3 * Generic Bluetooth USB driver
5 * Copyright (C) 2005-2008 Marcel Holtmann <marcel@holtmann.org>
8 * This program is free software; you can redistribute it and/or modify
9 * it under the terms of the GNU General Public License as published by
10 * the Free Software Foundation; either version 2 of the License, or
11 * (at your option) any later version.
13 * This program is distributed in the hope that it will be useful,
14 * but WITHOUT ANY WARRANTY; without even the implied warranty of
15 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
16 * GNU General Public License for more details.
18 * You should have received a copy of the GNU General Public License
19 * along with this program; if not, write to the Free Software
20 * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
24 #include <linux/module.h>
25 #include <linux/usb.h>
26 #include <linux/firmware.h>
28 #include <net/bluetooth/bluetooth.h>
29 #include <net/bluetooth/hci_core.h>
33 static bool ignore_dga
;
34 static bool ignore_csr
;
35 static bool ignore_sniffer
;
36 static bool disable_scofix
;
37 static bool force_scofix
;
39 static bool reset
= 1;
41 static struct usb_driver btusb_driver
;
43 #define BTUSB_IGNORE 0x01
44 #define BTUSB_DIGIANSWER 0x02
45 #define BTUSB_CSR 0x04
46 #define BTUSB_SNIFFER 0x08
47 #define BTUSB_BCM92035 0x10
48 #define BTUSB_BROKEN_ISOC 0x20
49 #define BTUSB_WRONG_SCO_MTU 0x40
50 #define BTUSB_ATH3012 0x80
51 #define BTUSB_INTEL 0x100
52 #define BTUSB_BCM_PATCHRAM 0x200
54 static const struct usb_device_id btusb_table
[] = {
55 /* Generic Bluetooth USB device */
56 { USB_DEVICE_INFO(0xe0, 0x01, 0x01) },
58 /* Apple-specific (Broadcom) devices */
59 { USB_VENDOR_AND_INTERFACE_INFO(0x05ac, 0xff, 0x01, 0x01) },
61 /* MediaTek MT76x0E */
62 { USB_DEVICE(0x0e8d, 0x763f) },
64 /* Broadcom SoftSailing reporting vendor specific */
65 { USB_DEVICE(0x0a5c, 0x21e1) },
67 /* Apple MacBookPro 7,1 */
68 { USB_DEVICE(0x05ac, 0x8213) },
71 { USB_DEVICE(0x05ac, 0x8215) },
73 /* Apple MacBookPro6,2 */
74 { USB_DEVICE(0x05ac, 0x8218) },
76 /* Apple MacBookAir3,1, MacBookAir3,2 */
77 { USB_DEVICE(0x05ac, 0x821b) },
79 /* Apple MacBookAir4,1 */
80 { USB_DEVICE(0x05ac, 0x821f) },
82 /* Apple MacBookPro8,2 */
83 { USB_DEVICE(0x05ac, 0x821a) },
85 /* Apple MacMini5,1 */
86 { USB_DEVICE(0x05ac, 0x8281) },
88 /* AVM BlueFRITZ! USB v2.0 */
89 { USB_DEVICE(0x057c, 0x3800) },
91 /* Bluetooth Ultraport Module from IBM */
92 { USB_DEVICE(0x04bf, 0x030a) },
94 /* ALPS Modules with non-standard id */
95 { USB_DEVICE(0x044e, 0x3001) },
96 { USB_DEVICE(0x044e, 0x3002) },
98 /* Ericsson with non-standard id */
99 { USB_DEVICE(0x0bdb, 0x1002) },
101 /* Canyon CN-BTU1 with HID interfaces */
102 { USB_DEVICE(0x0c10, 0x0000) },
104 /* Broadcom BCM20702A0 */
105 { USB_DEVICE(0x0489, 0xe042) },
106 { USB_DEVICE(0x04ca, 0x2003) },
107 { USB_DEVICE(0x0b05, 0x17b5) },
108 { USB_DEVICE(0x0b05, 0x17cb) },
109 { USB_DEVICE(0x413c, 0x8197) },
111 /* Foxconn - Hon Hai */
112 { USB_VENDOR_AND_INTERFACE_INFO(0x0489, 0xff, 0x01, 0x01) },
114 /* Broadcom devices with vendor specific id */
115 { USB_VENDOR_AND_INTERFACE_INFO(0x0a5c, 0xff, 0x01, 0x01),
116 .driver_info
= BTUSB_BCM_PATCHRAM
},
118 /* Belkin F8065bf - Broadcom based */
119 { USB_VENDOR_AND_INTERFACE_INFO(0x050d, 0xff, 0x01, 0x01) },
121 /* IMC Networks - Broadcom based */
122 { USB_VENDOR_AND_INTERFACE_INFO(0x13d3, 0xff, 0x01, 0x01) },
124 { } /* Terminating entry */
127 MODULE_DEVICE_TABLE(usb
, btusb_table
);
129 static const struct usb_device_id blacklist_table
[] = {
130 /* CSR BlueCore devices */
131 { USB_DEVICE(0x0a12, 0x0001), .driver_info
= BTUSB_CSR
},
133 /* Broadcom BCM2033 without firmware */
134 { USB_DEVICE(0x0a5c, 0x2033), .driver_info
= BTUSB_IGNORE
},
136 /* Atheros 3011 with sflash firmware */
137 { USB_DEVICE(0x0489, 0xe027), .driver_info
= BTUSB_IGNORE
},
138 { USB_DEVICE(0x0489, 0xe03d), .driver_info
= BTUSB_IGNORE
},
139 { USB_DEVICE(0x0930, 0x0215), .driver_info
= BTUSB_IGNORE
},
140 { USB_DEVICE(0x0cf3, 0x3002), .driver_info
= BTUSB_IGNORE
},
141 { USB_DEVICE(0x0cf3, 0xe019), .driver_info
= BTUSB_IGNORE
},
142 { USB_DEVICE(0x13d3, 0x3304), .driver_info
= BTUSB_IGNORE
},
144 /* Atheros AR9285 Malbec with sflash firmware */
145 { USB_DEVICE(0x03f0, 0x311d), .driver_info
= BTUSB_IGNORE
},
147 /* Atheros 3012 with sflash firmware */
148 { USB_DEVICE(0x0489, 0xe04d), .driver_info
= BTUSB_ATH3012
},
149 { USB_DEVICE(0x0489, 0xe04e), .driver_info
= BTUSB_ATH3012
},
150 { USB_DEVICE(0x0489, 0xe056), .driver_info
= BTUSB_ATH3012
},
151 { USB_DEVICE(0x0489, 0xe057), .driver_info
= BTUSB_ATH3012
},
152 { USB_DEVICE(0x0489, 0xe05f), .driver_info
= BTUSB_ATH3012
},
153 { USB_DEVICE(0x04c5, 0x1330), .driver_info
= BTUSB_ATH3012
},
154 { USB_DEVICE(0x04ca, 0x3004), .driver_info
= BTUSB_ATH3012
},
155 { USB_DEVICE(0x04ca, 0x3005), .driver_info
= BTUSB_ATH3012
},
156 { USB_DEVICE(0x04ca, 0x3006), .driver_info
= BTUSB_ATH3012
},
157 { USB_DEVICE(0x04ca, 0x3007), .driver_info
= BTUSB_ATH3012
},
158 { USB_DEVICE(0x04ca, 0x3008), .driver_info
= BTUSB_ATH3012
},
159 { USB_DEVICE(0x04ca, 0x300b), .driver_info
= BTUSB_ATH3012
},
160 { USB_DEVICE(0x0930, 0x0219), .driver_info
= BTUSB_ATH3012
},
161 { USB_DEVICE(0x0930, 0x0220), .driver_info
= BTUSB_ATH3012
},
162 { USB_DEVICE(0x0b05, 0x17d0), .driver_info
= BTUSB_ATH3012
},
163 { USB_DEVICE(0x0cf3, 0x0036), .driver_info
= BTUSB_ATH3012
},
164 { USB_DEVICE(0x0cf3, 0x3004), .driver_info
= BTUSB_ATH3012
},
165 { USB_DEVICE(0x0cf3, 0x3008), .driver_info
= BTUSB_ATH3012
