]> git.proxmox.com Git - mirror_ubuntu-hirsute-kernel.git/blob - drivers/bluetooth/btusb.c
projects / mirror_ubuntu-hirsute-kernel.git / blob
? search:
summary | shortlog | log | commit | commitdiff | tree
blame | history | raw | HEAD
Merge tag 'platform-drivers-x86-v4.16-7' of git://git.infradead.org/linux-platform...
[mirror_ubuntu-hirsute-kernel.git] / drivers / bluetooth / btusb.c
1 /*
2 *
3 * Generic Bluetooth USB driver
4 *
5 * Copyright (C) 2005-2008 Marcel Holtmann <marcel@holtmann.org>
6 *
7 *
8 * This program is free software; you can redistribute it and/or modify
9 * it under the terms of the GNU General Public License as published by
10 * the Free Software Foundation; either version 2 of the License, or
11 * (at your option) any later version.
12 *
13 * This program is distributed in the hope that it will be useful,
14 * but WITHOUT ANY WARRANTY; without even the implied warranty of
15 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
16 * GNU General Public License for more details.
17 *
18 * You should have received a copy of the GNU General Public License
19 * along with this program; if not, write to the Free Software
20 * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
21 *
22 */
23
24 #include <linux/dmi.h>
25 #include <linux/module.h>
26 #include <linux/usb.h>
27 #include <linux/usb/quirks.h>
28 #include <linux/firmware.h>
29 #include <linux/of_device.h>
30 #include <linux/of_irq.h>
31 #include <linux/suspend.h>
32 #include <asm/unaligned.h>
33
34 #include <net/bluetooth/bluetooth.h>
35 #include <net/bluetooth/hci_core.h>
36
37 #include "btintel.h"
38 #include "btbcm.h"
39 #include "btrtl.h"
40
41 #define VERSION "0.8"
42
43 static bool disable_scofix;
44 static bool force_scofix;
45 static bool enable_autosuspend = IS_ENABLED(CONFIG_BT_HCIBTUSB_AUTOSUSPEND);
46
47 static bool reset = true;
48
49 static struct usb_driver btusb_driver;
50
51 #define BTUSB_IGNORE 0x01
52 #define BTUSB_DIGIANSWER 0x02
53 #define BTUSB_CSR 0x04
54 #define BTUSB_SNIFFER 0x08
55 #define BTUSB_BCM92035 0x10
56 #define BTUSB_BROKEN_ISOC 0x20
57 #define BTUSB_WRONG_SCO_MTU 0x40
58 #define BTUSB_ATH3012 0x80
59 #define BTUSB_INTEL 0x100
60 #define BTUSB_INTEL_BOOT 0x200
61 #define BTUSB_BCM_PATCHRAM 0x400
62 #define BTUSB_MARVELL 0x800
63 #define BTUSB_SWAVE 0x1000
64 #define BTUSB_INTEL_NEW 0x2000
65 #define BTUSB_AMP 0x4000
66 #define BTUSB_QCA_ROME 0x8000
67 #define BTUSB_BCM_APPLE 0x10000
68 #define BTUSB_REALTEK 0x20000
69 #define BTUSB_BCM2045 0x40000
70 #define BTUSB_IFNUM_2 0x80000
71 #define BTUSB_CW6622 0x100000
72
73 static const struct usb_device_id btusb_table[] = {
74 /* Generic Bluetooth USB device */
75 { USB_DEVICE_INFO(0xe0, 0x01, 0x01) },
76
77 /* Generic Bluetooth AMP device */
78 { USB_DEVICE_INFO(0xe0, 0x01, 0x04), .driver_info = BTUSB_AMP },
79
80 /* Generic Bluetooth USB interface */
81 { USB_INTERFACE_INFO(0xe0, 0x01, 0x01) },
82
83 /* Apple-specific (Broadcom) devices */
84 { USB_VENDOR_AND_INTERFACE_INFO(0x05ac, 0xff, 0x01, 0x01),
85 .driver_info = BTUSB_BCM_APPLE | BTUSB_IFNUM_2 },
86
87 /* MediaTek MT76x0E */
88 { USB_DEVICE(0x0e8d, 0x763f) },
89
90 /* Broadcom SoftSailing reporting vendor specific */
91 { USB_DEVICE(0x0a5c, 0x21e1) },
92
93 /* Apple MacBookPro 7,1 */
94 { USB_DEVICE(0x05ac, 0x8213) },
95
96 /* Apple iMac11,1 */
97 { USB_DEVICE(0x05ac, 0x8215) },
98
99 /* Apple MacBookPro6,2 */
100 { USB_DEVICE(0x05ac, 0x8218) },
101
102 /* Apple MacBookAir3,1, MacBookAir3,2 */
103 { USB_DEVICE(0x05ac, 0x821b) },
104
105 /* Apple MacBookAir4,1 */
106 { USB_DEVICE(0x05ac, 0x821f) },
107
108 /* Apple MacBookPro8,2 */
109 { USB_DEVICE(0x05ac, 0x821a) },
110
111 /* Apple MacMini5,1 */
112 { USB_DEVICE(0x05ac, 0x8281) },
113
114 /* AVM BlueFRITZ! USB v2.0 */
115 { USB_DEVICE(0x057c, 0x3800), .driver_info = BTUSB_SWAVE },
116
117 /* Bluetooth Ultraport Module from IBM */
118 { USB_DEVICE(0x04bf, 0x030a) },
119
120 /* ALPS Modules with non-standard id */
121 { USB_DEVICE(0x044e, 0x3001) },
122 { USB_DEVICE(0x044e, 0x3002) },
123
124 /* Ericsson with non-standard id */
125 { USB_DEVICE(0x0bdb, 0x1002) },
126
127 /* Canyon CN-BTU1 with HID interfaces */
128 { USB_DEVICE(0x0c10, 0x0000) },
129
130 /* Broadcom BCM20702A0 */
131 { USB_DEVICE(0x413c, 0x8197) },
132
133 /* Broadcom BCM20702B0 (Dynex/Insignia) */
134 { USB_DEVICE(0x19ff, 0x0239), .driver_info = BTUSB_BCM_PATCHRAM },
135
136 /* Broadcom BCM43142A0 (Foxconn/Lenovo) */
137 { USB_VENDOR_AND_INTERFACE_INFO(0x105b, 0xff, 0x01, 0x01),
138 .driver_info = BTUSB_BCM_PATCHRAM },
139
140 /* Broadcom BCM920703 (HTC Vive) */
141 { USB_VENDOR_AND_INTERFACE_INFO(0x0bb4, 0xff, 0x01, 0x01),
142 .driver_info = BTUSB_BCM_PATCHRAM },
143
144 /* Foxconn - Hon Hai */
145 { USB_VENDOR_AND_INTERFACE_INFO(0x0489, 0xff, 0x01, 0x01),
146 .driver_info = BTUSB_BCM_PATCHRAM },
147
148 /* Lite-On Technology - Broadcom based */
149 { USB_VENDOR_AND_INTERFACE_INFO(0x04ca, 0xff, 0x01, 0x01),
150 .driver_info = BTUSB_BCM_PATCHRAM },
151
152 /* Broadcom devices with vendor specific id */
153 { USB_VENDOR_AND_INTERFACE_INFO(0x0a5c, 0xff, 0x01, 0x01),
154 .driver_info = BTUSB_BCM_PATCHRAM },
155
156 /* ASUSTek Computer - Broadcom based */
157 { USB_VENDOR_AND_INTERFACE_INFO(0x0b05, 0xff, 0x01, 0x01),
158 .driver_info = BTUSB_BCM_PATCHRAM },
159
160 /* Belkin F8065bf - Broadcom based */
161 { USB_VENDOR_AND_INTERFACE_INFO(0x050d, 0xff, 0x01, 0x01),
162 .driver_info = BTUSB_BCM_PATCHRAM },
163
164 /* IMC Networks - Broadcom based */
165 { USB_VENDOR_AND_INTERFACE_INFO(0x13d3, 0xff, 0x01, 0x01),
166 .driver_info = BTUSB_BCM_PATCHRAM },
167
168 /* Dell Computer - Broadcom based */
169 { USB_VENDOR_AND_INTERFACE_INFO(0x413c, 0xff, 0x01, 0x01),
170 .driver_info = BTUSB_BCM_PATCHRAM },
171
172 /* Toshiba Corp - Broadcom based */
173 { USB_VENDOR_AND_INTERFACE_INFO(0x0930, 0xff, 0x01, 0x01),
174 .driver_info = BTUSB_BCM_PATCHRAM },
175
176 /* Intel Bluetooth USB Bootloader (RAM module) */
177 { USB_DEVICE(0x8087, 0x0a5a),
178 .driver_info = BTUSB_INTEL_BOOT | BTUSB_BROKEN_ISOC },
179
180 { } /* Terminating entry */
181 };
182
183 MODULE_DEVICE_TABLE(usb, btusb_table);
184
185 static const struct usb_device_id blacklist_table[] = {
186 /* CSR BlueCore devices */
187 { USB_DEVICE(0x0a12, 0x0001), .driver_info = BTUSB_CSR },
188
189 /* Broadcom BCM2033 without firmware */
190 { USB_DEVICE(0x0a5c, 0x2033), .driver_info = BTUSB_IGNORE },
191
192 /* Broadcom BCM2045 devices */
193 { USB_DEVICE(0x0a5c, 0x2045), .driver_info = BTUSB_BCM2045 },
194
195 /* Atheros 3011 with sflash firmware */
196 { USB_DEVICE(0x0489, 0xe027), .driver_info = BTUSB_IGNORE },
197 { USB_DEVICE(0x0489, 0xe03d), .driver_info = BTUSB_IGNORE },
198 { USB_DEVICE(0x04f2, 0xaff1), .driver_info = BTUSB_IGNORE },
199 { USB_DEVICE(0x0930, 0x0215), .driver_info = BTUSB_IGNORE },
200 { USB_DEVICE(0x0cf3, 0x3002), .driver_info = BTUSB_IGNORE },
201 { USB_DEVICE(0x0cf3, 0xe019), .driver_info = BTUSB_IGNORE },
202 { USB_DEVICE(0x13d3, 0x3304), .driver_info = BTUSB_IGNORE },
203
204 /* Atheros AR9285 Malbec with sflash firmware */
205 { USB_DEVICE(0x03f0, 0x311d), .driver_info = BTUSB_IGNORE },
206
207 /* Atheros 3012 with sflash firmware */
208 { USB_DEVICE(0x0489, 0xe04d), .driver_info = BTUSB_ATH3012 },
209 { USB_DEVICE(0x0489, 0xe04e), .driver_info = BTUSB_ATH3012 },
210 { USB_DEVICE(0x0489, 0xe056), .driver_info = BTUSB_ATH3012 },
211 { USB_DEVICE(0x0489, 0xe057), .driver_info = BTUSB_ATH3012 },
212 { USB_DEVICE(0x0489, 0xe05f), .driver_info = BTUSB_ATH3012 },
213 { USB_DEVICE(0x0489, 0xe076), .driver_info = BTUSB_ATH3012 },
214 { USB_DEVICE(0x0489, 0xe078), .driver_info = BTUSB_ATH3012 },
215 { USB_DEVICE(0x0489, 0xe095), .driver_info = BTUSB_ATH3012 },
216 { USB_DEVICE(0x04c5, 0x1330), .driver_info = BTUSB_ATH3012 },
217 { USB_DEVICE(0x04ca, 0x3004), .driver_info = BTUSB_ATH3012 },
218 { USB_DEVICE(0x04ca, 0x3005), .driver_info = BTUSB_ATH3012 },
219 { USB_DEVICE(0x04ca, 0x3006), .driver_info = BTUSB_ATH3012 },
220 { USB_DEVICE(0x04ca, 0x3007), .driver_info = BTUSB_ATH3012 },
221 { USB_DEVICE(0x04ca, 0x3008), .driver_info = BTUSB_ATH3012 },
222 { USB_DEVICE(0x04ca, 0x300b), .driver_info = BTUSB_ATH3012 },
223 { USB_DEVICE(0x04ca, 0x300d), .driver_info = BTUSB_ATH3012 },
224 { USB_DEVICE(0x04ca, 0x300f), .driver_info = BTUSB_ATH3012 },
225 { USB_DEVICE(0x04ca, 0x3010), .driver_info = BTUSB_ATH3012 },
226 { USB_DEVICE(0x04ca, 0x3014), .driver_info = BTUSB_ATH3012 },
227 { USB_DEVICE(0x04ca, 0x3018), .driver_info = BTUSB_ATH3012 },
228 { USB_DEVICE(0x0930, 0x0219), .driver_info = BTUSB_ATH3012 },
229 { USB_DEVICE(0x0930, 0x021c), .driver_info = BTUSB_ATH3012 },
230 { USB_DEVICE(0x0930, 0x0220), .driver_info = BTUSB_ATH3012 },
231 { USB_DEVICE(0x0930, 0x0227), .driver_info = BTUSB_ATH3012 },
232 { USB_DEVICE(0x0b05, 0x17d0), .driver_info = BTUSB_ATH3012 },
233 { USB_DEVICE(0x0cf3, 0x0036), .driver_info = BTUSB_ATH3012 },
234 { USB_DEVICE(0x0cf3, 0x3004), .driver_info = BTUSB_ATH3012 },
235 { USB_DEVICE(0x0cf3, 0x3008), .driver_info = BTUSB_ATH3012 },
236 { USB_DEVICE(0x0cf3, 0x311d), .driver_info = BTUSB_ATH3012 },
237 { USB_DEVICE(0x0cf3, 0x311e), .driver_info = BTUSB_ATH3012 },
238 { USB_DEVICE(0x0cf3, 0x311f), .driver_info = BTUSB_ATH3012 },
239 { USB_DEVICE(0x0cf3, 0x3121), .driver_info = BTUSB_ATH3012 },
240 { USB_DEVICE(0x0cf3, 0x817a), .driver_info = BTUSB_ATH3012 },
241 { USB_DEVICE(0x0cf3, 0x817b), .driver_info = BTUSB_ATH3012 },
242 { USB_DEVICE(0x0cf3, 0xe003), .driver_info = BTUSB_ATH3012 },
243 { USB_DEVICE(0x0cf3, 0xe004), .driver_info = BTUSB_ATH3012 },
244 { USB_DEVICE(0x0cf3, 0xe005), .driver_info = BTUSB_ATH3012 },
245 { USB_DEVICE(0x0cf3, 0xe006), .driver_info = BTUSB_ATH3012 },
246 { USB_DEVICE(0x13d3, 0x3362), .driver_info = BTUSB_ATH3012 },
247 { USB_DEVICE(0x13d3, 0x3375), .driver_info = BTUSB_ATH3012 },
248 { USB_DEVICE(0x13d3, 0x3393), .driver_info = BTUSB_ATH3012 },
249 { USB_DEVICE(0x13d3, 0x3395), .driver_info = BTUSB_ATH3012 },
250 { USB_DEVICE(0x13d3, 0x3402), .driver_info = BTUSB_ATH3012 },
251 { USB_DEVICE(0x13d3, 0x3408), .driver_info = BTUSB_ATH3012 },
252 { USB_DEVICE(0x13d3, 0x3423), .driver_info = BTUSB_ATH3012 },
253 { USB_DEVICE(0x13d3, 0x3432), .driver_info = BTUSB_ATH3012 },
254 { USB_DEVICE(0x13d3, 0x3472), .driver_info = BTUSB_ATH3012 },
255 { USB_DEVICE(0x13d3, 0x3474), .driver_info = BTUSB_ATH3012 },
256 { USB_DEVICE(0x13d3, 0x3487), .driver_info = BTUSB_ATH3012 },
257 { USB_DEVICE(0x13d3, 0x3490), .driver_info = BTUSB_ATH3012 },
258
259 /* Atheros AR5BBU12 with sflash firmware */
260 { USB_DEVICE(0x0489, 0xe02c), .driver_info = BTUSB_IGNORE },
261
262 /* Atheros AR5BBU12 with sflash firmware */
263 { USB_DEVICE(0x0489, 0xe036), .driver_info = BTUSB_ATH3012 },
264 { USB_DEVICE(0x0489, 0xe03c), .driver_info = BTUSB_ATH3012 },
265
266 /* QCA ROME chipset */
267 { USB_DEVICE(0x0cf3, 0xe007), .driver_info = BTUSB_QCA_ROME },
268 { USB_DEVICE(0x0cf3, 0xe009), .driver_info = BTUSB_QCA_ROME },
269 { USB_DEVICE(0x0cf3, 0xe010), .driver_info = BTUSB_QCA_ROME },
270 { USB_DEVICE(0x0cf3, 0xe300), .driver_info = BTUSB_QCA_ROME },
271 { USB_DEVICE(0x0cf3, 0xe301), .driver_info = BTUSB_QCA_ROME },
272 { USB_DEVICE(0x0cf3, 0xe360), .driver_info = BTUSB_QCA_ROME },
273 { USB_DEVICE(0x0489, 0xe092), .driver_info = BTUSB_QCA_ROME },
274 { USB_DEVICE(0x0489, 0xe09f), .driver_info = BTUSB_QCA_ROME },
275 { USB_DEVICE(0x0489, 0xe0a2), .driver_info = BTUSB_QCA_ROME },
276 { USB_DEVICE(0x04ca, 0x3011), .driver_info = BTUSB_QCA_ROME },
277 { USB_DEVICE(0x04ca, 0x3015), .driver_info = BTUSB_QCA_ROME },
278 { USB_DEVICE(0x04ca, 0x3016), .driver_info = BTUSB_QCA_ROME },
279
280 /* Broadcom BCM2035 */
281 { USB_DEVICE(0x0a5c, 0x2009), .driver_info = BTUSB_BCM92035 },
282 { USB_DEVICE(0x0a5c, 0x200a), .driver_info = BTUSB_WRONG_SCO_MTU },
283 { USB_DEVICE(0x0a5c, 0x2035), .driver_info = BTUSB_WRONG_SCO_MTU },
284
285 /* Broadcom BCM2045 */
