCHRAM },
c2aef6e8 128
5bcecf32
KB		 129 /* Belkin F8065bf - Broadcom based */
130 { USB_VENDOR_AND_INTERFACE_INFO(0x050d, 0xff, 0x01, 0x01) },
131
9113bfd8
JK		 132 /* IMC Networks - Broadcom based */
133 { USB_VENDOR_AND_INTERFACE_INFO(0x13d3, 0xff, 0x01, 0x01) },
134
40df783d 135 /* Intel Bluetooth USB Bootloader (RAM module) */
d92f2df0
MH		 136 { USB_DEVICE(0x8087, 0x0a5a),
137 .driver_info = BTUSB_INTEL_BOOT | BTUSB_BROKEN_ISOC },
40df783d 138
5e23b923
MH		 139 { } /* Terminating entry */
140};
141
142MODULE_DEVICE_TABLE(usb, btusb_table);
143
54265202 144static const struct usb_device_id blacklist_table[] = {
cfeb4145
MH		 145 /* CSR BlueCore devices */
146 { USB_DEVICE(0x0a12, 0x0001), .driver_info = BTUSB_CSR },
147
148 /* Broadcom BCM2033 without firmware */
149 { USB_DEVICE(0x0a5c, 0x2033), .driver_info = BTUSB_IGNORE },
150
be93112a 151 /* Atheros 3011 with sflash firmware */
0b880062
AS		 152 { USB_DEVICE(0x0489, 0xe027), .driver_info = BTUSB_IGNORE },
153 { USB_DEVICE(0x0489, 0xe03d), .driver_info = BTUSB_IGNORE },
154 { USB_DEVICE(0x0930, 0x0215), .driver_info = BTUSB_IGNORE },
be93112a 155 { USB_DEVICE(0x0cf3, 0x3002), .driver_info = BTUSB_IGNORE },
6eda541d 156 { USB_DEVICE(0x0cf3, 0xe019), .driver_info = BTUSB_IGNORE },
2a7bcccc 157 { USB_DEVICE(0x13d3, 0x3304), .driver_info = BTUSB_IGNORE },
be93112a 158
509e7861
CYC		 159 /* Atheros AR9285 Malbec with sflash firmware */
160 { USB_DEVICE(0x03f0, 0x311d), .driver_info = BTUSB_IGNORE },
161
d9f51b51 162 /* Atheros 3012 with sflash firmware */
0b880062
AS		 163 { USB_DEVICE(0x0489, 0xe04d), .driver_info = BTUSB_ATH3012 },
164 { USB_DEVICE(0x0489, 0xe04e), .driver_info = BTUSB_ATH3012 },
165 { USB_DEVICE(0x0489, 0xe056), .driver_info = BTUSB_ATH3012 },
166 { USB_DEVICE(0x0489, 0xe057), .driver_info = BTUSB_ATH3012 },
167 { USB_DEVICE(0x0489, 0xe05f), .driver_info = BTUSB_ATH3012 },
4b552bc9 168 { USB_DEVICE(0x0489, 0xe078), .driver_info = BTUSB_ATH3012 },
0b880062
AS		 169 { USB_DEVICE(0x04c5, 0x1330), .driver_info = BTUSB_ATH3012 },
170 { USB_DEVICE(0x04ca, 0x3004), .driver_info = BTUSB_ATH3012 },
171 { USB_DEVICE(0x04ca, 0x3005), .driver_info = BTUSB_ATH3012 },
172 { USB_DEVICE(0x04ca, 0x3006), .driver_info = BTUSB_ATH3012 },
1fb4e09a 173 { USB_DEVICE(0x04ca, 0x3007), .driver_info = BTUSB_ATH3012 },
0b880062
AS		 174 { USB_DEVICE(0x04ca, 0x3008), .driver_info = BTUSB_ATH3012 },
175 { USB_DEVICE(0x04ca, 0x300b), .driver_info = BTUSB_ATH3012 },
134d3b35 176 { USB_DEVICE(0x04ca, 0x3010), .driver_info = BTUSB_ATH3012 },
0b880062
AS		 177 { USB_DEVICE(0x0930, 0x0219), .driver_info = BTUSB_ATH3012 },
178 { USB_DEVICE(0x0930, 0x0220), .driver_info = BTUSB_ATH3012 },
89d2975f 179 { USB_DEVICE(0x0930, 0x0227), .driver_info = BTUSB_ATH3012 },
a735f9e2 180 { USB_DEVICE(0x0b05, 0x17d0), .driver_info = BTUSB_ATH3012 },
d66629c1 181 { USB_DEVICE(0x0cf3, 0x0036), .driver_info = BTUSB_ATH3012 },
2d25f8b4 182 { USB_DEVICE(0x0cf3, 0x3004), .driver_info = BTUSB_ATH3012 },
94a32d10 183 { USB_DEVICE(0x0cf3, 0x3008), .driver_info = BTUSB_ATH3012 },
07c0ea87 184 { USB_DEVICE(0x0cf3, 0x311d), .driver_info = BTUSB_ATH3012 },
b131237c 185 { USB_DEVICE(0x0cf3, 0x311e), .driver_info = BTUSB_ATH3012 },
1e56f1eb 186 { USB_DEVICE(0x0cf3, 0x311f), .driver_info = BTUSB_ATH3012 },
0b880062 187 { USB_DEVICE(0x0cf3, 0x3121), .driver_info = BTUSB_ATH3012 },
ebaf5795 188 { USB_DEVICE(0x0cf3, 0x817a), .driver_info = BTUSB_ATH3012 },
0b880062 189 { USB_DEVICE(0x0cf3, 0xe003), .driver_info = BTUSB_ATH3012 },
ac71311e 190 { USB_DEVICE(0x0cf3, 0xe004), .driver_info = BTUSB_ATH3012 },
0a3658cc 191 { USB_DEVICE(0x0cf3, 0xe005), .driver_info = BTUSB_ATH3012 },
0b880062
AS		 192 { USB_DEVICE(0x13d3, 0x3362), .driver_info = BTUSB_ATH3012 },
193 { USB_DEVICE(0x13d3, 0x3375), .driver_info = BTUSB_ATH3012 },
eed307e2 194 { USB_DEVICE(0x13d3, 0x3393), .driver_info = BTUSB_ATH3012 },
5b77a1f3 195 { USB_DEVICE(0x13d3, 0x3402), .driver_info = BTUSB_ATH3012 },
3bb30a7c 196 { USB_DEVICE(0x13d3, 0x3408), .driver_info = BTUSB_ATH3012 },
033efa92 197 { USB_DEVICE(0x13d3, 0x3423), .driver_info = BTUSB_ATH3012 },
fa2f1394 198 { USB_DEVICE(0x13d3, 0x3432), .driver_info = BTUSB_ATH3012 },
d9f51b51 199
e9036e33
CYC		 200 /* Atheros AR5BBU12 with sflash firmware */
201 { USB_DEVICE(0x0489, 0xe02c), .driver_info = BTUSB_IGNORE },
202
85d59726 203 /* Atheros AR5BBU12 with sflash firmware */
bc21fde2 204 { USB_DEVICE(0x0489, 0xe036), .driver_info = BTUSB_ATH3012 },
0b880062 205 { USB_DEVICE(0x0489, 0xe03c), .driver_info = BTUSB_ATH3012 },
85d59726 206
cfeb4145 207 /* Broadcom BCM2035 */
7a9d4020 208 { USB_DEVICE(0x0a5c, 0x2009), .driver_info = BTUSB_BCM92035 },
0b880062
AS		 209 { USB_DEVICE(0x0a5c, 0x200a), .driver_info = BTUSB_WRONG_SCO_MTU },
210 { USB_DEVICE(0x0a5c, 0x2035), .driver_info = BTUSB_WRONG_SCO_MTU },
cfeb4145
MH		 211
212 /* Broadcom BCM2045 */
7a9d4020
MH		 213 { USB_DEVICE(0x0a5c, 0x2039), .driver_info = BTUSB_WRONG_SCO_MTU },
214 { USB_DEVICE(0x0a5c, 0x2101), .driver_info = BTUSB_WRONG_SCO_MTU },
bdbef3d6 215
cfeb4145 216 /* IBM/Lenovo ThinkPad with Broadcom chip */
7a9d4020
MH		 217 { USB_DEVICE(0x0a5c, 0x201e), .driver_info = BTUSB_WRONG_SCO_MTU },
218 { USB_DEVICE(0x0a5c, 0x2110), .driver_info = BTUSB_WRONG_SCO_MTU },
cfeb4145
MH		 219
220 /* HP laptop with Broadcom chip */
7a9d4020 221 { USB_DEVICE(0x03f0, 0x171d), .driver_info = BTUSB_WRONG_SCO_MTU },
cfeb4145
MH		 222
223 /* Dell laptop with Broadcom chip */
7a9d4020 224 { USB_DEVICE(0x413c, 0x8126), .driver_info = BTUSB_WRONG_SCO_MTU },
cfeb4145 225
5ddd4a60 226 /* Dell Wireless 370 and 410 devices */
7a9d4020 227 { USB_DEVICE(0x413c, 0x8152), .driver_info = BTUSB_WRONG_SCO_MTU },
5ddd4a60 228 { USB_DEVICE(0x413c, 0x8156), .driver_info = BTUSB_WRONG_SCO_MTU },
cfeb4145 229
7a9d4020
MH		 230 /* Belkin F8T012 and F8T013 devices */
231 { USB_DEVICE(0x050d, 0x0012), .driver_info = BTUSB_WRONG_SCO_MTU },
232 { USB_DEVICE(0x050d, 0x0013), .driver_info = BTUSB_WRONG_SCO_MTU },
cfeb4145 233
5ddd4a60
MH		 234 /* Asus WL-BTD202 device */
235 { USB_DEVICE(0x0b05, 0x1715), .driver_info = BTUSB_WRONG_SCO_MTU },
236
237 /* Kensington Bluetooth USB adapter */
238 { USB_DEVICE(0x047d, 0x105e), .driver_info = BTUSB_WRONG_SCO_MTU },
239
cfeb4145
MH		 240 /* RTX Telecom based adapters with buggy SCO support */
241 { USB_DEVICE(0x0400, 0x0807), .driver_info = BTUSB_BROKEN_ISOC },
242 { USB_DEVICE(0x0400, 0x080a), .driver_info = BTUSB_BROKEN_ISOC },
243
244 /* CONWISE Technology based adapters with buggy SCO support */
245 { USB_DEVICE(0x0e5e, 0x6622), .driver_info = BTUSB_BROKEN_ISOC },
246
4fcef8ed
MH		 247 /* Roper Class 1 Bluetooth Dongle (Silicon Wave based) */
248 { USB_DEVICE(0x1300, 0x0001), .driver_info = BTUSB_SWAVE },
249
cfeb4145
MH		 250 /* Digianswer devices */
251 { USB_DEVICE(0x08fd, 0x0001), .driver_info = BTUSB_DIGIANSWER },
252 { USB_DEVICE(0x08fd, 0x0002), .driver_info = BTUSB_IGNORE },
253
254 /* CSR BlueCore Bluetooth Sniffer */
4f64fa80
MH		 255 { USB_DEVICE(0x0a12, 0x0002),
256 .driver_info = BTUSB_SNIFFER | BTUSB_BROKEN_ISOC },
cfeb4145
MH		 257
258 /* Frontline ComProbe Bluetooth Sniffer */
4f64fa80
MH		 259 { USB_DEVICE(0x16d3, 0x0002),
260 .driver_info = BTUSB_SNIFFER | BTUSB_BROKEN_ISOC },
cfeb4145 261
dffd30ee
THJA		 262 /* Intel Bluetooth device */
263 { USB_DEVICE(0x8087, 0x07dc), .driver_info = BTUSB_INTEL },
ef4e5e4a 264 { USB_DEVICE(0x8087, 0x0a2a), .driver_info = BTUSB_INTEL },
cda0dd78 265 { USB_DEVICE(0x8087, 0x0a2b), .driver_info = BTUSB_INTEL_NEW },
dffd30ee 266
ae8df494
AK		 267 /* Marvell device */
268 { USB_DEVICE(0x1286, 0x2044), .driver_info = BTUSB_MARVELL },
269 { USB_DEVICE(0x1286, 0x2046), .driver_info = BTUSB_MARVELL },
270
5e23b923
MH		 271 { } /* Terminating entry */
272};
273
9bfa35fe
MH		 274#define BTUSB_MAX_ISOC_FRAMES 10
275
5e23b923
MH		 276#define BTUSB_INTR_RUNNING 0
277#define BTUSB_BULK_RUNNING 1
9bfa35fe 278#define BTUSB_ISOC_RUNNING 2
7bee549e 279#define BTUSB_SUSPENDING 3
08b8b6c4 280#define BTUSB_DID_ISO_RESUME 4
cda0dd78
MH		 281#define BTUSB_BOOTLOADER 5
282#define BTUSB_DOWNLOADING 6
ce6bb929 283#define BTUSB_FIRMWARE_LOADED 7
cda0dd78 284#define BTUSB_FIRMWARE_FAILED 8
ce6bb929 285#define BTUSB_BOOTING 9
5e23b923
MH		 286
287struct btusb_data {
288 struct hci_dev *hdev;
289 struct usb_device *udev;
5fbcd260 290 struct usb_interface *intf;
9bfa35fe 291 struct usb_interface *isoc;
5e23b923 292
5e23b923
MH		 293 unsigned long flags;
294
295 struct work_struct work;
7bee549e 296 struct work_struct waker;
5e23b923 297
803b5836 298 struct usb_anchor deferred;
5e23b923 299 struct usb_anchor tx_anchor;
803b5836
MH		 300 int tx_in_flight;
301 spinlock_t txlock;
302
5e23b923
MH		 303 struct usb_anchor intr_anchor;
304 struct usb_anchor bulk_anchor;
9bfa35fe 305 struct usb_anchor isoc_anchor;
803b5836
MH		 306 spinlock_t rxlock;
307
308 struct sk_buff *evt_skb;
309 struct sk_buff *acl_skb;
310 struct sk_buff *sco_skb;
5e23b923
MH		 311
312 struct usb_endpoint_descriptor *intr_ep;
313 struct usb_endpoint_descriptor *bulk_tx_ep;
314 struct usb_endpoint_descriptor *bulk_rx_ep;
9bfa35fe
MH		 315 struct usb_endpoint_descriptor *isoc_tx_ep;
316 struct usb_endpoint_descriptor *isoc_rx_ep;
317
7a9d4020
MH		 318 __u8 cmdreq_type;
319
43c2e57f 320 unsigned int sco_num;
9bfa35fe 321 int isoc_altsetting;
6a88adf2 322 int suspend_count;
2cbd3f5c 323
97307f51 324 int (*recv_event)(struct hci_dev *hdev, struct sk_buff *skb);
2cbd3f5c 325 int (*recv_bulk)(struct btusb_data *data, void *buffer, int count);
5e23b923
MH		 326};
327
803b5836
MH		 328static inline void btusb_free_frags(struct btusb_data *data)
329{
330 unsigned long flags;
331
332 spin_lock_irqsave(&data->rxlock, flags);
333
334 kfree_skb(data->evt_skb);
335 data->evt_skb = NULL;
336
337 kfree_skb(data->acl_skb);
338 data->acl_skb = NULL;
339
340 kfree_skb(data->sco_skb);
341 data->sco_skb = NULL;
342
343 spin_unlock_irqrestore(&data->rxlock, flags);
344}
345
1ffa4ad0
MH		 346static int btusb_recv_intr(struct btusb_data *data, void *buffer, int count)
347{
803b5836
MH		 348 struct sk_buff *skb;
349 int err = 0;
350
351 spin_lock(&data->rxlock);
352 skb = data->evt_skb;
353
354 while (count) {
355 int len;
356
357 if (!skb) {
358 skb = bt_skb_alloc(HCI_MAX_EVENT_SIZE, GFP_ATOMIC);
359 if (!skb) {
360 err = -ENOMEM;
361 break;
362 }
363
364 bt_cb(skb)->pkt_type = HCI_EVENT_PKT;
365 bt_cb(skb)->expect = HCI_EVENT_HDR_SIZE;
366 }
367
368 len = min_t(uint, bt_cb(skb)->expect, count);
369 memcpy(skb_put(skb, len), buffer, len);