},
166 { USB_DEVICE(0x0cf3, 0x311d), .driver_info
= BTUSB_ATH3012
},
167 { USB_DEVICE(0x0cf3, 0x311e), .driver_info
= BTUSB_ATH3012
},
168 { USB_DEVICE(0x0cf3, 0x311f), .driver_info
= BTUSB_ATH3012
},
169 { USB_DEVICE(0x0cf3, 0x3121), .driver_info
= BTUSB_ATH3012
},
170 { USB_DEVICE(0x0cf3, 0x817a), .driver_info
= BTUSB_ATH3012
},
171 { USB_DEVICE(0x0cf3, 0xe003), .driver_info
= BTUSB_ATH3012
},
172 { USB_DEVICE(0x0cf3, 0xe004), .driver_info
= BTUSB_ATH3012
},
173 { USB_DEVICE(0x0cf3, 0xe005), .driver_info
= BTUSB_ATH3012
},
174 { USB_DEVICE(0x13d3, 0x3362), .driver_info
= BTUSB_ATH3012
},
175 { USB_DEVICE(0x13d3, 0x3375), .driver_info
= BTUSB_ATH3012
},
176 { USB_DEVICE(0x13d3, 0x3393), .driver_info
= BTUSB_ATH3012
},
177 { USB_DEVICE(0x13d3, 0x3402), .driver_info
= BTUSB_ATH3012
},
179 /* Atheros AR5BBU12 with sflash firmware */
180 { USB_DEVICE(0x0489, 0xe02c), .driver_info
= BTUSB_IGNORE
},
182 /* Atheros AR5BBU12 with sflash firmware */
183 { USB_DEVICE(0x0489, 0xe036), .driver_info
= BTUSB_ATH3012
},
184 { USB_DEVICE(0x0489, 0xe03c), .driver_info
= BTUSB_ATH3012
},
186 /* Broadcom BCM2035 */
187 { USB_DEVICE(0x0a5c, 0x2009), .driver_info
= BTUSB_BCM92035
},
188 { USB_DEVICE(0x0a5c, 0x200a), .driver_info
= BTUSB_WRONG_SCO_MTU
},
189 { USB_DEVICE(0x0a5c, 0x2035), .driver_info
= BTUSB_WRONG_SCO_MTU
},
191 /* Broadcom BCM2045 */
192 { USB_DEVICE(0x0a5c, 0x2039), .driver_info
= BTUSB_WRONG_SCO_MTU
},
193 { USB_DEVICE(0x0a5c, 0x2101), .driver_info
= BTUSB_WRONG_SCO_MTU
},
195 /* IBM/Lenovo ThinkPad with Broadcom chip */
196 { USB_DEVICE(0x0a5c, 0x201e), .driver_info
= BTUSB_WRONG_SCO_MTU
},
197 { USB_DEVICE(0x0a5c, 0x2110), .driver_info
= BTUSB_WRONG_SCO_MTU
},
199 /* HP laptop with Broadcom chip */
200 { USB_DEVICE(0x03f0, 0x171d), .driver_info
= BTUSB_WRONG_SCO_MTU
},
202 /* Dell laptop with Broadcom chip */
203 { USB_DEVICE(0x413c, 0x8126), .driver_info
= BTUSB_WRONG_SCO_MTU
},
205 /* Dell Wireless 370 and 410 devices */
206 { USB_DEVICE(0x413c, 0x8152), .driver_info
= BTUSB_WRONG_SCO_MTU
},
207 { USB_DEVICE(0x413c, 0x8156), .driver_info
= BTUSB_WRONG_SCO_MTU
},
209 /* Belkin F8T012 and F8T013 devices */
210 { USB_DEVICE(0x050d, 0x0012), .driver_info
= BTUSB_WRONG_SCO_MTU
},
211 { USB_DEVICE(0x050d, 0x0013), .driver_info
= BTUSB_WRONG_SCO_MTU
},
213 /* Asus WL-BTD202 device */
214 { USB_DEVICE(0x0b05, 0x1715), .driver_info
= BTUSB_WRONG_SCO_MTU
},
216 /* Kensington Bluetooth USB adapter */
217 { USB_DEVICE(0x047d, 0x105e), .driver_info
= BTUSB_WRONG_SCO_MTU
},
219 /* RTX Telecom based adapters with buggy SCO support */
220 { USB_DEVICE(0x0400, 0x0807), .driver_info
= BTUSB_BROKEN_ISOC
},
221 { USB_DEVICE(0x0400, 0x080a), .driver_info
= BTUSB_BROKEN_ISOC
},
223 /* CONWISE Technology based adapters with buggy SCO support */
224 { USB_DEVICE(0x0e5e, 0x6622), .driver_info
= BTUSB_BROKEN_ISOC
},
226 /* Digianswer devices */
227 { USB_DEVICE(0x08fd, 0x0001), .driver_info
= BTUSB_DIGIANSWER
},
228 { USB_DEVICE(0x08fd, 0x0002), .driver_info
= BTUSB_IGNORE
},
230 /* CSR BlueCore Bluetooth Sniffer */
231 { USB_DEVICE(0x0a12, 0x0002), .driver_info
= BTUSB_SNIFFER
},
233 /* Frontline ComProbe Bluetooth Sniffer */
234 { USB_DEVICE(0x16d3, 0x0002), .driver_info
= BTUSB_SNIFFER
},
236 /* Intel Bluetooth device */
237 { USB_DEVICE(0x8087, 0x07dc), .driver_info
= BTUSB_INTEL
},
238 { USB_DEVICE(0x8087, 0x0a2a), .driver_info
= BTUSB_INTEL
},
240 { } /* Terminating entry */
243 #define BTUSB_MAX_ISOC_FRAMES 10
245 #define BTUSB_INTR_RUNNING 0
246 #define BTUSB_BULK_RUNNING 1
247 #define BTUSB_ISOC_RUNNING 2
248 #define BTUSB_SUSPENDING 3
249 #define BTUSB_DID_ISO_RESUME 4
252 struct hci_dev
*hdev
;
253 struct usb_device
*udev
;
254 struct usb_interface
*intf
;
255 struct usb_interface
*isoc
;
261 struct work_struct work
;
262 struct work_struct waker
;
264 struct usb_anchor tx_anchor
;
265 struct usb_anchor intr_anchor
;
266 struct usb_anchor bulk_anchor
;
267 struct usb_anchor isoc_anchor
;
268 struct usb_anchor deferred
;
272 struct usb_endpoint_descriptor
*intr_ep
;
273 struct usb_endpoint_descriptor
*bulk_tx_ep
;
274 struct usb_endpoint_descriptor
*bulk_rx_ep
;
275 struct usb_endpoint_descriptor
*isoc_tx_ep
;
276 struct usb_endpoint_descriptor
*isoc_rx_ep
;
280 unsigned int sco_num
;
285 static int inc_tx(struct btusb_data
*data
)
290 spin_lock_irqsave(&data
->txlock
, flags
);
291 rv
= test_bit(BTUSB_SUSPENDING
, &data
->flags
);
293 data
->tx_in_flight
++;
294 spin_unlock_irqrestore(&data
->txlock
, flags
);
299 static void btusb_intr_complete(struct urb
*urb
)
301 struct hci_dev
*hdev
= urb
->context
;
302 struct btusb_data
*data
= hci_get_drvdata(hdev
);
305 BT_DBG("%s urb %p status %d count %d", hdev
->name
,
306 urb
, urb
->status
, urb
->actual_length
);
308 if (!test_bit(HCI_RUNNING
, &hdev
->flags
))
311 if (urb
->status
== 0) {
312 hdev
->stat
.byte_rx
+= urb
->actual_length
;
314 if (hci_recv_fragment(hdev
, HCI_EVENT_PKT
,
315 urb
->transfer_buffer
,
316 urb
->actual_length
) < 0) {
317 BT_ERR("%s corrupted event packet", hdev
->name
);
322 if (!test_bit(BTUSB_INTR_RUNNING
, &data
->flags
))
325 usb_mark_last_busy(data
->udev
);
326 usb_anchor_urb(urb
, &data
->intr_anchor
);
328 err
= usb_submit_urb(urb
, GFP_ATOMIC
);
330 /* -EPERM: urb is being killed;
331 * -ENODEV: device got disconnected */
332 if (err
!= -EPERM
&& err
!= -ENODEV
)
333 BT_ERR("%s urb %p failed to resubmit (%d)",
334 hdev
->name
, urb
, -err
);
335 usb_unanchor_urb(urb
);
339 static int btusb_submit_intr_urb(struct hci_dev
*hdev