286 { USB_DEVICE(0x0a5c, 0x2039), .driver_info = BTUSB_WRONG_SCO_MTU },
287 { USB_DEVICE(0x0a5c, 0x2101), .driver_info = BTUSB_WRONG_SCO_MTU },
288
289 /* IBM/Lenovo ThinkPad with Broadcom chip */
290 { USB_DEVICE(0x0a5c, 0x201e), .driver_info = BTUSB_WRONG_SCO_MTU },
291 { USB_DEVICE(0x0a5c, 0x2110), .driver_info = BTUSB_WRONG_SCO_MTU },
292
293 /* HP laptop with Broadcom chip */
294 { USB_DEVICE(0x03f0, 0x171d), .driver_info = BTUSB_WRONG_SCO_MTU },
295
296 /* Dell laptop with Broadcom chip */
297 { USB_DEVICE(0x413c, 0x8126), .driver_info = BTUSB_WRONG_SCO_MTU },
298
299 /* Dell Wireless 370 and 410 devices */
300 { USB_DEVICE(0x413c, 0x8152), .driver_info = BTUSB_WRONG_SCO_MTU },
301 { USB_DEVICE(0x413c, 0x8156), .driver_info = BTUSB_WRONG_SCO_MTU },
302
303 /* Belkin F8T012 and F8T013 devices */
304 { USB_DEVICE(0x050d, 0x0012), .driver_info = BTUSB_WRONG_SCO_MTU },
305 { USB_DEVICE(0x050d, 0x0013), .driver_info = BTUSB_WRONG_SCO_MTU },
306
307 /* Asus WL-BTD202 device */
308 { USB_DEVICE(0x0b05, 0x1715), .driver_info = BTUSB_WRONG_SCO_MTU },
309
310 /* Kensington Bluetooth USB adapter */
311 { USB_DEVICE(0x047d, 0x105e), .driver_info = BTUSB_WRONG_SCO_MTU },
312
313 /* RTX Telecom based adapters with buggy SCO support */
314 { USB_DEVICE(0x0400, 0x0807), .driver_info = BTUSB_BROKEN_ISOC },
315 { USB_DEVICE(0x0400, 0x080a), .driver_info = BTUSB_BROKEN_ISOC },
316
317 /* CONWISE Technology based adapters with buggy SCO support */
318 { USB_DEVICE(0x0e5e, 0x6622),
319 .driver_info = BTUSB_BROKEN_ISOC | BTUSB_CW6622},
320
321 /* Roper Class 1 Bluetooth Dongle (Silicon Wave based) */
322 { USB_DEVICE(0x1310, 0x0001), .driver_info = BTUSB_SWAVE },
323
324 /* Digianswer devices */
325 { USB_DEVICE(0x08fd, 0x0001), .driver_info = BTUSB_DIGIANSWER },
326 { USB_DEVICE(0x08fd, 0x0002), .driver_info = BTUSB_IGNORE },
327
328 /* CSR BlueCore Bluetooth Sniffer */
329 { USB_DEVICE(0x0a12, 0x0002),
330 .driver_info = BTUSB_SNIFFER | BTUSB_BROKEN_ISOC },
331
332 /* Frontline ComProbe Bluetooth Sniffer */
333 { USB_DEVICE(0x16d3, 0x0002),
334 .driver_info = BTUSB_SNIFFER | BTUSB_BROKEN_ISOC },
335
336 /* Marvell Bluetooth devices */
337 { USB_DEVICE(0x1286, 0x2044), .driver_info = BTUSB_MARVELL },
338 { USB_DEVICE(0x1286, 0x2046), .driver_info = BTUSB_MARVELL },
339 { USB_DEVICE(0x1286, 0x204e), .driver_info = BTUSB_MARVELL },
340
341 /* Intel Bluetooth devices */
342 { USB_DEVICE(0x8087, 0x0025), .driver_info = BTUSB_INTEL_NEW },
343 { USB_DEVICE(0x8087, 0x07da), .driver_info = BTUSB_CSR },
344 { USB_DEVICE(0x8087, 0x07dc), .driver_info = BTUSB_INTEL },
345 { USB_DEVICE(0x8087, 0x0a2a), .driver_info = BTUSB_INTEL },
346 { USB_DEVICE(0x8087, 0x0a2b), .driver_info = BTUSB_INTEL_NEW },
347 { USB_DEVICE(0x8087, 0x0aa7), .driver_info = BTUSB_INTEL },
348 { USB_DEVICE(0x8087, 0x0aaa), .driver_info = BTUSB_INTEL_NEW },
349
350 /* Other Intel Bluetooth devices */
351 { USB_VENDOR_AND_INTERFACE_INFO(0x8087, 0xe0, 0x01, 0x01),
352 .driver_info = BTUSB_IGNORE },
353
354 /* Realtek Bluetooth devices */
355 { USB_VENDOR_AND_INTERFACE_INFO(0x0bda, 0xe0, 0x01, 0x01),
356 .driver_info = BTUSB_REALTEK },
357
358 /* Additional Realtek 8723AE Bluetooth devices */
359 { USB_DEVICE(0x0930, 0x021d), .driver_info = BTUSB_REALTEK },
360 { USB_DEVICE(0x13d3, 0x3394), .driver_info = BTUSB_REALTEK },
361
362 /* Additional Realtek 8723BE Bluetooth devices */
363 { USB_DEVICE(0x0489, 0xe085), .driver_info = BTUSB_REALTEK },
364 { USB_DEVICE(0x0489, 0xe08b), .driver_info = BTUSB_REALTEK },
365 { USB_DEVICE(0x13d3, 0x3410), .driver_info = BTUSB_REALTEK },
366 { USB_DEVICE(0x13d3, 0x3416), .driver_info = BTUSB_REALTEK },
367 { USB_DEVICE(0x13d3, 0x3459), .driver_info = BTUSB_REALTEK },
368 { USB_DEVICE(0x13d3, 0x3494), .driver_info = BTUSB_REALTEK },
369
370 /* Additional Realtek 8821AE Bluetooth devices */
371 { USB_DEVICE(0x0b05, 0x17dc), .driver_info = BTUSB_REALTEK },
372 { USB_DEVICE(0x13d3, 0x3414), .driver_info = BTUSB_REALTEK },
373 { USB_DEVICE(0x13d3, 0x3458), .driver_info = BTUSB_REALTEK },
374 { USB_DEVICE(0x13d3, 0x3461), .driver_info = BTUSB_REALTEK },
375 { USB_DEVICE(0x13d3, 0x3462), .driver_info = BTUSB_REALTEK },
376
377 /* Silicon Wave based devices */
378 { USB_DEVICE(0x0c10, 0x0000), .driver_info = BTUSB_SWAVE },
379
380 { } /* Terminating entry */
381 };
382
383 /* The Bluetooth USB module build into some devices needs to be reset on resume,
384 * this is a problem with the platform (likely shutting off all power) not with
385 * the module itself. So we use a DMI list to match known broken platforms.
386 */
387 static const struct dmi_system_id btusb_needs_reset_resume_table[] = {
388 {
389 /* Lenovo Yoga 920 (QCA Rome device 0cf3:e300) */
390 .matches = {
391 DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
392 DMI_MATCH(DMI_PRODUCT_VERSION, "Lenovo YOGA 920"),
393 },
394 },
395 {}
396 };
397
398 #define BTUSB_MAX_ISOC_FRAMES 10
399
400 #define BTUSB_INTR_RUNNING 0
401 #define BTUSB_BULK_RUNNING 1
402 #define BTUSB_ISOC_RUNNING 2
403 #define BTUSB_SUSPENDING 3
404 #define BTUSB_DID_ISO_RESUME 4
405 #define BTUSB_BOOTLOADER 5
406 #define BTUSB_DOWNLOADING 6
407 #define BTUSB_FIRMWARE_LOADED 7
408 #define BTUSB_FIRMWARE_FAILED 8
409 #define BTUSB_BOOTING 9
410 #define BTUSB_DIAG_RUNNING 10
411 #define BTUSB_OOB_WAKE_ENABLED 11
412
413 struct btusb_data {
414 struct hci_dev *hdev;
415 struct usb_device *udev;
416 struct usb_interface *intf;
417 struct usb_interface *isoc;
418 struct usb_interface *diag;
419 unsigned isoc_ifnum;
420
421 unsigned long flags;
422
423 struct work_struct work;
424 struct work_struct waker;
425
426 struct usb_anchor deferred;
427 struct usb_anchor tx_anchor;
428 int tx_in_flight;
429 spinlock_t txlock;
430
431 struct usb_anchor intr_anchor;
432 struct usb_anchor bulk_anchor;
433 struct usb_anchor isoc_anchor;
434 struct usb_anchor diag_anchor;
435 spinlock_t rxlock;
436
437 struct sk_buff *evt_skb;
438 struct sk_buff *acl_skb;
439 struct sk_buff *sco_skb;
440
441 struct usb_endpoint_descriptor *intr_ep;
442 struct usb_endpoint_descriptor *bulk_tx_ep;
443 struct usb_endpoint_descriptor *bulk_rx_ep;
444 struct usb_endpoint_descriptor *isoc_tx_ep;
445 struct usb_endpoint_descriptor *isoc_rx_ep;
446 struct usb_endpoint_descriptor *diag_tx_ep;
447 struct usb_endpoint_descriptor *diag_rx_ep;
448
449 __u8 cmdreq_type;
450 __u8 cmdreq;
451
452 unsigned int sco_num;
453 int isoc_altsetting;
454 int suspend_count;
455
456 int (*recv_event)(struct hci_dev *hdev, struct sk_buff *skb);
457 int (*recv_bulk)(struct btusb_data *data, void *buffer, int count);
458
459 int (*setup_on_usb)(struct hci_dev *hdev);
460
461 int oob_wake_irq; /* irq for out-of-band wake-on-bt */
462 };
463
464 static inline void btusb_free_frags(struct btusb_data *data)
465 {
466 unsigned long flags;
467
468 spin_lock_irqsave(&data->rxlock, flags);
469
470 kfree_skb(data->evt_skb);
471 data->evt_skb = NULL;
472
473 kfree_skb(data->acl_skb);
474 data->acl_skb = NULL;
475
476 kfree_skb(data->sco_skb);
477 data->sco_skb = NULL;
478
479 spin_unlock_irqrestore(&data->rxlock, flags);
480 }
481
482 static int btusb_recv_intr(struct btusb_data *data, void *buffer, int count)
483 {
484 struct sk_buff *skb;
485 int err = 0;
486
487 spin_lock(&data->rxlock);
488 skb = data->evt_skb;
489
490 while (count) {
491 int len;
492
493 if (!skb) {
494 skb = bt_skb_alloc(HCI_MAX_EVENT_SIZE, GFP_ATOMIC);
495 if (!skb) {
496 err = -ENOMEM;
497 break;
498 }
499
500 hci_skb_pkt_type(skb) = HCI_EVENT_PKT;
501 hci_skb_expect(skb) = HCI_EVENT_HDR_SIZE;
502 }
503
504 len = min_t(uint, hci_skb_expect(skb), count);
505 skb_put_data(skb, buffer, len);
506
507 count -= len;
508 buffer += len;
509 hci_skb_expect(skb) -= len;
510
511 if (skb->len == HCI_EVENT_HDR_SIZE) {
512 /* Complete event header */
513 hci_skb_expect(skb) = hci_event_hdr(skb)->plen;
514
515 if (skb_tailroom(skb) < hci_skb_expect(skb)) {
516 kfree_skb(skb);
517 skb = NULL;
518
519 err = -EILSEQ;
520 break;
521 }
522 }
523
524 if (!hci_skb_expect(skb)) {
525 /* Complete frame */
526 data->recv_event(data->hdev, skb);
527 skb = NULL;
528 }
529 }
530
531 data->evt_skb = skb;
532 spin_unlock(&data->rxlock);
533
534 return err;
535 }
536
537 static int btusb_recv_bulk(struct btusb_data *data, void *buffer, int count)
538 {
539 struct sk_buff *skb;
540 int err = 0;
541
542 spin_lock(&data->rxlock);
543 skb = data->acl_skb;
544
545 while (count) {
546 int len;
547
548 if (!skb) {
549 skb = bt_skb_alloc(HCI_MAX_FRAME_SIZE, GFP_ATOMIC);
550 if (!skb) {
551 err = -ENOMEM;
552 break;
553 }
554
555 hci_skb_pkt_type(skb) = HCI_ACLDATA_PKT;
556 hci_skb_expect(skb) = HCI_ACL_HDR_SIZE;
557 }
558
559 len = min_t(uint, hci_skb_expect(skb), count);
560 skb_put_data(skb, buffer, len);
561
562 count -= len;
563 buffer += len;
564 hci_skb_expect(skb) -= len;
565
566 if (skb->len == HCI_ACL_HDR_SIZE) {
567 __le16 dlen = hci_acl_hdr(skb)->dlen;
568
569 /* Complete ACL header */
570 hci_skb_expect(skb) = __le16_to_cpu(dlen);
571
572 if (skb_tailroom(skb) < hci_skb_expect(skb)) {
573 kfree_skb(skb);
574 skb = NULL;
575
576 err = -EILSEQ;
577 break;
578 }
579 }
580
581 if (!hci_skb_expect(skb)) {
582 /* Complete frame */
583 hci_recv_frame(data->hdev, skb);
584 skb = NULL;
585 }
586 }
587
588 data->acl_skb = skb;
589 spin_unlock(&data->rxlock);
590
591 return err;
592 }
593
594 static int btusb_recv_isoc(struct btusb_data *data, void *buffer, int count)
595 {
596 struct sk_buff *skb;
597 int err = 0;
598
599 spin_lock(&data->rxlock);
600 skb = data->sco_skb;
601
602 while (count) {
603 int len;
604
605 if (!skb) {
606 skb = bt_skb_alloc(HCI_MAX_SCO_SIZE, GFP_ATOMIC);
607 if (!skb) {
608 err = -ENOMEM;
609 break;
610 }
611
612 hci_skb_pkt_type(skb) = HCI_SCODATA_PKT;
613 hci_skb_expect(skb) = HCI_SCO_HDR_SIZE;
614 }
615
616 len = min_t(uint, hci_skb_expect(skb), count);
617 skb_put_data(skb, buffer, len);
618
619 count -= len;
620 buffer += len;
621 hci_skb_expect(skb) -= len;
622
623 if (skb->len == HCI_SCO_HDR_SIZE) {
624 /* Complete SCO header */
625 hci_skb_expect(skb) = hci_sco_hdr(skb)->dlen;
626
627 if (skb_tailroom(skb) < hci_skb_expect(skb)) {
628 kfree_skb(skb);
629 skb = NULL;
630
631 err = -EILSEQ;
632 break;
633 }
634 }
635
636 if (!hci_skb_expect(skb)) {
637 /* Complete frame */
638 hci_recv_frame(data->hdev, skb);
639 skb = NULL;
640 }
641 }
642
643 data->sco_skb = skb;
644 spin_unlock(&data->rxlock);
645
646 return err;
647 }
648
649 static void btusb_intr_complete(struct urb *urb)
650 {
651 struct hci_dev *hdev = urb->context;
652 struct btusb_data *data = hci_get_drvdata(hdev);
653 int err;
654
655 BT_DBG("%s urb %p status %d count %d", hdev->name, urb, urb->status,
656 urb->actual_length);
657
658 if (!test_bit(HCI_RUNNING, &hdev->flags))
659 return;
660
661 if (urb->status == 0) {
662 hdev->stat.byte_rx += urb->actual_length;
663
664 if (btusb_recv_intr(data, urb->transfer_buffer,
665 urb->actual_length) < 0) {
666 bt_dev_err(hdev, "corrupted event packet");
667 hdev->stat.err_rx++;
668 }
669 } else if (urb->status == -ENOENT) {
670 /* Avoid suspend failed when usb_kill_urb */
671 return;
672 }
673
674 if (!test_bit(BTUSB_INTR_RUNNING, &data->flags))
675 return;
676
677 usb_mark_last_busy(data->udev);
678 usb_anchor_urb(urb, &data->intr_anchor);
679
680 err = usb_submit_urb(urb, GFP_ATOMIC);
681 if (err < 0) {
682 /* -EPERM: urb is being killed;
683 * -ENODEV: device got disconnected
684 */
685 if (err != -EPERM && err != -ENODEV)
686 bt_dev_err(hdev, "urb %p failed to resubmit (%d)",
687 urb, -err);
688 usb_unanchor_urb(urb);
689 }
690 }
691
692 static int btusb_submit_intr_urb(struct hci_dev *hdev, gfp_t mem_flags)
693 {
694 struct btusb_data *data = hci_get_drvdata(hdev);
695 struct urb *urb;
696 unsigned char *buf;
697 unsigned int pipe;
698 int err, size;
699
700 BT_DBG("%s", hdev->name);
701
702 if (!data->intr_ep)
703 return -ENODEV;
704
705 urb = usb_alloc_urb(0, mem_flags);
706 if (!urb)