370
371 count -= len;
372 buffer += len;
373 bt_cb(skb)->expect -= len;
374
375 if (skb->len == HCI_EVENT_HDR_SIZE) {
376 /* Complete event header */
377 bt_cb(skb)->expect = hci_event_hdr(skb)->plen;
378
379 if (skb_tailroom(skb) < bt_cb(skb)->expect) {
380 kfree_skb(skb);
381 skb = NULL;
382
383 err = -EILSEQ;
384 break;
385 }
386 }
387
388 if (bt_cb(skb)->expect == 0) {
389 /* Complete frame */
97307f51 390 data->recv_event(data->hdev, skb);
803b5836
MH		 391 skb = NULL;
392 }
393 }
394
395 data->evt_skb = skb;
396 spin_unlock(&data->rxlock);
397
398 return err;
1ffa4ad0
MH		 399}
400
401static int btusb_recv_bulk(struct btusb_data *data, void *buffer, int count)
402{
803b5836
MH		 403 struct sk_buff *skb;
404 int err = 0;
405
406 spin_lock(&data->rxlock);
407 skb = data->acl_skb;
408
409 while (count) {
410 int len;
411
412 if (!skb) {
413 skb = bt_skb_alloc(HCI_MAX_FRAME_SIZE, GFP_ATOMIC);
414 if (!skb) {
415 err = -ENOMEM;
416 break;
417 }
418
419 bt_cb(skb)->pkt_type = HCI_ACLDATA_PKT;
420 bt_cb(skb)->expect = HCI_ACL_HDR_SIZE;
421 }
422
423 len = min_t(uint, bt_cb(skb)->expect, count);
424 memcpy(skb_put(skb, len), buffer, len);
425
426 count -= len;
427 buffer += len;
428 bt_cb(skb)->expect -= len;
429
430 if (skb->len == HCI_ACL_HDR_SIZE) {
431 __le16 dlen = hci_acl_hdr(skb)->dlen;
432
433 /* Complete ACL header */
434 bt_cb(skb)->expect = __le16_to_cpu(dlen);
435
436 if (skb_tailroom(skb) < bt_cb(skb)->expect) {
437 kfree_skb(skb);
438 skb = NULL;
439
440 err = -EILSEQ;
441 break;
442 }
443 }
444
445 if (bt_cb(skb)->expect == 0) {
446 /* Complete frame */
447 hci_recv_frame(data->hdev, skb);
448 skb = NULL;
449 }
450 }
451
452 data->acl_skb = skb;
453 spin_unlock(&data->rxlock);
454
455 return err;
1ffa4ad0
MH		 456}
457
458static int btusb_recv_isoc(struct btusb_data *data, void *buffer, int count)
459{
803b5836
MH		 460 struct sk_buff *skb;
461 int err = 0;
462
463 spin_lock(&data->rxlock);
464 skb = data->sco_skb;
465
466 while (count) {
467 int len;
468
469 if (!skb) {
470 skb = bt_skb_alloc(HCI_MAX_SCO_SIZE, GFP_ATOMIC);
471 if (!skb) {
472 err = -ENOMEM;
473 break;
474 }
475
476 bt_cb(skb)->pkt_type = HCI_SCODATA_PKT;
477 bt_cb(skb)->expect = HCI_SCO_HDR_SIZE;
478 }
479
480 len = min_t(uint, bt_cb(skb)->expect, count);
481 memcpy(skb_put(skb, len), buffer, len);
482
483 count -= len;
484 buffer += len;
485 bt_cb(skb)->expect -= len;
486
487 if (skb->len == HCI_SCO_HDR_SIZE) {
488 /* Complete SCO header */
489 bt_cb(skb)->expect = hci_sco_hdr(skb)->dlen;
490
491 if (skb_tailroom(skb) < bt_cb(skb)->expect) {
492 kfree_skb(skb);
493 skb = NULL;
494
495 err = -EILSEQ;
496 break;
497 }
498 }
499
500 if (bt_cb(skb)->expect == 0) {
501 /* Complete frame */
502 hci_recv_frame(data->hdev, skb);
503 skb = NULL;
504 }
505 }
506
507 data->sco_skb = skb;
508 spin_unlock(&data->rxlock);
509
510 return err;
1ffa4ad0
MH		 511}
512
5e23b923
MH		 513static void btusb_intr_complete(struct urb *urb)
514{
515 struct hci_dev *hdev = urb->context;
155961e8 516 struct btusb_data *data = hci_get_drvdata(hdev);
5e23b923
MH		 517 int err;
518
89e7533d
MH		 519 BT_DBG("%s urb %p status %d count %d", hdev->name, urb, urb->status,
520 urb->actual_length);
5e23b923
MH		 521
522 if (!test_bit(HCI_RUNNING, &hdev->flags))
523 return;
524
525 if (urb->status == 0) {
9bfa35fe
MH		 526 hdev->stat.byte_rx += urb->actual_length;
527
1ffa4ad0
MH		 528 if (btusb_recv_intr(data, urb->transfer_buffer,
529 urb->actual_length) < 0) {
5e23b923
MH		 530 BT_ERR("%s corrupted event packet", hdev->name);
531 hdev->stat.err_rx++;
532 }
85560c4a
CC		 533 } else if (urb->status == -ENOENT) {
534 /* Avoid suspend failed when usb_kill_urb */
535 return;
5e23b923
MH		 536 }
537
538 if (!test_bit(BTUSB_INTR_RUNNING, &data->flags))
539 return;
540
7bee549e 541 usb_mark_last_busy(data->udev);
5e23b923
MH		 542 usb_anchor_urb(urb, &data->intr_anchor);
543
544 err = usb_submit_urb(urb, GFP_ATOMIC);
545 if (err < 0) {
4935f1c1
PB		 546 /* -EPERM: urb is being killed;
547 * -ENODEV: device got disconnected */
548 if (err != -EPERM && err != -ENODEV)
61faddf6 549 BT_ERR("%s urb %p failed to resubmit (%d)",
89e7533d 550 hdev->name, urb, -err);
5e23b923
MH		 551 usb_unanchor_urb(urb);
552 }
553}
554
2eda66f4 555static int btusb_submit_intr_urb(struct hci_dev *hdev, gfp_t mem_flags)
5e23b923 556{
155961e8 557 struct btusb_data *data = hci_get_drvdata(hdev);
5e23b923
MH		 558 struct urb *urb;
559 unsigned char *buf;
560 unsigned int pipe;
561 int err, size;
562
563 BT_DBG("%s", hdev->name);
564
9bfa35fe
MH		 565 if (!data->intr_ep)
566 return -ENODEV;
567
2eda66f4 568 urb = usb_alloc_urb(0, mem_flags);
5e23b923
MH		 569 if (!urb)
570 return -ENOMEM;
571
572 size = le16_to_cpu(data->intr_ep->wMaxPacketSize);
573
2eda66f4 574 buf = kmalloc(size, mem_flags);
5e23b923
MH		 575 if (!buf) {
576 usb_free_urb(urb);
577 return -ENOMEM;
578 }
579
580 pipe = usb_rcvintpipe(data->udev, data->intr_ep->bEndpointAddress);
581
582 usb_fill_int_urb(urb, data->udev, pipe, buf, size,
89e7533d 583 btusb_intr_complete, hdev, data->intr_ep->bInterval);
5e23b923
MH		 584
585 urb->transfer_flags |= URB_FREE_BUFFER;
586
587 usb_anchor_urb(urb, &data->intr_anchor);
588
2eda66f4 589 err = usb_submit_urb(urb, mem_flags);
5e23b923 590 if (err < 0) {
d4b8d1c9
PB		 591 if (err != -EPERM && err != -ENODEV)
592 BT_ERR("%s urb %p submission failed (%d)",
89e7533d 593 hdev->name, urb, -err);
5e23b923 594 usb_unanchor_urb(urb);
5e23b923
MH		 595 }
596
597 usb_free_urb(urb);
598
599 return err;
600}
601
602static void btusb_bulk_complete(struct urb *urb)
603{
604 struct hci_dev *hdev = urb->context;
155961e8 605 struct btusb_data *data = hci_get_drvdata(hdev);
5e23b923
MH		 606 int err;
607
89e7533d
MH		 608 BT_DBG("%s urb %p status %d count %d", hdev->name, urb, urb->status,
609 urb->actual_length);
5e23b923
MH		 610
611 if (!test_bit(HCI_RUNNING, &hdev->flags))
612 return;
613
614 if (urb->status == 0) {
9bfa35fe
MH		 615 hdev->stat.byte_rx += urb->actual_length;
616
2cbd3f5c 617 if (data->recv_bulk(data, urb->transfer_buffer,
1ffa4ad0 618 urb->actual_length) < 0) {
5e23b923
MH		 619 BT_ERR("%s corrupted ACL packet", hdev->name);
620 hdev->stat.err_rx++;
621 }
85560c4a
CC		 622 } else if (urb->status == -ENOENT) {
623 /* Avoid suspend failed when usb_kill_urb */
624 return;
5e23b923
MH		 625 }
626
627 if (!test_bit(BTUSB_BULK_RUNNING, &data->flags))
628 return;
629
630 usb_anchor_urb(urb, &data->bulk_anchor);
652fd781 631 usb_mark_last_busy(data->udev);
5e23b923
MH		 632
633 err = usb_submit_urb(urb, GFP_ATOMIC);
634 if (err < 0) {
4935f1c1
PB		 635 /* -EPERM: urb is being killed;
636 * -ENODEV: device got disconnected */
637 if (err != -EPERM && err != -ENODEV)
61faddf6 638 BT_ERR("%s urb %p failed to resubmit (%d)",
89e7533d 639 hdev->name, urb, -err);
5e23b923
MH		 640 usb_unanchor_urb(urb);
641 }
642}
643
2eda66f4 644static int btusb_submit_bulk_urb(struct hci_dev *hdev, gfp_t mem_flags)
5e23b923 645{
155961e8 646 struct btusb_data *data = hci_get_drvdata(hdev);
5e23b923
MH		 647 struct urb *urb;
648 unsigned char *buf;
649 unsigned int pipe;
290ba200 650 int err, size = HCI_MAX_FRAME_SIZE;
5e23b923
MH		 651
652 BT_DBG("%s", hdev->name);
653
9bfa35fe
MH		 654 if (!data->bulk_rx_ep)
655 return -ENODEV;
656
2eda66f4 657 urb = usb_alloc_urb(0, mem_flags);
5e23b923
MH		 658 if (!urb)
659 return -ENOMEM;
660
2eda66f4 661 buf = kmalloc(size, mem_flags);
5e23b923
MH		 662 if (!buf) {
663 usb_free_urb(urb);
664 return -ENOMEM;
665 }
666
667 pipe = usb_rcvbulkpipe(data->udev, data->bulk_rx_ep->bEndpointAddress);
668
89e7533d
MH		 669 usb_fill_bulk_urb(urb, data->udev, pipe, buf, size,
670 btusb_bulk_complete, hdev);
5e23b923
MH		 671
672 urb->transfer_flags |= URB_FREE_BUFFER;
673
7bee549e 674 usb_mark_last_busy(data->udev);
5e23b923
MH		 675 usb_anchor_urb(urb, &data->bulk_anchor);
676
2eda66f4 677 err = usb_submit_urb(urb, mem_flags);
5e23b923 678 if (err < 0) {
d4b8d1c9
PB		 679 if (err != -EPERM && err != -ENODEV)
680 BT_ERR("%s urb %p submission failed (%d)",
89e7533d 681 hdev->name, urb, -err);
5e23b923 682 usb_unanchor_urb(urb);
5e23b923
MH		 683 }
684
685 usb_free_urb(urb);
686
687 return err;
688}
689
9bfa35fe
MH		 690static void btusb_isoc_complete(struct urb *urb)
691{
692 struct hci_dev *hdev = urb->context;
155961e8 693 struct btusb_data *data = hci_get_drvdata(hdev);
9bfa35fe
MH		 694 int i, err;
695
89e7533d
MH		 696 BT_DBG("%s urb %p status %d count %d", hdev->name, urb, urb->status,
697 urb->actual_length);
9bfa35fe
MH		 698
699 if (!test_bit(HCI_RUNNING, &hdev->flags))
700 return;
701
702 if (urb->status == 0) {
703 for (i = 0; i < urb->number_of_packets; i++) {
704 unsigned int offset = urb->iso_frame_desc[i].offset;
705 unsigned int length = urb->iso_frame_desc[i].actual_length;
706
707 if (urb->iso_frame_desc[i].status)
708 continue;
709
710 hdev->stat.byte_rx += length;
711
1ffa4ad0
MH		 712 if (btusb_recv_isoc(data, urb->transfer_buffer + offset,
713 length) < 0) {
9bfa35fe
MH		 714 BT_ERR("%s corrupted SCO packet", hdev->name);
715 hdev->stat.err_rx++;
716 }
717 }
85560c4a
CC		 718 } else if (urb->status == -ENOENT) {
719 /* Avoid suspend failed when usb_kill_urb */
720 return;
9bfa35fe
MH		 721 }
722
723 if (!test_bit(BTUSB_ISOC_RUNNING, &data->flags))
724 return;
725
726 usb_anchor_urb(urb, &data->isoc_anchor);
727
728 err = usb_submit_urb(urb, GFP_ATOMIC);
729 if (err < 0) {
4935f1c1
PB		 730 /* -EPERM: urb is being killed;
731 * -ENODEV: device got disconnected */
732 if (err != -EPERM && err != -ENODEV)
61faddf6 733 BT_ERR("%s urb %p failed to resubmit (%d)",
89e7533d 734 hdev->name, urb, -err);
9bfa35fe
MH		 735 usb_unanchor_urb(urb);
736 }
737}
738
42b16b3f 739static inline void __fill_isoc_descriptor(struct urb *urb, int len, int mtu)
9bfa35fe
MH		 740{
741 int i, offset = 0;
742
743 BT_DBG("len %d mtu %d", len, mtu);
744
745 for (i = 0; i < BTUSB_MAX_ISOC_FRAMES && len >= mtu;
746 i++, offset += mtu, len -= mtu) {
747 urb->iso_frame_desc[i].offset = offset;
748 urb->iso_frame_desc[i].length = mtu;
749 }
750
751 if (len && i < BTUSB_MAX_ISOC_FRAMES) {
752 urb->iso_frame_desc[i].offset = offset;
753 urb->iso_frame_desc[i].length = len;
754 i++;
755 }
756
757 urb->number_of_packets = i;
758}
759
2eda66f4 760static int btusb_submit_isoc_urb(struct hci_dev *hdev, gfp_t mem_flags)
9bfa35fe 761{
155961e8 762 struct btusb_data *data = hci_get_drvdata(hdev);
9bfa35fe
MH		 763 struct urb *urb;
