]> git.proxmox.com Git - mirror_ubuntu-bionic-kernel.git/blame - drivers/bluetooth/btusb.c
projects / mirror_ubuntu-bionic-kernel.git / blame
? search:
summary | shortlog | log | commit | commitdiff | tree
blob | blame (incremental) | history | HEAD
Bluetooth: btbcm: Fix handling of firmware not found
[mirror_ubuntu-bionic-kernel.git] / drivers / bluetooth / btusb.c
CommitLineData
5e23b923
MH		 1/*
2 *
3 * Generic Bluetooth USB driver
4 *
9bfa35fe 5 * Copyright (C) 2005-2008 Marcel Holtmann <marcel@holtmann.org>
5e23b923
MH		 6 *
7 *
8 * This program is free software; you can redistribute it and/or modify
9 * it under the terms of the GNU General Public License as published by
10 * the Free Software Foundation; either version 2 of the License, or
11 * (at your option) any later version.
12 *
13 * This program is distributed in the hope that it will be useful,
14 * but WITHOUT ANY WARRANTY; without even the implied warranty of
15 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
16 * GNU General Public License for more details.
17 *
18 * You should have received a copy of the GNU General Public License
19 * along with this program; if not, write to the Free Software
20 * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
21 *
22 */
23
5e23b923 24#include <linux/module.h>
5e23b923 25#include <linux/usb.h>
dffd30ee 26#include <linux/firmware.h>
a2698a9b 27#include <asm/unaligned.h>
5e23b923
MH		 28
29#include <net/bluetooth/bluetooth.h>
30#include <net/bluetooth/hci_core.h>
31
4185a0f5 32#include "btintel.h"
1df1f591 33#include "btbcm.h"
db33c77d 34#include "btrtl.h"
1df1f591 35
34dced9b 36#define VERSION "0.8"
cfeb4145 37
90ab5ee9
RR		 38static bool disable_scofix;
39static bool force_scofix;
7a9d4020 40
917a3337 41static bool reset = true;
cfeb4145
MH		 42
43static struct usb_driver btusb_driver;
44
45#define BTUSB_IGNORE 0x01
7a9d4020
MH		 46#define BTUSB_DIGIANSWER 0x02
47#define BTUSB_CSR 0x04
48#define BTUSB_SNIFFER 0x08
49#define BTUSB_BCM92035 0x10
50#define BTUSB_BROKEN_ISOC 0x20
51#define BTUSB_WRONG_SCO_MTU 0x40
2d25f8b4 52#define BTUSB_ATH3012 0x80
dffd30ee 53#define BTUSB_INTEL 0x100
40df783d
MH		 54#define BTUSB_INTEL_BOOT 0x200
55#define BTUSB_BCM_PATCHRAM 0x400
ae8df494 56#define BTUSB_MARVELL 0x800
4fcef8ed 57#define BTUSB_SWAVE 0x1000
cda0dd78 58#define BTUSB_INTEL_NEW 0x2000
893ba544 59#define BTUSB_AMP 0x4000
3267c884 60#define BTUSB_QCA_ROME 0x8000
17b2772b 61#define BTUSB_BCM_APPLE 0x10000
a2698a9b 62#define BTUSB_REALTEK 0x20000
6c9d435d 63#define BTUSB_BCM2045 0x40000
22f8e9db 64#define BTUSB_IFNUM_2 0x80000
5e23b923 65
54265202 66static const struct usb_device_id btusb_table[] = {
5e23b923
MH		 67 /* Generic Bluetooth USB device */
68 { USB_DEVICE_INFO(0xe0, 0x01, 0x01) },
69
893ba544
MH		 70 /* Generic Bluetooth AMP device */
71 { USB_DEVICE_INFO(0xe0, 0x01, 0x04), .driver_info = BTUSB_AMP },
72
d63b2826
DD		 73 /* Generic Bluetooth USB interface */
74 { USB_INTERFACE_INFO(0xe0, 0x01, 0x01) },
75
1fa6535f 76 /* Apple-specific (Broadcom) devices */
17b2772b 77 { USB_VENDOR_AND_INTERFACE_INFO(0x05ac, 0xff, 0x01, 0x01),
22f8e9db 78 .driver_info = BTUSB_BCM_APPLE | BTUSB_IFNUM_2 },
1fa6535f 79
178c059e
CYC		 80 /* MediaTek MT76x0E */
81 { USB_DEVICE(0x0e8d, 0x763f) },
82
c510eae3 83 /* Broadcom SoftSailing reporting vendor specific */
2e8b5063 84 { USB_DEVICE(0x0a5c, 0x21e1) },
c510eae3 85
3cd01976
NI		 86 /* Apple MacBookPro 7,1 */
87 { USB_DEVICE(0x05ac, 0x8213) },
88
0a79f674
CL		 89 /* Apple iMac11,1 */
90 { USB_DEVICE(0x05ac, 0x8215) },
91
9c047157
NI		 92 /* Apple MacBookPro6,2 */
93 { USB_DEVICE(0x05ac, 0x8218) },
94
3e3ede7d
EH		 95 /* Apple MacBookAir3,1, MacBookAir3,2 */
96 { USB_DEVICE(0x05ac, 0x821b) },
97
a63b723d
PAVM		 98 /* Apple MacBookAir4,1 */
99 { USB_DEVICE(0x05ac, 0x821f) },
100
88d377b6
MAP		 101 /* Apple MacBookPro8,2 */
102 { USB_DEVICE(0x05ac, 0x821a) },
103
f78b6826
JK		 104 /* Apple MacMini5,1 */
105 { USB_DEVICE(0x05ac, 0x8281) },
106
cfeb4145 107 /* AVM BlueFRITZ! USB v2.0 */
4fcef8ed 108 { USB_DEVICE(0x057c, 0x3800), .driver_info = BTUSB_SWAVE },
cfeb4145
MH		 109
110 /* Bluetooth Ultraport Module from IBM */
111 { USB_DEVICE(0x04bf, 0x030a) },
112
113 /* ALPS Modules with non-standard id */
114 { USB_DEVICE(0x044e, 0x3001) },
115 { USB_DEVICE(0x044e, 0x3002) },
116
117 /* Ericsson with non-standard id */
118 { USB_DEVICE(0x0bdb, 0x1002) },
119
120 /* Canyon CN-BTU1 with HID interfaces */
7a9d4020 121 { USB_DEVICE(0x0c10, 0x0000) },
cfeb4145 122
d13431ca
WJS		 123 /* Broadcom BCM20702A0 */
124 { USB_DEVICE(0x413c, 0x8197) },
125
d049f4e5
MH		 126 /* Broadcom BCM20702B0 (Dynex/Insignia) */
127 { USB_DEVICE(0x19ff, 0x0239), .driver_info = BTUSB_BCM_PATCHRAM },
128
2faf71ce
SR		 129 /* Broadcom BCM43142A0 (Foxconn/Lenovo) */
130 { USB_DEVICE(0x105b, 0xe065), .driver_info = BTUSB_BCM_PATCHRAM },
131
98514036 132 /* Foxconn - Hon Hai */
6029ddc2
HS		 133 { USB_VENDOR_AND_INTERFACE_INFO(0x0489, 0xff, 0x01, 0x01),
134 .driver_info = BTUSB_BCM_PATCHRAM },
98514036 135
8f0c304c
MD		 136 /* Lite-On Technology - Broadcom based */
137 { USB_VENDOR_AND_INTERFACE_INFO(0x04ca, 0xff, 0x01, 0x01),
138 .driver_info = BTUSB_BCM_PATCHRAM },
139
0b880062 140 /* Broadcom devices with vendor specific id */
10d4c673
PG		 141 { USB_VENDOR_AND_INTERFACE_INFO(0x0a5c, 0xff, 0x01, 0x01),
142 .driver_info = BTUSB_BCM_PATCHRAM },
92c385f4 143
c2aef6e8 144 /* ASUSTek Computer - Broadcom based */
9a5abdaa
RD		 145 { USB_VENDOR_AND_INTERFACE_INFO(0x0b05, 0xff, 0x01, 0x01),
146 .driver_info = BTUSB_BCM_PATCHRAM },
c2aef6e8 147
5bcecf32 148 /* Belkin F8065bf - Broadcom based */
6331c686
MH		 149 { USB_VENDOR_AND_INTERFACE_INFO(0x050d, 0xff, 0x01, 0x01),
150 .driver_info = BTUSB_BCM_PATCHRAM },
5bcecf32 151
9113bfd8 152 /* IMC Networks - Broadcom based */
6331c686
MH		 153 { USB_VENDOR_AND_INTERFACE_INFO(0x13d3, 0xff, 0x01, 0x01),
154 .driver_info = BTUSB_BCM_PATCHRAM },
9113bfd8 155
1623d0bf
DT		 156 /* Toshiba Corp - Broadcom based */
157 { USB_VENDOR_AND_INTERFACE_INFO(0x0930, 0xff, 0x01, 0x01),
158 .driver_info = BTUSB_BCM_PATCHRAM },
159
40df783d 160 /* Intel Bluetooth USB Bootloader (RAM module) */
d92f2df0
MH		 161 { USB_DEVICE(0x8087, 0x0a5a),
162 .driver_info = BTUSB_INTEL_BOOT | BTUSB_BROKEN_ISOC },
40df783d 163
5e23b923
MH		 164 { } /* Terminating entry */
165};
166
167MODULE_DEVICE_TABLE(usb, btusb_table);
168
54265202 169static const struct usb_device_id blacklist_table[] = {
cfeb4145
MH		 170 /* CSR BlueCore devices */
171 { USB_DEVICE(0x0a12, 0x0001), .driver_info = BTUSB_CSR },
172
173 /* Broadcom BCM2033 without firmware */
174 { USB_DEVICE(0x0a5c, 0x2033), .driver_info = BTUSB_IGNORE },
175
6c9d435d
MH		 176 /* Broadcom BCM2045 devices */
177 { USB_DEVICE(0x0a5c, 0x2045), .driver_info = BTUSB_BCM2045 },
178
be93112a 179 /* Atheros 3011 with sflash firmware */
0b880062
AS		 180 { USB_DEVICE(0x0489, 0xe027), .driver_info = BTUSB_IGNORE },
181 { USB_DEVICE(0x0489, 0xe03d), .driver_info = BTUSB_IGNORE },
2eeff0b4 182 { USB_DEVICE(0x04f2, 0xaff1), .driver_info = BTUSB_IGNORE },
0b880062 183 { USB_DEVICE(0x0930, 0x0215), .driver_info = BTUSB_IGNORE },
be93112a 184 { USB_DEVICE(0x0cf3, 0x3002), .driver_info = BTUSB_IGNORE },
6eda541d 185 { USB_DEVICE(0x0cf3, 0xe019), .driver_info = BTUSB_IGNORE },
2a7bcccc 186 { USB_DEVICE(0x13d3, 0x3304), .driver_info = BTUSB_IGNORE },
be93112a 187
509e7861
CYC		 188 /* Atheros AR9285 Malbec with sflash firmware */
189 { USB_DEVICE(0x03f0, 0x311d), .driver_info = BTUSB_IGNORE },
190
d9f51b51 191 /* Atheros 3012 with sflash firmware */
0b880062
AS		 192 { USB_DEVICE(0x0489, 0xe04d), .driver_info = BTUSB_ATH3012 },
193 { USB_DEVICE(0x0489, 0xe04e), .driver_info = BTUSB_ATH3012 },
194 { USB_DEVICE(0x0489, 0xe056), .driver_info = BTUSB_ATH3012 },
195 { USB_DEVICE(0x0489, 0xe057), .driver_info = BTUSB_ATH3012 },
196 { USB_DEVICE(0x0489, 0xe05f), .driver_info = BTUSB_ATH3012 },
692c062e 197 { USB_DEVICE(0x0489, 0xe076), .driver_info = BTUSB_ATH3012 },
4b552bc9 198 { USB_DEVICE(0x0489, 0xe078), .driver_info = BTUSB_ATH3012 },
0b880062
AS		 199 { USB_DEVICE(0x04c5, 0x1330), .driver_info = BTUSB_ATH3012 },
200 { USB_DEVICE(0x04ca, 0x3004), .driver_info = BTUSB_ATH3012 },
201 { USB_DEVICE(0x04ca, 0x3005), .driver_info = BTUSB_ATH3012 },
202 { USB_DEVICE(0x04ca, 0x3006), .driver_info = BTUSB_ATH3012 },
1fb4e09a 203 { USB_DEVICE(0x04ca, 0x3007), .driver_info = BTUSB_ATH3012 },
0b880062
AS		 204 { USB_DEVICE(0x04ca, 0x3008), .driver_info = BTUSB_ATH3012 },
205 { USB_DEVICE(0x04ca, 0x300b), .driver_info = BTUSB_ATH3012 },
7e730c7f 206 { USB_DEVICE(0x04ca, 0x300d), .driver_info = BTUSB_ATH3012 },
ec0810d2 207 { USB_DEVICE(0x04ca, 0x300f), .driver_info = BTUSB_ATH3012 },
134d3b35 208 { USB_DEVICE(0x04ca, 0x3010), .driver_info = BTUSB_ATH3012 },
0b880062 209 { USB_DEVICE(0x0930, 0x0219), .driver_info = BTUSB_ATH3012 },
cd355ff0 210 { USB_DEVICE(0x0930, 0x021c), .driver_info = BTUSB_ATH3012 },
0b880062 211 { USB_DEVICE(0x0930, 0x0220), .driver_info = BTUSB_ATH3012 },
89d2975f 212 { USB_DEVICE(0x0930, 0x0227), .driver_info = BTUSB_ATH3012 },
a735f9e2 213 { USB_DEVICE(0x0b05, 0x17d0), .driver_info = BTUSB_ATH3012 },
d66629c1 214 { USB_DEVICE(0x0cf3, 0x0036), .driver_info = BTUSB_ATH3012 },
2d25f8b4 215 { USB_DEVICE(0x0cf3, 0x3004), .driver_info = BTUSB_ATH3012 },
94a32d10 216 { USB_DEVICE(0x0cf3, 0x3008), .driver_info = BTUSB_ATH3012 },
07c0ea87 217 { USB_DEVICE(0x0cf3, 0x311d), .driver_info = BTUSB_ATH3012 },
b131237c 218 { USB_DEVICE(0x0cf3, 0x311e), .driver_info = BTUSB_ATH3012 },
1e56f1eb 219 { USB_DEVICE(0x0cf3, 0x311f), .driver_info = BTUSB_ATH3012 },
0b880062 220 { USB_DEVICE(0x0cf3, 0x3121), .driver_info = BTUSB_ATH3012 },
ebaf5795 221 { USB_DEVICE(0x0cf3, 0x817a), .driver_info = BTUSB_ATH3012 },
18e0afab 222 { USB_DEVICE(0x0cf3, 0x817b), .driver_info = BTUSB_ATH3012 },
0b880062 223 { USB_DEVICE(0x0cf3, 0xe003), .driver_info = BTUSB_ATH3012 },
ac71311e 224 { USB_DEVICE(0x0cf3, 0xe004), .driver_info = BTUSB_ATH3012 },
0a3658cc 225 { USB_DEVICE(0x0cf3, 0xe005), .driver_info = BTUSB_ATH3012 },
ca79f232 226 { USB_DEVICE(0x0cf3, 0xe006), .driver_info = BTUSB_ATH3012 },
0b880062
AS		 227 { USB_DEVICE(0x13d3, 0x3362), .driver_info = BTUSB_ATH3012 },
228 { USB_DEVICE(0x13d3, 0x3375), .driver_info = BTUSB_ATH3012 },
eed307e2 229 { USB_DEVICE(0x13d3, 0x3393), .driver_info = BTUSB_ATH3012 },
609574eb 230 { USB_DEVICE(0x13d3, 0x3395), .driver_info = BTUSB_ATH3012 },
5b77a1f3 231 { USB_DEVICE(0x13d3, 0x3402), .driver_info = BTUSB_ATH3012 },
3bb30a7c 232 { USB_DEVICE(0x13d3, 0x3408), .driver_info = BTUSB_ATH3012 },
033efa92 233 { USB_DEVICE(0x13d3, 0x3423), .driver_info = BTUSB_ATH3012 },
fa2f1394 234 { USB_DEVICE(0x13d3, 0x3432), .driver_info = BTUSB_ATH3012 },
0d0cef61 235 { USB_DEVICE(0x13d3, 0x3474), .driver_info = BTUSB_ATH3012 },
d9f51b51 236
e9036e33
CYC		 237 /* Atheros AR5BBU12 with sflash firmware */
238 { USB_DEVICE(0x0489, 0xe02c), .driver_info = BTUSB_IGNORE },
239
85d59726 240 /* Atheros AR5BBU12 with sflash firmware */
bc21fde2 241 { USB_DEVICE(0x0489, 0xe036), .driver_info = BTUSB_ATH3012 },
0b880062 242 { USB_DEVICE(0x0489, 0xe03c), .driver_info = BTUSB_ATH3012 },
85d59726 243
3267c884 244 /* QCA ROME chipset */
2054111b 245 { USB_DEVICE(0x0cf3, 0xe007), .driver_info = BTUSB_QCA_ROME },
c9e44474
MH		 246 { USB_DEVICE(0x0cf3, 0xe300), .driver_info = BTUSB_QCA_ROME },
247 { USB_DEVICE(0x0cf3, 0xe360), .driver_info = BTUSB_QCA_ROME },
3267c884 248
cfeb4145 249 /* Broadcom BCM2035 */
7a9d4020 250 { USB_DEVICE(0x0a5c, 0x2009), .driver_info = BTUSB_BCM92035 },
0b880062
AS		 251 { USB_DEVICE(0x0a5c, 0x200a), .driver_info = BTUSB_WRONG_SCO_MTU },
252 { USB_DEVICE(0x0a5c, 0x2035), .driver_info = BTUSB_WRONG_SCO_MTU },
cfeb4145
MH		 253
254 /* Broadcom BCM2045 */
7a9d4020
MH		 255 { USB_DEVICE(0x0a5c, 0x2039), .driver_info = BTUSB_WRONG_SCO_MTU },
256 { USB_DEVICE(0x0a5c, 0x2101), .driver_info = BTUSB_WRONG_SCO_MTU },
bdbef3d6 257
cfeb4145 258 /* IBM/Lenovo ThinkPad with Broadcom chip */
7a9d4020
MH		 259 { USB_DEVICE(0x0a5c, 0x201e), .driver_info = BTUSB_WRONG_SCO_MTU },
260 { USB_DEVICE(0x0a5c, 0x2110), .driver_info = BTUSB_WRONG_SCO_MTU },
cfeb4145
MH		 261
262 /* HP laptop with Broadcom chip */
7a9d4020 263 { USB_DEVICE(0x03f0, 0x171d), .driver_info = BTUSB_WRONG_SCO_MTU },
