projects / deliverable / linux.git / blame
? search:
summary | shortlog | log | commit | commitdiff | tree
blob | blame (incremental) | history | HEAD
Bluetooth: Use EOPNOTSUPP instead of ENOTSUPP
[deliverable/linux.git] / drivers / bluetooth / btusb.c
CommitLineData
5e23b923
MH		 1/*
2 *
3 * Generic Bluetooth USB driver
4 *
9bfa35fe 5 * Copyright (C) 2005-2008 Marcel Holtmann <marcel@holtmann.org>
5e23b923
MH		 6 *
7 *
8 * This program is free software; you can redistribute it and/or modify
9 * it under the terms of the GNU General Public License as published by
10 * the Free Software Foundation; either version 2 of the License, or
11 * (at your option) any later version.
12 *
13 * This program is distributed in the hope that it will be useful,
14 * but WITHOUT ANY WARRANTY; without even the implied warranty of
15 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
16 * GNU General Public License for more details.
17 *
18 * You should have received a copy of the GNU General Public License
19 * along with this program; if not, write to the Free Software
20 * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
21 *
22 */
23
5e23b923 24#include <linux/module.h>
5e23b923 25#include <linux/usb.h>
dffd30ee 26#include <linux/firmware.h>
5e23b923
MH		 27
28#include <net/bluetooth/bluetooth.h>
29#include <net/bluetooth/hci_core.h>
30
7bee549e 31#define VERSION "0.6"
cfeb4145 32
90ab5ee9
RR		 33static bool disable_scofix;
34static bool force_scofix;
7a9d4020 35
90ab5ee9 36static bool reset = 1;
cfeb4145
MH		 37
38static struct usb_driver btusb_driver;
39
40#define BTUSB_IGNORE 0x01
7a9d4020
MH		 41#define BTUSB_DIGIANSWER 0x02
42#define BTUSB_CSR 0x04
43#define BTUSB_SNIFFER 0x08
44#define BTUSB_BCM92035 0x10
45#define BTUSB_BROKEN_ISOC 0x20
46#define BTUSB_WRONG_SCO_MTU 0x40
2d25f8b4 47#define BTUSB_ATH3012 0x80
dffd30ee 48#define BTUSB_INTEL 0x100
40df783d
MH		 49#define BTUSB_INTEL_BOOT 0x200
50#define BTUSB_BCM_PATCHRAM 0x400
5e23b923 51
54265202 52static const struct usb_device_id btusb_table[] = {
5e23b923
MH		 53 /* Generic Bluetooth USB device */
54 { USB_DEVICE_INFO(0xe0, 0x01, 0x01) },
55
1fa6535f
HR		 56 /* Apple-specific (Broadcom) devices */
57 { USB_VENDOR_AND_INTERFACE_INFO(0x05ac, 0xff, 0x01, 0x01) },
58
178c059e
CYC		 59 /* MediaTek MT76x0E */
60 { USB_DEVICE(0x0e8d, 0x763f) },
61
c510eae3 62 /* Broadcom SoftSailing reporting vendor specific */
2e8b5063 63 { USB_DEVICE(0x0a5c, 0x21e1) },
c510eae3 64
3cd01976
NI		 65 /* Apple MacBookPro 7,1 */
66 { USB_DEVICE(0x05ac, 0x8213) },
67
0a79f674
CL		 68 /* Apple iMac11,1 */
69 { USB_DEVICE(0x05ac, 0x8215) },
70
9c047157
NI		 71 /* Apple MacBookPro6,2 */
72 { USB_DEVICE(0x05ac, 0x8218) },
73
3e3ede7d
EH		 74 /* Apple MacBookAir3,1, MacBookAir3,2 */
75 { USB_DEVICE(0x05ac, 0x821b) },
76
a63b723d
PAVM		 77 /* Apple MacBookAir4,1 */
78 { USB_DEVICE(0x05ac, 0x821f) },
79
88d377b6
MAP		 80 /* Apple MacBookPro8,2 */
81 { USB_DEVICE(0x05ac, 0x821a) },
82
f78b6826
JK		 83 /* Apple MacMini5,1 */
84 { USB_DEVICE(0x05ac, 0x8281) },
85
cfeb4145
MH		 86 /* AVM BlueFRITZ! USB v2.0 */
87 { USB_DEVICE(0x057c, 0x3800) },
88
89 /* Bluetooth Ultraport Module from IBM */
90 { USB_DEVICE(0x04bf, 0x030a) },
91
92 /* ALPS Modules with non-standard id */
93 { USB_DEVICE(0x044e, 0x3001) },
94 { USB_DEVICE(0x044e, 0x3002) },
95
96 /* Ericsson with non-standard id */
97 { USB_DEVICE(0x0bdb, 0x1002) },
98
99 /* Canyon CN-BTU1 with HID interfaces */
7a9d4020 100 { USB_DEVICE(0x0c10, 0x0000) },
cfeb4145 101
d13431ca 102 /* Broadcom BCM20702A0 */
0b880062
AS		 103 { USB_DEVICE(0x0489, 0xe042) },
104 { USB_DEVICE(0x04ca, 0x2003) },
1ee3ff61 105 { USB_DEVICE(0x0b05, 0x17b5) },
38a172be 106 { USB_DEVICE(0x0b05, 0x17cb) },
d13431ca
WJS		 107 { USB_DEVICE(0x413c, 0x8197) },
108
98514036 109 /* Foxconn - Hon Hai */
ee66401b 110 { USB_VENDOR_AND_INTERFACE_INFO(0x0489, 0xff, 0x01, 0x01) },
98514036 111
0b880062 112 /* Broadcom devices with vendor specific id */
10d4c673
PG		 113 { USB_VENDOR_AND_INTERFACE_INFO(0x0a5c, 0xff, 0x01, 0x01),
114 .driver_info = BTUSB_BCM_PATCHRAM },
92c385f4 115
5bcecf32
KB		 116 /* Belkin F8065bf - Broadcom based */
117 { USB_VENDOR_AND_INTERFACE_INFO(0x050d, 0xff, 0x01, 0x01) },
118
9113bfd8
JK		 119 /* IMC Networks - Broadcom based */
120 { USB_VENDOR_AND_INTERFACE_INFO(0x13d3, 0xff, 0x01, 0x01) },
121
40df783d 122 /* Intel Bluetooth USB Bootloader (RAM module) */
d92f2df0
MH		 123 { USB_DEVICE(0x8087, 0x0a5a),
124 .driver_info = BTUSB_INTEL_BOOT | BTUSB_BROKEN_ISOC },
40df783d 125
5e23b923
MH		 126 { } /* Terminating entry */
127};
128
129MODULE_DEVICE_TABLE(usb, btusb_table);
130
54265202 131static const struct usb_device_id blacklist_table[] = {
cfeb4145
MH		 132 /* CSR BlueCore devices */
133 { USB_DEVICE(0x0a12, 0x0001), .driver_info = BTUSB_CSR },
134
135 /* Broadcom BCM2033 without firmware */
136 { USB_DEVICE(0x0a5c, 0x2033), .driver_info = BTUSB_IGNORE },
137
be93112a 138 /* Atheros 3011 with sflash firmware */
0b880062
AS		 139 { USB_DEVICE(0x0489, 0xe027), .driver_info = BTUSB_IGNORE },
140 { USB_DEVICE(0x0489, 0xe03d), .driver_info = BTUSB_IGNORE },
141 { USB_DEVICE(0x0930, 0x0215), .driver_info = BTUSB_IGNORE },
be93112a 142 { USB_DEVICE(0x0cf3, 0x3002), .driver_info = BTUSB_IGNORE },
6eda541d 143 { USB_DEVICE(0x0cf3, 0xe019), .driver_info = BTUSB_IGNORE },
2a7bcccc 144 { USB_DEVICE(0x13d3, 0x3304), .driver_info = BTUSB_IGNORE },
be93112a 145
509e7861
CYC		 146 /* Atheros AR9285 Malbec with sflash firmware */
147 { USB_DEVICE(0x03f0, 0x311d), .driver_info = BTUSB_IGNORE },
148
d9f51b51 149 /* Atheros 3012 with sflash firmware */
0b880062
AS		 150 { USB_DEVICE(0x0489, 0xe04d), .driver_info = BTUSB_ATH3012 },
151 { USB_DEVICE(0x0489, 0xe04e), .driver_info = BTUSB_ATH3012 },
152 { USB_DEVICE(0x0489, 0xe056), .driver_info = BTUSB_ATH3012 },
153 { USB_DEVICE(0x0489, 0xe057), .driver_info = BTUSB_ATH3012 },
154 { USB_DEVICE(0x0489, 0xe05f), .driver_info = BTUSB_ATH3012 },
155 { USB_DEVICE(0x04c5, 0x1330), .driver_info = BTUSB_ATH3012 },
156 { USB_DEVICE(0x04ca, 0x3004), .driver_info = BTUSB_ATH3012 },
157 { USB_DEVICE(0x04ca, 0x3005), .driver_info = BTUSB_ATH3012 },
158 { USB_DEVICE(0x04ca, 0x3006), .driver_info = BTUSB_ATH3012 },
1fb4e09a 159 { USB_DEVICE(0x04ca, 0x3007), .driver_info = BTUSB_ATH3012 },
0b880062
AS		 160 { USB_DEVICE(0x04ca, 0x3008), .driver_info = BTUSB_ATH3012 },
161 { USB_DEVICE(0x04ca, 0x300b), .driver_info = BTUSB_ATH3012 },
162 { USB_DEVICE(0x0930, 0x0219), .driver_info = BTUSB_ATH3012 },
163 { USB_DEVICE(0x0930, 0x0220), .driver_info = BTUSB_ATH3012 },
a735f9e2 164 { USB_DEVICE(0x0b05, 0x17d0), .driver_info = BTUSB_ATH3012 },
d66629c1 165 { USB_DEVICE(0x0cf3, 0x0036), .driver_info = BTUSB_ATH3012 },
2d25f8b4 166 { USB_DEVICE(0x0cf3, 0x3004), .driver_info = BTUSB_ATH3012 },
94a32d10 167 { USB_DEVICE(0x0cf3, 0x3008), .driver_info = BTUSB_ATH3012 },
07c0ea87 168 { USB_DEVICE(0x0cf3, 0x311d), .driver_info = BTUSB_ATH3012 },
b131237c 169 { USB_DEVICE(0x0cf3, 0x311e), .driver_info = BTUSB_ATH3012 },
1e56f1eb 170 { USB_DEVICE(0x0cf3, 0x311f), .driver_info = BTUSB_ATH3012 },
0b880062 171 { USB_DEVICE(0x0cf3, 0x3121), .driver_info = BTUSB_ATH3012 },
ebaf5795 172 { USB_DEVICE(0x0cf3, 0x817a), .driver_info = BTUSB_ATH3012 },
0b880062 173 { USB_DEVICE(0x0cf3, 0xe003), .driver_info = BTUSB_ATH3012 },
ac71311e 174 { USB_DEVICE(0x0cf3, 0xe004), .driver_info = BTUSB_ATH3012 },
0a3658cc 175 { USB_DEVICE(0x0cf3, 0xe005), .driver_info = BTUSB_ATH3012 },
0b880062
AS		 176 { USB_DEVICE(0x13d3, 0x3362), .driver_info = BTUSB_ATH3012 },
177 { USB_DEVICE(0x13d3, 0x3375), .driver_info = BTUSB_ATH3012 },
eed307e2 178 { USB_DEVICE(0x13d3, 0x3393), .driver_info = BTUSB_ATH3012 },
5b77a1f3 179 { USB_DEVICE(0x13d3, 0x3402), .driver_info = BTUSB_ATH3012 },
fa2f1394 180 { USB_DEVICE(0x13d3, 0x3432), .driver_info = BTUSB_ATH3012 },
d9f51b51 181
e9036e33
CYC		 182 /* Atheros AR5BBU12 with sflash firmware */
183 { USB_DEVICE(0x0489, 0xe02c), .driver_info = BTUSB_IGNORE },
184
85d59726 185 /* Atheros AR5BBU12 with sflash firmware */