764 unsigned char *buf;
765 unsigned int pipe;
766 int err, size;
767
768 BT_DBG("%s", hdev->name);
769
770 if (!data->isoc_rx_ep)
771 return -ENODEV;
772
2eda66f4 773 urb = usb_alloc_urb(BTUSB_MAX_ISOC_FRAMES, mem_flags);
9bfa35fe
MH		 774 if (!urb)
775 return -ENOMEM;
776
777 size = le16_to_cpu(data->isoc_rx_ep->wMaxPacketSize) *
778 BTUSB_MAX_ISOC_FRAMES;
779
2eda66f4 780 buf = kmalloc(size, mem_flags);
9bfa35fe
MH		 781 if (!buf) {
782 usb_free_urb(urb);
783 return -ENOMEM;
784 }
785
786 pipe = usb_rcvisocpipe(data->udev, data->isoc_rx_ep->bEndpointAddress);
787
fa0fb93f 788 usb_fill_int_urb(urb, data->udev, pipe, buf, size, btusb_isoc_complete,
89e7533d 789 hdev, data->isoc_rx_ep->bInterval);
9bfa35fe 790
89e7533d 791 urb->transfer_flags = URB_FREE_BUFFER | URB_ISO_ASAP;
9bfa35fe
MH		 792
793 __fill_isoc_descriptor(urb, size,
89e7533d 794 le16_to_cpu(data->isoc_rx_ep->wMaxPacketSize));
9bfa35fe
MH		 795
796 usb_anchor_urb(urb, &data->isoc_anchor);
797
2eda66f4 798 err = usb_submit_urb(urb, mem_flags);
9bfa35fe 799 if (err < 0) {
d4b8d1c9
PB		 800 if (err != -EPERM && err != -ENODEV)
801 BT_ERR("%s urb %p submission failed (%d)",
89e7533d 802 hdev->name, urb, -err);
9bfa35fe 803 usb_unanchor_urb(urb);
9bfa35fe
MH		 804 }
805
806 usb_free_urb(urb);
807
808 return err;
809}
810
5e23b923 811static void btusb_tx_complete(struct urb *urb)
7bee549e
ON		 812{
813 struct sk_buff *skb = urb->context;
89e7533d 814 struct hci_dev *hdev = (struct hci_dev *)skb->dev;
155961e8 815 struct btusb_data *data = hci_get_drvdata(hdev);
7bee549e 816
89e7533d
MH		 817 BT_DBG("%s urb %p status %d count %d", hdev->name, urb, urb->status,
818 urb->actual_length);
7bee549e
ON		 819
820 if (!test_bit(HCI_RUNNING, &hdev->flags))
821 goto done;
822
823 if (!urb->status)
824 hdev->stat.byte_tx += urb->transfer_buffer_length;
825 else
826 hdev->stat.err_tx++;
827
828done:
829 spin_lock(&data->txlock);
830 data->tx_in_flight--;
831 spin_unlock(&data->txlock);
832
833 kfree(urb->setup_packet);
834
835 kfree_skb(skb);
836}
837
838static void btusb_isoc_tx_complete(struct urb *urb)
5e23b923
MH		 839{
840 struct sk_buff *skb = urb->context;
89e7533d 841 struct hci_dev *hdev = (struct hci_dev *)skb->dev;
5e23b923 842
89e7533d
MH		 843 BT_DBG("%s urb %p status %d count %d", hdev->name, urb, urb->status,
844 urb->actual_length);
5e23b923
MH		 845
846 if (!test_bit(HCI_RUNNING, &hdev->flags))
847 goto done;
848
849 if (!urb->status)
850 hdev->stat.byte_tx += urb->transfer_buffer_length;
851 else
852 hdev->stat.err_tx++;
853
854done:
855 kfree(urb->setup_packet);
856
857 kfree_skb(skb);
858}
859
860static int btusb_open(struct hci_dev *hdev)
861{
155961e8 862 struct btusb_data *data = hci_get_drvdata(hdev);
5e23b923
MH		 863 int err;
864
865 BT_DBG("%s", hdev->name);
866
7bee549e
ON		 867 err = usb_autopm_get_interface(data->intf);
868 if (err < 0)
869 return err;
870
871 data->intf->needs_remote_wakeup = 1;
872
5e23b923 873 if (test_and_set_bit(HCI_RUNNING, &hdev->flags))
7bee549e 874 goto done;
5e23b923
MH		 875
876 if (test_and_set_bit(BTUSB_INTR_RUNNING, &data->flags))
7bee549e 877 goto done;
5e23b923 878
2eda66f4 879 err = btusb_submit_intr_urb(hdev, GFP_KERNEL);
43c2e57f
MH		 880 if (err < 0)
881 goto failed;
882
883 err = btusb_submit_bulk_urb(hdev, GFP_KERNEL);
5e23b923 884 if (err < 0) {
43c2e57f
MH		 885 usb_kill_anchored_urbs(&data->intr_anchor);
886 goto failed;
5e23b923
MH		 887 }
888
43c2e57f
MH		 889 set_bit(BTUSB_BULK_RUNNING, &data->flags);
890 btusb_submit_bulk_urb(hdev, GFP_KERNEL);
891
7bee549e
ON		 892done:
893 usb_autopm_put_interface(data->intf);
43c2e57f
MH		 894 return 0;
895
896failed:
897 clear_bit(BTUSB_INTR_RUNNING, &data->flags);
898 clear_bit(HCI_RUNNING, &hdev->flags);
7bee549e 899 usb_autopm_put_interface(data->intf);
5e23b923
MH		 900 return err;
901}
902
7bee549e
ON		 903static void btusb_stop_traffic(struct btusb_data *data)
904{
905 usb_kill_anchored_urbs(&data->intr_anchor);
906 usb_kill_anchored_urbs(&data->bulk_anchor);
907 usb_kill_anchored_urbs(&data->isoc_anchor);
908}
909
5e23b923
MH		 910static int btusb_close(struct hci_dev *hdev)
911{
155961e8 912 struct btusb_data *data = hci_get_drvdata(hdev);
7bee549e 913 int err;
5e23b923
MH		 914
915 BT_DBG("%s", hdev->name);
916
917 if (!test_and_clear_bit(HCI_RUNNING, &hdev->flags))
918 return 0;
919
e8c3c3d2 920 cancel_work_sync(&data->work);
404291ac 921 cancel_work_sync(&data->waker);
e8c3c3d2 922
9bfa35fe 923 clear_bit(BTUSB_ISOC_RUNNING, &data->flags);
5e23b923 924 clear_bit(BTUSB_BULK_RUNNING, &data->flags);
5e23b923 925 clear_bit(BTUSB_INTR_RUNNING, &data->flags);
7bee549e
ON		 926
927 btusb_stop_traffic(data);
803b5836
MH		 928 btusb_free_frags(data);
929
7bee549e
ON		 930 err = usb_autopm_get_interface(data->intf);
931 if (err < 0)
7b8e2c1d 932 goto failed;
7bee549e
ON		 933
934 data->intf->needs_remote_wakeup = 0;
935 usb_autopm_put_interface(data->intf);
5e23b923 936
7b8e2c1d
ON		 937failed:
938 usb_scuttle_anchored_urbs(&data->deferred);
5e23b923
MH		 939 return 0;
940}
941
942static int btusb_flush(struct hci_dev *hdev)
943{
155961e8 944 struct btusb_data *data = hci_get_drvdata(hdev);
5e23b923
MH		 945
946 BT_DBG("%s", hdev->name);
947
948 usb_kill_anchored_urbs(&data->tx_anchor);
803b5836 949 btusb_free_frags(data);
5e23b923
MH		 950
951 return 0;
952}
953
047b2ec8 954static struct urb *alloc_ctrl_urb(struct hci_dev *hdev, struct sk_buff *skb)
5e23b923 955{
155961e8 956 struct btusb_data *data = hci_get_drvdata(hdev);
5e23b923
MH		 957 struct usb_ctrlrequest *dr;
958 struct urb *urb;
959 unsigned int pipe;
5e23b923 960
047b2ec8
MH		 961 urb = usb_alloc_urb(0, GFP_KERNEL);
962 if (!urb)
963 return ERR_PTR(-ENOMEM);
5e23b923 964
047b2ec8
MH		 965 dr = kmalloc(sizeof(*dr), GFP_KERNEL);
966 if (!dr) {
967 usb_free_urb(urb);
968 return ERR_PTR(-ENOMEM);
969 }
5e23b923 970
047b2ec8
MH		 971 dr->bRequestType = data->cmdreq_type;
972 dr->bRequest = 0;
973 dr->wIndex = 0;
974 dr->wValue = 0;
975 dr->wLength = __cpu_to_le16(skb->len);
7bd8f09f 976
047b2ec8 977 pipe = usb_sndctrlpipe(data->udev, 0x00);
5e23b923 978
89e7533d 979 usb_fill_control_urb(urb, data->udev, pipe, (void *)dr,
047b2ec8 980 skb->data, skb->len, btusb_tx_complete, skb);
5e23b923 981
89e7533d 982 skb->dev = (void *)hdev;
5e23b923 983
047b2ec8
MH		 984 return urb;
985}
5e23b923 986
047b2ec8
MH		 987static struct urb *alloc_bulk_urb(struct hci_dev *hdev, struct sk_buff *skb)
988{
989 struct btusb_data *data = hci_get_drvdata(hdev);
990 struct urb *urb;
991 unsigned int pipe;
5e23b923 992
047b2ec8
MH		 993 if (!data->bulk_tx_ep)
994 return ERR_PTR(-ENODEV);
9bfa35fe 995
047b2ec8
MH		 996 urb = usb_alloc_urb(0, GFP_KERNEL);
997 if (!urb)
998 return ERR_PTR(-ENOMEM);
5e23b923 999
047b2ec8 1000 pipe = usb_sndbulkpipe(data->udev, data->bulk_tx_ep->bEndpointAddress);
5e23b923 1001
047b2ec8
MH		 1002 usb_fill_bulk_urb(urb, data->udev, pipe,
1003 skb->data, skb->len, btusb_tx_complete, skb);
5e23b923 1004
89e7533d 1005 skb->dev = (void *)hdev;
5e23b923 1006
047b2ec8
MH		 1007 return urb;
1008}
9bfa35fe 1009
047b2ec8
MH		 1010static struct urb *alloc_isoc_urb(struct hci_dev *hdev, struct sk_buff *skb)
1011{
1012 struct btusb_data *data = hci_get_drvdata(hdev);
1013 struct urb *urb;
1014 unsigned int pipe;
9bfa35fe 1015
047b2ec8
MH		 1016 if (!data->isoc_tx_ep)
1017 return ERR_PTR(-ENODEV);
9bfa35fe 1018
047b2ec8
MH		 1019 urb = usb_alloc_urb(BTUSB_MAX_ISOC_FRAMES, GFP_KERNEL);
1020 if (!urb)
1021 return ERR_PTR(-ENOMEM);
9bfa35fe 1022
047b2ec8 1023 pipe = usb_sndisocpipe(data->udev, data->isoc_tx_ep->bEndpointAddress);
9bfa35fe 1024
047b2ec8
MH		 1025 usb_fill_int_urb(urb, data->udev, pipe,
1026 skb->data, skb->len, btusb_isoc_tx_complete,
1027 skb, data->isoc_tx_ep->bInterval);
9bfa35fe 1028
047b2ec8 1029 urb->transfer_flags = URB_ISO_ASAP;
5e23b923 1030
047b2ec8
MH		 1031 __fill_isoc_descriptor(urb, skb->len,
1032 le16_to_cpu(data->isoc_tx_ep->wMaxPacketSize));
5e23b923 1033
89e7533d 1034 skb->dev = (void *)hdev;
047b2ec8
MH		 1035
1036 return urb;
1037}
1038
1039static int submit_tx_urb(struct hci_dev *hdev, struct urb *urb)
1040{
1041 struct btusb_data *data = hci_get_drvdata(hdev);
1042 int err;
7bee549e 1043
5e23b923
MH		 1044 usb_anchor_urb(urb, &data->tx_anchor);
1045
e9753eff 1046 err = usb_submit_urb(urb, GFP_KERNEL);
5e23b923 1047 if (err < 0) {
5a9b80e2
PB		 1048 if (err != -EPERM && err != -ENODEV)
1049 BT_ERR("%s urb %p submission failed (%d)",
89e7533d 1050 hdev->name, urb, -err);
5e23b923
MH		 1051 kfree(urb->setup_packet);
1052 usb_unanchor_urb(urb);
7bee549e
ON		 1053 } else {
1054 usb_mark_last_busy(data->udev);
5e23b923
MH		 1055 }
1056
54a8a79c 1057 usb_free_urb(urb);
5e23b923
MH		 1058 return err;
1059}
1060
047b2ec8
MH		 1061static int submit_or_queue_tx_urb(struct hci_dev *hdev, struct urb *urb)
1062{
1063 struct btusb_data *data = hci_get_drvdata(hdev);
1064 unsigned long flags;
1065 bool suspending;
1066
1067 spin_lock_irqsave(&data->txlock, flags);
1068 suspending = test_bit(BTUSB_SUSPENDING, &data->flags);
1069 if (!suspending)
1070 data->tx_in_flight++;
1071 spin_unlock_irqrestore(&data->txlock, flags);
1072
1073 if (!suspending)
1074 return submit_tx_urb(hdev, urb);
1075
1076 usb_anchor_urb(urb, &data->deferred);
1077 schedule_work(&data->waker);
1078
1079 usb_free_urb(urb);
1080 return 0;
1081}
1082
1083static int btusb_send_frame(struct hci_dev *hdev, struct sk_buff *skb)
1084{
1085 struct urb *urb;
1086
1087 BT_DBG("%s", hdev->name);
1088
1089 if (!test_bit(HCI_RUNNING, &hdev->flags))
1090 return -EBUSY;
1091
1092 switch (bt_cb(skb)->pkt_type) {
1093 case HCI_COMMAND_PKT:
1094 urb = alloc_ctrl_urb(hdev, skb);
1095 if (IS_ERR(urb))
1096 return PTR_ERR(urb);
1097
1098 hdev->stat.cmd_tx++;
1099 return submit_or_queue_tx_urb(hdev, urb);
1100
1101 case HCI_ACLDATA_PKT:
1102 urb = alloc_bulk_urb(hdev, skb);
1103 if (IS_ERR(urb))
1104 return PTR_ERR(urb);
1105
1106 hdev->stat.acl_tx++;
1107 return submit_or_queue_tx_urb(hdev, urb);
1108
1109 case HCI_SCODATA_PKT:
1110 if (hci_conn_num(hdev, SCO_LINK) < 1)
1111 return -ENODEV;
1112
1113 urb = alloc_isoc_urb(hdev, skb);
1114 if (IS_ERR(urb))
1115 return PTR_ERR(urb);
1116
1117 hdev->stat.sco_tx++;
1118 return submit_tx_urb(hdev, urb);
1119 }
1120
1121 return -EILSEQ;
1122}
1123
5e23b923
MH		 1124static void btusb_notify(struct hci_dev *hdev, unsigned int evt)
1125{
155961e8 1126 struct btusb_data *data = hci_get_drvdata(hdev);
5e23b923
MH		 1127
1128 BT_DBG("%s evt %d", hdev->name, evt);