cfeb4145
MH		 264
265 /* Dell laptop with Broadcom chip */
7a9d4020 266 { USB_DEVICE(0x413c, 0x8126), .driver_info = BTUSB_WRONG_SCO_MTU },
cfeb4145 267
5ddd4a60 268 /* Dell Wireless 370 and 410 devices */
7a9d4020 269 { USB_DEVICE(0x413c, 0x8152), .driver_info = BTUSB_WRONG_SCO_MTU },
5ddd4a60 270 { USB_DEVICE(0x413c, 0x8156), .driver_info = BTUSB_WRONG_SCO_MTU },
cfeb4145 271
7a9d4020
MH		 272 /* Belkin F8T012 and F8T013 devices */
273 { USB_DEVICE(0x050d, 0x0012), .driver_info = BTUSB_WRONG_SCO_MTU },
274 { USB_DEVICE(0x050d, 0x0013), .driver_info = BTUSB_WRONG_SCO_MTU },
cfeb4145 275
5ddd4a60
MH		 276 /* Asus WL-BTD202 device */
277 { USB_DEVICE(0x0b05, 0x1715), .driver_info = BTUSB_WRONG_SCO_MTU },
278
279 /* Kensington Bluetooth USB adapter */
280 { USB_DEVICE(0x047d, 0x105e), .driver_info = BTUSB_WRONG_SCO_MTU },
281
cfeb4145
MH		 282 /* RTX Telecom based adapters with buggy SCO support */
283 { USB_DEVICE(0x0400, 0x0807), .driver_info = BTUSB_BROKEN_ISOC },
284 { USB_DEVICE(0x0400, 0x080a), .driver_info = BTUSB_BROKEN_ISOC },
285
286 /* CONWISE Technology based adapters with buggy SCO support */
287 { USB_DEVICE(0x0e5e, 0x6622), .driver_info = BTUSB_BROKEN_ISOC },
288
4fcef8ed 289 /* Roper Class 1 Bluetooth Dongle (Silicon Wave based) */
2eeac871 290 { USB_DEVICE(0x1310, 0x0001), .driver_info = BTUSB_SWAVE },
4fcef8ed 291
cfeb4145
MH		 292 /* Digianswer devices */
293 { USB_DEVICE(0x08fd, 0x0001), .driver_info = BTUSB_DIGIANSWER },
294 { USB_DEVICE(0x08fd, 0x0002), .driver_info = BTUSB_IGNORE },
295
296 /* CSR BlueCore Bluetooth Sniffer */
4f64fa80
MH		 297 { USB_DEVICE(0x0a12, 0x0002),
298 .driver_info = BTUSB_SNIFFER | BTUSB_BROKEN_ISOC },
cfeb4145
MH		 299
300 /* Frontline ComProbe Bluetooth Sniffer */
4f64fa80
MH		 301 { USB_DEVICE(0x16d3, 0x0002),
302 .driver_info = BTUSB_SNIFFER | BTUSB_BROKEN_ISOC },
cfeb4145 303
cb1ee89f
MH		 304 /* Marvell Bluetooth devices */
305 { USB_DEVICE(0x1286, 0x2044), .driver_info = BTUSB_MARVELL },
306 { USB_DEVICE(0x1286, 0x2046), .driver_info = BTUSB_MARVELL },
307
d0ac9eb7 308 /* Intel Bluetooth devices */
407550fe 309 { USB_DEVICE(0x8087, 0x07da), .driver_info = BTUSB_CSR },
dffd30ee 310 { USB_DEVICE(0x8087, 0x07dc), .driver_info = BTUSB_INTEL },
ef4e5e4a 311 { USB_DEVICE(0x8087, 0x0a2a), .driver_info = BTUSB_INTEL },
cda0dd78 312 { USB_DEVICE(0x8087, 0x0a2b), .driver_info = BTUSB_INTEL_NEW },
dffd30ee 313
d0ac9eb7
MH		 314 /* Other Intel Bluetooth devices */
315 { USB_VENDOR_AND_INTERFACE_INFO(0x8087, 0xe0, 0x01, 0x01),
316 .driver_info = BTUSB_IGNORE },
ae8df494 317
a2698a9b
DD		 318 /* Realtek Bluetooth devices */
319 { USB_VENDOR_AND_INTERFACE_INFO(0x0bda, 0xe0, 0x01, 0x01),
320 .driver_info = BTUSB_REALTEK },
321
322 /* Additional Realtek 8723AE Bluetooth devices */
323 { USB_DEVICE(0x0930, 0x021d), .driver_info = BTUSB_REALTEK },
324 { USB_DEVICE(0x13d3, 0x3394), .driver_info = BTUSB_REALTEK },
325
326 /* Additional Realtek 8723BE Bluetooth devices */
327 { USB_DEVICE(0x0489, 0xe085), .driver_info = BTUSB_REALTEK },
328 { USB_DEVICE(0x0489, 0xe08b), .driver_info = BTUSB_REALTEK },
329 { USB_DEVICE(0x13d3, 0x3410), .driver_info = BTUSB_REALTEK },
330 { USB_DEVICE(0x13d3, 0x3416), .driver_info = BTUSB_REALTEK },
331 { USB_DEVICE(0x13d3, 0x3459), .driver_info = BTUSB_REALTEK },
332
333 /* Additional Realtek 8821AE Bluetooth devices */
334 { USB_DEVICE(0x0b05, 0x17dc), .driver_info = BTUSB_REALTEK },
335 { USB_DEVICE(0x13d3, 0x3414), .driver_info = BTUSB_REALTEK },
336 { USB_DEVICE(0x13d3, 0x3458), .driver_info = BTUSB_REALTEK },
337 { USB_DEVICE(0x13d3, 0x3461), .driver_info = BTUSB_REALTEK },
338 { USB_DEVICE(0x13d3, 0x3462), .driver_info = BTUSB_REALTEK },
339
4481c076
PP		 340 /* Silicon Wave based devices */
341 { USB_DEVICE(0x0c10, 0x0000), .driver_info = BTUSB_SWAVE },
342
5e23b923
MH		 343 { } /* Terminating entry */
344};
345
9bfa35fe
MH		 346#define BTUSB_MAX_ISOC_FRAMES 10
347
5e23b923
MH		 348#define BTUSB_INTR_RUNNING 0
349#define BTUSB_BULK_RUNNING 1
9bfa35fe 350#define BTUSB_ISOC_RUNNING 2
7bee549e 351#define BTUSB_SUSPENDING 3
08b8b6c4 352#define BTUSB_DID_ISO_RESUME 4
cda0dd78
MH		 353#define BTUSB_BOOTLOADER 5
354#define BTUSB_DOWNLOADING 6
ce6bb929 355#define BTUSB_FIRMWARE_LOADED 7
cda0dd78 356#define BTUSB_FIRMWARE_FAILED 8
ce6bb929 357#define BTUSB_BOOTING 9
04b8c814 358#define BTUSB_RESET_RESUME 10
9d08f504 359#define BTUSB_DIAG_RUNNING 11
5e23b923
MH		 360
361struct btusb_data {
362 struct hci_dev *hdev;
363 struct usb_device *udev;
5fbcd260 364 struct usb_interface *intf;
9bfa35fe 365 struct usb_interface *isoc;
9d08f504 366 struct usb_interface *diag;
5e23b923 367
5e23b923
MH		 368 unsigned long flags;
369
370 struct work_struct work;
7bee549e 371 struct work_struct waker;
5e23b923 372
803b5836 373 struct usb_anchor deferred;
5e23b923 374 struct usb_anchor tx_anchor;
803b5836
MH		 375 int tx_in_flight;
376 spinlock_t txlock;
377
5e23b923
MH		 378 struct usb_anchor intr_anchor;
379 struct usb_anchor bulk_anchor;
9bfa35fe 380 struct usb_anchor isoc_anchor;
9d08f504 381 struct usb_anchor diag_anchor;
803b5836
MH		 382 spinlock_t rxlock;
383
384 struct sk_buff *evt_skb;
385 struct sk_buff *acl_skb;
386 struct sk_buff *sco_skb;
5e23b923
MH		 387
388 struct usb_endpoint_descriptor *intr_ep;
389 struct usb_endpoint_descriptor *bulk_tx_ep;
390 struct usb_endpoint_descriptor *bulk_rx_ep;
9bfa35fe
MH		 391 struct usb_endpoint_descriptor *isoc_tx_ep;
392 struct usb_endpoint_descriptor *isoc_rx_ep;
9d08f504
MH		 393 struct usb_endpoint_descriptor *diag_tx_ep;
394 struct usb_endpoint_descriptor *diag_rx_ep;
9bfa35fe 395
7a9d4020 396 __u8 cmdreq_type;
893ba544 397 __u8 cmdreq;
7a9d4020 398
43c2e57f 399 unsigned int sco_num;
9bfa35fe 400 int isoc_altsetting;
6a88adf2 401 int suspend_count;
2cbd3f5c 402
97307f51 403 int (*recv_event)(struct hci_dev *hdev, struct sk_buff *skb);
2cbd3f5c 404 int (*recv_bulk)(struct btusb_data *data, void *buffer, int count);
ace31982
KBYT		 405
406 int (*setup_on_usb)(struct hci_dev *hdev);
5e23b923
MH		 407};
408
803b5836
MH		 409static inline void btusb_free_frags(struct btusb_data *data)
410{
411 unsigned long flags;
412
413 spin_lock_irqsave(&data->rxlock, flags);
414
415 kfree_skb(data->evt_skb);
416 data->evt_skb = NULL;
417
418 kfree_skb(data->acl_skb);
419 data->acl_skb = NULL;
420
421 kfree_skb(data->sco_skb);
422 data->sco_skb = NULL;
423
424 spin_unlock_irqrestore(&data->rxlock, flags);
425}
426
1ffa4ad0
MH		 427static int btusb_recv_intr(struct btusb_data *data, void *buffer, int count)
428{
803b5836
MH		 429 struct sk_buff *skb;
430 int err = 0;
431
432 spin_lock(&data->rxlock);
433 skb = data->evt_skb;
434
435 while (count) {
436 int len;
437
438 if (!skb) {
439 skb = bt_skb_alloc(HCI_MAX_EVENT_SIZE, GFP_ATOMIC);
440 if (!skb) {
441 err = -ENOMEM;
442 break;
443 }
444
618e8bc2
MH		 445 hci_skb_pkt_type(skb) = HCI_EVENT_PKT;
446 hci_skb_expect(skb) = HCI_EVENT_HDR_SIZE;
803b5836
MH		 447 }
448
618e8bc2 449 len = min_t(uint, hci_skb_expect(skb), count);
803b5836
MH		 450 memcpy(skb_put(skb, len), buffer, len);
451
452 count -= len;
453 buffer += len;
618e8bc2 454 hci_skb_expect(skb) -= len;
803b5836
MH		 455
456 if (skb->len == HCI_EVENT_HDR_SIZE) {
457 /* Complete event header */
618e8bc2 458 hci_skb_expect(skb) = hci_event_hdr(skb)->plen;
803b5836 459
618e8bc2 460 if (skb_tailroom(skb) < hci_skb_expect(skb)) {
803b5836
MH		 461 kfree_skb(skb);
462 skb = NULL;
463
464 err = -EILSEQ;
465 break;
466 }
467 }
468
618e8bc2 469 if (!hci_skb_expect(skb)) {
803b5836 470 /* Complete frame */
97307f51 471 data->recv_event(data->hdev, skb);
803b5836
MH		 472 skb = NULL;
473 }
474 }
475
476 data->evt_skb = skb;
477 spin_unlock(&data->rxlock);
478
479 return err;
1ffa4ad0
MH		 480}
481
482static int btusb_recv_bulk(struct btusb_data *data, void *buffer, int count)
483{
803b5836
MH		 484 struct sk_buff *skb;
485 int err = 0;
486
487 spin_lock(&data->rxlock);
488 skb = data->acl_skb;
489
490 while (count) {
491 int len;
492
493 if (!skb) {
494 skb = bt_skb_alloc(HCI_MAX_FRAME_SIZE, GFP_ATOMIC);
495 if (!skb) {
496 err = -ENOMEM;
497 break;
498 }
499
618e8bc2
MH		 500 hci_skb_pkt_type(skb) = HCI_ACLDATA_PKT;
501 hci_skb_expect(skb) = HCI_ACL_HDR_SIZE;
803b5836
MH		 502 }
503
618e8bc2 504 len = min_t(uint, hci_skb_expect(skb), count);
803b5836
MH		 505 memcpy(skb_put(skb, len), buffer, len);
506
507 count -= len;
508 buffer += len;
618e8bc2 509 hci_skb_expect(skb) -= len;
803b5836
MH		 510
511 if (skb->len == HCI_ACL_HDR_SIZE) {
512 __le16 dlen = hci_acl_hdr(skb)->dlen;
513
514 /* Complete ACL header */
618e8bc2 515 hci_skb_expect(skb) = __le16_to_cpu(dlen);
803b5836 516
618e8bc2 517 if (skb_tailroom(skb) < hci_skb_expect(skb)) {
803b5836
MH		 518 kfree_skb(skb);
519 skb = NULL;
520
521 err = -EILSEQ;
522 break;
523 }
524 }
525
618e8bc2 526 if (!hci_skb_expect(skb)) {
803b5836
MH		 527 /* Complete frame */
528 hci_recv_frame(data->hdev, skb);
529 skb = NULL;
530 }
531 }
532
533 data->acl_skb = skb;
534 spin_unlock(&data->rxlock);
535
536 return err;
1ffa4ad0
MH		 537}
538
539static int btusb_recv_isoc(struct btusb_data *data, void *buffer, int count)
540{
803b5836
MH		 541 struct sk_buff *skb;
542 int err = 0;
543
544 spin_lock(&data->rxlock);
545 skb = data->sco_skb;
546
547 while (count) {
548 int len;
549
550 if (!skb) {
551 skb = bt_skb_alloc(HCI_MAX_SCO_SIZE, GFP_ATOMIC);
552 if (!skb) {
553 err = -ENOMEM;
554 break;
555 }
556
618e8bc2
MH		 557 hci_skb_pkt_type(skb) = HCI_SCODATA_PKT;
558 hci_skb_expect(skb) = HCI_SCO_HDR_SIZE;
803b5836
MH		 559 }
560
618e8bc2 561 len = min_t(uint, hci_skb_expect(skb), count);
803b5836
MH		 562 memcpy(skb_put(skb, len), buffer, len);
563
564 count -= len;
565 buffer += len;
618e8bc2 566 hci_skb_expect(skb) -= len;
803b5836
MH		 567
568 if (skb->len == HCI_SCO_HDR_SIZE) {
569 /* Complete SCO header */
618e8bc2 570 hci_skb_expect(skb) = hci_sco_hdr(skb)->dlen;
803b5836 571
618e8bc2 572 if (skb_tailroom(skb) < hci_skb_expect(skb)) {
803b5836
MH		 573 kfree_skb(skb);
574 skb = NULL;
575
576 err = -EILSEQ;
577 break;
578 }
579 }
580
618e8bc2 581 if (!hci_skb_expect(skb)) {
803b5836
MH		 582 /* Complete frame */
583 hci_recv_frame(data->hdev, skb);
584 skb = NULL;
585 }
586 }
587
588 data->sco_skb = skb;
589 spin_unlock(&data->rxlock);
590
591 return err;
1ffa4ad0
MH		 592}
593
5e23b923
MH		 594static void btusb_intr_complete(struct urb *urb)
595{
596 struct hci_dev *hdev = urb->context;
155961e8 597 struct btusb_data *data = hci_get_drvdata(hdev);
5e23b923
MH		 598 int err;
599
89e7533d
MH		 600 BT_DBG("%s urb %p status %d count %d", hdev->name, urb, urb->status,
601 urb->actual_length);
5e23b923
MH		 602
603 if (!test_bit(HCI_RUNNING, &hdev->flags))
604 return;
605
606 if (urb->status == 0) {
9bfa35fe
MH		 607 hdev->stat.byte_rx += urb->actual_length;
608
1ffa4ad0
MH		 609 if (btusb_recv_intr(data, urb->transfer_buffer,
610 urb->actual_length) < 0) {
5e23b923
MH		 611 BT_ERR("%s corrupted event packet", hdev->name);
612 hdev->stat.err_rx++;
613 }
85560c4a
CC		 614 } else if (urb->status == -ENOENT) {
615 /* Avoid suspend failed when usb_kill_urb */
616 return;
5e23b923
MH		 617 }
618
619 if (!test_bit(BTUSB_INTR_RUNNING, &data->flags))
620 return;
621
7bee549e 622 usb_mark_last_busy(data->udev);
5e23b923
MH		 623 usb_anchor_urb(urb, &data->intr_anchor);
624
625 err = usb_submit_urb(urb, GFP_ATOMIC);
626 if (err < 0) {
4935f1c1
PB		 627 /* -EPERM: urb is being killed;
628 * -ENODEV: device got disconnected */
629 if (err != -EPERM && err != -ENODEV)
61faddf6 630 BT_ERR("%s urb %p failed to resubmit (%d)",
89e7533d 631 hdev->name, urb, -err);
5e23b923
MH		 632 usb_unanchor_urb(urb);
633 }
634}
635
2eda66f4 636static int btusb_submit_intr_urb(struct hci_dev *hdev, gfp_t mem_flags)
5e23b923 637{
155961e8 638 struct btusb_data *data = hci_get_drvdata(hdev);
5e23b923
MH		 639 struct urb *urb;
640 unsigned char *buf;
641 unsigned int pipe;
642 int err, size;
643
644 BT_DBG("%s", hdev->name);
645
9bfa35fe
MH		 646 if (!data->intr_ep)
647 return -ENODEV;
648
2eda66f4 649 urb = usb_alloc_urb(0, mem_flags);
5e23b923
MH		 650 if (!urb)
651 return -ENOMEM;
652
653 size = le16_to_cpu(data->intr_ep->wMaxPacketSize);
654
2eda66f4 655 buf = kmalloc(size, mem_flags);
5e23b923
MH		 656 if (!buf) {
