]> git.proxmox.com Git - mirror_ubuntu-artful-kernel.git/blame - drivers/bluetooth/btusb.c
projects / mirror_ubuntu-artful-kernel.git / blame
? search:
summary | shortlog | log | commit | commitdiff | tree
blob | blame (incremental) | history | HEAD
networking: make skb_put & friends return void pointers
[mirror_ubuntu-artful-kernel.git] / drivers / bluetooth / btusb.c
CommitLineData
5e23b923
MH		 1/*
2 *
3 * Generic Bluetooth USB driver
4 *
9bfa35fe 5 * Copyright (C) 2005-2008 Marcel Holtmann <marcel@holtmann.org>
5e23b923
MH		 6 *
7 *
8 * This program is free software; you can redistribute it and/or modify
9 * it under the terms of the GNU General Public License as published by
10 * the Free Software Foundation; either version 2 of the License, or
11 * (at your option) any later version.
12 *
13 * This program is distributed in the hope that it will be useful,
14 * but WITHOUT ANY WARRANTY; without even the implied warranty of
15 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
16 * GNU General Public License for more details.
17 *
18 * You should have received a copy of the GNU General Public License
19 * along with this program; if not, write to the Free Software
20 * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
21 *
22 */
23
5e23b923 24#include <linux/module.h>
5e23b923 25#include <linux/usb.h>
dffd30ee 26#include <linux/firmware.h>
fd913ef7
RJ		 27#include <linux/of_device.h>
28#include <linux/of_irq.h>
017789f3 29#include <linux/suspend.h>
a2698a9b 30#include <asm/unaligned.h>
5e23b923
MH		 31
32#include <net/bluetooth/bluetooth.h>
33#include <net/bluetooth/hci_core.h>
34
4185a0f5 35#include "btintel.h"
1df1f591 36#include "btbcm.h"
db33c77d 37#include "btrtl.h"
1df1f591 38
34dced9b 39#define VERSION "0.8"
cfeb4145 40
90ab5ee9
RR		 41static bool disable_scofix;
42static bool force_scofix;
7a9d4020 43
917a3337 44static bool reset = true;
cfeb4145
MH		 45
46static struct usb_driver btusb_driver;
47
48#define BTUSB_IGNORE 0x01
7a9d4020
MH		 49#define BTUSB_DIGIANSWER 0x02
50#define BTUSB_CSR 0x04
51#define BTUSB_SNIFFER 0x08
52#define BTUSB_BCM92035 0x10
53#define BTUSB_BROKEN_ISOC 0x20
54#define BTUSB_WRONG_SCO_MTU 0x40
2d25f8b4 55#define BTUSB_ATH3012 0x80
dffd30ee 56#define BTUSB_INTEL 0x100
40df783d
MH		 57#define BTUSB_INTEL_BOOT 0x200
58#define BTUSB_BCM_PATCHRAM 0x400
ae8df494 59#define BTUSB_MARVELL 0x800
4fcef8ed 60#define BTUSB_SWAVE 0x1000
cda0dd78 61#define BTUSB_INTEL_NEW 0x2000
893ba544 62#define BTUSB_AMP 0x4000
3267c884 63#define BTUSB_QCA_ROME 0x8000
17b2772b 64#define BTUSB_BCM_APPLE 0x10000
a2698a9b 65#define BTUSB_REALTEK 0x20000
6c9d435d 66#define BTUSB_BCM2045 0x40000
22f8e9db 67#define BTUSB_IFNUM_2 0x80000
418678b0 68#define BTUSB_CW6622 0x100000
5e23b923 69
54265202 70static const struct usb_device_id btusb_table[] = {
5e23b923
MH		 71 /* Generic Bluetooth USB device */
72 { USB_DEVICE_INFO(0xe0, 0x01, 0x01) },
73
893ba544
MH		 74 /* Generic Bluetooth AMP device */
75 { USB_DEVICE_INFO(0xe0, 0x01, 0x04), .driver_info = BTUSB_AMP },
76
d63b2826
DD		 77 /* Generic Bluetooth USB interface */
78 { USB_INTERFACE_INFO(0xe0, 0x01, 0x01) },
79
1fa6535f 80 /* Apple-specific (Broadcom) devices */
17b2772b 81 { USB_VENDOR_AND_INTERFACE_INFO(0x05ac, 0xff, 0x01, 0x01),
22f8e9db 82 .driver_info = BTUSB_BCM_APPLE | BTUSB_IFNUM_2 },
1fa6535f 83
178c059e
CYC		 84 /* MediaTek MT76x0E */
85 { USB_DEVICE(0x0e8d, 0x763f) },
86
c510eae3 87 /* Broadcom SoftSailing reporting vendor specific */
2e8b5063 88 { USB_DEVICE(0x0a5c, 0x21e1) },
c510eae3 89
3cd01976
NI		 90 /* Apple MacBookPro 7,1 */
91 { USB_DEVICE(0x05ac, 0x8213) },
92
0a79f674
CL		 93 /* Apple iMac11,1 */
94 { USB_DEVICE(0x05ac, 0x8215) },
95
9c047157
NI		 96 /* Apple MacBookPro6,2 */
97 { USB_DEVICE(0x05ac, 0x8218) },
98
3e3ede7d
EH		 99 /* Apple MacBookAir3,1, MacBookAir3,2 */
100 { USB_DEVICE(0x05ac, 0x821b) },
101
a63b723d
PAVM		 102 /* Apple MacBookAir4,1 */
103 { USB_DEVICE(0x05ac, 0x821f) },
104
88d377b6
MAP		 105 /* Apple MacBookPro8,2 */
106 { USB_DEVICE(0x05ac, 0x821a) },
107
f78b6826
JK		 108 /* Apple MacMini5,1 */
109 { USB_DEVICE(0x05ac, 0x8281) },
110
cfeb4145 111 /* AVM BlueFRITZ! USB v2.0 */
4fcef8ed 112 { USB_DEVICE(0x057c, 0x3800), .driver_info = BTUSB_SWAVE },
cfeb4145
MH		 113
114 /* Bluetooth Ultraport Module from IBM */
115 { USB_DEVICE(0x04bf, 0x030a) },
116
117 /* ALPS Modules with non-standard id */
118 { USB_DEVICE(0x044e, 0x3001) },
119 { USB_DEVICE(0x044e, 0x3002) },
120
121 /* Ericsson with non-standard id */
122 { USB_DEVICE(0x0bdb, 0x1002) },
123
124 /* Canyon CN-BTU1 with HID interfaces */
7a9d4020 125 { USB_DEVICE(0x0c10, 0x0000) },
cfeb4145 126
d13431ca
WJS		 127 /* Broadcom BCM20702A0 */
128 { USB_DEVICE(0x413c, 0x8197) },
129
d049f4e5
MH		 130 /* Broadcom BCM20702B0 (Dynex/Insignia) */
131 { USB_DEVICE(0x19ff, 0x0239), .driver_info = BTUSB_BCM_PATCHRAM },
132
2faf71ce
SR		 133 /* Broadcom BCM43142A0 (Foxconn/Lenovo) */
134 { USB_DEVICE(0x105b, 0xe065), .driver_info = BTUSB_BCM_PATCHRAM },
135
a57bac43
CH		 136 /* Broadcom BCM920703 (HTC Vive) */
137 { USB_VENDOR_AND_INTERFACE_INFO(0x0bb4, 0xff, 0x01, 0x01),
138 .driver_info = BTUSB_BCM_PATCHRAM },
139
98514036 140 /* Foxconn - Hon Hai */
6029ddc2
HS		 141 { USB_VENDOR_AND_INTERFACE_INFO(0x0489, 0xff, 0x01, 0x01),
142 .driver_info = BTUSB_BCM_PATCHRAM },
98514036 143
8f0c304c
MD		 144 /* Lite-On Technology - Broadcom based */
145 { USB_VENDOR_AND_INTERFACE_INFO(0x04ca, 0xff, 0x01, 0x01),
146 .driver_info = BTUSB_BCM_PATCHRAM },
147
0b880062 148 /* Broadcom devices with vendor specific id */
10d4c673
PG		 149 { USB_VENDOR_AND_INTERFACE_INFO(0x0a5c, 0xff, 0x01, 0x01),
150 .driver_info = BTUSB_BCM_PATCHRAM },
92c385f4 151
c2aef6e8 152 /* ASUSTek Computer - Broadcom based */
9a5abdaa
RD		 153 { USB_VENDOR_AND_INTERFACE_INFO(0x0b05, 0xff, 0x01, 0x01),
154 .driver_info = BTUSB_BCM_PATCHRAM },
c2aef6e8 155
5bcecf32 156 /* Belkin F8065bf - Broadcom based */
6331c686
MH		 157 { USB_VENDOR_AND_INTERFACE_INFO(0x050d, 0xff, 0x01, 0x01),
158 .driver_info = BTUSB_BCM_PATCHRAM },
5bcecf32 159
9113bfd8 160 /* IMC Networks - Broadcom based */
6331c686
MH		 161 { USB_VENDOR_AND_INTERFACE_INFO(0x13d3, 0xff, 0x01, 0x01),
162 .driver_info = BTUSB_BCM_PATCHRAM },
9113bfd8 163
fdfddc60
WJS		 164 /* Dell Computer - Broadcom based */
165 { USB_VENDOR_AND_INTERFACE_INFO(0x413c, 0xff, 0x01, 0x01),
166 .driver_info = BTUSB_BCM_PATCHRAM },
167
1623d0bf
DT		 168 /* Toshiba Corp - Broadcom based */
169 { USB_VENDOR_AND_INTERFACE_INFO(0x0930, 0xff, 0x01, 0x01),
170 .driver_info = BTUSB_BCM_PATCHRAM },
171
40df783d 172 /* Intel Bluetooth USB Bootloader (RAM module) */
d92f2df0
MH		 173 { USB_DEVICE(0x8087, 0x0a5a),
174 .driver_info = BTUSB_INTEL_BOOT | BTUSB_BROKEN_ISOC },
40df783d 175
5e23b923
MH		 176 { } /* Terminating entry */
177};
178
179MODULE_DEVICE_TABLE(usb, btusb_table);
180
54265202 181static const struct usb_device_id blacklist_table[] = {
cfeb4145
MH		 182 /* CSR BlueCore devices */
183 { USB_DEVICE(0x0a12, 0x0001), .driver_info = BTUSB_CSR },
184
185 /* Broadcom BCM2033 without firmware */
186 { USB_DEVICE(0x0a5c, 0x2033), .driver_info = BTUSB_IGNORE },
187
6c9d435d
MH		 188 /* Broadcom BCM2045 devices */
189 { USB_DEVICE(0x0a5c, 0x2045), .driver_info = BTUSB_BCM2045 },
190
be93112a 191 /* Atheros 3011 with sflash firmware */
0b880062
AS		 192 { USB_DEVICE(0x0489, 0xe027), .driver_info = BTUSB_IGNORE },
193 { USB_DEVICE(0x0489, 0xe03d), .driver_info = BTUSB_IGNORE },
2eeff0b4 194 { USB_DEVICE(0x04f2, 0xaff1), .driver_info = BTUSB_IGNORE },
0b880062 195 { USB_DEVICE(0x0930, 0x0215), .driver_info = BTUSB_IGNORE },
be93112a 196 { USB_DEVICE(0x0cf3, 0x3002), .driver_info = BTUSB_IGNORE },
6eda541d 197 { USB_DEVICE(0x0cf3, 0xe019), .driver_info = BTUSB_IGNORE },
2a7bcccc 198 { USB_DEVICE(0x13d3, 0x3304), .driver_info = BTUSB_IGNORE },
be93112a 199
509e7861
CYC		 200 /* Atheros AR9285 Malbec with sflash firmware */
201 { USB_DEVICE(0x03f0, 0x311d), .driver_info = BTUSB_IGNORE },
202
d9f51b51 203 /* Atheros 3012 with sflash firmware */
0b880062
AS		 204 { USB_DEVICE(0x0489, 0xe04d), .driver_info = BTUSB_ATH3012 },
205 { USB_DEVICE(0x0489, 0xe04e), .driver_info = BTUSB_ATH3012 },
206 { USB_DEVICE(0x0489, 0xe056), .driver_info = BTUSB_ATH3012 },
207 { USB_DEVICE(0x0489, 0xe057), .driver_info = BTUSB_ATH3012 },
208 { USB_DEVICE(0x0489, 0xe05f), .driver_info = BTUSB_ATH3012 },
692c062e 209 { USB_DEVICE(0x0489, 0xe076), .driver_info = BTUSB_ATH3012 },
4b552bc9 210 { USB_DEVICE(0x0489, 0xe078), .driver_info = BTUSB_ATH3012 },
28c971d8 211 { USB_DEVICE(0x0489, 0xe095), .driver_info = BTUSB_ATH3012 },
0b880062
AS		 212 { USB_DEVICE(0x04c5, 0x1330), .driver_info = BTUSB_ATH3012 },
213 { USB_DEVICE(0x04ca, 0x3004), .driver_info = BTUSB_ATH3012 },
214 { USB_DEVICE(0x04ca, 0x3005), .driver_info = BTUSB_ATH3012 },
215 { USB_DEVICE(0x04ca, 0x3006), .driver_info = BTUSB_ATH3012 },
1fb4e09a 216 { USB_DEVICE(0x04ca, 0x3007), .driver_info = BTUSB_ATH3012 },
0b880062
AS		 217 { USB_DEVICE(0x04ca, 0x3008), .driver_info = BTUSB_ATH3012 },
218 { USB_DEVICE(0x04ca, 0x300b), .driver_info = BTUSB_ATH3012 },
7e730c7f 219 { USB_DEVICE(0x04ca, 0x300d), .driver_info = BTUSB_ATH3012 },
ec0810d2 220 { USB_DEVICE(0x04ca, 0x300f), .driver_info = BTUSB_ATH3012 },
134d3b35 221 { USB_DEVICE(0x04ca, 0x3010), .driver_info = BTUSB_ATH3012 },
81d90442 222 { USB_DEVICE(0x04ca, 0x3014), .driver_info = BTUSB_ATH3012 },
441ad62d 223 { USB_DEVICE(0x04ca, 0x3018), .driver_info = BTUSB_ATH3012 },
0b880062 224 { USB_DEVICE(0x0930, 0x0219), .driver_info = BTUSB_ATH3012 },
cd355ff0 225 { USB_DEVICE(0x0930, 0x021c), .driver_info = BTUSB_ATH3012 },
0b880062 226 { USB_DEVICE(0x0930, 0x0220), .driver_info = BTUSB_ATH3012 },
89d2975f 227 { USB_DEVICE(0x0930, 0x0227), .driver_info = BTUSB_ATH3012 },
a735f9e2 228 { USB_DEVICE(0x0b05, 0x17d0), .driver_info = BTUSB_ATH3012 },
d66629c1 229 { USB_DEVICE(0x0cf3, 0x0036), .driver_info = BTUSB_ATH3012 },
2d25f8b4 230 { USB_DEVICE(0x0cf3, 0x3004), .driver_info = BTUSB_ATH3012 },
94a32d10 231 { USB_DEVICE(0x0cf3, 0x3008), .driver_info = BTUSB_ATH3012 },
07c0ea87 232 { USB_DEVICE(0x0cf3, 0x311d), .driver_info = BTUSB_ATH3012 },
b131237c 233 { USB_DEVICE(0x0cf3, 0x311e), .driver_info = BTUSB_ATH3012 },
1e56f1eb 234 { USB_DEVICE(0x0cf3, 0x311f), .driver_info = BTUSB_ATH3012 },
0b880062 235 { USB_DEVICE(0x0cf3, 0x3121), .driver_info = BTUSB_ATH3012 },
ebaf5795 236 { USB_DEVICE(0x0cf3, 0x817a), .driver_info = BTUSB_ATH3012 },
18e0afab 237 { USB_DEVICE(0x0cf3, 0x817b), .driver_info = BTUSB_ATH3012 },
0b880062 238 { USB_DEVICE(0x0cf3, 0xe003), .driver_info = BTUSB_ATH3012 },
ac71311e 239 { USB_DEVICE(0x0cf3, 0xe004), .driver_info = BTUSB_ATH3012 },
0a3658cc 240 { USB_DEVICE(0x0cf3, 0xe005), .driver_info = BTUSB_ATH3012 },
ca79f232 241 { USB_DEVICE(0x0cf3, 0xe006), .driver_info = BTUSB_ATH3012 },
0b880062
AS		 242 { USB_DEVICE(0x13d3, 0x3362), .driver_info = BTUSB_ATH3012 },
243 { USB_DEVICE(0x13d3, 0x3375), .driver_info = BTUSB_ATH3012 },
eed307e2 244 { USB_DEVICE(0x13d3, 0x3393), .driver_info = BTUSB_ATH3012 },
609574eb 245 { USB_DEVICE(0x13d3, 0x3395), .driver_info = BTUSB_ATH3012 },
5b77a1f3 246 { USB_DEVICE(0x13d3, 0x3402), .driver_info = BTUSB_ATH3012 },
3bb30a7c 247 { USB_DEVICE(0x13d3, 0x3408), .driver_info = BTUSB_ATH3012 },
033efa92 248 { USB_DEVICE(0x13d3, 0x3423), .driver_info = BTUSB_ATH3012 },
fa2f1394 249 { USB_DEVICE(0x13d3, 0x3432), .driver_info = BTUSB_ATH3012 },
75c6aca4 250 { USB_DEVICE(0x13d3, 0x3472), .driver_info = BTUSB_ATH3012 },
0d0cef61 251 { USB_DEVICE(0x13d3, 0x3474), .driver_info = BTUSB_ATH3012 },
72f9f8b5 252 { USB_DEVICE(0x13d3, 0x3487), .driver_info = BTUSB_ATH3012 },
12d86896 253 { USB_DEVICE(0x13d3, 0x3490), .driver_info = BTUSB_ATH3012 },
d9f51b51 254
e9036e33
CYC		 255 /* Atheros AR5BBU12 with sflash firmware */
256 { USB_DEVICE(0x0489, 0xe02c), .driver_info = BTUSB_IGNORE },
257
85d59726 258 /* Atheros AR5BBU12 with sflash firmware */
bc21fde2 259 { USB_DEVICE(0x0489, 0xe036), .driver_info = BTUSB_ATH3012 },
0b880062 260 { USB_DEVICE(0x0489, 0xe03c), .driver_info = BTUSB_ATH3012 },
85d59726 261
3267c884 262 /* QCA ROME chipset */
2054111b 263 { USB_DEVICE(0x0cf3, 0xe007), .driver_info = BTUSB_QCA_ROME },
93519934 264 { USB_DEVICE(0x0cf3, 0xe009), .driver_info = BTUSB_QCA_ROME },
c9e44474 265 { USB_DEVICE(0x0cf3, 0xe300), .driver_info = BTUSB_QCA_ROME },
1eef1c35 266 { USB_DEVICE(0x0cf3, 0xe301), .driver_info = BTUSB_QCA_ROME },
c9e44474 267 { USB_DEVICE(0x0cf3, 0xe360), .driver_info = BTUSB_QCA_ROME },
47ca5898 268 { USB_DEVICE(0x0489, 0xe092), .driver_info = BTUSB_QCA_ROME },
06e41d8a 269 { USB_DEVICE(0x0489, 0xe0a2), .driver_info = BTUSB_QCA_ROME },
1144a4ee 270 { USB_DEVICE(0x04ca, 0x3011), .driver_info = BTUSB_QCA_ROME },
3267c884 271
cfeb4145 272 /* Broadcom BCM2035 */
7a9d4020 273 { USB_DEVICE(0x0a5c, 0x2009), .driver_info = BTUSB_BCM92035 },
0b880062
AS		 274 { USB_DEVICE(0x0a5c, 0x200a), .driver_info = BTUSB_WRONG_SCO_MTU },
275 { USB_DEVICE(0x0a5c, 0x2035), .driver_info = BTUSB_WRONG_SCO_MTU },
cfeb4145
MH		 276
277 /* Broadcom BCM2045 */
7a9d4020
MH		 278 { USB_DEVICE(0x0a5c, 0x2039), .driver_info = BTUSB_WRONG_SCO_MTU },
279 { USB_DEVICE(0x0a5c, 0x2101), .driver_info = BTUSB_WRONG_SCO_MTU },