1129
014f7bc7
MH		 1130 if (hci_conn_num(hdev, SCO_LINK) != data->sco_num) {
1131 data->sco_num = hci_conn_num(hdev, SCO_LINK);
43c2e57f 1132 schedule_work(&data->work);
a780efa8 1133 }
5e23b923
MH		 1134}
1135
42b16b3f 1136static inline int __set_isoc_interface(struct hci_dev *hdev, int altsetting)
9bfa35fe 1137{
155961e8 1138 struct btusb_data *data = hci_get_drvdata(hdev);
9bfa35fe
MH		 1139 struct usb_interface *intf = data->isoc;
1140 struct usb_endpoint_descriptor *ep_desc;
1141 int i, err;
1142
1143 if (!data->isoc)
1144 return -ENODEV;
1145
1146 err = usb_set_interface(data->udev, 1, altsetting);
1147 if (err < 0) {
1148 BT_ERR("%s setting interface failed (%d)", hdev->name, -err);
1149 return err;
1150 }
1151
1152 data->isoc_altsetting = altsetting;
1153
1154 data->isoc_tx_ep = NULL;
1155 data->isoc_rx_ep = NULL;
1156
1157 for (i = 0; i < intf->cur_altsetting->desc.bNumEndpoints; i++) {
1158 ep_desc = &intf->cur_altsetting->endpoint[i].desc;
1159
1160 if (!data->isoc_tx_ep && usb_endpoint_is_isoc_out(ep_desc)) {
1161 data->isoc_tx_ep = ep_desc;
1162 continue;
1163 }
1164
1165 if (!data->isoc_rx_ep && usb_endpoint_is_isoc_in(ep_desc)) {
1166 data->isoc_rx_ep = ep_desc;
1167 continue;
1168 }
1169 }
1170
1171 if (!data->isoc_tx_ep || !data->isoc_rx_ep) {
1172 BT_ERR("%s invalid SCO descriptors", hdev->name);
1173 return -ENODEV;
1174 }
1175
1176 return 0;
1177}
1178
5e23b923
MH		 1179static void btusb_work(struct work_struct *work)
1180{
1181 struct btusb_data *data = container_of(work, struct btusb_data, work);
1182 struct hci_dev *hdev = data->hdev;
f4001d28 1183 int new_alts;
7bee549e 1184 int err;
5e23b923 1185
014f7bc7 1186 if (data->sco_num > 0) {
08b8b6c4 1187 if (!test_bit(BTUSB_DID_ISO_RESUME, &data->flags)) {
8efdd0cd 1188 err = usb_autopm_get_interface(data->isoc ? data->isoc : data->intf);
7bee549e
ON		 1189 if (err < 0) {
1190 clear_bit(BTUSB_ISOC_RUNNING, &data->flags);
1191 usb_kill_anchored_urbs(&data->isoc_anchor);
1192 return;
1193 }
1194
08b8b6c4 1195 set_bit(BTUSB_DID_ISO_RESUME, &data->flags);
7bee549e 1196 }
f4001d28
MA		 1197
1198 if (hdev->voice_setting & 0x0020) {
1199 static const int alts[3] = { 2, 4, 5 };
89e7533d 1200
014f7bc7 1201 new_alts = alts[data->sco_num - 1];
f4001d28 1202 } else {
014f7bc7 1203 new_alts = data->sco_num;
f4001d28
MA		 1204 }
1205
1206 if (data->isoc_altsetting != new_alts) {
9bfa35fe
MH		 1207 clear_bit(BTUSB_ISOC_RUNNING, &data->flags);
1208 usb_kill_anchored_urbs(&data->isoc_anchor);
1209
f4001d28 1210 if (__set_isoc_interface(hdev, new_alts) < 0)
9bfa35fe
MH		 1211 return;
1212 }
1213
1214 if (!test_and_set_bit(BTUSB_ISOC_RUNNING, &data->flags)) {
2eda66f4 1215 if (btusb_submit_isoc_urb(hdev, GFP_KERNEL) < 0)
9bfa35fe
MH		 1216 clear_bit(BTUSB_ISOC_RUNNING, &data->flags);
1217 else
2eda66f4 1218 btusb_submit_isoc_urb(hdev, GFP_KERNEL);
9bfa35fe
MH		 1219 }
1220 } else {
1221 clear_bit(BTUSB_ISOC_RUNNING, &data->flags);
1222 usb_kill_anchored_urbs(&data->isoc_anchor);
1223
1224 __set_isoc_interface(hdev, 0);
08b8b6c4 1225 if (test_and_clear_bit(BTUSB_DID_ISO_RESUME, &data->flags))
8efdd0cd 1226 usb_autopm_put_interface(data->isoc ? data->isoc : data->intf);
5e23b923
MH		 1227 }
1228}
1229
7bee549e
ON		 1230static void btusb_waker(struct work_struct *work)
1231{
1232 struct btusb_data *data = container_of(work, struct btusb_data, waker);
1233 int err;
1234
1235 err = usb_autopm_get_interface(data->intf);
1236 if (err < 0)
1237 return;
1238
1239 usb_autopm_put_interface(data->intf);
1240}
1241
9f8f962c
MH		 1242static int btusb_setup_bcm92035(struct hci_dev *hdev)
1243{
1244 struct sk_buff *skb;
1245 u8 val = 0x00;
1246
1247 BT_DBG("%s", hdev->name);
1248
1249 skb = __hci_cmd_sync(hdev, 0xfc3b, 1, &val, HCI_INIT_TIMEOUT);
1250 if (IS_ERR(skb))
1251 BT_ERR("BCM92035 command failed (%ld)", -PTR_ERR(skb));
1252 else
1253 kfree_skb(skb);
1254
1255 return 0;
1256}
1257
81cac64b
MH		 1258static int btusb_setup_csr(struct hci_dev *hdev)
1259{
1260 struct hci_rp_read_local_version *rp;
1261 struct sk_buff *skb;
1262 int ret;
1263
1264 BT_DBG("%s", hdev->name);
1265
1266 skb = __hci_cmd_sync(hdev, HCI_OP_READ_LOCAL_VERSION, 0, NULL,
1267 HCI_INIT_TIMEOUT);
1268 if (IS_ERR(skb)) {
1269 BT_ERR("Reading local version failed (%ld)", -PTR_ERR(skb));
1270 return -PTR_ERR(skb);
1271 }
1272
89e7533d 1273 rp = (struct hci_rp_read_local_version *)skb->data;
81cac64b
MH		 1274
1275 if (!rp->status) {
1276 if (le16_to_cpu(rp->manufacturer) != 10) {
1277 /* Clear the reset quirk since this is not an actual
1278 * early Bluetooth 1.1 device from CSR.
1279 */
1280 clear_bit(HCI_QUIRK_RESET_ON_CLOSE, &hdev->quirks);
1281
1282 /* These fake CSR controllers have all a broken
1283 * stored link key handling and so just disable it.
1284 */
1285 set_bit(HCI_QUIRK_BROKEN_STORED_LINK_KEY,
1286 &hdev->quirks);
1287 }
1288 }
1289
1290 ret = -bt_to_errno(rp->status);
1291
1292 kfree_skb(skb);
1293
1294 return ret;
1295}
1296
dffd30ee
THJA		 1297struct intel_version {
1298 u8 status;
1299 u8 hw_platform;
1300 u8 hw_variant;
1301 u8 hw_revision;
1302 u8 fw_variant;
1303 u8 fw_revision;
1304 u8 fw_build_num;
1305 u8 fw_build_ww;
1306 u8 fw_build_yy;
1307 u8 fw_patch_num;
1308} __packed;
1309
cda0dd78
MH		 1310struct intel_boot_params {
1311 __u8 status;
1312 __u8 otp_format;
1313 __u8 otp_content;
1314 __u8 otp_patch;
1315 __le16 dev_revid;
1316 __u8 secure_boot;
1317 __u8 key_from_hdr;
1318 __u8 key_type;
1319 __u8 otp_lock;
1320 __u8 api_lock;
1321 __u8 debug_lock;
1322 bdaddr_t otp_bdaddr;
1323 __u8 min_fw_build_nn;
1324 __u8 min_fw_build_cw;
1325 __u8 min_fw_build_yy;
1326 __u8 limited_cce;
1327 __u8 unlocked_state;
1328} __packed;
1329
dffd30ee 1330static const struct firmware *btusb_setup_intel_get_fw(struct hci_dev *hdev,
89e7533d 1331 struct intel_version *ver)
dffd30ee
THJA		 1332{
1333 const struct firmware *fw;
1334 char fwname[64];
1335 int ret;
1336
1337 snprintf(fwname, sizeof(fwname),
1338 "intel/ibt-hw-%x.%x.%x-fw-%x.%x.%x.%x.%x.bseq",
1339 ver->hw_platform, ver->hw_variant, ver->hw_revision,
1340 ver->fw_variant, ver->fw_revision, ver->fw_build_num,
1341 ver->fw_build_ww, ver->fw_build_yy);
1342
1343 ret = request_firmware(&fw, fwname, &hdev->dev);
1344 if (ret < 0) {
1345 if (ret == -EINVAL) {
1346 BT_ERR("%s Intel firmware file request failed (%d)",
1347 hdev->name, ret);
1348 return NULL;
1349 }
1350
1351 BT_ERR("%s failed to open Intel firmware file: %s(%d)",
1352 hdev->name, fwname, ret);
1353
1354 /* If the correct firmware patch file is not found, use the
1355 * default firmware patch file instead
1356 */
1357 snprintf(fwname, sizeof(fwname), "intel/ibt-hw-%x.%x.bseq",
1358 ver->hw_platform, ver->hw_variant);
1359 if (request_firmware(&fw, fwname, &hdev->dev) < 0) {
1360 BT_ERR("%s failed to open default Intel fw file: %s",
1361 hdev->name, fwname);
1362 return NULL;
1363 }
1364 }
1365
1366 BT_INFO("%s: Intel Bluetooth firmware file: %s", hdev->name, fwname);
1367
1368 return fw;
1369}
1370
1371static int btusb_setup_intel_patching(struct hci_dev *hdev,
1372 const struct firmware *fw,
1373 const u8 **fw_ptr, int *disable_patch)
1374{
1375 struct sk_buff *skb;
1376 struct hci_command_hdr *cmd;
1377 const u8 *cmd_param;
1378 struct hci_event_hdr *evt = NULL;
1379 const u8 *evt_param = NULL;
1380 int remain = fw->size - (*fw_ptr - fw->data);
1381
1382 /* The first byte indicates the types of the patch command or event.
1383 * 0x01 means HCI command and 0x02 is HCI event. If the first bytes
1384 * in the current firmware buffer doesn't start with 0x01 or
1385 * the size of remain buffer is smaller than HCI command header,
1386 * the firmware file is corrupted and it should stop the patching
1387 * process.
1388 */
1389 if (remain > HCI_COMMAND_HDR_SIZE && *fw_ptr[0] != 0x01) {
1390 BT_ERR("%s Intel fw corrupted: invalid cmd read", hdev->name);
1391 return -EINVAL;
1392 }
1393 (*fw_ptr)++;
1394 remain--;
1395
1396 cmd = (struct hci_command_hdr *)(*fw_ptr);
1397 *fw_ptr += sizeof(*cmd);
1398 remain -= sizeof(*cmd);
1399
1400 /* Ensure that the remain firmware data is long enough than the length
1401 * of command parameter. If not, the firmware file is corrupted.
1402 */
1403 if (remain < cmd->plen) {
1404 BT_ERR("%s Intel fw corrupted: invalid cmd len", hdev->name);
1405 return -EFAULT;
1406 }
1407
1408 /* If there is a command that loads a patch in the firmware
1409 * file, then enable the patch upon success, otherwise just
1410 * disable the manufacturer mode, for example patch activation
1411 * is not required when the default firmware patch file is used
1412 * because there are no patch data to load.
1413 */
1414 if (*disable_patch && le16_to_cpu(cmd->opcode) == 0xfc8e)
1415 *disable_patch = 0;
1416
1417 cmd_param = *fw_ptr;
1418 *fw_ptr += cmd->plen;
1419 remain -= cmd->plen;
1420
1421 /* This reads the expected events when the above command is sent to the
1422 * device. Some vendor commands expects more than one events, for
1423 * example command status event followed by vendor specific event.
1424 * For this case, it only keeps the last expected event. so the command
1425 * can be sent with __hci_cmd_sync_ev() which returns the sk_buff of
1426 * last expected event.
1427 */
1428 while (remain > HCI_EVENT_HDR_SIZE && *fw_ptr[0] == 0x02) {
1429 (*fw_ptr)++;
1430 remain--;
1431
1432 evt = (struct hci_event_hdr *)(*fw_ptr);
1433 *fw_ptr += sizeof(*evt);
1434 remain -= sizeof(*evt);
1435
1436 if (remain < evt->plen) {
1437 BT_ERR("%s Intel fw corrupted: invalid evt len",
1438 hdev->name);
1439 return -EFAULT;
1440 }
1441
1442 evt_param = *fw_ptr;
1443 *fw_ptr += evt->plen;
1444 remain -= evt->plen;
1445 }
1446
1447 /* Every HCI commands in the firmware file has its correspond event.
1448 * If event is not found or remain is smaller than zero, the firmware
1449 * file is corrupted.
1450 */
1451 if (!evt || !evt_param || remain < 0) {
1452 BT_ERR("%s Intel fw corrupted: invalid evt read", hdev->name);
1453 return -EFAULT;
1454 }
1455
1456 skb = __hci_cmd_sync_ev(hdev, le16_to_cpu(cmd->opcode), cmd->plen,
1457 cmd_param, evt->evt, HCI_INIT_TIMEOUT);
1458 if (IS_ERR(skb)) {
1459 BT_ERR("%s sending Intel patch command (0x%4.4x) failed (%ld)",
1460 hdev->name, cmd->opcode, PTR_ERR(skb));
d9c78e97 1461 return PTR_ERR(skb);
dffd30ee
THJA		 1462 }
1463
1464 /* It ensures that the returned event matches the event data read from
1465 * the firmware file. At fist, it checks the length and then
1466 * the contents of the event.