657 usb_free_urb(urb);
658 return -ENOMEM;
659 }
660
661 pipe = usb_rcvintpipe(data->udev, data->intr_ep->bEndpointAddress);
662
663 usb_fill_int_urb(urb, data->udev, pipe, buf, size,
89e7533d 664 btusb_intr_complete, hdev, data->intr_ep->bInterval);
5e23b923
MH		 665
666 urb->transfer_flags |= URB_FREE_BUFFER;
667
668 usb_anchor_urb(urb, &data->intr_anchor);
669
2eda66f4 670 err = usb_submit_urb(urb, mem_flags);
5e23b923 671 if (err < 0) {
d4b8d1c9
PB		 672 if (err != -EPERM && err != -ENODEV)
673 BT_ERR("%s urb %p submission failed (%d)",
89e7533d 674 hdev->name, urb, -err);
5e23b923 675 usb_unanchor_urb(urb);
5e23b923
MH		 676 }
677
678 usb_free_urb(urb);
679
680 return err;
681}
682
683static void btusb_bulk_complete(struct urb *urb)
684{
685 struct hci_dev *hdev = urb->context;
155961e8 686 struct btusb_data *data = hci_get_drvdata(hdev);
5e23b923
MH		 687 int err;
688
89e7533d
MH		 689 BT_DBG("%s urb %p status %d count %d", hdev->name, urb, urb->status,
690 urb->actual_length);
5e23b923
MH		 691
692 if (!test_bit(HCI_RUNNING, &hdev->flags))
693 return;
694
695 if (urb->status == 0) {
9bfa35fe
MH		 696 hdev->stat.byte_rx += urb->actual_length;
697
2cbd3f5c 698 if (data->recv_bulk(data, urb->transfer_buffer,
1ffa4ad0 699 urb->actual_length) < 0) {
5e23b923
MH		 700 BT_ERR("%s corrupted ACL packet", hdev->name);
701 hdev->stat.err_rx++;
702 }
85560c4a
CC		 703 } else if (urb->status == -ENOENT) {
704 /* Avoid suspend failed when usb_kill_urb */
705 return;
5e23b923
MH		 706 }
707
708 if (!test_bit(BTUSB_BULK_RUNNING, &data->flags))
709 return;
710
711 usb_anchor_urb(urb, &data->bulk_anchor);
652fd781 712 usb_mark_last_busy(data->udev);
5e23b923
MH		 713
714 err = usb_submit_urb(urb, GFP_ATOMIC);
715 if (err < 0) {
4935f1c1
PB		 716 /* -EPERM: urb is being killed;
717 * -ENODEV: device got disconnected */
718 if (err != -EPERM && err != -ENODEV)
61faddf6 719 BT_ERR("%s urb %p failed to resubmit (%d)",
89e7533d 720 hdev->name, urb, -err);
5e23b923
MH		 721 usb_unanchor_urb(urb);
722 }
723}
724
2eda66f4 725static int btusb_submit_bulk_urb(struct hci_dev *hdev, gfp_t mem_flags)
5e23b923 726{
155961e8 727 struct btusb_data *data = hci_get_drvdata(hdev);
5e23b923
MH		 728 struct urb *urb;
729 unsigned char *buf;
730 unsigned int pipe;
290ba200 731 int err, size = HCI_MAX_FRAME_SIZE;
5e23b923
MH		 732
733 BT_DBG("%s", hdev->name);
734
9bfa35fe
MH		 735 if (!data->bulk_rx_ep)
736 return -ENODEV;
737
2eda66f4 738 urb = usb_alloc_urb(0, mem_flags);
5e23b923
MH		 739 if (!urb)
740 return -ENOMEM;
741
2eda66f4 742 buf = kmalloc(size, mem_flags);
5e23b923
MH		 743 if (!buf) {
744 usb_free_urb(urb);
745 return -ENOMEM;
746 }
747
748 pipe = usb_rcvbulkpipe(data->udev, data->bulk_rx_ep->bEndpointAddress);
749
89e7533d
MH		 750 usb_fill_bulk_urb(urb, data->udev, pipe, buf, size,
751 btusb_bulk_complete, hdev);
5e23b923
MH		 752
753 urb->transfer_flags |= URB_FREE_BUFFER;
754
7bee549e 755 usb_mark_last_busy(data->udev);
5e23b923
MH		 756 usb_anchor_urb(urb, &data->bulk_anchor);
757
2eda66f4 758 err = usb_submit_urb(urb, mem_flags);
5e23b923 759 if (err < 0) {
d4b8d1c9
PB		 760 if (err != -EPERM && err != -ENODEV)
761 BT_ERR("%s urb %p submission failed (%d)",
89e7533d 762 hdev->name, urb, -err);
5e23b923 763 usb_unanchor_urb(urb);
5e23b923
MH		 764 }
765
766 usb_free_urb(urb);
767
768 return err;
769}
770
9bfa35fe
MH		 771static void btusb_isoc_complete(struct urb *urb)
772{
773 struct hci_dev *hdev = urb->context;
155961e8 774 struct btusb_data *data = hci_get_drvdata(hdev);
9bfa35fe
MH		 775 int i, err;
776
89e7533d
MH		 777 BT_DBG("%s urb %p status %d count %d", hdev->name, urb, urb->status,
778 urb->actual_length);
9bfa35fe
MH		 779
780 if (!test_bit(HCI_RUNNING, &hdev->flags))
781 return;
782
783 if (urb->status == 0) {
784 for (i = 0; i < urb->number_of_packets; i++) {
785 unsigned int offset = urb->iso_frame_desc[i].offset;
786 unsigned int length = urb->iso_frame_desc[i].actual_length;
787
788 if (urb->iso_frame_desc[i].status)
789 continue;
790
791 hdev->stat.byte_rx += length;
792
1ffa4ad0
MH		 793 if (btusb_recv_isoc(data, urb->transfer_buffer + offset,
794 length) < 0) {
9bfa35fe
MH		 795 BT_ERR("%s corrupted SCO packet", hdev->name);
796 hdev->stat.err_rx++;
797 }
798 }
85560c4a
CC		 799 } else if (urb->status == -ENOENT) {
800 /* Avoid suspend failed when usb_kill_urb */
801 return;
9bfa35fe
MH		 802 }
803
804 if (!test_bit(BTUSB_ISOC_RUNNING, &data->flags))
805 return;
806
807 usb_anchor_urb(urb, &data->isoc_anchor);
808
809 err = usb_submit_urb(urb, GFP_ATOMIC);
810 if (err < 0) {
4935f1c1
PB		 811 /* -EPERM: urb is being killed;
812 * -ENODEV: device got disconnected */
813 if (err != -EPERM && err != -ENODEV)
61faddf6 814 BT_ERR("%s urb %p failed to resubmit (%d)",
89e7533d 815 hdev->name, urb, -err);
9bfa35fe
MH		 816 usb_unanchor_urb(urb);
817 }
818}
819
42b16b3f 820static inline void __fill_isoc_descriptor(struct urb *urb, int len, int mtu)
9bfa35fe
MH		 821{
822 int i, offset = 0;
823
824 BT_DBG("len %d mtu %d", len, mtu);
825
826 for (i = 0; i < BTUSB_MAX_ISOC_FRAMES && len >= mtu;
827 i++, offset += mtu, len -= mtu) {
828 urb->iso_frame_desc[i].offset = offset;
829 urb->iso_frame_desc[i].length = mtu;
830 }
831
832 if (len && i < BTUSB_MAX_ISOC_FRAMES) {
833 urb->iso_frame_desc[i].offset = offset;
834 urb->iso_frame_desc[i].length = len;
835 i++;
836 }
837
838 urb->number_of_packets = i;
839}
840
2eda66f4 841static int btusb_submit_isoc_urb(struct hci_dev *hdev, gfp_t mem_flags)
9bfa35fe 842{
155961e8 843 struct btusb_data *data = hci_get_drvdata(hdev);
9bfa35fe
MH		 844 struct urb *urb;
845 unsigned char *buf;
846 unsigned int pipe;
847 int err, size;
848
849 BT_DBG("%s", hdev->name);
850
851 if (!data->isoc_rx_ep)
852 return -ENODEV;
853
2eda66f4 854 urb = usb_alloc_urb(BTUSB_MAX_ISOC_FRAMES, mem_flags);
9bfa35fe
MH		 855 if (!urb)
856 return -ENOMEM;
857
858 size = le16_to_cpu(data->isoc_rx_ep->wMaxPacketSize) *
859 BTUSB_MAX_ISOC_FRAMES;
860
2eda66f4 861 buf = kmalloc(size, mem_flags);
9bfa35fe
MH		 862 if (!buf) {
863 usb_free_urb(urb);
864 return -ENOMEM;
865 }
866
867 pipe = usb_rcvisocpipe(data->udev, data->isoc_rx_ep->bEndpointAddress);
868
fa0fb93f 869 usb_fill_int_urb(urb, data->udev, pipe, buf, size, btusb_isoc_complete,
89e7533d 870 hdev, data->isoc_rx_ep->bInterval);
9bfa35fe 871
89e7533d 872 urb->transfer_flags = URB_FREE_BUFFER | URB_ISO_ASAP;
9bfa35fe
MH		 873
874 __fill_isoc_descriptor(urb, size,
89e7533d 875 le16_to_cpu(data->isoc_rx_ep->wMaxPacketSize));
9bfa35fe
MH		 876
877 usb_anchor_urb(urb, &data->isoc_anchor);
878
2eda66f4 879 err = usb_submit_urb(urb, mem_flags);
9bfa35fe 880 if (err < 0) {
d4b8d1c9
PB		 881 if (err != -EPERM && err != -ENODEV)
882 BT_ERR("%s urb %p submission failed (%d)",
89e7533d 883 hdev->name, urb, -err);
9bfa35fe 884 usb_unanchor_urb(urb);
9bfa35fe
MH		 885 }
886
887 usb_free_urb(urb);
888
889 return err;
890}
891
9d08f504
MH		 892static void btusb_diag_complete(struct urb *urb)
893{
894 struct hci_dev *hdev = urb->context;
895 struct btusb_data *data = hci_get_drvdata(hdev);
896 int err;
897
898 BT_DBG("%s urb %p status %d count %d", hdev->name, urb, urb->status,
899 urb->actual_length);
900
901 if (urb->status == 0) {
902 struct sk_buff *skb;
903
904 skb = bt_skb_alloc(urb->actual_length, GFP_ATOMIC);
905 if (skb) {
906 memcpy(skb_put(skb, urb->actual_length),
907 urb->transfer_buffer, urb->actual_length);
908 hci_recv_diag(hdev, skb);
909 }
910 } else if (urb->status == -ENOENT) {
911 /* Avoid suspend failed when usb_kill_urb */
912 return;
913 }
914
915 if (!test_bit(BTUSB_DIAG_RUNNING, &data->flags))
916 return;
917
918 usb_anchor_urb(urb, &data->diag_anchor);
919 usb_mark_last_busy(data->udev);
920
921 err = usb_submit_urb(urb, GFP_ATOMIC);
922 if (err < 0) {
923 /* -EPERM: urb is being killed;
924 * -ENODEV: device got disconnected */
925 if (err != -EPERM && err != -ENODEV)
926 BT_ERR("%s urb %p failed to resubmit (%d)",
927 hdev->name, urb, -err);
928 usb_unanchor_urb(urb);
929 }
930}
931
932static int btusb_submit_diag_urb(struct hci_dev *hdev, gfp_t mem_flags)
933{
934 struct btusb_data *data = hci_get_drvdata(hdev);
935 struct urb *urb;
936 unsigned char *buf;
937 unsigned int pipe;
938 int err, size = HCI_MAX_FRAME_SIZE;
939
940 BT_DBG("%s", hdev->name);
941
942 if (!data->diag_rx_ep)
943 return -ENODEV;
944
945 urb = usb_alloc_urb(0, mem_flags);
946 if (!urb)
947 return -ENOMEM;
948
949 buf = kmalloc(size, mem_flags);
950 if (!buf) {
951 usb_free_urb(urb);
952 return -ENOMEM;
953 }
954
955 pipe = usb_rcvbulkpipe(data->udev, data->diag_rx_ep->bEndpointAddress);
956
957 usb_fill_bulk_urb(urb, data->udev, pipe, buf, size,
958 btusb_diag_complete, hdev);
959
960 urb->transfer_flags |= URB_FREE_BUFFER;
961
962 usb_mark_last_busy(data->udev);
963 usb_anchor_urb(urb, &data->diag_anchor);
964
965 err = usb_submit_urb(urb, mem_flags);
966 if (err < 0) {
967 if (err != -EPERM && err != -ENODEV)
968 BT_ERR("%s urb %p submission failed (%d)",
969 hdev->name, urb, -err);
970 usb_unanchor_urb(urb);
971 }
972
973 usb_free_urb(urb);
974
975 return err;
976}
977
5e23b923 978static void btusb_tx_complete(struct urb *urb)
7bee549e
ON		 979{
980 struct sk_buff *skb = urb->context;
89e7533d 981 struct hci_dev *hdev = (struct hci_dev *)skb->dev;
155961e8 982 struct btusb_data *data = hci_get_drvdata(hdev);
7bee549e 983
89e7533d
MH		 984 BT_DBG("%s urb %p status %d count %d", hdev->name, urb, urb->status,
985 urb->actual_length);
7bee549e
ON		 986
987 if (!test_bit(HCI_RUNNING, &hdev->flags))
988 goto done;
989
990 if (!urb->status)
991 hdev->stat.byte_tx += urb->transfer_buffer_length;
992 else
993 hdev->stat.err_tx++;
994
995done:
996 spin_lock(&data->txlock);
997 data->tx_in_flight--;
998 spin_unlock(&data->txlock);
999
1000 kfree(urb->setup_packet);
1001
1002 kfree_skb(skb);
1003}
1004
1005static void btusb_isoc_tx_complete(struct urb *urb)
5e23b923
MH		 1006{
1007 struct sk_buff *skb = urb->context;
89e7533d 1008 struct hci_dev *hdev = (struct hci_dev *)skb->dev;
5e23b923 1009
89e7533d
MH		 1010 BT_DBG("%s urb %p status %d count %d", hdev->name, urb, urb->status,
1011 urb->actual_length);
5e23b923
MH		 1012
1013 if (!test_bit(HCI_RUNNING, &hdev->flags))
1014 goto done;
1015
1016 if (!urb->status)
1017 hdev->stat.byte_tx += urb->transfer_buffer_length;
1018 else
1019 hdev->stat.err_tx++;
1020
1021done:
1022 kfree(urb->setup_packet);
1023
1024 kfree_skb(skb);
1025}
1026
1027static int btusb_open(struct hci_dev *hdev)
1028{
155961e8 1029 struct btusb_data *data = hci_get_drvdata(hdev);
5e23b923
MH		 1030 int err;
1031
1032 BT_DBG("%s", hdev->name);
1033
ace31982
KBYT		 1034 /* Patching USB firmware files prior to starting any URBs of HCI path
1035 * It is more safe to use USB bulk channel for downloading USB patch
1036 */
1037 if (data->setup_on_usb) {
1038 err = data->setup_on_usb(hdev);
eb50042f 1039 if (err < 0)
ace31982
KBYT		 1040 return err;
1041 }
1042
7bee549e
ON		 1043 err = usb_autopm_get_interface(data->intf);
1044 if (err < 0)
1045 return err;
1046
1047 data->intf->needs_remote_wakeup = 1;
1048
5e23b923 1049 if (test_and_set_bit(BTUSB_INTR_RUNNING, &data->flags))
7bee549e 1050 goto done;
5e23b923 1051
2eda66f4 1052 err = btusb_submit_intr_urb(hdev, GFP_KERNEL);
43c2e57f
MH		 1053 if (err < 0)
1054 goto failed;
1055
1056 err = btusb_submit_bulk_urb(hdev, GFP_KERNEL);
5e23b923 1057 if (err < 0) {
43c2e57f
MH		 1058 usb_kill_anchored_urbs(&data->intr_anchor);
1059 goto failed;
5e23b923
MH		 1060 }
1061
43c2e57f
MH		 1062 set_bit(BTUSB_BULK_RUNNING, &data->flags);
1063 btusb_submit_bulk_urb(hdev, GFP_KERNEL);
1064
9d08f504
MH		 1065 if (data->diag) {
1066 if (!btusb_submit_diag_urb(hdev, GFP_KERNEL))
1067 set_bit(BTUSB_DIAG_RUNNING, &data->flags);
1068 }
1069
7bee549e
ON		 1070done:
1071 usb_autopm_put_interface(data->intf);
43c2e57f
MH		 1072 return 0;
1073
1074failed:
1075 clear_bit(BTUSB_INTR_RUNNING, &data->flags);
7bee549e 1076 usb_autopm_put_interface(data->intf);
5e23b923
MH		 1077 return err;
1078}
1079
7bee549e
ON		 1080static void btusb_stop_traffic(struct btusb_data *data)
1081{
1082 usb_kill_anchored_urbs(&data->intr_anchor);
1083 usb_kill_anchored_urbs(&data->bulk_anchor);
1084 usb_kill_anchored_urbs(&data->isoc_anchor);