707 return -ENOMEM;
708
709 size = le16_to_cpu(data->intr_ep->wMaxPacketSize);
710
711 buf = kmalloc(size, mem_flags);
712 if (!buf) {
713 usb_free_urb(urb);
714 return -ENOMEM;
715 }
716
717 pipe = usb_rcvintpipe(data->udev, data->intr_ep->bEndpointAddress);
718
719 usb_fill_int_urb(urb, data->udev, pipe, buf, size,
720 btusb_intr_complete, hdev, data->intr_ep->bInterval);
721
722 urb->transfer_flags |= URB_FREE_BUFFER;
723
724 usb_anchor_urb(urb, &data->intr_anchor);
725
726 err = usb_submit_urb(urb, mem_flags);
727 if (err < 0) {
728 if (err != -EPERM && err != -ENODEV)
729 bt_dev_err(hdev, "urb %p submission failed (%d)",
730 urb, -err);
731 usb_unanchor_urb(urb);
732 }
733
734 usb_free_urb(urb);
735
736 return err;
737 }
738
739 static void btusb_bulk_complete(struct urb *urb)
740 {
741 struct hci_dev *hdev = urb->context;
742 struct btusb_data *data = hci_get_drvdata(hdev);
743 int err;
744
745 BT_DBG("%s urb %p status %d count %d", hdev->name, urb, urb->status,
746 urb->actual_length);
747
748 if (!test_bit(HCI_RUNNING, &hdev->flags))
749 return;
750
751 if (urb->status == 0) {
752 hdev->stat.byte_rx += urb->actual_length;
753
754 if (data->recv_bulk(data, urb->transfer_buffer,
755 urb->actual_length) < 0) {
756 bt_dev_err(hdev, "corrupted ACL packet");
757 hdev->stat.err_rx++;
758 }
759 } else if (urb->status == -ENOENT) {
760 /* Avoid suspend failed when usb_kill_urb */
761 return;
762 }
763
764 if (!test_bit(BTUSB_BULK_RUNNING, &data->flags))
765 return;
766
767 usb_anchor_urb(urb, &data->bulk_anchor);
768 usb_mark_last_busy(data->udev);
769
770 err = usb_submit_urb(urb, GFP_ATOMIC);
771 if (err < 0) {
772 /* -EPERM: urb is being killed;
773 * -ENODEV: device got disconnected
774 */
775 if (err != -EPERM && err != -ENODEV)
776 bt_dev_err(hdev, "urb %p failed to resubmit (%d)",
777 urb, -err);
778 usb_unanchor_urb(urb);
779 }
780 }
781
782 static int btusb_submit_bulk_urb(struct hci_dev *hdev, gfp_t mem_flags)
783 {
784 struct btusb_data *data = hci_get_drvdata(hdev);
785 struct urb *urb;
786 unsigned char *buf;
787 unsigned int pipe;
788 int err, size = HCI_MAX_FRAME_SIZE;
789
790 BT_DBG("%s", hdev->name);
791
792 if (!data->bulk_rx_ep)
793 return -ENODEV;
794
795 urb = usb_alloc_urb(0, mem_flags);
796 if (!urb)
797 return -ENOMEM;
798
799 buf = kmalloc(size, mem_flags);
800 if (!buf) {
801 usb_free_urb(urb);
802 return -ENOMEM;
803 }
804
805 pipe = usb_rcvbulkpipe(data->udev, data->bulk_rx_ep->bEndpointAddress);
806
807 usb_fill_bulk_urb(urb, data->udev, pipe, buf, size,
808 btusb_bulk_complete, hdev);
809
810 urb->transfer_flags |= URB_FREE_BUFFER;
811
812 usb_mark_last_busy(data->udev);
813 usb_anchor_urb(urb, &data->bulk_anchor);
814
815 err = usb_submit_urb(urb, mem_flags);
816 if (err < 0) {
817 if (err != -EPERM && err != -ENODEV)
818 bt_dev_err(hdev, "urb %p submission failed (%d)",
819 urb, -err);
820 usb_unanchor_urb(urb);
821 }
822
823 usb_free_urb(urb);
824
825 return err;
826 }
827
828 static void btusb_isoc_complete(struct urb *urb)
829 {
830 struct hci_dev *hdev = urb->context;
831 struct btusb_data *data = hci_get_drvdata(hdev);
832 int i, err;
833
834 BT_DBG("%s urb %p status %d count %d", hdev->name, urb, urb->status,
835 urb->actual_length);
836
837 if (!test_bit(HCI_RUNNING, &hdev->flags))
838 return;
839
840 if (urb->status == 0) {
841 for (i = 0; i < urb->number_of_packets; i++) {
842 unsigned int offset = urb->iso_frame_desc[i].offset;
843 unsigned int length = urb->iso_frame_desc[i].actual_length;
844
845 if (urb->iso_frame_desc[i].status)
846 continue;
847
848 hdev->stat.byte_rx += length;
849
850 if (btusb_recv_isoc(data, urb->transfer_buffer + offset,
851 length) < 0) {
852 bt_dev_err(hdev, "corrupted SCO packet");
853 hdev->stat.err_rx++;
854 }
855 }
856 } else if (urb->status == -ENOENT) {
857 /* Avoid suspend failed when usb_kill_urb */
858 return;
859 }
860
861 if (!test_bit(BTUSB_ISOC_RUNNING, &data->flags))
862 return;
863
864 usb_anchor_urb(urb, &data->isoc_anchor);
865
866 err = usb_submit_urb(urb, GFP_ATOMIC);
867 if (err < 0) {
868 /* -EPERM: urb is being killed;
869 * -ENODEV: device got disconnected
870 */
871 if (err != -EPERM && err != -ENODEV)
872 bt_dev_err(hdev, "urb %p failed to resubmit (%d)",
873 urb, -err);
874 usb_unanchor_urb(urb);
875 }
876 }
877
878 static inline void __fill_isoc_descriptor(struct urb *urb, int len, int mtu)
879 {
880 int i, offset = 0;
881
882 BT_DBG("len %d mtu %d", len, mtu);
883
884 for (i = 0; i < BTUSB_MAX_ISOC_FRAMES && len >= mtu;
885 i++, offset += mtu, len -= mtu) {
886 urb->iso_frame_desc[i].offset = offset;
887 urb->iso_frame_desc[i].length = mtu;
888 }
889
890 if (len && i < BTUSB_MAX_ISOC_FRAMES) {
891 urb->iso_frame_desc[i].offset = offset;
892 urb->iso_frame_desc[i].length = len;
893 i++;
894 }
895
896 urb->number_of_packets = i;
897 }
898
899 static int btusb_submit_isoc_urb(struct hci_dev *hdev, gfp_t mem_flags)
900 {
901 struct btusb_data *data = hci_get_drvdata(hdev);
902 struct urb *urb;
903 unsigned char *buf;
904 unsigned int pipe;
905 int err, size;
906
907 BT_DBG("%s", hdev->name);
908
909 if (!data->isoc_rx_ep)
910 return -ENODEV;
911
912 urb = usb_alloc_urb(BTUSB_MAX_ISOC_FRAMES, mem_flags);
913 if (!urb)
914 return -ENOMEM;
915
916 size = le16_to_cpu(data->isoc_rx_ep->wMaxPacketSize) *
917 BTUSB_MAX_ISOC_FRAMES;
918
919 buf = kmalloc(size, mem_flags);
920 if (!buf) {
921 usb_free_urb(urb);
922 return -ENOMEM;
923 }
924
925 pipe = usb_rcvisocpipe(data->udev, data->isoc_rx_ep->bEndpointAddress);
926
927 usb_fill_int_urb(urb, data->udev, pipe, buf, size, btusb_isoc_complete,
928 hdev, data->isoc_rx_ep->bInterval);
929
930 urb->transfer_flags = URB_FREE_BUFFER | URB_ISO_ASAP;
931
932 __fill_isoc_descriptor(urb, size,
933 le16_to_cpu(data->isoc_rx_ep->wMaxPacketSize));
934
935 usb_anchor_urb(urb, &data->isoc_anchor);
936
937 err = usb_submit_urb(urb, mem_flags);
938 if (err < 0) {
939 if (err != -EPERM && err != -ENODEV)
940 bt_dev_err(hdev, "urb %p submission failed (%d)",
941 urb, -err);
942 usb_unanchor_urb(urb);
943 }
944
945 usb_free_urb(urb);
946
947 return err;
948 }
949
950 static void btusb_diag_complete(struct urb *urb)
951 {
952 struct hci_dev *hdev = urb->context;
953 struct btusb_data *data = hci_get_drvdata(hdev);
954 int err;
955
956 BT_DBG("%s urb %p status %d count %d", hdev->name, urb, urb->status,
957 urb->actual_length);
958
959 if (urb->status == 0) {
960 struct sk_buff *skb;
961
962 skb = bt_skb_alloc(urb->actual_length, GFP_ATOMIC);
963 if (skb) {
964 skb_put_data(skb, urb->transfer_buffer,
965 urb->actual_length);
966 hci_recv_diag(hdev, skb);
967 }
968 } else if (urb->status == -ENOENT) {
969 /* Avoid suspend failed when usb_kill_urb */
970 return;
971 }
972
973 if (!test_bit(BTUSB_DIAG_RUNNING, &data->flags))
974 return;
975
976 usb_anchor_urb(urb, &data->diag_anchor);
977 usb_mark_last_busy(data->udev);
978
979 err = usb_submit_urb(urb, GFP_ATOMIC);
980 if (err < 0) {
981 /* -EPERM: urb is being killed;
982 * -ENODEV: device got disconnected
983 */
984 if (err != -EPERM && err != -ENODEV)
985 bt_dev_err(hdev, "urb %p failed to resubmit (%d)",
986 urb, -err);
987 usb_unanchor_urb(urb);
988 }
989 }
990
991 static int btusb_submit_diag_urb(struct hci_dev *hdev, gfp_t mem_flags)
992 {
993 struct btusb_data *data = hci_get_drvdata(hdev);
994 struct urb *urb;
995 unsigned char *buf;
996 unsigned int pipe;
997 int err, size = HCI_MAX_FRAME_SIZE;
998
999 BT_DBG("%s", hdev->name);
1000
1001 if (!data->diag_rx_ep)
1002 return -ENODEV;
1003
1004 urb = usb_alloc_urb(0, mem_flags);
1005 if (!urb)
1006 return -ENOMEM;
1007
1008 buf = kmalloc(size, mem_flags);
1009 if (!buf) {
1010 usb_free_urb(urb);
1011 return -ENOMEM;
1012 }
1013
1014 pipe = usb_rcvbulkpipe(data->udev, data->diag_rx_ep->bEndpointAddress);
1015
1016 usb_fill_bulk_urb(urb, data->udev, pipe, buf, size,
1017 btusb_diag_complete, hdev);
1018
1019 urb->transfer_flags |= URB_FREE_BUFFER;
1020
1021 usb_mark_last_busy(data->udev);
1022 usb_anchor_urb(urb, &data->diag_anchor);
1023
1024 err = usb_submit_urb(urb, mem_flags);
1025 if (err < 0) {
1026 if (err != -EPERM && err != -ENODEV)
1027 bt_dev_err(hdev, "urb %p submission failed (%d)",
1028 urb, -err);
1029 usb_unanchor_urb(urb);
1030 }
1031
1032 usb_free_urb(urb);
1033
1034 return err;
1035 }
1036
1037 static void btusb_tx_complete(struct urb *urb)
1038 {
1039 struct sk_buff *skb = urb->context;
1040 struct hci_dev *hdev = (struct hci_dev *)skb->dev;
1041 struct btusb_data *data = hci_get_drvdata(hdev);
1042
1043 BT_DBG("%s urb %p status %d count %d", hdev->name, urb, urb->status,
1044 urb->actual_length);
1045
1046 if (!test_bit(HCI_RUNNING, &hdev->flags))
1047 goto done;
1048
1049 if (!urb->status)
1050 hdev->stat.byte_tx += urb->transfer_buffer_length;
1051 else
1052 hdev->stat.err_tx++;
1053
1054 done:
1055 spin_lock(&data->txlock);
1056 data->tx_in_flight--;
1057 spin_unlock(&data->txlock);
1058
1059 kfree(urb->setup_packet);
1060
1061 kfree_skb(skb);
1062 }
1063
1064 static void btusb_isoc_tx_complete(struct urb *urb)
1065 {
1066 struct sk_buff *skb = urb->context;
1067 struct hci_dev *hdev = (struct hci_dev *)skb->dev;
1068
1069 BT_DBG("%s urb %p status %d count %d", hdev->name, urb, urb->status,
1070 urb->actual_length);
1071
1072 if (!test_bit(HCI_RUNNING, &hdev->flags))
1073 goto done;
1074
1075 if (!urb->status)
1076 hdev->stat.byte_tx += urb->transfer_buffer_length;
1077 else
1078 hdev->stat.err_tx++;
1079
1080 done:
1081 kfree(urb->setup_packet);
1082
1083 kfree_skb(skb);
1084 }
1085
1086 static int btusb_open(struct hci_dev *hdev)
1087 {
1088 struct btusb_data *data = hci_get_drvdata(hdev);
1089 int err;
1090
1091 BT_DBG("%s", hdev->name);
1092
1093 err = usb_autopm_get_interface(data->intf);
1094 if (err < 0)
1095 return err;
1096
1097 /* Patching USB firmware files prior to starting any URBs of HCI path
1098 * It is more safe to use USB bulk channel for downloading USB patch
1099 */
1100 if (data->setup_on_usb) {
1101 err = data->setup_on_usb(hdev);
1102 if (err < 0)
1103 return err;
1104 }
1105
1106 data->intf->needs_remote_wakeup = 1;
1107 /* device specific wakeup source enabled and required for USB
1108 * remote wakeup while host is suspended
1109 */
1110 device_wakeup_enable(&data->udev->dev);
1111
1112 if (test_and_set_bit(BTUSB_INTR_RUNNING, &data->flags))
1113 goto done;
1114
1115 err = btusb_submit_intr_urb(hdev, GFP_KERNEL);
1116 if (err < 0)
1117 goto failed;
1118
1119 err = btusb_submit_bulk_urb(hdev, GFP_KERNEL);
1120 if (err < 0) {
1121 usb_kill_anchored_urbs(&data->intr_anchor);
1122 goto failed;
1123 }
1124
1125 set_bit(BTUSB_BULK_RUNNING, &data->flags);
1126 btusb_submit_bulk_urb(hdev, GFP_KERNEL);
1127
1128 if (data->diag) {
1129 if (!btusb_submit_diag_urb(hdev, GFP_KERNEL))
1130 set_bit(BTUSB_DIAG_RUNNING, &data->flags);
1131 }
1132
1133 done:
1134 usb_autopm_put_interface(data->intf);
1135 return 0;
1136
1137 failed:
1138 clear_bit(BTUSB_INTR_RUNNING, &data->flags);
1139 usb_autopm_put_interface(data->intf);
1140 return err;
1141 }
1142
1143 static void btusb_stop_traffic(struct btusb_data *data)
1144 {
1145 usb_kill_anchored_urbs(&data->intr_anchor);
1146 usb_kill_anchored_urbs(&data->bulk_anchor);
1147 usb_kill_anchored_urbs(&data->isoc_anchor);
1148 usb_kill_anchored_urbs(&data->diag_anchor);
1149 }
1150
1151 static int btusb_close(struct hci_dev *hdev)
1152 {
1153 struct btusb_data *data = hci_get_drvdata(hdev);
1154 int err;
1155
1156 BT_DBG("%s", hdev->name);
1157
1158 cancel_work_sync(&data->work);
1159 cancel_work_sync(&data->waker);
1160
1161 clear_bit(BTUSB_ISOC_RUNNING, &data->flags);
1162 clear_bit(BTUSB_BULK_RUNNING, &data->flags);
1163 clear_bit(BTUSB_INTR_RUNNING, &data->flags);
1164 clear_bit(BTUSB_DIAG_RUNNING, &data->flags);
1165
1166 btusb_stop_traffic(data);
1167 btusb_free_frags(data);
1168
1169 err = usb_autopm_get_interface(data->intf);
1170 if (err < 0)
1171 goto failed;
1172