1467 */
1468 if (skb->len != evt->plen) {
1469 BT_ERR("%s mismatch event length (opcode 0x%4.4x)", hdev->name,
1470 le16_to_cpu(cmd->opcode));
1471 kfree_skb(skb);
1472 return -EFAULT;
1473 }
1474
1475 if (memcmp(skb->data, evt_param, evt->plen)) {
1476 BT_ERR("%s mismatch event parameter (opcode 0x%4.4x)",
1477 hdev->name, le16_to_cpu(cmd->opcode));
1478 kfree_skb(skb);
1479 return -EFAULT;
1480 }
1481 kfree_skb(skb);
1482
1483 return 0;
1484}
1485
40cb0984
MH		 1486#define BDADDR_INTEL (&(bdaddr_t) {{0x00, 0x8b, 0x9e, 0x19, 0x03, 0x00}})
1487
1488static int btusb_check_bdaddr_intel(struct hci_dev *hdev)
1489{
1490 struct sk_buff *skb;
1491 struct hci_rp_read_bd_addr *rp;
1492
1493 skb = __hci_cmd_sync(hdev, HCI_OP_READ_BD_ADDR, 0, NULL,
1494 HCI_INIT_TIMEOUT);
1495 if (IS_ERR(skb)) {
1496 BT_ERR("%s reading Intel device address failed (%ld)",
1497 hdev->name, PTR_ERR(skb));
1498 return PTR_ERR(skb);
1499 }
1500
1501 if (skb->len != sizeof(*rp)) {
1502 BT_ERR("%s Intel device address length mismatch", hdev->name);
1503 kfree_skb(skb);
1504 return -EIO;
1505 }
1506
89e7533d 1507 rp = (struct hci_rp_read_bd_addr *)skb->data;
40cb0984
MH		 1508 if (rp->status) {
1509 BT_ERR("%s Intel device address result failed (%02x)",
1510 hdev->name, rp->status);
1511 kfree_skb(skb);
1512 return -bt_to_errno(rp->status);
1513 }
1514
1515 /* For some Intel based controllers, the default Bluetooth device
1516 * address 00:03:19:9E:8B:00 can be found. These controllers are
1517 * fully operational, but have the danger of duplicate addresses
1518 * and that in turn can cause problems with Bluetooth operation.
1519 */
4739b5b1 1520 if (!bacmp(&rp->bdaddr, BDADDR_INTEL)) {
40cb0984
MH		 1521 BT_ERR("%s found Intel default device address (%pMR)",
1522 hdev->name, &rp->bdaddr);
4739b5b1
MH		 1523 set_bit(HCI_QUIRK_INVALID_BDADDR, &hdev->quirks);
1524 }
40cb0984
MH		 1525
1526 kfree_skb(skb);
1527
1528 return 0;
1529}
1530
dffd30ee
THJA		 1531static int btusb_setup_intel(struct hci_dev *hdev)
1532{
1533 struct sk_buff *skb;
1534 const struct firmware *fw;
1535 const u8 *fw_ptr;
1536 int disable_patch;
1537 struct intel_version *ver;
1538
1539 const u8 mfg_enable[] = { 0x01, 0x00 };
1540 const u8 mfg_disable[] = { 0x00, 0x00 };
1541 const u8 mfg_reset_deactivate[] = { 0x00, 0x01 };
1542 const u8 mfg_reset_activate[] = { 0x00, 0x02 };
1543
1544 BT_DBG("%s", hdev->name);
1545
1546 /* The controller has a bug with the first HCI command sent to it
1547 * returning number of completed commands as zero. This would stall the
1548 * command processing in the Bluetooth core.
1549 *
1550 * As a workaround, send HCI Reset command first which will reset the
1551 * number of completed commands and allow normal command processing
1552 * from now on.
1553 */
1554 skb = __hci_cmd_sync(hdev, HCI_OP_RESET, 0, NULL, HCI_INIT_TIMEOUT);
1555 if (IS_ERR(skb)) {
1556 BT_ERR("%s sending initial HCI reset command failed (%ld)",
1557 hdev->name, PTR_ERR(skb));
d9c78e97 1558 return PTR_ERR(skb);
dffd30ee
THJA		 1559 }
1560 kfree_skb(skb);
1561
1562 /* Read Intel specific controller version first to allow selection of
1563 * which firmware file to load.
1564 *
1565 * The returned information are hardware variant and revision plus
1566 * firmware variant, revision and build number.
1567 */
1568 skb = __hci_cmd_sync(hdev, 0xfc05, 0, NULL, HCI_INIT_TIMEOUT);
1569 if (IS_ERR(skb)) {
1570 BT_ERR("%s reading Intel fw version command failed (%ld)",
1571 hdev->name, PTR_ERR(skb));
d9c78e97 1572 return PTR_ERR(skb);
dffd30ee
THJA		 1573 }
1574
1575 if (skb->len != sizeof(*ver)) {
1576 BT_ERR("%s Intel version event length mismatch", hdev->name);
1577 kfree_skb(skb);
1578 return -EIO;
1579 }
1580
1581 ver = (struct intel_version *)skb->data;
1582 if (ver->status) {
1583 BT_ERR("%s Intel fw version event failed (%02x)", hdev->name,
1584 ver->status);
1585 kfree_skb(skb);
1586 return -bt_to_errno(ver->status);
1587 }
1588
1589 BT_INFO("%s: read Intel version: %02x%02x%02x%02x%02x%02x%02x%02x%02x",
1590 hdev->name, ver->hw_platform, ver->hw_variant,
1591 ver->hw_revision, ver->fw_variant, ver->fw_revision,
1592 ver->fw_build_num, ver->fw_build_ww, ver->fw_build_yy,
1593 ver->fw_patch_num);
1594
1595 /* fw_patch_num indicates the version of patch the device currently
1596 * have. If there is no patch data in the device, it is always 0x00.
1597 * So, if it is other than 0x00, no need to patch the deivce again.
1598 */
1599 if (ver->fw_patch_num) {
1600 BT_INFO("%s: Intel device is already patched. patch num: %02x",
1601 hdev->name, ver->fw_patch_num);
1602 kfree_skb(skb);
40cb0984 1603 btusb_check_bdaddr_intel(hdev);
dffd30ee
THJA		 1604 return 0;
1605 }
1606
1607 /* Opens the firmware patch file based on the firmware version read
1608 * from the controller. If it fails to open the matching firmware
1609 * patch file, it tries to open the default firmware patch file.
1610 * If no patch file is found, allow the device to operate without
1611 * a patch.
1612 */
1613 fw = btusb_setup_intel_get_fw(hdev, ver);
1614 if (!fw) {
1615 kfree_skb(skb);
40cb0984 1616 btusb_check_bdaddr_intel(hdev);
dffd30ee
THJA		 1617 return 0;
1618 }
1619 fw_ptr = fw->data;
1620
1621 /* This Intel specific command enables the manufacturer mode of the
1622 * controller.
1623 *
1624 * Only while this mode is enabled, the driver can download the
1625 * firmware patch data and configuration parameters.
1626 */
1627 skb = __hci_cmd_sync(hdev, 0xfc11, 2, mfg_enable, HCI_INIT_TIMEOUT);
1628 if (IS_ERR(skb)) {
1629 BT_ERR("%s entering Intel manufacturer mode failed (%ld)",
1630 hdev->name, PTR_ERR(skb));
1631 release_firmware(fw);
d9c78e97 1632 return PTR_ERR(skb);
dffd30ee
THJA		 1633 }
1634
1635 if (skb->data[0]) {
1636 u8 evt_status = skb->data[0];
89e7533d 1637
dffd30ee
THJA		 1638 BT_ERR("%s enable Intel manufacturer mode event failed (%02x)",
1639 hdev->name, evt_status);
1640 kfree_skb(skb);
1641 release_firmware(fw);
1642 return -bt_to_errno(evt_status);
1643 }
1644 kfree_skb(skb);
1645
1646 disable_patch = 1;
1647
1648 /* The firmware data file consists of list of Intel specific HCI
1649 * commands and its expected events. The first byte indicates the
1650 * type of the message, either HCI command or HCI event.
1651 *
1652 * It reads the command and its expected event from the firmware file,
1653 * and send to the controller. Once __hci_cmd_sync_ev() returns,
1654 * the returned event is compared with the event read from the firmware
1655 * file and it will continue until all the messages are downloaded to
1656 * the controller.
1657 *
1658 * Once the firmware patching is completed successfully,
1659 * the manufacturer mode is disabled with reset and activating the
1660 * downloaded patch.
1661 *
1662 * If the firmware patching fails, the manufacturer mode is
1663 * disabled with reset and deactivating the patch.
1664 *
1665 * If the default patch file is used, no reset is done when disabling
1666 * the manufacturer.
1667 */
1668 while (fw->size > fw_ptr - fw->data) {
1669 int ret;
1670
1671 ret = btusb_setup_intel_patching(hdev, fw, &fw_ptr,
1672 &disable_patch);
1673 if (ret < 0)
1674 goto exit_mfg_deactivate;
1675 }
1676
1677 release_firmware(fw);
1678
1679 if (disable_patch)
1680 goto exit_mfg_disable;
1681
1682 /* Patching completed successfully and disable the manufacturer mode
1683 * with reset and activate the downloaded firmware patches.
1684 */
1685 skb = __hci_cmd_sync(hdev, 0xfc11, sizeof(mfg_reset_activate),
1686 mfg_reset_activate, HCI_INIT_TIMEOUT);
1687 if (IS_ERR(skb)) {
1688 BT_ERR("%s exiting Intel manufacturer mode failed (%ld)",
1689 hdev->name, PTR_ERR(skb));
d9c78e97 1690 return PTR_ERR(skb);
dffd30ee
THJA		 1691 }
1692 kfree_skb(skb);
1693
1694 BT_INFO("%s: Intel Bluetooth firmware patch completed and activated",
1695 hdev->name);
1696
40cb0984 1697 btusb_check_bdaddr_intel(hdev);
dffd30ee
THJA		 1698 return 0;
1699
1700exit_mfg_disable:
1701 /* Disable the manufacturer mode without reset */
1702 skb = __hci_cmd_sync(hdev, 0xfc11, sizeof(mfg_disable), mfg_disable,
1703 HCI_INIT_TIMEOUT);
1704 if (IS_ERR(skb)) {
1705 BT_ERR("%s exiting Intel manufacturer mode failed (%ld)",
1706 hdev->name, PTR_ERR(skb));
d9c78e97 1707 return PTR_ERR(skb);
dffd30ee
THJA		 1708 }
1709 kfree_skb(skb);
1710
1711 BT_INFO("%s: Intel Bluetooth firmware patch completed", hdev->name);
40cb0984
MH		 1712
1713 btusb_check_bdaddr_intel(hdev);
dffd30ee
THJA		 1714 return 0;
1715
1716exit_mfg_deactivate:
1717 release_firmware(fw);
1718
1719 /* Patching failed. Disable the manufacturer mode with reset and
1720 * deactivate the downloaded firmware patches.
1721 */
1722 skb = __hci_cmd_sync(hdev, 0xfc11, sizeof(mfg_reset_deactivate),
1723 mfg_reset_deactivate, HCI_INIT_TIMEOUT);
1724 if (IS_ERR(skb)) {
1725 BT_ERR("%s exiting Intel manufacturer mode failed (%ld)",
1726 hdev->name, PTR_ERR(skb));
d9c78e97 1727 return PTR_ERR(skb);
dffd30ee
THJA		 1728 }
1729 kfree_skb(skb);
1730
1731 BT_INFO("%s: Intel Bluetooth firmware patch completed and deactivated",
1732 hdev->name);
1733
40cb0984 1734 btusb_check_bdaddr_intel(hdev);
dffd30ee
THJA		 1735 return 0;
1736}
1737
cda0dd78
MH		 1738static int inject_cmd_complete(struct hci_dev *hdev, __u16 opcode)
1739{
1740 struct sk_buff *skb;
1741 struct hci_event_hdr *hdr;
1742 struct hci_ev_cmd_complete *evt;
1743
1744 skb = bt_skb_alloc(sizeof(*hdr) + sizeof(*evt) + 1, GFP_ATOMIC);
1745 if (!skb)
1746 return -ENOMEM;
1747
1748 hdr = (struct hci_event_hdr *)skb_put(skb, sizeof(*hdr));
1749 hdr->evt = HCI_EV_CMD_COMPLETE;
1750 hdr->plen = sizeof(*evt) + 1;
1751
1752 evt = (struct hci_ev_cmd_complete *)skb_put(skb, sizeof(*evt));
1753 evt->ncmd = 0x01;
1754 evt->opcode = cpu_to_le16(opcode);
1755
1756 *skb_put(skb, 1) = 0x00;
1757
1758 bt_cb(skb)->pkt_type = HCI_EVENT_PKT;
1759
1760 return hci_recv_frame(hdev, skb);
1761}
1762
1763static int btusb_recv_bulk_intel(struct btusb_data *data, void *buffer,
1764 int count)
1765{
1766 /* When the device is in bootloader mode, then it can send
1767 * events via the bulk endpoint. These events are treated the
1768 * same way as the ones received from the interrupt endpoint.
1769 */
1770 if (test_bit(BTUSB_BOOTLOADER, &data->flags))
1771 return btusb_recv_intr(data, buffer, count);
1772
1773 return btusb_recv_bulk(data, buffer, count);
1774}
1775
1776static int btusb_recv_event_intel(struct hci_dev *hdev, struct sk_buff *skb)
1777{
1778 struct btusb_data *data = hci_get_drvdata(hdev);
1779
1780 if (test_bit(BTUSB_BOOTLOADER, &data->flags)) {
1781 struct hci_event_hdr *hdr = (void *)skb->data;
1782
1783 /* When the firmware loading completes the device sends
1784 * out a vendor specific event indicating the result of
1785 * the firmware loading.
1786 */
1787 if (skb->len == 7 && hdr->evt == 0xff && hdr->plen == 0x05 &&
1788 skb->data[2] == 0x06) {
1789 if (skb->data[3] != 0x00)
1790 test_bit(BTUSB_FIRMWARE_FAILED, &data->flags);
1791
ce6bb929
MH		 1792 if (test_and_clear_bit(BTUSB_DOWNLOADING,
1793 &data->flags) &&
1794 test_bit(BTUSB_FIRMWARE_LOADED, &data->flags))
cda0dd78
MH		 1795 wake_up_interruptible(&hdev->req_wait_q);
1796 }
1797
1798 /* When switching to the operational firmware the device
1799 * sends a vendor specific event indicating that the bootup
1800 * completed.
1801 */
1802 if (skb->len == 9 && hdr->evt == 0xff && hdr->plen == 0x07 &&
1803 skb->data[2] == 0x02) {
1804 if (test_and_clear_bit(BTUSB_BOOTING, &data->flags))
1805 wake_up_interruptible(&hdev->req_wait_q);
1806 }
1807 }
1808
1809 return hci_recv_frame(hdev, skb);
1810}
1811
1812static int btusb_send_frame_intel(struct hci_dev *hdev, struct sk_buff *skb)
1813{
1814 struct btusb_data *data = hci_get_drvdata(hdev);
1815 struct urb *urb;
1816
1817 BT_DBG("%s", hdev->name);
1818
1819 if (!test_bit(HCI_RUNNING, &hdev->flags))
1820 return -EBUSY;
1821
1822 switch (bt_cb(skb)->pkt_type) {
1823 case HCI_COMMAND_PKT:
1824 if (test_bit(BTUSB_BOOTLOADER, &data->flags)) {
1825 struct hci_command_hdr *cmd = (void *)skb->data;
1826 __u16 opcode = le16_to_cpu(cmd->opcode);
1827
1828 /* When in bootloader mode and the command 0xfc09
1829 * is received, it needs to be send down the
1830 * bulk endpoint. So allocate a bulk URB instead.
1831 */
1832 if (opcode == 0xfc09)
1833 urb = alloc_bulk_urb(hdev, skb);
1834 else
1835 urb = alloc_ctrl_urb(hdev, skb);
1836
1837 /* When the 0xfc01 command is issued to boot into
1838 * the operational firmware, it will actually not
1839 * send a command complete event. To keep the flow
1840 * control working inject that event here.