9d08f504 1085 usb_kill_anchored_urbs(&data->diag_anchor);
7bee549e
ON		 1086}
1087
5e23b923
MH		 1088static int btusb_close(struct hci_dev *hdev)
1089{
155961e8 1090 struct btusb_data *data = hci_get_drvdata(hdev);
7bee549e 1091 int err;
5e23b923
MH		 1092
1093 BT_DBG("%s", hdev->name);
1094
e8c3c3d2 1095 cancel_work_sync(&data->work);
404291ac 1096 cancel_work_sync(&data->waker);
e8c3c3d2 1097
9bfa35fe 1098 clear_bit(BTUSB_ISOC_RUNNING, &data->flags);
5e23b923 1099 clear_bit(BTUSB_BULK_RUNNING, &data->flags);
5e23b923 1100 clear_bit(BTUSB_INTR_RUNNING, &data->flags);
9d08f504 1101 clear_bit(BTUSB_DIAG_RUNNING, &data->flags);
7bee549e
ON		 1102
1103 btusb_stop_traffic(data);
803b5836
MH		 1104 btusb_free_frags(data);
1105
7bee549e
ON		 1106 err = usb_autopm_get_interface(data->intf);
1107 if (err < 0)
7b8e2c1d 1108 goto failed;
7bee549e
ON		 1109
1110 data->intf->needs_remote_wakeup = 0;
1111 usb_autopm_put_interface(data->intf);
5e23b923 1112
7b8e2c1d
ON		 1113failed:
1114 usb_scuttle_anchored_urbs(&data->deferred);
5e23b923
MH		 1115 return 0;
1116}
1117
1118static int btusb_flush(struct hci_dev *hdev)
1119{
155961e8 1120 struct btusb_data *data = hci_get_drvdata(hdev);
5e23b923
MH		 1121
1122 BT_DBG("%s", hdev->name);
1123
1124 usb_kill_anchored_urbs(&data->tx_anchor);
803b5836 1125 btusb_free_frags(data);
5e23b923
MH		 1126
1127 return 0;
1128}
1129
047b2ec8 1130static struct urb *alloc_ctrl_urb(struct hci_dev *hdev, struct sk_buff *skb)
5e23b923 1131{
155961e8 1132 struct btusb_data *data = hci_get_drvdata(hdev);
5e23b923
MH		 1133 struct usb_ctrlrequest *dr;
1134 struct urb *urb;
1135 unsigned int pipe;
5e23b923 1136
047b2ec8
MH		 1137 urb = usb_alloc_urb(0, GFP_KERNEL);
1138 if (!urb)
1139 return ERR_PTR(-ENOMEM);
5e23b923 1140
047b2ec8
MH		 1141 dr = kmalloc(sizeof(*dr), GFP_KERNEL);
1142 if (!dr) {
1143 usb_free_urb(urb);
1144 return ERR_PTR(-ENOMEM);
1145 }
5e23b923 1146
047b2ec8 1147 dr->bRequestType = data->cmdreq_type;
893ba544 1148 dr->bRequest = data->cmdreq;
047b2ec8
MH		 1149 dr->wIndex = 0;
1150 dr->wValue = 0;
1151 dr->wLength = __cpu_to_le16(skb->len);
7bd8f09f 1152
047b2ec8 1153 pipe = usb_sndctrlpipe(data->udev, 0x00);
5e23b923 1154
89e7533d 1155 usb_fill_control_urb(urb, data->udev, pipe, (void *)dr,
047b2ec8 1156 skb->data, skb->len, btusb_tx_complete, skb);
5e23b923 1157
89e7533d 1158 skb->dev = (void *)hdev;
5e23b923 1159
047b2ec8
MH		 1160 return urb;
1161}
5e23b923 1162
047b2ec8
MH		 1163static struct urb *alloc_bulk_urb(struct hci_dev *hdev, struct sk_buff *skb)
1164{
1165 struct btusb_data *data = hci_get_drvdata(hdev);
1166 struct urb *urb;
1167 unsigned int pipe;
5e23b923 1168
047b2ec8
MH		 1169 if (!data->bulk_tx_ep)
1170 return ERR_PTR(-ENODEV);
9bfa35fe 1171
047b2ec8
MH		 1172 urb = usb_alloc_urb(0, GFP_KERNEL);
1173 if (!urb)
1174 return ERR_PTR(-ENOMEM);
5e23b923 1175
047b2ec8 1176 pipe = usb_sndbulkpipe(data->udev, data->bulk_tx_ep->bEndpointAddress);
5e23b923 1177
047b2ec8
MH		 1178 usb_fill_bulk_urb(urb, data->udev, pipe,
1179 skb->data, skb->len, btusb_tx_complete, skb);
5e23b923 1180
89e7533d 1181 skb->dev = (void *)hdev;
5e23b923 1182
047b2ec8
MH		 1183 return urb;
1184}
9bfa35fe 1185
047b2ec8
MH		 1186static struct urb *alloc_isoc_urb(struct hci_dev *hdev, struct sk_buff *skb)
1187{
1188 struct btusb_data *data = hci_get_drvdata(hdev);
1189 struct urb *urb;
1190 unsigned int pipe;
9bfa35fe 1191
047b2ec8
MH		 1192 if (!data->isoc_tx_ep)
1193 return ERR_PTR(-ENODEV);
9bfa35fe 1194
047b2ec8
MH		 1195 urb = usb_alloc_urb(BTUSB_MAX_ISOC_FRAMES, GFP_KERNEL);
1196 if (!urb)
1197 return ERR_PTR(-ENOMEM);
9bfa35fe 1198
047b2ec8 1199 pipe = usb_sndisocpipe(data->udev, data->isoc_tx_ep->bEndpointAddress);
9bfa35fe 1200
047b2ec8
MH		 1201 usb_fill_int_urb(urb, data->udev, pipe,
1202 skb->data, skb->len, btusb_isoc_tx_complete,
1203 skb, data->isoc_tx_ep->bInterval);
9bfa35fe 1204
047b2ec8 1205 urb->transfer_flags = URB_ISO_ASAP;
5e23b923 1206
047b2ec8
MH		 1207 __fill_isoc_descriptor(urb, skb->len,
1208 le16_to_cpu(data->isoc_tx_ep->wMaxPacketSize));
5e23b923 1209
89e7533d 1210 skb->dev = (void *)hdev;
047b2ec8
MH		 1211
1212 return urb;
1213}
1214
1215static int submit_tx_urb(struct hci_dev *hdev, struct urb *urb)
1216{
1217 struct btusb_data *data = hci_get_drvdata(hdev);
1218 int err;
7bee549e 1219
5e23b923
MH		 1220 usb_anchor_urb(urb, &data->tx_anchor);
1221
e9753eff 1222 err = usb_submit_urb(urb, GFP_KERNEL);
5e23b923 1223 if (err < 0) {
5a9b80e2
PB		 1224 if (err != -EPERM && err != -ENODEV)
1225 BT_ERR("%s urb %p submission failed (%d)",
89e7533d 1226 hdev->name, urb, -err);
5e23b923
MH		 1227 kfree(urb->setup_packet);
1228 usb_unanchor_urb(urb);
7bee549e
ON		 1229 } else {
1230 usb_mark_last_busy(data->udev);
5e23b923
MH		 1231 }
1232
54a8a79c 1233 usb_free_urb(urb);
5e23b923
MH		 1234 return err;
1235}
1236
047b2ec8
MH		 1237static int submit_or_queue_tx_urb(struct hci_dev *hdev, struct urb *urb)
1238{
1239 struct btusb_data *data = hci_get_drvdata(hdev);
1240 unsigned long flags;
1241 bool suspending;
1242
1243 spin_lock_irqsave(&data->txlock, flags);
1244 suspending = test_bit(BTUSB_SUSPENDING, &data->flags);
1245 if (!suspending)
1246 data->tx_in_flight++;
1247 spin_unlock_irqrestore(&data->txlock, flags);
1248
1249 if (!suspending)
1250 return submit_tx_urb(hdev, urb);
1251
1252 usb_anchor_urb(urb, &data->deferred);
1253 schedule_work(&data->waker);
1254
1255 usb_free_urb(urb);
1256 return 0;
1257}
1258
1259static int btusb_send_frame(struct hci_dev *hdev, struct sk_buff *skb)
1260{
1261 struct urb *urb;
1262
1263 BT_DBG("%s", hdev->name);
1264
618e8bc2 1265 switch (hci_skb_pkt_type(skb)) {
047b2ec8
MH		 1266 case HCI_COMMAND_PKT:
1267 urb = alloc_ctrl_urb(hdev, skb);
1268 if (IS_ERR(urb))
1269 return PTR_ERR(urb);
1270
1271 hdev->stat.cmd_tx++;
1272 return submit_or_queue_tx_urb(hdev, urb);
1273
1274 case HCI_ACLDATA_PKT:
1275 urb = alloc_bulk_urb(hdev, skb);
1276 if (IS_ERR(urb))
1277 return PTR_ERR(urb);
1278
1279 hdev->stat.acl_tx++;
1280 return submit_or_queue_tx_urb(hdev, urb);
1281
1282 case HCI_SCODATA_PKT:
1283 if (hci_conn_num(hdev, SCO_LINK) < 1)
1284 return -ENODEV;
1285
1286 urb = alloc_isoc_urb(hdev, skb);
1287 if (IS_ERR(urb))
1288 return PTR_ERR(urb);
1289
1290 hdev->stat.sco_tx++;
1291 return submit_tx_urb(hdev, urb);
1292 }
1293
1294 return -EILSEQ;
1295}
1296
5e23b923
MH		 1297static void btusb_notify(struct hci_dev *hdev, unsigned int evt)
1298{
155961e8 1299 struct btusb_data *data = hci_get_drvdata(hdev);
5e23b923
MH		 1300
1301 BT_DBG("%s evt %d", hdev->name, evt);
1302
014f7bc7
MH		 1303 if (hci_conn_num(hdev, SCO_LINK) != data->sco_num) {
1304 data->sco_num = hci_conn_num(hdev, SCO_LINK);
43c2e57f 1305 schedule_work(&data->work);
a780efa8 1306 }
5e23b923
MH		 1307}
1308
42b16b3f 1309static inline int __set_isoc_interface(struct hci_dev *hdev, int altsetting)
9bfa35fe 1310{
155961e8 1311 struct btusb_data *data = hci_get_drvdata(hdev);
9bfa35fe
MH		 1312 struct usb_interface *intf = data->isoc;
1313 struct usb_endpoint_descriptor *ep_desc;
1314 int i, err;
1315
1316 if (!data->isoc)
1317 return -ENODEV;
1318
1319 err = usb_set_interface(data->udev, 1, altsetting);
1320 if (err < 0) {
1321 BT_ERR("%s setting interface failed (%d)", hdev->name, -err);
1322 return err;
1323 }
1324
1325 data->isoc_altsetting = altsetting;
1326
1327 data->isoc_tx_ep = NULL;
1328 data->isoc_rx_ep = NULL;
1329
1330 for (i = 0; i < intf->cur_altsetting->desc.bNumEndpoints; i++) {
1331 ep_desc = &intf->cur_altsetting->endpoint[i].desc;
1332
1333 if (!data->isoc_tx_ep && usb_endpoint_is_isoc_out(ep_desc)) {
1334 data->isoc_tx_ep = ep_desc;
1335 continue;
1336 }
1337
1338 if (!data->isoc_rx_ep && usb_endpoint_is_isoc_in(ep_desc)) {
1339 data->isoc_rx_ep = ep_desc;
1340 continue;
1341 }
1342 }
1343
1344 if (!data->isoc_tx_ep || !data->isoc_rx_ep) {
1345 BT_ERR("%s invalid SCO descriptors", hdev->name);
1346 return -ENODEV;
1347 }
1348
1349 return 0;
1350}
1351
5e23b923
MH		 1352static void btusb_work(struct work_struct *work)
1353{
1354 struct btusb_data *data = container_of(work, struct btusb_data, work);
1355 struct hci_dev *hdev = data->hdev;
f4001d28 1356 int new_alts;
7bee549e 1357 int err;
5e23b923 1358
014f7bc7 1359 if (data->sco_num > 0) {
08b8b6c4 1360 if (!test_bit(BTUSB_DID_ISO_RESUME, &data->flags)) {
8efdd0cd 1361 err = usb_autopm_get_interface(data->isoc ? data->isoc : data->intf);
7bee549e
ON		 1362 if (err < 0) {
1363 clear_bit(BTUSB_ISOC_RUNNING, &data->flags);
1364 usb_kill_anchored_urbs(&data->isoc_anchor);
1365 return;
1366 }
1367
08b8b6c4 1368 set_bit(BTUSB_DID_ISO_RESUME, &data->flags);
7bee549e 1369 }
f4001d28
MA		 1370
1371 if (hdev->voice_setting & 0x0020) {
1372 static const int alts[3] = { 2, 4, 5 };
89e7533d 1373
014f7bc7 1374 new_alts = alts[data->sco_num - 1];
f4001d28 1375 } else {
014f7bc7 1376 new_alts = data->sco_num;
f4001d28
MA		 1377 }
1378
1379 if (data->isoc_altsetting != new_alts) {
f6fc86f2
KP		 1380 unsigned long flags;
1381
9bfa35fe
MH		 1382 clear_bit(BTUSB_ISOC_RUNNING, &data->flags);
1383 usb_kill_anchored_urbs(&data->isoc_anchor);
1384
8f9d02f4
KP		 1385 /* When isochronous alternate setting needs to be
1386 * changed, because SCO connection has been added
1387 * or removed, a packet fragment may be left in the
1388 * reassembling state. This could lead to wrongly
1389 * assembled fragments.
1390 *
1391 * Clear outstanding fragment when selecting a new
1392 * alternate setting.
1393 */
f6fc86f2 1394 spin_lock_irqsave(&data->rxlock, flags);
8f9d02f4
KP		 1395 kfree_skb(data->sco_skb);
1396 data->sco_skb = NULL;
f6fc86f2 1397 spin_unlock_irqrestore(&data->rxlock, flags);
8f9d02f4 1398
f4001d28 1399 if (__set_isoc_interface(hdev, new_alts) < 0)
9bfa35fe
MH		 1400 return;
1401 }
1402
1403 if (!test_and_set_bit(BTUSB_ISOC_RUNNING, &data->flags)) {
2eda66f4 1404 if (btusb_submit_isoc_urb(hdev, GFP_KERNEL) < 0)
9bfa35fe
MH		 1405 clear_bit(BTUSB_ISOC_RUNNING, &data->flags);
1406 else
2eda66f4 1407 btusb_submit_isoc_urb(hdev, GFP_KERNEL);
9bfa35fe
MH		 1408 }
1409 } else {
1410 clear_bit(BTUSB_ISOC_RUNNING, &data->flags);
1411 usb_kill_anchored_urbs(&data->isoc_anchor);
1412
1413 __set_isoc_interface(hdev, 0);
08b8b6c4 1414 if (test_and_clear_bit(BTUSB_DID_ISO_RESUME, &data->flags))
8efdd0cd 1415 usb_autopm_put_interface(data->isoc ? data->isoc : data->intf);
5e23b923
MH		 1416 }
1417}
1418
7bee549e
ON		 1419static void btusb_waker(struct work_struct *work)
1420{
1421 struct btusb_data *data = container_of(work, struct btusb_data, waker);
1422 int err;
1423
1424 err = usb_autopm_get_interface(data->intf);
1425 if (err < 0)
1426 return;
1427
1428 usb_autopm_put_interface(data->intf);
1429}
1430
9f8f962c
MH		 1431static int btusb_setup_bcm92035(struct hci_dev *hdev)
1432{
1433 struct sk_buff *skb;
1434 u8 val = 0x00;
1435
1436 BT_DBG("%s", hdev->name);
1437
1438 skb = __hci_cmd_sync(hdev, 0xfc3b, 1, &val, HCI_INIT_TIMEOUT);
1439 if (IS_ERR(skb))
1440 BT_ERR("BCM92035 command failed (%ld)", -PTR_ERR(skb));
1441 else
1442 kfree_skb(skb);
1443
1444 return 0;
1445}
1446
81cac64b
MH		 1447static int btusb_setup_csr(struct hci_dev *hdev)
1448{
1449 struct hci_rp_read_local_version *rp;
1450 struct sk_buff *skb;
81cac64b
MH		 1451
1452 BT_DBG("%s", hdev->name);
1453
7cd84d72
MH		 1454 skb = __hci_cmd_sync(hdev, HCI_OP_READ_LOCAL_VERSION, 0, NULL,
1455 HCI_INIT_TIMEOUT);
1456 if (IS_ERR(skb)) {
1457 int err = PTR_ERR(skb);
1458 BT_ERR("%s: CSR: Local version failed (%d)", hdev->name, err);
1459 return err;
1460 }
1461
1462 if (skb->len != sizeof(struct hci_rp_read_local_version)) {
1463 BT_ERR("%s: CSR: Local version length mismatch", hdev->name);
1464 kfree_skb(skb);
1465 return -EIO;
1466 }
81cac64b 1467
89e7533d 1468 rp = (struct hci_rp_read_local_version *)skb->data;
81cac64b 1469
6cafcd95
JH		 1470 /* Detect controllers which aren't real CSR ones. */
1471 if (le16_to_cpu(rp->manufacturer) != 10 ||
1472 le16_to_cpu(rp->lmp_subver) == 0x0c5c) {
9641d343
MH		 1473 /* Clear the reset quirk since this is not an actual
1474 * early Bluetooth 1.1 device from CSR.
1475 */
1476 clear_bit(HCI_QUIRK_RESET_ON_CLOSE, &hdev->quirks);
81cac64b 1477
9641d343
MH		 1478 /* These fake CSR controllers have all a broken
1479 * stored link key handling and so just disable it.