bc21fde2 186 { USB_DEVICE(0x0489, 0xe036), .driver_info = BTUSB_ATH3012 },
0b880062 187 { USB_DEVICE(0x0489, 0xe03c), .driver_info = BTUSB_ATH3012 },
85d59726 188
cfeb4145 189 /* Broadcom BCM2035 */
7a9d4020 190 { USB_DEVICE(0x0a5c, 0x2009), .driver_info = BTUSB_BCM92035 },
0b880062
AS		 191 { USB_DEVICE(0x0a5c, 0x200a), .driver_info = BTUSB_WRONG_SCO_MTU },
192 { USB_DEVICE(0x0a5c, 0x2035), .driver_info = BTUSB_WRONG_SCO_MTU },
cfeb4145
MH		 193
194 /* Broadcom BCM2045 */
7a9d4020
MH		 195 { USB_DEVICE(0x0a5c, 0x2039), .driver_info = BTUSB_WRONG_SCO_MTU },
196 { USB_DEVICE(0x0a5c, 0x2101), .driver_info = BTUSB_WRONG_SCO_MTU },
bdbef3d6 197
cfeb4145 198 /* IBM/Lenovo ThinkPad with Broadcom chip */
7a9d4020
MH		 199 { USB_DEVICE(0x0a5c, 0x201e), .driver_info = BTUSB_WRONG_SCO_MTU },
200 { USB_DEVICE(0x0a5c, 0x2110), .driver_info = BTUSB_WRONG_SCO_MTU },
cfeb4145
MH		 201
202 /* HP laptop with Broadcom chip */
7a9d4020 203 { USB_DEVICE(0x03f0, 0x171d), .driver_info = BTUSB_WRONG_SCO_MTU },
cfeb4145
MH		 204
205 /* Dell laptop with Broadcom chip */
7a9d4020 206 { USB_DEVICE(0x413c, 0x8126), .driver_info = BTUSB_WRONG_SCO_MTU },
cfeb4145 207
5ddd4a60 208 /* Dell Wireless 370 and 410 devices */
7a9d4020 209 { USB_DEVICE(0x413c, 0x8152), .driver_info = BTUSB_WRONG_SCO_MTU },
5ddd4a60 210 { USB_DEVICE(0x413c, 0x8156), .driver_info = BTUSB_WRONG_SCO_MTU },
cfeb4145 211
7a9d4020
MH		 212 /* Belkin F8T012 and F8T013 devices */
213 { USB_DEVICE(0x050d, 0x0012), .driver_info = BTUSB_WRONG_SCO_MTU },
214 { USB_DEVICE(0x050d, 0x0013), .driver_info = BTUSB_WRONG_SCO_MTU },
cfeb4145 215
5ddd4a60
MH		 216 /* Asus WL-BTD202 device */
217 { USB_DEVICE(0x0b05, 0x1715), .driver_info = BTUSB_WRONG_SCO_MTU },
218
219 /* Kensington Bluetooth USB adapter */
220 { USB_DEVICE(0x047d, 0x105e), .driver_info = BTUSB_WRONG_SCO_MTU },
221
cfeb4145
MH		 222 /* RTX Telecom based adapters with buggy SCO support */
223 { USB_DEVICE(0x0400, 0x0807), .driver_info = BTUSB_BROKEN_ISOC },
224 { USB_DEVICE(0x0400, 0x080a), .driver_info = BTUSB_BROKEN_ISOC },
225
226 /* CONWISE Technology based adapters with buggy SCO support */
227 { USB_DEVICE(0x0e5e, 0x6622), .driver_info = BTUSB_BROKEN_ISOC },
228
cfeb4145
MH		 229 /* Digianswer devices */
230 { USB_DEVICE(0x08fd, 0x0001), .driver_info = BTUSB_DIGIANSWER },
231 { USB_DEVICE(0x08fd, 0x0002), .driver_info = BTUSB_IGNORE },
232
233 /* CSR BlueCore Bluetooth Sniffer */
4f64fa80
MH		 234 { USB_DEVICE(0x0a12, 0x0002),
235 .driver_info = BTUSB_SNIFFER | BTUSB_BROKEN_ISOC },
cfeb4145
MH		 236
237 /* Frontline ComProbe Bluetooth Sniffer */
4f64fa80
MH		 238 { USB_DEVICE(0x16d3, 0x0002),
239 .driver_info = BTUSB_SNIFFER | BTUSB_BROKEN_ISOC },
cfeb4145 240
dffd30ee
THJA		 241 /* Intel Bluetooth device */
242 { USB_DEVICE(0x8087, 0x07dc), .driver_info = BTUSB_INTEL },
ef4e5e4a 243 { USB_DEVICE(0x8087, 0x0a2a), .driver_info = BTUSB_INTEL },
dffd30ee 244
5e23b923
MH		 245 { } /* Terminating entry */
246};
247
9bfa35fe
MH		 248#define BTUSB_MAX_ISOC_FRAMES 10
249
5e23b923
MH		 250#define BTUSB_INTR_RUNNING 0
251#define BTUSB_BULK_RUNNING 1
9bfa35fe 252#define BTUSB_ISOC_RUNNING 2
7bee549e 253#define BTUSB_SUSPENDING 3
08b8b6c4 254#define BTUSB_DID_ISO_RESUME 4
5e23b923
MH		 255
256struct btusb_data {
257 struct hci_dev *hdev;
258 struct usb_device *udev;
5fbcd260 259 struct usb_interface *intf;
9bfa35fe 260 struct usb_interface *isoc;
5e23b923
MH		 261
262 spinlock_t lock;
263
264 unsigned long flags;
265
266 struct work_struct work;
7bee549e 267 struct work_struct waker;
5e23b923
MH		 268
269 struct usb_anchor tx_anchor;
270 struct usb_anchor intr_anchor;
271 struct usb_anchor bulk_anchor;
9bfa35fe 272 struct usb_anchor isoc_anchor;
7bee549e
ON		 273 struct usb_anchor deferred;
274 int tx_in_flight;
275 spinlock_t txlock;
5e23b923
MH		 276
277 struct usb_endpoint_descriptor *intr_ep;
278 struct usb_endpoint_descriptor *bulk_tx_ep;
279 struct usb_endpoint_descriptor *bulk_rx_ep;
9bfa35fe
MH		 280 struct usb_endpoint_descriptor *isoc_tx_ep;
281 struct usb_endpoint_descriptor *isoc_rx_ep;
282
7a9d4020
MH		 283 __u8 cmdreq_type;
284
43c2e57f 285 unsigned int sco_num;
9bfa35fe 286 int isoc_altsetting;
6a88adf2 287 int suspend_count;
5e23b923
MH		 288};
289
7bee549e
ON		 290static int inc_tx(struct btusb_data *data)
291{
292 unsigned long flags;
293 int rv;
294
295 spin_lock_irqsave(&data->txlock, flags);
296 rv = test_bit(BTUSB_SUSPENDING, &data->flags);
297 if (!rv)
298 data->tx_in_flight++;
299 spin_unlock_irqrestore(&data->txlock, flags);
300
301 return rv;
302}
303
5e23b923
MH		 304static void btusb_intr_complete(struct urb *urb)
305{
306 struct hci_dev *hdev = urb->context;
155961e8 307 struct btusb_data *data = hci_get_drvdata(hdev);
5e23b923
MH		 308 int err;
309
310 BT_DBG("%s urb %p status %d count %d", hdev->name,
311 urb, urb->status, urb->actual_length);
312
313 if (!test_bit(HCI_RUNNING, &hdev->flags))
314 return;
315
316 if (urb->status == 0) {
9bfa35fe
MH		 317 hdev->stat.byte_rx += urb->actual_length;
318
5e23b923
MH		 319 if (hci_recv_fragment(hdev, HCI_EVENT_PKT,
320 urb->transfer_buffer,
321 urb->actual_length) < 0) {
322 BT_ERR("%s corrupted event packet", hdev->name);
323 hdev->stat.err_rx++;
324 }
325 }
326
327 if (!test_bit(BTUSB_INTR_RUNNING, &data->flags))
328 return;
329
7bee549e 330 usb_mark_last_busy(data->udev);
5e23b923
MH		 331 usb_anchor_urb(urb, &data->intr_anchor);
332
333 err = usb_submit_urb(urb, GFP_ATOMIC);
334 if (err < 0) {
4935f1c1
PB		 335 /* -EPERM: urb is being killed;
336 * -ENODEV: device got disconnected */
337 if (err != -EPERM && err != -ENODEV)
61faddf6 338 BT_ERR("%s urb %p failed to resubmit (%d)",
5e23b923
MH		 339 hdev->name, urb, -err);
340 usb_unanchor_urb(urb);
341 }
342}
343
2eda66f4 344static int btusb_submit_intr_urb(struct hci_dev *hdev, gfp_t mem_flags)
5e23b923 345{
155961e8 346 struct btusb_data *data = hci_get_drvdata(hdev);
5e23b923
MH		 347 struct urb *urb;
348 unsigned char *buf;
349 unsigned int pipe;
350 int err, size;
351
352 BT_DBG("%s", hdev->name);
353
9bfa35fe
MH		 354 if (!data->intr_ep)
355 return -ENODEV;
356
2eda66f4 357 urb = usb_alloc_urb(0, mem_flags);
5e23b923
MH		 358 if (!urb)
359 return -ENOMEM;
360
361 size = le16_to_cpu(data->intr_ep->wMaxPacketSize);
362
2eda66f4 363 buf = kmalloc(size, mem_flags);
5e23b923
MH		 364 if (!buf) {
365 usb_free_urb(urb);
366 return -ENOMEM;
367 }
368
369 pipe = usb_rcvintpipe(data->udev, data->intr_ep->bEndpointAddress);
370
371 usb_fill_int_urb(urb, data->udev, pipe, buf, size,
372 btusb_intr_complete, hdev,
373 data->intr_ep->bInterval);
374
375 urb->transfer_flags |= URB_FREE_BUFFER;
376
377 usb_anchor_urb(urb, &data->intr_anchor);
378
2eda66f4 379 err = usb_submit_urb(urb, mem_flags);
5e23b923 380 if (err < 0) {
d4b8d1c9
PB		 381 if (err != -EPERM && err != -ENODEV)
382 BT_ERR("%s urb %p submission failed (%d)",
5e23b923
MH		 383 hdev->name, urb, -err);
384 usb_unanchor_urb(urb);
5e23b923
MH		 385 }
386
387 usb_free_urb(urb);
388
389 return err;
390}
391
392static void btusb_bulk_complete(struct urb *urb)
393{
394 struct hci_dev *hdev = urb->context;
155961e8 395 struct btusb_data *data = hci_get_drvdata(hdev);
5e23b923
MH		 396 int err;
397
398 BT_DBG("%s urb %p status %d count %d", hdev->name,
399 urb, urb->status, urb->actual_length);
400
401 if (!test_bit(HCI_RUNNING, &hdev->flags))
402 return;
403
404 if (urb->status == 0) {
9bfa35fe
MH		 405 hdev->stat.byte_rx += urb->actual_length;
406
5e23b923
MH		 407 if (hci_recv_fragment(hdev, HCI_ACLDATA_PKT,
408 urb->transfer_buffer,
409 urb->actual_length) < 0) {
410 BT_ERR("%s corrupted ACL packet", hdev->name);
411 hdev->stat.err_rx++;
412 }
413 }
414
415 if (!test_bit(BTUSB_BULK_RUNNING, &data->flags))
416 return;
417
418 usb_anchor_urb(urb, &data->bulk_anchor);
652fd781 419 usb_mark_last_busy(data->udev);
5e23b923
MH		 420
421 err = usb_submit_urb(urb, GFP_ATOMIC);
422 if (err < 0) {
4935f1c1
PB		 423 /* -EPERM: urb is being killed;
424 * -ENODEV: device got disconnected */
425 if (err != -EPERM && err != -ENODEV)
61faddf6 426 BT_ERR("%s urb %p failed to resubmit (%d)",