, gfp_t mem_flags
)
341 struct btusb_data
*data
= hci_get_drvdata(hdev
);
347 BT_DBG("%s", hdev
->name
);
352 urb
= usb_alloc_urb(0, mem_flags
);
356 size
= le16_to_cpu(data
->intr_ep
->wMaxPacketSize
);
358 buf
= kmalloc(size
, mem_flags
);
364 pipe
= usb_rcvintpipe(data
->udev
, data
->intr_ep
->bEndpointAddress
);
366 usb_fill_int_urb(urb
, data
->udev
, pipe
, buf
, size
,
367 btusb_intr_complete
, hdev
,
368 data
->intr_ep
->bInterval
);
370 urb
->transfer_flags
|= URB_FREE_BUFFER
;
372 usb_anchor_urb(urb
, &data
->intr_anchor
);
374 err
= usb_submit_urb(urb
, mem_flags
);
376 if (err
!= -EPERM
&& err
!= -ENODEV
)
377 BT_ERR("%s urb %p submission failed (%d)",
378 hdev
->name
, urb
, -err
);
379 usb_unanchor_urb(urb
);
387 static void btusb_bulk_complete(struct urb
*urb
)
389 struct hci_dev
*hdev
= urb
->context
;
390 struct btusb_data
*data
= hci_get_drvdata(hdev
);
393 BT_DBG("%s urb %p status %d count %d", hdev
->name
,
394 urb
, urb
->status
, urb
->actual_length
);
396 if (!test_bit(HCI_RUNNING
, &hdev
->flags
))
399 if (urb
->status
== 0) {
400 hdev
->stat
.byte_rx
+= urb
->actual_length
;
402 if (hci_recv_fragment(hdev
, HCI_ACLDATA_PKT
,
403 urb
->transfer_buffer
,
404 urb
->actual_length
) < 0) {
405 BT_ERR("%s corrupted ACL packet", hdev
->name
);
410 if (!test_bit(BTUSB_BULK_RUNNING
, &data
->flags
))
413 usb_anchor_urb(urb
, &data
->bulk_anchor
);
414 usb_mark_last_busy(data
->udev
);
416 err
= usb_submit_urb(urb
, GFP_ATOMIC
);
418 /* -EPERM: urb is being killed;
419 * -ENODEV: device got disconnected */
420 if (err
!= -EPERM
&& err
!= -ENODEV
)
421 BT_ERR("%s urb %p failed to resubmit (%d)",
422 hdev
->name
, urb
, -err
);
423 usb_unanchor_urb(urb
);
427 static int btusb_submit_bulk_urb(struct hci_dev
*hdev
, gfp_t mem_flags
)
429 struct btusb_data
*data
= hci_get_drvdata(hdev
);
433 int err
, size
= HCI_MAX_FRAME_SIZE
;
435 BT_DBG("%s", hdev
->name
);
437 if (!data
->bulk_rx_ep
)
440 urb
= usb_alloc_urb(0, mem_flags
);
444 buf
= kmalloc(size
, mem_flags
);
450 pipe
= usb_rcvbulkpipe(data
->udev
, data
->bulk_rx_ep
->bEndpointAddress
);
452 usb_fill_bulk_urb(urb
, data
->udev
, pipe
,
453 buf
, size
, btusb_bulk_complete
, hdev
);
455 urb
->transfer_flags
|= URB_FREE_BUFFER
;
457 usb_mark_last_busy(data
->udev
);
458 usb_anchor_urb(urb
, &data
->bulk_anchor
);
460 err
= usb_submit_urb(urb
, mem_flags
);
462 if (err
!= -EPERM
&& err
!= -ENODEV
)
463 BT_ERR("%s urb %p submission failed (%d)",
464 hdev
->name
, urb
, -err
);
465 usb_unanchor_urb(urb
);
473 static void btusb_isoc_complete(struct urb
*urb
)
475 struct hci_dev
*hdev
= urb
->context
;
476 struct btusb_data
*data
= hci_get_drvdata(hdev
);
479 BT_DBG("%s urb %p status %d count %d", hdev
->name
,
480 urb
, urb
->status
, urb
->actual_length
);
482 if (!test_bit(HCI_RUNNING
, &hdev
->flags
))
485 if (urb
->status
== 0) {
486 for (i
= 0; i
< urb
->number_of_packets
; i
++) {
487 unsigned int offset
= urb
->iso_frame_desc
[i
].offset
;
488 unsigned int length
= urb
->iso_frame_desc
[i
].actual_length
;
490 if (urb
->iso_frame_desc
[i
].status
)
493 hdev
->stat
.byte_rx
+= length
;
495 if (hci_recv_fragment(hdev
, HCI_SCODATA_PKT
,
496 urb
->transfer_buffer
+ offset
,
498 BT_ERR("%s corrupted SCO packet", hdev
->name
);
504 if (!test_bit(BTUSB_ISOC_RUNNING
, &data
->flags
))
507 usb_anchor_urb(urb
, &data
->isoc_anchor
);
509 err
= usb_submit_urb(urb
, GFP_ATOMIC
);
511 /* -EPERM: urb is being killed;
512 * -ENODEV: device got disconnected */
513 if (err
!= -EPERM
&& err
!= -ENODEV
)
514 BT_ERR("%s urb %p failed to resubmit (%d)",
515 hdev
->name
, urb
, -err
);
516 usb_unanchor_urb(urb
);
520 static inline void __fill_isoc_descriptor(struct urb
*urb
, int len
, int mtu
)
524 BT_DBG("len %d mtu %d", len
, mtu
);
526 for (i
= 0; i
< BTUSB_MAX_ISOC_FRAMES
&& len
>= mtu
;
527 i
++, offset
+= mtu
, len
-= mtu
) {
528 urb
->iso_frame_desc
[i
].offset
= offset
;
529 urb
->iso_frame_desc
[i
].length
= mtu
;
532 if (len
&& i
< BTUSB_MAX_ISOC_FRAMES
) {
533 urb
->iso_frame_desc
[i
].offset
= offset
;
534 urb
->iso_frame_desc
[i
].length
= len
;
538 urb
->number_of_packets
= i
;
541 static int btusb_submit_isoc_urb(struct hci_dev
*hdev
, gfp_t mem_flags
)
543 struct btusb_data
*data
= hci_get_drvdata(hdev
);
549 BT_DBG("%s", hdev
->name
);
551 if (!data
->isoc_rx_ep
)
554 urb
= usb_alloc_urb(BTUSB_MAX_ISOC_FRAMES
, mem_flags
);
558 size
= le16_to_cpu(data
->isoc_rx_ep
->wMaxPacketSize
) *
559 BTUSB_MAX_ISOC_FRAMES
;
561 buf
= kmalloc(size
, mem_flags
);
567 pipe
= usb_rcvisocpipe(data
->udev
, data
->isoc_rx_ep
->bEndpointAddress
);
569 usb_fill_int_urb(urb
, data
->udev
, pipe
, buf
, size
, btusb_isoc_complete
,
570 hdev
, data
->isoc_rx_ep
->bInterval
);
572 urb
->transfer_flags
= URB_FREE_BUFFER
| URB_ISO_ASAP
;
574 __fill_isoc_descriptor(urb
, size
,
575 le16_to_cpu(data
->isoc_rx_ep
->wMaxPacketSize
));
577 usb_anchor_urb(urb
, &data
->isoc_anchor
);
579 err
= usb_submit_urb(urb
, mem_flags
);
581 if (err
!= -EPERM
&& err
!= -ENODEV
)
582 BT_ERR("%s urb %p submission failed (%d)",
583 hdev
->name
, urb
, -err
);
584 usb_unanchor_urb(urb
);
592 static void btusb_tx_complete(struct urb
*urb
)
594 struct sk_buff
*skb
= urb
->context
;
595 struct hci_dev
*hdev
= (struct hci_dev
*) skb
->dev
;
596 struct btusb_data
*data
= hci_get_drvdata(hdev
);
598 BT_DBG("%s urb %p status %d count %d", hdev
->name
,
599 urb
, urb
->status
, urb
->actual_length
);
601 if (!test_bit(HCI_RUNNING
, &hdev
->flags
))
605 hdev
->stat
.byte_tx
+= urb
->transfer_buffer_length
;