1480 */
1481 set_bit(HCI_QUIRK_BROKEN_STORED_LINK_KEY, &hdev->quirks);
1482 }
81cac64b
MH		 1483
1484 kfree_skb(skb);
1485
9641d343 1486 return 0;
81cac64b
MH		 1487}
1488
dffd30ee 1489static const struct firmware *btusb_setup_intel_get_fw(struct hci_dev *hdev,
89e7533d 1490 struct intel_version *ver)
dffd30ee
THJA		 1491{
1492 const struct firmware *fw;
1493 char fwname[64];
1494 int ret;
1495
1496 snprintf(fwname, sizeof(fwname),
1497 "intel/ibt-hw-%x.%x.%x-fw-%x.%x.%x.%x.%x.bseq",
1498 ver->hw_platform, ver->hw_variant, ver->hw_revision,
1499 ver->fw_variant, ver->fw_revision, ver->fw_build_num,
1500 ver->fw_build_ww, ver->fw_build_yy);
1501
1502 ret = request_firmware(&fw, fwname, &hdev->dev);
1503 if (ret < 0) {
1504 if (ret == -EINVAL) {
1505 BT_ERR("%s Intel firmware file request failed (%d)",
1506 hdev->name, ret);
1507 return NULL;
1508 }
1509
1510 BT_ERR("%s failed to open Intel firmware file: %s(%d)",
1511 hdev->name, fwname, ret);
1512
1513 /* If the correct firmware patch file is not found, use the
1514 * default firmware patch file instead
1515 */
1516 snprintf(fwname, sizeof(fwname), "intel/ibt-hw-%x.%x.bseq",
1517 ver->hw_platform, ver->hw_variant);
1518 if (request_firmware(&fw, fwname, &hdev->dev) < 0) {
1519 BT_ERR("%s failed to open default Intel fw file: %s",
1520 hdev->name, fwname);
1521 return NULL;
1522 }
1523 }
1524
1525 BT_INFO("%s: Intel Bluetooth firmware file: %s", hdev->name, fwname);
1526
1527 return fw;
1528}
1529
1530static int btusb_setup_intel_patching(struct hci_dev *hdev,
1531 const struct firmware *fw,
1532 const u8 **fw_ptr, int *disable_patch)
1533{
1534 struct sk_buff *skb;
1535 struct hci_command_hdr *cmd;
1536 const u8 *cmd_param;
1537 struct hci_event_hdr *evt = NULL;
1538 const u8 *evt_param = NULL;
1539 int remain = fw->size - (*fw_ptr - fw->data);
1540
1541 /* The first byte indicates the types of the patch command or event.
1542 * 0x01 means HCI command and 0x02 is HCI event. If the first bytes
1543 * in the current firmware buffer doesn't start with 0x01 or
1544 * the size of remain buffer is smaller than HCI command header,
1545 * the firmware file is corrupted and it should stop the patching
1546 * process.
1547 */
1548 if (remain > HCI_COMMAND_HDR_SIZE && *fw_ptr[0] != 0x01) {
1549 BT_ERR("%s Intel fw corrupted: invalid cmd read", hdev->name);
1550 return -EINVAL;
1551 }
1552 (*fw_ptr)++;
1553 remain--;
1554
1555 cmd = (struct hci_command_hdr *)(*fw_ptr);
1556 *fw_ptr += sizeof(*cmd);
1557 remain -= sizeof(*cmd);
1558
1559 /* Ensure that the remain firmware data is long enough than the length
1560 * of command parameter. If not, the firmware file is corrupted.
1561 */
1562 if (remain < cmd->plen) {
1563 BT_ERR("%s Intel fw corrupted: invalid cmd len", hdev->name);
1564 return -EFAULT;
1565 }
1566
1567 /* If there is a command that loads a patch in the firmware
1568 * file, then enable the patch upon success, otherwise just
1569 * disable the manufacturer mode, for example patch activation
1570 * is not required when the default firmware patch file is used
1571 * because there are no patch data to load.
1572 */
1573 if (*disable_patch && le16_to_cpu(cmd->opcode) == 0xfc8e)
1574 *disable_patch = 0;
1575
1576 cmd_param = *fw_ptr;
1577 *fw_ptr += cmd->plen;
1578 remain -= cmd->plen;
1579
1580 /* This reads the expected events when the above command is sent to the
1581 * device. Some vendor commands expects more than one events, for
1582 * example command status event followed by vendor specific event.
1583 * For this case, it only keeps the last expected event. so the command
1584 * can be sent with __hci_cmd_sync_ev() which returns the sk_buff of
1585 * last expected event.
1586 */
1587 while (remain > HCI_EVENT_HDR_SIZE && *fw_ptr[0] == 0x02) {
1588 (*fw_ptr)++;
1589 remain--;
1590
1591 evt = (struct hci_event_hdr *)(*fw_ptr);
1592 *fw_ptr += sizeof(*evt);
1593 remain -= sizeof(*evt);
1594
1595 if (remain < evt->plen) {
1596 BT_ERR("%s Intel fw corrupted: invalid evt len",
1597 hdev->name);
1598 return -EFAULT;
1599 }
1600
1601 evt_param = *fw_ptr;
1602 *fw_ptr += evt->plen;
1603 remain -= evt->plen;
1604 }
1605
1606 /* Every HCI commands in the firmware file has its correspond event.
1607 * If event is not found or remain is smaller than zero, the firmware
1608 * file is corrupted.
1609 */
1610 if (!evt || !evt_param || remain < 0) {
1611 BT_ERR("%s Intel fw corrupted: invalid evt read", hdev->name);
1612 return -EFAULT;
1613 }
1614
1615 skb = __hci_cmd_sync_ev(hdev, le16_to_cpu(cmd->opcode), cmd->plen,
1616 cmd_param, evt->evt, HCI_INIT_TIMEOUT);
1617 if (IS_ERR(skb)) {
1618 BT_ERR("%s sending Intel patch command (0x%4.4x) failed (%ld)",
1619 hdev->name, cmd->opcode, PTR_ERR(skb));
d9c78e97 1620 return PTR_ERR(skb);
dffd30ee
THJA		 1621 }
1622
1623 /* It ensures that the returned event matches the event data read from
1624 * the firmware file. At fist, it checks the length and then
1625 * the contents of the event.
1626 */
1627 if (skb->len != evt->plen) {
1628 BT_ERR("%s mismatch event length (opcode 0x%4.4x)", hdev->name,
1629 le16_to_cpu(cmd->opcode));
1630 kfree_skb(skb);
1631 return -EFAULT;
1632 }
1633
1634 if (memcmp(skb->data, evt_param, evt->plen)) {
1635 BT_ERR("%s mismatch event parameter (opcode 0x%4.4x)",
1636 hdev->name, le16_to_cpu(cmd->opcode));
1637 kfree_skb(skb);
1638 return -EFAULT;
1639 }
1640 kfree_skb(skb);
1641
1642 return 0;
1643}
1644
1645static int btusb_setup_intel(struct hci_dev *hdev)
1646{
1647 struct sk_buff *skb;
1648 const struct firmware *fw;
1649 const u8 *fw_ptr;
28dc4b92 1650 int disable_patch, err;
6c483de1 1651 struct intel_version ver;
dffd30ee 1652
dffd30ee
THJA		 1653 BT_DBG("%s", hdev->name);
1654
1655 /* The controller has a bug with the first HCI command sent to it
1656 * returning number of completed commands as zero. This would stall the
1657 * command processing in the Bluetooth core.
1658 *
1659 * As a workaround, send HCI Reset command first which will reset the
1660 * number of completed commands and allow normal command processing
1661 * from now on.
1662 */
1663 skb = __hci_cmd_sync(hdev, HCI_OP_RESET, 0, NULL, HCI_INIT_TIMEOUT);
1664 if (IS_ERR(skb)) {
1665 BT_ERR("%s sending initial HCI reset command failed (%ld)",
1666 hdev->name, PTR_ERR(skb));
d9c78e97 1667 return PTR_ERR(skb);
dffd30ee
THJA		 1668 }
1669 kfree_skb(skb);
1670
1671 /* Read Intel specific controller version first to allow selection of
1672 * which firmware file to load.
1673 *
1674 * The returned information are hardware variant and revision plus
1675 * firmware variant, revision and build number.
1676 */
6c483de1
LP		 1677 err = btintel_read_version(hdev, &ver);
1678 if (err)
1679 return err;
dffd30ee
THJA		 1680
1681 BT_INFO("%s: read Intel version: %02x%02x%02x%02x%02x%02x%02x%02x%02x",
6c483de1
LP		 1682 hdev->name, ver.hw_platform, ver.hw_variant, ver.hw_revision,
1683 ver.fw_variant, ver.fw_revision, ver.fw_build_num,
1684 ver.fw_build_ww, ver.fw_build_yy, ver.fw_patch_num);
dffd30ee
THJA		 1685
1686 /* fw_patch_num indicates the version of patch the device currently
1687 * have. If there is no patch data in the device, it is always 0x00.
5075edae 1688 * So, if it is other than 0x00, no need to patch the device again.
dffd30ee 1689 */
6c483de1 1690 if (ver.fw_patch_num) {
dffd30ee 1691 BT_INFO("%s: Intel device is already patched. patch num: %02x",
6c483de1 1692 hdev->name, ver.fw_patch_num);
213445b2 1693 goto complete;
dffd30ee
THJA		 1694 }
1695
1696 /* Opens the firmware patch file based on the firmware version read
1697 * from the controller. If it fails to open the matching firmware
1698 * patch file, it tries to open the default firmware patch file.
1699 * If no patch file is found, allow the device to operate without
1700 * a patch.
1701 */
6c483de1
LP		 1702 fw = btusb_setup_intel_get_fw(hdev, &ver);
1703 if (!fw)
213445b2 1704 goto complete;
dffd30ee
THJA		 1705 fw_ptr = fw->data;
1706
28dc4b92 1707 /* Enable the manufacturer mode of the controller.
dffd30ee
THJA		 1708 * Only while this mode is enabled, the driver can download the
1709 * firmware patch data and configuration parameters.
1710 */
28dc4b92
LP		 1711 err = btintel_enter_mfg(hdev);
1712 if (err) {
dffd30ee 1713 release_firmware(fw);
28dc4b92 1714 return err;
dffd30ee
THJA		 1715 }
1716
dffd30ee
THJA		 1717 disable_patch = 1;
1718
1719 /* The firmware data file consists of list of Intel specific HCI
1720 * commands and its expected events. The first byte indicates the
1721 * type of the message, either HCI command or HCI event.
1722 *
1723 * It reads the command and its expected event from the firmware file,
1724 * and send to the controller. Once __hci_cmd_sync_ev() returns,
1725 * the returned event is compared with the event read from the firmware
1726 * file and it will continue until all the messages are downloaded to
1727 * the controller.
1728 *
1729 * Once the firmware patching is completed successfully,
1730 * the manufacturer mode is disabled with reset and activating the
1731 * downloaded patch.
1732 *
1733 * If the firmware patching fails, the manufacturer mode is
1734 * disabled with reset and deactivating the patch.
1735 *
1736 * If the default patch file is used, no reset is done when disabling
1737 * the manufacturer.
1738 */
1739 while (fw->size > fw_ptr - fw->data) {
1740 int ret;
1741
1742 ret = btusb_setup_intel_patching(hdev, fw, &fw_ptr,
1743 &disable_patch);
1744 if (ret < 0)
1745 goto exit_mfg_deactivate;
1746 }
1747
1748 release_firmware(fw);
1749
1750 if (disable_patch)
1751 goto exit_mfg_disable;
1752
1753 /* Patching completed successfully and disable the manufacturer mode
1754 * with reset and activate the downloaded firmware patches.
1755 */
28dc4b92
LP		 1756 err = btintel_exit_mfg(hdev, true, true);
1757 if (err)
1758 return err;
dffd30ee
THJA		 1759
1760 BT_INFO("%s: Intel Bluetooth firmware patch completed and activated",
1761 hdev->name);
1762
213445b2 1763 goto complete;
dffd30ee
THJA		 1764
1765exit_mfg_disable:
1766 /* Disable the manufacturer mode without reset */
28dc4b92
LP		 1767 err = btintel_exit_mfg(hdev, false, false);
1768 if (err)
1769 return err;
dffd30ee
THJA		 1770
1771 BT_INFO("%s: Intel Bluetooth firmware patch completed", hdev->name);
40cb0984 1772
213445b2 1773 goto complete;
dffd30ee
THJA		 1774
1775exit_mfg_deactivate:
1776 release_firmware(fw);
1777
1778 /* Patching failed. Disable the manufacturer mode with reset and
1779 * deactivate the downloaded firmware patches.
1780 */
28dc4b92
LP		 1781 err = btintel_exit_mfg(hdev, true, false);
1782 if (err)
1783 return err;
dffd30ee
THJA		 1784
1785 BT_INFO("%s: Intel Bluetooth firmware patch completed and deactivated",
1786 hdev->name);
1787
213445b2
MH		 1788complete:
1789 /* Set the event mask for Intel specific vendor events. This enables
1790 * a few extra events that are useful during general operation.
1791 */
1792 btintel_set_event_mask_mfg(hdev, false);
1793
4185a0f5 1794 btintel_check_bdaddr(hdev);
dffd30ee
THJA		 1795 return 0;
1796}
1797
cda0dd78
MH		 1798static int inject_cmd_complete(struct hci_dev *hdev, __u16 opcode)
1799{
1800 struct sk_buff *skb;
1801 struct hci_event_hdr *hdr;
1802 struct hci_ev_cmd_complete *evt;
1803
1804 skb = bt_skb_alloc(sizeof(*hdr) + sizeof(*evt) + 1, GFP_ATOMIC);
1805 if (!skb)
1806 return -ENOMEM;
1807
1808 hdr = (struct hci_event_hdr *)skb_put(skb, sizeof(*hdr));
1809 hdr->evt = HCI_EV_CMD_COMPLETE;
1810 hdr->plen = sizeof(*evt) + 1;
1811
1812 evt = (struct hci_ev_cmd_complete *)skb_put(skb, sizeof(*evt));
1813 evt->ncmd = 0x01;
1814 evt->opcode = cpu_to_le16(opcode);
1815
1816 *skb_put(skb, 1) = 0x00;
1817
618e8bc2 1818 hci_skb_pkt_type(skb) = HCI_EVENT_PKT;
cda0dd78
MH		 1819
1820 return hci_recv_frame(hdev, skb);
1821}
1822
1823static int btusb_recv_bulk_intel(struct btusb_data *data, void *buffer,
1824 int count)
1825{
1826 /* When the device is in bootloader mode, then it can send
1827 * events via the bulk endpoint. These events are treated the
1828 * same way as the ones received from the interrupt endpoint.
1829 */
1830 if (test_bit(BTUSB_BOOTLOADER, &data->flags))
1831 return btusb_recv_intr(data, buffer, count);
1832
1833 return btusb_recv_bulk(data, buffer, count);
1834}
1835
ccd6da2a
MH		 1836static void btusb_intel_bootup(struct btusb_data *data, const void *ptr,
1837 unsigned int len)
1838{
1839 const struct intel_bootup *evt = ptr;
1840
1841 if (len != sizeof(*evt))
1842 return;
1843
1844 if (test_and_clear_bit(BTUSB_BOOTING, &data->flags)) {
1845 smp_mb__after_atomic();
1846 wake_up_bit(&data->flags, BTUSB_BOOTING);
1847 }
1848}
1849
1850static void btusb_intel_secure_send_result(struct btusb_data *data,
1851 const void *ptr, unsigned int len)
1852{
1853 const struct intel_secure_send_result *evt = ptr;
1854
1855 if (len != sizeof(*evt))
1856 return;
1857
1858 if (evt->result)
1859 set_bit(BTUSB_FIRMWARE_FAILED, &data->flags);
1860
1861 if (test_and_clear_bit(BTUSB_DOWNLOADING, &data->flags) &&
1862 test_bit(BTUSB_FIRMWARE_LOADED, &data->flags)) {
1863 smp_mb__after_atomic();
1864 wake_up_bit(&data->flags, BTUSB_DOWNLOADING);
1865 }
1866}
1867
cda0dd78
MH		 1868static int btusb_recv_event_intel(struct hci_dev *hdev, struct sk_buff *skb)
1869{
1870 struct btusb_data *data = hci_get_drvdata(hdev);
1871
1872 if (test_bit(BTUSB_BOOTLOADER, &data->flags)) {
1873 struct hci_event_hdr *hdr = (void *)skb->data;
1874
ccd6da2a
MH		 1875 if (skb->len > HCI_EVENT_HDR_SIZE && hdr->evt == 0xff &&
1876 hdr->plen > 0) {
1877 const void *ptr = skb->data + HCI_EVENT_HDR_SIZE + 1;
1878 unsigned int len = skb->len - HCI_EVENT_HDR_SIZE - 1;
1879
1880 switch (skb->data[2]) {
1881 case 0x02:
1882 /* When switching to the operational firmware
1883 * the device sends a vendor specific event
1884 * indicating that the bootup completed.
1885 */
1886 btusb_intel_bootup(data, ptr, len);
1887 break;
1888 case 0x06:
1889 /* When the firmware loading completes the
1890 * device sends out a vendor specific event
1891 * indicating the result of the firmware
1892 * loading.
1893 */
1894 btusb_intel_secure_send_result(data, ptr, len);
1895 break;
fad70972 1896 }
cda0dd78
MH		 1897 }
1898 }
1899
1900 return hci_recv_frame(hdev, skb);
1901}
1902
1903static int btusb_send_frame_intel(struct hci_dev *hdev, struct sk_buff *skb)
1904{
1905 struct btusb_data *data = hci_get_drvdata(hdev);
1906 struct urb *urb;
1907
1908 BT_DBG("%s", hdev->name);
1909
618e8bc2 1910 switch (hci_skb_pkt_type(skb)) {
cda0dd78
MH		 1911 case HCI_COMMAND_PKT:
1912 if (test_bit(BTUSB_BOOTLOADER, &data->flags)) {
1913 struct hci_command_hdr *cmd = (void *)skb->data;
1914 __u16 opcode = le16_to_cpu(cmd->opcode);
1915
1916 /* When in bootloader mode and the command 0xfc09
1917 * is received, it needs to be send down the
1918 * bulk endpoint. So allocate a bulk URB instead.
1919 */
1920 if (opcode == 0xfc09)
1921 urb = alloc_bulk_urb(hdev, skb);
1922 else
1923 urb = alloc_ctrl_urb(hdev, skb);
1924
1925 /* When the 0xfc01 command is issued to boot into
1926 * the operational firmware, it will actually not
1927 * send a command complete event. To keep the flow
1928 * control working inject that event here.
