projects / deliverable / linux.git / blame
? search:
summary | shortlog | log | commit | commitdiff | tree
blob | blame (incremental) | history | HEAD
Bluetooth: Fix clearing HCI_LE_ADV for LE connections
[deliverable/linux.git] / drivers / bluetooth / btusb.c
CommitLineData
5e23b923
MH		 1/*
2 *
3 * Generic Bluetooth USB driver
4 *
9bfa35fe 5 * Copyright (C) 2005-2008 Marcel Holtmann <marcel@holtmann.org>
5e23b923
MH		 6 *
7 *
8 * This program is free software; you can redistribute it and/or modify
9 * it under the terms of the GNU General Public License as published by
10 * the Free Software Foundation; either version 2 of the License, or
11 * (at your option) any later version.
12 *
13 * This program is distributed in the hope that it will be useful,
14 * but WITHOUT ANY WARRANTY; without even the implied warranty of
15 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
16 * GNU General Public License for more details.
17 *
18 * You should have received a copy of the GNU General Public License
19 * along with this program; if not, write to the Free Software
20 * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
21 *
22 */
23
5e23b923 24#include <linux/module.h>
5e23b923 25#include <linux/usb.h>
dffd30ee 26#include <linux/firmware.h>
5e23b923
MH		 27
28#include <net/bluetooth/bluetooth.h>
29#include <net/bluetooth/hci_core.h>
30
7bee549e 31#define VERSION "0.6"
cfeb4145 32
90ab5ee9
RR		 33static bool disable_scofix;
34static bool force_scofix;
7a9d4020 35
90ab5ee9 36static bool reset = 1;
cfeb4145
MH		 37
38static struct usb_driver btusb_driver;
39
40#define BTUSB_IGNORE 0x01
7a9d4020
MH		 41#define BTUSB_DIGIANSWER 0x02
42#define BTUSB_CSR 0x04
43#define BTUSB_SNIFFER 0x08
44#define BTUSB_BCM92035 0x10
45#define BTUSB_BROKEN_ISOC 0x20
46#define BTUSB_WRONG_SCO_MTU 0x40
2d25f8b4 47#define BTUSB_ATH3012 0x80
dffd30ee 48#define BTUSB_INTEL 0x100
40df783d
MH		 49#define BTUSB_INTEL_BOOT 0x200
50#define BTUSB_BCM_PATCHRAM 0x400
5e23b923 51
54265202 52static const struct usb_device_id btusb_table[] = {
5e23b923
MH		 53 /* Generic Bluetooth USB device */
54 { USB_DEVICE_INFO(0xe0, 0x01, 0x01) },
55
1fa6535f
HR		 56 /* Apple-specific (Broadcom) devices */
57 { USB_VENDOR_AND_INTERFACE_INFO(0x05ac, 0xff, 0x01, 0x01) },
58
178c059e
CYC		 59 /* MediaTek MT76x0E */
60 { USB_DEVICE(0x0e8d, 0x763f) },
61
c510eae3 62 /* Broadcom SoftSailing reporting vendor specific */
2e8b5063 63 { USB_DEVICE(0x0a5c, 0x21e1) },
c510eae3 64
3cd01976
NI		 65 /* Apple MacBookPro 7,1 */
66 { USB_DEVICE(0x05ac, 0x8213) },
67
0a79f674
CL		 68 /* Apple iMac11,1 */
69 { USB_DEVICE(0x05ac, 0x8215) },
70
9c047157
NI		 71 /* Apple MacBookPro6,2 */
72 { USB_DEVICE(0x05ac, 0x8218) },
73
3e3ede7d
EH		 74 /* Apple MacBookAir3,1, MacBookAir3,2 */
75 { USB_DEVICE(0x05ac, 0x821b) },
76
a63b723d
PAVM		 77 /* Apple MacBookAir4,1 */
78 { USB_DEVICE(0x05ac, 0x821f) },
79
88d377b6
MAP		 80 /* Apple MacBookPro8,2 */
81 { USB_DEVICE(0x05ac, 0x821a) },
82
f78b6826
JK		 83 /* Apple MacMini5,1 */
84 { USB_DEVICE(0x05ac, 0x8281) },
85
cfeb4145
MH		 86 /* AVM BlueFRITZ! USB v2.0 */
87 { USB_DEVICE(0x057c, 0x3800) },
88
89 /* Bluetooth Ultraport Module from IBM */
90 { USB_DEVICE(0x04bf, 0x030a) },
91
92 /* ALPS Modules with non-standard id */
93 { USB_DEVICE(0x044e, 0x3001) },
94 { USB_DEVICE(0x044e, 0x3002) },
95
96 /* Ericsson with non-standard id */
97 { USB_DEVICE(0x0bdb, 0x1002) },
98