1841 */
1842 if (opcode == 0xfc01)
1843 inject_cmd_complete(hdev, opcode);
1844 } else {
1845 urb = alloc_ctrl_urb(hdev, skb);
1846 }
1847 if (IS_ERR(urb))
1848 return PTR_ERR(urb);
1849
1850 hdev->stat.cmd_tx++;
1851 return submit_or_queue_tx_urb(hdev, urb);
1852
1853 case HCI_ACLDATA_PKT:
1854 urb = alloc_bulk_urb(hdev, skb);
1855 if (IS_ERR(urb))
1856 return PTR_ERR(urb);
1857
1858 hdev->stat.acl_tx++;
1859 return submit_or_queue_tx_urb(hdev, urb);
1860
1861 case HCI_SCODATA_PKT:
1862 if (hci_conn_num(hdev, SCO_LINK) < 1)
1863 return -ENODEV;
1864
1865 urb = alloc_isoc_urb(hdev, skb);
1866 if (IS_ERR(urb))
1867 return PTR_ERR(urb);
1868
1869 hdev->stat.sco_tx++;
1870 return submit_tx_urb(hdev, urb);
1871 }
1872
1873 return -EILSEQ;
1874}
1875
1876static int btusb_intel_secure_send(struct hci_dev *hdev, u8 fragment_type,
1877 u32 plen, const void *param)
1878{
1879 while (plen > 0) {
1880 struct sk_buff *skb;
1881 u8 cmd_param[253], fragment_len = (plen > 252) ? 252 : plen;
1882
1883 cmd_param[0] = fragment_type;
1884 memcpy(cmd_param + 1, param, fragment_len);
1885
1886 skb = __hci_cmd_sync(hdev, 0xfc09, fragment_len + 1,
1887 cmd_param, HCI_INIT_TIMEOUT);
1888 if (IS_ERR(skb))
1889 return PTR_ERR(skb);
1890
1891 kfree_skb(skb);
1892
1893 plen -= fragment_len;
1894 param += fragment_len;
1895 }
1896
1897 return 0;
1898}
1899
1900static void btusb_intel_version_info(struct hci_dev *hdev,
1901 struct intel_version *ver)
1902{
1903 const char *variant;
1904
1905 switch (ver->fw_variant) {
1906 case 0x06:
1907 variant = "Bootloader";
1908 break;
1909 case 0x23:
1910 variant = "Firmware";
1911 break;
1912 default:
1913 return;
1914 }
1915
1916 BT_INFO("%s: %s revision %u.%u build %u week %u %u", hdev->name,
1917 variant, ver->fw_revision >> 4, ver->fw_revision & 0x0f,
1918 ver->fw_build_num, ver->fw_build_ww, 2000 + ver->fw_build_yy);
1919}
1920
1921static int btusb_setup_intel_new(struct hci_dev *hdev)
1922{
1923 static const u8 reset_param[] = { 0x00, 0x01, 0x00, 0x01,
1924 0x00, 0x08, 0x04, 0x00 };
1925 struct btusb_data *data = hci_get_drvdata(hdev);
1926 struct sk_buff *skb;
1927 struct intel_version *ver;
1928 struct intel_boot_params *params;
1929 const struct firmware *fw;
1930 const u8 *fw_ptr;
1931 char fwname[64];
1932 ktime_t calltime, delta, rettime;
1933 unsigned long long duration;
1934 int err;
1935
1936 BT_DBG("%s", hdev->name);
1937
1938 calltime = ktime_get();
1939
1940 /* Read the Intel version information to determine if the device
1941 * is in bootloader mode or if it already has operational firmware
1942 * loaded.
1943 */
1944 skb = __hci_cmd_sync(hdev, 0xfc05, 0, NULL, HCI_INIT_TIMEOUT);
1945 if (IS_ERR(skb)) {
1946 BT_ERR("%s: Reading Intel version information failed (%ld)",
1947 hdev->name, PTR_ERR(skb));
1948 return PTR_ERR(skb);
1949 }
1950
1951 if (skb->len != sizeof(*ver)) {
1952 BT_ERR("%s: Intel version event size mismatch", hdev->name);
1953 kfree_skb(skb);
1954 return -EILSEQ;
1955 }
1956
1957 ver = (struct intel_version *)skb->data;
1958 if (ver->status) {
1959 BT_ERR("%s: Intel version command failure (%02x)",
1960 hdev->name, ver->status);
1961 err = -bt_to_errno(ver->status);
1962 kfree_skb(skb);
1963 return err;
1964 }
1965
1966 /* The hardware platform number has a fixed value of 0x37 and
1967 * for now only accept this single value.
1968 */
1969 if (ver->hw_platform != 0x37) {
1970 BT_ERR("%s: Unsupported Intel hardware platform (%u)",
1971 hdev->name, ver->hw_platform);
1972 kfree_skb(skb);
1973 return -EINVAL;
1974 }
1975
1976 /* At the moment only the hardware variant iBT 3.0 (LnP/SfP) is
1977 * supported by this firmware loading method. This check has been
1978 * put in place to ensure correct forward compatibility options
1979 * when newer hardware variants come along.
1980 */
1981 if (ver->hw_variant != 0x0b) {
1982 BT_ERR("%s: Unsupported Intel hardware variant (%u)",
1983 hdev->name, ver->hw_variant);
1984 kfree_skb(skb);
1985 return -EINVAL;
1986 }
1987
1988 btusb_intel_version_info(hdev, ver);
1989
1990 /* The firmware variant determines if the device is in bootloader
1991 * mode or is running operational firmware. The value 0x06 identifies
1992 * the bootloader and the value 0x23 identifies the operational
1993 * firmware.
1994 *
1995 * When the operational firmware is already present, then only
1996 * the check for valid Bluetooth device address is needed. This
1997 * determines if the device will be added as configured or
1998 * unconfigured controller.
1999 *
2000 * It is not possible to use the Secure Boot Parameters in this
2001 * case since that command is only available in bootloader mode.
2002 */
2003 if (ver->fw_variant == 0x23) {
2004 kfree_skb(skb);
2005 clear_bit(BTUSB_BOOTLOADER, &data->flags);
2006 btusb_check_bdaddr_intel(hdev);
2007 return 0;
2008 }
2009
2010 /* If the device is not in bootloader mode, then the only possible
2011 * choice is to return an error and abort the device initialization.
2012 */
2013 if (ver->fw_variant != 0x06) {
2014 BT_ERR("%s: Unsupported Intel firmware variant (%u)",
2015 hdev->name, ver->fw_variant);
2016 kfree_skb(skb);
2017 return -ENODEV;
2018 }
2019
2020 kfree_skb(skb);
2021
2022 /* Read the secure boot parameters to identify the operating
2023 * details of the bootloader.
2024 */
2025 skb = __hci_cmd_sync(hdev, 0xfc0d, 0, NULL, HCI_INIT_TIMEOUT);
2026 if (IS_ERR(skb)) {
2027 BT_ERR("%s: Reading Intel boot parameters failed (%ld)",
2028 hdev->name, PTR_ERR(skb));
2029 return PTR_ERR(skb);
2030 }
2031
2032 if (skb->len != sizeof(*params)) {
2033 BT_ERR("%s: Intel boot parameters size mismatch", hdev->name);
2034 kfree_skb(skb);
2035 return -EILSEQ;
2036 }
2037
2038 params = (struct intel_boot_params *)skb->data;
2039 if (params->status) {
2040 BT_ERR("%s: Intel boot parameters command failure (%02x)",
2041 hdev->name, params->status);
2042 err = -bt_to_errno(params->status);
2043 kfree_skb(skb);
2044 return err;
2045 }
2046
2047 BT_INFO("%s: Device revision is %u", hdev->name,
2048 le16_to_cpu(params->dev_revid));
2049
2050 BT_INFO("%s: Secure boot is %s", hdev->name,
2051 params->secure_boot ? "enabled" : "disabled");
2052
2053 BT_INFO("%s: Minimum firmware build %u week %u %u", hdev->name,
2054 params->min_fw_build_nn, params->min_fw_build_cw,
2055 2000 + params->min_fw_build_yy);
2056
2057 /* It is required that every single firmware fragment is acknowledged
2058 * with a command complete event. If the boot parameters indicate
2059 * that this bootloader does not send them, then abort the setup.
2060 */
2061 if (params->limited_cce != 0x00) {
2062 BT_ERR("%s: Unsupported Intel firmware loading method (%u)",
2063 hdev->name, params->limited_cce);
2064 kfree_skb(skb);
2065 return -EINVAL;
2066 }
2067
2068 /* If the OTP has no valid Bluetooth device address, then there will
2069 * also be no valid address for the operational firmware.
2070 */
2071 if (!bacmp(&params->otp_bdaddr, BDADDR_ANY)) {
2072 BT_INFO("%s: No device address configured", hdev->name);
2073 set_bit(HCI_QUIRK_INVALID_BDADDR, &hdev->quirks);
2074 }
2075
2076 /* With this Intel bootloader only the hardware variant and device
2077 * revision information are used to select the right firmware.
2078 *
2079 * Currently this bootloader support is limited to hardware variant
2080 * iBT 3.0 (LnP/SfP) which is identified by the value 11 (0x0b).
2081 */
2082 snprintf(fwname, sizeof(fwname), "intel/ibt-11-%u.sfi",
2083 le16_to_cpu(params->dev_revid));
2084
2085 err = request_firmware(&fw, fwname, &hdev->dev);
2086 if (err < 0) {
2087 BT_ERR("%s: Failed to load Intel firmware file (%d)",
2088 hdev->name, err);
2089 kfree_skb(skb);
2090 return err;
2091 }
2092
2093 BT_INFO("%s: Found device firmware: %s", hdev->name, fwname);
2094
2095 kfree_skb(skb);
2096
2097 if (fw->size < 644) {
2098 BT_ERR("%s: Invalid size of firmware file (%zu)",
2099 hdev->name, fw->size);
2100 err = -EBADF;
2101 goto done;
2102 }
2103
2104 set_bit(BTUSB_DOWNLOADING, &data->flags);
2105
2106 /* Start the firmware download transaction with the Init fragment
2107 * represented by the 128 bytes of CSS header.
2108 */
2109 err = btusb_intel_secure_send(hdev, 0x00, 128, fw->data);
2110 if (err < 0) {
2111 BT_ERR("%s: Failed to send firmware header (%d)",
2112 hdev->name, err);
2113 goto done;
2114 }
2115
2116 /* Send the 256 bytes of public key information from the firmware
2117 * as the PKey fragment.
2118 */
2119 err = btusb_intel_secure_send(hdev, 0x03, 256, fw->data + 128);
2120 if (err < 0) {
2121 BT_ERR("%s: Failed to send firmware public key (%d)",
2122 hdev->name, err);
2123 goto done;
2124 }
2125
2126 /* Send the 256 bytes of signature information from the firmware
2127 * as the Sign fragment.
2128 */
2129 err = btusb_intel_secure_send(hdev, 0x02, 256, fw->data + 388);
2130 if (err < 0) {
2131 BT_ERR("%s: Failed to send firmware signature (%d)",
2132 hdev->name, err);
2133 goto done;
2134 }
2135
2136 fw_ptr = fw->data + 644;
2137
2138 while (fw_ptr - fw->data < fw->size) {
2139 struct hci_command_hdr *cmd = (void *)fw_ptr;
2140 u8 cmd_len;
2141
2142 cmd_len = sizeof(*cmd) + cmd->plen;
2143
2144 /* Send each command from the firmware data buffer as
2145 * a single Data fragment.
2146 */
2147 err = btusb_intel_secure_send(hdev, 0x01, cmd_len, fw_ptr);
2148 if (err < 0) {
2149 BT_ERR("%s: Failed to send firmware data (%d)",
2150 hdev->name, err);
2151 goto done;
2152 }
2153
2154 fw_ptr += cmd_len;
2155 }
2156
ce6bb929
MH		 2157 set_bit(BTUSB_FIRMWARE_LOADED, &data->flags);
2158
cda0dd78
MH		 2159 /* Before switching the device into operational mode and with that
2160 * booting the loaded firmware, wait for the bootloader notification
2161 * that all fragments have been successfully received.
2162 *
2163 * When the event processing receives the notification, then this
2164 * flag will be cleared. So just in case that happens really quickly,
2165 * check it first before adding the wait queue.
2166 */
2167 if (test_bit(BTUSB_DOWNLOADING, &data->flags)) {
2168 DECLARE_WAITQUEUE(wait, current);
2169 signed long timeout;
2170
2171 BT_INFO("%s: Waiting for firmware download to complete",
2172 hdev->name);
2173
2174 add_wait_queue(&hdev->req_wait_q, &wait);
2175 set_current_state(TASK_INTERRUPTIBLE);
2176
2177 /* The firmware loading should not take longer than 5 seconds
2178 * and thus just timeout if that happens and fail the setup
2179 * of this device.
2180 */
2181 timeout = schedule_timeout(msecs_to_jiffies(5000));
2182
2183 remove_wait_queue(&hdev->req_wait_q, &wait);
2184
2185 if (signal_pending(current)) {
2186 BT_ERR("%s: Firmware loading interrupted", hdev->name);
2187 err = -EINTR;
2188 goto done;
2189 }
2190
2191 if (!timeout) {
2192 BT_ERR("%s: Firmware loading timeout", hdev->name);
2193 err = -ETIMEDOUT;
2194 goto done;
2195 }
2196 }
2197
2198 if (test_bit(BTUSB_FIRMWARE_FAILED, &data->flags)) {
2199 BT_ERR("%s: Firmware loading failed", hdev->name);
2200 err = -ENOEXEC;
2201 goto done;
2202 }
2203
2204 rettime = ktime_get();
2205 delta = ktime_sub(rettime, calltime);
2206 duration = (unsigned long long) ktime_to_ns(delta) >> 10;
2207
2208 BT_INFO("%s: Firmware loaded in %llu usecs", hdev->name, duration);
2209
2210done:
2211 release_firmware(fw);
2212
2213 if (err < 0)
2214 return err;
2215
2216 calltime = ktime_get();
2217
2218 set_bit(BTUSB_BOOTING, &data->flags);
2219
2220 skb = __hci_cmd_sync(hdev, 0xfc01, sizeof(reset_param), reset_param,
2221 HCI_INIT_TIMEOUT);
2222 if (IS_ERR(skb))
2223 return PTR_ERR(skb);
2224
2225 kfree_skb(skb);
2226
2227 /* The bootloader will not indicate when the device is ready. This
2228 * is done by the operational firmware sending bootup notification.
2229 */
2230 if (test_bit(BTUSB_BOOTING, &data->flags)) {
2231 DECLARE_WAITQUEUE(wait, current);
2232 signed long timeout;
2233
2234 BT_INFO("%s: Waiting for device to boot", hdev->name);
2235
2236 add_wait_queue(&hdev->req_wait_q, &wait);
2237 set_current_state(TASK_INTERRUPTIBLE);
2238
2239 /* Booting into operational firmware should not take
2240 * longer than 1 second. However if that happens, then
2241 * just fail the setup since something went wrong.