1929 */
1930 if (opcode == 0xfc01)
1931 inject_cmd_complete(hdev, opcode);
1932 } else {
1933 urb = alloc_ctrl_urb(hdev, skb);
1934 }
1935 if (IS_ERR(urb))
1936 return PTR_ERR(urb);
1937
1938 hdev->stat.cmd_tx++;
1939 return submit_or_queue_tx_urb(hdev, urb);
1940
1941 case HCI_ACLDATA_PKT:
1942 urb = alloc_bulk_urb(hdev, skb);
1943 if (IS_ERR(urb))
1944 return PTR_ERR(urb);
1945
1946 hdev->stat.acl_tx++;
1947 return submit_or_queue_tx_urb(hdev, urb);
1948
1949 case HCI_SCODATA_PKT:
1950 if (hci_conn_num(hdev, SCO_LINK) < 1)
1951 return -ENODEV;
1952
1953 urb = alloc_isoc_urb(hdev, skb);
1954 if (IS_ERR(urb))
1955 return PTR_ERR(urb);
1956
1957 hdev->stat.sco_tx++;
1958 return submit_tx_urb(hdev, urb);
1959 }
1960
1961 return -EILSEQ;
1962}
1963
cda0dd78
MH		 1964static int btusb_setup_intel_new(struct hci_dev *hdev)
1965{
1966 static const u8 reset_param[] = { 0x00, 0x01, 0x00, 0x01,
1967 0x00, 0x08, 0x04, 0x00 };
1968 struct btusb_data *data = hci_get_drvdata(hdev);
1969 struct sk_buff *skb;
6c483de1 1970 struct intel_version ver;
cda0dd78
MH		 1971 struct intel_boot_params *params;
1972 const struct firmware *fw;
1973 const u8 *fw_ptr;
e66890a9 1974 u32 frag_len;
cda0dd78
MH		 1975 char fwname[64];
1976 ktime_t calltime, delta, rettime;
1977 unsigned long long duration;
1978 int err;
1979
1980 BT_DBG("%s", hdev->name);
1981
1982 calltime = ktime_get();
1983
1984 /* Read the Intel version information to determine if the device
1985 * is in bootloader mode or if it already has operational firmware
1986 * loaded.
1987 */
6c483de1
LP		 1988 err = btintel_read_version(hdev, &ver);
1989 if (err)
1990 return err;
cda0dd78
MH		 1991
1992 /* The hardware platform number has a fixed value of 0x37 and
1993 * for now only accept this single value.
1994 */
6c483de1 1995 if (ver.hw_platform != 0x37) {
cda0dd78 1996 BT_ERR("%s: Unsupported Intel hardware platform (%u)",
6c483de1 1997 hdev->name, ver.hw_platform);
cda0dd78
MH		 1998 return -EINVAL;
1999 }
2000
2001 /* At the moment only the hardware variant iBT 3.0 (LnP/SfP) is
2002 * supported by this firmware loading method. This check has been
2003 * put in place to ensure correct forward compatibility options
2004 * when newer hardware variants come along.
2005 */
6c483de1 2006 if (ver.hw_variant != 0x0b) {
cda0dd78 2007 BT_ERR("%s: Unsupported Intel hardware variant (%u)",
6c483de1 2008 hdev->name, ver.hw_variant);
cda0dd78
MH		 2009 return -EINVAL;
2010 }
2011
6c483de1 2012 btintel_version_info(hdev, &ver);
cda0dd78
MH		 2013
2014 /* The firmware variant determines if the device is in bootloader
2015 * mode or is running operational firmware. The value 0x06 identifies
2016 * the bootloader and the value 0x23 identifies the operational
2017 * firmware.
2018 *
2019 * When the operational firmware is already present, then only
2020 * the check for valid Bluetooth device address is needed. This
2021 * determines if the device will be added as configured or
2022 * unconfigured controller.
2023 *
2024 * It is not possible to use the Secure Boot Parameters in this
2025 * case since that command is only available in bootloader mode.
2026 */
6c483de1 2027 if (ver.fw_variant == 0x23) {
cda0dd78 2028 clear_bit(BTUSB_BOOTLOADER, &data->flags);
4185a0f5 2029 btintel_check_bdaddr(hdev);
cda0dd78
MH		 2030 return 0;
2031 }
2032
2033 /* If the device is not in bootloader mode, then the only possible
2034 * choice is to return an error and abort the device initialization.
2035 */
6c483de1 2036 if (ver.fw_variant != 0x06) {
cda0dd78 2037 BT_ERR("%s: Unsupported Intel firmware variant (%u)",
6c483de1 2038 hdev->name, ver.fw_variant);
cda0dd78
MH		 2039 return -ENODEV;
2040 }
2041
cda0dd78
MH		 2042 /* Read the secure boot parameters to identify the operating
2043 * details of the bootloader.
2044 */
2045 skb = __hci_cmd_sync(hdev, 0xfc0d, 0, NULL, HCI_INIT_TIMEOUT);
2046 if (IS_ERR(skb)) {
2047 BT_ERR("%s: Reading Intel boot parameters failed (%ld)",
2048 hdev->name, PTR_ERR(skb));
2049 return PTR_ERR(skb);
2050 }
2051
2052 if (skb->len != sizeof(*params)) {
2053 BT_ERR("%s: Intel boot parameters size mismatch", hdev->name);
2054 kfree_skb(skb);
2055 return -EILSEQ;
2056 }
2057
2058 params = (struct intel_boot_params *)skb->data;
cda0dd78
MH		 2059
2060 BT_INFO("%s: Device revision is %u", hdev->name,
2061 le16_to_cpu(params->dev_revid));
2062
2063 BT_INFO("%s: Secure boot is %s", hdev->name,
2064 params->secure_boot ? "enabled" : "disabled");
2065
2220994e
MH		 2066 BT_INFO("%s: OTP lock is %s", hdev->name,
2067 params->otp_lock ? "enabled" : "disabled");
2068
2069 BT_INFO("%s: API lock is %s", hdev->name,
2070 params->api_lock ? "enabled" : "disabled");
2071
2072 BT_INFO("%s: Debug lock is %s", hdev->name,
2073 params->debug_lock ? "enabled" : "disabled");
2074
cda0dd78
MH		 2075 BT_INFO("%s: Minimum firmware build %u week %u %u", hdev->name,
2076 params->min_fw_build_nn, params->min_fw_build_cw,
2077 2000 + params->min_fw_build_yy);
2078
2079 /* It is required that every single firmware fragment is acknowledged
2080 * with a command complete event. If the boot parameters indicate
2081 * that this bootloader does not send them, then abort the setup.
2082 */
2083 if (params->limited_cce != 0x00) {
2084 BT_ERR("%s: Unsupported Intel firmware loading method (%u)",
2085 hdev->name, params->limited_cce);
2086 kfree_skb(skb);
2087 return -EINVAL;
2088 }
2089
2090 /* If the OTP has no valid Bluetooth device address, then there will
2091 * also be no valid address for the operational firmware.
2092 */
2093 if (!bacmp(&params->otp_bdaddr, BDADDR_ANY)) {
2094 BT_INFO("%s: No device address configured", hdev->name);
2095 set_bit(HCI_QUIRK_INVALID_BDADDR, &hdev->quirks);
2096 }
2097
2098 /* With this Intel bootloader only the hardware variant and device
2099 * revision information are used to select the right firmware.
2100 *
2101 * Currently this bootloader support is limited to hardware variant
2102 * iBT 3.0 (LnP/SfP) which is identified by the value 11 (0x0b).
2103 */
2104 snprintf(fwname, sizeof(fwname), "intel/ibt-11-%u.sfi",
2105 le16_to_cpu(params->dev_revid));
2106
2107 err = request_firmware(&fw, fwname, &hdev->dev);
2108 if (err < 0) {
2109 BT_ERR("%s: Failed to load Intel firmware file (%d)",
2110 hdev->name, err);
2111 kfree_skb(skb);
2112 return err;
2113 }
2114
2115 BT_INFO("%s: Found device firmware: %s", hdev->name, fwname);
2116
52cc9168
THJA		 2117 /* Save the DDC file name for later use to apply once the firmware
2118 * downloading is done.
2119 */
2120 snprintf(fwname, sizeof(fwname), "intel/ibt-11-%u.ddc",
2121 le16_to_cpu(params->dev_revid));
2122
cda0dd78
MH		 2123 kfree_skb(skb);
2124
2125 if (fw->size < 644) {
2126 BT_ERR("%s: Invalid size of firmware file (%zu)",
2127 hdev->name, fw->size);
2128 err = -EBADF;
2129 goto done;
2130 }
2131
2132 set_bit(BTUSB_DOWNLOADING, &data->flags);
2133
2134 /* Start the firmware download transaction with the Init fragment
2135 * represented by the 128 bytes of CSS header.
2136 */
09df123d 2137 err = btintel_secure_send(hdev, 0x00, 128, fw->data);
cda0dd78
MH		 2138 if (err < 0) {
2139 BT_ERR("%s: Failed to send firmware header (%d)",
2140 hdev->name, err);
2141 goto done;
2142 }
2143
2144 /* Send the 256 bytes of public key information from the firmware
2145 * as the PKey fragment.
2146 */
09df123d 2147 err = btintel_secure_send(hdev, 0x03, 256, fw->data + 128);
cda0dd78
MH		 2148 if (err < 0) {
2149 BT_ERR("%s: Failed to send firmware public key (%d)",
2150 hdev->name, err);
2151 goto done;
2152 }
2153
2154 /* Send the 256 bytes of signature information from the firmware
2155 * as the Sign fragment.
2156 */
09df123d 2157 err = btintel_secure_send(hdev, 0x02, 256, fw->data + 388);
cda0dd78
MH		 2158 if (err < 0) {
2159 BT_ERR("%s: Failed to send firmware signature (%d)",
2160 hdev->name, err);
2161 goto done;
2162 }
2163
2164 fw_ptr = fw->data + 644;
e66890a9 2165 frag_len = 0;
cda0dd78
MH		 2166
2167 while (fw_ptr - fw->data < fw->size) {
e66890a9 2168 struct hci_command_hdr *cmd = (void *)(fw_ptr + frag_len);
cda0dd78 2169
e66890a9 2170 frag_len += sizeof(*cmd) + cmd->plen;
cda0dd78 2171
5075edae 2172 /* The parameter length of the secure send command requires
e66890a9
MH		 2173 * a 4 byte alignment. It happens so that the firmware file
2174 * contains proper Intel_NOP commands to align the fragments
2175 * as needed.
2176 *
2177 * Send set of commands with 4 byte alignment from the
2178 * firmware data buffer as a single Data fragement.
cda0dd78 2179 */
e66890a9 2180 if (!(frag_len % 4)) {
09df123d 2181 err = btintel_secure_send(hdev, 0x01, frag_len, fw_ptr);
e66890a9
MH		 2182 if (err < 0) {
2183 BT_ERR("%s: Failed to send firmware data (%d)",
2184 hdev->name, err);
2185 goto done;
2186 }
cda0dd78 2187
e66890a9
MH		 2188 fw_ptr += frag_len;
2189 frag_len = 0;
2190 }
cda0dd78
MH		 2191 }
2192
ce6bb929
MH		 2193 set_bit(BTUSB_FIRMWARE_LOADED, &data->flags);
2194
a087a98e
JH		 2195 BT_INFO("%s: Waiting for firmware download to complete", hdev->name);
2196
cda0dd78
MH		 2197 /* Before switching the device into operational mode and with that
2198 * booting the loaded firmware, wait for the bootloader notification
2199 * that all fragments have been successfully received.
2200 *
a087a98e
JH		 2201 * When the event processing receives the notification, then the
2202 * BTUSB_DOWNLOADING flag will be cleared.
2203 *
2204 * The firmware loading should not take longer than 5 seconds
2205 * and thus just timeout if that happens and fail the setup
2206 * of this device.
cda0dd78 2207 */
129a7693
JH		 2208 err = wait_on_bit_timeout(&data->flags, BTUSB_DOWNLOADING,
2209 TASK_INTERRUPTIBLE,
2210 msecs_to_jiffies(5000));
a087a98e
JH		 2211 if (err == 1) {
2212 BT_ERR("%s: Firmware loading interrupted", hdev->name);
2213 err = -EINTR;
2214 goto done;
2215 }
cda0dd78 2216
a087a98e
JH		 2217 if (err) {
2218 BT_ERR("%s: Firmware loading timeout", hdev->name);
2219 err = -ETIMEDOUT;
2220 goto done;
cda0dd78
MH		 2221 }
2222
2223 if (test_bit(BTUSB_FIRMWARE_FAILED, &data->flags)) {
2224 BT_ERR("%s: Firmware loading failed", hdev->name);
2225 err = -ENOEXEC;
2226 goto done;
2227 }
2228
2229 rettime = ktime_get();
2230 delta = ktime_sub(rettime, calltime);
2231 duration = (unsigned long long) ktime_to_ns(delta) >> 10;
2232
2233 BT_INFO("%s: Firmware loaded in %llu usecs", hdev->name, duration);
2234
2235done:
2236 release_firmware(fw);
2237
2238 if (err < 0)
2239 return err;
2240
2241 calltime = ktime_get();
2242
2243 set_bit(BTUSB_BOOTING, &data->flags);
2244
2245 skb = __hci_cmd_sync(hdev, 0xfc01, sizeof(reset_param), reset_param,
2246 HCI_INIT_TIMEOUT);
2247 if (IS_ERR(skb))
2248 return PTR_ERR(skb);
2249
2250 kfree_skb(skb);
2251
2252 /* The bootloader will not indicate when the device is ready. This
2253 * is done by the operational firmware sending bootup notification.
fad70972
JH		 2254 *
2255 * Booting into operational firmware should not take longer than
2256 * 1 second. However if that happens, then just fail the setup
2257 * since something went wrong.
cda0dd78 2258 */
fad70972 2259 BT_INFO("%s: Waiting for device to boot", hdev->name);
cda0dd78 2260
129a7693
JH		 2261 err = wait_on_bit_timeout(&data->flags, BTUSB_BOOTING,
2262 TASK_INTERRUPTIBLE,
2263 msecs_to_jiffies(1000));
cda0dd78 2264
fad70972
JH		 2265 if (err == 1) {
2266 BT_ERR("%s: Device boot interrupted", hdev->name);
2267 return -EINTR;
2268 }
cda0dd78 2269
fad70972
JH		 2270 if (err) {
2271 BT_ERR("%s: Device boot timeout", hdev->name);
2272 return -ETIMEDOUT;
cda0dd78
MH		 2273 }
2274
2275 rettime = ktime_get();
2276 delta = ktime_sub(rettime, calltime);
2277 duration = (unsigned long long) ktime_to_ns(delta) >> 10;
2278
2279 BT_INFO("%s: Device booted in %llu usecs", hdev->name, duration);
2280
2281 clear_bit(BTUSB_BOOTLOADER, &data->flags);
2282
52cc9168
THJA		 2283 /* Once the device is running in operational mode, it needs to apply
2284 * the device configuration (DDC) parameters.
2285 *
2286 * The device can work without DDC parameters, so even if it fails
2287 * to load the file, no need to fail the setup.
2288 */
e924d3d6 2289 btintel_load_ddc_config(hdev, fwname);
52cc9168 2290
213445b2
MH		 2291 /* Set the event mask for Intel specific vendor events. This enables
2292 * a few extra events that are useful during general operation. It
2293 * does not enable any debugging related events.
2294 *
2295 * The device will function correctly without these events enabled
2296 * and thus no need to fail the setup.
2297 */
2298 btintel_set_event_mask(hdev, false);
2299
cda0dd78
MH		 2300 return 0;
2301}
2302
bfbd45e9
THJA		 2303static int btusb_shutdown_intel(struct hci_dev *hdev)
2304{
2305 struct sk_buff *skb;
2306 long ret;
2307
2308 /* Some platforms have an issue with BT LED when the interface is
2309 * down or BT radio is turned off, which takes 5 seconds to BT LED
2310 * goes off. This command turns off the BT LED immediately.