1173 data->intf->needs_remote_wakeup = 0;
1174 device_wakeup_disable(&data->udev->dev);
1175 usb_autopm_put_interface(data->intf);
1176
1177 failed:
1178 usb_scuttle_anchored_urbs(&data->deferred);
1179 return 0;
1180 }
1181
1182 static int btusb_flush(struct hci_dev *hdev)
1183 {
1184 struct btusb_data *data = hci_get_drvdata(hdev);
1185
1186 BT_DBG("%s", hdev->name);
1187
1188 usb_kill_anchored_urbs(&data->tx_anchor);
1189 btusb_free_frags(data);
1190
1191 return 0;
1192 }
1193
1194 static struct urb *alloc_ctrl_urb(struct hci_dev *hdev, struct sk_buff *skb)
1195 {
1196 struct btusb_data *data = hci_get_drvdata(hdev);
1197 struct usb_ctrlrequest *dr;
1198 struct urb *urb;
1199 unsigned int pipe;
1200
1201 urb = usb_alloc_urb(0, GFP_KERNEL);
1202 if (!urb)
1203 return ERR_PTR(-ENOMEM);
1204
1205 dr = kmalloc(sizeof(*dr), GFP_KERNEL);
1206 if (!dr) {
1207 usb_free_urb(urb);
1208 return ERR_PTR(-ENOMEM);
1209 }
1210
1211 dr->bRequestType = data->cmdreq_type;
1212 dr->bRequest = data->cmdreq;
1213 dr->wIndex = 0;
1214 dr->wValue = 0;
1215 dr->wLength = __cpu_to_le16(skb->len);
1216
1217 pipe = usb_sndctrlpipe(data->udev, 0x00);
1218
1219 usb_fill_control_urb(urb, data->udev, pipe, (void *)dr,
1220 skb->data, skb->len, btusb_tx_complete, skb);
1221
1222 skb->dev = (void *)hdev;
1223
1224 return urb;
1225 }
1226
1227 static struct urb *alloc_bulk_urb(struct hci_dev *hdev, struct sk_buff *skb)
1228 {
1229 struct btusb_data *data = hci_get_drvdata(hdev);
1230 struct urb *urb;
1231 unsigned int pipe;
1232
1233 if (!data->bulk_tx_ep)
1234 return ERR_PTR(-ENODEV);
1235
1236 urb = usb_alloc_urb(0, GFP_KERNEL);
1237 if (!urb)
1238 return ERR_PTR(-ENOMEM);
1239
1240 pipe = usb_sndbulkpipe(data->udev, data->bulk_tx_ep->bEndpointAddress);
1241
1242 usb_fill_bulk_urb(urb, data->udev, pipe,
1243 skb->data, skb->len, btusb_tx_complete, skb);
1244
1245 skb->dev = (void *)hdev;
1246
1247 return urb;
1248 }
1249
1250 static struct urb *alloc_isoc_urb(struct hci_dev *hdev, struct sk_buff *skb)
1251 {
1252 struct btusb_data *data = hci_get_drvdata(hdev);
1253 struct urb *urb;
1254 unsigned int pipe;
1255
1256 if (!data->isoc_tx_ep)
1257 return ERR_PTR(-ENODEV);
1258
1259 urb = usb_alloc_urb(BTUSB_MAX_ISOC_FRAMES, GFP_KERNEL);
1260 if (!urb)
1261 return ERR_PTR(-ENOMEM);
1262
1263 pipe = usb_sndisocpipe(data->udev, data->isoc_tx_ep->bEndpointAddress);
1264
1265 usb_fill_int_urb(urb, data->udev, pipe,
1266 skb->data, skb->len, btusb_isoc_tx_complete,
1267 skb, data->isoc_tx_ep->bInterval);
1268
1269 urb->transfer_flags = URB_ISO_ASAP;
1270
1271 __fill_isoc_descriptor(urb, skb->len,
1272 le16_to_cpu(data->isoc_tx_ep->wMaxPacketSize));
1273
1274 skb->dev = (void *)hdev;
1275
1276 return urb;
1277 }
1278
1279 static int submit_tx_urb(struct hci_dev *hdev, struct urb *urb)
1280 {
1281 struct btusb_data *data = hci_get_drvdata(hdev);
1282 int err;
1283
1284 usb_anchor_urb(urb, &data->tx_anchor);
1285
1286 err = usb_submit_urb(urb, GFP_KERNEL);
1287 if (err < 0) {
1288 if (err != -EPERM && err != -ENODEV)
1289 bt_dev_err(hdev, "urb %p submission failed (%d)",
1290 urb, -err);
1291 kfree(urb->setup_packet);
1292 usb_unanchor_urb(urb);
1293 } else {
1294 usb_mark_last_busy(data->udev);
1295 }
1296
1297 usb_free_urb(urb);
1298 return err;
1299 }
1300
1301 static int submit_or_queue_tx_urb(struct hci_dev *hdev, struct urb *urb)
1302 {
1303 struct btusb_data *data = hci_get_drvdata(hdev);
1304 unsigned long flags;
1305 bool suspending;
1306
1307 spin_lock_irqsave(&data->txlock, flags);
1308 suspending = test_bit(BTUSB_SUSPENDING, &data->flags);
1309 if (!suspending)
1310 data->tx_in_flight++;
1311 spin_unlock_irqrestore(&data->txlock, flags);
1312
1313 if (!suspending)
1314 return submit_tx_urb(hdev, urb);
1315
1316 usb_anchor_urb(urb, &data->deferred);
1317 schedule_work(&data->waker);
1318
1319 usb_free_urb(urb);
1320 return 0;
1321 }
1322
1323 static int btusb_send_frame(struct hci_dev *hdev, struct sk_buff *skb)
1324 {
1325 struct urb *urb;
1326
1327 BT_DBG("%s", hdev->name);
1328
1329 switch (hci_skb_pkt_type(skb)) {
1330 case HCI_COMMAND_PKT:
1331 urb = alloc_ctrl_urb(hdev, skb);
1332 if (IS_ERR(urb))
1333 return PTR_ERR(urb);
1334
1335 hdev->stat.cmd_tx++;
1336 return submit_or_queue_tx_urb(hdev, urb);
1337
1338 case HCI_ACLDATA_PKT:
1339 urb = alloc_bulk_urb(hdev, skb);
1340 if (IS_ERR(urb))
1341 return PTR_ERR(urb);
1342
1343 hdev->stat.acl_tx++;
1344 return submit_or_queue_tx_urb(hdev, urb);
1345
1346 case HCI_SCODATA_PKT:
1347 if (hci_conn_num(hdev, SCO_LINK) < 1)
1348 return -ENODEV;
1349
1350 urb = alloc_isoc_urb(hdev, skb);
1351 if (IS_ERR(urb))
1352 return PTR_ERR(urb);
1353
1354 hdev->stat.sco_tx++;
1355 return submit_tx_urb(hdev, urb);
1356 }
1357
1358 return -EILSEQ;
1359 }
1360
1361 static void btusb_notify(struct hci_dev *hdev, unsigned int evt)
1362 {
1363 struct btusb_data *data = hci_get_drvdata(hdev);
1364
1365 BT_DBG("%s evt %d", hdev->name, evt);
1366
1367 if (hci_conn_num(hdev, SCO_LINK) != data->sco_num) {
1368 data->sco_num = hci_conn_num(hdev, SCO_LINK);
1369 schedule_work(&data->work);
1370 }
1371 }
1372
1373 static inline int __set_isoc_interface(struct hci_dev *hdev, int altsetting)
1374 {
1375 struct btusb_data *data = hci_get_drvdata(hdev);
1376 struct usb_interface *intf = data->isoc;
1377 struct usb_endpoint_descriptor *ep_desc;
1378 int i, err;
1379
1380 if (!data->isoc)
1381 return -ENODEV;
1382
1383 err = usb_set_interface(data->udev, data->isoc_ifnum, altsetting);
1384 if (err < 0) {
1385 bt_dev_err(hdev, "setting interface failed (%d)", -err);
1386 return err;
1387 }
1388
1389 data->isoc_altsetting = altsetting;
1390
1391 data->isoc_tx_ep = NULL;
1392 data->isoc_rx_ep = NULL;
1393
1394 for (i = 0; i < intf->cur_altsetting->desc.bNumEndpoints; i++) {
1395 ep_desc = &intf->cur_altsetting->endpoint[i].desc;
1396
1397 if (!data->isoc_tx_ep && usb_endpoint_is_isoc_out(ep_desc)) {
1398 data->isoc_tx_ep = ep_desc;
1399 continue;
1400 }
1401
1402 if (!data->isoc_rx_ep && usb_endpoint_is_isoc_in(ep_desc)) {
1403 data->isoc_rx_ep = ep_desc;
1404 continue;
1405 }
1406 }
1407
1408 if (!data->isoc_tx_ep || !data->isoc_rx_ep) {
1409 bt_dev_err(hdev, "invalid SCO descriptors");
1410 return -ENODEV;
1411 }
1412
1413 return 0;
1414 }
1415
1416 static void btusb_work(struct work_struct *work)
1417 {
1418 struct btusb_data *data = container_of(work, struct btusb_data, work);
1419 struct hci_dev *hdev = data->hdev;
1420 int new_alts;
1421 int err;
1422
1423 if (data->sco_num > 0) {
1424 if (!test_bit(BTUSB_DID_ISO_RESUME, &data->flags)) {
1425 err = usb_autopm_get_interface(data->isoc ? data->isoc : data->intf);
1426 if (err < 0) {
1427 clear_bit(BTUSB_ISOC_RUNNING, &data->flags);
1428 usb_kill_anchored_urbs(&data->isoc_anchor);
1429 return;
1430 }
1431
1432 set_bit(BTUSB_DID_ISO_RESUME, &data->flags);
1433 }
1434
1435 if (hdev->voice_setting & 0x0020) {
1436 static const int alts[3] = { 2, 4, 5 };
1437
1438 new_alts = alts[data->sco_num - 1];
1439 } else {
1440 new_alts = data->sco_num;
1441 }
1442
1443 if (data->isoc_altsetting != new_alts) {
1444 unsigned long flags;
1445
1446 clear_bit(BTUSB_ISOC_RUNNING, &data->flags);
1447 usb_kill_anchored_urbs(&data->isoc_anchor);
1448
1449 /* When isochronous alternate setting needs to be
1450 * changed, because SCO connection has been added
1451 * or removed, a packet fragment may be left in the
1452 * reassembling state. This could lead to wrongly
1453 * assembled fragments.
1454 *
1455 * Clear outstanding fragment when selecting a new
1456 * alternate setting.
1457 */
1458 spin_lock_irqsave(&data->rxlock, flags);
1459 kfree_skb(data->sco_skb);
1460 data->sco_skb = NULL;
1461 spin_unlock_irqrestore(&data->rxlock, flags);
1462
1463 if (__set_isoc_interface(hdev, new_alts) < 0)
1464 return;
1465 }
1466
1467 if (!test_and_set_bit(BTUSB_ISOC_RUNNING, &data->flags)) {
1468 if (btusb_submit_isoc_urb(hdev, GFP_KERNEL) < 0)
1469 clear_bit(BTUSB_ISOC_RUNNING, &data->flags);
1470 else
1471 btusb_submit_isoc_urb(hdev, GFP_KERNEL);
1472 }
1473 } else {
1474 clear_bit(BTUSB_ISOC_RUNNING, &data->flags);
1475 usb_kill_anchored_urbs(&data->isoc_anchor);
1476
1477 __set_isoc_interface(hdev, 0);
1478 if (test_and_clear_bit(BTUSB_DID_ISO_RESUME, &data->flags))
1479 usb_autopm_put_interface(data->isoc ? data->isoc : data->intf);
1480 }
1481 }
1482
1483 static void btusb_waker(struct work_struct *work)
1484 {
1485 struct btusb_data *data = container_of(work, struct btusb_data, waker);
1486 int err;
1487
1488 err = usb_autopm_get_interface(data->intf);
1489 if (err < 0)
1490 return;
1491
1492 usb_autopm_put_interface(data->intf);
1493 }
1494
1495 static int btusb_setup_bcm92035(struct hci_dev *hdev)
1496 {
1497 struct sk_buff *skb;
1498 u8 val = 0x00;
1499
1500 BT_DBG("%s", hdev->name);
1501
1502 skb = __hci_cmd_sync(hdev, 0xfc3b, 1, &val, HCI_INIT_TIMEOUT);
1503 if (IS_ERR(skb))
1504 bt_dev_err(hdev, "BCM92035 command failed (%ld)", PTR_ERR(skb));
1505 else
1506 kfree_skb(skb);
1507
1508 return 0;
1509 }
1510
1511 static int btusb_setup_csr(struct hci_dev *hdev)
1512 {
1513 struct hci_rp_read_local_version *rp;
1514 struct sk_buff *skb;
1515
1516 BT_DBG("%s", hdev->name);
1517
1518 skb = __hci_cmd_sync(hdev, HCI_OP_READ_LOCAL_VERSION, 0, NULL,
1519 HCI_INIT_TIMEOUT);
1520 if (IS_ERR(skb)) {
1521 int err = PTR_ERR(skb);
1522 bt_dev_err(hdev, "CSR: Local version failed (%d)", err);
1523 return err;
1524 }
1525
1526 if (skb->len != sizeof(struct hci_rp_read_local_version)) {
1527 bt_dev_err(hdev, "CSR: Local version length mismatch");
1528 kfree_skb(skb);
1529 return -EIO;
1530 }
1531
1532 rp = (struct hci_rp_read_local_version *)skb->data;
1533
1534 /* Detect controllers which aren't real CSR ones. */
1535 if (le16_to_cpu(rp->manufacturer) != 10 ||
1536 le16_to_cpu(rp->lmp_subver) == 0x0c5c) {
1537 /* Clear the reset quirk since this is not an actual
1538 * early Bluetooth 1.1 device from CSR.
1539 */
1540 clear_bit(HCI_QUIRK_RESET_ON_CLOSE, &hdev->quirks);
1541
1542 /* These fake CSR controllers have all a broken
1543 * stored link key handling and so just disable it.
1544 */
1545 set_bit(HCI_QUIRK_BROKEN_STORED_LINK_KEY, &hdev->quirks);
1546 }
1547
1548 kfree_skb(skb);
1549
1550 return 0;
1551 }
1552
1553 static const struct firmware *btusb_setup_intel_get_fw(struct hci_dev *hdev,
1554 struct intel_version *ver)
1555 {
1556 const struct firmware *fw;
1557 char fwname[64];
1558 int ret;
1559
1560 snprintf(fwname, sizeof(fwname),
1561 "intel/ibt-hw-%x.%x.%x-fw-%x.%x.%x.%x.%x.bseq",
1562 ver->hw_platform, ver->hw_variant, ver->hw_revision,
1563 ver->fw_variant, ver->fw_revision, ver->fw_build_num,
1564 ver->fw_build_ww, ver->fw_build_yy);
1565
1566 ret = request_firmware(&fw, fwname, &hdev->dev);
1567 if (ret < 0) {
1568 if (ret == -EINVAL) {
1569 BT_ERR("%s Intel firmware file request failed (%d)",
1570 hdev->name, ret);
1571 return NULL;
1572 }
1573
1574 BT_ERR("%s failed to open Intel firmware file: %s(%d)",
1575 hdev->name, fwname, ret);
1576
1577 /* If the correct firmware patch file is not found, use the
1578 * default firmware patch file instead
1579 */
1580 snprintf(fwname, sizeof(fwname), "intel/ibt-hw-%x.%x.bseq",
1581 ver->hw_platform, ver->hw_variant);
1582 if (request_firmware(&fw, fwname, &hdev->dev) < 0) {
1583 BT_ERR("%s failed to open default Intel fw file: %s",
1584 hdev->name, fwname);
1585 return NULL;
1586 }
1587 }
1588
1589 bt_dev_info(hdev, "Intel Bluetooth firmware file: %s", fwname);
1590
1591 return fw;
1592 }
1593
1594 static int btusb_setup_intel_patching(struct hci_dev *hdev,
1595 const struct firmware *fw,
1596 const u8 **fw_ptr, int *disable_patch)
1597 {
1598 struct sk_buff *skb;
1599 struct hci_command_hdr *cmd;
1600 const u8 *cmd_param;
1601 struct hci_event_hdr *evt = NULL;
1602 const u8 *evt_param = NULL;
1603 int remain = fw->size - (*fw_ptr - fw->data);
1604
1605 /* The first byte indicates the types of the patch command or event.