bdbef3d6 280
cfeb4145 281 /* IBM/Lenovo ThinkPad with Broadcom chip */
7a9d4020
MH		 282 { USB_DEVICE(0x0a5c, 0x201e), .driver_info = BTUSB_WRONG_SCO_MTU },
283 { USB_DEVICE(0x0a5c, 0x2110), .driver_info = BTUSB_WRONG_SCO_MTU },
cfeb4145
MH		 284
285 /* HP laptop with Broadcom chip */
7a9d4020 286 { USB_DEVICE(0x03f0, 0x171d), .driver_info = BTUSB_WRONG_SCO_MTU },
cfeb4145
MH		 287
288 /* Dell laptop with Broadcom chip */
7a9d4020 289 { USB_DEVICE(0x413c, 0x8126), .driver_info = BTUSB_WRONG_SCO_MTU },
cfeb4145 290
5ddd4a60 291 /* Dell Wireless 370 and 410 devices */
7a9d4020 292 { USB_DEVICE(0x413c, 0x8152), .driver_info = BTUSB_WRONG_SCO_MTU },
5ddd4a60 293 { USB_DEVICE(0x413c, 0x8156), .driver_info = BTUSB_WRONG_SCO_MTU },
cfeb4145 294
7a9d4020
MH		 295 /* Belkin F8T012 and F8T013 devices */
296 { USB_DEVICE(0x050d, 0x0012), .driver_info = BTUSB_WRONG_SCO_MTU },
297 { USB_DEVICE(0x050d, 0x0013), .driver_info = BTUSB_WRONG_SCO_MTU },
cfeb4145 298
5ddd4a60
MH		 299 /* Asus WL-BTD202 device */
300 { USB_DEVICE(0x0b05, 0x1715), .driver_info = BTUSB_WRONG_SCO_MTU },
301
302 /* Kensington Bluetooth USB adapter */
303 { USB_DEVICE(0x047d, 0x105e), .driver_info = BTUSB_WRONG_SCO_MTU },
304
cfeb4145
MH		 305 /* RTX Telecom based adapters with buggy SCO support */
306 { USB_DEVICE(0x0400, 0x0807), .driver_info = BTUSB_BROKEN_ISOC },
307 { USB_DEVICE(0x0400, 0x080a), .driver_info = BTUSB_BROKEN_ISOC },
308
309 /* CONWISE Technology based adapters with buggy SCO support */
418678b0
SJ		 310 { USB_DEVICE(0x0e5e, 0x6622),
311 .driver_info = BTUSB_BROKEN_ISOC | BTUSB_CW6622},
cfeb4145 312
4fcef8ed 313 /* Roper Class 1 Bluetooth Dongle (Silicon Wave based) */
2eeac871 314 { USB_DEVICE(0x1310, 0x0001), .driver_info = BTUSB_SWAVE },
4fcef8ed 315
cfeb4145
MH		 316 /* Digianswer devices */
317 { USB_DEVICE(0x08fd, 0x0001), .driver_info = BTUSB_DIGIANSWER },
318 { USB_DEVICE(0x08fd, 0x0002), .driver_info = BTUSB_IGNORE },
319
320 /* CSR BlueCore Bluetooth Sniffer */
4f64fa80
MH		 321 { USB_DEVICE(0x0a12, 0x0002),
322 .driver_info = BTUSB_SNIFFER | BTUSB_BROKEN_ISOC },
cfeb4145
MH		 323
324 /* Frontline ComProbe Bluetooth Sniffer */
4f64fa80
MH		 325 { USB_DEVICE(0x16d3, 0x0002),
326 .driver_info = BTUSB_SNIFFER | BTUSB_BROKEN_ISOC },
cfeb4145 327
cb1ee89f
MH		 328 /* Marvell Bluetooth devices */
329 { USB_DEVICE(0x1286, 0x2044), .driver_info = BTUSB_MARVELL },
330 { USB_DEVICE(0x1286, 0x2046), .driver_info = BTUSB_MARVELL },
1165df0e 331 { USB_DEVICE(0x1286, 0x204e), .driver_info = BTUSB_MARVELL },
cb1ee89f 332
d0ac9eb7 333 /* Intel Bluetooth devices */
de766142 334 { USB_DEVICE(0x8087, 0x0025), .driver_info = BTUSB_INTEL_NEW },
407550fe 335 { USB_DEVICE(0x8087, 0x07da), .driver_info = BTUSB_CSR },
dffd30ee 336 { USB_DEVICE(0x8087, 0x07dc), .driver_info = BTUSB_INTEL },
ef4e5e4a 337 { USB_DEVICE(0x8087, 0x0a2a), .driver_info = BTUSB_INTEL },
cda0dd78 338 { USB_DEVICE(0x8087, 0x0a2b), .driver_info = BTUSB_INTEL_NEW },
439e65d3 339 { USB_DEVICE(0x8087, 0x0aa7), .driver_info = BTUSB_INTEL },
86a6129a 340 { USB_DEVICE(0x8087, 0x0aaa), .driver_info = BTUSB_INTEL_NEW },
dffd30ee 341
d0ac9eb7
MH		 342 /* Other Intel Bluetooth devices */
343 { USB_VENDOR_AND_INTERFACE_INFO(0x8087, 0xe0, 0x01, 0x01),
344 .driver_info = BTUSB_IGNORE },
ae8df494 345
a2698a9b
DD		 346 /* Realtek Bluetooth devices */
347 { USB_VENDOR_AND_INTERFACE_INFO(0x0bda, 0xe0, 0x01, 0x01),
348 .driver_info = BTUSB_REALTEK },
349
350 /* Additional Realtek 8723AE Bluetooth devices */
351 { USB_DEVICE(0x0930, 0x021d), .driver_info = BTUSB_REALTEK },
352 { USB_DEVICE(0x13d3, 0x3394), .driver_info = BTUSB_REALTEK },
353
354 /* Additional Realtek 8723BE Bluetooth devices */
355 { USB_DEVICE(0x0489, 0xe085), .driver_info = BTUSB_REALTEK },
356 { USB_DEVICE(0x0489, 0xe08b), .driver_info = BTUSB_REALTEK },
357 { USB_DEVICE(0x13d3, 0x3410), .driver_info = BTUSB_REALTEK },
358 { USB_DEVICE(0x13d3, 0x3416), .driver_info = BTUSB_REALTEK },
359 { USB_DEVICE(0x13d3, 0x3459), .driver_info = BTUSB_REALTEK },
360
361 /* Additional Realtek 8821AE Bluetooth devices */
362 { USB_DEVICE(0x0b05, 0x17dc), .driver_info = BTUSB_REALTEK },
363 { USB_DEVICE(0x13d3, 0x3414), .driver_info = BTUSB_REALTEK },
364 { USB_DEVICE(0x13d3, 0x3458), .driver_info = BTUSB_REALTEK },
365 { USB_DEVICE(0x13d3, 0x3461), .driver_info = BTUSB_REALTEK },
366 { USB_DEVICE(0x13d3, 0x3462), .driver_info = BTUSB_REALTEK },
367
4481c076
PP		 368 /* Silicon Wave based devices */
369 { USB_DEVICE(0x0c10, 0x0000), .driver_info = BTUSB_SWAVE },
370
5e23b923
MH		 371 { } /* Terminating entry */
372};
373
9bfa35fe
MH		 374#define BTUSB_MAX_ISOC_FRAMES 10
375
5e23b923
MH		 376#define BTUSB_INTR_RUNNING 0
377#define BTUSB_BULK_RUNNING 1
9bfa35fe 378#define BTUSB_ISOC_RUNNING 2
7bee549e 379#define BTUSB_SUSPENDING 3
08b8b6c4 380#define BTUSB_DID_ISO_RESUME 4
cda0dd78
MH		 381#define BTUSB_BOOTLOADER 5
382#define BTUSB_DOWNLOADING 6
ce6bb929 383#define BTUSB_FIRMWARE_LOADED 7
cda0dd78 384#define BTUSB_FIRMWARE_FAILED 8
ce6bb929 385#define BTUSB_BOOTING 9
04b8c814 386#define BTUSB_RESET_RESUME 10
9d08f504 387#define BTUSB_DIAG_RUNNING 11
fd913ef7 388#define BTUSB_OOB_WAKE_ENABLED 12
5e23b923
MH		 389
390struct btusb_data {
391 struct hci_dev *hdev;
392 struct usb_device *udev;
5fbcd260 393 struct usb_interface *intf;
9bfa35fe 394 struct usb_interface *isoc;
9d08f504 395 struct usb_interface *diag;
5e23b923 396
5e23b923
MH		 397 unsigned long flags;
398
399 struct work_struct work;
7bee549e 400 struct work_struct waker;
5e23b923 401
803b5836 402 struct usb_anchor deferred;
5e23b923 403 struct usb_anchor tx_anchor;
803b5836
MH		 404 int tx_in_flight;
405 spinlock_t txlock;
406
5e23b923
MH		 407 struct usb_anchor intr_anchor;
408 struct usb_anchor bulk_anchor;
9bfa35fe 409 struct usb_anchor isoc_anchor;
9d08f504 410 struct usb_anchor diag_anchor;
803b5836
MH		 411 spinlock_t rxlock;
412
413 struct sk_buff *evt_skb;
414 struct sk_buff *acl_skb;
415 struct sk_buff *sco_skb;
5e23b923
MH		 416
417 struct usb_endpoint_descriptor *intr_ep;
418 struct usb_endpoint_descriptor *bulk_tx_ep;
419 struct usb_endpoint_descriptor *bulk_rx_ep;
9bfa35fe
MH		 420 struct usb_endpoint_descriptor *isoc_tx_ep;
421 struct usb_endpoint_descriptor *isoc_rx_ep;
9d08f504
MH		 422 struct usb_endpoint_descriptor *diag_tx_ep;
423 struct usb_endpoint_descriptor *diag_rx_ep;
9bfa35fe 424
7a9d4020 425 __u8 cmdreq_type;
893ba544 426 __u8 cmdreq;
7a9d4020 427
43c2e57f 428 unsigned int sco_num;
9bfa35fe 429 int isoc_altsetting;
6a88adf2 430 int suspend_count;
2cbd3f5c 431
97307f51 432 int (*recv_event)(struct hci_dev *hdev, struct sk_buff *skb);
2cbd3f5c 433 int (*recv_bulk)(struct btusb_data *data, void *buffer, int count);
ace31982
KBYT		 434
435 int (*setup_on_usb)(struct hci_dev *hdev);
fd913ef7
RJ		 436
437 int oob_wake_irq; /* irq for out-of-band wake-on-bt */
5e23b923
MH		 438};
439
803b5836
MH		 440static inline void btusb_free_frags(struct btusb_data *data)
441{
442 unsigned long flags;
443
444 spin_lock_irqsave(&data->rxlock, flags);
445
446 kfree_skb(data->evt_skb);
447 data->evt_skb = NULL;
448
449 kfree_skb(data->acl_skb);
450 data->acl_skb = NULL;
451
452 kfree_skb(data->sco_skb);
453 data->sco_skb = NULL;
454
455 spin_unlock_irqrestore(&data->rxlock, flags);
456}
457
1ffa4ad0
MH		 458static int btusb_recv_intr(struct btusb_data *data, void *buffer, int count)
459{
803b5836
MH		 460 struct sk_buff *skb;
461 int err = 0;
462
463 spin_lock(&data->rxlock);
464 skb = data->evt_skb;
465
466 while (count) {
467 int len;
468
469 if (!skb) {
470 skb = bt_skb_alloc(HCI_MAX_EVENT_SIZE, GFP_ATOMIC);
471 if (!skb) {
472 err = -ENOMEM;
473 break;
474 }
475
618e8bc2
MH		 476 hci_skb_pkt_type(skb) = HCI_EVENT_PKT;
477 hci_skb_expect(skb) = HCI_EVENT_HDR_SIZE;
803b5836
MH		 478 }
479
618e8bc2 480 len = min_t(uint, hci_skb_expect(skb), count);
59ae1d12 481 skb_put_data(skb, buffer, len);
803b5836
MH		 482
483 count -= len;
484 buffer += len;
618e8bc2 485 hci_skb_expect(skb) -= len;
803b5836
MH		 486
487 if (skb->len == HCI_EVENT_HDR_SIZE) {
488 /* Complete event header */
618e8bc2 489 hci_skb_expect(skb) = hci_event_hdr(skb)->plen;
803b5836 490
618e8bc2 491 if (skb_tailroom(skb) < hci_skb_expect(skb)) {
803b5836
MH		 492 kfree_skb(skb);
493 skb = NULL;
494
495 err = -EILSEQ;
496 break;
497 }
498 }
499
618e8bc2 500 if (!hci_skb_expect(skb)) {
803b5836 501 /* Complete frame */
97307f51 502 data->recv_event(data->hdev, skb);
803b5836
MH		 503 skb = NULL;
504 }
505 }
506
507 data->evt_skb = skb;
508 spin_unlock(&data->rxlock);
509
510 return err;
1ffa4ad0
MH		 511}
512
513static int btusb_recv_bulk(struct btusb_data *data, void *buffer, int count)
514{
803b5836
MH		 515 struct sk_buff *skb;
516 int err = 0;
517
518 spin_lock(&data->rxlock);
519 skb = data->acl_skb;
520
521 while (count) {
522 int len;
523
524 if (!skb) {
525 skb = bt_skb_alloc(HCI_MAX_FRAME_SIZE, GFP_ATOMIC);
526 if (!skb) {
527 err = -ENOMEM;
528 break;
529 }
530
618e8bc2
MH		 531 hci_skb_pkt_type(skb) = HCI_ACLDATA_PKT;
532 hci_skb_expect(skb) = HCI_ACL_HDR_SIZE;
803b5836
MH		 533 }
534
618e8bc2 535 len = min_t(uint, hci_skb_expect(skb), count);
59ae1d12 536 skb_put_data(skb, buffer, len);
803b5836
MH		 537
538 count -= len;
539 buffer += len;
618e8bc2 540 hci_skb_expect(skb) -= len;
803b5836
MH		 541
542 if (skb->len == HCI_ACL_HDR_SIZE) {
543 __le16 dlen = hci_acl_hdr(skb)->dlen;
544
545 /* Complete ACL header */
618e8bc2 546 hci_skb_expect(skb) = __le16_to_cpu(dlen);
803b5836 547
618e8bc2 548 if (skb_tailroom(skb) < hci_skb_expect(skb)) {
803b5836
MH		 549 kfree_skb(skb);
550 skb = NULL;
551
552 err = -EILSEQ;
553 break;
554 }
555 }
556
618e8bc2 557 if (!hci_skb_expect(skb)) {
803b5836
MH		 558 /* Complete frame */
559 hci_recv_frame(data->hdev, skb);
560 skb = NULL;
561 }
562 }
563
564 data->acl_skb = skb;
565 spin_unlock(&data->rxlock);
566
567 return err;
1ffa4ad0
MH		 568}
569
570static int btusb_recv_isoc(struct btusb_data *data, void *buffer, int count)
571{
803b5836
MH		 572 struct sk_buff *skb;
573 int err = 0;
574
575 spin_lock(&data->rxlock);
576 skb = data->sco_skb;
577
578 while (count) {
579 int len;
580
581 if (!skb) {
582 skb = bt_skb_alloc(HCI_MAX_SCO_SIZE, GFP_ATOMIC);
583 if (!skb) {
584 err = -ENOMEM;
585 break;
586 }
587
618e8bc2
MH		 588 hci_skb_pkt_type(skb) = HCI_SCODATA_PKT;
589 hci_skb_expect(skb) = HCI_SCO_HDR_SIZE;
803b5836
MH		 590 }
591
618e8bc2 592 len = min_t(uint, hci_skb_expect(skb), count);
59ae1d12 593 skb_put_data(skb, buffer, len);
803b5836
MH		 594
595 count -= len;
596 buffer += len;
618e8bc2 597 hci_skb_expect(skb) -= len;
803b5836
MH		 598
599 if (skb->len == HCI_SCO_HDR_SIZE) {
600 /* Complete SCO header */
618e8bc2 601 hci_skb_expect(skb) = hci_sco_hdr(skb)->dlen;
803b5836 602
618e8bc2 603 if (skb_tailroom(skb) < hci_skb_expect(skb)) {
803b5836
MH		 604 kfree_skb(skb);
605 skb = NULL;
606
607 err = -EILSEQ;
608 break;
609 }
610 }
611
618e8bc2 612 if (!hci_skb_expect(skb)) {
803b5836
MH		 613 /* Complete frame */
614 hci_recv_frame(data->hdev, skb);
615 skb = NULL;
616 }
617 }
618
619 data->sco_skb = skb;
620 spin_unlock(&data->rxlock);
621
622 return err;
1ffa4ad0
MH		 623}
624
5e23b923
MH		 625static void btusb_intr_complete(struct urb *urb)
626{
627 struct hci_dev *hdev = urb->context;
155961e8 628 struct btusb_data *data = hci_get_drvdata(hdev);
5e23b923
MH		 629 int err;
630
89e7533d
MH		 631 BT_DBG("%s urb %p status %d count %d", hdev->name, urb, urb->status,
632 urb->actual_length);
5e23b923
MH		 633
634 if (!test_bit(HCI_RUNNING, &hdev->flags))
635 return;
636
637 if (urb->status == 0) {
9bfa35fe
MH		 638 hdev->stat.byte_rx += urb->actual_length;
639
1ffa4ad0
MH		 640 if (btusb_recv_intr(data, urb->transfer_buffer,
641 urb->actual_length) < 0) {
5e23b923
MH		 642 BT_ERR("%s corrupted event packet", hdev->name);
643 hdev->stat.err_rx++;
644 }
85560c4a
CC		 645 } else if (urb->status == -ENOENT) {
646 /* Avoid suspend failed when usb_kill_urb */
647 return;
5e23b923
MH		 648 }
649
650 if (!test_bit(BTUSB_INTR_RUNNING, &data->flags))
651 return;
652
7bee549e 653 usb_mark_last_busy(data->udev);
5e23b923
MH		 654 usb_anchor_urb(urb, &data->intr_anchor);
655
656 err = usb_submit_urb(urb, GFP_ATOMIC);
657 if (err < 0) {
4935f1c1
PB		 658 /* -EPERM: urb is being killed;
659 * -ENODEV: device got disconnected */
660 if (err != -EPERM && err != -ENODEV)
61faddf6 661 BT_ERR("%s urb %p failed to resubmit (%d)",
89e7533d 662 hdev->name, urb, -err);
5e23b923
MH		 663 usb_unanchor_urb(urb);
664 }
665}
666
2eda66f4 667static int btusb_submit_intr_urb(struct hci_dev *hdev, gfp_t mem_flags)
5e23b923 668{
155961e8 669 struct btusb_data *data = hci_get_drvdata(hdev);
5e23b923
MH		 670 struct urb *urb;
671 unsigned char *buf;
672 unsigned int pipe;
673 int err, size;
674
675 BT_DBG("%s", hdev->name);
676
9bfa35fe
MH		 677 if (!data->intr_ep)
678 return -ENODEV;
679
2eda66f4 680 urb = usb_alloc_urb(0, mem_flags);
5e23b923
MH		 681 if (!urb)
682 return -ENOMEM;
683
684 size = le16_to_cpu(data->intr_ep->wMaxPacketSize);
685
2eda66f4 686 buf = kmalloc(size, mem_flags);
5e23b923
MH		 687 if (!buf) {
688 usb_free_urb(urb);
689 return -ENOMEM;
690 }
691