2311 */
2312 skb = __hci_cmd_sync(hdev, 0xfc3f, 0, NULL, HCI_INIT_TIMEOUT);
2313 if (IS_ERR(skb)) {
2314 ret = PTR_ERR(skb);
2315 BT_ERR("%s: turning off Intel device LED failed (%ld)",
2316 hdev->name, ret);
2317 return ret;
2318 }
2319 kfree_skb(skb);
2320
2321 return 0;
2322}
2323
ae8df494
AK		 2324static int btusb_set_bdaddr_marvell(struct hci_dev *hdev,
2325 const bdaddr_t *bdaddr)
2326{
2327 struct sk_buff *skb;
2328 u8 buf[8];
2329 long ret;
2330
2331 buf[0] = 0xfe;
2332 buf[1] = sizeof(bdaddr_t);
2333 memcpy(buf + 2, bdaddr, sizeof(bdaddr_t));
2334
2335 skb = __hci_cmd_sync(hdev, 0xfc22, sizeof(buf), buf, HCI_INIT_TIMEOUT);
2336 if (IS_ERR(skb)) {
2337 ret = PTR_ERR(skb);
2338 BT_ERR("%s: changing Marvell device address failed (%ld)",
2339 hdev->name, ret);
2340 return ret;
2341 }
2342 kfree_skb(skb);
2343
2344 return 0;
2345}
2346
5859223e
TK		 2347static int btusb_set_bdaddr_ath3012(struct hci_dev *hdev,
2348 const bdaddr_t *bdaddr)
2349{
2350 struct sk_buff *skb;
2351 u8 buf[10];
2352 long ret;
2353
2354 buf[0] = 0x01;
2355 buf[1] = 0x01;
2356 buf[2] = 0x00;
2357 buf[3] = sizeof(bdaddr_t);
2358 memcpy(buf + 4, bdaddr, sizeof(bdaddr_t));
2359
2360 skb = __hci_cmd_sync(hdev, 0xfc0b, sizeof(buf), buf, HCI_INIT_TIMEOUT);
2361 if (IS_ERR(skb)) {
2362 ret = PTR_ERR(skb);
2363 BT_ERR("%s: Change address command failed (%ld)",
2364 hdev->name, ret);
2365 return ret;
2366 }
2367 kfree_skb(skb);
2368
2369 return 0;
2370}
2371
3267c884
KBYT		 2372#define QCA_DFU_PACKET_LEN 4096
2373
2374#define QCA_GET_TARGET_VERSION 0x09
2375#define QCA_CHECK_STATUS 0x05
2376#define QCA_DFU_DOWNLOAD 0x01
2377
2378#define QCA_SYSCFG_UPDATED 0x40
2379#define QCA_PATCH_UPDATED 0x80
2380#define QCA_DFU_TIMEOUT 3000
2381
2382struct qca_version {
2383 __le32 rom_version;
2384 __le32 patch_version;
2385 __le32 ram_version;
2386 __le32 ref_clock;
2387 __u8 reserved[4];
2388} __packed;
2389
2390struct qca_rampatch_version {
2391 __le16 rom_version;
2392 __le16 patch_version;
2393} __packed;
2394
2395struct qca_device_info {
bf906b3d
KBYT		 2396 u32 rom_version;
2397 u8 rampatch_hdr; /* length of header in rampatch */
2398 u8 nvm_hdr; /* length of header in NVM */
2399 u8 ver_offset; /* offset of version structure in rampatch */
3267c884
KBYT		 2400};
2401
2402static const struct qca_device_info qca_devices_table[] = {
2403 { 0x00000100, 20, 4, 10 }, /* Rome 1.0 */
2404 { 0x00000101, 20, 4, 10 }, /* Rome 1.1 */
7f6e6363 2405 { 0x00000200, 28, 4, 18 }, /* Rome 2.0 */
3267c884
KBYT		 2406 { 0x00000201, 28, 4, 18 }, /* Rome 2.1 */
2407 { 0x00000300, 28, 4, 18 }, /* Rome 3.0 */
2408 { 0x00000302, 28, 4, 18 }, /* Rome 3.2 */
2409};
2410
2411static int btusb_qca_send_vendor_req(struct hci_dev *hdev, u8 request,
2412 void *data, u16 size)
2413{
2414 struct btusb_data *btdata = hci_get_drvdata(hdev);
2415 struct usb_device *udev = btdata->udev;
2416 int pipe, err;
2417 u8 *buf;
2418
2419 buf = kmalloc(size, GFP_KERNEL);
2420 if (!buf)
2421 return -ENOMEM;
2422
2423 /* Found some of USB hosts have IOT issues with ours so that we should
2424 * not wait until HCI layer is ready.
2425 */
2426 pipe = usb_rcvctrlpipe(udev, 0);
2427 err = usb_control_msg(udev, pipe, request, USB_TYPE_VENDOR | USB_DIR_IN,
2428 0, 0, buf, size, USB_CTRL_SET_TIMEOUT);
2429 if (err < 0) {
2430 BT_ERR("%s: Failed to access otp area (%d)", hdev->name, err);
2431 goto done;
2432 }
2433
2434 memcpy(data, buf, size);
2435
2436done:
2437 kfree(buf);
2438
2439 return err;
2440}
2441
2442static int btusb_setup_qca_download_fw(struct hci_dev *hdev,
2443 const struct firmware *firmware,
2444 size_t hdr_size)
2445{
2446 struct btusb_data *btdata = hci_get_drvdata(hdev);
2447 struct usb_device *udev = btdata->udev;
2448 size_t count, size, sent = 0;
2449 int pipe, len, err;
2450 u8 *buf;
2451
2452 buf = kmalloc(QCA_DFU_PACKET_LEN, GFP_KERNEL);
2453 if (!buf)
2454 return -ENOMEM;
2455
2456 count = firmware->size;
2457
2458 size = min_t(size_t, count, hdr_size);
2459 memcpy(buf, firmware->data, size);
2460
2461 /* USB patches should go down to controller through USB path
2462 * because binary format fits to go down through USB channel.
2463 * USB control path is for patching headers and USB bulk is for
2464 * patch body.
2465 */
2466 pipe = usb_sndctrlpipe(udev, 0);
2467 err = usb_control_msg(udev, pipe, QCA_DFU_DOWNLOAD, USB_TYPE_VENDOR,
2468 0, 0, buf, size, USB_CTRL_SET_TIMEOUT);
2469 if (err < 0) {
2470 BT_ERR("%s: Failed to send headers (%d)", hdev->name, err);
2471 goto done;
2472 }
2473
2474 sent += size;
2475 count -= size;
2476
2477 while (count) {
2478 size = min_t(size_t, count, QCA_DFU_PACKET_LEN);
2479
2480 memcpy(buf, firmware->data + sent, size);
2481
2482 pipe = usb_sndbulkpipe(udev, 0x02);
2483 err = usb_bulk_msg(udev, pipe, buf, size, &len,
2484 QCA_DFU_TIMEOUT);
2485 if (err < 0) {
2486 BT_ERR("%s: Failed to send body at %zd of %zd (%d)",
2487 hdev->name, sent, firmware->size, err);
2488 break;
2489 }
2490
2491 if (size != len) {
2492 BT_ERR("%s: Failed to get bulk buffer", hdev->name);
2493 err = -EILSEQ;
2494 break;
2495 }
2496
2497 sent += size;
2498 count -= size;
2499 }
2500
2501done:
2502 kfree(buf);
2503 return err;
2504}
2505
2506static int btusb_setup_qca_load_rampatch(struct hci_dev *hdev,
2507 struct qca_version *ver,
2508 const struct qca_device_info *info)
2509{
2510 struct qca_rampatch_version *rver;
2511 const struct firmware *fw;
bf906b3d
KBYT		 2512 u32 ver_rom, ver_patch;
2513 u16 rver_rom, rver_patch;
3267c884
KBYT		 2514 char fwname[64];
2515 int err;
2516
bf906b3d
KBYT		 2517 ver_rom = le32_to_cpu(ver->rom_version);
2518 ver_patch = le32_to_cpu(ver->patch_version);
2519
2520 snprintf(fwname, sizeof(fwname), "qca/rampatch_usb_%08x.bin", ver_rom);
3267c884
KBYT		 2521
2522 err = request_firmware(&fw, fwname, &hdev->dev);
2523 if (err) {
2524 BT_ERR("%s: failed to request rampatch file: %s (%d)",
2525 hdev->name, fwname, err);
2526 return err;
2527 }
2528
2529 BT_INFO("%s: using rampatch file: %s", hdev->name, fwname);
bf906b3d 2530
3267c884 2531 rver = (struct qca_rampatch_version *)(fw->data + info->ver_offset);
bf906b3d
KBYT		 2532 rver_rom = le16_to_cpu(rver->rom_version);
2533 rver_patch = le16_to_cpu(rver->patch_version);
2534
3267c884 2535 BT_INFO("%s: QCA: patch rome 0x%x build 0x%x, firmware rome 0x%x "
bf906b3d
KBYT		 2536 "build 0x%x", hdev->name, rver_rom, rver_patch, ver_rom,
2537 ver_patch);
3267c884 2538
bf906b3d 2539 if (rver_rom != ver_rom || rver_patch <= ver_patch) {
3267c884
KBYT		 2540 BT_ERR("%s: rampatch file version did not match with firmware",
2541 hdev->name);
2542 err = -EINVAL;
2543 goto done;
2544 }
2545
2546 err = btusb_setup_qca_download_fw(hdev, fw, info->rampatch_hdr);
2547
2548done:
2549 release_firmware(fw);
2550
2551 return err;
2552}
2553
2554static int btusb_setup_qca_load_nvm(struct hci_dev *hdev,
2555 struct qca_version *ver,
2556 const struct qca_device_info *info)
2557{
2558 const struct firmware *fw;
2559 char fwname[64];
2560 int err;
2561
2562 snprintf(fwname, sizeof(fwname), "qca/nvm_usb_%08x.bin",
2563 le32_to_cpu(ver->rom_version));
2564
2565 err = request_firmware(&fw, fwname, &hdev->dev);
2566 if (err) {
2567 BT_ERR("%s: failed to request NVM file: %s (%d)",
2568 hdev->name, fwname, err);
2569 return err;
2570 }
2571
2572 BT_INFO("%s: using NVM file: %s", hdev->name, fwname);
2573
2574 err = btusb_setup_qca_download_fw(hdev, fw, info->nvm_hdr);
2575
2576 release_firmware(fw);
2577
2578 return err;
2579}
2580
2581static int btusb_setup_qca(struct hci_dev *hdev)
2582{
2583 const struct qca_device_info *info = NULL;
2584 struct qca_version ver;
bf906b3d 2585 u32 ver_rom;
3267c884
KBYT		 2586 u8 status;
2587 int i, err;
2588
2589 err = btusb_qca_send_vendor_req(hdev, QCA_GET_TARGET_VERSION, &ver,
eb50042f 2590 sizeof(ver));
3267c884
KBYT		 2591 if (err < 0)
2592 return err;
2593
bf906b3d 2594 ver_rom = le32_to_cpu(ver.rom_version);
3267c884 2595 for (i = 0; i < ARRAY_SIZE(qca_devices_table); i++) {
bf906b3d 2596 if (ver_rom == qca_devices_table[i].rom_version)
3267c884
KBYT		 2597 info = &qca_devices_table[i];
2598 }
2599 if (!info) {
2600 BT_ERR("%s: don't support firmware rome 0x%x", hdev->name,
bf906b3d 2601 ver_rom);
3267c884
KBYT		 2602 return -ENODEV;
2603 }
2604
2605 err = btusb_qca_send_vendor_req(hdev, QCA_CHECK_STATUS, &status,
2606 sizeof(status));
2607 if (err < 0)
2608 return err;
2609
2610 if (!(status & QCA_PATCH_UPDATED)) {
2611 err = btusb_setup_qca_load_rampatch(hdev, &ver, info);
2612 if (err < 0)
2613 return err;
2614 }
2615
2616 if (!(status & QCA_SYSCFG_UPDATED)) {
2617 err = btusb_setup_qca_load_nvm(hdev, &ver, info);
2618 if (err < 0)
2619 return err;
2620 }
2621
2622 return 0;
2623}
2624
9d08f504
MH		 2625#ifdef CONFIG_BT_HCIBTUSB_BCM
2626static inline int __set_diag_interface(struct hci_dev *hdev)
2627{
2628 struct btusb_data *data = hci_get_drvdata(hdev);
2629 struct usb_interface *intf = data->diag;
2630 int i;
2631
2632 if (!data->diag)
2633 return -ENODEV;
2634
2635 data->diag_tx_ep = NULL;
2636 data->diag_rx_ep = NULL;
2637
2638 for (i = 0; i < intf->cur_altsetting->desc.bNumEndpoints; i++) {
2639 struct usb_endpoint_descriptor *ep_desc;
2640
2641 ep_desc = &intf->cur_altsetting->endpoint[i].desc;
2642
2643 if (!data->diag_tx_ep && usb_endpoint_is_bulk_out(ep_desc)) {
2644 data->diag_tx_ep = ep_desc;
2645 continue;
2646 }
2647
2648 if (!data->diag_rx_ep && usb_endpoint_is_bulk_in(ep_desc)) {
2649 data->diag_rx_ep = ep_desc;
2650 continue;
2651 }
2652 }
2653
2654 if (!data->diag_tx_ep || !data->diag_rx_ep) {
2655 BT_ERR("%s invalid diagnostic descriptors", hdev->name);
2656 return -ENODEV;
2657 }
2658
2659 return 0;
2660}
2661
2662static struct urb *alloc_diag_urb(struct hci_dev *hdev, bool enable)
2663{
2664 struct btusb_data *data = hci_get_drvdata(hdev);
2665 struct sk_buff *skb;
2666 struct urb *urb;
2667 unsigned int pipe;
2668
2669 if (!data->diag_tx_ep)
2670 return ERR_PTR(-ENODEV);
2671
2672 urb = usb_alloc_urb(0, GFP_KERNEL);
2673 if (!urb)
2674 return ERR_PTR(-ENOMEM);
2675
2676 skb = bt_skb_alloc(2, GFP_KERNEL);
2677 if (!skb) {
2678 usb_free_urb(urb);
2679 return ERR_PTR(-ENOMEM);
2680 }
2681
2682 *skb_put(skb, 1) = 0xf0;
2683 *skb_put(skb, 1) = enable;
2684
2685 pipe = usb_sndbulkpipe(data->udev, data->diag_tx_ep->bEndpointAddress);
2686
2687 usb_fill_bulk_urb(urb, data->udev, pipe,
2688 skb->data, skb->len, btusb_tx_complete, skb);
2689
2690 skb->dev = (void *)hdev;
2691
2692 return urb;
2693}
2694
2695static int btusb_bcm_set_diag(struct hci_dev *hdev, bool enable)
2696{
2697 struct btusb_data *data = hci_get_drvdata(hdev);
2698 struct urb *urb;
2699
2700 if (!data->diag)
2701 return -ENODEV;
2702
2703 if (!test_bit(HCI_RUNNING, &hdev->flags))
2704 return -ENETDOWN;
2705
2706 urb = alloc_diag_urb(hdev, enable);
2707 if (IS_ERR(urb))
2708 return PTR_ERR(urb);
2709
2710 return submit_or_queue_tx_urb(hdev, urb);
2711}
2712#endif
2713
5e23b923 2714static int btusb_probe(struct usb_interface *intf,
89e7533d 2715 const struct usb_device_id *id)
5e23b923
MH		 2716{
2717 struct usb_endpoint_descriptor *ep_desc;
2718 struct btusb_data *data;
2719 struct hci_dev *hdev;
22f8e9db 2720 unsigned ifnum_base;
5e23b923
MH		 2721 int i, err;
2722
2723 BT_DBG("intf %p id %p", intf, id);
2724
cfeb4145 2725 /* interface numbers are hardcoded in the spec */
22f8e9db
MH		 2726 if (intf->cur_altsetting->desc.bInterfaceNumber != 0) {
2727 if (!(id->driver_info & BTUSB_IFNUM_2))
2728 return -ENODEV;
2729 if (intf->cur_altsetting->desc.bInterfaceNumber != 2)
2730 return -ENODEV;
2731 }
2732
2733 ifnum_base = intf->cur_altsetting->desc.bInterfaceNumber;
5e23b923
MH		 2734
2735 if (!id->driver_info) {
2736 const struct usb_device_id *match;
89e7533d 2737
5e23b923
MH		 2738 match = usb_match_id(intf, blacklist_table);
2739 if (match)
2740 id = match;
2741 }
2742
cfeb4145
MH		 2743 if (id->driver_info == BTUSB_IGNORE)
2744 return -ENODEV;
2745
2d25f8b4
SL		 2746 if (id->driver_info & BTUSB_ATH3012) {
2747 struct usb_device *udev = interface_to_usbdev(intf);
2748
2749 /* Old firmware would otherwise let ath3k driver load
2750 * patch and sysconfig files */
2751 if (le16_to_cpu(udev->descriptor.bcdDevice) <= 0x0001)
2752 return -ENODEV;
2753 }
2754
98921dbd 2755 data = devm_kzalloc(&intf->dev, sizeof(*data), GFP_KERNEL);
5e23b923
MH		 2756 if (!data)
2757 return -ENOMEM;
2758
2759 for (i = 0; i < intf->cur_altsetting->desc.bNumEndpoints; i++) {
2760 ep_desc = &intf->cur_altsetting->endpoint[i].desc;
2761
2762 if (!data->intr_ep && usb_endpoint_is_int_in(ep_desc)) {
2763 data->intr_ep = ep_desc;
2764 continue;
2765 }
2766
2767 if (!data->bulk_tx_ep && usb_endpoint_is_bulk_out(ep_desc)) {
2768 data->bulk_tx_ep = ep_desc;
2769 continue;
2770 }
2771
2772 if (!data->bulk_rx_ep && usb_endpoint_is_bulk_in(ep_desc)) {
2773 data->bulk_rx_ep = ep_desc;
2774 continue;
2775 }
2776 }
2777
98921dbd 2778 if (!data->intr_ep || !data->bulk_tx_ep || !data->bulk_rx_ep)
5e23b923 2779 return -ENODEV;
5e23b923 2780
893ba544
MH		 2781 if (id->driver_info & BTUSB_AMP) {
2782 data->cmdreq_type = USB_TYPE_CLASS | 0x01;
2783 data->cmdreq = 0x2b;
2784 } else {
2785 data->cmdreq_type = USB_TYPE_CLASS;
2786 data->cmdreq = 0x00;
2787 }
7a9d4020 2788
5e23b923 2789 data->udev = interface_to_usbdev(intf);
5fbcd260 2790 data->intf = intf;