5e23b923
MH		 427 hdev->name, urb, -err);
428 usb_unanchor_urb(urb);
429 }
430}
431
2eda66f4 432static int btusb_submit_bulk_urb(struct hci_dev *hdev, gfp_t mem_flags)
5e23b923 433{
155961e8 434 struct btusb_data *data = hci_get_drvdata(hdev);
5e23b923
MH		 435 struct urb *urb;
436 unsigned char *buf;
437 unsigned int pipe;
290ba200 438 int err, size = HCI_MAX_FRAME_SIZE;
5e23b923
MH		 439
440 BT_DBG("%s", hdev->name);
441
9bfa35fe
MH		 442 if (!data->bulk_rx_ep)
443 return -ENODEV;
444
2eda66f4 445 urb = usb_alloc_urb(0, mem_flags);
5e23b923
MH		 446 if (!urb)
447 return -ENOMEM;
448
2eda66f4 449 buf = kmalloc(size, mem_flags);
5e23b923
MH		 450 if (!buf) {
451 usb_free_urb(urb);
452 return -ENOMEM;
453 }
454
455 pipe = usb_rcvbulkpipe(data->udev, data->bulk_rx_ep->bEndpointAddress);
456
457 usb_fill_bulk_urb(urb, data->udev, pipe,
458 buf, size, btusb_bulk_complete, hdev);
459
460 urb->transfer_flags |= URB_FREE_BUFFER;
461
7bee549e 462 usb_mark_last_busy(data->udev);
5e23b923
MH		 463 usb_anchor_urb(urb, &data->bulk_anchor);
464
2eda66f4 465 err = usb_submit_urb(urb, mem_flags);
5e23b923 466 if (err < 0) {
d4b8d1c9
PB		 467 if (err != -EPERM && err != -ENODEV)
468 BT_ERR("%s urb %p submission failed (%d)",
5e23b923
MH		 469 hdev->name, urb, -err);
470 usb_unanchor_urb(urb);
5e23b923
MH		 471 }
472
473 usb_free_urb(urb);
474
475 return err;
476}
477
9bfa35fe
MH		 478static void btusb_isoc_complete(struct urb *urb)
479{
480 struct hci_dev *hdev = urb->context;
155961e8 481 struct btusb_data *data = hci_get_drvdata(hdev);
9bfa35fe
MH		 482 int i, err;
483
484 BT_DBG("%s urb %p status %d count %d", hdev->name,
485 urb, urb->status, urb->actual_length);
486
487 if (!test_bit(HCI_RUNNING, &hdev->flags))
488 return;
489
490 if (urb->status == 0) {
491 for (i = 0; i < urb->number_of_packets; i++) {
492 unsigned int offset = urb->iso_frame_desc[i].offset;
493 unsigned int length = urb->iso_frame_desc[i].actual_length;
494
495 if (urb->iso_frame_desc[i].status)
496 continue;
497
498 hdev->stat.byte_rx += length;
499
500 if (hci_recv_fragment(hdev, HCI_SCODATA_PKT,
501 urb->transfer_buffer + offset,
502 length) < 0) {
503 BT_ERR("%s corrupted SCO packet", hdev->name);
504 hdev->stat.err_rx++;
505 }
506 }
507 }
508
509 if (!test_bit(BTUSB_ISOC_RUNNING, &data->flags))
510 return;
511
512 usb_anchor_urb(urb, &data->isoc_anchor);
513
514 err = usb_submit_urb(urb, GFP_ATOMIC);
515 if (err < 0) {
4935f1c1
PB		 516 /* -EPERM: urb is being killed;
517 * -ENODEV: device got disconnected */
518 if (err != -EPERM && err != -ENODEV)
61faddf6 519 BT_ERR("%s urb %p failed to resubmit (%d)",
9bfa35fe
MH		 520 hdev->name, urb, -err);
521 usb_unanchor_urb(urb);
522 }
523}
524
42b16b3f 525static inline void __fill_isoc_descriptor(struct urb *urb, int len, int mtu)
9bfa35fe
MH		 526{
527 int i, offset = 0;
528
529 BT_DBG("len %d mtu %d", len, mtu);
530
531 for (i = 0; i < BTUSB_MAX_ISOC_FRAMES && len >= mtu;
532 i++, offset += mtu, len -= mtu) {
533 urb->iso_frame_desc[i].offset = offset;
534 urb->iso_frame_desc[i].length = mtu;
535 }
536
537 if (len && i < BTUSB_MAX_ISOC_FRAMES) {
538 urb->iso_frame_desc[i].offset = offset;
539 urb->iso_frame_desc[i].length = len;
540 i++;
541 }
542
543 urb->number_of_packets = i;
544}
545
2eda66f4 546static int btusb_submit_isoc_urb(struct hci_dev *hdev, gfp_t mem_flags)
9bfa35fe 547{
155961e8 548 struct btusb_data *data = hci_get_drvdata(hdev);
9bfa35fe
MH		 549 struct urb *urb;
550 unsigned char *buf;
551 unsigned int pipe;
552 int err, size;
553
554 BT_DBG("%s", hdev->name);
555
556 if (!data->isoc_rx_ep)
557 return -ENODEV;
558
2eda66f4 559 urb = usb_alloc_urb(BTUSB_MAX_ISOC_FRAMES, mem_flags);
9bfa35fe
MH		 560 if (!urb)
561 return -ENOMEM;
562
563 size = le16_to_cpu(data->isoc_rx_ep->wMaxPacketSize) *
564 BTUSB_MAX_ISOC_FRAMES;
565
2eda66f4 566 buf = kmalloc(size, mem_flags);
9bfa35fe
MH		 567 if (!buf) {
568 usb_free_urb(urb);
569 return -ENOMEM;
570 }
571
572 pipe = usb_rcvisocpipe(data->udev, data->isoc_rx_ep->bEndpointAddress);
573
fa0fb93f
BZ		 574 usb_fill_int_urb(urb, data->udev, pipe, buf, size, btusb_isoc_complete,
575 hdev, data->isoc_rx_ep->bInterval);
9bfa35fe
MH		 576
577 urb->transfer_flags = URB_FREE_BUFFER | URB_ISO_ASAP;
9bfa35fe
MH		 578
579 __fill_isoc_descriptor(urb, size,
580 le16_to_cpu(data->isoc_rx_ep->wMaxPacketSize));
581
582 usb_anchor_urb(urb, &data->isoc_anchor);
583
2eda66f4 584 err = usb_submit_urb(urb, mem_flags);
9bfa35fe 585 if (err < 0) {
d4b8d1c9
PB		 586 if (err != -EPERM && err != -ENODEV)
587 BT_ERR("%s urb %p submission failed (%d)",
9bfa35fe
MH		 588 hdev->name, urb, -err);
589 usb_unanchor_urb(urb);
9bfa35fe
MH		 590 }
591
592 usb_free_urb(urb);
593
594 return err;
595}
596
5e23b923 597static void btusb_tx_complete(struct urb *urb)
7bee549e
ON		 598{
599 struct sk_buff *skb = urb->context;
600 struct hci_dev *hdev = (struct hci_dev *) skb->dev;
155961e8 601 struct btusb_data *data = hci_get_drvdata(hdev);
7bee549e
ON		 602
603 BT_DBG("%s urb %p status %d count %d", hdev->name,
604 urb, urb->status, urb->actual_length);
605
606 if (!test_bit(HCI_RUNNING, &hdev->flags))
607 goto done;
608
609 if (!urb->status)
610 hdev->stat.byte_tx += urb->transfer_buffer_length;
611 else
612 hdev->stat.err_tx++;
613
614done:
615 spin_lock(&data->txlock);
616 data->tx_in_flight--;
617 spin_unlock(&data->txlock);
618
619 kfree(urb->setup_packet);
620
621 kfree_skb(skb);
622}
623
624static void btusb_isoc_tx_complete(struct urb *urb)
5e23b923
MH		 625{
626 struct sk_buff *skb = urb->context;
627 struct hci_dev *hdev = (struct hci_dev *) skb->dev;
628
629 BT_DBG("%s urb %p status %d count %d", hdev->name,
630 urb, urb->status, urb->actual_length);
631
632 if (!test_bit(HCI_RUNNING, &hdev->flags))
633 goto done;
634
635 if (!urb->status)
636 hdev->stat.byte_tx += urb->transfer_buffer_length;
637 else
638 hdev->stat.err_tx++;
639
640done:
641 kfree(urb->setup_packet);
642
643 kfree_skb(skb);
644}
645
646static int btusb_open(struct hci_dev *hdev)
647{
155961e8 648 struct btusb_data *data = hci_get_drvdata(hdev);
5e23b923
MH		 649 int err;
650
651 BT_DBG("%s", hdev->name);
652
7bee549e
ON		 653 err = usb_autopm_get_interface(data->intf);
654 if (err < 0)
655 return err;
656
657 data->intf->needs_remote_wakeup = 1;
658
5e23b923 659 if (test_and_set_bit(HCI_RUNNING, &hdev->flags))
7bee549e 660 goto done;
5e23b923
MH		 661
662 if (test_and_set_bit(BTUSB_INTR_RUNNING, &data->flags))
7bee549e 663 goto done;
5e23b923 664
2eda66f4 665 err = btusb_submit_intr_urb(hdev, GFP_KERNEL);
43c2e57f
MH		 666 if (err < 0)
667 goto failed;
668
669 err = btusb_submit_bulk_urb(hdev, GFP_KERNEL);
5e23b923 670 if (err < 0) {
43c2e57f
MH		 671 usb_kill_anchored_urbs(&data->intr_anchor);
672 goto failed;
5e23b923
MH		 673 }
674
43c2e57f
MH		 675 set_bit(BTUSB_BULK_RUNNING, &data->flags);
676 btusb_submit_bulk_urb(hdev, GFP_KERNEL);
677
7bee549e
ON		 678done:
679 usb_autopm_put_interface(data->intf);
43c2e57f
MH		 680 return 0;
681
682failed:
683 clear_bit(BTUSB_INTR_RUNNING, &data->flags);
684 clear_bit(HCI_RUNNING, &hdev->flags);
7bee549e 685 usb_autopm_put_interface(data->intf);
5e23b923
MH		 686 return err;
687}
688
7bee549e
ON		 689static void btusb_stop_traffic(struct btusb_data *data)
690{
691 usb_kill_anchored_urbs(&data->intr_anchor);
692 usb_kill_anchored_urbs(&data->bulk_anchor);
693 usb_kill_anchored_urbs(&data->isoc_anchor);
694}
695
5e23b923
MH		 696static int btusb_close(struct hci_dev *hdev)
697{
155961e8 698 struct btusb_data *data = hci_get_drvdata(hdev);
7bee549e 699 int err;
5e23b923
MH		 700
701 BT_DBG("%s", hdev->name);
702
703 if (!test_and_clear_bit(HCI_RUNNING, &hdev->flags))
704 return 0;
705
e8c3c3d2 706 cancel_work_sync(&data->work);
404291ac 707 cancel_work_sync(&data->waker);
e8c3c3d2 708
9bfa35fe 709 clear_bit(BTUSB_ISOC_RUNNING, &data->flags);
5e23b923 710 clear_bit(BTUSB_BULK_RUNNING, &data->flags);
5e23b923 711 clear_bit(BTUSB_INTR_RUNNING, &data->flags);
7bee549e
ON		 712
713 btusb_stop_traffic(data);
714 err = usb_autopm_get_interface(data->intf);