692 pipe = usb_rcvintpipe(data->udev, data->intr_ep->bEndpointAddress);
693
694 usb_fill_int_urb(urb, data->udev, pipe, buf, size,
89e7533d 695 btusb_intr_complete, hdev, data->intr_ep->bInterval);
5e23b923
MH		 696
697 urb->transfer_flags |= URB_FREE_BUFFER;
698
699 usb_anchor_urb(urb, &data->intr_anchor);
700
2eda66f4 701 err = usb_submit_urb(urb, mem_flags);
5e23b923 702 if (err < 0) {
d4b8d1c9
PB		 703 if (err != -EPERM && err != -ENODEV)
704 BT_ERR("%s urb %p submission failed (%d)",
89e7533d 705 hdev->name, urb, -err);
5e23b923 706 usb_unanchor_urb(urb);
5e23b923
MH		 707 }
708
709 usb_free_urb(urb);
710
711 return err;
712}
713
714static void btusb_bulk_complete(struct urb *urb)
715{
716 struct hci_dev *hdev = urb->context;
155961e8 717 struct btusb_data *data = hci_get_drvdata(hdev);
5e23b923
MH		 718 int err;
719
89e7533d
MH		 720 BT_DBG("%s urb %p status %d count %d", hdev->name, urb, urb->status,
721 urb->actual_length);
5e23b923
MH		 722
723 if (!test_bit(HCI_RUNNING, &hdev->flags))
724 return;
725
726 if (urb->status == 0) {
9bfa35fe
MH		 727 hdev->stat.byte_rx += urb->actual_length;
728
2cbd3f5c 729 if (data->recv_bulk(data, urb->transfer_buffer,
1ffa4ad0 730 urb->actual_length) < 0) {
5e23b923
MH		 731 BT_ERR("%s corrupted ACL packet", hdev->name);
732 hdev->stat.err_rx++;
733 }
85560c4a
CC		 734 } else if (urb->status == -ENOENT) {
735 /* Avoid suspend failed when usb_kill_urb */
736 return;
5e23b923
MH		 737 }
738
739 if (!test_bit(BTUSB_BULK_RUNNING, &data->flags))
740 return;
741
742 usb_anchor_urb(urb, &data->bulk_anchor);
652fd781 743 usb_mark_last_busy(data->udev);
5e23b923
MH		 744
745 err = usb_submit_urb(urb, GFP_ATOMIC);
746 if (err < 0) {
4935f1c1
PB		 747 /* -EPERM: urb is being killed;
748 * -ENODEV: device got disconnected */
749 if (err != -EPERM && err != -ENODEV)
61faddf6 750 BT_ERR("%s urb %p failed to resubmit (%d)",
89e7533d 751 hdev->name, urb, -err);
5e23b923
MH		 752 usb_unanchor_urb(urb);
753 }
754}
755
2eda66f4 756static int btusb_submit_bulk_urb(struct hci_dev *hdev, gfp_t mem_flags)
5e23b923 757{
155961e8 758 struct btusb_data *data = hci_get_drvdata(hdev);
5e23b923
MH		 759 struct urb *urb;
760 unsigned char *buf;
761 unsigned int pipe;
290ba200 762 int err, size = HCI_MAX_FRAME_SIZE;
5e23b923
MH		 763
764 BT_DBG("%s", hdev->name);
765
9bfa35fe
MH		 766 if (!data->bulk_rx_ep)
767 return -ENODEV;
768
2eda66f4 769 urb = usb_alloc_urb(0, mem_flags);
5e23b923
MH		 770 if (!urb)
771 return -ENOMEM;
772
2eda66f4 773 buf = kmalloc(size, mem_flags);
5e23b923
MH		 774 if (!buf) {
775 usb_free_urb(urb);
776 return -ENOMEM;
777 }
778
779 pipe = usb_rcvbulkpipe(data->udev, data->bulk_rx_ep->bEndpointAddress);
780
89e7533d
MH		 781 usb_fill_bulk_urb(urb, data->udev, pipe, buf, size,
782 btusb_bulk_complete, hdev);
5e23b923
MH		 783
784 urb->transfer_flags |= URB_FREE_BUFFER;
785
7bee549e 786 usb_mark_last_busy(data->udev);
5e23b923
MH		 787 usb_anchor_urb(urb, &data->bulk_anchor);
788
2eda66f4 789 err = usb_submit_urb(urb, mem_flags);
5e23b923 790 if (err < 0) {
d4b8d1c9
PB		 791 if (err != -EPERM && err != -ENODEV)
792 BT_ERR("%s urb %p submission failed (%d)",
89e7533d 793 hdev->name, urb, -err);
5e23b923 794 usb_unanchor_urb(urb);
5e23b923
MH		 795 }
796
797 usb_free_urb(urb);
798
799 return err;
800}
801
9bfa35fe
MH		 802static void btusb_isoc_complete(struct urb *urb)
803{
804 struct hci_dev *hdev = urb->context;
155961e8 805 struct btusb_data *data = hci_get_drvdata(hdev);
9bfa35fe
MH		 806 int i, err;
807
89e7533d
MH		 808 BT_DBG("%s urb %p status %d count %d", hdev->name, urb, urb->status,
809 urb->actual_length);
9bfa35fe
MH		 810
811 if (!test_bit(HCI_RUNNING, &hdev->flags))
812 return;
813
814 if (urb->status == 0) {
815 for (i = 0; i < urb->number_of_packets; i++) {
816 unsigned int offset = urb->iso_frame_desc[i].offset;
817 unsigned int length = urb->iso_frame_desc[i].actual_length;
818
819 if (urb->iso_frame_desc[i].status)
820 continue;
821
822 hdev->stat.byte_rx += length;
823
1ffa4ad0
MH		 824 if (btusb_recv_isoc(data, urb->transfer_buffer + offset,
825 length) < 0) {
9bfa35fe
MH		 826 BT_ERR("%s corrupted SCO packet", hdev->name);
827 hdev->stat.err_rx++;
828 }
829 }
85560c4a
CC		 830 } else if (urb->status == -ENOENT) {
831 /* Avoid suspend failed when usb_kill_urb */
832 return;
9bfa35fe
MH		 833 }
834
835 if (!test_bit(BTUSB_ISOC_RUNNING, &data->flags))
836 return;
837
838 usb_anchor_urb(urb, &data->isoc_anchor);
839
840 err = usb_submit_urb(urb, GFP_ATOMIC);
841 if (err < 0) {
4935f1c1
PB		 842 /* -EPERM: urb is being killed;
843 * -ENODEV: device got disconnected */
844 if (err != -EPERM && err != -ENODEV)
61faddf6 845 BT_ERR("%s urb %p failed to resubmit (%d)",
89e7533d 846 hdev->name, urb, -err);
9bfa35fe
MH		 847 usb_unanchor_urb(urb);
848 }
849}
850
42b16b3f 851static inline void __fill_isoc_descriptor(struct urb *urb, int len, int mtu)
9bfa35fe
MH		 852{
853 int i, offset = 0;
854
855 BT_DBG("len %d mtu %d", len, mtu);
856
857 for (i = 0; i < BTUSB_MAX_ISOC_FRAMES && len >= mtu;
858 i++, offset += mtu, len -= mtu) {
859 urb->iso_frame_desc[i].offset = offset;
860 urb->iso_frame_desc[i].length = mtu;
861 }
862
863 if (len && i < BTUSB_MAX_ISOC_FRAMES) {
864 urb->iso_frame_desc[i].offset = offset;
865 urb->iso_frame_desc[i].length = len;
866 i++;
867 }
868
869 urb->number_of_packets = i;
870}
871
2eda66f4 872static int btusb_submit_isoc_urb(struct hci_dev *hdev, gfp_t mem_flags)
9bfa35fe 873{
155961e8 874 struct btusb_data *data = hci_get_drvdata(hdev);
9bfa35fe
MH		 875 struct urb *urb;
876 unsigned char *buf;
877 unsigned int pipe;
878 int err, size;
879
880 BT_DBG("%s", hdev->name);
881
882 if (!data->isoc_rx_ep)
883 return -ENODEV;
884
2eda66f4 885 urb = usb_alloc_urb(BTUSB_MAX_ISOC_FRAMES, mem_flags);
9bfa35fe
MH		 886 if (!urb)
887 return -ENOMEM;
888
889 size = le16_to_cpu(data->isoc_rx_ep->wMaxPacketSize) *
890 BTUSB_MAX_ISOC_FRAMES;
891
2eda66f4 892 buf = kmalloc(size, mem_flags);
9bfa35fe
MH		 893 if (!buf) {
894 usb_free_urb(urb);
895 return -ENOMEM;
896 }
897
898 pipe = usb_rcvisocpipe(data->udev, data->isoc_rx_ep->bEndpointAddress);
899
fa0fb93f 900 usb_fill_int_urb(urb, data->udev, pipe, buf, size, btusb_isoc_complete,
89e7533d 901 hdev, data->isoc_rx_ep->bInterval);
9bfa35fe 902
89e7533d 903 urb->transfer_flags = URB_FREE_BUFFER | URB_ISO_ASAP;
9bfa35fe
MH		 904
905 __fill_isoc_descriptor(urb, size,
89e7533d 906 le16_to_cpu(data->isoc_rx_ep->wMaxPacketSize));
9bfa35fe
MH		 907
908 usb_anchor_urb(urb, &data->isoc_anchor);
909
2eda66f4 910 err = usb_submit_urb(urb, mem_flags);
9bfa35fe 911 if (err < 0) {
d4b8d1c9
PB		 912 if (err != -EPERM && err != -ENODEV)
913 BT_ERR("%s urb %p submission failed (%d)",
89e7533d 914 hdev->name, urb, -err);
9bfa35fe 915 usb_unanchor_urb(urb);
9bfa35fe
MH		 916 }
917
918 usb_free_urb(urb);
919
920 return err;
921}
922
9d08f504
MH		 923static void btusb_diag_complete(struct urb *urb)
924{
925 struct hci_dev *hdev = urb->context;
926 struct btusb_data *data = hci_get_drvdata(hdev);
927 int err;
928
929 BT_DBG("%s urb %p status %d count %d", hdev->name, urb, urb->status,
930 urb->actual_length);
931
932 if (urb->status == 0) {
933 struct sk_buff *skb;
934
935 skb = bt_skb_alloc(urb->actual_length, GFP_ATOMIC);
936 if (skb) {
59ae1d12
JB		 937 skb_put_data(skb, urb->transfer_buffer,
938 urb->actual_length);
9d08f504
MH		 939 hci_recv_diag(hdev, skb);
940 }
941 } else if (urb->status == -ENOENT) {
942 /* Avoid suspend failed when usb_kill_urb */
943 return;
944 }
945
946 if (!test_bit(BTUSB_DIAG_RUNNING, &data->flags))
947 return;
948
949 usb_anchor_urb(urb, &data->diag_anchor);
950 usb_mark_last_busy(data->udev);
951
952 err = usb_submit_urb(urb, GFP_ATOMIC);
953 if (err < 0) {
954 /* -EPERM: urb is being killed;
955 * -ENODEV: device got disconnected */
956 if (err != -EPERM && err != -ENODEV)
957 BT_ERR("%s urb %p failed to resubmit (%d)",
958 hdev->name, urb, -err);
959 usb_unanchor_urb(urb);
960 }
961}
962
963static int btusb_submit_diag_urb(struct hci_dev *hdev, gfp_t mem_flags)
964{
965 struct btusb_data *data = hci_get_drvdata(hdev);
966 struct urb *urb;
967 unsigned char *buf;
968 unsigned int pipe;
969 int err, size = HCI_MAX_FRAME_SIZE;
970
971 BT_DBG("%s", hdev->name);
972
973 if (!data->diag_rx_ep)
974 return -ENODEV;
975
976 urb = usb_alloc_urb(0, mem_flags);
977 if (!urb)
978 return -ENOMEM;
979
980 buf = kmalloc(size, mem_flags);
981 if (!buf) {
982 usb_free_urb(urb);
983 return -ENOMEM;
984 }
985
986 pipe = usb_rcvbulkpipe(data->udev, data->diag_rx_ep->bEndpointAddress);
987
988 usb_fill_bulk_urb(urb, data->udev, pipe, buf, size,
989 btusb_diag_complete, hdev);
990
991 urb->transfer_flags |= URB_FREE_BUFFER;
992
993 usb_mark_last_busy(data->udev);
994 usb_anchor_urb(urb, &data->diag_anchor);
995
996 err = usb_submit_urb(urb, mem_flags);
997 if (err < 0) {
998 if (err != -EPERM && err != -ENODEV)
999 BT_ERR("%s urb %p submission failed (%d)",
1000 hdev->name, urb, -err);
1001 usb_unanchor_urb(urb);
1002 }
1003
1004 usb_free_urb(urb);
1005
1006 return err;
1007}
1008
5e23b923 1009static void btusb_tx_complete(struct urb *urb)
7bee549e
ON		 1010{
1011 struct sk_buff *skb = urb->context;
89e7533d 1012 struct hci_dev *hdev = (struct hci_dev *)skb->dev;
155961e8 1013 struct btusb_data *data = hci_get_drvdata(hdev);
7bee549e 1014
89e7533d
MH		 1015 BT_DBG("%s urb %p status %d count %d", hdev->name, urb, urb->status,
1016 urb->actual_length);
7bee549e
ON		 1017
1018 if (!test_bit(HCI_RUNNING, &hdev->flags))
1019 goto done;
1020
1021 if (!urb->status)
1022 hdev->stat.byte_tx += urb->transfer_buffer_length;
1023 else
1024 hdev->stat.err_tx++;
1025
1026done:
1027 spin_lock(&data->txlock);
1028 data->tx_in_flight--;
1029 spin_unlock(&data->txlock);
1030
1031 kfree(urb->setup_packet);
1032
1033 kfree_skb(skb);
1034}
1035
1036static void btusb_isoc_tx_complete(struct urb *urb)
5e23b923
MH		 1037{
1038 struct sk_buff *skb = urb->context;
89e7533d 1039 struct hci_dev *hdev = (struct hci_dev *)skb->dev;
5e23b923 1040
89e7533d
MH		 1041 BT_DBG("%s urb %p status %d count %d", hdev->name, urb, urb->status,
1042 urb->actual_length);
5e23b923
MH		 1043
1044 if (!test_bit(HCI_RUNNING, &hdev->flags))
1045 goto done;
1046
1047 if (!urb->status)
1048 hdev->stat.byte_tx += urb->transfer_buffer_length;
1049 else
1050 hdev->stat.err_tx++;
1051
1052done:
1053 kfree(urb->setup_packet);
1054
1055 kfree_skb(skb);
1056}
1057
1058static int btusb_open(struct hci_dev *hdev)
1059{
155961e8 1060 struct btusb_data *data = hci_get_drvdata(hdev);
5e23b923
MH		 1061 int err;
1062
1063 BT_DBG("%s", hdev->name);
1064
c7e163fe
EH		 1065 err = usb_autopm_get_interface(data->intf);
1066 if (err < 0)
1067 return err;
1068
ace31982
KBYT		 1069 /* Patching USB firmware files prior to starting any URBs of HCI path
1070 * It is more safe to use USB bulk channel for downloading USB patch
1071 */
1072 if (data->setup_on_usb) {
1073 err = data->setup_on_usb(hdev);
eb50042f 1074 if (err < 0)
ace31982
KBYT		 1075 return err;
1076 }
1077
7bee549e
ON		 1078 data->intf->needs_remote_wakeup = 1;
1079
5e23b923 1080 if (test_and_set_bit(BTUSB_INTR_RUNNING, &data->flags))
7bee549e 1081 goto done;
5e23b923 1082
2eda66f4 1083 err = btusb_submit_intr_urb(hdev, GFP_KERNEL);
43c2e57f
MH		 1084 if (err < 0)
1085 goto failed;
1086
1087 err = btusb_submit_bulk_urb(hdev, GFP_KERNEL);
5e23b923 1088 if (err < 0) {
43c2e57f
MH		 1089 usb_kill_anchored_urbs(&data->intr_anchor);
1090 goto failed;
5e23b923
MH		 1091 }
1092
43c2e57f
MH		 1093 set_bit(BTUSB_BULK_RUNNING, &data->flags);
1094 btusb_submit_bulk_urb(hdev, GFP_KERNEL);
1095
9d08f504
MH		 1096 if (data->diag) {
1097 if (!btusb_submit_diag_urb(hdev, GFP_KERNEL))
1098 set_bit(BTUSB_DIAG_RUNNING, &data->flags);
1099 }
1100
7bee549e
ON		 1101done:
1102 usb_autopm_put_interface(data->intf);
43c2e57f
MH		 1103 return 0;
1104
1105failed:
1106 clear_bit(BTUSB_INTR_RUNNING, &data->flags);
7bee549e 1107 usb_autopm_put_interface(data->intf);
5e23b923
MH		 1108 return err;
1109}
1110
7bee549e
ON		 1111static void btusb_stop_traffic(struct btusb_data *data)
1112{
1113 usb_kill_anchored_urbs(&data->intr_anchor);
1114 usb_kill_anchored_urbs(&data->bulk_anchor);
1115 usb_kill_anchored_urbs(&data->isoc_anchor);
9d08f504 1116 usb_kill_anchored_urbs(&data->diag_anchor);
7bee549e
ON		 1117}
1118
5e23b923
MH		 1119static int btusb_close(struct hci_dev *hdev)
1120{
155961e8 1121 struct btusb_data *data = hci_get_drvdata(hdev);
7bee549e 1122 int err;
5e23b923
MH		 1123
1124 BT_DBG("%s", hdev->name);
1125
e8c3c3d2 1126 cancel_work_sync(&data->work);
404291ac 1127 cancel_work_sync(&data->waker);
e8c3c3d2 1128
9bfa35fe 1129 clear_bit(BTUSB_ISOC_RUNNING, &data->flags);
5e23b923 1130 clear_bit(BTUSB_BULK_RUNNING, &data->flags);
5e23b923 1131 clear_bit(BTUSB_INTR_RUNNING, &data->flags);
9d08f504 1132 clear_bit(BTUSB_DIAG_RUNNING, &data->flags);
7bee549e
ON		 1133
1134 btusb_stop_traffic(data);
803b5836
MH		 1135 btusb_free_frags(data);
1136
7bee549e
ON		 1137 err = usb_autopm_get_interface(data->intf);
1138 if (err < 0)
7b8e2c1d 1139 goto failed;
7bee549e
ON		 1140
1141 data->intf->needs_remote_wakeup = 0;
1142 usb_autopm_put_interface(data->intf);
5e23b923 1143
7b8e2c1d
ON		 1144failed:
1145 usb_scuttle_anchored_urbs(&data->deferred);
5e23b923
MH		 1146 return 0;
1147}
1148
1149static int btusb_flush(struct hci_dev *hdev)
1150{
155961e8 1151 struct btusb_data *data = hci_get_drvdata(hdev);
5e23b923
MH		 1152
1153 BT_DBG("%s", hdev->name);
1154
1155 usb_kill_anchored_urbs(&data->tx_anchor);
803b5836 1156 btusb_free_frags(data);
5e23b923
MH		 1157
1158 return 0;
1159}
1160
047b2ec8 1161static struct urb *alloc_ctrl_urb(struct hci_dev *hdev, struct sk_buff *skb)
5e23b923 1162{
155961e8 1163 struct btusb_data *data = hci_get_drvdata(hdev);
5e23b923
MH		 1164 struct usb_ctrlrequest *dr;
1165 struct urb *urb;
1166 unsigned int pipe;
5e23b923 1167
047b2ec8
MH		 1168 urb = usb_alloc_urb(0, GFP_KERNEL);
1169 if (!urb)
1170 return ERR_PTR(-ENOMEM);
5e23b923 1171
047b2ec8
MH		 1172 dr = kmalloc(sizeof(*dr), GFP_KERNEL);
1173 if (!dr) {
1174 usb_free_urb(urb);
1175 return ERR_PTR(-ENOMEM);
1176 }
5e23b923 1177
047b2ec8 1178 dr->bRequestType = data->cmdreq_type;
893ba544 1179 dr->bRequest = data->cmdreq;
047b2ec8
MH		 1180 dr->wIndex = 0;
1181 dr->wValue = 0;
1182 dr->wLength = __cpu_to_le16(skb->len);
7bd8f09f 1183
047b2ec8 1184 pipe = usb_sndctrlpipe(data->udev, 0x00);
5e23b923 1185
89e7533d 1186 usb_fill_control_urb(urb, data->udev, pipe, (void *)dr,
047b2ec8 1187 skb->data, skb->len, btusb_tx_complete, skb);
5e23b923 1188
89e7533d 1189 skb->dev = (void *)hdev;
5e23b923 1190
047b2ec8
MH		 1191 return urb;
1192}
5e23b923 1193
047b2ec8
MH		 1194static struct urb *alloc_bulk_urb(struct hci_dev *hdev, struct sk_buff *skb)
1195{
1196 struct btusb_data *data = hci_get_drvdata(hdev);
1197 struct urb *urb;
1198 unsigned int pipe;
5e23b923 1199
047b2ec8
MH		 1200 if (!data->bulk_tx_ep)
1201 return ERR_PTR(-ENODEV);
9bfa35fe 1202
047b2ec8
MH		 1203 urb = usb_alloc_urb(0, GFP_KERNEL);
1204 if (!urb)
1205 return ERR_PTR(-ENOMEM);
5e23b923 1206
047b2ec8 1207 pipe = usb_sndbulkpipe(data->udev, data->bulk_tx_ep->bEndpointAddress);
5e23b923 1208
047b2ec8
MH		 1209 usb_fill_bulk_urb(urb, data->udev, pipe,
1210 skb->data, skb->len, btusb_tx_complete, skb);
5e23b923 1211
89e7533d 1212 skb->dev = (void *)hdev;
5e23b923 1213
047b2ec8
MH		 1214 return urb;
1215}
9bfa35fe 1216
047b2ec8
MH		 1217static struct urb *alloc_isoc_urb(struct hci_dev *hdev, struct sk_buff *skb)
1218{
1219 struct btusb_data *data = hci_get_drvdata(hdev);
1220 struct urb *urb;
1221 unsigned int pipe;
9bfa35fe 1222
047b2ec8
MH		 1223 if (!data->isoc_tx_ep)
1224 return ERR_PTR(-ENODEV);
9bfa35fe 1225
047b2ec8
MH		 1226 urb = usb_alloc_urb(BTUSB_MAX_ISOC_FRAMES, GFP_KERNEL);
1227 if (!urb)
1228 return ERR_PTR(-ENOMEM);
9bfa35fe 1229
047b2ec8 1230 pipe = usb_sndisocpipe(data->udev, data->isoc_tx_ep->bEndpointAddress);
9bfa35fe 1231
047b2ec8
MH		 1232 usb_fill_int_urb(urb, data->udev, pipe,
1233 skb->data, skb->len, btusb_isoc_tx_complete,
1234 skb, data->isoc_tx_ep->bInterval);
9bfa35fe 1235
047b2ec8 1236 urb->transfer_flags = URB_ISO_ASAP;
5e23b923 1237
047b2ec8
MH		 1238 __fill_isoc_descriptor(urb, skb->len,
1239 le16_to_cpu(data->isoc_tx_ep->wMaxPacketSize));
5e23b923 1240
89e7533d 1241 skb->dev = (void *)hdev;
047b2ec8
MH		 1242
1243 return urb;
1244}
1245
1246static int submit_tx_urb(struct hci_dev *hdev, struct urb *urb)
1247{
1248 struct btusb_data *data = hci_get_drvdata(hdev);
1249 int err;
7bee549e 1250
5e23b923
MH		 1251 usb_anchor_urb(urb, &data->tx_anchor);
1252
e9753eff 1253 err = usb_submit_urb(urb, GFP_KERNEL);
5e23b923 1254 if (err < 0) {
5a9b80e2
PB		 1255 if (err != -EPERM && err != -ENODEV)
1256 BT_ERR("%s urb %p submission failed (%d)",
89e7533d 1257 hdev->name, urb, -err);
5e23b923
MH		 1258 kfree(urb->setup_packet);
1259 usb_unanchor_urb(urb);
7bee549e
ON		 1260 } else {
1261 usb_mark_last_busy(data->udev);
5e23b923
MH		 1262 }
1263
54a8a79c 1264 usb_free_urb(urb);
5e23b923
MH		 1265 return err;
1266}
1267
047b2ec8
MH		 1268static int submit_or_queue_tx_urb(struct hci_dev *hdev, struct urb *urb)
1269{
1270 struct btusb_data *data = hci_get_drvdata(hdev);
1271 unsigned long flags;
1272 bool suspending;
1273
1274 spin_lock_irqsave(&data->txlock, flags);
1275 suspending = test_bit(BTUSB_SUSPENDING, &data->flags);
1276 if (!suspending)
1277 data->tx_in_flight++;
1278 spin_unlock_irqrestore(&data->txlock, flags);
1279
1280 if (!suspending)
1281 return submit_tx_urb(hdev, urb);
1282
1283 usb_anchor_urb(urb, &data->deferred);
1284 schedule_work(&data->waker);
1285
1286 usb_free_urb(urb);
1287 return 0;
1288}
1289
1290static int btusb_send_frame(struct hci_dev *hdev, struct sk_buff *skb)
1291{
1292 struct urb *urb;
1293
1294 BT_DBG("%s", hdev->name);
1295
618e8bc2 1296 switch (hci_skb_pkt_type(skb)) {
047b2ec8
MH		 1297 case HCI_COMMAND_PKT:
1298 urb = alloc_ctrl_urb(hdev, skb);
1299 if (IS_ERR(urb))
1300 return PTR_ERR(urb);
1301
1302 hdev->stat.cmd_tx++;
1303 return submit_or_queue_tx_urb(hdev, urb);
1304
1305 case HCI_ACLDATA_PKT:
1306 urb = alloc_bulk_urb(hdev, skb);
1307 if (IS_ERR(urb))
1308 return PTR_ERR(urb);
1309
1310 hdev->stat.acl_tx++;
1311 return submit_or_queue_tx_urb(hdev, urb);
1312
1313 case HCI_SCODATA_PKT:
1314 if (hci_conn_num(hdev, SCO_LINK) < 1)
1315 return -ENODEV;
1316
1317 urb = alloc_isoc_urb(hdev, skb);
1318 if (IS_ERR(urb))
1319 return PTR_ERR(urb);
1320
1321 hdev->stat.sco_tx++;
1322 return submit_tx_urb(hdev, urb);
1323 }
1324
1325 return -EILSEQ;
1326}
1327
5e23b923
MH		 1328static void btusb_notify(struct hci_dev *hdev, unsigned int evt)
1329{
155961e8 1330 struct btusb_data *data = hci_get_drvdata(hdev);
5e23b923
MH		 1331
1332 BT_DBG("%s evt %d", hdev->name, evt);
1333
014f7bc7
MH		 1334 if (hci_conn_num(hdev, SCO_LINK) != data->sco_num) {
1335 data->sco_num = hci_conn_num(hdev, SCO_LINK);
43c2e57f 1336 schedule_work(&data->work);
a780efa8 1337 }
5e23b923
MH		 1338}
1339
42b16b3f 1340static inline int __set_isoc_interface(struct hci_dev *hdev, int altsetting)
9bfa35fe 1341{
155961e8 1342 struct btusb_data *data = hci_get_drvdata(hdev);
9bfa35fe
MH		 1343 struct usb_interface *intf = data->isoc;
1344 struct usb_endpoint_descriptor *ep_desc;
1345 int i, err;
1346
1347 if (!data->isoc)
1348 return -ENODEV;
1349
1350 err = usb_set_interface(data->udev, 1, altsetting);
1351 if (err < 0) {
1352 BT_ERR("%s setting interface failed (%d)", hdev->name, -err);
1353 return err;
1354 }
1355
1356 data->isoc_altsetting = altsetting;
1357
1358 data->isoc_tx_ep = NULL;
1359 data->isoc_rx_ep = NULL;
1360
1361 for (i = 0; i < intf->cur_altsetting->desc.bNumEndpoints; i++) {
1362 ep_desc = &intf->cur_altsetting->endpoint[i].desc;
1363
1364 if (!data->isoc_tx_ep && usb_endpoint_is_isoc_out(ep_desc)) {
1365 data->isoc_tx_ep = ep_desc;
1366 continue;
1367 }
1368
1369 if (!data->isoc_rx_ep && usb_endpoint_is_isoc_in(ep_desc)) {
1370 data->isoc_rx_ep = ep_desc;
1371 continue;
1372 }
1373 }
1374
1375 if (!data->isoc_tx_ep || !data->isoc_rx_ep) {
1376 BT_ERR("%s invalid SCO descriptors", hdev->name);
1377 return -ENODEV;
1378 }
1379
1380 return 0;
1381}
1382
5e23b923
MH		 1383static void btusb_work(struct work_struct *work)
1384{
1385 struct btusb_data *data = container_of(work, struct btusb_data, work);
1386 struct hci_dev *hdev = data->hdev;
f4001d28 1387 int new_alts;
7bee549e 1388 int err;
5e23b923 1389
014f7bc7 1390 if (data->sco_num > 0) {
08b8b6c4 1391 if (!test_bit(BTUSB_DID_ISO_RESUME, &data->flags)) {
8efdd0cd 1392 err = usb_autopm_get_interface(data->isoc ? data->isoc : data->intf);
7bee549e
ON		 1393 if (err < 0) {
1394 clear_bit(BTUSB_ISOC_RUNNING, &data->flags);
1395 usb_kill_anchored_urbs(&data->isoc_anchor);
1396 return;
1397 }
1398
08b8b6c4 1399 set_bit(BTUSB_DID_ISO_RESUME, &data->flags);
7bee549e 1400 }
f4001d28
MA		 1401
1402 if (hdev->voice_setting & 0x0020) {
1403 static const int alts[3] = { 2, 4, 5 };
89e7533d 1404
014f7bc7 1405 new_alts = alts[data->sco_num - 1];
f4001d28 1406 } else {
014f7bc7 1407 new_alts = data->sco_num;
f4001d28
MA		 1408 }
1409
1410 if (data->isoc_altsetting != new_alts) {
f6fc86f2
KP		 1411 unsigned long flags;
1412
9bfa35fe
MH		 1413 clear_bit(BTUSB_ISOC_RUNNING, &data->flags);
1414 usb_kill_anchored_urbs(&data->isoc_anchor);
1415
8f9d02f4
KP		 1416 /* When isochronous alternate setting needs to be
1417 * changed, because SCO connection has been added
1418 * or removed, a packet fragment may be left in the
1419 * reassembling state. This could lead to wrongly
1420 * assembled fragments.
1421 *
1422 * Clear outstanding fragment when selecting a new
1423 * alternate setting.
1424 */
f6fc86f2 1425 spin_lock_irqsave(&data->rxlock, flags);
8f9d02f4
KP		 1426 kfree_skb(data->sco_skb);
1427 data->sco_skb = NULL;
f6fc86f2 1428 spin_unlock_irqrestore(&data->rxlock, flags);
8f9d02f4 1429
f4001d28 1430 if (__set_isoc_interface(hdev, new_alts) < 0)
9bfa35fe
MH		 1431 return;
1432 }
1433
1434 if (!test_and_set_bit(BTUSB_ISOC_RUNNING, &data->flags)) {
2eda66f4 1435 if (btusb_submit_isoc_urb(hdev, GFP_KERNEL) < 0)
9bfa35fe
MH		 1436 clear_bit(BTUSB_ISOC_RUNNING, &data->flags);
1437 else
2eda66f4 1438 btusb_submit_isoc_urb(hdev, GFP_KERNEL);
9bfa35fe
MH		 1439 }
1440 } else {
1441 clear_bit(BTUSB_ISOC_RUNNING, &data->flags);
1442 usb_kill_anchored_urbs(&data->isoc_anchor);
1443
1444 __set_isoc_interface(hdev, 0);
08b8b6c4 1445 if (test_and_clear_bit(BTUSB_DID_ISO_RESUME, &data->flags))
8efdd0cd 1446 usb_autopm_put_interface(data->isoc ? data->isoc : data->intf);
5e23b923
MH		 1447 }
1448}
1449
7bee549e
ON		 1450static void btusb_waker(struct work_struct *work)
1451{
1452 struct btusb_data *data = container_of(work, struct btusb_data, waker);
1453 int err;
1454
1455 err = usb_autopm_get_interface(data->intf);
1456 if (err < 0)
1457 return;
1458
1459 usb_autopm_put_interface(data->intf);
1460}
1461
9f8f962c
MH		 1462static int btusb_setup_bcm92035(struct hci_dev *hdev)
1463{
1464 struct sk_buff *skb;
1465 u8 val = 0x00;
1466
1467 BT_DBG("%s", hdev->name);
1468
1469 skb = __hci_cmd_sync(hdev, 0xfc3b, 1, &val, HCI_INIT_TIMEOUT);
1470 if (IS_ERR(skb))
1471 BT_ERR("BCM92035 command failed (%ld)", -PTR_ERR(skb));
1472 else
1473 kfree_skb(skb);
1474
1475 return 0;
1476}
1477
81cac64b
MH		 1478static int btusb_setup_csr(struct hci_dev *hdev)
1479{
1480 struct hci_rp_read_local_version *rp;
1481 struct sk_buff *skb;
81cac64b
MH		 1482
1483 BT_DBG("%s", hdev->name);
1484
7cd84d72
MH		 1485 skb = __hci_cmd_sync(hdev, HCI_OP_READ_LOCAL_VERSION, 0, NULL,
1486 HCI_INIT_TIMEOUT);
1487 if (IS_ERR(skb)) {
1488 int err = PTR_ERR(skb);
1489 BT_ERR("%s: CSR: Local version failed (%d)", hdev->name, err);
1490 return err;
1491 }
1492
1493 if (skb->len != sizeof(struct hci_rp_read_local_version)) {
1494 BT_ERR("%s: CSR: Local version length mismatch", hdev->name);
1495 kfree_skb(skb);
1496 return -EIO;
1497 }
81cac64b 1498
89e7533d 1499 rp = (struct hci_rp_read_local_version *)skb->data;
81cac64b 1500
6cafcd95
JH		 1501 /* Detect controllers which aren't real CSR ones. */
1502 if (le16_to_cpu(rp->manufacturer) != 10 ||
1503 le16_to_cpu(rp->lmp_subver) == 0x0c5c) {
9641d343
MH		 1504 /* Clear the reset quirk since this is not an actual
1505 * early Bluetooth 1.1 device from CSR.
1506 */
1507 clear_bit(HCI_QUIRK_RESET_ON_CLOSE, &hdev->quirks);
81cac64b 1508
9641d343
MH		 1509 /* These fake CSR controllers have all a broken
1510 * stored link key handling and so just disable it.
1511 */
1512 set_bit(HCI_QUIRK_BROKEN_STORED_LINK_KEY, &hdev->quirks);
1513 }
81cac64b
MH		 1514
1515 kfree_skb(skb);
1516
9641d343 1517 return 0;
81cac64b
MH		 1518}
1519
dffd30ee 1520static const struct firmware *btusb_setup_intel_get_fw(struct hci_dev *hdev,
89e7533d 1521 struct intel_version *ver)
dffd30ee
THJA		 1522{
1523 const struct firmware *fw;
1524 char fwname[64];
1525 int ret;
1526
1527 snprintf(fwname, sizeof(fwname),
1528 "intel/ibt-hw-%x.%x.%x-fw-%x.%x.%x.%x.%x.bseq",
1529 ver->hw_platform, ver->hw_variant, ver->hw_revision,
1530 ver->fw_variant, ver->fw_revision, ver->fw_build_num,
1531 ver->fw_build_ww, ver->fw_build_yy);
1532
1533 ret = request_firmware(&fw, fwname, &hdev->dev);
1534 if (ret < 0) {
1535 if (ret == -EINVAL) {
1536 BT_ERR("%s Intel firmware file request failed (%d)",
1537 hdev->name, ret);
1538 return NULL;
1539 }
1540
1541 BT_ERR("%s failed to open Intel firmware file: %s(%d)",
1542 hdev->name, fwname, ret);
1543
1544 /* If the correct firmware patch file is not found, use the
1545 * default firmware patch file instead
1546 */
1547 snprintf(fwname, sizeof(fwname), "intel/ibt-hw-%x.%x.bseq",
1548 ver->hw_platform, ver->hw_variant);
1549 if (request_firmware(&fw, fwname, &hdev->dev) < 0) {
1550 BT_ERR("%s failed to open default Intel fw file: %s",
1551 hdev->name, fwname);
1552 return NULL;
1553 }
1554 }
1555
1556 BT_INFO("%s: Intel Bluetooth firmware file: %s", hdev->name, fwname);
1557
1558 return fw;
1559}
1560
1561static int btusb_setup_intel_patching(struct hci_dev *hdev,
1562 const struct firmware *fw,
1563 const u8 **fw_ptr, int *disable_patch)
1564{
1565 struct sk_buff *skb;
1566 struct hci_command_hdr *cmd;
1567 const u8 *cmd_param;
1568 struct hci_event_hdr *evt = NULL;
1569 const u8 *evt_param = NULL;
1570 int remain = fw->size - (*fw_ptr - fw->data);
1571
1572 /* The first byte indicates the types of the patch command or event.