610 spin_lock(&data
->txlock
);
611 data
->tx_in_flight
--;
612 spin_unlock(&data
->txlock
);
614 kfree(urb
->setup_packet
);
619 static void btusb_isoc_tx_complete(struct urb
*urb
)
621 struct sk_buff
*skb
= urb
->context
;
622 struct hci_dev
*hdev
= (struct hci_dev
*) skb
->dev
;
624 BT_DBG("%s urb %p status %d count %d", hdev
->name
,
625 urb
, urb
->status
, urb
->actual_length
);
627 if (!test_bit(HCI_RUNNING
, &hdev
->flags
))
631 hdev
->stat
.byte_tx
+= urb
->transfer_buffer_length
;
636 kfree(urb
->setup_packet
);
641 static int btusb_open(struct hci_dev
*hdev
)
643 struct btusb_data
*data
= hci_get_drvdata(hdev
);
646 BT_DBG("%s", hdev
->name
);
648 err
= usb_autopm_get_interface(data
->intf
);
652 data
->intf
->needs_remote_wakeup
= 1;
654 if (test_and_set_bit(HCI_RUNNING
, &hdev
->flags
))
657 if (test_and_set_bit(BTUSB_INTR_RUNNING
, &data
->flags
))
660 err
= btusb_submit_intr_urb(hdev
, GFP_KERNEL
);
664 err
= btusb_submit_bulk_urb(hdev
, GFP_KERNEL
);
666 usb_kill_anchored_urbs(&data
->intr_anchor
);
670 set_bit(BTUSB_BULK_RUNNING
, &data
->flags
);
671 btusb_submit_bulk_urb(hdev
, GFP_KERNEL
);
674 usb_autopm_put_interface(data
->intf
);
678 clear_bit(BTUSB_INTR_RUNNING
, &data
->flags
);
679 clear_bit(HCI_RUNNING
, &hdev
->flags
);
680 usb_autopm_put_interface(data
->intf
);
684 static void btusb_stop_traffic(struct btusb_data
*data
)
686 usb_kill_anchored_urbs(&data
->intr_anchor
);
687 usb_kill_anchored_urbs(&data
->bulk_anchor
);
688 usb_kill_anchored_urbs(&data
->isoc_anchor
);
691 static int btusb_close(struct hci_dev
*hdev
)
693 struct btusb_data
*data
= hci_get_drvdata(hdev
);
696 BT_DBG("%s", hdev
->name
);
698 if (!test_and_clear_bit(HCI_RUNNING
, &hdev
->flags
))
701 cancel_work_sync(&data
->work
);
702 cancel_work_sync(&data
->waker
);
704 clear_bit(BTUSB_ISOC_RUNNING
, &data
->flags
);
705 clear_bit(BTUSB_BULK_RUNNING
, &data
->flags
);
706 clear_bit(BTUSB_INTR_RUNNING
, &data
->flags
);
708 btusb_stop_traffic(data
);
709 err
= usb_autopm_get_interface(data
->intf
);
713 data
->intf
->needs_remote_wakeup
= 0;
714 usb_autopm_put_interface(data
->intf
);
717 usb_scuttle_anchored_urbs(&data
->deferred
);
721 static int btusb_flush(struct hci_dev
*hdev
)
723 struct btusb_data
*data
= hci_get_drvdata(hdev
);
725 BT_DBG("%s", hdev
->name
);
727 usb_kill_anchored_urbs(&data
->tx_anchor
);
732 static int btusb_send_frame(struct hci_dev
*hdev
, struct sk_buff
*skb
)
734 struct btusb_data
*data
= hci_get_drvdata(hdev
);
735 struct usb_ctrlrequest
*dr
;
740 BT_DBG("%s", hdev
->name
);
742 if (!test_bit(HCI_RUNNING
, &hdev
->flags
))
745 skb
->dev
= (void *) hdev
;
747 switch (bt_cb(skb
)->pkt_type
) {
748 case HCI_COMMAND_PKT
:
749 urb
= usb_alloc_urb(0, GFP_ATOMIC
);
753 dr
= kmalloc(sizeof(*dr
), GFP_ATOMIC
);
759 dr
->bRequestType
= data
->cmdreq_type
;
763 dr
->wLength
= __cpu_to_le16(skb
->len
);
765 pipe
= usb_sndctrlpipe(data
->udev
, 0x00);
767 usb_fill_control_urb(urb
, data
->udev
, pipe
, (void *) dr
,
768 skb
->data
, skb
->len
, btusb_tx_complete
, skb
);
773 case HCI_ACLDATA_PKT
:
774 if (!data
->bulk_tx_ep
)
777 urb
= usb_alloc_urb(0, GFP_ATOMIC
);
781 pipe
= usb_sndbulkpipe(data
->udev
,
782 data
->bulk_tx_ep
->bEndpointAddress
);
784 usb_fill_bulk_urb(urb
, data
->udev
, pipe
,
785 skb
->data
, skb
->len
, btusb_tx_complete
, skb
);
790 case HCI_SCODATA_PKT
:
791 if (!data
->isoc_tx_ep
|| hci_conn_num(hdev
, SCO_LINK
) < 1)
794 urb
= usb_alloc_urb(BTUSB_MAX_ISOC_FRAMES
, GFP_ATOMIC
);
798 pipe
= usb_sndisocpipe(data
->udev
,
799 data
->isoc_tx_ep
->bEndpointAddress
);
801 usb_fill_int_urb(urb
, data
->udev
, pipe
,
802 skb
->data
, skb
->len
, btusb_isoc_tx_complete
,
803 skb
, data
->isoc_tx_ep
->bInterval
);
805 urb
->transfer_flags
= URB_ISO_ASAP
;
807 __fill_isoc_descriptor(urb
, skb
->len
,
808 le16_to_cpu(data
->isoc_tx_ep
->wMaxPacketSize
));
819 usb_anchor_urb(urb
, &data
->deferred
);
820 schedule_work(&data
->waker
);
826 usb_anchor_urb(urb
, &data
->tx_anchor
);
828 err
= usb_submit_urb(urb
, GFP_ATOMIC
);
830 if (err
!= -EPERM
&& err
!= -ENODEV
)
831 BT_ERR("%s urb %p submission failed (%d)",
832 hdev
->name
, urb
, -err
);
833 kfree(urb
->setup_packet
);
834 usb_unanchor_urb(urb
);
836 usb_mark_last_busy(data
->udev
);
844 static void btusb_notify(struct hci_dev
*hdev
, unsigned int evt
)
846 struct btusb_data
*data
= hci_get_drvdata(hdev
);
848 BT_DBG("%s evt %d", hdev
->name
, evt
);
850 if (hci_conn_num(hdev
, SCO_LINK
) != data
->sco_num
) {
851 data
->sco_num
= hci_conn_num(hdev
, SCO_LINK
);
852 schedule_work(&data
->work
);
856 static inline int __set_isoc_interface(struct hci_dev
*hdev
, int altsetting
)
858 struct btusb_data
*data
= hci_get_drvdata(hdev
);
859 struct usb_interface
*intf
= data
->isoc
;
860 struct usb_endpoint_descriptor
*ep_desc
;
866 err
= usb_set_interface(data
->udev
, 1, altsetting
);
868 BT_ERR("%s setting interface failed (%d)", hdev
->name
, -err
);
872 data
->isoc_altsetting
= altsetting
;
874 data
->isoc_tx_ep
= NULL
;
875 data
->isoc_rx_ep
= NULL
;
877 for (i
= 0; i
< intf
->cur_altsetting
->desc
.bNumEndpoints
; i
++) {
878 ep_desc
= &intf
->cur_altsetting
->endpoint
[i
].desc
;
880 if (!data
->isoc_tx_ep
&& usb_endpoint_is_isoc_out(ep_desc
)) {
881 data
->isoc_tx_ep
= ep_desc
;
885 if (!data
->isoc_rx_ep
&& usb_endpoint_is_isoc_in(ep_desc
)) {
886 data
->isoc_rx_ep
= ep_desc
;
891 if (!data
->isoc_tx_ep
|| !data
->isoc_rx_ep
) {
892 BT_ERR("%s invalid SCO descriptors", hdev
->name
);
899 static void btusb_work(struct work_struct
*work
)