715 if (err < 0)
7b8e2c1d 716 goto failed;
7bee549e
ON		 717
718 data->intf->needs_remote_wakeup = 0;
719 usb_autopm_put_interface(data->intf);
5e23b923 720
7b8e2c1d
ON		 721failed:
722 usb_scuttle_anchored_urbs(&data->deferred);
5e23b923
MH		 723 return 0;
724}
725
726static int btusb_flush(struct hci_dev *hdev)
727{
155961e8 728 struct btusb_data *data = hci_get_drvdata(hdev);
5e23b923
MH		 729
730 BT_DBG("%s", hdev->name);
731
732 usb_kill_anchored_urbs(&data->tx_anchor);
733
734 return 0;
735}
736
7bd8f09f 737static int btusb_send_frame(struct hci_dev *hdev, struct sk_buff *skb)
5e23b923 738{
155961e8 739 struct btusb_data *data = hci_get_drvdata(hdev);
5e23b923
MH		 740 struct usb_ctrlrequest *dr;
741 struct urb *urb;
742 unsigned int pipe;
743 int err;
744
745 BT_DBG("%s", hdev->name);
746
747 if (!test_bit(HCI_RUNNING, &hdev->flags))
748 return -EBUSY;
749
7bd8f09f
MH		 750 skb->dev = (void *) hdev;
751
5e23b923
MH		 752 switch (bt_cb(skb)->pkt_type) {
753 case HCI_COMMAND_PKT:
754 urb = usb_alloc_urb(0, GFP_ATOMIC);
755 if (!urb)
756 return -ENOMEM;
757
758 dr = kmalloc(sizeof(*dr), GFP_ATOMIC);
759 if (!dr) {
760 usb_free_urb(urb);
761 return -ENOMEM;
762 }
763
7a9d4020 764 dr->bRequestType = data->cmdreq_type;
5e23b923
MH		 765 dr->bRequest = 0;
766 dr->wIndex = 0;
767 dr->wValue = 0;
768 dr->wLength = __cpu_to_le16(skb->len);
769
770 pipe = usb_sndctrlpipe(data->udev, 0x00);
771
772 usb_fill_control_urb(urb, data->udev, pipe, (void *) dr,
773 skb->data, skb->len, btusb_tx_complete, skb);
774
775 hdev->stat.cmd_tx++;
776 break;
777
778 case HCI_ACLDATA_PKT:
9fd481e0 779 if (!data->bulk_tx_ep)
9bfa35fe
MH		 780 return -ENODEV;
781
5e23b923
MH		 782 urb = usb_alloc_urb(0, GFP_ATOMIC);
783 if (!urb)
784 return -ENOMEM;
785
786 pipe = usb_sndbulkpipe(data->udev,
787 data->bulk_tx_ep->bEndpointAddress);
788
789 usb_fill_bulk_urb(urb, data->udev, pipe,
790 skb->data, skb->len, btusb_tx_complete, skb);
791
792 hdev->stat.acl_tx++;
793 break;
794
795 case HCI_SCODATA_PKT:
014f7bc7 796 if (!data->isoc_tx_ep || hci_conn_num(hdev, SCO_LINK) < 1)
9bfa35fe
MH		 797 return -ENODEV;
798
799 urb = usb_alloc_urb(BTUSB_MAX_ISOC_FRAMES, GFP_ATOMIC);
800 if (!urb)
801 return -ENOMEM;
802
803 pipe = usb_sndisocpipe(data->udev,
804 data->isoc_tx_ep->bEndpointAddress);
805
03c2d0e8
GP		 806 usb_fill_int_urb(urb, data->udev, pipe,
807 skb->data, skb->len, btusb_isoc_tx_complete,
808 skb, data->isoc_tx_ep->bInterval);
9bfa35fe
MH		 809
810 urb->transfer_flags = URB_ISO_ASAP;
9bfa35fe
MH		 811
812 __fill_isoc_descriptor(urb, skb->len,
813 le16_to_cpu(data->isoc_tx_ep->wMaxPacketSize));
814
5e23b923 815 hdev->stat.sco_tx++;
7bee549e 816 goto skip_waking;
5e23b923
MH		 817
818 default:
819 return -EILSEQ;
820 }
821
7bee549e
ON		 822 err = inc_tx(data);
823 if (err) {
824 usb_anchor_urb(urb, &data->deferred);
825 schedule_work(&data->waker);
826 err = 0;
827 goto done;
828 }
829
830skip_waking:
5e23b923
MH		 831 usb_anchor_urb(urb, &data->tx_anchor);
832
833 err = usb_submit_urb(urb, GFP_ATOMIC);
834 if (err < 0) {
5a9b80e2
PB		 835 if (err != -EPERM && err != -ENODEV)
836 BT_ERR("%s urb %p submission failed (%d)",
837 hdev->name, urb, -err);
5e23b923
MH		 838 kfree(urb->setup_packet);
839 usb_unanchor_urb(urb);
7bee549e
ON		 840 } else {
841 usb_mark_last_busy(data->udev);
5e23b923
MH		 842 }
843
7bee549e 844done:
54a8a79c 845 usb_free_urb(urb);
5e23b923
MH		 846 return err;
847}
848
5e23b923
MH		 849static void btusb_notify(struct hci_dev *hdev, unsigned int evt)
850{
155961e8 851 struct btusb_data *data = hci_get_drvdata(hdev);
5e23b923
MH		 852
853 BT_DBG("%s evt %d", hdev->name, evt);
854
014f7bc7
MH		 855 if (hci_conn_num(hdev, SCO_LINK) != data->sco_num) {
856 data->sco_num = hci_conn_num(hdev, SCO_LINK);
43c2e57f 857 schedule_work(&data->work);
a780efa8 858 }
5e23b923
MH		 859}
860
42b16b3f 861static inline int __set_isoc_interface(struct hci_dev *hdev, int altsetting)
9bfa35fe 862{
155961e8 863 struct btusb_data *data = hci_get_drvdata(hdev);
9bfa35fe
MH		 864 struct usb_interface *intf = data->isoc;
865 struct usb_endpoint_descriptor *ep_desc;
866 int i, err;
867
868 if (!data->isoc)
869 return -ENODEV;
870
871 err = usb_set_interface(data->udev, 1, altsetting);
872 if (err < 0) {
873 BT_ERR("%s setting interface failed (%d)", hdev->name, -err);
874 return err;
875 }
876
877 data->isoc_altsetting = altsetting;
878
879 data->isoc_tx_ep = NULL;
880 data->isoc_rx_ep = NULL;
881
882 for (i = 0; i < intf->cur_altsetting->desc.bNumEndpoints; i++) {
883 ep_desc = &intf->cur_altsetting->endpoint[i].desc;
884
885 if (!data->isoc_tx_ep && usb_endpoint_is_isoc_out(ep_desc)) {
886 data->isoc_tx_ep = ep_desc;
887 continue;
888 }
889
890 if (!data->isoc_rx_ep && usb_endpoint_is_isoc_in(ep_desc)) {
891 data->isoc_rx_ep = ep_desc;
892 continue;
893 }
894 }
895
896 if (!data->isoc_tx_ep || !data->isoc_rx_ep) {
897 BT_ERR("%s invalid SCO descriptors", hdev->name);
898 return -ENODEV;
899 }
900
901 return 0;
902}
903
5e23b923
MH		 904static void btusb_work(struct work_struct *work)
905{
906 struct btusb_data *data = container_of(work, struct btusb_data, work);
907 struct hci_dev *hdev = data->hdev;
f4001d28 908 int new_alts;
7bee549e 909 int err;
5e23b923 910
014f7bc7 911 if (data->sco_num > 0) {
08b8b6c4 912 if (!test_bit(BTUSB_DID_ISO_RESUME, &data->flags)) {
8efdd0cd 913 err = usb_autopm_get_interface(data->isoc ? data->isoc : data->intf);
7bee549e
ON		 914 if (err < 0) {
915 clear_bit(BTUSB_ISOC_RUNNING, &data->flags);
916 usb_kill_anchored_urbs(&data->isoc_anchor);
917 return;
918 }
919
08b8b6c4 920 set_bit(BTUSB_DID_ISO_RESUME, &data->flags);
7bee549e 921 }
f4001d28
MA		 922
923 if (hdev->voice_setting & 0x0020) {
924 static const int alts[3] = { 2, 4, 5 };
014f7bc7 925 new_alts = alts[data->sco_num - 1];
f4001d28 926 } else {
014f7bc7 927 new_alts = data->sco_num;
f4001d28
MA		 928 }
929
930 if (data->isoc_altsetting != new_alts) {
9bfa35fe
MH		 931 clear_bit(BTUSB_ISOC_RUNNING, &data->flags);
932 usb_kill_anchored_urbs(&data->isoc_anchor);
933
f4001d28 934 if (__set_isoc_interface(hdev, new_alts) < 0)
9bfa35fe
MH		 935 return;
936 }
937
938 if (!test_and_set_bit(BTUSB_ISOC_RUNNING, &data->flags)) {
2eda66f4 939 if (btusb_submit_isoc_urb(hdev, GFP_KERNEL) < 0)
9bfa35fe
MH		 940 clear_bit(BTUSB_ISOC_RUNNING, &data->flags);
941 else
2eda66f4 942 btusb_submit_isoc_urb(hdev, GFP_KERNEL);
9bfa35fe
MH		 943 }
944 } else {
945 clear_bit(BTUSB_ISOC_RUNNING, &data->flags);
946 usb_kill_anchored_urbs(&data->isoc_anchor);
947
948 __set_isoc_interface(hdev, 0);
08b8b6c4 949 if (test_and_clear_bit(BTUSB_DID_ISO_RESUME, &data->flags))
8efdd0cd 950 usb_autopm_put_interface(data->isoc ? data->isoc : data->intf);
5e23b923
MH		 951 }
952}
953
7bee549e
ON		 954static void btusb_waker(struct work_struct *work)
955{
956 struct btusb_data *data = container_of(work, struct btusb_data, waker);
957 int err;
958
959 err = usb_autopm_get_interface(data->intf);
960 if (err < 0)
961 return;
962
963 usb_autopm_put_interface(data->intf);
964}
965
9f8f962c
MH		 966static int btusb_setup_bcm92035(struct hci_dev *hdev)
967{
968 struct sk_buff *skb;
969 u8 val = 0x00;
970
971 BT_DBG("%s", hdev->name);
972
973 skb = __hci_cmd_sync(hdev, 0xfc3b, 1, &val, HCI_INIT_TIMEOUT);
974 if (IS_ERR(skb))
975 BT_ERR("BCM92035 command failed (%ld)", -PTR_ERR(skb));
976 else
977 kfree_skb(skb);
978
979 return 0;
980}
981
81cac64b
MH		 982static int btusb_setup_csr(struct hci_dev *hdev)
983{
984 struct hci_rp_read_local_version *rp;
985 struct sk_buff *skb;
986 int ret;
987
988 BT_DBG("%s", hdev->name);
989
990 skb = __hci_cmd_sync(hdev, HCI_OP_READ_LOCAL_VERSION, 0, NULL,
991 HCI_INIT_TIMEOUT);
992 if (IS_ERR(skb)) {
993 BT_ERR("Reading local version failed (%ld)", -PTR_ERR(skb));
994 return -PTR_ERR(skb);
995 }
996
997 rp = (struct hci_rp_read_local_version *) skb->data;
998
999 if (!rp->status) {
1000 if (le16_to_cpu(rp->manufacturer) != 10) {
1001 /* Clear the reset quirk since this is not an actual
1002 * early Bluetooth 1.1 device from CSR.