99 /* Canyon CN-BTU1 with HID interfaces */
7a9d4020 100 { USB_DEVICE(0x0c10, 0x0000) },
cfeb4145 101
d13431ca 102 /* Broadcom BCM20702A0 */
0b880062
AS		 103 { USB_DEVICE(0x0489, 0xe042) },
104 { USB_DEVICE(0x04ca, 0x2003) },
1ee3ff61 105 { USB_DEVICE(0x0b05, 0x17b5) },
38a172be 106 { USB_DEVICE(0x0b05, 0x17cb) },
d13431ca
WJS		 107 { USB_DEVICE(0x413c, 0x8197) },
108
98514036 109 /* Foxconn - Hon Hai */
ee66401b 110 { USB_VENDOR_AND_INTERFACE_INFO(0x0489, 0xff, 0x01, 0x01) },
98514036 111
0b880062 112 /* Broadcom devices with vendor specific id */
10d4c673
PG		 113 { USB_VENDOR_AND_INTERFACE_INFO(0x0a5c, 0xff, 0x01, 0x01),
114 .driver_info = BTUSB_BCM_PATCHRAM },
92c385f4 115
5bcecf32
KB		 116 /* Belkin F8065bf - Broadcom based */
117 { USB_VENDOR_AND_INTERFACE_INFO(0x050d, 0xff, 0x01, 0x01) },
118
9113bfd8
JK		 119 /* IMC Networks - Broadcom based */
120 { USB_VENDOR_AND_INTERFACE_INFO(0x13d3, 0xff, 0x01, 0x01) },
121
40df783d 122 /* Intel Bluetooth USB Bootloader (RAM module) */
d92f2df0
MH		 123 { USB_DEVICE(0x8087, 0x0a5a),
124 .driver_info = BTUSB_INTEL_BOOT | BTUSB_BROKEN_ISOC },
40df783d 125
5e23b923
MH		 126 { } /* Terminating entry */
127};
128
129MODULE_DEVICE_TABLE(usb, btusb_table);
130
54265202 131static const struct usb_device_id blacklist_table[] = {
cfeb4145
MH		 132 /* CSR BlueCore devices */
133 { USB_DEVICE(0x0a12, 0x0001), .driver_info = BTUSB_CSR },
134
135 /* Broadcom BCM2033 without firmware */
136 { USB_DEVICE(0x0a5c, 0x2033), .driver_info = BTUSB_IGNORE },
137
be93112a 138 /* Atheros 3011 with sflash firmware */
0b880062
AS		 139 { USB_DEVICE(0x0489, 0xe027), .driver_info = BTUSB_IGNORE },
140 { USB_DEVICE(0x0489, 0xe03d), .driver_info = BTUSB_IGNORE },
141 { USB_DEVICE(0x0930, 0x0215), .driver_info = BTUSB_IGNORE },
be93112a 142 { USB_DEVICE(0x0cf3, 0x3002), .driver_info = BTUSB_IGNORE },
6eda541d 143 { USB_DEVICE(0x0cf3, 0xe019), .driver_info = BTUSB_IGNORE },
2a7bcccc 144 { USB_DEVICE(0x13d3, 0x3304), .driver_info = BTUSB_IGNORE },
be93112a 145
509e7861
CYC		 146 /* Atheros AR9285 Malbec with sflash firmware */
147 { USB_DEVICE(0x03f0, 0x311d), .driver_info = BTUSB_IGNORE },
148
d9f51b51 149 /* Atheros 3012 with sflash firmware */
0b880062
AS		 150 { USB_DEVICE(0x0489, 0xe04d), .driver_info = BTUSB_ATH3012 },
151 { USB_DEVICE(0x0489, 0xe04e), .driver_info = BTUSB_ATH3012 },
152 { USB_DEVICE(0x0489, 0xe056), .driver_info = BTUSB_ATH3012 },
153 { USB_DEVICE(0x0489, 0xe057), .driver_info = BTUSB_ATH3012 },
154 { USB_DEVICE(0x0489, 0xe05f), .driver_info = BTUSB_ATH3012 },
155 { USB_DEVICE(0x04c5, 0x1330), .driver_info = BTUSB_ATH3012 },
156 { USB_DEVICE(0x04ca, 0x3004), .driver_info = BTUSB_ATH3012 },
157 { USB_DEVICE(0x04ca, 0x3005), .driver_info = BTUSB_ATH3012 },
158 { USB_DEVICE(0x04ca, 0x3006), .driver_info = BTUSB_ATH3012 },
1fb4e09a 159 { USB_DEVICE(0x04ca, 0x3007), .driver_info = BTUSB_ATH3012 },
0b880062
AS		 160 { USB_DEVICE(0x04ca, 0x3008), .driver_info = BTUSB_ATH3012 },
161 { USB_DEVICE(0x04ca, 0x300b), .driver_info = BTUSB_ATH3012 },
162 { USB_DEVICE(0x0930, 0x0219), .driver_info = BTUSB_ATH3012 },
163 { USB_DEVICE(0x0930, 0x0220), .driver_info = BTUSB_ATH3012 },
a735f9e2 164 { USB_DEVICE(0x0b05, 0x17d0), .driver_info = BTUSB_ATH3012 },
d66629c1 165 { USB_DEVICE(0x0cf3, 0x0036), .driver_info = BTUSB_ATH3012 },
2d25f8b4 166 { USB_DEVICE(0x0cf3, 0x3004), .driver_info = BTUSB_ATH3012 },