901 struct btusb_data
*data
= container_of(work
, struct btusb_data
, work
);
902 struct hci_dev
*hdev
= data
->hdev
;
906 if (data
->sco_num
> 0) {
907 if (!test_bit(BTUSB_DID_ISO_RESUME
, &data
->flags
)) {
908 err
= usb_autopm_get_interface(data
->isoc
? data
->isoc
: data
->intf
);
910 clear_bit(BTUSB_ISOC_RUNNING
, &data
->flags
);
911 usb_kill_anchored_urbs(&data
->isoc_anchor
);
915 set_bit(BTUSB_DID_ISO_RESUME
, &data
->flags
);
918 if (hdev
->voice_setting
& 0x0020) {
919 static const int alts
[3] = { 2, 4, 5 };
920 new_alts
= alts
[data
->sco_num
- 1];
922 new_alts
= data
->sco_num
;
925 if (data
->isoc_altsetting
!= new_alts
) {
926 clear_bit(BTUSB_ISOC_RUNNING
, &data
->flags
);
927 usb_kill_anchored_urbs(&data
->isoc_anchor
);
929 if (__set_isoc_interface(hdev
, new_alts
) < 0)
933 if (!test_and_set_bit(BTUSB_ISOC_RUNNING
, &data
->flags
)) {
934 if (btusb_submit_isoc_urb(hdev
, GFP_KERNEL
) < 0)
935 clear_bit(BTUSB_ISOC_RUNNING
, &data
->flags
);
937 btusb_submit_isoc_urb(hdev
, GFP_KERNEL
);
940 clear_bit(BTUSB_ISOC_RUNNING
, &data
->flags
);
941 usb_kill_anchored_urbs(&data
->isoc_anchor
);
943 __set_isoc_interface(hdev
, 0);
944 if (test_and_clear_bit(BTUSB_DID_ISO_RESUME
, &data
->flags
))
945 usb_autopm_put_interface(data
->isoc
? data
->isoc
: data
->intf
);
949 static void btusb_waker(struct work_struct
*work
)
951 struct btusb_data
*data
= container_of(work
, struct btusb_data
, waker
);
954 err
= usb_autopm_get_interface(data
->intf
);
958 usb_autopm_put_interface(data
->intf
);
961 static int btusb_setup_bcm92035(struct hci_dev
*hdev
)
966 BT_DBG("%s", hdev
->name
);
968 skb
= __hci_cmd_sync(hdev
, 0xfc3b, 1, &val
, HCI_INIT_TIMEOUT
);
970 BT_ERR("BCM92035 command failed (%ld)", -PTR_ERR(skb
));
977 static int btusb_setup_csr(struct hci_dev
*hdev
)
979 struct hci_rp_read_local_version
*rp
;
983 BT_DBG("%s", hdev
->name
);
985 skb
= __hci_cmd_sync(hdev
, HCI_OP_READ_LOCAL_VERSION
, 0, NULL
,
988 BT_ERR("Reading local version failed (%ld)", -PTR_ERR(skb
));
989 return -PTR_ERR(skb
);
992 rp
= (struct hci_rp_read_local_version
*) skb
->data
;
995 if (le16_to_cpu(rp
->manufacturer
) != 10) {
996 /* Clear the reset quirk since this is not an actual
997 * early Bluetooth 1.1 device from CSR.
999 clear_bit(HCI_QUIRK_RESET_ON_CLOSE
, &hdev
->quirks
);
1001 /* These fake CSR controllers have all a broken
1002 * stored link key handling and so just disable it.
1004 set_bit(HCI_QUIRK_BROKEN_STORED_LINK_KEY
,
1009 ret
= -bt_to_errno(rp
->status
);
1016 struct intel_version
{
1029 static const struct firmware
*btusb_setup_intel_get_fw(struct hci_dev
*hdev
,
1030 struct intel_version
*ver
)
1032 const struct firmware
*fw
;
1036 snprintf(fwname
, sizeof(fwname
),
1037 "intel/ibt-hw-%x.%x.%x-fw-%x.%x.%x.%x.%x.bseq",
1038 ver
->hw_platform
, ver
->hw_variant
, ver
->hw_revision
,
1039 ver
->fw_variant
, ver
->fw_revision
, ver
->fw_build_num
,
1040 ver
->fw_build_ww
, ver
->fw_build_yy
);
1042 ret
= request_firmware(&fw
, fwname
, &hdev
->dev
);
1044 if (ret
== -EINVAL
) {
1045 BT_ERR("%s Intel firmware file request failed (%d)",
1050 BT_ERR("%s failed to open Intel firmware file: %s(%d)",
1051 hdev
->name
, fwname
, ret
);
1053 /* If the correct firmware patch file is not found, use the
1054 * default firmware patch file instead
1056 snprintf(fwname
, sizeof(fwname
), "intel/ibt-hw-%x.%x.bseq",
1057 ver
->hw_platform
, ver
->hw_variant
);
1058 if (request_firmware(&fw
, fwname
, &hdev
->dev
) < 0) {
1059 BT_ERR("%s failed to open default Intel fw file: %s",
1060 hdev
->name
, fwname
);
1065 BT_INFO("%s: Intel Bluetooth firmware file: %s", hdev
->name
, fwname
);
1070 static int btusb_setup_intel_patching(struct hci_dev
*hdev
,
1071 const struct firmware
*fw
,
1072 const u8
**fw_ptr
, int *disable_patch
)
1074 struct sk_buff
*skb
;
1075 struct hci_command_hdr
*cmd
;
1076 const u8
*cmd_param
;
1077 struct hci_event_hdr
*evt
= NULL
;
1078 const u8
*evt_param
= NULL
;
1079 int remain
= fw
->size
- (*fw_ptr
- fw
->data
);
1081 /* The first byte indicates the types of the patch command or event.
1082 * 0x01 means HCI command and 0x02 is HCI event. If the first bytes
1083 * in the current firmware buffer doesn't start with 0x01 or
1084 * the size of remain buffer is smaller than HCI command header,
1085 * the firmware file is corrupted and it should stop the patching
1088 if (remain
> HCI_COMMAND_HDR_SIZE
&& *fw_ptr
[0] != 0x01) {
1089 BT_ERR("%s Intel fw corrupted: invalid cmd read", hdev
->name
);
1095 cmd
= (struct hci_command_hdr
*)(*fw_ptr
);
1096 *fw_ptr
+= sizeof(*cmd
);
1097 remain
-= sizeof(*cmd
);
1099 /* Ensure that the remain firmware data is long enough than the length
1100 * of command parameter. If not, the firmware file is corrupted.
1102 if (remain
< cmd
->plen
) {
1103 BT_ERR("%s Intel fw corrupted: invalid cmd len", hdev
->name
);
1107 /* If there is a command that loads a patch in the firmware
1108 * file, then enable the patch upon success, otherwise just
1109 * disable the manufacturer mode, for example patch activation
1110 * is not required when the default firmware patch file is used
1111 * because there are no patch data to load.
1113 if (*disable_patch
&& le16_to_cpu(cmd
->opcode
) == 0xfc8e)
1116 cmd_param
= *fw_ptr
;
1117 *fw_ptr
+= cmd
->plen
;
1118 remain
-= cmd
->plen
;
1120 /* This reads the expected events when the above command is sent to the
1121 * device. Some vendor commands expects more than one events, for
1122 * example command status event followed by vendor specific event.