1003 */
1004 clear_bit(HCI_QUIRK_RESET_ON_CLOSE, &hdev->quirks);
1005
1006 /* These fake CSR controllers have all a broken
1007 * stored link key handling and so just disable it.
1008 */
1009 set_bit(HCI_QUIRK_BROKEN_STORED_LINK_KEY,
1010 &hdev->quirks);
1011 }
1012 }
1013
1014 ret = -bt_to_errno(rp->status);
1015
1016 kfree_skb(skb);
1017
1018 return ret;
1019}
1020
dffd30ee
THJA		 1021struct intel_version {
1022 u8 status;
1023 u8 hw_platform;
1024 u8 hw_variant;
1025 u8 hw_revision;
1026 u8 fw_variant;
1027 u8 fw_revision;
1028 u8 fw_build_num;
1029 u8 fw_build_ww;
1030 u8 fw_build_yy;
1031 u8 fw_patch_num;
1032} __packed;
1033
1034static const struct firmware *btusb_setup_intel_get_fw(struct hci_dev *hdev,
1035 struct intel_version *ver)
1036{
1037 const struct firmware *fw;
1038 char fwname[64];
1039 int ret;
1040
1041 snprintf(fwname, sizeof(fwname),
1042 "intel/ibt-hw-%x.%x.%x-fw-%x.%x.%x.%x.%x.bseq",
1043 ver->hw_platform, ver->hw_variant, ver->hw_revision,
1044 ver->fw_variant, ver->fw_revision, ver->fw_build_num,
1045 ver->fw_build_ww, ver->fw_build_yy);
1046
1047 ret = request_firmware(&fw, fwname, &hdev->dev);
1048 if (ret < 0) {
1049 if (ret == -EINVAL) {
1050 BT_ERR("%s Intel firmware file request failed (%d)",
1051 hdev->name, ret);
1052 return NULL;
1053 }
1054
1055 BT_ERR("%s failed to open Intel firmware file: %s(%d)",
1056 hdev->name, fwname, ret);
1057
1058 /* If the correct firmware patch file is not found, use the
1059 * default firmware patch file instead
1060 */
1061 snprintf(fwname, sizeof(fwname), "intel/ibt-hw-%x.%x.bseq",
1062 ver->hw_platform, ver->hw_variant);
1063 if (request_firmware(&fw, fwname, &hdev->dev) < 0) {
1064 BT_ERR("%s failed to open default Intel fw file: %s",
1065 hdev->name, fwname);
1066 return NULL;
1067 }
1068 }
1069
1070 BT_INFO("%s: Intel Bluetooth firmware file: %s", hdev->name, fwname);
1071
1072 return fw;
1073}
1074
1075static int btusb_setup_intel_patching(struct hci_dev *hdev,
1076 const struct firmware *fw,
1077 const u8 **fw_ptr, int *disable_patch)
1078{
1079 struct sk_buff *skb;
1080 struct hci_command_hdr *cmd;
1081 const u8 *cmd_param;
1082 struct hci_event_hdr *evt = NULL;
1083 const u8 *evt_param = NULL;
1084 int remain = fw->size - (*fw_ptr - fw->data);
1085
1086 /* The first byte indicates the types of the patch command or event.
1087 * 0x01 means HCI command and 0x02 is HCI event. If the first bytes
1088 * in the current firmware buffer doesn't start with 0x01 or
1089 * the size of remain buffer is smaller than HCI command header,
1090 * the firmware file is corrupted and it should stop the patching
1091 * process.
1092 */
1093 if (remain > HCI_COMMAND_HDR_SIZE && *fw_ptr[0] != 0x01) {
1094 BT_ERR("%s Intel fw corrupted: invalid cmd read", hdev->name);
1095 return -EINVAL;
1096 }
1097 (*fw_ptr)++;
1098 remain--;
1099
1100 cmd = (struct hci_command_hdr *)(*fw_ptr);
1101 *fw_ptr += sizeof(*cmd);
1102 remain -= sizeof(*cmd);
1103
1104 /* Ensure that the remain firmware data is long enough than the length
1105 * of command parameter. If not, the firmware file is corrupted.
1106 */
1107 if (remain < cmd->plen) {
1108 BT_ERR("%s Intel fw corrupted: invalid cmd len", hdev->name);
1109 return -EFAULT;
1110 }
1111
1112 /* If there is a command that loads a patch in the firmware
1113 * file, then enable the patch upon success, otherwise just
1114 * disable the manufacturer mode, for example patch activation
1115 * is not required when the default firmware patch file is used
1116 * because there are no patch data to load.
1117 */
1118 if (*disable_patch && le16_to_cpu(cmd->opcode) == 0xfc8e)
1119 *disable_patch = 0;
1120
1121 cmd_param = *fw_ptr;
1122 *fw_ptr += cmd->plen;
1123 remain -= cmd->plen;
1124
1125 /* This reads the expected events when the above command is sent to the
1126 * device. Some vendor commands expects more than one events, for
1127 * example command status event followed by vendor specific event.
1128 * For this case, it only keeps the last expected event. so the command
1129 * can be sent with __hci_cmd_sync_ev() which returns the sk_buff of
1130 * last expected event.
1131 */
1132 while (remain > HCI_EVENT_HDR_SIZE && *fw_ptr[0] == 0x02) {
1133 (*fw_ptr)++;
1134 remain--;
1135
1136 evt = (struct hci_event_hdr *)(*fw_ptr);
1137 *fw_ptr += sizeof(*evt);
1138 remain -= sizeof(*evt);
1139
1140 if (remain < evt->plen) {
1141 BT_ERR("%s Intel fw corrupted: invalid evt len",
1142 hdev->name);
1143 return -EFAULT;
1144 }
1145
1146 evt_param = *fw_ptr;
1147 *fw_ptr += evt->plen;
1148 remain -= evt->plen;
1149 }
1150
1151 /* Every HCI commands in the firmware file has its correspond event.
1152 * If event is not found or remain is smaller than zero, the firmware
1153 * file is corrupted.
1154 */
1155 if (!evt || !evt_param || remain < 0) {
1156 BT_ERR("%s Intel fw corrupted: invalid evt read", hdev->name);
1157 return -EFAULT;
1158 }
1159
1160 skb = __hci_cmd_sync_ev(hdev, le16_to_cpu(cmd->opcode), cmd->plen,
1161 cmd_param, evt->evt, HCI_INIT_TIMEOUT);
1162 if (IS_ERR(skb)) {
1163 BT_ERR("%s sending Intel patch command (0x%4.4x) failed (%ld)",
1164 hdev->name, cmd->opcode, PTR_ERR(skb));
d9c78e97 1165 return PTR_ERR(skb);
dffd30ee
THJA		 1166 }
1167
1168 /* It ensures that the returned event matches the event data read from
1169 * the firmware file. At fist, it checks the length and then
1170 * the contents of the event.
1171 */
1172 if (skb->len != evt->plen) {
1173 BT_ERR("%s mismatch event length (opcode 0x%4.4x)", hdev->name,
1174 le16_to_cpu(cmd->opcode));
1175 kfree_skb(skb);
1176 return -EFAULT;
1177 }
1178
1179 if (memcmp(skb->data, evt_param, evt->plen)) {
1180 BT_ERR("%s mismatch event parameter (opcode 0x%4.4x)",
1181 hdev->name, le16_to_cpu(cmd->opcode));
1182 kfree_skb(skb);
1183 return -EFAULT;
1184 }
1185 kfree_skb(skb);
1186
1187 return 0;
1188}
1189
40cb0984
MH		 1190#define BDADDR_INTEL (&(bdaddr_t) {{0x00, 0x8b, 0x9e, 0x19, 0x03, 0x00}})
1191
1192static int btusb_check_bdaddr_intel(struct hci_dev *hdev)
1193{
1194 struct sk_buff *skb;
1195 struct hci_rp_read_bd_addr *rp;
1196
1197 skb = __hci_cmd_sync(hdev, HCI_OP_READ_BD_ADDR, 0, NULL,
1198 HCI_INIT_TIMEOUT);
1199 if (IS_ERR(skb)) {
1200 BT_ERR("%s reading Intel device address failed (%ld)",
1201 hdev->name, PTR_ERR(skb));
1202 return PTR_ERR(skb);
1203 }
1204
1205 if (skb->len != sizeof(*rp)) {
1206 BT_ERR("%s Intel device address length mismatch", hdev->name);
1207 kfree_skb(skb);
1208 return -EIO;
1209 }
1210
1211 rp = (struct hci_rp_read_bd_addr *) skb->data;
1212 if (rp->status) {
1213 BT_ERR("%s Intel device address result failed (%02x)",
1214 hdev->name, rp->status);
1215 kfree_skb(skb);
1216 return -bt_to_errno(rp->status);
1217 }
1218
1219 /* For some Intel based controllers, the default Bluetooth device
1220 * address 00:03:19:9E:8B:00 can be found. These controllers are
1221 * fully operational, but have the danger of duplicate addresses
1222 * and that in turn can cause problems with Bluetooth operation.