94a32d10 167 { USB_DEVICE(0x0cf3, 0x3008), .driver_info = BTUSB_ATH3012 },
07c0ea87 168 { USB_DEVICE(0x0cf3, 0x311d), .driver_info = BTUSB_ATH3012 },
b131237c 169 { USB_DEVICE(0x0cf3, 0x311e), .driver_info = BTUSB_ATH3012 },
1e56f1eb 170 { USB_DEVICE(0x0cf3, 0x311f), .driver_info = BTUSB_ATH3012 },
0b880062 171 { USB_DEVICE(0x0cf3, 0x3121), .driver_info = BTUSB_ATH3012 },
ebaf5795 172 { USB_DEVICE(0x0cf3, 0x817a), .driver_info = BTUSB_ATH3012 },
0b880062 173 { USB_DEVICE(0x0cf3, 0xe003), .driver_info = BTUSB_ATH3012 },
ac71311e 174 { USB_DEVICE(0x0cf3, 0xe004), .driver_info = BTUSB_ATH3012 },
0a3658cc 175 { USB_DEVICE(0x0cf3, 0xe005), .driver_info = BTUSB_ATH3012 },
0b880062
AS		 176 { USB_DEVICE(0x13d3, 0x3362), .driver_info = BTUSB_ATH3012 },
177 { USB_DEVICE(0x13d3, 0x3375), .driver_info = BTUSB_ATH3012 },
eed307e2 178 { USB_DEVICE(0x13d3, 0x3393), .driver_info = BTUSB_ATH3012 },
5b77a1f3 179 { USB_DEVICE(0x13d3, 0x3402), .driver_info = BTUSB_ATH3012 },
d9f51b51 180
e9036e33
CYC		 181 /* Atheros AR5BBU12 with sflash firmware */
182 { USB_DEVICE(0x0489, 0xe02c), .driver_info = BTUSB_IGNORE },
183
85d59726 184 /* Atheros AR5BBU12 with sflash firmware */
bc21fde2 185 { USB_DEVICE(0x0489, 0xe036), .driver_info = BTUSB_ATH3012 },
0b880062 186 { USB_DEVICE(0x0489, 0xe03c), .driver_info = BTUSB_ATH3012 },
85d59726 187
cfeb4145 188 /* Broadcom BCM2035 */
7a9d4020 189 { USB_DEVICE(0x0a5c, 0x2009), .driver_info = BTUSB_BCM92035 },
0b880062
AS		 190 { USB_DEVICE(0x0a5c, 0x200a), .driver_info = BTUSB_WRONG_SCO_MTU },
191 { USB_DEVICE(0x0a5c, 0x2035), .driver_info = BTUSB_WRONG_SCO_MTU },
cfeb4145
MH		 192
193 /* Broadcom BCM2045 */
7a9d4020
MH		 194 { USB_DEVICE(0x0a5c, 0x2039), .driver_info = BTUSB_WRONG_SCO_MTU },
195 { USB_DEVICE(0x0a5c, 0x2101), .driver_info = BTUSB_WRONG_SCO_MTU },
bdbef3d6 196
cfeb4145 197 /* IBM/Lenovo ThinkPad with Broadcom chip */
7a9d4020
MH		 198 { USB_DEVICE(0x0a5c, 0x201e), .driver_info = BTUSB_WRONG_SCO_MTU },
199 { USB_DEVICE(0x0a5c, 0x2110), .driver_info = BTUSB_WRONG_SCO_MTU },
cfeb4145
MH		 200
201 /* HP laptop with Broadcom chip */
7a9d4020 202 { USB_DEVICE(0x03f0, 0x171d), .driver_info = BTUSB_WRONG_SCO_MTU },
cfeb4145
MH		 203
204 /* Dell laptop with Broadcom chip */
7a9d4020 205 { USB_DEVICE(0x413c, 0x8126), .driver_info = BTUSB_WRONG_SCO_MTU },
cfeb4145 206
5ddd4a60 207 /* Dell Wireless 370 and 410 devices */
7a9d4020 208 { USB_DEVICE(0x413c, 0x8152), .driver_info = BTUSB_WRONG_SCO_MTU },
5ddd4a60 209 { USB_DEVICE(0x413c, 0x8156), .driver_info = BTUSB_WRONG_SCO_MTU },
cfeb4145 210
7a9d4020
MH		 211 /* Belkin F8T012 and F8T013 devices */
212 { USB_DEVICE(0x050d, 0x0012), .driver_info = BTUSB_WRONG_SCO_MTU },
213 { USB_DEVICE(0x050d, 0x0013), .driver_info = BTUSB_WRONG_SCO_MTU },
cfeb4145 214
5ddd4a60
MH		 215 /* Asus WL-BTD202 device */
216 { USB_DEVICE(0x0b05, 0x1715), .driver_info = BTUSB_WRONG_SCO_MTU },
217
218 /* Kensington Bluetooth USB adapter */
219 { USB_DEVICE(0x047d, 0x105e), .driver_info = BTUSB_WRONG_SCO_MTU },
220
cfeb4145
MH		 221 /* RTX Telecom based adapters with buggy SCO support */
222 { USB_DEVICE(0x0400, 0x0807), .driver_info = BTUSB_BROKEN_ISOC },
223 { USB_DEVICE(0x0400, 0x080a), .driver_info = BTUSB_BROKEN_ISOC },
224
225 /* CONWISE Technology based adapters with buggy SCO support */
226 { USB_DEVICE(0x0e5e, 0x6622), .driver_info = BTUSB_BROKEN_ISOC },
227
cfeb4145
MH		 228 /* Digianswer devices */