1573 * 0x01 means HCI command and 0x02 is HCI event. If the first bytes
1574 * in the current firmware buffer doesn't start with 0x01 or
1575 * the size of remain buffer is smaller than HCI command header,
1576 * the firmware file is corrupted and it should stop the patching
1577 * process.
1578 */
1579 if (remain > HCI_COMMAND_HDR_SIZE && *fw_ptr[0] != 0x01) {
1580 BT_ERR("%s Intel fw corrupted: invalid cmd read", hdev->name);
1581 return -EINVAL;
1582 }
1583 (*fw_ptr)++;
1584 remain--;
1585
1586 cmd = (struct hci_command_hdr *)(*fw_ptr);
1587 *fw_ptr += sizeof(*cmd);
1588 remain -= sizeof(*cmd);
1589
1590 /* Ensure that the remain firmware data is long enough than the length
1591 * of command parameter. If not, the firmware file is corrupted.
1592 */
1593 if (remain < cmd->plen) {
1594 BT_ERR("%s Intel fw corrupted: invalid cmd len", hdev->name);
1595 return -EFAULT;
1596 }
1597
1598 /* If there is a command that loads a patch in the firmware
1599 * file, then enable the patch upon success, otherwise just
1600 * disable the manufacturer mode, for example patch activation
1601 * is not required when the default firmware patch file is used
1602 * because there are no patch data to load.
1603 */
1604 if (*disable_patch && le16_to_cpu(cmd->opcode) == 0xfc8e)
1605 *disable_patch = 0;
1606
1607 cmd_param = *fw_ptr;
1608 *fw_ptr += cmd->plen;
1609 remain -= cmd->plen;
1610
1611 /* This reads the expected events when the above command is sent to the
1612 * device. Some vendor commands expects more than one events, for
1613 * example command status event followed by vendor specific event.
1614 * For this case, it only keeps the last expected event. so the command
1615 * can be sent with __hci_cmd_sync_ev() which returns the sk_buff of
1616 * last expected event.
1617 */
1618 while (remain > HCI_EVENT_HDR_SIZE && *fw_ptr[0] == 0x02) {
1619 (*fw_ptr)++;
1620 remain--;
1621
1622 evt = (struct hci_event_hdr *)(*fw_ptr);
1623 *fw_ptr += sizeof(*evt);
1624 remain -= sizeof(*evt);
1625
1626 if (remain < evt->plen) {
1627 BT_ERR("%s Intel fw corrupted: invalid evt len",
1628 hdev->name);
1629 return -EFAULT;
1630 }
1631
1632 evt_param = *fw_ptr;
1633 *fw_ptr += evt->plen;
1634 remain -= evt->plen;
1635 }
1636
1637 /* Every HCI commands in the firmware file has its correspond event.
1638 * If event is not found or remain is smaller than zero, the firmware
1639 * file is corrupted.
1640 */
1641 if (!evt || !evt_param || remain < 0) {
1642 BT_ERR("%s Intel fw corrupted: invalid evt read", hdev->name);
1643 return -EFAULT;
1644 }
1645
1646 skb = __hci_cmd_sync_ev(hdev, le16_to_cpu(cmd->opcode), cmd->plen,
1647 cmd_param, evt->evt, HCI_INIT_TIMEOUT);
1648 if (IS_ERR(skb)) {
1649 BT_ERR("%s sending Intel patch command (0x%4.4x) failed (%ld)",
1650 hdev->name, cmd->opcode, PTR_ERR(skb));
d9c78e97 1651 return PTR_ERR(skb);
dffd30ee
THJA		 1652 }
1653
1654 /* It ensures that the returned event matches the event data read from
1655 * the firmware file. At fist, it checks the length and then
1656 * the contents of the event.
1657 */
1658 if (skb->len != evt->plen) {
1659 BT_ERR("%s mismatch event length (opcode 0x%4.4x)", hdev->name,
1660 le16_to_cpu(cmd->opcode));
1661 kfree_skb(skb);
1662 return -EFAULT;
1663 }
1664
1665 if (memcmp(skb->data, evt_param, evt->plen)) {
1666 BT_ERR("%s mismatch event parameter (opcode 0x%4.4x)",
1667 hdev->name, le16_to_cpu(cmd->opcode));
1668 kfree_skb(skb);
1669 return -EFAULT;
1670 }
1671 kfree_skb(skb);
1672
1673 return 0;
1674}
1675
1676static int btusb_setup_intel(struct hci_dev *hdev)
1677{
1678 struct sk_buff *skb;
1679 const struct firmware *fw;
1680 const u8 *fw_ptr;
28dc4b92 1681 int disable_patch, err;
6c483de1 1682 struct intel_version ver;
dffd30ee 1683
dffd30ee
THJA		 1684 BT_DBG("%s", hdev->name);
1685
1686 /* The controller has a bug with the first HCI command sent to it
1687 * returning number of completed commands as zero. This would stall the
1688 * command processing in the Bluetooth core.
1689 *
1690 * As a workaround, send HCI Reset command first which will reset the
1691 * number of completed commands and allow normal command processing
1692 * from now on.
1693 */
1694 skb = __hci_cmd_sync(hdev, HCI_OP_RESET, 0, NULL, HCI_INIT_TIMEOUT);
1695 if (IS_ERR(skb)) {
1696 BT_ERR("%s sending initial HCI reset command failed (%ld)",
1697 hdev->name, PTR_ERR(skb));
d9c78e97 1698 return PTR_ERR(skb);
dffd30ee
THJA		 1699 }
1700 kfree_skb(skb);
1701
1702 /* Read Intel specific controller version first to allow selection of
1703 * which firmware file to load.
1704 *
1705 * The returned information are hardware variant and revision plus
1706 * firmware variant, revision and build number.
1707 */
6c483de1
LP		 1708 err = btintel_read_version(hdev, &ver);
1709 if (err)
1710 return err;
dffd30ee
THJA		 1711
1712 BT_INFO("%s: read Intel version: %02x%02x%02x%02x%02x%02x%02x%02x%02x",
6c483de1
LP		 1713 hdev->name, ver.hw_platform, ver.hw_variant, ver.hw_revision,
1714 ver.fw_variant, ver.fw_revision, ver.fw_build_num,
1715 ver.fw_build_ww, ver.fw_build_yy, ver.fw_patch_num);
dffd30ee
THJA		 1716
1717 /* fw_patch_num indicates the version of patch the device currently
1718 * have. If there is no patch data in the device, it is always 0x00.
5075edae 1719 * So, if it is other than 0x00, no need to patch the device again.
dffd30ee 1720 */
6c483de1 1721 if (ver.fw_patch_num) {
dffd30ee 1722 BT_INFO("%s: Intel device is already patched. patch num: %02x",
6c483de1 1723 hdev->name, ver.fw_patch_num);
213445b2 1724 goto complete;
dffd30ee
THJA		 1725 }
1726
1727 /* Opens the firmware patch file based on the firmware version read
1728 * from the controller. If it fails to open the matching firmware
1729 * patch file, it tries to open the default firmware patch file.
1730 * If no patch file is found, allow the device to operate without
1731 * a patch.
1732 */
6c483de1
LP		 1733 fw = btusb_setup_intel_get_fw(hdev, &ver);
1734 if (!fw)
213445b2 1735 goto complete;
dffd30ee
THJA		 1736 fw_ptr = fw->data;
1737
28dc4b92 1738 /* Enable the manufacturer mode of the controller.
dffd30ee
THJA		 1739 * Only while this mode is enabled, the driver can download the
1740 * firmware patch data and configuration parameters.
1741 */
28dc4b92
LP		 1742 err = btintel_enter_mfg(hdev);
1743 if (err) {
dffd30ee 1744 release_firmware(fw);
28dc4b92 1745 return err;
dffd30ee
THJA		 1746 }
1747
dffd30ee
THJA		 1748 disable_patch = 1;
1749
1750 /* The firmware data file consists of list of Intel specific HCI
1751 * commands and its expected events. The first byte indicates the
1752 * type of the message, either HCI command or HCI event.
1753 *
1754 * It reads the command and its expected event from the firmware file,
1755 * and send to the controller. Once __hci_cmd_sync_ev() returns,
1756 * the returned event is compared with the event read from the firmware
1757 * file and it will continue until all the messages are downloaded to
1758 * the controller.
1759 *
1760 * Once the firmware patching is completed successfully,
1761 * the manufacturer mode is disabled with reset and activating the
1762 * downloaded patch.
1763 *
1764 * If the firmware patching fails, the manufacturer mode is
1765 * disabled with reset and deactivating the patch.
1766 *
1767 * If the default patch file is used, no reset is done when disabling
1768 * the manufacturer.
1769 */
1770 while (fw->size > fw_ptr - fw->data) {
1771 int ret;
1772
1773 ret = btusb_setup_intel_patching(hdev, fw, &fw_ptr,
1774 &disable_patch);
1775 if (ret < 0)
1776 goto exit_mfg_deactivate;
1777 }
1778
1779 release_firmware(fw);
1780
1781 if (disable_patch)
1782 goto exit_mfg_disable;
1783
1784 /* Patching completed successfully and disable the manufacturer mode
1785 * with reset and activate the downloaded firmware patches.
1786 */
28dc4b92
LP		 1787 err = btintel_exit_mfg(hdev, true, true);
1788 if (err)
1789 return err;
dffd30ee
THJA		 1790
1791 BT_INFO("%s: Intel Bluetooth firmware patch completed and activated",
1792 hdev->name);
1793
213445b2 1794 goto complete;
dffd30ee
THJA		 1795
1796exit_mfg_disable:
1797 /* Disable the manufacturer mode without reset */
28dc4b92
LP		 1798 err = btintel_exit_mfg(hdev, false, false);
1799 if (err)
1800 return err;
dffd30ee
THJA		 1801
1802 BT_INFO("%s: Intel Bluetooth firmware patch completed", hdev->name);
40cb0984 1803
213445b2 1804 goto complete;
dffd30ee
THJA		 1805
1806exit_mfg_deactivate:
1807 release_firmware(fw);
1808
1809 /* Patching failed. Disable the manufacturer mode with reset and
1810 * deactivate the downloaded firmware patches.
1811 */
28dc4b92
LP		 1812 err = btintel_exit_mfg(hdev, true, false);
1813 if (err)
1814 return err;
dffd30ee
THJA		 1815
1816 BT_INFO("%s: Intel Bluetooth firmware patch completed and deactivated",
1817 hdev->name);
1818
213445b2
MH		 1819complete:
1820 /* Set the event mask for Intel specific vendor events. This enables
1821 * a few extra events that are useful during general operation.
1822 */
1823 btintel_set_event_mask_mfg(hdev, false);
1824
4185a0f5 1825 btintel_check_bdaddr(hdev);
dffd30ee
THJA		 1826 return 0;
1827}
1828
cda0dd78
MH		 1829static int inject_cmd_complete(struct hci_dev *hdev, __u16 opcode)
1830{
1831 struct sk_buff *skb;
1832 struct hci_event_hdr *hdr;
1833 struct hci_ev_cmd_complete *evt;
1834
1835 skb = bt_skb_alloc(sizeof(*hdr) + sizeof(*evt) + 1, GFP_ATOMIC);
1836 if (!skb)
1837 return -ENOMEM;
1838
4df864c1 1839 hdr = skb_put(skb, sizeof(*hdr));
cda0dd78
MH		 1840 hdr->evt = HCI_EV_CMD_COMPLETE;
1841 hdr->plen = sizeof(*evt) + 1;
1842
4df864c1 1843 evt = skb_put(skb, sizeof(*evt));
cda0dd78
MH		 1844 evt->ncmd = 0x01;
1845 evt->opcode = cpu_to_le16(opcode);
1846
4df864c1 1847 *(u8 *)skb_put(skb, 1) = 0x00;
cda0dd78 1848
618e8bc2 1849 hci_skb_pkt_type(skb) = HCI_EVENT_PKT;
cda0dd78
MH		 1850
1851 return hci_recv_frame(hdev, skb);
1852}
1853
1854static int btusb_recv_bulk_intel(struct btusb_data *data, void *buffer,
1855 int count)
1856{
1857 /* When the device is in bootloader mode, then it can send
1858 * events via the bulk endpoint. These events are treated the
1859 * same way as the ones received from the interrupt endpoint.
1860 */
1861 if (test_bit(BTUSB_BOOTLOADER, &data->flags))
1862 return btusb_recv_intr(data, buffer, count);
1863
1864 return btusb_recv_bulk(data, buffer, count);
1865}
1866
ccd6da2a
MH		 1867static void btusb_intel_bootup(struct btusb_data *data, const void *ptr,
1868 unsigned int len)
1869{
1870 const struct intel_bootup *evt = ptr;
1871
1872 if (len != sizeof(*evt))
1873 return;
1874
1875 if (test_and_clear_bit(BTUSB_BOOTING, &data->flags)) {
1876 smp_mb__after_atomic();
1877 wake_up_bit(&data->flags, BTUSB_BOOTING);
1878 }
1879}
1880
1881static void btusb_intel_secure_send_result(struct btusb_data *data,
1882 const void *ptr, unsigned int len)
1883{
1884 const struct intel_secure_send_result *evt = ptr;
1885
1886 if (len != sizeof(*evt))
1887 return;
1888
1889 if (evt->result)
1890 set_bit(BTUSB_FIRMWARE_FAILED, &data->flags);
1891
1892 if (test_and_clear_bit(BTUSB_DOWNLOADING, &data->flags) &&
1893 test_bit(BTUSB_FIRMWARE_LOADED, &data->flags)) {
1894 smp_mb__after_atomic();
1895 wake_up_bit(&data->flags, BTUSB_DOWNLOADING);
1896 }
1897}
1898
cda0dd78
MH		 1899static int btusb_recv_event_intel(struct hci_dev *hdev, struct sk_buff *skb)
1900{
1901 struct btusb_data *data = hci_get_drvdata(hdev);
1902
1903 if (test_bit(BTUSB_BOOTLOADER, &data->flags)) {
1904 struct hci_event_hdr *hdr = (void *)skb->data;
1905
ccd6da2a
MH		 1906 if (skb->len > HCI_EVENT_HDR_SIZE && hdr->evt == 0xff &&
1907 hdr->plen > 0) {
1908 const void *ptr = skb->data + HCI_EVENT_HDR_SIZE + 1;
1909 unsigned int len = skb->len - HCI_EVENT_HDR_SIZE - 1;
1910
1911 switch (skb->data[2]) {
1912 case 0x02:
1913 /* When switching to the operational firmware
1914 * the device sends a vendor specific event
1915 * indicating that the bootup completed.
1916 */
1917 btusb_intel_bootup(data, ptr, len);
1918 break;
1919 case 0x06:
1920 /* When the firmware loading completes the
1921 * device sends out a vendor specific event
1922 * indicating the result of the firmware
1923 * loading.
1924 */
1925 btusb_intel_secure_send_result(data, ptr, len);
1926 break;
fad70972 1927 }
cda0dd78
MH		 1928 }
1929 }
1930
1931 return hci_recv_frame(hdev, skb);
1932}
1933
1934static int btusb_send_frame_intel(struct hci_dev *hdev, struct sk_buff *skb)
1935{
1936 struct btusb_data *data = hci_get_drvdata(hdev);
1937 struct urb *urb;
1938
1939 BT_DBG("%s", hdev->name);
1940
618e8bc2 1941 switch (hci_skb_pkt_type(skb)) {
cda0dd78
MH		 1942 case HCI_COMMAND_PKT:
1943 if (test_bit(BTUSB_BOOTLOADER, &data->flags)) {
1944 struct hci_command_hdr *cmd = (void *)skb->data;
1945 __u16 opcode = le16_to_cpu(cmd->opcode);
1946
1947 /* When in bootloader mode and the command 0xfc09
1948 * is received, it needs to be send down the
1949 * bulk endpoint. So allocate a bulk URB instead.
1950 */
1951 if (opcode == 0xfc09)
1952 urb = alloc_bulk_urb(hdev, skb);
1953 else
1954 urb = alloc_ctrl_urb(hdev, skb);
1955
1956 /* When the 0xfc01 command is issued to boot into
1957 * the operational firmware, it will actually not
1958 * send a command complete event. To keep the flow
1959 * control working inject that event here.
1960 */
1961 if (opcode == 0xfc01)
1962 inject_cmd_complete(hdev, opcode);
1963 } else {
1964 urb = alloc_ctrl_urb(hdev, skb);
1965 }
1966 if (IS_ERR(urb))
1967 return PTR_ERR(urb);
1968
1969 hdev->stat.cmd_tx++;
1970 return submit_or_queue_tx_urb(hdev, urb);
1971
1972 case HCI_ACLDATA_PKT:
1973 urb = alloc_bulk_urb(hdev, skb);
1974 if (IS_ERR(urb))
1975 return PTR_ERR(urb);
1976
1977 hdev->stat.acl_tx++;
1978 return submit_or_queue_tx_urb(hdev, urb);
1979
1980 case HCI_SCODATA_PKT:
1981 if (hci_conn_num(hdev, SCO_LINK) < 1)
1982 return -ENODEV;
1983
1984 urb = alloc_isoc_urb(hdev, skb);
1985 if (IS_ERR(urb))
1986 return PTR_ERR(urb);
1987
1988 hdev->stat.sco_tx++;
1989 return submit_tx_urb(hdev, urb);
1990 }
1991
1992 return -EILSEQ;
1993}
1994
cda0dd78
MH		 1995static int btusb_setup_intel_new(struct hci_dev *hdev)
1996{
1997 static const u8 reset_param[] = { 0x00, 0x01, 0x00, 0x01,
1998 0x00, 0x08, 0x04, 0x00 };
1999 struct btusb_data *data = hci_get_drvdata(hdev);
2000 struct sk_buff *skb;
6c483de1 2001 struct intel_version ver;
cda0dd78
MH		 2002 struct intel_boot_params *params;
2003 const struct firmware *fw;
2004 const u8 *fw_ptr;
e66890a9 2005 u32 frag_len;
cda0dd78
MH		 2006 char fwname[64];
2007 ktime_t calltime, delta, rettime;
2008 unsigned long long duration;
2009 int err;
2010
2011 BT_DBG("%s", hdev->name);
2012
2013 calltime = ktime_get();
2014
2015 /* Read the Intel version information to determine if the device
2016 * is in bootloader mode or if it already has operational firmware
2017 * loaded.
2018 */
6c483de1
LP		 2019 err = btintel_read_version(hdev, &ver);
2020 if (err)
2021 return err;
cda0dd78
MH		 2022
2023 /* The hardware platform number has a fixed value of 0x37 and
2024 * for now only accept this single value.