5e23b923 2791
5e23b923 2792 INIT_WORK(&data->work, btusb_work);
7bee549e 2793 INIT_WORK(&data->waker, btusb_waker);
803b5836
MH		 2794 init_usb_anchor(&data->deferred);
2795 init_usb_anchor(&data->tx_anchor);
7bee549e 2796 spin_lock_init(&data->txlock);
5e23b923 2797
5e23b923
MH		 2798 init_usb_anchor(&data->intr_anchor);
2799 init_usb_anchor(&data->bulk_anchor);
9bfa35fe 2800 init_usb_anchor(&data->isoc_anchor);
9d08f504 2801 init_usb_anchor(&data->diag_anchor);
803b5836 2802 spin_lock_init(&data->rxlock);
5e23b923 2803
cda0dd78
MH		 2804 if (id->driver_info & BTUSB_INTEL_NEW) {
2805 data->recv_event = btusb_recv_event_intel;
2806 data->recv_bulk = btusb_recv_bulk_intel;
2807 set_bit(BTUSB_BOOTLOADER, &data->flags);
2808 } else {
2809 data->recv_event = hci_recv_frame;
2810 data->recv_bulk = btusb_recv_bulk;
2811 }
2cbd3f5c 2812
5e23b923 2813 hdev = hci_alloc_dev();
98921dbd 2814 if (!hdev)
5e23b923 2815 return -ENOMEM;
5e23b923 2816
c13854ce 2817 hdev->bus = HCI_USB;
155961e8 2818 hci_set_drvdata(hdev, data);
5e23b923 2819
893ba544
MH		 2820 if (id->driver_info & BTUSB_AMP)
2821 hdev->dev_type = HCI_AMP;
2822 else
2823 hdev->dev_type = HCI_BREDR;
2824
5e23b923
MH		 2825 data->hdev = hdev;
2826
2827 SET_HCIDEV_DEV(hdev, &intf->dev);
2828
9f8f962c
MH		 2829 hdev->open = btusb_open;
2830 hdev->close = btusb_close;
2831 hdev->flush = btusb_flush;
2832 hdev->send = btusb_send_frame;
2833 hdev->notify = btusb_notify;
2834
6c9d435d
MH		 2835 if (id->driver_info & BTUSB_BCM2045)
2836 set_bit(HCI_QUIRK_BROKEN_STORED_LINK_KEY, &hdev->quirks);
2837
9f8f962c
MH		 2838 if (id->driver_info & BTUSB_BCM92035)
2839 hdev->setup = btusb_setup_bcm92035;
5e23b923 2840
c2bfb100 2841#ifdef CONFIG_BT_HCIBTUSB_BCM
abbaf50e 2842 if (id->driver_info & BTUSB_BCM_PATCHRAM) {
49a5f782 2843 hdev->manufacturer = 15;
c2bfb100 2844 hdev->setup = btbcm_setup_patchram;
9d08f504 2845 hdev->set_diag = btusb_bcm_set_diag;
1df1f591 2846 hdev->set_bdaddr = btbcm_set_bdaddr;
9d08f504
MH		 2847
2848 /* Broadcom LM_DIAG Interface numbers are hardcoded */
22f8e9db 2849 data->diag = usb_ifnum_to_if(data->udev, ifnum_base + 2);
abbaf50e 2850 }
10d4c673 2851
9d08f504 2852 if (id->driver_info & BTUSB_BCM_APPLE) {
49a5f782 2853 hdev->manufacturer = 15;
c2bfb100 2854 hdev->setup = btbcm_setup_apple;
9d08f504
MH		 2855 hdev->set_diag = btusb_bcm_set_diag;
2856
2857 /* Broadcom LM_DIAG Interface numbers are hardcoded */
22f8e9db 2858 data->diag = usb_ifnum_to_if(data->udev, ifnum_base + 2);
9d08f504 2859 }
c2bfb100 2860#endif
17b2772b 2861
cb8d6597 2862 if (id->driver_info & BTUSB_INTEL) {
49a5f782 2863 hdev->manufacturer = 2;
dffd30ee 2864 hdev->setup = btusb_setup_intel;
bfbd45e9 2865 hdev->shutdown = btusb_shutdown_intel;
3e24767b 2866 hdev->set_diag = btintel_set_diag_mfg;
4185a0f5 2867 hdev->set_bdaddr = btintel_set_bdaddr;
c33fb9b4 2868 set_bit(HCI_QUIRK_STRICT_DUPLICATE_FILTER, &hdev->quirks);
c1154842 2869 set_bit(HCI_QUIRK_SIMULTANEOUS_DISCOVERY, &hdev->quirks);
3e24767b 2870 set_bit(HCI_QUIRK_NON_PERSISTENT_DIAG, &hdev->quirks);
cb8d6597 2871 }
dffd30ee 2872
cda0dd78 2873 if (id->driver_info & BTUSB_INTEL_NEW) {
49a5f782 2874 hdev->manufacturer = 2;
cda0dd78
MH		 2875 hdev->send = btusb_send_frame_intel;
2876 hdev->setup = btusb_setup_intel_new;
eeb6abe9 2877 hdev->hw_error = btintel_hw_error;
6d2e50d2 2878 hdev->set_diag = btintel_set_diag;
4185a0f5 2879 hdev->set_bdaddr = btintel_set_bdaddr;
b970c5ba 2880 set_bit(HCI_QUIRK_STRICT_DUPLICATE_FILTER, &hdev->quirks);
d8270fbb 2881 set_bit(HCI_QUIRK_NON_PERSISTENT_DIAG, &hdev->quirks);
cda0dd78
MH		 2882 }
2883
ae8df494
AK		 2884 if (id->driver_info & BTUSB_MARVELL)
2885 hdev->set_bdaddr = btusb_set_bdaddr_marvell;
2886
661cf88a
MH		 2887 if (id->driver_info & BTUSB_SWAVE) {
2888 set_bit(HCI_QUIRK_FIXUP_INQUIRY_MODE, &hdev->quirks);
d57dbe77 2889 set_bit(HCI_QUIRK_BROKEN_LOCAL_COMMANDS, &hdev->quirks);
661cf88a 2890 }
d57dbe77 2891
e4c534bb
MH		 2892 if (id->driver_info & BTUSB_INTEL_BOOT) {
2893 hdev->manufacturer = 2;
40df783d 2894 set_bit(HCI_QUIRK_RAW_DEVICE, &hdev->quirks);
e4c534bb 2895 }
40df783d 2896
79f0c87d 2897 if (id->driver_info & BTUSB_ATH3012) {
5859223e 2898 hdev->set_bdaddr = btusb_set_bdaddr_ath3012;
3d50d51a 2899 set_bit(HCI_QUIRK_SIMULTANEOUS_DISCOVERY, &hdev->quirks);
79f0c87d
JP		 2900 set_bit(HCI_QUIRK_STRICT_DUPLICATE_FILTER, &hdev->quirks);
2901 }
5859223e 2902
3267c884
KBYT		 2903 if (id->driver_info & BTUSB_QCA_ROME) {
2904 data->setup_on_usb = btusb_setup_qca;
2905 hdev->set_bdaddr = btusb_set_bdaddr_ath3012;
2906 }
2907
db33c77d 2908#ifdef CONFIG_BT_HCIBTUSB_RTL
04b8c814 2909 if (id->driver_info & BTUSB_REALTEK) {
db33c77d 2910 hdev->setup = btrtl_setup_realtek;
04b8c814
DD		 2911
2912 /* Realtek devices lose their updated firmware over suspend,
2913 * but the USB hub doesn't notice any status change.
2914 * Explicitly request a device reset on resume.
2915 */
2916 set_bit(BTUSB_RESET_RESUME, &data->flags);
2917 }
db33c77d 2918#endif
a2698a9b 2919
893ba544
MH		 2920 if (id->driver_info & BTUSB_AMP) {
2921 /* AMP controllers do not support SCO packets */
2922 data->isoc = NULL;
2923 } else {
22f8e9db
MH		 2924 /* Interface orders are hardcoded in the specification */
2925 data->isoc = usb_ifnum_to_if(data->udev, ifnum_base + 1);
893ba544 2926 }
9bfa35fe 2927
7a9d4020 2928 if (!reset)
a6c511c6 2929 set_bit(HCI_QUIRK_RESET_ON_CLOSE, &hdev->quirks);
cfeb4145
MH		 2930
2931 if (force_scofix || id->driver_info & BTUSB_WRONG_SCO_MTU) {
2932 if (!disable_scofix)
2933 set_bit(HCI_QUIRK_FIXUP_BUFFER_SIZE, &hdev->quirks);
2934 }
2935
9bfa35fe
MH		 2936 if (id->driver_info & BTUSB_BROKEN_ISOC)
2937 data->isoc = NULL;
2938
7a9d4020
MH		 2939 if (id->driver_info & BTUSB_DIGIANSWER) {
2940 data->cmdreq_type = USB_TYPE_VENDOR;
a6c511c6 2941 set_bit(HCI_QUIRK_RESET_ON_CLOSE, &hdev->quirks);
7a9d4020
MH		 2942 }
2943
2944 if (id->driver_info & BTUSB_CSR) {
2945 struct usb_device *udev = data->udev;
81cac64b 2946 u16 bcdDevice = le16_to_cpu(udev->descriptor.bcdDevice);
7a9d4020
MH		 2947
2948 /* Old firmware would otherwise execute USB reset */
81cac64b 2949 if (bcdDevice < 0x117)
a6c511c6 2950 set_bit(HCI_QUIRK_RESET_ON_CLOSE, &hdev->quirks);
81cac64b
MH		 2951
2952 /* Fake CSR devices with broken commands */
6cafcd95 2953 if (bcdDevice <= 0x100 || bcdDevice == 0x134)
81cac64b 2954 hdev->setup = btusb_setup_csr;
49c989a0
JP		 2955
2956 set_bit(HCI_QUIRK_SIMULTANEOUS_DISCOVERY, &hdev->quirks);
7a9d4020
MH		 2957 }
2958
cfeb4145 2959 if (id->driver_info & BTUSB_SNIFFER) {
9bfa35fe 2960 struct usb_device *udev = data->udev;
cfeb4145 2961
7a9d4020 2962 /* New sniffer firmware has crippled HCI interface */
cfeb4145
MH		 2963 if (le16_to_cpu(udev->descriptor.bcdDevice) > 0x997)
2964 set_bit(HCI_QUIRK_RAW_DEVICE, &hdev->quirks);
2965 }
2966
3a5ef20c
MH		 2967 if (id->driver_info & BTUSB_INTEL_BOOT) {
2968 /* A bug in the bootloader causes that interrupt interface is
2969 * only enabled after receiving SetInterface(0, AltSetting=0).
2970 */
2971 err = usb_set_interface(data->udev, 0, 0);
2972 if (err < 0) {
2973 BT_ERR("failed to set interface 0, alt 0 %d", err);
2974 hci_free_dev(hdev);
2975 return err;
2976 }
2977 }
2978
9bfa35fe
MH		 2979 if (data->isoc) {
2980 err = usb_driver_claim_interface(&btusb_driver,
89e7533d 2981 data->isoc, data);
9bfa35fe
MH		 2982 if (err < 0) {
2983 hci_free_dev(hdev);
9bfa35fe
MH		 2984 return err;
2985 }
2986 }
2987
9d08f504
MH		 2988#ifdef CONFIG_BT_HCIBTUSB_BCM
2989 if (data->diag) {
2990 if (!usb_driver_claim_interface(&btusb_driver,
2991 data->diag, data))
2992 __set_diag_interface(hdev);
2993 else
2994 data->diag = NULL;
2995 }
2996#endif
2997
5e23b923
MH		 2998 err = hci_register_dev(hdev);
2999 if (err < 0) {
3000 hci_free_dev(hdev);
5e23b923
MH		 3001 return err;
3002 }
3003
3004 usb_set_intfdata(intf, data);
3005
3006 return 0;
3007}
3008
3009static void btusb_disconnect(struct usb_interface *intf)
3010{
3011 struct btusb_data *data = usb_get_intfdata(intf);
3012 struct hci_dev *hdev;
3013
3014 BT_DBG("intf %p", intf);
3015
3016 if (!data)
3017 return;
3018
3019 hdev = data->hdev;
5fbcd260
MH		 3020 usb_set_intfdata(data->intf, NULL);
3021
3022 if (data->isoc)
3023 usb_set_intfdata(data->isoc, NULL);
5e23b923 3024
9d08f504
MH		 3025 if (data->diag)
3026 usb_set_intfdata(data->diag, NULL);
3027
5e23b923
MH		 3028 hci_unregister_dev(hdev);
3029
9d08f504
MH		 3030 if (intf == data->intf) {
3031 if (data->isoc)
3032 usb_driver_release_interface(&btusb_driver, data->isoc);
3033 if (data->diag)
3034 usb_driver_release_interface(&btusb_driver, data->diag);
3035 } else if (intf == data->isoc) {
3036 if (data->diag)
3037 usb_driver_release_interface(&btusb_driver, data->diag);
5fbcd260 3038 usb_driver_release_interface(&btusb_driver, data->intf);
9d08f504
MH		 3039 } else if (intf == data->diag) {
3040 usb_driver_release_interface(&btusb_driver, data->intf);
3041 if (data->isoc)
3042 usb_driver_release_interface(&btusb_driver, data->isoc);
3043 }
5fbcd260 3044
5e23b923
MH		 3045 hci_free_dev(hdev);
3046}
3047
7bee549e 3048#ifdef CONFIG_PM
6a88adf2
MH		 3049static int btusb_suspend(struct usb_interface *intf, pm_message_t message)
3050{
3051 struct btusb_data *data = usb_get_intfdata(intf);
3052
3053 BT_DBG("intf %p", intf);
3054
3055 if (data->suspend_count++)
3056 return 0;
3057
7bee549e 3058 spin_lock_irq(&data->txlock);
5b1b0b81 3059 if (!(PMSG_IS_AUTO(message) && data->tx_in_flight)) {
7bee549e
ON		 3060 set_bit(BTUSB_SUSPENDING, &data->flags);
3061 spin_unlock_irq(&data->txlock);
3062 } else {
3063 spin_unlock_irq(&data->txlock);
3064 data->suspend_count--;
3065 return -EBUSY;
3066 }
3067
6a88adf2
MH		 3068 cancel_work_sync(&data->work);
3069
7bee549e 3070 btusb_stop_traffic(data);
6a88adf2
MH		 3071 usb_kill_anchored_urbs(&data->tx_anchor);
3072
04b8c814
DD		 3073 /* Optionally request a device reset on resume, but only when
3074 * wakeups are disabled. If wakeups are enabled we assume the
3075 * device will stay powered up throughout suspend.
3076 */
3077 if (test_bit(BTUSB_RESET_RESUME, &data->flags) &&
3078 !device_may_wakeup(&data->udev->dev))
3079 data->udev->reset_resume = 1;
3080
6a88adf2
MH		 3081 return 0;
3082}
3083
7bee549e
ON		 3084static void play_deferred(struct btusb_data *data)
3085{
3086 struct urb *urb;
3087 int err;
3088
3089 while ((urb = usb_get_from_anchor(&data->deferred))) {
3090 err = usb_submit_urb(urb, GFP_ATOMIC);
3091 if (err < 0)
3092 break;
3093
3094 data->tx_in_flight++;
3095 }
3096 usb_scuttle_anchored_urbs(&data->deferred);
3097}
3098
6a88adf2
MH		 3099static int btusb_resume(struct usb_interface *intf)
3100{
3101 struct btusb_data *data = usb_get_intfdata(intf);
3102 struct hci_dev *hdev = data->hdev;
7bee549e 3103 int err = 0;
6a88adf2
MH		 3104
3105 BT_DBG("intf %p", intf);
3106
3107 if (--data->suspend_count)
3108 return 0;
3109
3110 if (!test_bit(HCI_RUNNING, &hdev->flags))
7bee549e 3111 goto done;
6a88adf2
MH		 3112
3113 if (test_bit(BTUSB_INTR_RUNNING, &data->flags)) {
3114 err = btusb_submit_intr_urb(hdev, GFP_NOIO);
3115 if (err < 0) {
3116 clear_bit(BTUSB_INTR_RUNNING, &data->flags);
7bee549e 3117 goto failed;
6a88adf2
MH		 3118 }
3119 }
3120
3121 if (test_bit(BTUSB_BULK_RUNNING, &data->flags)) {
43c2e57f
MH		 3122 err = btusb_submit_bulk_urb(hdev, GFP_NOIO);
3123 if (err < 0) {
6a88adf2 3124 clear_bit(BTUSB_BULK_RUNNING, &data->flags);
7bee549e
ON		 3125 goto failed;
3126 }
3127
3128 btusb_submit_bulk_urb(hdev, GFP_NOIO);
6a88adf2
MH		 3129 }
3130
3131 if (test_bit(BTUSB_ISOC_RUNNING, &data->flags)) {
3132 if (btusb_submit_isoc_urb(hdev, GFP_NOIO) < 0)
3133 clear_bit(BTUSB_ISOC_RUNNING, &data->flags);
3134 else
3135 btusb_submit_isoc_urb(hdev, GFP_NOIO);
3136 }
3137
7bee549e
ON		 3138 spin_lock_irq(&data->txlock);
3139 play_deferred(data);
3140 clear_bit(BTUSB_SUSPENDING, &data->flags);
3141 spin_unlock_irq(&data->txlock);
3142 schedule_work(&data->work);
3143
6a88adf2 3144 return 0;
7bee549e
ON		 3145
3146failed:
3147 usb_scuttle_anchored_urbs(&data->deferred);
3148done:
3149 spin_lock_irq(&data->txlock);
3150 clear_bit(BTUSB_SUSPENDING, &data->flags);
3151 spin_unlock_irq(&data->txlock);
3152
3153 return err;
6a88adf2 3154}
7bee549e 3155#endif
6a88adf2 3156
5e23b923
MH		 3157static struct usb_driver btusb_driver = {
3158 .name = "btusb",
3159 .probe = btusb_probe,
3160 .disconnect = btusb_disconnect,
7bee549e 3161#ifdef CONFIG_PM
6a88adf2
MH		 3162 .suspend = btusb_suspend,
3163 .resume = btusb_resume,
7bee549e 3164#endif
5e23b923 3165 .id_table = btusb_table,
7bee549e 3166 .supports_autosuspend = 1,
e1f12eb6 3167 .disable_hub_initiated_lpm = 1,
5e23b923
MH		 3168};
3169
93f1508c 3170module_usb_driver(btusb_driver);
5e23b923 3171
cfeb4145
MH		 3172module_param(disable_scofix, bool, 0644);
3173MODULE_PARM_DESC(disable_scofix, "Disable fixup of wrong SCO buffer size");
3174
3175module_param(force_scofix, bool, 0644);
3176MODULE_PARM_DESC(force_scofix, "Force fixup of wrong SCO buffers size");
3177
3178module_param(reset, bool, 0644);
3179MODULE_PARM_DESC(reset, "Send HCI reset command on initialization");
3180
5e23b923
MH		 3181MODULE_AUTHOR("Marcel Holtmann <marcel@holtmann.org>");
3182MODULE_DESCRIPTION("Generic Bluetooth USB driver ver " VERSION);
3183MODULE_VERSION(VERSION);
3184MODULE_LICENSE("GPL");
ubuntu-bionic-kernel mirror