229 { USB_DEVICE(0x08fd, 0x0001), .driver_info = BTUSB_DIGIANSWER },
230 { USB_DEVICE(0x08fd, 0x0002), .driver_info = BTUSB_IGNORE },
231
232 /* CSR BlueCore Bluetooth Sniffer */
4f64fa80
MH		 233 { USB_DEVICE(0x0a12, 0x0002),
234 .driver_info = BTUSB_SNIFFER | BTUSB_BROKEN_ISOC },
cfeb4145
MH		 235
236 /* Frontline ComProbe Bluetooth Sniffer */
4f64fa80
MH		 237 { USB_DEVICE(0x16d3, 0x0002),
238 .driver_info = BTUSB_SNIFFER | BTUSB_BROKEN_ISOC },
cfeb4145 239
dffd30ee
THJA		 240 /* Intel Bluetooth device */
241 { USB_DEVICE(0x8087, 0x07dc), .driver_info = BTUSB_INTEL },
ef4e5e4a 242 { USB_DEVICE(0x8087, 0x0a2a), .driver_info = BTUSB_INTEL },
dffd30ee 243
5e23b923
MH		 244 { } /* Terminating entry */
245};
246
9bfa35fe
MH		 247#define BTUSB_MAX_ISOC_FRAMES 10
248
5e23b923
MH		 249#define BTUSB_INTR_RUNNING 0
250#define BTUSB_BULK_RUNNING 1
9bfa35fe 251#define BTUSB_ISOC_RUNNING 2
7bee549e 252#define BTUSB_SUSPENDING 3
08b8b6c4 253#define BTUSB_DID_ISO_RESUME 4
5e23b923
MH		 254
255struct btusb_data {
256 struct hci_dev *hdev;
257 struct usb_device *udev;
5fbcd260 258 struct usb_interface *intf;
9bfa35fe 259 struct usb_interface *isoc;
5e23b923
MH		 260
261 spinlock_t lock;
262
263 unsigned long flags;
264
265 struct work_struct work;
7bee549e 266 struct work_struct waker;
5e23b923
MH		 267
268 struct usb_anchor tx_anchor;
269 struct usb_anchor intr_anchor;
270 struct usb_anchor bulk_anchor;
9bfa35fe 271 struct usb_anchor isoc_anchor;
7bee549e
ON		 272 struct usb_anchor deferred;
273 int tx_in_flight;
274 spinlock_t txlock;
5e23b923
MH		 275
276 struct usb_endpoint_descriptor *intr_ep;
277 struct usb_endpoint_descriptor *bulk_tx_ep;
278 struct usb_endpoint_descriptor *bulk_rx_ep;
9bfa35fe
MH		 279 struct usb_endpoint_descriptor *isoc_tx_ep;
280 struct usb_endpoint_descriptor *isoc_rx_ep;
281
7a9d4020
MH		 282 __u8 cmdreq_type;
283
43c2e57f 284 unsigned int sco_num;
9bfa35fe 285 int isoc_altsetting;
6a88adf2 286 int suspend_count;
5e23b923
MH		 287};
288
7bee549e
ON		 289static int inc_tx(struct btusb_data *data)
290{
291 unsigned long flags;
292 int rv;
293
294 spin_lock_irqsave(&data->txlock, flags);
295 rv = test_bit(BTUSB_SUSPENDING, &data->flags);
296 if (!rv)
297 data->tx_in_flight++;
298 spin_unlock_irqrestore(&data->txlock, flags);
299
300 return rv;
301}
302
5e23b923
MH		 303static void btusb_intr_complete(struct urb *urb)
304{
305 struct hci_dev *hdev = urb->context;
155961e8 306 struct btusb_data *data = hci_get_drvdata(hdev);
5e23b923
MH		 307 int err;
308
309 BT_DBG("%s urb %p status %d count %d", hdev->name,
310 urb, urb->status, urb->actual_length);
311
312 if (!test_bit(HCI_RUNNING, &hdev->flags))
313 return;
314
315 if (urb->status == 0) {
9bfa35fe
MH		 316 hdev->stat.byte_rx += urb->actual_length;
317
5e23b923
MH		 318 if (hci_recv_fragment(hdev, HCI_EVENT_PKT,
319 urb->transfer_buffer,
320 urb->actual_length) < 0) {
321 BT_ERR("%s corrupted event packet", hdev->name);
322 hdev->stat.err_rx++;
323 }
324 }
325
326 if (!test_bit(BTUSB_INTR_RUNNING, &data->flags))
327 return;
328
7bee549e 329 usb_mark_last_busy(data->udev);
5e23b923
MH		 330 usb_anchor_urb(urb, &data->intr_anchor);
331
332 err = usb_submit_urb(urb, GFP_ATOMIC);
333 if (err < 0) {
4935f1c1
PB		 334 /* -EPERM: urb is being killed;
335 * -ENODEV: device got disconnected */
336 if (err != -EPERM && err != -ENODEV)
61faddf6 337 BT_ERR("%s urb %p failed to resubmit (%d)",
5e23b923