1606 * 0x01 means HCI command and 0x02 is HCI event. If the first bytes
1607 * in the current firmware buffer doesn't start with 0x01 or
1608 * the size of remain buffer is smaller than HCI command header,
1609 * the firmware file is corrupted and it should stop the patching
1610 * process.
1611 */
1612 if (remain > HCI_COMMAND_HDR_SIZE && *fw_ptr[0] != 0x01) {
1613 BT_ERR("%s Intel fw corrupted: invalid cmd read", hdev->name);
1614 return -EINVAL;
1615 }
1616 (*fw_ptr)++;
1617 remain--;
1618
1619 cmd = (struct hci_command_hdr *)(*fw_ptr);
1620 *fw_ptr += sizeof(*cmd);
1621 remain -= sizeof(*cmd);
1622
1623 /* Ensure that the remain firmware data is long enough than the length
1624 * of command parameter. If not, the firmware file is corrupted.
1625 */
1626 if (remain < cmd->plen) {
1627 BT_ERR("%s Intel fw corrupted: invalid cmd len", hdev->name);
1628 return -EFAULT;
1629 }
1630
1631 /* If there is a command that loads a patch in the firmware
1632 * file, then enable the patch upon success, otherwise just
1633 * disable the manufacturer mode, for example patch activation
1634 * is not required when the default firmware patch file is used
1635 * because there are no patch data to load.
1636 */
1637 if (*disable_patch && le16_to_cpu(cmd->opcode) == 0xfc8e)
1638 *disable_patch = 0;
1639
1640 cmd_param = *fw_ptr;
1641 *fw_ptr += cmd->plen;
1642 remain -= cmd->plen;
1643
1644 /* This reads the expected events when the above command is sent to the
1645 * device. Some vendor commands expects more than one events, for
1646 * example command status event followed by vendor specific event.
1647 * For this case, it only keeps the last expected event. so the command
1648 * can be sent with __hci_cmd_sync_ev() which returns the sk_buff of
1649 * last expected event.
1650 */
1651 while (remain > HCI_EVENT_HDR_SIZE && *fw_ptr[0] == 0x02) {
1652 (*fw_ptr)++;
1653 remain--;
1654
1655 evt = (struct hci_event_hdr *)(*fw_ptr);
1656 *fw_ptr += sizeof(*evt);
1657 remain -= sizeof(*evt);
1658
1659 if (remain < evt->plen) {
1660 BT_ERR("%s Intel fw corrupted: invalid evt len",
1661 hdev->name);
1662 return -EFAULT;
1663 }
1664
1665 evt_param = *fw_ptr;
1666 *fw_ptr += evt->plen;
1667 remain -= evt->plen;
1668 }
1669
1670 /* Every HCI commands in the firmware file has its correspond event.
1671 * If event is not found or remain is smaller than zero, the firmware
1672 * file is corrupted.
1673 */
1674 if (!evt || !evt_param || remain < 0) {
1675 BT_ERR("%s Intel fw corrupted: invalid evt read", hdev->name);
1676 return -EFAULT;
1677 }
1678
1679 skb = __hci_cmd_sync_ev(hdev, le16_to_cpu(cmd->opcode), cmd->plen,
1680 cmd_param, evt->evt, HCI_INIT_TIMEOUT);
1681 if (IS_ERR(skb)) {
1682 BT_ERR("%s sending Intel patch command (0x%4.4x) failed (%ld)",
1683 hdev->name, cmd->opcode, PTR_ERR(skb));
1684 return PTR_ERR(skb);
1685 }
1686
1687 /* It ensures that the returned event matches the event data read from
1688 * the firmware file. At fist, it checks the length and then
1689 * the contents of the event.
1690 */
1691 if (skb->len != evt->plen) {
1692 BT_ERR("%s mismatch event length (opcode 0x%4.4x)", hdev->name,
1693 le16_to_cpu(cmd->opcode));
1694 kfree_skb(skb);
1695 return -EFAULT;
1696 }
1697
1698 if (memcmp(skb->data, evt_param, evt->plen)) {
1699 BT_ERR("%s mismatch event parameter (opcode 0x%4.4x)",
1700 hdev->name, le16_to_cpu(cmd->opcode));
1701 kfree_skb(skb);
1702 return -EFAULT;
1703 }
1704 kfree_skb(skb);
1705
1706 return 0;
1707 }
1708
1709 static int btusb_setup_intel(struct hci_dev *hdev)
1710 {
1711 struct sk_buff *skb;
1712 const struct firmware *fw;
1713 const u8 *fw_ptr;
1714 int disable_patch, err;
1715 struct intel_version ver;
1716
1717 BT_DBG("%s", hdev->name);
1718
1719 /* The controller has a bug with the first HCI command sent to it
1720 * returning number of completed commands as zero. This would stall the
1721 * command processing in the Bluetooth core.
1722 *
1723 * As a workaround, send HCI Reset command first which will reset the
1724 * number of completed commands and allow normal command processing
1725 * from now on.
1726 */
1727 skb = __hci_cmd_sync(hdev, HCI_OP_RESET, 0, NULL, HCI_INIT_TIMEOUT);
1728 if (IS_ERR(skb)) {
1729 BT_ERR("%s sending initial HCI reset command failed (%ld)",
1730 hdev->name, PTR_ERR(skb));
1731 return PTR_ERR(skb);
1732 }
1733 kfree_skb(skb);
1734
1735 /* Read Intel specific controller version first to allow selection of
1736 * which firmware file to load.
1737 *
1738 * The returned information are hardware variant and revision plus
1739 * firmware variant, revision and build number.
1740 */
1741 err = btintel_read_version(hdev, &ver);
1742 if (err)
1743 return err;
1744
1745 bt_dev_info(hdev, "read Intel version: %02x%02x%02x%02x%02x%02x%02x%02x%02x",
1746 ver.hw_platform, ver.hw_variant, ver.hw_revision,
1747 ver.fw_variant, ver.fw_revision, ver.fw_build_num,
1748 ver.fw_build_ww, ver.fw_build_yy, ver.fw_patch_num);
1749
1750 /* fw_patch_num indicates the version of patch the device currently
1751 * have. If there is no patch data in the device, it is always 0x00.
1752 * So, if it is other than 0x00, no need to patch the device again.
1753 */
1754 if (ver.fw_patch_num) {
1755 bt_dev_info(hdev, "Intel device is already patched. "
1756 "patch num: %02x", ver.fw_patch_num);
1757 goto complete;
1758 }
1759
1760 /* Opens the firmware patch file based on the firmware version read
1761 * from the controller. If it fails to open the matching firmware
1762 * patch file, it tries to open the default firmware patch file.
1763 * If no patch file is found, allow the device to operate without
1764 * a patch.
1765 */
1766 fw = btusb_setup_intel_get_fw(hdev, &ver);
1767 if (!fw)
1768 goto complete;
1769 fw_ptr = fw->data;
1770
1771 /* Enable the manufacturer mode of the controller.
1772 * Only while this mode is enabled, the driver can download the
1773 * firmware patch data and configuration parameters.
1774 */
1775 err = btintel_enter_mfg(hdev);
1776 if (err) {
1777 release_firmware(fw);
1778 return err;
1779 }
1780
1781 disable_patch = 1;
1782
1783 /* The firmware data file consists of list of Intel specific HCI
1784 * commands and its expected events. The first byte indicates the
1785 * type of the message, either HCI command or HCI event.
1786 *
1787 * It reads the command and its expected event from the firmware file,
1788 * and send to the controller. Once __hci_cmd_sync_ev() returns,
1789 * the returned event is compared with the event read from the firmware
1790 * file and it will continue until all the messages are downloaded to
1791 * the controller.
1792 *
1793 * Once the firmware patching is completed successfully,
1794 * the manufacturer mode is disabled with reset and activating the
1795 * downloaded patch.
1796 *
1797 * If the firmware patching fails, the manufacturer mode is
1798 * disabled with reset and deactivating the patch.
1799 *
1800 * If the default patch file is used, no reset is done when disabling
1801 * the manufacturer.
1802 */
1803 while (fw->size > fw_ptr - fw->data) {
1804 int ret;
1805
1806 ret = btusb_setup_intel_patching(hdev, fw, &fw_ptr,
1807 &disable_patch);
1808 if (ret < 0)
1809 goto exit_mfg_deactivate;
1810 }
1811
1812 release_firmware(fw);
1813
1814 if (disable_patch)
1815 goto exit_mfg_disable;
1816
1817 /* Patching completed successfully and disable the manufacturer mode
1818 * with reset and activate the downloaded firmware patches.
1819 */
1820 err = btintel_exit_mfg(hdev, true, true);
1821 if (err)
1822 return err;
1823
1824 bt_dev_info(hdev, "Intel firmware patch completed and activated");
1825
1826 goto complete;
1827
1828 exit_mfg_disable:
1829 /* Disable the manufacturer mode without reset */
1830 err = btintel_exit_mfg(hdev, false, false);
1831 if (err)
1832 return err;
1833
1834 bt_dev_info(hdev, "Intel firmware patch completed");
1835
1836 goto complete;
1837
1838 exit_mfg_deactivate:
1839 release_firmware(fw);
1840
1841 /* Patching failed. Disable the manufacturer mode with reset and
1842 * deactivate the downloaded firmware patches.
1843 */
1844 err = btintel_exit_mfg(hdev, true, false);
1845 if (err)
1846 return err;
1847
1848 bt_dev_info(hdev, "Intel firmware patch completed and deactivated");
1849
1850 complete:
1851 /* Set the event mask for Intel specific vendor events. This enables
1852 * a few extra events that are useful during general operation.
1853 */
1854 btintel_set_event_mask_mfg(hdev, false);
1855
1856 btintel_check_bdaddr(hdev);
1857 return 0;
1858 }
1859
1860 static int inject_cmd_complete(struct hci_dev *hdev, __u16 opcode)
1861 {
1862 struct sk_buff *skb;
1863 struct hci_event_hdr *hdr;
1864 struct hci_ev_cmd_complete *evt;
1865
1866 skb = bt_skb_alloc(sizeof(*hdr) + sizeof(*evt) + 1, GFP_ATOMIC);
1867 if (!skb)
1868 return -ENOMEM;
1869
1870 hdr = skb_put(skb, sizeof(*hdr));
1871 hdr->evt = HCI_EV_CMD_COMPLETE;
1872 hdr->plen = sizeof(*evt) + 1;
1873
1874 evt = skb_put(skb, sizeof(*evt));
1875 evt->ncmd = 0x01;
1876 evt->opcode = cpu_to_le16(opcode);
1877
1878 skb_put_u8(skb, 0x00);
1879
1880 hci_skb_pkt_type(skb) = HCI_EVENT_PKT;
1881
1882 return hci_recv_frame(hdev, skb);
1883 }
1884
1885 static int btusb_recv_bulk_intel(struct btusb_data *data, void *buffer,
1886 int count)
1887 {
1888 /* When the device is in bootloader mode, then it can send
1889 * events via the bulk endpoint. These events are treated the
1890 * same way as the ones received from the interrupt endpoint.
1891 */
1892 if (test_bit(BTUSB_BOOTLOADER, &data->flags))
1893 return btusb_recv_intr(data, buffer, count);
1894
1895 return btusb_recv_bulk(data, buffer, count);
1896 }
1897
1898 static void btusb_intel_bootup(struct btusb_data *data, const void *ptr,
1899 unsigned int len)
1900 {
1901 const struct intel_bootup *evt = ptr;
1902
1903 if (len != sizeof(*evt))
1904 return;
1905
1906 if (test_and_clear_bit(BTUSB_BOOTING, &data->flags)) {
1907 smp_mb__after_atomic();
1908 wake_up_bit(&data->flags, BTUSB_BOOTING);
1909 }
1910 }
1911
1912 static void btusb_intel_secure_send_result(struct btusb_data *data,
1913 const void *ptr, unsigned int len)
1914 {
1915 const struct intel_secure_send_result *evt = ptr;
1916
1917 if (len != sizeof(*evt))
1918 return;
1919
1920 if (evt->result)
1921 set_bit(BTUSB_FIRMWARE_FAILED, &data->flags);
1922
1923 if (test_and_clear_bit(BTUSB_DOWNLOADING, &data->flags) &&
1924 test_bit(BTUSB_FIRMWARE_LOADED, &data->flags)) {
1925 smp_mb__after_atomic();
1926 wake_up_bit(&data->flags, BTUSB_DOWNLOADING);
1927 }
1928 }
1929
1930 static int btusb_recv_event_intel(struct hci_dev *hdev, struct sk_buff *skb)
1931 {
1932 struct btusb_data *data = hci_get_drvdata(hdev);
1933
1934 if (test_bit(BTUSB_BOOTLOADER, &data->flags)) {
1935 struct hci_event_hdr *hdr = (void *)skb->data;
1936
1937 if (skb->len > HCI_EVENT_HDR_SIZE && hdr->evt == 0xff &&
1938 hdr->plen > 0) {
1939 const void *ptr = skb->data + HCI_EVENT_HDR_SIZE + 1;
1940 unsigned int len = skb->len - HCI_EVENT_HDR_SIZE - 1;
1941
1942 switch (skb->data[2]) {
1943 case 0x02:
1944 /* When switching to the operational firmware
1945 * the device sends a vendor specific event
1946 * indicating that the bootup completed.
1947 */
1948 btusb_intel_bootup(data, ptr, len);
1949 break;
1950 case 0x06:
1951 /* When the firmware loading completes the
1952 * device sends out a vendor specific event
1953 * indicating the result of the firmware
1954 * loading.
1955 */
1956 btusb_intel_secure_send_result(data, ptr, len);
1957 break;
1958 }
1959 }
1960 }
1961
1962 return hci_recv_frame(hdev, skb);
1963 }
1964
1965 static int btusb_send_frame_intel(struct hci_dev *hdev, struct sk_buff *skb)
1966 {
1967 struct btusb_data *data = hci_get_drvdata(hdev);
1968 struct urb *urb;
1969
1970 BT_DBG("%s", hdev->name);
1971
1972 switch (hci_skb_pkt_type(skb)) {
1973 case HCI_COMMAND_PKT:
1974 if (test_bit(BTUSB_BOOTLOADER, &data->flags)) {
1975 struct hci_command_hdr *cmd = (void *)skb->data;
1976 __u16 opcode = le16_to_cpu(cmd->opcode);
1977
1978 /* When in bootloader mode and the command 0xfc09
1979 * is received, it needs to be send down the
1980 * bulk endpoint. So allocate a bulk URB instead.
1981 */
1982 if (opcode == 0xfc09)
1983 urb = alloc_bulk_urb(hdev, skb);
1984 else
1985 urb = alloc_ctrl_urb(hdev, skb);
1986
1987 /* When the 0xfc01 command is issued to boot into
1988 * the operational firmware, it will actually not
1989 * send a command complete event. To keep the flow
1990 * control working inject that event here.
1991 */
1992 if (opcode == 0xfc01)
1993 inject_cmd_complete(hdev, opcode);
1994 } else {
1995 urb = alloc_ctrl_urb(hdev, skb);
1996 }
1997 if (IS_ERR(urb))
1998 return PTR_ERR(urb);
1999
2000 hdev->stat.cmd_tx++;
2001 return submit_or_queue_tx_urb(hdev, urb);
2002
2003 case HCI_ACLDATA_PKT:
2004 urb = alloc_bulk_urb(hdev, skb);
2005 if (IS_ERR(urb))
2006 return PTR_ERR(urb);
2007
2008 hdev->stat.acl_tx++;
2009 return submit_or_queue_tx_urb(hdev, urb);
2010
2011 case HCI_SCODATA_PKT:
2012 if (hci_conn_num(hdev, SCO_LINK) < 1)
2013 return -ENODEV;
2014
2015 urb = alloc_isoc_urb(hdev, skb);
2016 if (IS_ERR(urb))
2017 return PTR_ERR(urb);
2018
2019 hdev->stat.sco_tx++;
2020 return submit_tx_urb(hdev, urb);
2021 }
2022
2023 return -EILSEQ;
2024 }
2025
2026 static int btusb_setup_intel_new(struct hci_dev *hdev)
2027 {
2028 struct btusb_data *data = hci_get_drvdata(hdev);
2029 struct intel_version ver;
2030 struct intel_boot_params params;
2031 const struct firmware *fw;
2032 u32 boot_param;
2033 char fwname[64];
2034 ktime_t calltime, delta, rettime;
2035 unsigned long long duration;
2036 int err;
2037
2038 BT_DBG("%s", hdev->name);
2039
2040 /* Set the default boot parameter to 0x0 and it is updated to
2041 * SKU specific boot parameter after reading Intel_Write_Boot_Params
2042 * command while downloading the firmware.
2043 */
2044 boot_param = 0x00000000;
2045
2046 calltime = ktime_get();
2047
2048 /* Read the Intel version information to determine if the device
2049 * is in bootloader mode or if it already has operational firmware
2050 * loaded.