2025 */
6c483de1 2026 if (ver.hw_platform != 0x37) {
cda0dd78 2027 BT_ERR("%s: Unsupported Intel hardware platform (%u)",
6c483de1 2028 hdev->name, ver.hw_platform);
cda0dd78
MH		 2029 return -EINVAL;
2030 }
2031
9268834b
THJA		 2032 /* Check for supported iBT hardware variants of this firmware
2033 * loading method.
a0af53b5
THJA		 2034 *
2035 * This check has been put in place to ensure correct forward
2036 * compatibility options when newer hardware variants come along.
cda0dd78 2037 */
9268834b
THJA		 2038 switch (ver.hw_variant) {
2039 case 0x0b: /* SfP */
2040 case 0x0c: /* WsP */
86a6129a 2041 case 0x11: /* JfP */
de766142 2042 case 0x12: /* ThP */
9268834b
THJA		 2043 break;
2044 default:
cda0dd78 2045 BT_ERR("%s: Unsupported Intel hardware variant (%u)",
6c483de1 2046 hdev->name, ver.hw_variant);
cda0dd78
MH		 2047 return -EINVAL;
2048 }
2049
6c483de1 2050 btintel_version_info(hdev, &ver);
cda0dd78
MH		 2051
2052 /* The firmware variant determines if the device is in bootloader
2053 * mode or is running operational firmware. The value 0x06 identifies
2054 * the bootloader and the value 0x23 identifies the operational
2055 * firmware.
2056 *
2057 * When the operational firmware is already present, then only
2058 * the check for valid Bluetooth device address is needed. This
2059 * determines if the device will be added as configured or
2060 * unconfigured controller.
2061 *
2062 * It is not possible to use the Secure Boot Parameters in this
2063 * case since that command is only available in bootloader mode.
2064 */
6c483de1 2065 if (ver.fw_variant == 0x23) {
cda0dd78 2066 clear_bit(BTUSB_BOOTLOADER, &data->flags);
4185a0f5 2067 btintel_check_bdaddr(hdev);
cda0dd78
MH		 2068 return 0;
2069 }
2070
2071 /* If the device is not in bootloader mode, then the only possible
2072 * choice is to return an error and abort the device initialization.
2073 */
6c483de1 2074 if (ver.fw_variant != 0x06) {
cda0dd78 2075 BT_ERR("%s: Unsupported Intel firmware variant (%u)",
6c483de1 2076 hdev->name, ver.fw_variant);
cda0dd78
MH		 2077 return -ENODEV;
2078 }
2079
cda0dd78
MH		 2080 /* Read the secure boot parameters to identify the operating
2081 * details of the bootloader.
2082 */
2083 skb = __hci_cmd_sync(hdev, 0xfc0d, 0, NULL, HCI_INIT_TIMEOUT);
2084 if (IS_ERR(skb)) {
2085 BT_ERR("%s: Reading Intel boot parameters failed (%ld)",
2086 hdev->name, PTR_ERR(skb));
2087 return PTR_ERR(skb);
2088 }
2089
2090 if (skb->len != sizeof(*params)) {
2091 BT_ERR("%s: Intel boot parameters size mismatch", hdev->name);
2092 kfree_skb(skb);
2093 return -EILSEQ;
2094 }
2095
2096 params = (struct intel_boot_params *)skb->data;
cda0dd78
MH		 2097
2098 BT_INFO("%s: Device revision is %u", hdev->name,
2099 le16_to_cpu(params->dev_revid));
2100
2101 BT_INFO("%s: Secure boot is %s", hdev->name,
2102 params->secure_boot ? "enabled" : "disabled");
2103
2220994e
MH		 2104 BT_INFO("%s: OTP lock is %s", hdev->name,
2105 params->otp_lock ? "enabled" : "disabled");
2106
2107 BT_INFO("%s: API lock is %s", hdev->name,
2108 params->api_lock ? "enabled" : "disabled");
2109
2110 BT_INFO("%s: Debug lock is %s", hdev->name,
2111 params->debug_lock ? "enabled" : "disabled");
2112
cda0dd78
MH		 2113 BT_INFO("%s: Minimum firmware build %u week %u %u", hdev->name,
2114 params->min_fw_build_nn, params->min_fw_build_cw,
2115 2000 + params->min_fw_build_yy);
2116
2117 /* It is required that every single firmware fragment is acknowledged
2118 * with a command complete event. If the boot parameters indicate
2119 * that this bootloader does not send them, then abort the setup.
2120 */
2121 if (params->limited_cce != 0x00) {
2122 BT_ERR("%s: Unsupported Intel firmware loading method (%u)",
2123 hdev->name, params->limited_cce);
2124 kfree_skb(skb);
2125 return -EINVAL;
2126 }
2127
2128 /* If the OTP has no valid Bluetooth device address, then there will
2129 * also be no valid address for the operational firmware.
2130 */
2131 if (!bacmp(&params->otp_bdaddr, BDADDR_ANY)) {
2132 BT_INFO("%s: No device address configured", hdev->name);
2133 set_bit(HCI_QUIRK_INVALID_BDADDR, &hdev->quirks);
2134 }
2135
2136 /* With this Intel bootloader only the hardware variant and device
2137 * revision information are used to select the right firmware.
2138 *
230b04ac
THJA		 2139 * The firmware filename is ibt-<hw_variant>-<dev_revid>.sfi.
2140 *
2141 * Currently the supported hardware variants are:
2142 * 11 (0x0b) for iBT3.0 (LnP/SfP)
2143 * 12 (0x0c) for iBT3.5 (WsP)
86a6129a
THJA		 2144 * 17 (0x11) for iBT3.5 (JfP)
2145 * 18 (0x12) for iBT3.5 (ThP)
cda0dd78 2146 */
230b04ac
THJA		 2147 snprintf(fwname, sizeof(fwname), "intel/ibt-%u-%u.sfi",
2148 le16_to_cpu(ver.hw_variant),
cda0dd78
MH		 2149 le16_to_cpu(params->dev_revid));
2150
2151 err = request_firmware(&fw, fwname, &hdev->dev);
2152 if (err < 0) {
2153 BT_ERR("%s: Failed to load Intel firmware file (%d)",
2154 hdev->name, err);
2155 kfree_skb(skb);
2156 return err;
2157 }
2158
2159 BT_INFO("%s: Found device firmware: %s", hdev->name, fwname);
2160
52cc9168
THJA		 2161 /* Save the DDC file name for later use to apply once the firmware
2162 * downloading is done.
2163 */
230b04ac
THJA		 2164 snprintf(fwname, sizeof(fwname), "intel/ibt-%u-%u.ddc",
2165 le16_to_cpu(ver.hw_variant),
52cc9168
THJA		 2166 le16_to_cpu(params->dev_revid));
2167
cda0dd78
MH		 2168 kfree_skb(skb);
2169
2170 if (fw->size < 644) {
2171 BT_ERR("%s: Invalid size of firmware file (%zu)",
2172 hdev->name, fw->size);
2173 err = -EBADF;
2174 goto done;
2175 }
2176
2177 set_bit(BTUSB_DOWNLOADING, &data->flags);
2178
2179 /* Start the firmware download transaction with the Init fragment
2180 * represented by the 128 bytes of CSS header.
2181 */
09df123d 2182 err = btintel_secure_send(hdev, 0x00, 128, fw->data);
cda0dd78
MH		 2183 if (err < 0) {
2184 BT_ERR("%s: Failed to send firmware header (%d)",
2185 hdev->name, err);
2186 goto done;
2187 }
2188
2189 /* Send the 256 bytes of public key information from the firmware
2190 * as the PKey fragment.
2191 */
09df123d 2192 err = btintel_secure_send(hdev, 0x03, 256, fw->data + 128);
cda0dd78
MH		 2193 if (err < 0) {
2194 BT_ERR("%s: Failed to send firmware public key (%d)",
2195 hdev->name, err);
2196 goto done;
2197 }
2198
2199 /* Send the 256 bytes of signature information from the firmware
2200 * as the Sign fragment.
2201 */
09df123d 2202 err = btintel_secure_send(hdev, 0x02, 256, fw->data + 388);
cda0dd78
MH		 2203 if (err < 0) {
2204 BT_ERR("%s: Failed to send firmware signature (%d)",
2205 hdev->name, err);
2206 goto done;
2207 }
2208
2209 fw_ptr = fw->data + 644;
e66890a9 2210 frag_len = 0;
cda0dd78
MH		 2211
2212 while (fw_ptr - fw->data < fw->size) {
e66890a9 2213 struct hci_command_hdr *cmd = (void *)(fw_ptr + frag_len);
cda0dd78 2214
e66890a9 2215 frag_len += sizeof(*cmd) + cmd->plen;
cda0dd78 2216
5075edae 2217 /* The parameter length of the secure send command requires
e66890a9
MH		 2218 * a 4 byte alignment. It happens so that the firmware file
2219 * contains proper Intel_NOP commands to align the fragments
2220 * as needed.
2221 *
2222 * Send set of commands with 4 byte alignment from the
2223 * firmware data buffer as a single Data fragement.
cda0dd78 2224 */
e66890a9 2225 if (!(frag_len % 4)) {
09df123d 2226 err = btintel_secure_send(hdev, 0x01, frag_len, fw_ptr);
e66890a9
MH		 2227 if (err < 0) {
2228 BT_ERR("%s: Failed to send firmware data (%d)",
2229 hdev->name, err);
2230 goto done;
2231 }
cda0dd78 2232
e66890a9
MH		 2233 fw_ptr += frag_len;
2234 frag_len = 0;
2235 }
cda0dd78
MH		 2236 }
2237
ce6bb929
MH		 2238 set_bit(BTUSB_FIRMWARE_LOADED, &data->flags);
2239
a087a98e
JH		 2240 BT_INFO("%s: Waiting for firmware download to complete", hdev->name);
2241
cda0dd78
MH		 2242 /* Before switching the device into operational mode and with that
2243 * booting the loaded firmware, wait for the bootloader notification
2244 * that all fragments have been successfully received.
2245 *
a087a98e
JH		 2246 * When the event processing receives the notification, then the
2247 * BTUSB_DOWNLOADING flag will be cleared.
2248 *
2249 * The firmware loading should not take longer than 5 seconds
2250 * and thus just timeout if that happens and fail the setup
2251 * of this device.
cda0dd78 2252 */
129a7693
JH		 2253 err = wait_on_bit_timeout(&data->flags, BTUSB_DOWNLOADING,
2254 TASK_INTERRUPTIBLE,
2255 msecs_to_jiffies(5000));
f0a70a04 2256 if (err == -EINTR) {
a087a98e 2257 BT_ERR("%s: Firmware loading interrupted", hdev->name);
a087a98e
JH		 2258 goto done;
2259 }
cda0dd78 2260
a087a98e
JH		 2261 if (err) {
2262 BT_ERR("%s: Firmware loading timeout", hdev->name);
2263 err = -ETIMEDOUT;
2264 goto done;
cda0dd78
MH		 2265 }
2266
2267 if (test_bit(BTUSB_FIRMWARE_FAILED, &data->flags)) {
2268 BT_ERR("%s: Firmware loading failed", hdev->name);
2269 err = -ENOEXEC;
2270 goto done;
2271 }
2272
2273 rettime = ktime_get();
2274 delta = ktime_sub(rettime, calltime);
2275 duration = (unsigned long long) ktime_to_ns(delta) >> 10;
2276
2277 BT_INFO("%s: Firmware loaded in %llu usecs", hdev->name, duration);
2278
2279done:
2280 release_firmware(fw);
2281
2282 if (err < 0)
2283 return err;
2284
2285 calltime = ktime_get();
2286
2287 set_bit(BTUSB_BOOTING, &data->flags);
2288
2289 skb = __hci_cmd_sync(hdev, 0xfc01, sizeof(reset_param), reset_param,
2290 HCI_INIT_TIMEOUT);
2291 if (IS_ERR(skb))
2292 return PTR_ERR(skb);
2293
2294 kfree_skb(skb);
2295
2296 /* The bootloader will not indicate when the device is ready. This
2297 * is done by the operational firmware sending bootup notification.
fad70972
JH		 2298 *
2299 * Booting into operational firmware should not take longer than
2300 * 1 second. However if that happens, then just fail the setup
2301 * since something went wrong.
cda0dd78 2302 */
fad70972 2303 BT_INFO("%s: Waiting for device to boot", hdev->name);
cda0dd78 2304
129a7693
JH		 2305 err = wait_on_bit_timeout(&data->flags, BTUSB_BOOTING,
2306 TASK_INTERRUPTIBLE,
2307 msecs_to_jiffies(1000));
cda0dd78 2308
f0a70a04 2309 if (err == -EINTR) {
fad70972
JH		 2310 BT_ERR("%s: Device boot interrupted", hdev->name);
2311 return -EINTR;
2312 }
cda0dd78 2313
fad70972
JH		 2314 if (err) {
2315 BT_ERR("%s: Device boot timeout", hdev->name);
2316 return -ETIMEDOUT;
cda0dd78
MH		 2317 }
2318
2319 rettime = ktime_get();
2320 delta = ktime_sub(rettime, calltime);
2321 duration = (unsigned long long) ktime_to_ns(delta) >> 10;
2322
2323 BT_INFO("%s: Device booted in %llu usecs", hdev->name, duration);
2324
2325 clear_bit(BTUSB_BOOTLOADER, &data->flags);
2326
52cc9168
THJA		 2327 /* Once the device is running in operational mode, it needs to apply
2328 * the device configuration (DDC) parameters.
2329 *
2330 * The device can work without DDC parameters, so even if it fails
2331 * to load the file, no need to fail the setup.
2332 */
e924d3d6 2333 btintel_load_ddc_config(hdev, fwname);
52cc9168 2334
213445b2
MH		 2335 /* Set the event mask for Intel specific vendor events. This enables
2336 * a few extra events that are useful during general operation. It
2337 * does not enable any debugging related events.
2338 *
2339 * The device will function correctly without these events enabled
2340 * and thus no need to fail the setup.
2341 */
2342 btintel_set_event_mask(hdev, false);
2343
cda0dd78
MH		 2344 return 0;
2345}
2346
bfbd45e9
THJA		 2347static int btusb_shutdown_intel(struct hci_dev *hdev)
2348{
2349 struct sk_buff *skb;
2350 long ret;
2351
2352 /* Some platforms have an issue with BT LED when the interface is
2353 * down or BT radio is turned off, which takes 5 seconds to BT LED
2354 * goes off. This command turns off the BT LED immediately.
2355 */
2356 skb = __hci_cmd_sync(hdev, 0xfc3f, 0, NULL, HCI_INIT_TIMEOUT);
2357 if (IS_ERR(skb)) {
2358 ret = PTR_ERR(skb);
2359 BT_ERR("%s: turning off Intel device LED failed (%ld)",
2360 hdev->name, ret);
2361 return ret;
2362 }
2363 kfree_skb(skb);
2364
2365 return 0;
2366}
2367
a4ccc9e3
RJ		 2368#ifdef CONFIG_PM
2369/* Configure an out-of-band gpio as wake-up pin, if specified in device tree */
2370static int marvell_config_oob_wake(struct hci_dev *hdev)
2371{
2372 struct sk_buff *skb;
2373 struct btusb_data *data = hci_get_drvdata(hdev);
2374 struct device *dev = &data->udev->dev;
2375 u16 pin, gap, opcode;
2376 int ret;
2377 u8 cmd[5];
2378
2379 /* Move on if no wakeup pin specified */
2380 if (of_property_read_u16(dev->of_node, "marvell,wakeup-pin", &pin) ||
2381 of_property_read_u16(dev->of_node, "marvell,wakeup-gap-ms", &gap))
2382 return 0;
2383
2384 /* Vendor specific command to configure a GPIO as wake-up pin */
2385 opcode = hci_opcode_pack(0x3F, 0x59);
2386 cmd[0] = opcode & 0xFF;
2387 cmd[1] = opcode >> 8;
2388 cmd[2] = 2; /* length of parameters that follow */
2389 cmd[3] = pin;
2390 cmd[4] = gap; /* time in ms, for which wakeup pin should be asserted */
2391
2392 skb = bt_skb_alloc(sizeof(cmd), GFP_KERNEL);
2393 if (!skb) {
2394 bt_dev_err(hdev, "%s: No memory\n", __func__);
2395 return -ENOMEM;
2396 }
2397
59ae1d12 2398 skb_put_data(skb, cmd, sizeof(cmd));
a4ccc9e3
RJ		 2399 hci_skb_pkt_type(skb) = HCI_COMMAND_PKT;
2400
2401 ret = btusb_send_frame(hdev, skb);
2402 if (ret) {
2403 bt_dev_err(hdev, "%s: configuration failed\n", __func__);
2404 kfree_skb(skb);
2405 return ret;
2406 }
2407
2408 return 0;
2409}
2410#endif
2411
ae8df494
AK		 2412static int btusb_set_bdaddr_marvell(struct hci_dev *hdev,
2413 const bdaddr_t *bdaddr)
2414{
2415 struct sk_buff *skb;
2416 u8 buf[8];
2417 long ret;
2418
2419 buf[0] = 0xfe;
2420 buf[1] = sizeof(bdaddr_t);
2421 memcpy(buf + 2, bdaddr, sizeof(bdaddr_t));
2422
2423 skb = __hci_cmd_sync(hdev, 0xfc22, sizeof(buf), buf, HCI_INIT_TIMEOUT);
2424 if (IS_ERR(skb)) {
2425 ret = PTR_ERR(skb);
2426 BT_ERR("%s: changing Marvell device address failed (%ld)",
2427 hdev->name, ret);
2428 return ret;
2429 }
2430 kfree_skb(skb);
2431
2432 return 0;
2433}
2434
5859223e
TK		 2435static int btusb_set_bdaddr_ath3012(struct hci_dev *hdev,
2436 const bdaddr_t *bdaddr)
2437{
2438 struct sk_buff *skb;
2439 u8 buf[10];
2440 long ret;
2441
2442 buf[0] = 0x01;
2443 buf[1] = 0x01;
2444 buf[2] = 0x00;
2445 buf[3] = sizeof(bdaddr_t);
2446 memcpy(buf + 4, bdaddr, sizeof(bdaddr_t));
2447
2448 skb = __hci_cmd_sync(hdev, 0xfc0b, sizeof(buf), buf, HCI_INIT_TIMEOUT);
2449 if (IS_ERR(skb)) {
2450 ret = PTR_ERR(skb);
2451 BT_ERR("%s: Change address command failed (%ld)",
2452 hdev->name, ret);
2453 return ret;
2454 }
2455 kfree_skb(skb);
2456
2457 return 0;
2458}
2459
3267c884
KBYT		 2460#define QCA_DFU_PACKET_LEN 4096
2461
2462#define QCA_GET_TARGET_VERSION 0x09
2463#define QCA_CHECK_STATUS 0x05
2464#define QCA_DFU_DOWNLOAD 0x01
2465
2466#define QCA_SYSCFG_UPDATED 0x40
2467#define QCA_PATCH_UPDATED 0x80
2468#define QCA_DFU_TIMEOUT 3000
2469
2470struct qca_version {
2471 __le32 rom_version;
2472 __le32 patch_version;
2473 __le32 ram_version;
2474 __le32 ref_clock;
2475 __u8 reserved[4];
2476} __packed;
2477
2478struct qca_rampatch_version {
2479 __le16 rom_version;
2480 __le16 patch_version;
2481} __packed;
2482
2483struct qca_device_info {
bf906b3d
KBYT		 2484 u32 rom_version;
2485 u8 rampatch_hdr; /* length of header in rampatch */
2486 u8 nvm_hdr; /* length of header in NVM */
2487 u8 ver_offset; /* offset of version structure in rampatch */
3267c884
KBYT		 2488};
2489
2490static const struct qca_device_info qca_devices_table[] = {
2491 { 0x00000100, 20, 4, 10 }, /* Rome 1.0 */
2492 { 0x00000101, 20, 4, 10 }, /* Rome 1.1 */
7f6e6363 2493 { 0x00000200, 28, 4, 18 }, /* Rome 2.0 */
3267c884
KBYT		 2494 { 0x00000201, 28, 4, 18 }, /* Rome 2.1 */
2495 { 0x00000300, 28, 4, 18 }, /* Rome 3.0 */
2496 { 0x00000302, 28, 4, 18 }, /* Rome 3.2 */
2497};
2498
2499static int btusb_qca_send_vendor_req(struct hci_dev *hdev, u8 request,
2500 void *data, u16 size)
2501{
2502 struct btusb_data *btdata = hci_get_drvdata(hdev);
2503 struct usb_device *udev = btdata->udev;
2504 int pipe, err;
2505 u8 *buf;
2506
2507 buf = kmalloc(size, GFP_KERNEL);
2508 if (!buf)
2509 return -ENOMEM;
2510
2511 /* Found some of USB hosts have IOT issues with ours so that we should
2512 * not wait until HCI layer is ready.