MH		 338 hdev->name, urb, -err);
339 usb_unanchor_urb(urb);
340 }
341}
342
2eda66f4 343static int btusb_submit_intr_urb(struct hci_dev *hdev, gfp_t mem_flags)
5e23b923 344{
155961e8 345 struct btusb_data *data = hci_get_drvdata(hdev);
5e23b923
MH		 346 struct urb *urb;
347 unsigned char *buf;
348 unsigned int pipe;
349 int err, size;
350
351 BT_DBG("%s", hdev->name);
352
9bfa35fe
MH		 353 if (!data->intr_ep)
354 return -ENODEV;
355
2eda66f4 356 urb = usb_alloc_urb(0, mem_flags);
5e23b923
MH		 357 if (!urb)
358 return -ENOMEM;
359
360 size = le16_to_cpu(data->intr_ep->wMaxPacketSize);
361
2eda66f4 362 buf = kmalloc(size, mem_flags);
5e23b923
MH		 363 if (!buf) {
364 usb_free_urb(urb);
365 return -ENOMEM;
366 }
367
368 pipe = usb_rcvintpipe(data->udev, data->intr_ep->bEndpointAddress);
369
370 usb_fill_int_urb(urb, data->udev, pipe, buf, size,
371 btusb_intr_complete, hdev,
372 data->intr_ep->bInterval);
373
374 urb->transfer_flags |= URB_FREE_BUFFER;
375
376 usb_anchor_urb(urb, &data->intr_anchor);
377
2eda66f4 378 err = usb_submit_urb(urb, mem_flags);
5e23b923 379 if (err < 0) {
d4b8d1c9
PB		 380 if (err != -EPERM && err != -ENODEV)
381 BT_ERR("%s urb %p submission failed (%d)",
5e23b923
MH		 382 hdev->name, urb, -err);
383 usb_unanchor_urb(urb);
5e23b923
MH		 384 }
385
386 usb_free_urb(urb);
387
388 return err;
389}
390
391static void btusb_bulk_complete(struct urb *urb)
392{
393 struct hci_dev *hdev = urb->context;
155961e8 394 struct btusb_data *data = hci_get_drvdata(hdev);
5e23b923
MH		 395 int err;
396
397 BT_DBG("%s urb %p status %d count %d", hdev->name,
398 urb, urb->status, urb->actual_length);
399
400 if (!test_bit(HCI_RUNNING, &hdev->flags))
401 return;
402
403 if (urb->status == 0) {
9bfa35fe
MH		 404 hdev->stat.byte_rx += urb->actual_length;
405
5e23b923
MH		 406 if (hci_recv_fragment(hdev, HCI_ACLDATA_PKT,
407 urb->transfer_buffer,
408 urb->actual_length) < 0) {
409 BT_ERR("%s corrupted ACL packet", hdev->name);
410 hdev->stat.err_rx++;
411 }
412 }
413
414 if (!test_bit(BTUSB_BULK_RUNNING, &data->flags))
415 return;
416
417 usb_anchor_urb(urb, &data->bulk_anchor);
652fd781 418 usb_mark_last_busy(data->udev);
5e23b923
MH		 419
420 err = usb_submit_urb(urb, GFP_ATOMIC);
421 if (err < 0) {
4935f1c1
PB		 422 /* -EPERM: urb is being killed;
423 * -ENODEV: device got disconnected */
424 if (err != -EPERM && err != -ENODEV)
61faddf6 425 BT_ERR("%s urb %p failed to resubmit (%d)",
5e23b923
MH		 426 hdev->name, urb, -err);
427 usb_unanchor_urb(urb);
428 }
429}
430
2eda66f4 431static int btusb_submit_bulk_urb(struct hci_dev *hdev, gfp_t mem_flags)
5e23b923 432{
155961e8 433 struct btusb_data *data = hci_get_drvdata(hdev);
5e23b923
MH		 434 struct urb *urb;
435 unsigned char *buf;
436 unsigned int pipe;
290ba200 437 int err, size = HCI_MAX_FRAME_SIZE;
5e23b923
MH		 438
439 BT_DBG("%s", hdev->name);
440
9bfa35fe
MH		 441 if (!data->bulk_rx_ep)
442 return -ENODEV;
443
2eda66f4 444 urb = usb_alloc_urb(0, mem_flags);
5e23b923
MH		 445 if (!urb)
446 return -ENOMEM;
447
2eda66f4 448 buf = kmalloc(size, mem_flags);
5e23b923
MH		 449 if (!buf) {
450 usb_free_urb(urb);
451 return -ENOMEM;
452 }
453
454 pipe = usb_rcvbulkpipe(data->udev, data->bulk_rx_ep->bEndpointAddress);
455
456 usb_fill_bulk_urb(urb, data->udev, pipe,
457 buf, size, btusb_bulk_complete, hdev);
458
459 urb->transfer_flags |= URB_FREE_BUFFER;
460
7bee549e 461 usb_mark_last_busy(data->udev);