1123 * For this case, it only keeps the last expected event. so the command
1124 * can be sent with __hci_cmd_sync_ev() which returns the sk_buff of
1125 * last expected event.
1127 while (remain
> HCI_EVENT_HDR_SIZE
&& *fw_ptr
[0] == 0x02) {
1131 evt
= (struct hci_event_hdr
*)(*fw_ptr
);
1132 *fw_ptr
+= sizeof(*evt
);
1133 remain
-= sizeof(*evt
);
1135 if (remain
< evt
->plen
) {
1136 BT_ERR("%s Intel fw corrupted: invalid evt len",
1141 evt_param
= *fw_ptr
;
1142 *fw_ptr
+= evt
->plen
;
1143 remain
-= evt
->plen
;
1146 /* Every HCI commands in the firmware file has its correspond event.
1147 * If event is not found or remain is smaller than zero, the firmware
1148 * file is corrupted.
1150 if (!evt
|| !evt_param
|| remain
< 0) {
1151 BT_ERR("%s Intel fw corrupted: invalid evt read", hdev
->name
);
1155 skb
= __hci_cmd_sync_ev(hdev
, le16_to_cpu(cmd
->opcode
), cmd
->plen
,
1156 cmd_param
, evt
->evt
, HCI_INIT_TIMEOUT
);
1158 BT_ERR("%s sending Intel patch command (0x%4.4x) failed (%ld)",
1159 hdev
->name
, cmd
->opcode
, PTR_ERR(skb
));
1160 return PTR_ERR(skb
);
1163 /* It ensures that the returned event matches the event data read from
1164 * the firmware file. At fist, it checks the length and then
1165 * the contents of the event.
1167 if (skb
->len
!= evt
->plen
) {
1168 BT_ERR("%s mismatch event length (opcode 0x%4.4x)", hdev
->name
,
1169 le16_to_cpu(cmd
->opcode
));
1174 if (memcmp(skb
->data
, evt_param
, evt
->plen
)) {
1175 BT_ERR("%s mismatch event parameter (opcode 0x%4.4x)",
1176 hdev
->name
, le16_to_cpu(cmd
->opcode
));
1185 static int btusb_setup_intel(struct hci_dev
*hdev
)
1187 struct sk_buff
*skb
;
1188 const struct firmware
*fw
;
1191 struct intel_version
*ver
;
1193 const u8 mfg_enable
[] = { 0x01, 0x00 };
1194 const u8 mfg_disable
[] = { 0x00, 0x00 };
1195 const u8 mfg_reset_deactivate
[] = { 0x00, 0x01 };
1196 const u8 mfg_reset_activate
[] = { 0x00, 0x02 };
1198 BT_DBG("%s", hdev
->name
);
1200 /* The controller has a bug with the first HCI command sent to it
1201 * returning number of completed commands as zero. This would stall the
1202 * command processing in the Bluetooth core.
1204 * As a workaround, send HCI Reset command first which will reset the
1205 * number of completed commands and allow normal command processing
1208 skb
= __hci_cmd_sync(hdev
, HCI_OP_RESET
, 0, NULL
, HCI_INIT_TIMEOUT
);
1210 BT_ERR("%s sending initial HCI reset command failed (%ld)",
1211 hdev
->name
, PTR_ERR(skb
));
1212 return PTR_ERR(skb
);
1216 /* Read Intel specific controller version first to allow selection of
1217 * which firmware file to load.
1219 * The returned information are hardware variant and revision plus
1220 * firmware variant, revision and build number.
1222 skb
= __hci_cmd_sync(hdev
, 0xfc05, 0, NULL
, HCI_INIT_TIMEOUT
);
1224 BT_ERR("%s reading Intel fw version command failed (%ld)",
1225 hdev
->name
, PTR_ERR(skb
));
1226 return PTR_ERR(skb
);
1229 if (skb
->len
!= sizeof(*ver
)) {
1230 BT_ERR("%s Intel version event length mismatch", hdev
->name
);
1235 ver
= (struct intel_version
*)skb
->data
;
1237 BT_ERR("%s Intel fw version event failed (%02x)", hdev
->name
,
1240 return -bt_to_errno(ver
->status
);
1243 BT_INFO("%s: read Intel version: %02x%02x%02x%02x%02x%02x%02x%02x%02x",
1244 hdev
->name
, ver
->hw_platform
, ver
->hw_variant
,
1245 ver
->hw_revision
, ver
->fw_variant
, ver
->fw_revision
,
1246 ver
->fw_build_num
, ver
->fw_build_ww
, ver
->fw_build_yy
,
1249 /* fw_patch_num indicates the version of patch the device currently
1250 * have. If there is no patch data in the device, it is always 0x00.
1251 * So, if it is other than 0x00, no need to patch the deivce again.
1253 if (ver
->fw_patch_num
) {
1254 BT_INFO("%s: Intel device is already patched. patch num: %02x",
1255 hdev
->name
, ver
->fw_patch_num
);
1260 /* Opens the firmware patch file based on the firmware version read
1261 * from the controller. If it fails to open the matching firmware
1262 * patch file, it tries to open the default firmware patch file.
1263 * If no patch file is found, allow the device to operate without
1266 fw
= btusb_setup_intel_get_fw(hdev
, ver
);
1273 /* This Intel specific command enables the manufacturer mode of the
1276 * Only while this mode is enabled, the driver can download the
1277 * firmware patch data and configuration parameters.
1279 skb
= __hci_cmd_sync(hdev
, 0xfc11, 2, mfg_enable
, HCI_INIT_TIMEOUT
);
1281 BT_ERR("%s entering Intel manufacturer mode failed (%ld)",
1282 hdev
->name
, PTR_ERR(skb
));
1283 release_firmware(fw
);
1284 return PTR_ERR(skb
);
1288 u8 evt_status
= skb
->data
[0];
1289 BT_ERR("%s enable Intel manufacturer mode event failed (%02x)",
1290 hdev
->name
, evt_status
);
1292 release_firmware(fw
);
1293 return -bt_to_errno(evt_status
);
1299 /* The firmware data file consists of list of Intel specific HCI
1300 * commands and its expected events. The first byte indicates the
1301 * type of the message, either HCI command or HCI event.
1303 * It reads the command and its expected event from the firmware file,
1304 * and send to the controller. Once __hci_cmd_sync_ev() returns,
1305 * the returned event is compared with the event read from the firmware
1306 * file and it will continue until all the messages are downloaded to
1309 * Once the firmware patching is completed successfully,
1310 * the manufacturer mode is disabled with reset and activating the
1313 * If the firmware patching fails, the manufacturer mode is
1314 * disabled with reset and deactivating the patch.
1316 * If the default patch file is used, no reset is done when disabling
1319 while (fw
->size
> fw_ptr
- fw
->data
) {
1322 ret
= btusb_setup_intel_patching(hdev
, fw
, &fw_ptr
,
1325 goto exit_mfg_deactivate
;
1328 release_firmware(fw
);
1331 goto exit_mfg_disable
;
1333 /* Patching completed successfully and disable the manufacturer mode
1334 * with reset and activate the downloaded firmware patches.
1336 skb
= __hci_cmd_sync(hdev
, 0xfc11, sizeof(mfg_reset_activate
),
1337 mfg_reset_activate
, HCI_INIT_TIMEOUT
);
1339 BT_ERR("%s exiting Intel manufacturer mode failed (%ld)",
1340 hdev
->name
, PTR_ERR(skb
));
1341 return PTR_ERR(skb
);
1345 BT_INFO("%s: Intel Bluetooth firmware patch completed and activated",
1351 /* Disable the manufacturer mode without reset */
1352 skb
= __hci_cmd_sync(hdev
, 0xfc11, sizeof(mfg_disable
), mfg_disable
,
1355 BT_ERR("%s exiting Intel manufacturer mode failed (%ld)",
1356 hdev
->name
, PTR_ERR(skb
));
1357 return PTR_ERR(skb
);
1361 BT_INFO("%s: Intel Bluetooth firmware patch completed", hdev
->name
);
1364 exit_mfg_deactivate
:
1365 release_firmware(fw
);
1367 /* Patching failed. Disable the manufacturer mode with reset and
1368 * deactivate the downloaded firmware patches.