1223 */
4739b5b1 1224 if (!bacmp(&rp->bdaddr, BDADDR_INTEL)) {
40cb0984
MH		 1225 BT_ERR("%s found Intel default device address (%pMR)",
1226 hdev->name, &rp->bdaddr);
4739b5b1
MH		 1227 set_bit(HCI_QUIRK_INVALID_BDADDR, &hdev->quirks);
1228 }
40cb0984
MH		 1229
1230 kfree_skb(skb);
1231
1232 return 0;
1233}
1234
dffd30ee
THJA		 1235static int btusb_setup_intel(struct hci_dev *hdev)
1236{
1237 struct sk_buff *skb;
1238 const struct firmware *fw;
1239 const u8 *fw_ptr;
1240 int disable_patch;
1241 struct intel_version *ver;
1242
1243 const u8 mfg_enable[] = { 0x01, 0x00 };
1244 const u8 mfg_disable[] = { 0x00, 0x00 };
1245 const u8 mfg_reset_deactivate[] = { 0x00, 0x01 };
1246 const u8 mfg_reset_activate[] = { 0x00, 0x02 };
1247
1248 BT_DBG("%s", hdev->name);
1249
1250 /* The controller has a bug with the first HCI command sent to it
1251 * returning number of completed commands as zero. This would stall the
1252 * command processing in the Bluetooth core.
1253 *
1254 * As a workaround, send HCI Reset command first which will reset the
1255 * number of completed commands and allow normal command processing
1256 * from now on.
1257 */
1258 skb = __hci_cmd_sync(hdev, HCI_OP_RESET, 0, NULL, HCI_INIT_TIMEOUT);
1259 if (IS_ERR(skb)) {
1260 BT_ERR("%s sending initial HCI reset command failed (%ld)",
1261 hdev->name, PTR_ERR(skb));
d9c78e97 1262 return PTR_ERR(skb);
dffd30ee
THJA		 1263 }
1264 kfree_skb(skb);
1265
1266 /* Read Intel specific controller version first to allow selection of
1267 * which firmware file to load.
1268 *
1269 * The returned information are hardware variant and revision plus
1270 * firmware variant, revision and build number.
1271 */
1272 skb = __hci_cmd_sync(hdev, 0xfc05, 0, NULL, HCI_INIT_TIMEOUT);
1273 if (IS_ERR(skb)) {
1274 BT_ERR("%s reading Intel fw version command failed (%ld)",
1275 hdev->name, PTR_ERR(skb));
d9c78e97 1276 return PTR_ERR(skb);
dffd30ee
THJA		 1277 }
1278
1279 if (skb->len != sizeof(*ver)) {
1280 BT_ERR("%s Intel version event length mismatch", hdev->name);
1281 kfree_skb(skb);
1282 return -EIO;
1283 }
1284
1285 ver = (struct intel_version *)skb->data;
1286 if (ver->status) {
1287 BT_ERR("%s Intel fw version event failed (%02x)", hdev->name,
1288 ver->status);
1289 kfree_skb(skb);
1290 return -bt_to_errno(ver->status);
1291 }
1292
1293 BT_INFO("%s: read Intel version: %02x%02x%02x%02x%02x%02x%02x%02x%02x",
1294 hdev->name, ver->hw_platform, ver->hw_variant,
1295 ver->hw_revision, ver->fw_variant, ver->fw_revision,
1296 ver->fw_build_num, ver->fw_build_ww, ver->fw_build_yy,
1297 ver->fw_patch_num);
1298
1299 /* fw_patch_num indicates the version of patch the device currently
1300 * have. If there is no patch data in the device, it is always 0x00.
1301 * So, if it is other than 0x00, no need to patch the deivce again.
1302 */
1303 if (ver->fw_patch_num) {
1304 BT_INFO("%s: Intel device is already patched. patch num: %02x",
1305 hdev->name, ver->fw_patch_num);
1306 kfree_skb(skb);
40cb0984 1307 btusb_check_bdaddr_intel(hdev);
dffd30ee
THJA		 1308 return 0;
1309 }
1310
1311 /* Opens the firmware patch file based on the firmware version read
1312 * from the controller. If it fails to open the matching firmware
1313 * patch file, it tries to open the default firmware patch file.
1314 * If no patch file is found, allow the device to operate without
1315 * a patch.
1316 */
1317 fw = btusb_setup_intel_get_fw(hdev, ver);
1318 if (!fw) {
1319 kfree_skb(skb);
40cb0984 1320 btusb_check_bdaddr_intel(hdev);
dffd30ee
THJA		 1321 return 0;
1322 }
1323 fw_ptr = fw->data;
1324
1325 /* This Intel specific command enables the manufacturer mode of the
1326 * controller.
1327 *
1328 * Only while this mode is enabled, the driver can download the
1329 * firmware patch data and configuration parameters.
1330 */
1331 skb = __hci_cmd_sync(hdev, 0xfc11, 2, mfg_enable, HCI_INIT_TIMEOUT);
1332 if (IS_ERR(skb)) {
1333 BT_ERR("%s entering Intel manufacturer mode failed (%ld)",
1334 hdev->name, PTR_ERR(skb));
1335 release_firmware(fw);
d9c78e97 1336 return PTR_ERR(skb);
dffd30ee
THJA		 1337 }
1338
1339 if (skb->data[0]) {
1340 u8 evt_status = skb->data[0];
1341 BT_ERR("%s enable Intel manufacturer mode event failed (%02x)",
1342 hdev->name, evt_status);
1343 kfree_skb(skb);
1344 release_firmware(fw);
1345 return -bt_to_errno(evt_status);
1346 }
1347 kfree_skb(skb);
1348
1349 disable_patch = 1;
1350
1351 /* The firmware data file consists of list of Intel specific HCI
1352 * commands and its expected events. The first byte indicates the
1353 * type of the message, either HCI command or HCI event.
1354 *
1355 * It reads the command and its expected event from the firmware file,
1356 * and send to the controller. Once __hci_cmd_sync_ev() returns,
1357 * the returned event is compared with the event read from the firmware
1358 * file and it will continue until all the messages are downloaded to
1359 * the controller.
1360 *
1361 * Once the firmware patching is completed successfully,
1362 * the manufacturer mode is disabled with reset and activating the
1363 * downloaded patch.
1364 *
1365 * If the firmware patching fails, the manufacturer mode is
1366 * disabled with reset and deactivating the patch.
1367 *
1368 * If the default patch file is used, no reset is done when disabling
1369 * the manufacturer.
1370 */
1371 while (fw->size > fw_ptr - fw->data) {
1372 int ret;
1373
1374 ret = btusb_setup_intel_patching(hdev, fw, &fw_ptr,
1375 &disable_patch);
1376 if (ret < 0)
1377 goto exit_mfg_deactivate;
1378 }
1379
1380 release_firmware(fw);
1381
1382 if (disable_patch)
1383 goto exit_mfg_disable;
1384
1385 /* Patching completed successfully and disable the manufacturer mode
1386 * with reset and activate the downloaded firmware patches.
1387 */
1388 skb = __hci_cmd_sync(hdev, 0xfc11, sizeof(mfg_reset_activate),
1389 mfg_reset_activate, HCI_INIT_TIMEOUT);
1390 if (IS_ERR(skb)) {
1391 BT_ERR("%s exiting Intel manufacturer mode failed (%ld)",
1392 hdev->name, PTR_ERR(skb));
d9c78e97 1393 return PTR_ERR(skb);
dffd30ee
THJA		 1394 }
1395 kfree_skb(skb);
1396
1397 BT_INFO("%s: Intel Bluetooth firmware patch completed and activated",
1398 hdev->name);
1399
40cb0984 1400 btusb_check_bdaddr_intel(hdev);
dffd30ee
THJA		 1401 return 0;
1402
1403exit_mfg_disable:
1404 /* Disable the manufacturer mode without reset */
1405 skb = __hci_cmd_sync(hdev, 0xfc11, sizeof(mfg_disable), mfg_disable,
1406 HCI_INIT_TIMEOUT);
1407 if (IS_ERR(skb)) {
1408 BT_ERR("%s exiting Intel manufacturer mode failed (%ld)",
1409 hdev->name, PTR_ERR(skb));
d9c78e97 1410 return PTR_ERR(skb);
dffd30ee
THJA		 1411 }
1412 kfree_skb(skb);
1413
1414 BT_INFO("%s: Intel Bluetooth firmware patch completed", hdev->name);
40cb0984
MH		 1415
1416 btusb_check_bdaddr_intel(hdev);
dffd30ee
THJA		 1417 return 0;
1418
1419exit_mfg_deactivate:
1420 release_firmware(fw);
1421
1422 /* Patching failed. Disable the manufacturer mode with reset and
1423 * deactivate the downloaded firmware patches.