2242 */
2243 timeout = schedule_timeout(msecs_to_jiffies(1000));
2244
2245 remove_wait_queue(&hdev->req_wait_q, &wait);
2246
2247 if (signal_pending(current)) {
2248 BT_ERR("%s: Device boot interrupted", hdev->name);
2249 return -EINTR;
2250 }
2251
2252 if (!timeout) {
2253 BT_ERR("%s: Device boot timeout", hdev->name);
2254 return -ETIMEDOUT;
2255 }
2256 }
2257
2258 rettime = ktime_get();
2259 delta = ktime_sub(rettime, calltime);
2260 duration = (unsigned long long) ktime_to_ns(delta) >> 10;
2261
2262 BT_INFO("%s: Device booted in %llu usecs", hdev->name, duration);
2263
2264 clear_bit(BTUSB_BOOTLOADER, &data->flags);
2265
2266 return 0;
2267}
2268
385a768c
MH		 2269static void btusb_hw_error_intel(struct hci_dev *hdev, u8 code)
2270{
2271 struct sk_buff *skb;
2272 u8 type = 0x00;
2273
2274 BT_ERR("%s: Hardware error 0x%2.2x", hdev->name, code);
2275
2276 skb = __hci_cmd_sync(hdev, HCI_OP_RESET, 0, NULL, HCI_INIT_TIMEOUT);
2277 if (IS_ERR(skb)) {
2278 BT_ERR("%s: Reset after hardware error failed (%ld)",
2279 hdev->name, PTR_ERR(skb));
2280 return;
2281 }
2282 kfree_skb(skb);
2283
2284 skb = __hci_cmd_sync(hdev, 0xfc22, 1, &type, HCI_INIT_TIMEOUT);
2285 if (IS_ERR(skb)) {
2286 BT_ERR("%s: Retrieving Intel exception info failed (%ld)",
2287 hdev->name, PTR_ERR(skb));
2288 return;
2289 }
2290
2291 if (skb->len != 13) {
2292 BT_ERR("%s: Exception info size mismatch", hdev->name);
2293 kfree_skb(skb);
2294 return;
2295 }
2296
2297 if (skb->data[0] != 0x00) {
2298 BT_ERR("%s: Exception info command failure (%02x)",
2299 hdev->name, skb->data[0]);
2300 kfree_skb(skb);
2301 return;
2302 }
2303
2304 BT_ERR("%s: Exception info %s", hdev->name, (char *)(skb->data + 1));
2305
2306 kfree_skb(skb);
2307}
2308
cb8d6597
MH		 2309static int btusb_set_bdaddr_intel(struct hci_dev *hdev, const bdaddr_t *bdaddr)
2310{
2311 struct sk_buff *skb;
2312 long ret;
2313
2314 skb = __hci_cmd_sync(hdev, 0xfc31, 6, bdaddr, HCI_INIT_TIMEOUT);
2315 if (IS_ERR(skb)) {
2316 ret = PTR_ERR(skb);
2317 BT_ERR("%s: changing Intel device address failed (%ld)",
89e7533d 2318 hdev->name, ret);
cb8d6597
MH		 2319 return ret;
2320 }
2321 kfree_skb(skb);
2322
2323 return 0;
2324}
2325
ae8df494
AK		 2326static int btusb_set_bdaddr_marvell(struct hci_dev *hdev,
2327 const bdaddr_t *bdaddr)
2328{
2329 struct sk_buff *skb;
2330 u8 buf[8];
2331 long ret;
2332
2333 buf[0] = 0xfe;
2334 buf[1] = sizeof(bdaddr_t);
2335 memcpy(buf + 2, bdaddr, sizeof(bdaddr_t));
2336
2337 skb = __hci_cmd_sync(hdev, 0xfc22, sizeof(buf), buf, HCI_INIT_TIMEOUT);
2338 if (IS_ERR(skb)) {
2339 ret = PTR_ERR(skb);
2340 BT_ERR("%s: changing Marvell device address failed (%ld)",
2341 hdev->name, ret);
2342 return ret;
2343 }
2344 kfree_skb(skb);
2345
2346 return 0;
2347}
2348
c8abb73f
MH		 2349#define BDADDR_BCM20702A0 (&(bdaddr_t) {{0x00, 0xa0, 0x02, 0x70, 0x20, 0x00}})
2350
10d4c673
PG		 2351static int btusb_setup_bcm_patchram(struct hci_dev *hdev)
2352{
2353 struct btusb_data *data = hci_get_drvdata(hdev);
2354 struct usb_device *udev = data->udev;
2355 char fw_name[64];
2356 const struct firmware *fw;
2357 const u8 *fw_ptr;
2358 size_t fw_size;
2359 const struct hci_command_hdr *cmd;
2360 const u8 *cmd_param;
2361 u16 opcode;
2362 struct sk_buff *skb;
2363 struct hci_rp_read_local_version *ver;
c8abb73f 2364 struct hci_rp_read_bd_addr *bda;
10d4c673
PG		 2365 long ret;
2366
2367 snprintf(fw_name, sizeof(fw_name), "brcm/%s-%04x-%04x.hcd",
2368 udev->product ? udev->product : "BCM",
2369 le16_to_cpu(udev->descriptor.idVendor),
2370 le16_to_cpu(udev->descriptor.idProduct));
2371
2372 ret = request_firmware(&fw, fw_name, &hdev->dev);
2373 if (ret < 0) {
c8abb73f 2374 BT_INFO("%s: BCM: patch %s not found", hdev->name, fw_name);
10d4c673
PG		 2375 return 0;
2376 }
2377
2378 /* Reset */
2379 skb = __hci_cmd_sync(hdev, HCI_OP_RESET, 0, NULL, HCI_INIT_TIMEOUT);
2380 if (IS_ERR(skb)) {
2381 ret = PTR_ERR(skb);
2382 BT_ERR("%s: HCI_OP_RESET failed (%ld)", hdev->name, ret);
2383 goto done;
2384 }
2385 kfree_skb(skb);
2386
2387 /* Read Local Version Info */
2388 skb = __hci_cmd_sync(hdev, HCI_OP_READ_LOCAL_VERSION, 0, NULL,
2389 HCI_INIT_TIMEOUT);
2390 if (IS_ERR(skb)) {
2391 ret = PTR_ERR(skb);
2392 BT_ERR("%s: HCI_OP_READ_LOCAL_VERSION failed (%ld)",
89e7533d 2393 hdev->name, ret);
10d4c673
PG		 2394 goto done;
2395 }
2396
2397 if (skb->len != sizeof(*ver)) {
2398 BT_ERR("%s: HCI_OP_READ_LOCAL_VERSION event length mismatch",
89e7533d 2399 hdev->name);
10d4c673
PG		 2400 kfree_skb(skb);
2401 ret = -EIO;
2402 goto done;
2403 }
2404
89e7533d 2405 ver = (struct hci_rp_read_local_version *)skb->data;
10d4c673
PG		 2406 BT_INFO("%s: BCM: patching hci_ver=%02x hci_rev=%04x lmp_ver=%02x "
2407 "lmp_subver=%04x", hdev->name, ver->hci_ver, ver->hci_rev,
2408 ver->lmp_ver, ver->lmp_subver);
2409 kfree_skb(skb);
2410
2411 /* Start Download */
2412 skb = __hci_cmd_sync(hdev, 0xfc2e, 0, NULL, HCI_INIT_TIMEOUT);
2413 if (IS_ERR(skb)) {
2414 ret = PTR_ERR(skb);
2415 BT_ERR("%s: BCM: Download Minidrv command failed (%ld)",
89e7533d 2416 hdev->name, ret);
10d4c673
PG		 2417 goto reset_fw;
2418 }
2419 kfree_skb(skb);
2420
2421 /* 50 msec delay after Download Minidrv completes */
2422 msleep(50);
2423
2424 fw_ptr = fw->data;
2425 fw_size = fw->size;
2426
2427 while (fw_size >= sizeof(*cmd)) {
89e7533d 2428 cmd = (struct hci_command_hdr *)fw_ptr;
10d4c673
PG		 2429 fw_ptr += sizeof(*cmd);
2430 fw_size -= sizeof(*cmd);
2431
2432 if (fw_size < cmd->plen) {
2433 BT_ERR("%s: BCM: patch %s is corrupted",
89e7533d 2434 hdev->name, fw_name);
10d4c673
PG		 2435 ret = -EINVAL;
2436 goto reset_fw;
2437 }
2438
2439 cmd_param = fw_ptr;
2440 fw_ptr += cmd->plen;
2441 fw_size -= cmd->plen;
2442
2443 opcode = le16_to_cpu(cmd->opcode);
2444
2445 skb = __hci_cmd_sync(hdev, opcode, cmd->plen, cmd_param,
2446 HCI_INIT_TIMEOUT);
2447 if (IS_ERR(skb)) {
2448 ret = PTR_ERR(skb);
2449 BT_ERR("%s: BCM: patch command %04x failed (%ld)",
89e7533d 2450 hdev->name, opcode, ret);
10d4c673
PG		 2451 goto reset_fw;
2452 }
2453 kfree_skb(skb);
2454 }
2455
2456 /* 250 msec delay after Launch Ram completes */
2457 msleep(250);
2458
2459reset_fw:
2460 /* Reset */
2461 skb = __hci_cmd_sync(hdev, HCI_OP_RESET, 0, NULL, HCI_INIT_TIMEOUT);
2462 if (IS_ERR(skb)) {
2463 ret = PTR_ERR(skb);
2464 BT_ERR("%s: HCI_OP_RESET failed (%ld)", hdev->name, ret);
2465 goto done;
2466 }
2467 kfree_skb(skb);
2468
2469 /* Read Local Version Info */
2470 skb = __hci_cmd_sync(hdev, HCI_OP_READ_LOCAL_VERSION, 0, NULL,
2471 HCI_INIT_TIMEOUT);
2472 if (IS_ERR(skb)) {
2473 ret = PTR_ERR(skb);
2474 BT_ERR("%s: HCI_OP_READ_LOCAL_VERSION failed (%ld)",
89e7533d 2475 hdev->name, ret);
10d4c673
PG		 2476 goto done;
2477 }
2478
2479 if (skb->len != sizeof(*ver)) {
2480 BT_ERR("%s: HCI_OP_READ_LOCAL_VERSION event length mismatch",
89e7533d 2481 hdev->name);
10d4c673
PG		 2482 kfree_skb(skb);
2483 ret = -EIO;
2484 goto done;
2485 }
2486
89e7533d 2487 ver = (struct hci_rp_read_local_version *)skb->data;
10d4c673
PG		 2488 BT_INFO("%s: BCM: firmware hci_ver=%02x hci_rev=%04x lmp_ver=%02x "
2489 "lmp_subver=%04x", hdev->name, ver->hci_ver, ver->hci_rev,
2490 ver->lmp_ver, ver->lmp_subver);
2491 kfree_skb(skb);
2492
c8abb73f
MH		 2493 /* Read BD Address */
2494 skb = __hci_cmd_sync(hdev, HCI_OP_READ_BD_ADDR, 0, NULL,
2495 HCI_INIT_TIMEOUT);
2496 if (IS_ERR(skb)) {
2497 ret = PTR_ERR(skb);
2498 BT_ERR("%s: HCI_OP_READ_BD_ADDR failed (%ld)",
89e7533d 2499 hdev->name, ret);
c8abb73f
MH		 2500 goto done;
2501 }
2502
2503 if (skb->len != sizeof(*bda)) {
2504 BT_ERR("%s: HCI_OP_READ_BD_ADDR event length mismatch",
89e7533d 2505 hdev->name);
c8abb73f
MH		 2506 kfree_skb(skb);
2507 ret = -EIO;
2508 goto done;
2509 }
2510
89e7533d 2511 bda = (struct hci_rp_read_bd_addr *)skb->data;
c8abb73f
MH		 2512 if (bda->status) {
2513 BT_ERR("%s: HCI_OP_READ_BD_ADDR error status (%02x)",
2514 hdev->name, bda->status);
2515 kfree_skb(skb);
2516 ret = -bt_to_errno(bda->status);
2517 goto done;
2518 }
2519
2520 /* The address 00:20:70:02:A0:00 indicates a BCM20702A0 controller
2521 * with no configured address.