1370 skb
= __hci_cmd_sync(hdev
, 0xfc11, sizeof(mfg_reset_deactivate
),
1371 mfg_reset_deactivate
, HCI_INIT_TIMEOUT
);
1373 BT_ERR("%s exiting Intel manufacturer mode failed (%ld)",
1374 hdev
->name
, PTR_ERR(skb
));
1375 return PTR_ERR(skb
);
1379 BT_INFO("%s: Intel Bluetooth firmware patch completed and deactivated",
1385 static int btusb_setup_bcm_patchram(struct hci_dev
*hdev
)
1387 struct btusb_data
*data
= hci_get_drvdata(hdev
);
1388 struct usb_device
*udev
= data
->udev
;
1390 const struct firmware
*fw
;
1393 const struct hci_command_hdr
*cmd
;
1394 const u8
*cmd_param
;
1396 struct sk_buff
*skb
;
1397 struct hci_rp_read_local_version
*ver
;
1400 snprintf(fw_name
, sizeof(fw_name
), "brcm/%s-%04x-%04x.hcd",
1401 udev
->product
? udev
->product
: "BCM",
1402 le16_to_cpu(udev
->descriptor
.idVendor
),
1403 le16_to_cpu(udev
->descriptor
.idProduct
));
1405 ret
= request_firmware(&fw
, fw_name
, &hdev
->dev
);
1407 BT_INFO("%s: BCM: patch %s not found", hdev
->name
,
1413 skb
= __hci_cmd_sync(hdev
, HCI_OP_RESET
, 0, NULL
, HCI_INIT_TIMEOUT
);
1416 BT_ERR("%s: HCI_OP_RESET failed (%ld)", hdev
->name
, ret
);
1421 /* Read Local Version Info */
1422 skb
= __hci_cmd_sync(hdev
, HCI_OP_READ_LOCAL_VERSION
, 0, NULL
,
1426 BT_ERR("%s: HCI_OP_READ_LOCAL_VERSION failed (%ld)",
1431 if (skb
->len
!= sizeof(*ver
)) {
1432 BT_ERR("%s: HCI_OP_READ_LOCAL_VERSION event length mismatch",
1439 ver
= (struct hci_rp_read_local_version
*) skb
->data
;
1440 BT_INFO("%s: BCM: patching hci_ver=%02x hci_rev=%04x lmp_ver=%02x "
1441 "lmp_subver=%04x", hdev
->name
, ver
->hci_ver
, ver
->hci_rev
,
1442 ver
->lmp_ver
, ver
->lmp_subver
);
1445 /* Start Download */
1446 skb
= __hci_cmd_sync(hdev
, 0xfc2e, 0, NULL
, HCI_INIT_TIMEOUT
);
1449 BT_ERR("%s: BCM: Download Minidrv command failed (%ld)",
1455 /* 50 msec delay after Download Minidrv completes */
1461 while (fw_size
>= sizeof(*cmd
)) {
1462 cmd
= (struct hci_command_hdr
*) fw_ptr
;
1463 fw_ptr
+= sizeof(*cmd
);
1464 fw_size
-= sizeof(*cmd
);
1466 if (fw_size
< cmd
->plen
) {
1467 BT_ERR("%s: BCM: patch %s is corrupted",
1468 hdev
->name
, fw_name
);
1474 fw_ptr
+= cmd
->plen
;
1475 fw_size
-= cmd
->plen
;
1477 opcode
= le16_to_cpu(cmd
->opcode
);
1479 skb
= __hci_cmd_sync(hdev
, opcode
, cmd
->plen
, cmd_param
,
1483 BT_ERR("%s: BCM: patch command %04x failed (%ld)",
1484 hdev
->name
, opcode
, ret
);
1490 /* 250 msec delay after Launch Ram completes */
1495 skb
= __hci_cmd_sync(hdev
, HCI_OP_RESET
, 0, NULL
, HCI_INIT_TIMEOUT
);
1498 BT_ERR("%s: HCI_OP_RESET failed (%ld)", hdev
->name
, ret
);
1503 /* Read Local Version Info */
1504 skb
= __hci_cmd_sync(hdev
, HCI_OP_READ_LOCAL_VERSION
, 0, NULL
,
1508 BT_ERR("%s: HCI_OP_READ_LOCAL_VERSION failed (%ld)",
1513 if (skb
->len
!= sizeof(*ver
)) {
1514 BT_ERR("%s: HCI_OP_READ_LOCAL_VERSION event length mismatch",
1521 ver
= (struct hci_rp_read_local_version
*) skb
->data
;
1522 BT_INFO("%s: BCM: firmware hci_ver=%02x hci_rev=%04x lmp_ver=%02x "
1523 "lmp_subver=%04x", hdev
->name
, ver
->hci_ver
, ver
->hci_rev
,
1524 ver
->lmp_ver
, ver
->lmp_subver
);
1528 release_firmware(fw
);
1533 static int btusb_probe(struct usb_interface
*intf
,
1534 const struct usb_device_id
*id
)
1536 struct usb_endpoint_descriptor
*ep_desc
;
1537 struct btusb_data
*data
;
1538 struct hci_dev
*hdev
;
1541 BT_DBG("intf %p id %p", intf
, id
);
1543 /* interface numbers are hardcoded in the spec */
1544 if (intf
->cur_altsetting
->desc
.bInterfaceNumber
!= 0)
1547 if (!id
->driver_info
) {
1548 const struct usb_device_id
*match
;
1549 match
= usb_match_id(intf
, blacklist_table
);
1554 if (id
->driver_info
== BTUSB_IGNORE
)
1557 if (ignore_dga
&& id
->driver_info
& BTUSB_DIGIANSWER
)
1560 if (ignore_csr
&& id
->driver_info
& BTUSB_CSR
)
1563 if (ignore_sniffer
&& id
->driver_info
& BTUSB_SNIFFER
)
1566 if (id
->driver_info
& BTUSB_ATH3012
) {
1567 struct usb_device
*udev
= interface_to_usbdev(intf
);
1569 /* Old firmware would otherwise let ath3k driver load
1570 * patch and sysconfig files */
1571 if (le16_to_cpu(udev
->descriptor
.bcdDevice
) <= 0x0001)
1575 data
= devm_kzalloc(&intf
->dev
, sizeof(*data
), GFP_KERNEL
);
1579 for (i
= 0; i
< intf
->cur_altsetting
->desc
.bNumEndpoints
; i
++) {
1580 ep_desc
= &intf
->cur_altsetting
->endpoint
[i
].desc
;
1582 if (!data
->intr_ep
&& usb_endpoint_is_int_in(ep_desc
)) {
1583 data
->intr_ep
= ep_desc
;
1587 if (!data
->bulk_tx_ep
&& usb_endpoint_is_bulk_out(ep_desc
)) {
1588 data
->bulk_tx_ep
= ep_desc
;
1592 if (!data
->bulk_rx_ep
&& usb_endpoint_is_bulk_in(ep_desc
)) {
1593 data
->bulk_rx_ep
= ep_desc
;
1598 if (!data
->intr_ep
|| !data
->bulk_tx_ep
|| !data
->bulk_rx_ep
)
1601 data
->cmdreq_type
= USB_TYPE_CLASS
;
1603 data
->udev
= interface_to_usbdev(intf
);
1606 spin_lock_init(&data
->lock
);
1608 INIT_WORK(&data
->work
, btusb_work
);
1609 INIT_WORK(&data
->waker
, btusb_waker
);
1610 spin_lock_init(&data
->txlock
);
1612 init_usb_anchor(&data
->tx_anchor
);
1613 init_usb_anchor(&data
->intr_anchor
);
1614 init_usb_anchor(&data
->bulk_anchor
);
1615 init_usb_anchor(&data
->isoc_anchor
);
1616 init_usb_anchor(&data
->deferred
);
1618 hdev
= hci_alloc_dev();
1622 hdev
->bus
= HCI_USB
;
1623 hci_set_drvdata(hdev
, data
);
1627 SET_HCIDEV_DEV(hdev
, &intf
->dev
);
1629 hdev
->open
= btusb_open
;
1630 hdev
->close
= btusb_close
;
1631 hdev
->flush
= btusb_flush
;
1632 hdev
->send
= btusb_send_frame