2513 */
2514 pipe = usb_rcvctrlpipe(udev, 0);
2515 err = usb_control_msg(udev, pipe, request, USB_TYPE_VENDOR | USB_DIR_IN,
2516 0, 0, buf, size, USB_CTRL_SET_TIMEOUT);
2517 if (err < 0) {
2518 BT_ERR("%s: Failed to access otp area (%d)", hdev->name, err);
2519 goto done;
2520 }
2521
2522 memcpy(data, buf, size);
2523
2524done:
2525 kfree(buf);
2526
2527 return err;
2528}
2529
2530static int btusb_setup_qca_download_fw(struct hci_dev *hdev,
2531 const struct firmware *firmware,
2532 size_t hdr_size)
2533{
2534 struct btusb_data *btdata = hci_get_drvdata(hdev);
2535 struct usb_device *udev = btdata->udev;
2536 size_t count, size, sent = 0;
2537 int pipe, len, err;
2538 u8 *buf;
2539
2540 buf = kmalloc(QCA_DFU_PACKET_LEN, GFP_KERNEL);
2541 if (!buf)
2542 return -ENOMEM;
2543
2544 count = firmware->size;
2545
2546 size = min_t(size_t, count, hdr_size);
2547 memcpy(buf, firmware->data, size);
2548
2549 /* USB patches should go down to controller through USB path
2550 * because binary format fits to go down through USB channel.
2551 * USB control path is for patching headers and USB bulk is for
2552 * patch body.
2553 */
2554 pipe = usb_sndctrlpipe(udev, 0);
2555 err = usb_control_msg(udev, pipe, QCA_DFU_DOWNLOAD, USB_TYPE_VENDOR,
2556 0, 0, buf, size, USB_CTRL_SET_TIMEOUT);
2557 if (err < 0) {
2558 BT_ERR("%s: Failed to send headers (%d)", hdev->name, err);
2559 goto done;
2560 }
2561
2562 sent += size;
2563 count -= size;
2564
2565 while (count) {
2566 size = min_t(size_t, count, QCA_DFU_PACKET_LEN);
2567
2568 memcpy(buf, firmware->data + sent, size);
2569
2570 pipe = usb_sndbulkpipe(udev, 0x02);
2571 err = usb_bulk_msg(udev, pipe, buf, size, &len,
2572 QCA_DFU_TIMEOUT);
2573 if (err < 0) {
2574 BT_ERR("%s: Failed to send body at %zd of %zd (%d)",
2575 hdev->name, sent, firmware->size, err);
2576 break;
2577 }
2578
2579 if (size != len) {
2580 BT_ERR("%s: Failed to get bulk buffer", hdev->name);
2581 err = -EILSEQ;
2582 break;
2583 }
2584
2585 sent += size;
2586 count -= size;
2587 }
2588
2589done:
2590 kfree(buf);
2591 return err;
2592}
2593
2594static int btusb_setup_qca_load_rampatch(struct hci_dev *hdev,
2595 struct qca_version *ver,
2596 const struct qca_device_info *info)
2597{
2598 struct qca_rampatch_version *rver;
2599 const struct firmware *fw;
bf906b3d
KBYT		 2600 u32 ver_rom, ver_patch;
2601 u16 rver_rom, rver_patch;
3267c884
KBYT		 2602 char fwname[64];
2603 int err;
2604
bf906b3d
KBYT		 2605 ver_rom = le32_to_cpu(ver->rom_version);
2606 ver_patch = le32_to_cpu(ver->patch_version);
2607
2608 snprintf(fwname, sizeof(fwname), "qca/rampatch_usb_%08x.bin", ver_rom);
3267c884
KBYT		 2609
2610 err = request_firmware(&fw, fwname, &hdev->dev);
2611 if (err) {
2612 BT_ERR("%s: failed to request rampatch file: %s (%d)",
2613 hdev->name, fwname, err);
2614 return err;
2615 }
2616
2617 BT_INFO("%s: using rampatch file: %s", hdev->name, fwname);
bf906b3d 2618
3267c884 2619 rver = (struct qca_rampatch_version *)(fw->data + info->ver_offset);
bf906b3d
KBYT		 2620 rver_rom = le16_to_cpu(rver->rom_version);
2621 rver_patch = le16_to_cpu(rver->patch_version);
2622
3267c884 2623 BT_INFO("%s: QCA: patch rome 0x%x build 0x%x, firmware rome 0x%x "
bf906b3d
KBYT		 2624 "build 0x%x", hdev->name, rver_rom, rver_patch, ver_rom,
2625 ver_patch);
3267c884 2626
bf906b3d 2627 if (rver_rom != ver_rom || rver_patch <= ver_patch) {
3267c884
KBYT		 2628 BT_ERR("%s: rampatch file version did not match with firmware",
2629 hdev->name);
2630 err = -EINVAL;
2631 goto done;
2632 }
2633
2634 err = btusb_setup_qca_download_fw(hdev, fw, info->rampatch_hdr);
2635
2636done:
2637 release_firmware(fw);
2638
2639 return err;
2640}
2641
2642static int btusb_setup_qca_load_nvm(struct hci_dev *hdev,
2643 struct qca_version *ver,
2644 const struct qca_device_info *info)
2645{
2646 const struct firmware *fw;
2647 char fwname[64];
2648 int err;
2649
2650 snprintf(fwname, sizeof(fwname), "qca/nvm_usb_%08x.bin",
2651 le32_to_cpu(ver->rom_version));
2652
2653 err = request_firmware(&fw, fwname, &hdev->dev);
2654 if (err) {
2655 BT_ERR("%s: failed to request NVM file: %s (%d)",
2656 hdev->name, fwname, err);
2657 return err;
2658 }
2659
2660 BT_INFO("%s: using NVM file: %s", hdev->name, fwname);
2661
2662 err = btusb_setup_qca_download_fw(hdev, fw, info->nvm_hdr);
2663
2664 release_firmware(fw);
2665
2666 return err;
2667}
2668
2669static int btusb_setup_qca(struct hci_dev *hdev)
2670{
2671 const struct qca_device_info *info = NULL;
2672 struct qca_version ver;
bf906b3d 2673 u32 ver_rom;
3267c884
KBYT		 2674 u8 status;
2675 int i, err;
2676
2677 err = btusb_qca_send_vendor_req(hdev, QCA_GET_TARGET_VERSION, &ver,
eb50042f 2678 sizeof(ver));
3267c884
KBYT		 2679 if (err < 0)
2680 return err;
2681
bf906b3d 2682 ver_rom = le32_to_cpu(ver.rom_version);
3267c884 2683 for (i = 0; i < ARRAY_SIZE(qca_devices_table); i++) {
bf906b3d 2684 if (ver_rom == qca_devices_table[i].rom_version)
3267c884
KBYT		 2685 info = &qca_devices_table[i];
2686 }
2687 if (!info) {
2688 BT_ERR("%s: don't support firmware rome 0x%x", hdev->name,
bf906b3d 2689 ver_rom);
3267c884
KBYT		 2690 return -ENODEV;
2691 }
2692
2693 err = btusb_qca_send_vendor_req(hdev, QCA_CHECK_STATUS, &status,
2694 sizeof(status));
2695 if (err < 0)
2696 return err;
2697
2698 if (!(status & QCA_PATCH_UPDATED)) {
2699 err = btusb_setup_qca_load_rampatch(hdev, &ver, info);
2700 if (err < 0)
2701 return err;
2702 }
2703
2704 if (!(status & QCA_SYSCFG_UPDATED)) {
2705 err = btusb_setup_qca_load_nvm(hdev, &ver, info);
2706 if (err < 0)
2707 return err;
2708 }
2709
2710 return 0;
2711}
2712
9d08f504
MH		 2713#ifdef CONFIG_BT_HCIBTUSB_BCM
2714static inline int __set_diag_interface(struct hci_dev *hdev)
2715{
2716 struct btusb_data *data = hci_get_drvdata(hdev);
2717 struct usb_interface *intf = data->diag;
2718 int i;
2719
2720 if (!data->diag)
2721 return -ENODEV;
2722
2723 data->diag_tx_ep = NULL;
2724 data->diag_rx_ep = NULL;
2725
2726 for (i = 0; i < intf->cur_altsetting->desc.bNumEndpoints; i++) {
2727 struct usb_endpoint_descriptor *ep_desc;
2728
2729 ep_desc = &intf->cur_altsetting->endpoint[i].desc;
2730
2731 if (!data->diag_tx_ep && usb_endpoint_is_bulk_out(ep_desc)) {
2732 data->diag_tx_ep = ep_desc;
2733 continue;
2734 }
2735
2736 if (!data->diag_rx_ep && usb_endpoint_is_bulk_in(ep_desc)) {
2737 data->diag_rx_ep = ep_desc;
2738 continue;
2739 }
2740 }
2741
2742 if (!data->diag_tx_ep || !data->diag_rx_ep) {
2743 BT_ERR("%s invalid diagnostic descriptors", hdev->name);
2744 return -ENODEV;
2745 }
2746
2747 return 0;
2748}
2749
2750static struct urb *alloc_diag_urb(struct hci_dev *hdev, bool enable)
2751{
2752 struct btusb_data *data = hci_get_drvdata(hdev);
2753 struct sk_buff *skb;
2754 struct urb *urb;
2755 unsigned int pipe;
2756
2757 if (!data->diag_tx_ep)
2758 return ERR_PTR(-ENODEV);
2759
2760 urb = usb_alloc_urb(0, GFP_KERNEL);
2761 if (!urb)
2762 return ERR_PTR(-ENOMEM);
2763
2764 skb = bt_skb_alloc(2, GFP_KERNEL);
2765 if (!skb) {
2766 usb_free_urb(urb);
2767 return ERR_PTR(-ENOMEM);
2768 }
2769
4df864c1
JB		 2770 *(u8 *)skb_put(skb, 1) = 0xf0;
2771 *(u8 *)skb_put(skb, 1) = enable;
9d08f504
MH		 2772
2773 pipe = usb_sndbulkpipe(data->udev, data->diag_tx_ep->bEndpointAddress);
2774
2775 usb_fill_bulk_urb(urb, data->udev, pipe,
2776 skb->data, skb->len, btusb_tx_complete, skb);
2777
2778 skb->dev = (void *)hdev;
2779
2780 return urb;
2781}
2782
2783static int btusb_bcm_set_diag(struct hci_dev *hdev, bool enable)
2784{
2785 struct btusb_data *data = hci_get_drvdata(hdev);
2786 struct urb *urb;
2787
2788 if (!data->diag)
2789 return -ENODEV;
2790
2791 if (!test_bit(HCI_RUNNING, &hdev->flags))
2792 return -ENETDOWN;
2793
2794 urb = alloc_diag_urb(hdev, enable);
2795 if (IS_ERR(urb))
2796 return PTR_ERR(urb);
2797
2798 return submit_or_queue_tx_urb(hdev, urb);
2799}
2800#endif
2801
fd913ef7
RJ		 2802#ifdef CONFIG_PM
2803static irqreturn_t btusb_oob_wake_handler(int irq, void *priv)
2804{
2805 struct btusb_data *data = priv;
2806
2807 pm_wakeup_event(&data->udev->dev, 0);
017789f3 2808 pm_system_wakeup();
fd913ef7
RJ		 2809
2810 /* Disable only if not already disabled (keep it balanced) */
2811 if (test_and_clear_bit(BTUSB_OOB_WAKE_ENABLED, &data->flags)) {
2812 disable_irq_nosync(irq);
2813 disable_irq_wake(irq);
2814 }
2815 return IRQ_HANDLED;
2816}
2817
2818static const struct of_device_id btusb_match_table[] = {
2819 { .compatible = "usb1286,204e" },
2820 { }
2821};
2822MODULE_DEVICE_TABLE(of, btusb_match_table);
2823
2824/* Use an oob wakeup pin? */
2825static int btusb_config_oob_wake(struct hci_dev *hdev)
2826{
2827 struct btusb_data *data = hci_get_drvdata(hdev);
2828 struct device *dev = &data->udev->dev;
2829 int irq, ret;
2830
2831 clear_bit(BTUSB_OOB_WAKE_ENABLED, &data->flags);
2832
2833 if (!of_match_device(btusb_match_table, dev))
2834 return 0;
2835
2836 /* Move on if no IRQ specified */
2837 irq = of_irq_get_byname(dev->of_node, "wakeup");
2838 if (irq <= 0) {
2839 bt_dev_dbg(hdev, "%s: no OOB Wakeup IRQ in DT", __func__);
2840 return 0;
2841 }
2842
2843 ret = devm_request_irq(&hdev->dev, irq, btusb_oob_wake_handler,
2844 0, "OOB Wake-on-BT", data);
2845 if (ret) {
2846 bt_dev_err(hdev, "%s: IRQ request failed", __func__);
2847 return ret;
2848 }
2849
2850 ret = device_init_wakeup(dev, true);
2851 if (ret) {
2852 bt_dev_err(hdev, "%s: failed to init_wakeup", __func__);
2853 return ret;
2854 }
2855
2856 data->oob_wake_irq = irq;
2857 disable_irq(irq);
2858 bt_dev_info(hdev, "OOB Wake-on-BT configured at IRQ %u", irq);
2859 return 0;
2860}
2861#endif
2862
5e23b923 2863static int btusb_probe(struct usb_interface *intf,
89e7533d 2864 const struct usb_device_id *id)
5e23b923
MH		 2865{
2866 struct usb_endpoint_descriptor *ep_desc;
2867 struct btusb_data *data;
2868 struct hci_dev *hdev;
22f8e9db 2869 unsigned ifnum_base;
5e23b923
MH		 2870 int i, err;
2871
2872 BT_DBG("intf %p id %p", intf, id);
2873
cfeb4145 2874 /* interface numbers are hardcoded in the spec */
22f8e9db
MH		 2875 if (intf->cur_altsetting->desc.bInterfaceNumber != 0) {
2876 if (!(id->driver_info & BTUSB_IFNUM_2))
2877 return -ENODEV;
2878 if (intf->cur_altsetting->desc.bInterfaceNumber != 2)
2879 return -ENODEV;
2880 }
2881
2882 ifnum_base = intf->cur_altsetting->desc.bInterfaceNumber;
5e23b923
MH		 2883
2884 if (!id->driver_info) {
2885 const struct usb_device_id *match;
89e7533d 2886
5e23b923
MH		 2887 match = usb_match_id(intf, blacklist_table);
2888 if (match)
2889 id = match;
2890 }
2891
cfeb4145
MH		 2892 if (id->driver_info == BTUSB_IGNORE)
2893 return -ENODEV;
2894
2d25f8b4
SL		 2895 if (id->driver_info & BTUSB_ATH3012) {
2896 struct usb_device *udev = interface_to_usbdev(intf);
2897
2898 /* Old firmware would otherwise let ath3k driver load
2899 * patch and sysconfig files */
2900 if (le16_to_cpu(udev->descriptor.bcdDevice) <= 0x0001)
2901 return -ENODEV;
2902 }
2903
98921dbd 2904 data = devm_kzalloc(&intf->dev, sizeof(*data), GFP_KERNEL);
5e23b923
MH		 2905 if (!data)
2906 return -ENOMEM;
2907
2908 for (i = 0; i < intf->cur_altsetting->desc.bNumEndpoints; i++) {
2909 ep_desc = &intf->cur_altsetting->endpoint[i].desc;
2910
2911 if (!data->intr_ep && usb_endpoint_is_int_in(ep_desc)) {
2912 data->intr_ep = ep_desc;
2913 continue;
2914 }
2915
2916 if (!data->bulk_tx_ep && usb_endpoint_is_bulk_out(ep_desc)) {
2917 data->bulk_tx_ep = ep_desc;
2918 continue;
2919 }
2920
2921 if (!data->bulk_rx_ep && usb_endpoint_is_bulk_in(ep_desc)) {
2922 data->bulk_rx_ep = ep_desc;
2923 continue;
2924 }
2925 }
2926
98921dbd 2927 if (!data->intr_ep || !data->bulk_tx_ep || !data->bulk_rx_ep)
5e23b923 2928 return -ENODEV;
5e23b923 2929
893ba544
MH		 2930 if (id->driver_info & BTUSB_AMP) {
2931 data->cmdreq_type = USB_TYPE_CLASS | 0x01;
2932 data->cmdreq = 0x2b;
2933 } else {
2934 data->cmdreq_type = USB_TYPE_CLASS;
2935 data->cmdreq = 0x00;
2936 }
7a9d4020 2937
5e23b923 2938 data->udev = interface_to_usbdev(intf);
5fbcd260 2939 data->intf = intf;
5e23b923 2940
5e23b923 2941 INIT_WORK(&data->work, btusb_work);
7bee549e 2942 INIT_WORK(&data->waker, btusb_waker);
803b5836
MH		 2943 init_usb_anchor(&data->deferred);
2944 init_usb_anchor(&data->tx_anchor);
7bee549e 2945 spin_lock_init(&data->txlock);
5e23b923 2946
5e23b923
MH		 2947 init_usb_anchor(&data->intr_anchor);
2948 init_usb_anchor(&data->bulk_anchor);
9bfa35fe 2949 init_usb_anchor(&data->isoc_anchor);
9d08f504 2950 init_usb_anchor(&data->diag_anchor);
803b5836 2951 spin_lock_init(&data->rxlock);
5e23b923 2952
cda0dd78
MH		 2953 if (id->driver_info & BTUSB_INTEL_NEW) {
2954 data->recv_event = btusb_recv_event_intel;
2955 data->recv_bulk = btusb_recv_bulk_intel;
2956 set_bit(BTUSB_BOOTLOADER, &data->flags);
2957 } else {
2958 data->recv_event = hci_recv_frame;
2959 data->recv_bulk = btusb_recv_bulk;
2960 }
2cbd3f5c 2961
5e23b923 2962 hdev = hci_alloc_dev();
98921dbd 2963 if (!hdev)
5e23b923 2964 return -ENOMEM;
5e23b923 2965
c13854ce 2966 hdev->bus = HCI_USB;
155961e8 2967 hci_set_drvdata(hdev, data);
5e23b923 2968
893ba544
MH		 2969 if (id->driver_info & BTUSB_AMP)
2970 hdev->dev_type = HCI_AMP;
2971 else
ca8bee5d 2972 hdev->dev_type = HCI_PRIMARY;
893ba544 2973
5e23b923
MH		 2974 data->hdev = hdev;
2975