5e23b923
MH		 462 usb_anchor_urb(urb, &data->bulk_anchor);
463
2eda66f4 464 err = usb_submit_urb(urb, mem_flags);
5e23b923 465 if (err < 0) {
d4b8d1c9
PB		 466 if (err != -EPERM && err != -ENODEV)
467 BT_ERR("%s urb %p submission failed (%d)",
5e23b923
MH		 468 hdev->name, urb, -err);
469 usb_unanchor_urb(urb);
5e23b923
MH		 470 }
471
472 usb_free_urb(urb);
473
474 return err;
475}
476
9bfa35fe
MH		 477static void btusb_isoc_complete(struct urb *urb)
478{
479 struct hci_dev *hdev = urb->context;
155961e8 480 struct btusb_data *data = hci_get_drvdata(hdev);
9bfa35fe
MH		 481 int i, err;
482
483 BT_DBG("%s urb %p status %d count %d", hdev->name,
484 urb, urb->status, urb->actual_length);
485
486 if (!test_bit(HCI_RUNNING, &hdev->flags))
487 return;
488
489 if (urb->status == 0) {
490 for (i = 0; i < urb->number_of_packets; i++) {
491 unsigned int offset = urb->iso_frame_desc[i].offset;
492 unsigned int length = urb->iso_frame_desc[i].actual_length;
493
494 if (urb->iso_frame_desc[i].status)
495 continue;
496
497 hdev->stat.byte_rx += length;
498
499 if (hci_recv_fragment(hdev, HCI_SCODATA_PKT,
500 urb->transfer_buffer + offset,
501 length) < 0) {
502 BT_ERR("%s corrupted SCO packet", hdev->name);
503 hdev->stat.err_rx++;
504 }
505 }
506 }
507
508 if (!test_bit(BTUSB_ISOC_RUNNING, &data->flags))
509 return;
510
511 usb_anchor_urb(urb, &data->isoc_anchor);
512
513 err = usb_submit_urb(urb, GFP_ATOMIC);
514 if (err < 0) {
4935f1c1
PB		 515 /* -EPERM: urb is being killed;
516 * -ENODEV: device got disconnected */
517 if (err != -EPERM && err != -ENODEV)
61faddf6 518 BT_ERR("%s urb %p failed to resubmit (%d)",
9bfa35fe
MH		 519 hdev->name, urb, -err);
520 usb_unanchor_urb(urb);
521 }
522}
523
42b16b3f 524static inline void __fill_isoc_descriptor(struct urb *urb, int len, int mtu)
9bfa35fe
MH		 525{
526 int i, offset = 0;
527
528 BT_DBG("len %d mtu %d", len, mtu);
529
530 for (i = 0; i < BTUSB_MAX_ISOC_FRAMES && len >= mtu;
531 i++, offset += mtu, len -= mtu) {
532 urb->iso_frame_desc[i].offset = offset;
533 urb->iso_frame_desc[i].length = mtu;
534 }
535
536 if (len && i < BTUSB_MAX_ISOC_FRAMES) {
537 urb->iso_frame_desc[i].offset = offset;
538 urb->iso_frame_desc[i].length = len;
539 i++;
540 }
541
542 urb->number_of_packets = i;
543}
544
2eda66f4 545static int btusb_submit_isoc_urb(struct hci_dev *hdev, gfp_t mem_flags)
9bfa35fe 546{
155961e8 547 struct btusb_data *data = hci_get_drvdata(hdev);
9bfa35fe
MH		 548 struct urb *urb;
549 unsigned char *buf;
550 unsigned int pipe;
551 int err, size;
552
553 BT_DBG("%s", hdev->name);
554
555 if (!data->isoc_rx_ep)
556 return -ENODEV;
557
2eda66f4 558 urb = usb_alloc_urb(BTUSB_MAX_ISOC_FRAMES, mem_flags);
9bfa35fe
MH		 559 if (!urb)
560 return -ENOMEM;
561
562 size = le16_to_cpu(data->isoc_rx_ep->wMaxPacketSize) *
563 BTUSB_MAX_ISOC_FRAMES;
564
2eda66f4 565 buf = kmalloc(size, mem_flags);
9bfa35fe
MH		 566 if (!buf) {
567 usb_free_urb(urb);
568 return -ENOMEM;
569 }
570
571 pipe = usb_rcvisocpipe(data->udev, data->isoc_rx_ep->bEndpointAddress);
572
fa0fb93f
BZ		 573 usb_fill_int_urb(urb, data->udev, pipe, buf, size, btusb_isoc_complete,
574 hdev, data->isoc_rx_ep->bInterval);
9bfa35fe
MH		 575
576 urb->transfer_flags = URB_FREE_BUFFER | URB_ISO_ASAP;
9bfa35fe
MH		 577
578 __fill_isoc_descriptor(urb, size,
579 le16_to_cpu(data->isoc_rx_ep->wMaxPacketSize));
580
581 usb_anchor_urb(urb, &data->isoc_anchor);
582