1424 */
1425 skb = __hci_cmd_sync(hdev, 0xfc11, sizeof(mfg_reset_deactivate),
1426 mfg_reset_deactivate, HCI_INIT_TIMEOUT);
1427 if (IS_ERR(skb)) {
1428 BT_ERR("%s exiting Intel manufacturer mode failed (%ld)",
1429 hdev->name, PTR_ERR(skb));
d9c78e97 1430 return PTR_ERR(skb);
dffd30ee
THJA		 1431 }
1432 kfree_skb(skb);
1433
1434 BT_INFO("%s: Intel Bluetooth firmware patch completed and deactivated",
1435 hdev->name);
1436
40cb0984 1437 btusb_check_bdaddr_intel(hdev);
dffd30ee
THJA		 1438 return 0;
1439}
1440
cb8d6597
MH		 1441static int btusb_set_bdaddr_intel(struct hci_dev *hdev, const bdaddr_t *bdaddr)
1442{
1443 struct sk_buff *skb;
1444 long ret;
1445
1446 skb = __hci_cmd_sync(hdev, 0xfc31, 6, bdaddr, HCI_INIT_TIMEOUT);
1447 if (IS_ERR(skb)) {
1448 ret = PTR_ERR(skb);
1449 BT_ERR("%s: changing Intel device address failed (%ld)",
1450 hdev->name, ret);
1451 return ret;
1452 }
1453 kfree_skb(skb);
1454
1455 return 0;
1456}
1457
c8abb73f
MH		 1458#define BDADDR_BCM20702A0 (&(bdaddr_t) {{0x00, 0xa0, 0x02, 0x70, 0x20, 0x00}})
1459
10d4c673
PG		 1460static int btusb_setup_bcm_patchram(struct hci_dev *hdev)
1461{
1462 struct btusb_data *data = hci_get_drvdata(hdev);
1463 struct usb_device *udev = data->udev;
1464 char fw_name[64];
1465 const struct firmware *fw;
1466 const u8 *fw_ptr;
1467 size_t fw_size;
1468 const struct hci_command_hdr *cmd;
1469 const u8 *cmd_param;
1470 u16 opcode;
1471 struct sk_buff *skb;
1472 struct hci_rp_read_local_version *ver;
c8abb73f 1473 struct hci_rp_read_bd_addr *bda;
10d4c673
PG		 1474 long ret;
1475
1476 snprintf(fw_name, sizeof(fw_name), "brcm/%s-%04x-%04x.hcd",
1477 udev->product ? udev->product : "BCM",
1478 le16_to_cpu(udev->descriptor.idVendor),
1479 le16_to_cpu(udev->descriptor.idProduct));
1480
1481 ret = request_firmware(&fw, fw_name, &hdev->dev);
1482 if (ret < 0) {
c8abb73f 1483 BT_INFO("%s: BCM: patch %s not found", hdev->name, fw_name);
10d4c673
PG		 1484 return 0;
1485 }
1486
1487 /* Reset */
1488 skb = __hci_cmd_sync(hdev, HCI_OP_RESET, 0, NULL, HCI_INIT_TIMEOUT);
1489 if (IS_ERR(skb)) {
1490 ret = PTR_ERR(skb);
1491 BT_ERR("%s: HCI_OP_RESET failed (%ld)", hdev->name, ret);
1492 goto done;
1493 }
1494 kfree_skb(skb);
1495
1496 /* Read Local Version Info */
1497 skb = __hci_cmd_sync(hdev, HCI_OP_READ_LOCAL_VERSION, 0, NULL,
1498 HCI_INIT_TIMEOUT);
1499 if (IS_ERR(skb)) {
1500 ret = PTR_ERR(skb);
1501 BT_ERR("%s: HCI_OP_READ_LOCAL_VERSION failed (%ld)",
1502 hdev->name, ret);
1503 goto done;
1504 }
1505
1506 if (skb->len != sizeof(*ver)) {
1507 BT_ERR("%s: HCI_OP_READ_LOCAL_VERSION event length mismatch",
1508 hdev->name);
1509 kfree_skb(skb);
1510 ret = -EIO;
1511 goto done;
1512 }
1513
1514 ver = (struct hci_rp_read_local_version *) skb->data;
1515 BT_INFO("%s: BCM: patching hci_ver=%02x hci_rev=%04x lmp_ver=%02x "
1516 "lmp_subver=%04x", hdev->name, ver->hci_ver, ver->hci_rev,
1517 ver->lmp_ver, ver->lmp_subver);
1518 kfree_skb(skb);
1519
1520 /* Start Download */
1521 skb = __hci_cmd_sync(hdev, 0xfc2e, 0, NULL, HCI_INIT_TIMEOUT);
1522 if (IS_ERR(skb)) {
1523 ret = PTR_ERR(skb);
1524 BT_ERR("%s: BCM: Download Minidrv command failed (%ld)",
1525 hdev->name, ret);
1526 goto reset_fw;
1527 }
1528 kfree_skb(skb);
1529
1530 /* 50 msec delay after Download Minidrv completes */
1531 msleep(50);
1532
1533 fw_ptr = fw->data;
1534 fw_size = fw->size;
1535
1536 while (fw_size >= sizeof(*cmd)) {
1537 cmd = (struct hci_command_hdr *) fw_ptr;
1538 fw_ptr += sizeof(*cmd);
1539 fw_size -= sizeof(*cmd);
1540
1541 if (fw_size < cmd->plen) {
1542 BT_ERR("%s: BCM: patch %s is corrupted",
1543 hdev->name, fw_name);
1544 ret = -EINVAL;
1545 goto reset_fw;
1546 }
1547
1548 cmd_param = fw_ptr;
1549 fw_ptr += cmd->plen;
1550 fw_size -= cmd->plen;
1551
1552 opcode = le16_to_cpu(cmd->opcode);
1553
1554 skb = __hci_cmd_sync(hdev, opcode, cmd->plen, cmd_param,
1555 HCI_INIT_TIMEOUT);
1556 if (IS_ERR(skb)) {
1557 ret = PTR_ERR(skb);
1558 BT_ERR("%s: BCM: patch command %04x failed (%ld)",
1559 hdev->name, opcode, ret);
1560 goto reset_fw;
1561 }
1562 kfree_skb(skb);
1563 }
1564
1565 /* 250 msec delay after Launch Ram completes */
1566 msleep(250);
1567
1568reset_fw:
1569 /* Reset */
1570 skb = __hci_cmd_sync(hdev, HCI_OP_RESET, 0, NULL, HCI_INIT_TIMEOUT);
1571 if (IS_ERR(skb)) {
1572 ret = PTR_ERR(skb);
1573 BT_ERR("%s: HCI_OP_RESET failed (%ld)", hdev->name, ret);
1574 goto done;
1575 }
1576 kfree_skb(skb);
1577
1578 /* Read Local Version Info */
1579 skb = __hci_cmd_sync(hdev, HCI_OP_READ_LOCAL_VERSION, 0, NULL,
1580 HCI_INIT_TIMEOUT);
1581 if (IS_ERR(skb)) {
1582 ret = PTR_ERR(skb);
1583 BT_ERR("%s: HCI_OP_READ_LOCAL_VERSION failed (%ld)",
1584 hdev->name, ret);
1585 goto done;
1586 }
1587
1588 if (skb->len != sizeof(*ver)) {
1589 BT_ERR("%s: HCI_OP_READ_LOCAL_VERSION event length mismatch",
1590 hdev->name);
1591 kfree_skb(skb);
1592 ret = -EIO;
1593 goto done;
1594 }
1595
1596 ver = (struct hci_rp_read_local_version *) skb->data;
1597 BT_INFO("%s: BCM: firmware hci_ver=%02x hci_rev=%04x lmp_ver=%02x "
1598 "lmp_subver=%04x", hdev->name, ver->hci_ver, ver->hci_rev,
1599 ver->lmp_ver, ver->lmp_subver);
1600 kfree_skb(skb);
1601
c8abb73f
MH		 1602 /* Read BD Address */
1603 skb = __hci_cmd_sync(hdev, HCI_OP_READ_BD_ADDR, 0, NULL,
1604 HCI_INIT_TIMEOUT);
1605 if (IS_ERR(skb)) {
1606 ret = PTR_ERR(skb);
1607 BT_ERR("%s: HCI_OP_READ_BD_ADDR failed (%ld)",
1608 hdev->name, ret);
1609 goto done;
1610 }
1611
1612 if (skb->len != sizeof(*bda)) {
1613 BT_ERR("%s: HCI_OP_READ_BD_ADDR event length mismatch",
1614 hdev->name);
1615 kfree_skb(skb);
1616 ret = -EIO;
1617 goto done;
1618 }
1619
1620 bda = (struct hci_rp_read_bd_addr *) skb->data;
1621 if (bda->status) {
1622 BT_ERR("%s: HCI_OP_READ_BD_ADDR error status (%02x)",
1623 hdev->name, bda->status);
1624 kfree_skb(skb);
1625 ret = -bt_to_errno(bda->status);
1626 goto done;
1627 }
1628
1629 /* The address 00:20:70:02:A0:00 indicates a BCM20702A0 controller
1630 * with no configured address.
1631 */
849e5086 1632 if (!bacmp(&bda->bdaddr, BDADDR_BCM20702A0)) {
c8abb73f
MH		 1633 BT_INFO("%s: BCM: using default device address (%pMR)",
1634 hdev->name, &bda->bdaddr);
849e5086
MH		 1635 set_bit(HCI_QUIRK_INVALID_BDADDR, &hdev->quirks);
1636 }
c8abb73f
MH		 1637
1638 kfree_skb(skb);
1639
10d4c673
PG		 1640done:
1641 release_firmware(fw);
1642
1643 return ret;
1644}
1645
abbaf50e
MH		 1646static int btusb_set_bdaddr_bcm(struct hci_dev *hdev, const bdaddr_t *bdaddr)
1647{
1648 struct sk_buff *skb;
1649 long ret;
1650
1651 skb = __hci_cmd_sync(hdev, 0xfc01, 6, bdaddr, HCI_INIT_TIMEOUT);
1652 if (IS_ERR(skb)) {
1653 ret = PTR_ERR(skb);
1654 BT_ERR("%s: BCM: Change address command failed (%ld)",
1655 hdev->name, ret);
1656 return ret;
1657 }
1658 kfree_skb(skb);
1659
1660 return 0;
1661}
1662
5e23b923
MH		 1663static int btusb_probe(struct usb_interface *intf,
1664 const struct usb_device_id *id)
1665{
1666 struct usb_endpoint_descriptor *ep_desc;
1667 struct btusb_data *data;
1668 struct hci_dev *hdev;
1669 int i, err;
1670
1671 BT_DBG("intf %p id %p", intf, id);
1672
cfeb4145 1673 /* interface numbers are hardcoded in the spec */
5e23b923
MH		 1674 if (intf->cur_altsetting->desc.bInterfaceNumber != 0)
1675 return -ENODEV;
1676
1677 if (!id->driver_info) {
1678 const struct usb_device_id *match;
1679 match = usb_match_id(intf, blacklist_table);
1680 if (match)
1681 id = match;
1682 }
1683
cfeb4145
MH		 1684 if (id->driver_info == BTUSB_IGNORE)
1685 return -ENODEV;
1686
2d25f8b4
SL		 1687 if (id->driver_info & BTUSB_ATH3012) {
1688 struct usb_device *udev = interface_to_usbdev(intf);
1689
1690 /* Old firmware would otherwise let ath3k driver load
1691 * patch and sysconfig files */
1692 if (le16_to_cpu(udev->descriptor.bcdDevice) <= 0x0001)
1693 return -ENODEV;
1694 }
1695
98921dbd 1696 data = devm_kzalloc(&intf->dev, sizeof(*data), GFP_KERNEL);
5e23b923
MH		 1697 if (!data)
1698 return -ENOMEM;
1699
1700 for (i = 0; i < intf->cur_altsetting->desc.bNumEndpoints; i++) {
1701 ep_desc = &intf->cur_altsetting->endpoint[i].desc;
1702
1703 if (!data->intr_ep && usb_endpoint_is_int_in(ep_desc)) {
1704 data->intr_ep = ep_desc;
1705 continue;
1706 }
1707
1708 if (!data->bulk_tx_ep && usb_endpoint_is_bulk_out(ep_desc)) {
1709 data->bulk_tx_ep = ep_desc;
1710 continue;
1711 }
1712
1713 if (!data->bulk_rx_ep && usb_endpoint_is_bulk_in(ep_desc)) {
1714 data->bulk_rx_ep = ep_desc;
1715 continue;
1716 }
1717 }
1718
98921dbd 1719 if (!data->intr_ep || !data->bulk_tx_ep || !data->bulk_rx_ep)
5e23b923 1720 return -ENODEV;
5e23b923 1721
7a9d4020
MH		 1722 data->cmdreq_type = USB_TYPE_CLASS;