2522 */
849e5086 2523 if (!bacmp(&bda->bdaddr, BDADDR_BCM20702A0)) {
c8abb73f
MH		 2524 BT_INFO("%s: BCM: using default device address (%pMR)",
2525 hdev->name, &bda->bdaddr);
849e5086
MH		 2526 set_bit(HCI_QUIRK_INVALID_BDADDR, &hdev->quirks);
2527 }
c8abb73f
MH		 2528
2529 kfree_skb(skb);
2530
10d4c673
PG		 2531done:
2532 release_firmware(fw);
2533
2534 return ret;
2535}
2536
abbaf50e
MH		 2537static int btusb_set_bdaddr_bcm(struct hci_dev *hdev, const bdaddr_t *bdaddr)
2538{
2539 struct sk_buff *skb;
2540 long ret;
2541
2542 skb = __hci_cmd_sync(hdev, 0xfc01, 6, bdaddr, HCI_INIT_TIMEOUT);
2543 if (IS_ERR(skb)) {
2544 ret = PTR_ERR(skb);
2545 BT_ERR("%s: BCM: Change address command failed (%ld)",
89e7533d 2546 hdev->name, ret);
abbaf50e
MH		 2547 return ret;
2548 }
2549 kfree_skb(skb);
2550
2551 return 0;
2552}
2553
5859223e
TK		 2554static int btusb_set_bdaddr_ath3012(struct hci_dev *hdev,
2555 const bdaddr_t *bdaddr)
2556{
2557 struct sk_buff *skb;
2558 u8 buf[10];
2559 long ret;
2560
2561 buf[0] = 0x01;
2562 buf[1] = 0x01;
2563 buf[2] = 0x00;
2564 buf[3] = sizeof(bdaddr_t);
2565 memcpy(buf + 4, bdaddr, sizeof(bdaddr_t));
2566
2567 skb = __hci_cmd_sync(hdev, 0xfc0b, sizeof(buf), buf, HCI_INIT_TIMEOUT);
2568 if (IS_ERR(skb)) {
2569 ret = PTR_ERR(skb);
2570 BT_ERR("%s: Change address command failed (%ld)",
2571 hdev->name, ret);
2572 return ret;
2573 }
2574 kfree_skb(skb);
2575
2576 return 0;
2577}
2578
5e23b923 2579static int btusb_probe(struct usb_interface *intf,
89e7533d 2580 const struct usb_device_id *id)
5e23b923
MH		 2581{
2582 struct usb_endpoint_descriptor *ep_desc;
2583 struct btusb_data *data;
2584 struct hci_dev *hdev;
2585 int i, err;
2586
2587 BT_DBG("intf %p id %p", intf, id);
2588
cfeb4145 2589 /* interface numbers are hardcoded in the spec */
5e23b923
MH		 2590 if (intf->cur_altsetting->desc.bInterfaceNumber != 0)
2591 return -ENODEV;
2592
2593 if (!id->driver_info) {
2594 const struct usb_device_id *match;
89e7533d 2595
5e23b923
MH		 2596 match = usb_match_id(intf, blacklist_table);
2597 if (match)
2598 id = match;
2599 }
2600
cfeb4145
MH		 2601 if (id->driver_info == BTUSB_IGNORE)
2602 return -ENODEV;
2603
2d25f8b4
SL		 2604 if (id->driver_info & BTUSB_ATH3012) {
2605 struct usb_device *udev = interface_to_usbdev(intf);
2606
2607 /* Old firmware would otherwise let ath3k driver load
2608 * patch and sysconfig files */
2609 if (le16_to_cpu(udev->descriptor.bcdDevice) <= 0x0001)
2610 return -ENODEV;
2611 }
2612
98921dbd 2613 data = devm_kzalloc(&intf->dev, sizeof(*data), GFP_KERNEL);
5e23b923
MH		 2614 if (!data)
2615 return -ENOMEM;
2616
2617 for (i = 0; i < intf->cur_altsetting->desc.bNumEndpoints; i++) {
2618 ep_desc = &intf->cur_altsetting->endpoint[i].desc;
2619
2620 if (!data->intr_ep && usb_endpoint_is_int_in(ep_desc)) {
2621 data->intr_ep = ep_desc;
2622 continue;
2623 }
2624
2625 if (!data->bulk_tx_ep && usb_endpoint_is_bulk_out(ep_desc)) {
2626 data->bulk_tx_ep = ep_desc;
2627 continue;
2628 }
2629
2630 if (!data->bulk_rx_ep && usb_endpoint_is_bulk_in(ep_desc)) {
2631 data->bulk_rx_ep = ep_desc;
2632 continue;
2633 }
2634 }
2635
98921dbd 2636 if (!data->intr_ep || !data->bulk_tx_ep || !data->bulk_rx_ep)
5e23b923 2637 return -ENODEV;
5e23b923 2638
7a9d4020
MH		 2639 data->cmdreq_type = USB_TYPE_CLASS;
2640
5e23b923 2641 data->udev = interface_to_usbdev(intf);
5fbcd260 2642 data->intf = intf;
5e23b923 2643
5e23b923 2644 INIT_WORK(&data->work, btusb_work);
7bee549e 2645 INIT_WORK(&data->waker, btusb_waker);
803b5836
MH		 2646 init_usb_anchor(&data->deferred);
2647 init_usb_anchor(&data->tx_anchor);
7bee549e 2648 spin_lock_init(&data->txlock);
5e23b923 2649
5e23b923
MH		 2650 init_usb_anchor(&data->intr_anchor);
2651 init_usb_anchor(&data->bulk_anchor);
9bfa35fe 2652 init_usb_anchor(&data->isoc_anchor);
803b5836 2653 spin_lock_init(&data->rxlock);
5e23b923 2654
cda0dd78
MH		 2655 if (id->driver_info & BTUSB_INTEL_NEW) {
2656 data->recv_event = btusb_recv_event_intel;
2657 data->recv_bulk = btusb_recv_bulk_intel;
2658 set_bit(BTUSB_BOOTLOADER, &data->flags);
2659 } else {
2660 data->recv_event = hci_recv_frame;
2661 data->recv_bulk = btusb_recv_bulk;
2662 }
2cbd3f5c 2663
5e23b923 2664 hdev = hci_alloc_dev();
98921dbd 2665 if (!hdev)
5e23b923 2666 return -ENOMEM;
5e23b923 2667
c13854ce 2668 hdev->bus = HCI_USB;
155961e8 2669 hci_set_drvdata(hdev, data);
5e23b923
MH		 2670
2671 data->hdev = hdev;
2672
2673 SET_HCIDEV_DEV(hdev, &intf->dev);
2674
9f8f962c
MH		 2675 hdev->open = btusb_open;
2676 hdev->close = btusb_close;
2677 hdev->flush = btusb_flush;
2678 hdev->send = btusb_send_frame;
2679 hdev->notify = btusb_notify;
2680
2681 if (id->driver_info & BTUSB_BCM92035)
2682 hdev->setup = btusb_setup_bcm92035;
5e23b923 2683
abbaf50e 2684 if (id->driver_info & BTUSB_BCM_PATCHRAM) {
10d4c673 2685 hdev->setup = btusb_setup_bcm_patchram;
abbaf50e 2686 hdev->set_bdaddr = btusb_set_bdaddr_bcm;
27c3fbe0 2687 set_bit(HCI_QUIRK_STRICT_DUPLICATE_FILTER, &hdev->quirks);
abbaf50e 2688 }
10d4c673 2689
cb8d6597 2690 if (id->driver_info & BTUSB_INTEL) {
dffd30ee 2691 hdev->setup = btusb_setup_intel;
385a768c 2692 hdev->hw_error = btusb_hw_error_intel;
cb8d6597
MH		 2693 hdev->set_bdaddr = btusb_set_bdaddr_intel;
2694 }
dffd30ee 2695
cda0dd78
MH		 2696 if (id->driver_info & BTUSB_INTEL_NEW) {
2697 hdev->send = btusb_send_frame_intel;
2698 hdev->setup = btusb_setup_intel_new;
385a768c 2699 hdev->hw_error = btusb_hw_error_intel;
cda0dd78
MH		 2700 hdev->set_bdaddr = btusb_set_bdaddr_intel;
2701 }
2702
ae8df494
AK		 2703 if (id->driver_info & BTUSB_MARVELL)
2704 hdev->set_bdaddr = btusb_set_bdaddr_marvell;
2705
661cf88a
MH		 2706 if (id->driver_info & BTUSB_SWAVE) {
2707 set_bit(HCI_QUIRK_FIXUP_INQUIRY_MODE, &hdev->quirks);
d57dbe77 2708 set_bit(HCI_QUIRK_BROKEN_LOCAL_COMMANDS, &hdev->quirks);
661cf88a 2709 }
d57dbe77 2710
40df783d
MH		 2711 if (id->driver_info & BTUSB_INTEL_BOOT)
2712 set_bit(HCI_QUIRK_RAW_DEVICE, &hdev->quirks);
2713
5859223e
TK		 2714 if (id->driver_info & BTUSB_ATH3012)
2715 hdev->set_bdaddr = btusb_set_bdaddr_ath3012;
2716
7a9d4020 2717 /* Interface numbers are hardcoded in the specification */
9bfa35fe
MH		 2718 data->isoc = usb_ifnum_to_if(data->udev, 1);
2719
7a9d4020 2720 if (!reset)
a6c511c6 2721 set_bit(HCI_QUIRK_RESET_ON_CLOSE, &hdev->quirks);
cfeb4145
MH		 2722
2723 if (force_scofix || id->driver_info & BTUSB_WRONG_SCO_MTU) {
2724 if (!disable_scofix)
2725 set_bit(HCI_QUIRK_FIXUP_BUFFER_SIZE, &hdev->quirks);
2726 }
2727
9bfa35fe
MH		 2728 if (id->driver_info & BTUSB_BROKEN_ISOC)
2729 data->isoc = NULL;
2730
7a9d4020
MH		 2731 if (id->driver_info & BTUSB_DIGIANSWER) {
2732 data->cmdreq_type = USB_TYPE_VENDOR;
a6c511c6 2733 set_bit(HCI_QUIRK_RESET_ON_CLOSE, &hdev->quirks);
7a9d4020
MH		 2734 }
2735
2736 if (id->driver_info & BTUSB_CSR) {
2737 struct usb_device *udev = data->udev;
81cac64b 2738 u16 bcdDevice = le16_to_cpu(udev->descriptor.bcdDevice);
7a9d4020
MH		 2739
2740 /* Old firmware would otherwise execute USB reset */
81cac64b 2741 if (bcdDevice < 0x117)
a6c511c6 2742 set_bit(HCI_QUIRK_RESET_ON_CLOSE, &hdev->quirks);
81cac64b
MH		 2743
2744 /* Fake CSR devices with broken commands */
2745 if (bcdDevice <= 0x100)
2746 hdev->setup = btusb_setup_csr;
7a9d4020
MH		 2747 }
2748
cfeb4145 2749 if (id->driver_info & BTUSB_SNIFFER) {
9bfa35fe 2750 struct usb_device *udev = data->udev;
cfeb4145 2751
7a9d4020 2752 /* New sniffer firmware has crippled HCI interface */
cfeb4145
MH		 2753 if (le16_to_cpu(udev->descriptor.bcdDevice) > 0x997)
2754 set_bit(HCI_QUIRK_RAW_DEVICE, &hdev->quirks);
2755 }
2756
3a5ef20c
MH		 2757 if (id->driver_info & BTUSB_INTEL_BOOT) {
2758 /* A bug in the bootloader causes that interrupt interface is
2759 * only enabled after receiving SetInterface(0, AltSetting=0).
2760 */
2761 err = usb_set_interface(data->udev, 0, 0);
2762 if (err < 0) {
2763 BT_ERR("failed to set interface 0, alt 0 %d", err);
2764 hci_free_dev(hdev);
2765 return err;
2766 }
2767 }
2768
9bfa35fe
MH		 2769 if (data->isoc) {
2770 err = usb_driver_claim_interface(&btusb_driver,
89e7533d 2771 data->isoc, data);
9bfa35fe
MH		 2772 if (err < 0) {
2773 hci_free_dev(hdev);
9bfa35fe
MH		 2774 return err;
2775 }
2776 }
2777
5e23b923
MH		 2778 err = hci_register_dev(hdev);
2779 if (err < 0) {
2780 hci_free_dev(hdev);
5e23b923
MH		 2781 return err;
2782 }
2783
2784 usb_set_intfdata(intf, data);
2785
2786 return 0;
2787}
2788
2789static void btusb_disconnect(struct usb_interface *intf)
2790{
2791 struct btusb_data *data = usb_get_intfdata(intf);
2792 struct hci_dev *hdev;
2793
2794 BT_DBG("intf %p", intf);
2795
2796 if (!data)
2797 return;
2798
2799 hdev = data->hdev;
5fbcd260
MH		 2800 usb_set_intfdata(data->intf, NULL);
2801
2802 if (data->isoc)
2803 usb_set_intfdata(data->isoc, NULL);
5e23b923
MH		 2804
2805 hci_unregister_dev(hdev);
2806
5fbcd260
MH		 2807 if (intf == data->isoc)
2808 usb_driver_release_interface(&btusb_driver, data->intf);
2809 else if (data->isoc)
2810 usb_driver_release_interface(&btusb_driver, data->isoc);
2811
5e23b923
MH		 2812 hci_free_dev(hdev);
2813}
2814
7bee549e 2815#ifdef CONFIG_PM
6a88adf2
MH		 2816static int btusb_suspend(struct usb_interface *intf, pm_message_t message)
2817{
2818 struct btusb_data *data = usb_get_intfdata(intf);
2819
2820 BT_DBG("intf %p", intf);
2821
2822 if (data->suspend_count++)
2823 return 0;
2824
7bee549e 2825 spin_lock_irq(&data->txlock);
5b1b0b81 2826 if (!(PMSG_IS_AUTO(message) && data->tx_in_flight)) {
7bee549e
ON		 2827 set_bit(BTUSB_SUSPENDING, &data->flags);
2828 spin_unlock_irq(&data->txlock);
2829 } else {
2830 spin_unlock_irq(&data->txlock);
2831 data->suspend_count--;
2832 return -EBUSY;
2833 }
2834
6a88adf2
MH		 2835 cancel_work_sync(&data->work);
2836
7bee549e 2837 btusb_stop_traffic(data);
6a88adf2
MH		 2838 usb_kill_anchored_urbs(&data->tx_anchor);
2839
6a88adf2
MH		 2840 return 0;
2841}
2842
7bee549e
ON		 2843static void play_deferred(struct btusb_data *data)
2844{
2845 struct urb *urb;
2846 int err;
2847
2848 while ((urb = usb_get_from_anchor(&data->deferred))) {
2849 err = usb_submit_urb(urb, GFP_ATOMIC);
2850 if (err < 0)
2851 break;
2852
2853 data->tx_in_flight++;
2854 }
2855 usb_scuttle_anchored_urbs(&data->deferred);
2856}
2857
6a88adf2
MH		 2858static int btusb_resume(struct usb_interface *intf)
2859{
2860 struct btusb_data *data = usb_get_intfdata(intf);
2861 struct hci_dev *hdev = data->hdev;
7bee549e 2862 int err = 0;
6a88adf2
MH		 2863
2864 BT_DBG("intf %p", intf);
2865
2866 if (--data->suspend_count)
2867 return 0;
2868
2869 if (!test_bit(HCI_RUNNING, &hdev->flags))
7bee549e 2870 goto done;
6a88adf2
MH		 2871
2872 if (test_bit(BTUSB_INTR_RUNNING, &data->flags)) {
2873 err = btusb_submit_intr_urb(hdev, GFP_NOIO);
2874 if (err < 0) {
2875 clear_bit(BTUSB_INTR_RUNNING, &data->flags);
7bee549e 2876 goto failed;
6a88adf2
MH		 2877 }
2878 }
2879
2880 if (test_bit(BTUSB_BULK_RUNNING, &data->flags)) {
43c2e57f
MH		 2881 err = btusb_submit_bulk_urb(hdev, GFP_NOIO);
2882 if (err < 0) {
6a88adf2 2883 clear_bit(BTUSB_BULK_RUNNING, &data->flags);
7bee549e
ON		 2884 goto failed;
2885 }
2886
2887 btusb_submit_bulk_urb(hdev, GFP_NOIO);
6a88adf2
MH		 2888 }
2889
2890 if (test_bit(BTUSB_ISOC_RUNNING, &data->flags)) {
2891 if (btusb_submit_isoc_urb(hdev, GFP_NOIO) < 0)
2892 clear_bit(BTUSB_ISOC_RUNNING, &data->flags);
2893 else
2894 btusb_submit_isoc_urb(hdev, GFP_NOIO);
2895 }
2896
7bee549e
ON		 2897 spin_lock_irq(&data->txlock);
2898 play_deferred(data);
2899 clear_bit(BTUSB_SUSPENDING, &data->flags);
2900 spin_unlock_irq(&data->txlock);
2901 schedule_work(&data->work);
2902
6a88adf2 2903 return 0;
7bee549e
ON		 2904
2905failed:
2906 usb_scuttle_anchored_urbs(&data->deferred);
2907done:
2908 spin_lock_irq(&data->txlock);
2909 clear_bit(BTUSB_SUSPENDING, &data->flags);
2910 spin_unlock_irq(&data->txlock);
2911
2912 return err;
6a88adf2 2913}
7bee549e 2914#endif
6a88adf2 2915
5e23b923
MH		 2916static struct usb_driver btusb_driver = {
2917 .name = "btusb",
2918 .probe = btusb_probe,
2919 .disconnect = btusb_disconnect,
7bee549e 2920#ifdef CONFIG_PM
6a88adf2
MH		 2921 .suspend = btusb_suspend,
2922 .resume = btusb_resume,
7bee549e 2923#endif
5e23b923 2924 .id_table = btusb_table,
7bee549e 2925 .supports_autosuspend = 1,
e1f12eb6 2926 .disable_hub_initiated_lpm = 1,
5e23b923
MH		 2927};
2928
93f1508c 2929module_usb_driver(btusb_driver);
5e23b923 2930
cfeb4145
MH		 2931module_param(disable_scofix, bool, 0644);
2932MODULE_PARM_DESC(disable_scofix, "Disable fixup of wrong SCO buffer size");
2933
2934module_param(force_scofix, bool, 0644);
2935MODULE_PARM_DESC(force_scofix, "Force fixup of wrong SCO buffers size");
2936
2937module_param(reset, bool, 0644);
2938MODULE_PARM_DESC(reset, "Send HCI reset command on initialization");
2939
5e23b923
MH		 2940MODULE_AUTHOR("Marcel Holtmann <marcel@holtmann.org>");
2941MODULE_DESCRIPTION("Generic Bluetooth USB driver ver " VERSION);
2942MODULE_VERSION(VERSION);
2943MODULE_LICENSE("GPL");
Linux kernel - Deliverables
This page took 0.803726 seconds and 5 git commands to generate.