2eda66f4 583 err = usb_submit_urb(urb, mem_flags);
9bfa35fe 584 if (err < 0) {
d4b8d1c9
PB		 585 if (err != -EPERM && err != -ENODEV)
586 BT_ERR("%s urb %p submission failed (%d)",
9bfa35fe
MH		 587 hdev->name, urb, -err);
588 usb_unanchor_urb(urb);
9bfa35fe
MH		 589 }
590
591 usb_free_urb(urb);
592
593 return err;
594}
595
5e23b923 596static void btusb_tx_complete(struct urb *urb)
7bee549e
ON		 597{
598 struct sk_buff *skb = urb->context;
599 struct hci_dev *hdev = (struct hci_dev *) skb->dev;
155961e8 600 struct btusb_data *data = hci_get_drvdata(hdev);
7bee549e
ON		 601
602 BT_DBG("%s urb %p status %d count %d", hdev->name,
603 urb, urb->status, urb->actual_length);
604
605 if (!test_bit(HCI_RUNNING, &hdev->flags))
606 goto done;
607
608 if (!urb->status)
609 hdev->stat.byte_tx += urb->transfer_buffer_length;
610 else
611 hdev->stat.err_tx++;
612
613done:
614 spin_lock(&data->txlock);
615 data->tx_in_flight--;
616 spin_unlock(&data->txlock);
617
618 kfree(urb->setup_packet);
619
620 kfree_skb(skb);
621}
622
623static void btusb_isoc_tx_complete(struct urb *urb)
5e23b923
MH		 624{
625 struct sk_buff *skb = urb->context;
626 struct hci_dev *hdev = (struct hci_dev *) skb->dev;
627
628 BT_DBG("%s urb %p status %d count %d", hdev->name,
629 urb, urb->status, urb->actual_length);
630
631 if (!test_bit(HCI_RUNNING, &hdev->flags))
632 goto done;
633
634 if (!urb->status)
635 hdev->stat.byte_tx += urb->transfer_buffer_length;
636 else
637 hdev->stat.err_tx++;
638
639done:
640 kfree(urb->setup_packet);
641
642 kfree_skb(skb);
643}
644
645static int btusb_open(struct hci_dev *hdev)
646{
155961e8 647 struct btusb_data *data = hci_get_drvdata(hdev);
5e23b923
MH		 648 int err;
649
650 BT_DBG("%s", hdev->name);
651
7bee549e
ON		 652 err = usb_autopm_get_interface(data->intf);
653 if (err < 0)
654 return err;
655
656 data->intf->needs_remote_wakeup = 1;
657
5e23b923 658 if (test_and_set_bit(HCI_RUNNING, &hdev->flags))
7bee549e 659 goto done;
5e23b923
MH		 660
661 if (test_and_set_bit(BTUSB_INTR_RUNNING, &data->flags))
7bee549e 662 goto done;
5e23b923 663
2eda66f4 664 err = btusb_submit_intr_urb(hdev, GFP_KERNEL);
43c2e57f
MH		 665 if (err < 0)
666 goto failed;
667
668 err = btusb_submit_bulk_urb(hdev, GFP_KERNEL);
5e23b923 669 if (err < 0) {
43c2e57f
MH		 670 usb_kill_anchored_urbs(&data->intr_anchor);
671 goto failed;
5e23b923
MH		 672 }
673
43c2e57f
MH		 674 set_bit(BTUSB_BULK_RUNNING, &data->flags);
675 btusb_submit_bulk_urb(hdev, GFP_KERNEL);
676
7bee549e
ON		 677done:
678 usb_autopm_put_interface(data->intf);
43c2e57f
MH		 679 return 0;
680
681failed:
682 clear_bit(BTUSB_INTR_RUNNING, &data->flags);
683 clear_bit(HCI_RUNNING, &hdev->flags);
7bee549e 684 usb_autopm_put_interface(data->intf);
5e23b923
MH		 685 return err;
686}
687
7bee549e
ON		 688static void btusb_stop_traffic(struct btusb_data *data)
689{
690 usb_kill_anchored_urbs(&data->intr_anchor);
691 usb_kill_anchored_urbs(&data->bulk_anchor);
692 usb_kill_anchored_urbs(&data->isoc_anchor);
693}
694
5e23b923
MH		 695static int btusb_close(struct hci_dev *hdev)
696{
155961e8 697 struct btusb_data *data = hci_get_drvdata(hdev);
7bee549e 698 int err;
5e23b923
MH		 699
700 BT_DBG("%s", hdev->name);
701
702 if (!test_and_clear_bit(HCI_RUNNING, &hdev->flags))
703 return 0;
704
e8c3c3d2 705 cancel_work_sync(&data->work);
404291ac 706 cancel_work_sync(&data->waker);
e8c3c3d2 707