2051 */
2052 err = btintel_read_version(hdev, &ver);
2053 if (err)
2054 return err;
2055
2056 /* The hardware platform number has a fixed value of 0x37 and
2057 * for now only accept this single value.
2058 */
2059 if (ver.hw_platform != 0x37) {
2060 BT_ERR("%s: Unsupported Intel hardware platform (%u)",
2061 hdev->name, ver.hw_platform);
2062 return -EINVAL;
2063 }
2064
2065 /* Check for supported iBT hardware variants of this firmware
2066 * loading method.
2067 *
2068 * This check has been put in place to ensure correct forward
2069 * compatibility options when newer hardware variants come along.
2070 */
2071 switch (ver.hw_variant) {
2072 case 0x0b: /* SfP */
2073 case 0x0c: /* WsP */
2074 case 0x11: /* JfP */
2075 case 0x12: /* ThP */
2076 break;
2077 default:
2078 BT_ERR("%s: Unsupported Intel hardware variant (%u)",
2079 hdev->name, ver.hw_variant);
2080 return -EINVAL;
2081 }
2082
2083 btintel_version_info(hdev, &ver);
2084
2085 /* The firmware variant determines if the device is in bootloader
2086 * mode or is running operational firmware. The value 0x06 identifies
2087 * the bootloader and the value 0x23 identifies the operational
2088 * firmware.
2089 *
2090 * When the operational firmware is already present, then only
2091 * the check for valid Bluetooth device address is needed. This
2092 * determines if the device will be added as configured or
2093 * unconfigured controller.
2094 *
2095 * It is not possible to use the Secure Boot Parameters in this
2096 * case since that command is only available in bootloader mode.
2097 */
2098 if (ver.fw_variant == 0x23) {
2099 clear_bit(BTUSB_BOOTLOADER, &data->flags);
2100 btintel_check_bdaddr(hdev);
2101 return 0;
2102 }
2103
2104 /* If the device is not in bootloader mode, then the only possible
2105 * choice is to return an error and abort the device initialization.
2106 */
2107 if (ver.fw_variant != 0x06) {
2108 BT_ERR("%s: Unsupported Intel firmware variant (%u)",
2109 hdev->name, ver.fw_variant);
2110 return -ENODEV;
2111 }
2112
2113 /* Read the secure boot parameters to identify the operating
2114 * details of the bootloader.
2115 */
2116 err = btintel_read_boot_params(hdev, &params);
2117 if (err)
2118 return err;
2119
2120 /* It is required that every single firmware fragment is acknowledged
2121 * with a command complete event. If the boot parameters indicate
2122 * that this bootloader does not send them, then abort the setup.
2123 */
2124 if (params.limited_cce != 0x00) {
2125 BT_ERR("%s: Unsupported Intel firmware loading method (%u)",
2126 hdev->name, params.limited_cce);
2127 return -EINVAL;
2128 }
2129
2130 /* If the OTP has no valid Bluetooth device address, then there will
2131 * also be no valid address for the operational firmware.
2132 */
2133 if (!bacmp(&params.otp_bdaddr, BDADDR_ANY)) {
2134 bt_dev_info(hdev, "No device address configured");
2135 set_bit(HCI_QUIRK_INVALID_BDADDR, &hdev->quirks);
2136 }
2137
2138 /* With this Intel bootloader only the hardware variant and device
2139 * revision information are used to select the right firmware for SfP
2140 * and WsP.
2141 *
2142 * The firmware filename is ibt-<hw_variant>-<dev_revid>.sfi.
2143 *
2144 * Currently the supported hardware variants are:
2145 * 11 (0x0b) for iBT3.0 (LnP/SfP)
2146 * 12 (0x0c) for iBT3.5 (WsP)
2147 *
2148 * For ThP/JfP and for future SKU's, the FW name varies based on HW
2149 * variant, HW revision and FW revision, as these are dependent on CNVi
2150 * and RF Combination.
2151 *
2152 * 17 (0x11) for iBT3.5 (JfP)
2153 * 18 (0x12) for iBT3.5 (ThP)
2154 *
2155 * The firmware file name for these will be
2156 * ibt-<hw_variant>-<hw_revision>-<fw_revision>.sfi.
2157 *
2158 */
2159 switch (ver.hw_variant) {
2160 case 0x0b: /* SfP */
2161 case 0x0c: /* WsP */
2162 snprintf(fwname, sizeof(fwname), "intel/ibt-%u-%u.sfi",
2163 le16_to_cpu(ver.hw_variant),
2164 le16_to_cpu(params.dev_revid));
2165 break;
2166 case 0x11: /* JfP */
2167 case 0x12: /* ThP */
2168 snprintf(fwname, sizeof(fwname), "intel/ibt-%u-%u-%u.sfi",
2169 le16_to_cpu(ver.hw_variant),
2170 le16_to_cpu(ver.hw_revision),
2171 le16_to_cpu(ver.fw_revision));
2172 break;
2173 default:
2174 BT_ERR("%s: Unsupported Intel firmware naming", hdev->name);
2175 return -EINVAL;
2176 }
2177
2178 err = request_firmware(&fw, fwname, &hdev->dev);
2179 if (err < 0) {
2180 BT_ERR("%s: Failed to load Intel firmware file (%d)",
2181 hdev->name, err);
2182 return err;
2183 }
2184
2185 bt_dev_info(hdev, "Found device firmware: %s", fwname);
2186
2187 /* Save the DDC file name for later use to apply once the firmware
2188 * downloading is done.
2189 */
2190 switch (ver.hw_variant) {
2191 case 0x0b: /* SfP */
2192 case 0x0c: /* WsP */
2193 snprintf(fwname, sizeof(fwname), "intel/ibt-%u-%u.ddc",
2194 le16_to_cpu(ver.hw_variant),
2195 le16_to_cpu(params.dev_revid));
2196 break;
2197 case 0x11: /* JfP */
2198 case 0x12: /* ThP */
2199 snprintf(fwname, sizeof(fwname), "intel/ibt-%u-%u-%u.ddc",
2200 le16_to_cpu(ver.hw_variant),
2201 le16_to_cpu(ver.hw_revision),
2202 le16_to_cpu(ver.fw_revision));
2203 break;
2204 default:
2205 BT_ERR("%s: Unsupported Intel firmware naming", hdev->name);
2206 return -EINVAL;
2207 }
2208
2209 if (fw->size < 644) {
2210 BT_ERR("%s: Invalid size of firmware file (%zu)",
2211 hdev->name, fw->size);
2212 err = -EBADF;
2213 goto done;
2214 }
2215
2216 set_bit(BTUSB_DOWNLOADING, &data->flags);
2217
2218 /* Start firmware downloading and get boot parameter */
2219 err = btintel_download_firmware(hdev, fw, &boot_param);
2220 if (err < 0)
2221 goto done;
2222
2223 set_bit(BTUSB_FIRMWARE_LOADED, &data->flags);
2224
2225 bt_dev_info(hdev, "Waiting for firmware download to complete");
2226
2227 /* Before switching the device into operational mode and with that
2228 * booting the loaded firmware, wait for the bootloader notification
2229 * that all fragments have been successfully received.
2230 *
2231 * When the event processing receives the notification, then the
2232 * BTUSB_DOWNLOADING flag will be cleared.
2233 *
2234 * The firmware loading should not take longer than 5 seconds
2235 * and thus just timeout if that happens and fail the setup
2236 * of this device.
2237 */
2238 err = wait_on_bit_timeout(&data->flags, BTUSB_DOWNLOADING,
2239 TASK_INTERRUPTIBLE,
2240 msecs_to_jiffies(5000));
2241 if (err == -EINTR) {
2242 BT_ERR("%s: Firmware loading interrupted", hdev->name);
2243 goto done;
2244 }
2245
2246 if (err) {
2247 BT_ERR("%s: Firmware loading timeout", hdev->name);
2248 err = -ETIMEDOUT;
2249 goto done;
2250 }
2251
2252 if (test_bit(BTUSB_FIRMWARE_FAILED, &data->flags)) {
2253 BT_ERR("%s: Firmware loading failed", hdev->name);
2254 err = -ENOEXEC;
2255 goto done;
2256 }
2257
2258 rettime = ktime_get();
2259 delta = ktime_sub(rettime, calltime);
2260 duration = (unsigned long long) ktime_to_ns(delta) >> 10;
2261
2262 bt_dev_info(hdev, "Firmware loaded in %llu usecs", duration);
2263
2264 done:
2265 release_firmware(fw);
2266
2267 if (err < 0)
2268 return err;
2269
2270 calltime = ktime_get();
2271
2272 set_bit(BTUSB_BOOTING, &data->flags);
2273
2274 err = btintel_send_intel_reset(hdev, boot_param);
2275 if (err)
2276 return err;
2277
2278 /* The bootloader will not indicate when the device is ready. This
2279 * is done by the operational firmware sending bootup notification.
2280 *
2281 * Booting into operational firmware should not take longer than
2282 * 1 second. However if that happens, then just fail the setup
2283 * since something went wrong.
2284 */
2285 bt_dev_info(hdev, "Waiting for device to boot");
2286
2287 err = wait_on_bit_timeout(&data->flags, BTUSB_BOOTING,
2288 TASK_INTERRUPTIBLE,
2289 msecs_to_jiffies(1000));
2290
2291 if (err == -EINTR) {
2292 BT_ERR("%s: Device boot interrupted", hdev->name);
2293 return -EINTR;
2294 }
2295
2296 if (err) {
2297 BT_ERR("%s: Device boot timeout", hdev->name);
2298 return -ETIMEDOUT;
2299 }
2300
2301 rettime = ktime_get();
2302 delta = ktime_sub(rettime, calltime);
2303 duration = (unsigned long long) ktime_to_ns(delta) >> 10;
2304
2305 bt_dev_info(hdev, "Device booted in %llu usecs", duration);
2306
2307 clear_bit(BTUSB_BOOTLOADER, &data->flags);
2308
2309 /* Once the device is running in operational mode, it needs to apply
2310 * the device configuration (DDC) parameters.
2311 *
2312 * The device can work without DDC parameters, so even if it fails
2313 * to load the file, no need to fail the setup.
2314 */
2315 btintel_load_ddc_config(hdev, fwname);
2316
2317 /* Set the event mask for Intel specific vendor events. This enables
2318 * a few extra events that are useful during general operation. It
2319 * does not enable any debugging related events.
2320 *
2321 * The device will function correctly without these events enabled
2322 * and thus no need to fail the setup.
2323 */
2324 btintel_set_event_mask(hdev, false);
2325
2326 return 0;
2327 }
2328
2329 static int btusb_shutdown_intel(struct hci_dev *hdev)
2330 {
2331 struct sk_buff *skb;
2332 long ret;
2333
2334 /* Some platforms have an issue with BT LED when the interface is
2335 * down or BT radio is turned off, which takes 5 seconds to BT LED
2336 * goes off. This command turns off the BT LED immediately.
2337 */
2338 skb = __hci_cmd_sync(hdev, 0xfc3f, 0, NULL, HCI_INIT_TIMEOUT);
2339 if (IS_ERR(skb)) {
2340 ret = PTR_ERR(skb);
2341 BT_ERR("%s: turning off Intel device LED failed (%ld)",
2342 hdev->name, ret);
2343 return ret;
2344 }
2345 kfree_skb(skb);
2346
2347 return 0;
2348 }
2349
2350 #ifdef CONFIG_PM
2351 /* Configure an out-of-band gpio as wake-up pin, if specified in device tree */
2352 static int marvell_config_oob_wake(struct hci_dev *hdev)
2353 {
2354 struct sk_buff *skb;
2355 struct btusb_data *data = hci_get_drvdata(hdev);
2356 struct device *dev = &data->udev->dev;
2357 u16 pin, gap, opcode;
2358 int ret;
2359 u8 cmd[5];
2360
2361 /* Move on if no wakeup pin specified */
2362 if (of_property_read_u16(dev->of_node, "marvell,wakeup-pin", &pin) ||
2363 of_property_read_u16(dev->of_node, "marvell,wakeup-gap-ms", &gap))
2364 return 0;
2365
2366 /* Vendor specific command to configure a GPIO as wake-up pin */
2367 opcode = hci_opcode_pack(0x3F, 0x59);
2368 cmd[0] = opcode & 0xFF;
2369 cmd[1] = opcode >> 8;
2370 cmd[2] = 2; /* length of parameters that follow */
2371 cmd[3] = pin;
2372 cmd[4] = gap; /* time in ms, for which wakeup pin should be asserted */
2373
2374 skb = bt_skb_alloc(sizeof(cmd), GFP_KERNEL);
2375 if (!skb) {
2376 bt_dev_err(hdev, "%s: No memory\n", __func__);
2377 return -ENOMEM;
2378 }
2379
2380 skb_put_data(skb, cmd, sizeof(cmd));
2381 hci_skb_pkt_type(skb) = HCI_COMMAND_PKT;
2382
2383 ret = btusb_send_frame(hdev, skb);
2384 if (ret) {
2385 bt_dev_err(hdev, "%s: configuration failed\n", __func__);
2386 kfree_skb(skb);
2387 return ret;
2388 }
2389
2390 return 0;
2391 }
2392 #endif
2393
2394 static int btusb_set_bdaddr_marvell(struct hci_dev *hdev,
2395 const bdaddr_t *bdaddr)
2396 {
2397 struct sk_buff *skb;
2398 u8 buf[8];
2399 long ret;
2400
2401 buf[0] = 0xfe;
2402 buf[1] = sizeof(bdaddr_t);
2403 memcpy(buf + 2, bdaddr, sizeof(bdaddr_t));
2404
2405 skb = __hci_cmd_sync(hdev, 0xfc22, sizeof(buf), buf, HCI_INIT_TIMEOUT);
2406 if (IS_ERR(skb)) {
2407 ret = PTR_ERR(skb);
2408 bt_dev_err(hdev, "changing Marvell device address failed (%ld)",
2409 ret);
2410 return ret;
2411 }
2412 kfree_skb(skb);
2413
2414 return 0;
2415 }
2416
2417 static int btusb_set_bdaddr_ath3012(struct hci_dev *hdev,
2418 const bdaddr_t *bdaddr)
2419 {
2420 struct sk_buff *skb;
2421 u8 buf[10];
2422 long ret;
2423
2424 buf[0] = 0x01;
2425 buf[1] = 0x01;
2426 buf[2] = 0x00;
2427 buf[3] = sizeof(bdaddr_t);
2428 memcpy(buf + 4, bdaddr, sizeof(bdaddr_t));
2429
2430 skb = __hci_cmd_sync(hdev, 0xfc0b, sizeof(buf), buf, HCI_INIT_TIMEOUT);
2431 if (IS_ERR(skb)) {
2432 ret = PTR_ERR(skb);
2433 bt_dev_err(hdev, "Change address command failed (%ld)", ret);
2434 return ret;
2435 }
2436 kfree_skb(skb);
2437
2438 return 0;
2439 }
2440
2441 #define QCA_DFU_PACKET_LEN 4096
2442
2443 #define QCA_GET_TARGET_VERSION 0x09
2444 #define QCA_CHECK_STATUS 0x05
2445 #define QCA_DFU_DOWNLOAD 0x01
2446
2447 #define QCA_SYSCFG_UPDATED 0x40
2448 #define QCA_PATCH_UPDATED 0x80
2449 #define QCA_DFU_TIMEOUT 3000
2450
2451 struct qca_version {
2452 __le32 rom_version;
2453 __le32 patch_version;
2454 __le32 ram_version;
2455 __le32 ref_clock;
2456 __u8 reserved[4];
2457 } __packed;
2458
2459 struct qca_rampatch_version {
2460 __le16 rom_version;
2461 __le16 patch_version;
2462 } __packed;
2463
2464 struct qca_device_info {
2465 u32 rom_version;
2466 u8 rampatch_hdr; /* length of header in rampatch */
2467 u8 nvm_hdr; /* length of header in NVM */
2468 u8 ver_offset; /* offset of version structure in rampatch */
2469 };
2470
2471 static const struct qca_device_info qca_devices_table[] = {
2472 { 0x00000100, 20, 4, 10 }, /* Rome 1.0 */
2473 { 0x00000101, 20, 4, 10 }, /* Rome 1.1 */
2474 { 0x00000200, 28, 4, 18 }, /* Rome 2.0 */
2475 { 0x00000201, 28, 4, 18 }, /* Rome 2.1 */
2476 { 0x00000300, 28, 4, 18 }, /* Rome 3.0 */
2477 { 0x00000302, 28, 4, 18 }, /* Rome 3.2 */
2478 };
2479
2480 static int btusb_qca_send_vendor_req(struct hci_dev *hdev, u8 request,
2481 void *data, u16 size)
2482 {
2483 struct btusb_data *btdata = hci_get_drvdata(hdev);
2484 struct usb_device *udev = btdata->udev;
2485 int pipe, err;
2486 u8 *buf;
2487
2488 buf = kmalloc(size, GFP_KERNEL);
2489 if (!buf)
2490 return -ENOMEM;
2491
2492 /* Found some of USB hosts have IOT issues with ours so that we should
2493 * not wait until HCI layer is ready.