2976 SET_HCIDEV_DEV(hdev, &intf->dev);
2977
9f8f962c
MH		 2978 hdev->open = btusb_open;
2979 hdev->close = btusb_close;
2980 hdev->flush = btusb_flush;
2981 hdev->send = btusb_send_frame;
2982 hdev->notify = btusb_notify;
2983
fd913ef7
RJ		 2984#ifdef CONFIG_PM
2985 err = btusb_config_oob_wake(hdev);
2986 if (err)
2987 goto out_free_dev;
a4ccc9e3
RJ		 2988
2989 /* Marvell devices may need a specific chip configuration */
2990 if (id->driver_info & BTUSB_MARVELL && data->oob_wake_irq) {
2991 err = marvell_config_oob_wake(hdev);
2992 if (err)
2993 goto out_free_dev;
2994 }
fd913ef7 2995#endif
418678b0
SJ		 2996 if (id->driver_info & BTUSB_CW6622)
2997 set_bit(HCI_QUIRK_BROKEN_STORED_LINK_KEY, &hdev->quirks);
2998
6c9d435d
MH		 2999 if (id->driver_info & BTUSB_BCM2045)
3000 set_bit(HCI_QUIRK_BROKEN_STORED_LINK_KEY, &hdev->quirks);
3001
9f8f962c
MH		 3002 if (id->driver_info & BTUSB_BCM92035)
3003 hdev->setup = btusb_setup_bcm92035;
5e23b923 3004
c2bfb100 3005#ifdef CONFIG_BT_HCIBTUSB_BCM
abbaf50e 3006 if (id->driver_info & BTUSB_BCM_PATCHRAM) {
49a5f782 3007 hdev->manufacturer = 15;
c2bfb100 3008 hdev->setup = btbcm_setup_patchram;
9d08f504 3009 hdev->set_diag = btusb_bcm_set_diag;
1df1f591 3010 hdev->set_bdaddr = btbcm_set_bdaddr;
9d08f504
MH		 3011
3012 /* Broadcom LM_DIAG Interface numbers are hardcoded */
22f8e9db 3013 data->diag = usb_ifnum_to_if(data->udev, ifnum_base + 2);
abbaf50e 3014 }
10d4c673 3015
9d08f504 3016 if (id->driver_info & BTUSB_BCM_APPLE) {
49a5f782 3017 hdev->manufacturer = 15;
c2bfb100 3018 hdev->setup = btbcm_setup_apple;
9d08f504
MH		 3019 hdev->set_diag = btusb_bcm_set_diag;
3020
3021 /* Broadcom LM_DIAG Interface numbers are hardcoded */
22f8e9db 3022 data->diag = usb_ifnum_to_if(data->udev, ifnum_base + 2);
9d08f504 3023 }
c2bfb100 3024#endif
17b2772b 3025
cb8d6597 3026 if (id->driver_info & BTUSB_INTEL) {
49a5f782 3027 hdev->manufacturer = 2;
dffd30ee 3028 hdev->setup = btusb_setup_intel;
bfbd45e9 3029 hdev->shutdown = btusb_shutdown_intel;
3e24767b 3030 hdev->set_diag = btintel_set_diag_mfg;
4185a0f5 3031 hdev->set_bdaddr = btintel_set_bdaddr;
c33fb9b4 3032 set_bit(HCI_QUIRK_STRICT_DUPLICATE_FILTER, &hdev->quirks);
c1154842 3033 set_bit(HCI_QUIRK_SIMULTANEOUS_DISCOVERY, &hdev->quirks);
3e24767b 3034 set_bit(HCI_QUIRK_NON_PERSISTENT_DIAG, &hdev->quirks);
cb8d6597 3035 }
dffd30ee 3036
cda0dd78 3037 if (id->driver_info & BTUSB_INTEL_NEW) {
49a5f782 3038 hdev->manufacturer = 2;
cda0dd78
MH		 3039 hdev->send = btusb_send_frame_intel;
3040 hdev->setup = btusb_setup_intel_new;
eeb6abe9 3041 hdev->hw_error = btintel_hw_error;
6d2e50d2 3042 hdev->set_diag = btintel_set_diag;
4185a0f5 3043 hdev->set_bdaddr = btintel_set_bdaddr;
b970c5ba 3044 set_bit(HCI_QUIRK_STRICT_DUPLICATE_FILTER, &hdev->quirks);
d8270fbb 3045 set_bit(HCI_QUIRK_NON_PERSISTENT_DIAG, &hdev->quirks);
cda0dd78
MH		 3046 }
3047
ae8df494
AK		 3048 if (id->driver_info & BTUSB_MARVELL)
3049 hdev->set_bdaddr = btusb_set_bdaddr_marvell;
3050
661cf88a
MH		 3051 if (id->driver_info & BTUSB_SWAVE) {
3052 set_bit(HCI_QUIRK_FIXUP_INQUIRY_MODE, &hdev->quirks);
d57dbe77 3053 set_bit(HCI_QUIRK_BROKEN_LOCAL_COMMANDS, &hdev->quirks);
661cf88a 3054 }
d57dbe77 3055
e4c534bb
MH		 3056 if (id->driver_info & BTUSB_INTEL_BOOT) {
3057 hdev->manufacturer = 2;
40df783d 3058 set_bit(HCI_QUIRK_RAW_DEVICE, &hdev->quirks);
e4c534bb 3059 }
40df783d 3060
79f0c87d 3061 if (id->driver_info & BTUSB_ATH3012) {
5859223e 3062 hdev->set_bdaddr = btusb_set_bdaddr_ath3012;
3d50d51a 3063 set_bit(HCI_QUIRK_SIMULTANEOUS_DISCOVERY, &hdev->quirks);
79f0c87d
JP		 3064 set_bit(HCI_QUIRK_STRICT_DUPLICATE_FILTER, &hdev->quirks);
3065 }
5859223e 3066
3267c884
KBYT		 3067 if (id->driver_info & BTUSB_QCA_ROME) {
3068 data->setup_on_usb = btusb_setup_qca;
3069 hdev->set_bdaddr = btusb_set_bdaddr_ath3012;
3070 }
3071
db33c77d 3072#ifdef CONFIG_BT_HCIBTUSB_RTL
04b8c814 3073 if (id->driver_info & BTUSB_REALTEK) {
db33c77d 3074 hdev->setup = btrtl_setup_realtek;
04b8c814
DD		 3075
3076 /* Realtek devices lose their updated firmware over suspend,
3077 * but the USB hub doesn't notice any status change.
3078 * Explicitly request a device reset on resume.
3079 */
3080 set_bit(BTUSB_RESET_RESUME, &data->flags);
3081 }
db33c77d 3082#endif
a2698a9b 3083
893ba544
MH		 3084 if (id->driver_info & BTUSB_AMP) {
3085 /* AMP controllers do not support SCO packets */
3086 data->isoc = NULL;
3087 } else {
22f8e9db
MH		 3088 /* Interface orders are hardcoded in the specification */
3089 data->isoc = usb_ifnum_to_if(data->udev, ifnum_base + 1);
893ba544 3090 }
9bfa35fe 3091
7a9d4020 3092 if (!reset)
a6c511c6 3093 set_bit(HCI_QUIRK_RESET_ON_CLOSE, &hdev->quirks);
cfeb4145
MH		 3094
3095 if (force_scofix || id->driver_info & BTUSB_WRONG_SCO_MTU) {
3096 if (!disable_scofix)
3097 set_bit(HCI_QUIRK_FIXUP_BUFFER_SIZE, &hdev->quirks);
3098 }
3099
9bfa35fe
MH		 3100 if (id->driver_info & BTUSB_BROKEN_ISOC)
3101 data->isoc = NULL;
3102
7a9d4020
MH		 3103 if (id->driver_info & BTUSB_DIGIANSWER) {
3104 data->cmdreq_type = USB_TYPE_VENDOR;
a6c511c6 3105 set_bit(HCI_QUIRK_RESET_ON_CLOSE, &hdev->quirks);
7a9d4020
MH		 3106 }
3107
3108 if (id->driver_info & BTUSB_CSR) {
3109 struct usb_device *udev = data->udev;
81cac64b 3110 u16 bcdDevice = le16_to_cpu(udev->descriptor.bcdDevice);
7a9d4020
MH		 3111
3112 /* Old firmware would otherwise execute USB reset */
81cac64b 3113 if (bcdDevice < 0x117)
a6c511c6 3114 set_bit(HCI_QUIRK_RESET_ON_CLOSE, &hdev->quirks);
81cac64b
MH		 3115
3116 /* Fake CSR devices with broken commands */
6cafcd95 3117 if (bcdDevice <= 0x100 || bcdDevice == 0x134)
81cac64b 3118 hdev->setup = btusb_setup_csr;
49c989a0
JP		 3119
3120 set_bit(HCI_QUIRK_SIMULTANEOUS_DISCOVERY, &hdev->quirks);
7a9d4020
MH		 3121 }
3122
cfeb4145 3123 if (id->driver_info & BTUSB_SNIFFER) {
9bfa35fe 3124 struct usb_device *udev = data->udev;
cfeb4145 3125
7a9d4020 3126 /* New sniffer firmware has crippled HCI interface */
cfeb4145
MH		 3127 if (le16_to_cpu(udev->descriptor.bcdDevice) > 0x997)
3128 set_bit(HCI_QUIRK_RAW_DEVICE, &hdev->quirks);
3129 }
3130
3a5ef20c
MH		 3131 if (id->driver_info & BTUSB_INTEL_BOOT) {
3132 /* A bug in the bootloader causes that interrupt interface is
3133 * only enabled after receiving SetInterface(0, AltSetting=0).
3134 */
3135 err = usb_set_interface(data->udev, 0, 0);
3136 if (err < 0) {
3137 BT_ERR("failed to set interface 0, alt 0 %d", err);
10ab133b 3138 goto out_free_dev;
3a5ef20c
MH		 3139 }
3140 }
3141
9bfa35fe
MH		 3142 if (data->isoc) {
3143 err = usb_driver_claim_interface(&btusb_driver,
89e7533d 3144 data->isoc, data);
10ab133b
RJ		 3145 if (err < 0)
3146 goto out_free_dev;
9bfa35fe
MH		 3147 }
3148
9d08f504
MH		 3149#ifdef CONFIG_BT_HCIBTUSB_BCM
3150 if (data->diag) {
3151 if (!usb_driver_claim_interface(&btusb_driver,
3152 data->diag, data))
3153 __set_diag_interface(hdev);
3154 else
3155 data->diag = NULL;
3156 }
3157#endif
3158
5e23b923 3159 err = hci_register_dev(hdev);
10ab133b
RJ		 3160 if (err < 0)
3161 goto out_free_dev;
5e23b923
MH		 3162
3163 usb_set_intfdata(intf, data);
3164
3165 return 0;
10ab133b
RJ		 3166
3167out_free_dev:
3168 hci_free_dev(hdev);
3169 return err;
5e23b923
MH		 3170}
3171
3172static void btusb_disconnect(struct usb_interface *intf)
3173{
3174 struct btusb_data *data = usb_get_intfdata(intf);
3175 struct hci_dev *hdev;
3176
3177 BT_DBG("intf %p", intf);
3178
3179 if (!data)
3180 return;
3181
3182 hdev = data->hdev;
5fbcd260
MH		 3183 usb_set_intfdata(data->intf, NULL);
3184
3185 if (data->isoc)
3186 usb_set_intfdata(data->isoc, NULL);
5e23b923 3187
9d08f504
MH		 3188 if (data->diag)
3189 usb_set_intfdata(data->diag, NULL);
3190
5e23b923
MH		 3191 hci_unregister_dev(hdev);
3192
9d08f504
MH		 3193 if (intf == data->intf) {
3194 if (data->isoc)
3195 usb_driver_release_interface(&btusb_driver, data->isoc);
3196 if (data->diag)
3197 usb_driver_release_interface(&btusb_driver, data->diag);
3198 } else if (intf == data->isoc) {
3199 if (data->diag)
3200 usb_driver_release_interface(&btusb_driver, data->diag);
5fbcd260 3201 usb_driver_release_interface(&btusb_driver, data->intf);
9d08f504
MH		 3202 } else if (intf == data->diag) {
3203 usb_driver_release_interface(&btusb_driver, data->intf);
3204 if (data->isoc)
3205 usb_driver_release_interface(&btusb_driver, data->isoc);
3206 }
5fbcd260 3207
fd913ef7
RJ		 3208 if (data->oob_wake_irq)
3209 device_init_wakeup(&data->udev->dev, false);
3210
5e23b923
MH		 3211 hci_free_dev(hdev);
3212}
3213
7bee549e 3214#ifdef CONFIG_PM
6a88adf2
MH		 3215static int btusb_suspend(struct usb_interface *intf, pm_message_t message)
3216{
3217 struct btusb_data *data = usb_get_intfdata(intf);
3218
3219 BT_DBG("intf %p", intf);
3220
3221 if (data->suspend_count++)
3222 return 0;
3223
7bee549e 3224 spin_lock_irq(&data->txlock);
5b1b0b81 3225 if (!(PMSG_IS_AUTO(message) && data->tx_in_flight)) {
7bee549e
ON		 3226 set_bit(BTUSB_SUSPENDING, &data->flags);
3227 spin_unlock_irq(&data->txlock);
3228 } else {
3229 spin_unlock_irq(&data->txlock);
3230 data->suspend_count--;
3231 return -EBUSY;
3232 }
3233
6a88adf2
MH		 3234 cancel_work_sync(&data->work);
3235
7bee549e 3236 btusb_stop_traffic(data);
6a88adf2
MH		 3237 usb_kill_anchored_urbs(&data->tx_anchor);
3238
fd913ef7
RJ		 3239 if (data->oob_wake_irq && device_may_wakeup(&data->udev->dev)) {
3240 set_bit(BTUSB_OOB_WAKE_ENABLED, &data->flags);
3241 enable_irq_wake(data->oob_wake_irq);
3242 enable_irq(data->oob_wake_irq);
3243 }
3244
04b8c814
DD		 3245 /* Optionally request a device reset on resume, but only when
3246 * wakeups are disabled. If wakeups are enabled we assume the
3247 * device will stay powered up throughout suspend.
3248 */
3249 if (test_bit(BTUSB_RESET_RESUME, &data->flags) &&
3250 !device_may_wakeup(&data->udev->dev))
3251 data->udev->reset_resume = 1;
3252
6a88adf2
MH		 3253 return 0;
3254}
3255
7bee549e
ON		 3256static void play_deferred(struct btusb_data *data)
3257{
3258 struct urb *urb;
3259 int err;
3260
3261 while ((urb = usb_get_from_anchor(&data->deferred))) {
3262 err = usb_submit_urb(urb, GFP_ATOMIC);
3263 if (err < 0)
3264 break;
3265
3266 data->tx_in_flight++;
3267 }
3268 usb_scuttle_anchored_urbs(&data->deferred);
3269}
3270
6a88adf2
MH		 3271static int btusb_resume(struct usb_interface *intf)
3272{
3273 struct btusb_data *data = usb_get_intfdata(intf);
3274 struct hci_dev *hdev = data->hdev;
7bee549e 3275 int err = 0;
6a88adf2
MH		 3276
3277 BT_DBG("intf %p", intf);
3278
3279 if (--data->suspend_count)
3280 return 0;
3281
fd913ef7
RJ		 3282 /* Disable only if not already disabled (keep it balanced) */
3283 if (test_and_clear_bit(BTUSB_OOB_WAKE_ENABLED, &data->flags)) {
3284 disable_irq(data->oob_wake_irq);
3285 disable_irq_wake(data->oob_wake_irq);
3286 }
3287
6a88adf2 3288 if (!test_bit(HCI_RUNNING, &hdev->flags))
7bee549e 3289 goto done;
6a88adf2
MH		 3290
3291 if (test_bit(BTUSB_INTR_RUNNING, &data->flags)) {
3292 err = btusb_submit_intr_urb(hdev, GFP_NOIO);
3293 if (err < 0) {
3294 clear_bit(BTUSB_INTR_RUNNING, &data->flags);
7bee549e 3295 goto failed;
6a88adf2
MH		 3296 }
3297 }
3298
3299 if (test_bit(BTUSB_BULK_RUNNING, &data->flags)) {
43c2e57f
MH		 3300 err = btusb_submit_bulk_urb(hdev, GFP_NOIO);
3301 if (err < 0) {
6a88adf2 3302 clear_bit(BTUSB_BULK_RUNNING, &data->flags);
7bee549e
ON		 3303 goto failed;
3304 }
3305
3306 btusb_submit_bulk_urb(hdev, GFP_NOIO);
6a88adf2
MH		 3307 }
3308
3309 if (test_bit(BTUSB_ISOC_RUNNING, &data->flags)) {
3310 if (btusb_submit_isoc_urb(hdev, GFP_NOIO) < 0)
3311 clear_bit(BTUSB_ISOC_RUNNING, &data->flags);
3312 else
3313 btusb_submit_isoc_urb(hdev, GFP_NOIO);
3314 }
3315
7bee549e
ON		 3316 spin_lock_irq(&data->txlock);
3317 play_deferred(data);
3318 clear_bit(BTUSB_SUSPENDING, &data->flags);
3319 spin_unlock_irq(&data->txlock);
3320 schedule_work(&data->work);
3321
6a88adf2 3322 return 0;
7bee549e
ON		 3323
3324failed:
3325 usb_scuttle_anchored_urbs(&data->deferred);
3326done:
3327 spin_lock_irq(&data->txlock);
3328 clear_bit(BTUSB_SUSPENDING, &data->flags);
3329 spin_unlock_irq(&data->txlock);
3330
3331 return err;
6a88adf2 3332}
7bee549e 3333#endif
6a88adf2 3334
5e23b923
MH		 3335static struct usb_driver btusb_driver = {
3336 .name = "btusb",
3337 .probe = btusb_probe,
3338 .disconnect = btusb_disconnect,
7bee549e 3339#ifdef CONFIG_PM
6a88adf2
MH		 3340 .suspend = btusb_suspend,
3341 .resume = btusb_resume,
7bee549e 3342#endif
5e23b923 3343 .id_table = btusb_table,
7bee549e 3344 .supports_autosuspend = 1,
e1f12eb6 3345 .disable_hub_initiated_lpm = 1,
5e23b923
MH		 3346};
3347
93f1508c 3348module_usb_driver(btusb_driver);
5e23b923 3349
cfeb4145
MH		 3350module_param(disable_scofix, bool, 0644);
3351MODULE_PARM_DESC(disable_scofix, "Disable fixup of wrong SCO buffer size");
3352
3353module_param(force_scofix, bool, 0644);
3354MODULE_PARM_DESC(force_scofix, "Force fixup of wrong SCO buffers size");
3355
3356module_param(reset, bool, 0644);
3357MODULE_PARM_DESC(reset, "Send HCI reset command on initialization");
3358
5e23b923
MH		 3359MODULE_AUTHOR("Marcel Holtmann <marcel@holtmann.org>");
3360MODULE_DESCRIPTION("Generic Bluetooth USB driver ver " VERSION);
3361MODULE_VERSION(VERSION);
3362MODULE_LICENSE("GPL");
Ubuntu Artful kernel mirror