;
1633 hdev
->notify
= btusb_notify
;
1635 if (id
->driver_info
& BTUSB_BCM92035
)
1636 hdev
->setup
= btusb_setup_bcm92035
;
1638 if (id
->driver_info
& BTUSB_BCM_PATCHRAM
)
1639 hdev
->setup
= btusb_setup_bcm_patchram
;
1641 if (id
->driver_info
& BTUSB_INTEL
)
1642 hdev
->setup
= btusb_setup_intel
;
1644 /* Interface numbers are hardcoded in the specification */
1645 data
->isoc
= usb_ifnum_to_if(data
->udev
, 1);
1648 set_bit(HCI_QUIRK_RESET_ON_CLOSE
, &hdev
->quirks
);
1650 if (force_scofix
|| id
->driver_info
& BTUSB_WRONG_SCO_MTU
) {
1651 if (!disable_scofix
)
1652 set_bit(HCI_QUIRK_FIXUP_BUFFER_SIZE
, &hdev
->quirks
);
1655 if (id
->driver_info
& BTUSB_BROKEN_ISOC
)
1658 if (id
->driver_info
& BTUSB_DIGIANSWER
) {
1659 data
->cmdreq_type
= USB_TYPE_VENDOR
;
1660 set_bit(HCI_QUIRK_RESET_ON_CLOSE
, &hdev
->quirks
);
1663 if (id
->driver_info
& BTUSB_CSR
) {
1664 struct usb_device
*udev
= data
->udev
;
1665 u16 bcdDevice
= le16_to_cpu(udev
->descriptor
.bcdDevice
);
1667 /* Old firmware would otherwise execute USB reset */
1668 if (bcdDevice
< 0x117)
1669 set_bit(HCI_QUIRK_RESET_ON_CLOSE
, &hdev
->quirks
);
1671 /* Fake CSR devices with broken commands */
1672 if (bcdDevice
<= 0x100)
1673 hdev
->setup
= btusb_setup_csr
;
1676 if (id
->driver_info
& BTUSB_SNIFFER
) {
1677 struct usb_device
*udev
= data
->udev
;
1679 /* New sniffer firmware has crippled HCI interface */
1680 if (le16_to_cpu(udev
->descriptor
.bcdDevice
) > 0x997)
1681 set_bit(HCI_QUIRK_RAW_DEVICE
, &hdev
->quirks
);
1687 err
= usb_driver_claim_interface(&btusb_driver
,
1695 err
= hci_register_dev(hdev
);
1701 usb_set_intfdata(intf
, data
);
1706 static void btusb_disconnect(struct usb_interface
*intf
)
1708 struct btusb_data
*data
= usb_get_intfdata(intf
);
1709 struct hci_dev
*hdev
;
1711 BT_DBG("intf %p", intf
);
1717 usb_set_intfdata(data
->intf
, NULL
);
1720 usb_set_intfdata(data
->isoc
, NULL
);
1722 hci_unregister_dev(hdev
);
1724 if (intf
== data
->isoc
)
1725 usb_driver_release_interface(&btusb_driver
, data
->intf
);
1726 else if (data
->isoc
)
1727 usb_driver_release_interface(&btusb_driver
, data
->isoc
);
1733 static int btusb_suspend(struct usb_interface
*intf
, pm_message_t message
)
1735 struct btusb_data
*data
= usb_get_intfdata(intf
);
1737 BT_DBG("intf %p", intf
);
1739 if (data
->suspend_count
++)
1742 spin_lock_irq(&data
->txlock
);
1743 if (!(PMSG_IS_AUTO(message
) && data
->tx_in_flight
)) {
1744 set_bit(BTUSB_SUSPENDING
, &data
->flags
);
1745 spin_unlock_irq(&data
->txlock
);
1747 spin_unlock_irq(&data
->txlock
);
1748 data
->suspend_count
--;
1752 cancel_work_sync(&data
->work
);
1754 btusb_stop_traffic(data
);
1755 usb_kill_anchored_urbs(&data
->tx_anchor
);
1760 static void play_deferred(struct btusb_data
*data
)
1765 while ((urb
= usb_get_from_anchor(&data
->deferred
))) {
1766 err
= usb_submit_urb(urb
, GFP_ATOMIC
);
1770 data
->tx_in_flight
++;
1772 usb_scuttle_anchored_urbs(&data
->deferred
);
1775 static int btusb_resume(struct usb_interface
*intf
)
1777 struct btusb_data
*data
= usb_get_intfdata(intf
);
1778 struct hci_dev
*hdev
= data
->hdev
;
1781 BT_DBG("intf %p", intf
);
1783 if (--data
->suspend_count
)
1786 if (!test_bit(HCI_RUNNING
, &hdev
->flags
))
1789 if (test_bit(BTUSB_INTR_RUNNING
, &data
->flags
)) {
1790 err
= btusb_submit_intr_urb(hdev
, GFP_NOIO
);
1792 clear_bit(BTUSB_INTR_RUNNING
, &data
->flags
);
1797 if (test_bit(BTUSB_BULK_RUNNING
, &data
->flags
)) {
1798 err
= btusb_submit_bulk_urb(hdev
, GFP_NOIO
);
1800 clear_bit(BTUSB_BULK_RUNNING
, &data
->flags
);
1804 btusb_submit_bulk_urb(hdev
, GFP_NOIO
);
1807 if (test_bit(BTUSB_ISOC_RUNNING
, &data
->flags
)) {
1808 if (btusb_submit_isoc_urb(hdev
, GFP_NOIO
) < 0)
1809 clear_bit(BTUSB_ISOC_RUNNING
, &data
->flags
);
1811 btusb_submit_isoc_urb(hdev
, GFP_NOIO
);
1814 spin_lock_irq(&data
->txlock
);
1815 play_deferred(data
);
1816 clear_bit(BTUSB_SUSPENDING
, &data
->flags
);
1817 spin_unlock_irq(&data
->txlock
);
1818 schedule_work(&data
->work
);
1823 usb_scuttle_anchored_urbs(&data
->deferred
);
1825 spin_lock_irq(&data
->txlock
);
1826 clear_bit(BTUSB_SUSPENDING
, &data
->flags
);
1827 spin_unlock_irq(&data
->txlock
);
1833 static struct usb_driver btusb_driver
= {
1835 .probe
= btusb_probe
,
1836 .disconnect
= btusb_disconnect
,
1838 .suspend
= btusb_suspend
,
1839 .resume
= btusb_resume
,
1841 .id_table
= btusb_table
,
1842 .supports_autosuspend
= 1,
1843 .disable_hub_initiated_lpm
= 1,
1846 module_usb_driver(btusb_driver
);
1848 module_param(ignore_dga
, bool, 0644);
1849 MODULE_PARM_DESC(ignore_dga
, "Ignore devices with id 08fd:0001");
1851 module_param(ignore_csr
, bool, 0644);
1852 MODULE_PARM_DESC(ignore_csr
, "Ignore devices with id 0a12:0001");
1854 module_param(ignore_sniffer
, bool, 0644);
1855 MODULE_PARM_DESC(ignore_sniffer
, "Ignore devices with id 0a12:0002");
1857 module_param(disable_scofix
, bool, 0644);
1858 MODULE_PARM_DESC(disable_scofix
, "Disable fixup of wrong SCO buffer size");
1860 module_param(force_scofix
, bool, 0644);
1861 MODULE_PARM_DESC(force_scofix
, "Force fixup of wrong SCO buffers size");
1863 module_param(reset
, bool, 0644);
1864 MODULE_PARM_DESC(reset
, "Send HCI reset command on initialization");
1866 MODULE_AUTHOR("Marcel Holtmann <marcel@holtmann.org>");
1867 MODULE_DESCRIPTION("Generic Bluetooth USB driver ver " VERSION
);
1868 MODULE_VERSION(VERSION
);
1869 MODULE_LICENSE("GPL");