2494 */
2495 pipe = usb_rcvctrlpipe(udev, 0);
2496 err = usb_control_msg(udev, pipe, request, USB_TYPE_VENDOR | USB_DIR_IN,
2497 0, 0, buf, size, USB_CTRL_SET_TIMEOUT);
2498 if (err < 0) {
2499 bt_dev_err(hdev, "Failed to access otp area (%d)", err);
2500 goto done;
2501 }
2502
2503 memcpy(data, buf, size);
2504
2505 done:
2506 kfree(buf);
2507
2508 return err;
2509 }
2510
2511 static int btusb_setup_qca_download_fw(struct hci_dev *hdev,
2512 const struct firmware *firmware,
2513 size_t hdr_size)
2514 {
2515 struct btusb_data *btdata = hci_get_drvdata(hdev);
2516 struct usb_device *udev = btdata->udev;
2517 size_t count, size, sent = 0;
2518 int pipe, len, err;
2519 u8 *buf;
2520
2521 buf = kmalloc(QCA_DFU_PACKET_LEN, GFP_KERNEL);
2522 if (!buf)
2523 return -ENOMEM;
2524
2525 count = firmware->size;
2526
2527 size = min_t(size_t, count, hdr_size);
2528 memcpy(buf, firmware->data, size);
2529
2530 /* USB patches should go down to controller through USB path
2531 * because binary format fits to go down through USB channel.
2532 * USB control path is for patching headers and USB bulk is for
2533 * patch body.
2534 */
2535 pipe = usb_sndctrlpipe(udev, 0);
2536 err = usb_control_msg(udev, pipe, QCA_DFU_DOWNLOAD, USB_TYPE_VENDOR,
2537 0, 0, buf, size, USB_CTRL_SET_TIMEOUT);
2538 if (err < 0) {
2539 bt_dev_err(hdev, "Failed to send headers (%d)", err);
2540 goto done;
2541 }
2542
2543 sent += size;
2544 count -= size;
2545
2546 while (count) {
2547 size = min_t(size_t, count, QCA_DFU_PACKET_LEN);
2548
2549 memcpy(buf, firmware->data + sent, size);
2550
2551 pipe = usb_sndbulkpipe(udev, 0x02);
2552 err = usb_bulk_msg(udev, pipe, buf, size, &len,
2553 QCA_DFU_TIMEOUT);
2554 if (err < 0) {
2555 bt_dev_err(hdev, "Failed to send body at %zd of %zd (%d)",
2556 sent, firmware->size, err);
2557 break;
2558 }
2559
2560 if (size != len) {
2561 bt_dev_err(hdev, "Failed to get bulk buffer");
2562 err = -EILSEQ;
2563 break;
2564 }
2565
2566 sent += size;
2567 count -= size;
2568 }
2569
2570 done:
2571 kfree(buf);
2572 return err;
2573 }
2574
2575 static int btusb_setup_qca_load_rampatch(struct hci_dev *hdev,
2576 struct qca_version *ver,
2577 const struct qca_device_info *info)
2578 {
2579 struct qca_rampatch_version *rver;
2580 const struct firmware *fw;
2581 u32 ver_rom, ver_patch;
2582 u16 rver_rom, rver_patch;
2583 char fwname[64];
2584 int err;
2585
2586 ver_rom = le32_to_cpu(ver->rom_version);
2587 ver_patch = le32_to_cpu(ver->patch_version);
2588
2589 snprintf(fwname, sizeof(fwname), "qca/rampatch_usb_%08x.bin", ver_rom);
2590
2591 err = request_firmware(&fw, fwname, &hdev->dev);
2592 if (err) {
2593 bt_dev_err(hdev, "failed to request rampatch file: %s (%d)",
2594 fwname, err);
2595 return err;
2596 }
2597
2598 bt_dev_info(hdev, "using rampatch file: %s", fwname);
2599
2600 rver = (struct qca_rampatch_version *)(fw->data + info->ver_offset);
2601 rver_rom = le16_to_cpu(rver->rom_version);
2602 rver_patch = le16_to_cpu(rver->patch_version);
2603
2604 bt_dev_info(hdev, "QCA: patch rome 0x%x build 0x%x, "
2605 "firmware rome 0x%x build 0x%x",
2606 rver_rom, rver_patch, ver_rom, ver_patch);
2607
2608 if (rver_rom != ver_rom || rver_patch <= ver_patch) {
2609 bt_dev_err(hdev, "rampatch file version did not match with firmware");
2610 err = -EINVAL;
2611 goto done;
2612 }
2613
2614 err = btusb_setup_qca_download_fw(hdev, fw, info->rampatch_hdr);
2615
2616 done:
2617 release_firmware(fw);
2618
2619 return err;
2620 }
2621
2622 static int btusb_setup_qca_load_nvm(struct hci_dev *hdev,
2623 struct qca_version *ver,
2624 const struct qca_device_info *info)
2625 {
2626 const struct firmware *fw;
2627 char fwname[64];
2628 int err;
2629
2630 snprintf(fwname, sizeof(fwname), "qca/nvm_usb_%08x.bin",
2631 le32_to_cpu(ver->rom_version));
2632
2633 err = request_firmware(&fw, fwname, &hdev->dev);
2634 if (err) {
2635 bt_dev_err(hdev, "failed to request NVM file: %s (%d)",
2636 fwname, err);
2637 return err;
2638 }
2639
2640 bt_dev_info(hdev, "using NVM file: %s", fwname);
2641
2642 err = btusb_setup_qca_download_fw(hdev, fw, info->nvm_hdr);
2643
2644 release_firmware(fw);
2645
2646 return err;
2647 }
2648
2649 static int btusb_setup_qca(struct hci_dev *hdev)
2650 {
2651 const struct qca_device_info *info = NULL;
2652 struct qca_version ver;
2653 u32 ver_rom;
2654 u8 status;
2655 int i, err;
2656
2657 err = btusb_qca_send_vendor_req(hdev, QCA_GET_TARGET_VERSION, &ver,
2658 sizeof(ver));
2659 if (err < 0)
2660 return err;
2661
2662 ver_rom = le32_to_cpu(ver.rom_version);
2663 for (i = 0; i < ARRAY_SIZE(qca_devices_table); i++) {
2664 if (ver_rom == qca_devices_table[i].rom_version)
2665 info = &qca_devices_table[i];
2666 }
2667 if (!info) {
2668 bt_dev_err(hdev, "don't support firmware rome 0x%x", ver_rom);
2669 return -ENODEV;
2670 }
2671
2672 err = btusb_qca_send_vendor_req(hdev, QCA_CHECK_STATUS, &status,
2673 sizeof(status));
2674 if (err < 0)
2675 return err;
2676
2677 if (!(status & QCA_PATCH_UPDATED)) {
2678 err = btusb_setup_qca_load_rampatch(hdev, &ver, info);
2679 if (err < 0)
2680 return err;
2681 }
2682
2683 if (!(status & QCA_SYSCFG_UPDATED)) {
2684 err = btusb_setup_qca_load_nvm(hdev, &ver, info);
2685 if (err < 0)
2686 return err;
2687 }
2688
2689 return 0;
2690 }
2691
2692 #ifdef CONFIG_BT_HCIBTUSB_BCM
2693 static inline int __set_diag_interface(struct hci_dev *hdev)
2694 {
2695 struct btusb_data *data = hci_get_drvdata(hdev);
2696 struct usb_interface *intf = data->diag;
2697 int i;
2698
2699 if (!data->diag)
2700 return -ENODEV;
2701
2702 data->diag_tx_ep = NULL;
2703 data->diag_rx_ep = NULL;
2704
2705 for (i = 0; i < intf->cur_altsetting->desc.bNumEndpoints; i++) {
2706 struct usb_endpoint_descriptor *ep_desc;
2707
2708 ep_desc = &intf->cur_altsetting->endpoint[i].desc;
2709
2710 if (!data->diag_tx_ep && usb_endpoint_is_bulk_out(ep_desc)) {
2711 data->diag_tx_ep = ep_desc;
2712 continue;
2713 }
2714
2715 if (!data->diag_rx_ep && usb_endpoint_is_bulk_in(ep_desc)) {
2716 data->diag_rx_ep = ep_desc;
2717 continue;
2718 }
2719 }
2720
2721 if (!data->diag_tx_ep || !data->diag_rx_ep) {
2722 bt_dev_err(hdev, "invalid diagnostic descriptors");
2723 return -ENODEV;
2724 }
2725
2726 return 0;
2727 }
2728
2729 static struct urb *alloc_diag_urb(struct hci_dev *hdev, bool enable)
2730 {
2731 struct btusb_data *data = hci_get_drvdata(hdev);
2732 struct sk_buff *skb;
2733 struct urb *urb;
2734 unsigned int pipe;
2735
2736 if (!data->diag_tx_ep)
2737 return ERR_PTR(-ENODEV);
2738
2739 urb = usb_alloc_urb(0, GFP_KERNEL);
2740 if (!urb)
2741 return ERR_PTR(-ENOMEM);
2742
2743 skb = bt_skb_alloc(2, GFP_KERNEL);
2744 if (!skb) {
2745 usb_free_urb(urb);
2746 return ERR_PTR(-ENOMEM);
2747 }
2748
2749 skb_put_u8(skb, 0xf0);
2750 skb_put_u8(skb, enable);
2751
2752 pipe = usb_sndbulkpipe(data->udev, data->diag_tx_ep->bEndpointAddress);
2753
2754 usb_fill_bulk_urb(urb, data->udev, pipe,
2755 skb->data, skb->len, btusb_tx_complete, skb);
2756
2757 skb->dev = (void *)hdev;
2758
2759 return urb;
2760 }
2761
2762 static int btusb_bcm_set_diag(struct hci_dev *hdev, bool enable)
2763 {
2764 struct btusb_data *data = hci_get_drvdata(hdev);
2765 struct urb *urb;
2766
2767 if (!data->diag)
2768 return -ENODEV;
2769
2770 if (!test_bit(HCI_RUNNING, &hdev->flags))
2771 return -ENETDOWN;
2772
2773 urb = alloc_diag_urb(hdev, enable);
2774 if (IS_ERR(urb))
2775 return PTR_ERR(urb);
2776
2777 return submit_or_queue_tx_urb(hdev, urb);
2778 }
2779 #endif
2780
2781 #ifdef CONFIG_PM
2782 static irqreturn_t btusb_oob_wake_handler(int irq, void *priv)
2783 {
2784 struct btusb_data *data = priv;
2785
2786 pm_wakeup_event(&data->udev->dev, 0);
2787 pm_system_wakeup();
2788
2789 /* Disable only if not already disabled (keep it balanced) */
2790 if (test_and_clear_bit(BTUSB_OOB_WAKE_ENABLED, &data->flags)) {
2791 disable_irq_nosync(irq);
2792 disable_irq_wake(irq);
2793 }
2794 return IRQ_HANDLED;
2795 }
2796
2797 static const struct of_device_id btusb_match_table[] = {
2798 { .compatible = "usb1286,204e" },
2799 { }
2800 };
2801 MODULE_DEVICE_TABLE(of, btusb_match_table);
2802
2803 /* Use an oob wakeup pin? */
2804 static int btusb_config_oob_wake(struct hci_dev *hdev)
2805 {
2806 struct btusb_data *data = hci_get_drvdata(hdev);
2807 struct device *dev = &data->udev->dev;
2808 int irq, ret;
2809
2810 clear_bit(BTUSB_OOB_WAKE_ENABLED, &data->flags);
2811
2812 if (!of_match_device(btusb_match_table, dev))
2813 return 0;
2814
2815 /* Move on if no IRQ specified */
2816 irq = of_irq_get_byname(dev->of_node, "wakeup");
2817 if (irq <= 0) {
2818 bt_dev_dbg(hdev, "%s: no OOB Wakeup IRQ in DT", __func__);
2819 return 0;
2820 }
2821
2822 ret = devm_request_irq(&hdev->dev, irq, btusb_oob_wake_handler,
2823 0, "OOB Wake-on-BT", data);
2824 if (ret) {
2825 bt_dev_err(hdev, "%s: IRQ request failed", __func__);
2826 return ret;
2827 }
2828
2829 ret = device_init_wakeup(dev, true);
2830 if (ret) {
2831 bt_dev_err(hdev, "%s: failed to init_wakeup", __func__);
2832 return ret;
2833 }
2834
2835 data->oob_wake_irq = irq;
2836 disable_irq(irq);
2837 bt_dev_info(hdev, "OOB Wake-on-BT configured at IRQ %u", irq);
2838 return 0;
2839 }
2840 #endif
2841
2842 static int btusb_probe(struct usb_interface *intf,
2843 const struct usb_device_id *id)
2844 {
2845 struct usb_endpoint_descriptor *ep_desc;
2846 struct btusb_data *data;
2847 struct hci_dev *hdev;
2848 unsigned ifnum_base;
2849 int i, err;
2850
2851 BT_DBG("intf %p id %p", intf, id);
2852
2853 /* interface numbers are hardcoded in the spec */
2854 if (intf->cur_altsetting->desc.bInterfaceNumber != 0) {
2855 if (!(id->driver_info & BTUSB_IFNUM_2))
2856 return -ENODEV;
2857 if (intf->cur_altsetting->desc.bInterfaceNumber != 2)
2858 return -ENODEV;
2859 }
2860
2861 ifnum_base = intf->cur_altsetting->desc.bInterfaceNumber;
2862
2863 if (!id->driver_info) {
2864 const struct usb_device_id *match;
2865
2866 match = usb_match_id(intf, blacklist_table);
2867 if (match)
2868 id = match;
2869 }
2870
2871 if (id->driver_info == BTUSB_IGNORE)
2872 return -ENODEV;
2873
2874 if (id->driver_info & BTUSB_ATH3012) {
2875 struct usb_device *udev = interface_to_usbdev(intf);
2876
2877 /* Old firmware would otherwise let ath3k driver load
2878 * patch and sysconfig files
2879 */
2880 if (le16_to_cpu(udev->descriptor.bcdDevice) <= 0x0001)
2881 return -ENODEV;
2882 }
2883
2884 data = devm_kzalloc(&intf->dev, sizeof(*data), GFP_KERNEL);
2885 if (!data)
2886 return -ENOMEM;
2887
2888 for (i = 0; i < intf->cur_altsetting->desc.bNumEndpoints; i++) {
2889 ep_desc = &intf->cur_altsetting->endpoint[i].desc;
2890
2891 if (!data->intr_ep && usb_endpoint_is_int_in(ep_desc)) {
2892 data->intr_ep = ep_desc;
2893 continue;
2894 }
2895
2896 if (!data->bulk_tx_ep && usb_endpoint_is_bulk_out(ep_desc)) {
2897 data->bulk_tx_ep = ep_desc;
2898 continue;
2899 }
2900
2901 if (!data->bulk_rx_ep && usb_endpoint_is_bulk_in(ep_desc)) {
2902 data->bulk_rx_ep = ep_desc;
2903 continue;
2904 }
2905 }
2906
2907 if (!data->intr_ep || !data->bulk_tx_ep || !data->bulk_rx_ep)
2908 return -ENODEV;
2909
2910 if (id->driver_info & BTUSB_AMP) {
2911 data->cmdreq_type = USB_TYPE_CLASS | 0x01;
2912 data->cmdreq = 0x2b;
2913 } else {
2914 data->cmdreq_type = USB_TYPE_CLASS;
2915 data->cmdreq = 0x00;
2916 }
2917
2918 data->udev = interface_to_usbdev(intf);
2919 data->intf = intf;
2920
2921 INIT_WORK(&data->work, btusb_work);
2922 INIT_WORK(&data->waker, btusb_waker);
2923 init_usb_anchor(&data->deferred);
2924 init_usb_anchor(&data->tx_anchor);
2925 spin_lock_init(&data->txlock);
2926
2927 init_usb_anchor(&data->intr_anchor);
2928 init_usb_anchor(&data->bulk_anchor);
2929 init_usb_anchor(&data->isoc_anchor);
2930 init_usb_anchor(&data->diag_anchor);
2931 spin_lock_init(&data->rxlock);
2932
2933 if (id->driver_info & BTUSB_INTEL_NEW) {
2934 data->recv_event = btusb_recv_event_intel;
2935 data->recv_bulk = btusb_recv_bulk_intel;
2936 set_bit(BTUSB_BOOTLOADER, &data->flags);
2937 } else {
2938 data->recv_event = hci_recv_frame;
2939 data->recv_bulk = btusb_recv_bulk;
2940 }
2941
2942 hdev = hci_alloc_dev();
2943 if (!hdev)
2944 return -ENOMEM;
2945
2946 hdev->bus = HCI_USB;