1723
5e23b923 1724 data->udev = interface_to_usbdev(intf);
5fbcd260 1725 data->intf = intf;
5e23b923
MH		 1726
1727 spin_lock_init(&data->lock);
1728
1729 INIT_WORK(&data->work, btusb_work);
7bee549e
ON		 1730 INIT_WORK(&data->waker, btusb_waker);
1731 spin_lock_init(&data->txlock);
5e23b923
MH		 1732
1733 init_usb_anchor(&data->tx_anchor);
1734 init_usb_anchor(&data->intr_anchor);
1735 init_usb_anchor(&data->bulk_anchor);
9bfa35fe 1736 init_usb_anchor(&data->isoc_anchor);
7bee549e 1737 init_usb_anchor(&data->deferred);
5e23b923
MH		 1738
1739 hdev = hci_alloc_dev();
98921dbd 1740 if (!hdev)
5e23b923 1741 return -ENOMEM;
5e23b923 1742
c13854ce 1743 hdev->bus = HCI_USB;
155961e8 1744 hci_set_drvdata(hdev, data);
5e23b923
MH		 1745
1746 data->hdev = hdev;
1747
1748 SET_HCIDEV_DEV(hdev, &intf->dev);
1749
9f8f962c
MH		 1750 hdev->open = btusb_open;
1751 hdev->close = btusb_close;
1752 hdev->flush = btusb_flush;
1753 hdev->send = btusb_send_frame;
1754 hdev->notify = btusb_notify;
1755
1756 if (id->driver_info & BTUSB_BCM92035)
1757 hdev->setup = btusb_setup_bcm92035;
5e23b923 1758
abbaf50e 1759 if (id->driver_info & BTUSB_BCM_PATCHRAM) {
10d4c673 1760 hdev->setup = btusb_setup_bcm_patchram;
abbaf50e
MH		 1761 hdev->set_bdaddr = btusb_set_bdaddr_bcm;
1762 }
10d4c673 1763
cb8d6597 1764 if (id->driver_info & BTUSB_INTEL) {
dffd30ee 1765 hdev->setup = btusb_setup_intel;
cb8d6597
MH		 1766 hdev->set_bdaddr = btusb_set_bdaddr_intel;
1767 }
dffd30ee 1768
40df783d
MH		 1769 if (id->driver_info & BTUSB_INTEL_BOOT)
1770 set_bit(HCI_QUIRK_RAW_DEVICE, &hdev->quirks);
1771
7a9d4020 1772 /* Interface numbers are hardcoded in the specification */
9bfa35fe
MH		 1773 data->isoc = usb_ifnum_to_if(data->udev, 1);
1774
7a9d4020 1775 if (!reset)
a6c511c6 1776 set_bit(HCI_QUIRK_RESET_ON_CLOSE, &hdev->quirks);
cfeb4145
MH		 1777
1778 if (force_scofix || id->driver_info & BTUSB_WRONG_SCO_MTU) {
1779 if (!disable_scofix)
1780 set_bit(HCI_QUIRK_FIXUP_BUFFER_SIZE, &hdev->quirks);
1781 }
1782
9bfa35fe
MH		 1783 if (id->driver_info & BTUSB_BROKEN_ISOC)
1784 data->isoc = NULL;
1785
7a9d4020
MH		 1786 if (id->driver_info & BTUSB_DIGIANSWER) {
1787 data->cmdreq_type = USB_TYPE_VENDOR;
a6c511c6 1788 set_bit(HCI_QUIRK_RESET_ON_CLOSE, &hdev->quirks);
7a9d4020
MH		 1789 }
1790
1791 if (id->driver_info & BTUSB_CSR) {
1792 struct usb_device *udev = data->udev;
81cac64b 1793 u16 bcdDevice = le16_to_cpu(udev->descriptor.bcdDevice);
7a9d4020
MH		 1794
1795 /* Old firmware would otherwise execute USB reset */
81cac64b 1796 if (bcdDevice < 0x117)
a6c511c6 1797 set_bit(HCI_QUIRK_RESET_ON_CLOSE, &hdev->quirks);
81cac64b
MH		 1798
1799 /* Fake CSR devices with broken commands */
1800 if (bcdDevice <= 0x100)
1801 hdev->setup = btusb_setup_csr;
7a9d4020
MH		 1802 }
1803
cfeb4145 1804 if (id->driver_info & BTUSB_SNIFFER) {
9bfa35fe 1805 struct usb_device *udev = data->udev;
cfeb4145 1806
7a9d4020 1807 /* New sniffer firmware has crippled HCI interface */
cfeb4145
MH		 1808 if (le16_to_cpu(udev->descriptor.bcdDevice) > 0x997)
1809 set_bit(HCI_QUIRK_RAW_DEVICE, &hdev->quirks);
1810 }
1811
3a5ef20c
MH		 1812 if (id->driver_info & BTUSB_INTEL_BOOT) {
1813 /* A bug in the bootloader causes that interrupt interface is
1814 * only enabled after receiving SetInterface(0, AltSetting=0).
1815 */
1816 err = usb_set_interface(data->udev, 0, 0);
1817 if (err < 0) {
1818 BT_ERR("failed to set interface 0, alt 0 %d", err);
1819 hci_free_dev(hdev);
1820 return err;
1821 }
1822 }
1823
9bfa35fe
MH		 1824 if (data->isoc) {
1825 err = usb_driver_claim_interface(&btusb_driver,
5fbcd260 1826 data->isoc, data);
9bfa35fe
MH		 1827 if (err < 0) {
1828 hci_free_dev(hdev);
9bfa35fe
MH		 1829 return err;
1830 }
1831 }
1832
5e23b923
MH		 1833 err = hci_register_dev(hdev);
1834 if (err < 0) {
1835 hci_free_dev(hdev);
5e23b923
MH		 1836 return err;
1837 }
1838
1839 usb_set_intfdata(intf, data);
1840
1841 return 0;
1842}
1843
1844static void btusb_disconnect(struct usb_interface *intf)
1845{
1846 struct btusb_data *data = usb_get_intfdata(intf);
1847 struct hci_dev *hdev;
1848
1849 BT_DBG("intf %p", intf);
1850
1851 if (!data)
1852 return;
1853
1854 hdev = data->hdev;
5fbcd260
MH		 1855 usb_set_intfdata(data->intf, NULL);
1856
1857 if (data->isoc)
1858 usb_set_intfdata(data->isoc, NULL);
5e23b923
MH		 1859
1860 hci_unregister_dev(hdev);
1861
5fbcd260
MH		 1862 if (intf == data->isoc)
1863 usb_driver_release_interface(&btusb_driver, data->intf);
1864 else if (data->isoc)
1865 usb_driver_release_interface(&btusb_driver, data->isoc);
1866
5e23b923
MH		 1867 hci_free_dev(hdev);
1868}
1869
7bee549e 1870#ifdef CONFIG_PM
6a88adf2
MH		 1871static int btusb_suspend(struct usb_interface *intf, pm_message_t message)
1872{
1873 struct btusb_data *data = usb_get_intfdata(intf);
1874
1875 BT_DBG("intf %p", intf);
1876
1877 if (data->suspend_count++)
1878 return 0;
1879
7bee549e 1880 spin_lock_irq(&data->txlock);
5b1b0b81 1881 if (!(PMSG_IS_AUTO(message) && data->tx_in_flight)) {
7bee549e
ON		 1882 set_bit(BTUSB_SUSPENDING, &data->flags);
1883 spin_unlock_irq(&data->txlock);
1884 } else {
1885 spin_unlock_irq(&data->txlock);
1886 data->suspend_count--;
1887 return -EBUSY;
1888 }
1889
6a88adf2
MH		 1890 cancel_work_sync(&data->work);
1891
7bee549e 1892 btusb_stop_traffic(data);
6a88adf2
MH		 1893 usb_kill_anchored_urbs(&data->tx_anchor);
1894
6a88adf2
MH		 1895 return 0;
1896}
1897
7bee549e
ON		 1898static void play_deferred(struct btusb_data *data)
1899{
1900 struct urb *urb;
1901 int err;
1902
1903 while ((urb = usb_get_from_anchor(&data->deferred))) {
1904 err = usb_submit_urb(urb, GFP_ATOMIC);
1905 if (err < 0)
1906 break;
1907
1908 data->tx_in_flight++;
1909 }
1910 usb_scuttle_anchored_urbs(&data->deferred);
1911}
1912
6a88adf2
MH		 1913static int btusb_resume(struct usb_interface *intf)
1914{
1915 struct btusb_data *data = usb_get_intfdata(intf);
1916 struct hci_dev *hdev = data->hdev;
7bee549e 1917 int err = 0;
6a88adf2
MH		 1918
1919 BT_DBG("intf %p", intf);
1920
1921 if (--data->suspend_count)
1922 return 0;
1923
1924 if (!test_bit(HCI_RUNNING, &hdev->flags))
7bee549e 1925 goto done;
6a88adf2
MH		 1926
1927 if (test_bit(BTUSB_INTR_RUNNING, &data->flags)) {
1928 err = btusb_submit_intr_urb(hdev, GFP_NOIO);
1929 if (err < 0) {
1930 clear_bit(BTUSB_INTR_RUNNING, &data->flags);
7bee549e 1931 goto failed;
6a88adf2
MH		 1932 }
1933 }
1934
1935 if (test_bit(BTUSB_BULK_RUNNING, &data->flags)) {
43c2e57f
MH		 1936 err = btusb_submit_bulk_urb(hdev, GFP_NOIO);
1937 if (err < 0) {
6a88adf2 1938 clear_bit(BTUSB_BULK_RUNNING, &data->flags);
7bee549e
ON		 1939 goto failed;
1940 }
1941
1942 btusb_submit_bulk_urb(hdev, GFP_NOIO);
6a88adf2
MH		 1943 }
1944
1945 if (test_bit(BTUSB_ISOC_RUNNING, &data->flags)) {
1946 if (btusb_submit_isoc_urb(hdev, GFP_NOIO) < 0)
1947 clear_bit(BTUSB_ISOC_RUNNING, &data->flags);
1948 else
1949 btusb_submit_isoc_urb(hdev, GFP_NOIO);
1950 }
1951
7bee549e
ON		 1952 spin_lock_irq(&data->txlock);
1953 play_deferred(data);
1954 clear_bit(BTUSB_SUSPENDING, &data->flags);
1955 spin_unlock_irq(&data->txlock);
1956 schedule_work(&data->work);
1957
6a88adf2 1958 return 0;
7bee549e
ON		 1959
1960failed:
1961 usb_scuttle_anchored_urbs(&data->deferred);
1962done:
1963 spin_lock_irq(&data->txlock);
1964 clear_bit(BTUSB_SUSPENDING, &data->flags);
1965 spin_unlock_irq(&data->txlock);
1966
1967 return err;
6a88adf2 1968}
7bee549e 1969#endif
6a88adf2 1970
5e23b923
MH		 1971static struct usb_driver btusb_driver = {
1972 .name = "btusb",
1973 .probe = btusb_probe,
1974 .disconnect = btusb_disconnect,
7bee549e 1975#ifdef CONFIG_PM
6a88adf2
MH		 1976 .suspend = btusb_suspend,
1977 .resume = btusb_resume,
7bee549e 1978#endif
5e23b923 1979 .id_table = btusb_table,
7bee549e 1980 .supports_autosuspend = 1,
e1f12eb6 1981 .disable_hub_initiated_lpm = 1,
5e23b923
MH		 1982};
1983
93f1508c 1984module_usb_driver(btusb_driver);
5e23b923 1985
cfeb4145
MH		 1986module_param(disable_scofix, bool, 0644);
1987MODULE_PARM_DESC(disable_scofix, "Disable fixup of wrong SCO buffer size");
1988
1989module_param(force_scofix, bool, 0644);
1990MODULE_PARM_DESC(force_scofix, "Force fixup of wrong SCO buffers size");
1991
1992module_param(reset, bool, 0644);
1993MODULE_PARM_DESC(reset, "Send HCI reset command on initialization");
1994
5e23b923
MH		 1995MODULE_AUTHOR("Marcel Holtmann <marcel@holtmann.org>");
1996MODULE_DESCRIPTION("Generic Bluetooth USB driver ver " VERSION);
1997MODULE_VERSION(VERSION);
1998MODULE_LICENSE("GPL");
Linux kernel - Deliverables
This page took 0.607585 seconds and 5 git commands to generate.