2947 hci_set_drvdata(hdev, data);
2948
2949 if (id->driver_info & BTUSB_AMP)
2950 hdev->dev_type = HCI_AMP;
2951 else
2952 hdev->dev_type = HCI_PRIMARY;
2953
2954 data->hdev = hdev;
2955
2956 SET_HCIDEV_DEV(hdev, &intf->dev);
2957
2958 hdev->open = btusb_open;
2959 hdev->close = btusb_close;
2960 hdev->flush = btusb_flush;
2961 hdev->send = btusb_send_frame;
2962 hdev->notify = btusb_notify;
2963
2964 if (dmi_check_system(btusb_needs_reset_resume_table))
2965 interface_to_usbdev(intf)->quirks |= USB_QUIRK_RESET_RESUME;
2966
2967 #ifdef CONFIG_PM
2968 err = btusb_config_oob_wake(hdev);
2969 if (err)
2970 goto out_free_dev;
2971
2972 /* Marvell devices may need a specific chip configuration */
2973 if (id->driver_info & BTUSB_MARVELL && data->oob_wake_irq) {
2974 err = marvell_config_oob_wake(hdev);
2975 if (err)
2976 goto out_free_dev;
2977 }
2978 #endif
2979 if (id->driver_info & BTUSB_CW6622)
2980 set_bit(HCI_QUIRK_BROKEN_STORED_LINK_KEY, &hdev->quirks);
2981
2982 if (id->driver_info & BTUSB_BCM2045)
2983 set_bit(HCI_QUIRK_BROKEN_STORED_LINK_KEY, &hdev->quirks);
2984
2985 if (id->driver_info & BTUSB_BCM92035)
2986 hdev->setup = btusb_setup_bcm92035;
2987
2988 #ifdef CONFIG_BT_HCIBTUSB_BCM
2989 if (id->driver_info & BTUSB_BCM_PATCHRAM) {
2990 hdev->manufacturer = 15;
2991 hdev->setup = btbcm_setup_patchram;
2992 hdev->set_diag = btusb_bcm_set_diag;
2993 hdev->set_bdaddr = btbcm_set_bdaddr;
2994
2995 /* Broadcom LM_DIAG Interface numbers are hardcoded */
2996 data->diag = usb_ifnum_to_if(data->udev, ifnum_base + 2);
2997 }
2998
2999 if (id->driver_info & BTUSB_BCM_APPLE) {
3000 hdev->manufacturer = 15;
3001 hdev->setup = btbcm_setup_apple;
3002 hdev->set_diag = btusb_bcm_set_diag;
3003
3004 /* Broadcom LM_DIAG Interface numbers are hardcoded */
3005 data->diag = usb_ifnum_to_if(data->udev, ifnum_base + 2);
3006 }
3007 #endif
3008
3009 if (id->driver_info & BTUSB_INTEL) {
3010 hdev->manufacturer = 2;
3011 hdev->setup = btusb_setup_intel;
3012 hdev->shutdown = btusb_shutdown_intel;
3013 hdev->set_diag = btintel_set_diag_mfg;
3014 hdev->set_bdaddr = btintel_set_bdaddr;
3015 set_bit(HCI_QUIRK_STRICT_DUPLICATE_FILTER, &hdev->quirks);
3016 set_bit(HCI_QUIRK_SIMULTANEOUS_DISCOVERY, &hdev->quirks);
3017 set_bit(HCI_QUIRK_NON_PERSISTENT_DIAG, &hdev->quirks);
3018 }
3019
3020 if (id->driver_info & BTUSB_INTEL_NEW) {
3021 hdev->manufacturer = 2;
3022 hdev->send = btusb_send_frame_intel;
3023 hdev->setup = btusb_setup_intel_new;
3024 hdev->hw_error = btintel_hw_error;
3025 hdev->set_diag = btintel_set_diag;
3026 hdev->set_bdaddr = btintel_set_bdaddr;
3027 set_bit(HCI_QUIRK_STRICT_DUPLICATE_FILTER, &hdev->quirks);
3028 set_bit(HCI_QUIRK_NON_PERSISTENT_DIAG, &hdev->quirks);
3029 }
3030
3031 if (id->driver_info & BTUSB_MARVELL)
3032 hdev->set_bdaddr = btusb_set_bdaddr_marvell;
3033
3034 if (id->driver_info & BTUSB_SWAVE) {
3035 set_bit(HCI_QUIRK_FIXUP_INQUIRY_MODE, &hdev->quirks);
3036 set_bit(HCI_QUIRK_BROKEN_LOCAL_COMMANDS, &hdev->quirks);
3037 }
3038
3039 if (id->driver_info & BTUSB_INTEL_BOOT) {
3040 hdev->manufacturer = 2;
3041 set_bit(HCI_QUIRK_RAW_DEVICE, &hdev->quirks);
3042 }
3043
3044 if (id->driver_info & BTUSB_ATH3012) {
3045 hdev->set_bdaddr = btusb_set_bdaddr_ath3012;
3046 set_bit(HCI_QUIRK_SIMULTANEOUS_DISCOVERY, &hdev->quirks);
3047 set_bit(HCI_QUIRK_STRICT_DUPLICATE_FILTER, &hdev->quirks);
3048 }
3049
3050 if (id->driver_info & BTUSB_QCA_ROME) {
3051 data->setup_on_usb = btusb_setup_qca;
3052 hdev->set_bdaddr = btusb_set_bdaddr_ath3012;
3053 }
3054
3055 #ifdef CONFIG_BT_HCIBTUSB_RTL
3056 if (id->driver_info & BTUSB_REALTEK) {
3057 hdev->setup = btrtl_setup_realtek;
3058
3059 /* Realtek devices lose their updated firmware over suspend,
3060 * but the USB hub doesn't notice any status change.
3061 * Explicitly request a device reset on resume.
3062 */
3063 interface_to_usbdev(intf)->quirks |= USB_QUIRK_RESET_RESUME;
3064 }
3065 #endif
3066
3067 if (id->driver_info & BTUSB_AMP) {
3068 /* AMP controllers do not support SCO packets */
3069 data->isoc = NULL;
3070 } else {
3071 /* Interface orders are hardcoded in the specification */
3072 data->isoc = usb_ifnum_to_if(data->udev, ifnum_base + 1);
3073 data->isoc_ifnum = ifnum_base + 1;
3074 }
3075
3076 if (!reset)
3077 set_bit(HCI_QUIRK_RESET_ON_CLOSE, &hdev->quirks);
3078
3079 if (force_scofix || id->driver_info & BTUSB_WRONG_SCO_MTU) {
3080 if (!disable_scofix)
3081 set_bit(HCI_QUIRK_FIXUP_BUFFER_SIZE, &hdev->quirks);
3082 }
3083
3084 if (id->driver_info & BTUSB_BROKEN_ISOC)
3085 data->isoc = NULL;
3086
3087 if (id->driver_info & BTUSB_DIGIANSWER) {
3088 data->cmdreq_type = USB_TYPE_VENDOR;
3089 set_bit(HCI_QUIRK_RESET_ON_CLOSE, &hdev->quirks);
3090 }
3091
3092 if (id->driver_info & BTUSB_CSR) {
3093 struct usb_device *udev = data->udev;
3094 u16 bcdDevice = le16_to_cpu(udev->descriptor.bcdDevice);
3095
3096 /* Old firmware would otherwise execute USB reset */
3097 if (bcdDevice < 0x117)
3098 set_bit(HCI_QUIRK_RESET_ON_CLOSE, &hdev->quirks);
3099
3100 /* Fake CSR devices with broken commands */
3101 if (bcdDevice <= 0x100 || bcdDevice == 0x134)
3102 hdev->setup = btusb_setup_csr;
3103
3104 set_bit(HCI_QUIRK_SIMULTANEOUS_DISCOVERY, &hdev->quirks);
3105 }
3106
3107 if (id->driver_info & BTUSB_SNIFFER) {
3108 struct usb_device *udev = data->udev;
3109
3110 /* New sniffer firmware has crippled HCI interface */
3111 if (le16_to_cpu(udev->descriptor.bcdDevice) > 0x997)
3112 set_bit(HCI_QUIRK_RAW_DEVICE, &hdev->quirks);
3113 }
3114
3115 if (id->driver_info & BTUSB_INTEL_BOOT) {
3116 /* A bug in the bootloader causes that interrupt interface is
3117 * only enabled after receiving SetInterface(0, AltSetting=0).
3118 */
3119 err = usb_set_interface(data->udev, 0, 0);
3120 if (err < 0) {
3121 BT_ERR("failed to set interface 0, alt 0 %d", err);
3122 goto out_free_dev;
3123 }
3124 }
3125
3126 if (data->isoc) {
3127 err = usb_driver_claim_interface(&btusb_driver,
3128 data->isoc, data);
3129 if (err < 0)
3130 goto out_free_dev;
3131 }
3132
3133 #ifdef CONFIG_BT_HCIBTUSB_BCM
3134 if (data->diag) {
3135 if (!usb_driver_claim_interface(&btusb_driver,
3136 data->diag, data))
3137 __set_diag_interface(hdev);
3138 else
3139 data->diag = NULL;
3140 }
3141 #endif
3142
3143 if (enable_autosuspend)
3144 usb_enable_autosuspend(data->udev);
3145
3146 err = hci_register_dev(hdev);
3147 if (err < 0)
3148 goto out_free_dev;
3149
3150 usb_set_intfdata(intf, data);
3151
3152 return 0;
3153
3154 out_free_dev:
3155 hci_free_dev(hdev);
3156 return err;
3157 }
3158
3159 static void btusb_disconnect(struct usb_interface *intf)
3160 {
3161 struct btusb_data *data = usb_get_intfdata(intf);
3162 struct hci_dev *hdev;
3163
3164 BT_DBG("intf %p", intf);
3165
3166 if (!data)
3167 return;
3168
3169 hdev = data->hdev;
3170 usb_set_intfdata(data->intf, NULL);
3171
3172 if (data->isoc)
3173 usb_set_intfdata(data->isoc, NULL);
3174
3175 if (data->diag)
3176 usb_set_intfdata(data->diag, NULL);
3177
3178 hci_unregister_dev(hdev);
3179
3180 if (intf == data->intf) {
3181 if (data->isoc)
3182 usb_driver_release_interface(&btusb_driver, data->isoc);
3183 if (data->diag)
3184 usb_driver_release_interface(&btusb_driver, data->diag);
3185 } else if (intf == data->isoc) {
3186 if (data->diag)
3187 usb_driver_release_interface(&btusb_driver, data->diag);
3188 usb_driver_release_interface(&btusb_driver, data->intf);
3189 } else if (intf == data->diag) {
3190 usb_driver_release_interface(&btusb_driver, data->intf);
3191 if (data->isoc)
3192 usb_driver_release_interface(&btusb_driver, data->isoc);
3193 }
3194
3195 if (data->oob_wake_irq)
3196 device_init_wakeup(&data->udev->dev, false);
3197
3198 hci_free_dev(hdev);
3199 }
3200
3201 #ifdef CONFIG_PM
3202 static int btusb_suspend(struct usb_interface *intf, pm_message_t message)
3203 {
3204 struct btusb_data *data = usb_get_intfdata(intf);
3205
3206 BT_DBG("intf %p", intf);
3207
3208 if (data->suspend_count++)
3209 return 0;
3210
3211 spin_lock_irq(&data->txlock);
3212 if (!(PMSG_IS_AUTO(message) && data->tx_in_flight)) {
3213 set_bit(BTUSB_SUSPENDING, &data->flags);
3214 spin_unlock_irq(&data->txlock);
3215 } else {
3216 spin_unlock_irq(&data->txlock);
3217 data->suspend_count--;
3218 return -EBUSY;
3219 }
3220
3221 cancel_work_sync(&data->work);
3222
3223 btusb_stop_traffic(data);
3224 usb_kill_anchored_urbs(&data->tx_anchor);
3225
3226 if (data->oob_wake_irq && device_may_wakeup(&data->udev->dev)) {
3227 set_bit(BTUSB_OOB_WAKE_ENABLED, &data->flags);
3228 enable_irq_wake(data->oob_wake_irq);
3229 enable_irq(data->oob_wake_irq);
3230 }
3231
3232 return 0;
3233 }
3234
3235 static void play_deferred(struct btusb_data *data)
3236 {
3237 struct urb *urb;
3238 int err;
3239
3240 while ((urb = usb_get_from_anchor(&data->deferred))) {
3241 usb_anchor_urb(urb, &data->tx_anchor);
3242
3243 err = usb_submit_urb(urb, GFP_ATOMIC);
3244 if (err < 0) {
3245 if (err != -EPERM && err != -ENODEV)
3246 BT_ERR("%s urb %p submission failed (%d)",
3247 data->hdev->name, urb, -err);
3248 kfree(urb->setup_packet);
3249 usb_unanchor_urb(urb);
3250 usb_free_urb(urb);
3251 break;
3252 }
3253
3254 data->tx_in_flight++;
3255 usb_free_urb(urb);
3256 }
3257
3258 /* Cleanup the rest deferred urbs. */
3259 while ((urb = usb_get_from_anchor(&data->deferred))) {
3260 kfree(urb->setup_packet);
3261 usb_free_urb(urb);
3262 }
3263 }
3264
3265 static int btusb_resume(struct usb_interface *intf)
3266 {
3267 struct btusb_data *data = usb_get_intfdata(intf);
3268 struct hci_dev *hdev = data->hdev;
3269 int err = 0;
3270
3271 BT_DBG("intf %p", intf);
3272
3273 if (--data->suspend_count)
3274 return 0;
3275
3276 /* Disable only if not already disabled (keep it balanced) */
3277 if (test_and_clear_bit(BTUSB_OOB_WAKE_ENABLED, &data->flags)) {
3278 disable_irq(data->oob_wake_irq);
3279 disable_irq_wake(data->oob_wake_irq);
3280 }
3281
3282 if (!test_bit(HCI_RUNNING, &hdev->flags))
3283 goto done;
3284
3285 if (test_bit(BTUSB_INTR_RUNNING, &data->flags)) {
3286 err = btusb_submit_intr_urb(hdev, GFP_NOIO);
3287 if (err < 0) {
3288 clear_bit(BTUSB_INTR_RUNNING, &data->flags);
3289 goto failed;
3290 }
3291 }
3292
3293 if (test_bit(BTUSB_BULK_RUNNING, &data->flags)) {
3294 err = btusb_submit_bulk_urb(hdev, GFP_NOIO);
3295 if (err < 0) {
3296 clear_bit(BTUSB_BULK_RUNNING, &data->flags);
3297 goto failed;
3298 }
3299
3300 btusb_submit_bulk_urb(hdev, GFP_NOIO);
3301 }
3302
3303 if (test_bit(BTUSB_ISOC_RUNNING, &data->flags)) {
3304 if (btusb_submit_isoc_urb(hdev, GFP_NOIO) < 0)
3305 clear_bit(BTUSB_ISOC_RUNNING, &data->flags);
3306 else
3307 btusb_submit_isoc_urb(hdev, GFP_NOIO);
3308 }
3309
3310 spin_lock_irq(&data->txlock);
3311 play_deferred(data);
3312 clear_bit(BTUSB_SUSPENDING, &data->flags);
3313 spin_unlock_irq(&data->txlock);
3314 schedule_work(&data->work);
3315
3316 return 0;
3317
3318 failed:
3319 usb_scuttle_anchored_urbs(&data->deferred);
3320 done:
3321 spin_lock_irq(&data->txlock);
3322 clear_bit(BTUSB_SUSPENDING, &data->flags);
3323 spin_unlock_irq(&data->txlock);
3324
3325 return err;
3326 }
3327 #endif
3328
3329 static struct usb_driver btusb_driver = {
3330 .name = "btusb",
3331 .probe = btusb_probe,
3332 .disconnect = btusb_disconnect,
3333 #ifdef CONFIG_PM
3334 .suspend = btusb_suspend,
3335 .resume = btusb_resume,
3336 #endif
3337 .id_table = btusb_table,
3338 .supports_autosuspend = 1,
3339 .disable_hub_initiated_lpm = 1,
3340 };
3341
3342 module_usb_driver(btusb_driver);
3343
3344 module_param(disable_scofix, bool, 0644);
3345 MODULE_PARM_DESC(disable_scofix, "Disable fixup of wrong SCO buffer size");
3346
3347 module_param(force_scofix, bool, 0644);
3348 MODULE_PARM_DESC(force_scofix, "Force fixup of wrong SCO buffers size");
3349
3350 module_param(enable_autosuspend, bool, 0644);
3351 MODULE_PARM_DESC(enable_autosuspend, "Enable USB autosuspend by default");
3352
3353 module_param(reset, bool, 0644);
3354 MODULE_PARM_DESC(reset, "Send HCI reset command on initialization");
3355
3356 MODULE_AUTHOR("Marcel Holtmann <marcel@holtmann.org>");
3357 MODULE_DESCRIPTION("Generic Bluetooth USB driver ver " VERSION);
3358 MODULE_VERSION(VERSION);
3359 MODULE_LICENSE("GPL");
Ubuntu Hirsute Linux kernel mirror