9bfa35fe 708 clear_bit(BTUSB_ISOC_RUNNING, &data->flags);
5e23b923 709 clear_bit(BTUSB_BULK_RUNNING, &data->flags);
5e23b923 710 clear_bit(BTUSB_INTR_RUNNING, &data->flags);
7bee549e
ON		 711
712 btusb_stop_traffic(data);
713 err = usb_autopm_get_interface(data->intf);
714 if (err < 0)
7b8e2c1d 715 goto failed;
7bee549e
ON		 716
717 data->intf->needs_remote_wakeup = 0;
718 usb_autopm_put_interface(data->intf);
5e23b923 719
7b8e2c1d
ON		 720failed:
721 usb_scuttle_anchored_urbs(&data->deferred);
5e23b923
MH		 722 return 0;
723}
724
725static int btusb_flush(struct hci_dev *hdev)
726{
155961e8 727 struct btusb_data *data = hci_get_drvdata(hdev);
5e23b923
MH		 728
729 BT_DBG("%s", hdev->name);
730
731 usb_kill_anchored_urbs(&data->tx_anchor);
732
733 return 0;
734}
735
7bd8f09f 736static int btusb_send_frame(struct hci_dev *hdev, struct sk_buff *skb)
5e23b923 737{
155961e8 738 struct btusb_data *data = hci_get_drvdata(hdev);
5e23b923
MH		 739 struct usb_ctrlrequest *dr;
740 struct urb *urb;
741 unsigned int pipe;
742 int err;
743
744 BT_DBG("%s", hdev->name);
745
746 if (!test_bit(HCI_RUNNING, &hdev->flags))
747 return -EBUSY;
748
7bd8f09f
MH		 749 skb->dev = (void *) hdev;
750
5e23b923
MH		 751 switch (bt_cb(skb)->pkt_type) {
752 case HCI_COMMAND_PKT:
753 urb = usb_alloc_urb(0, GFP_ATOMIC);
754 if (!urb)
755 return -ENOMEM;
756
757 dr = kmalloc(sizeof(*dr), GFP_ATOMIC);
758 if (!dr) {
759 usb_free_urb(urb);
760 return -ENOMEM;
761 }
762
7a9d4020 763 dr->bRequestType = data->cmdreq_type;
5e23b923
MH		 764 dr->bRequest = 0;
765 dr->wIndex = 0;
766 dr->wValue = 0;
767 dr->wLength = __cpu_to_le16(skb->len);
768
769 pipe = usb_sndctrlpipe(data->udev, 0x00);
770
771 usb_fill_control_urb(urb, data->udev, pipe, (void *) dr,
772 skb->data, skb->len, btusb_tx_complete, skb);
773
774 hdev->stat.cmd_tx++;
775 break;
776
777 case HCI_ACLDATA_PKT:
9fd481e0 778 if (!data->bulk_tx_ep)
9bfa35fe
MH		 779 return -ENODEV;
780
5e23b923
MH		 781 urb = usb_alloc_urb(0, GFP_ATOMIC);
782 if (!urb)
783 return -ENOMEM;
784
785 pipe = usb_sndbulkpipe(data->udev,
786 data->bulk_tx_ep->bEndpointAddress);
787
788 usb_fill_bulk_urb(urb, data->udev, pipe,
789 skb->data, skb->len, btusb_tx_complete, skb);
790
791 hdev->stat.acl_tx++;
792 break;
793
794 case HCI_SCODATA_PKT:
014f7bc7 795 if (!data->isoc_tx_ep || hci_conn_num(hdev, SCO_LINK) < 1)
9bfa35fe
MH		 796 return -ENODEV;
797
798 urb = usb_alloc_urb(BTUSB_MAX_ISOC_FRAMES, GFP_ATOMIC);
799 if (!urb)
800 return -ENOMEM;
801
802 pipe = usb_sndisocpipe(data->udev,
803 data->isoc_tx_ep->bEndpointAddress);
804
03c2d0e8
GP		 805 usb_fill_int_urb(urb, data->udev, pipe,
806 skb->data, skb->len, btusb_isoc_tx_complete,
807 skb, data->isoc_tx_ep->bInterval);
9bfa35fe
MH		 808
809 urb->transfer_flags = URB_ISO_ASAP;
9bfa35fe
MH		 810
811 __fill_isoc_descriptor(urb, skb->len,
812 le16_to_cpu(data->isoc_tx_ep->wMaxPacketSize));
813
5e23b923 814 hdev->stat.sco_tx++;
7bee549e 815 goto skip_waking;
5e23b923
MH		 816
817 default:
818 return -EILSEQ;
819 }
820
7bee549e
ON		 821 err = inc_tx(data);
822 if (err) {
823 usb_anchor_urb(urb, &data->deferred);
824 schedule_work(&data->waker);
825 err = 0;
826 goto done;
827 }
828
829skip_waking:
5e23b923
MH		 830 usb_anchor_urb(urb, &data->tx_anchor);
831
832 err = usb_submit_urb(urb, GFP_ATOMIC);
833 if (err < 0) {
5a9b80e2
PB		 834 if (err != -EPERM && err != -ENODEV)
835 BT_ERR("%s urb %p submission failed (%d)",
836 hdev->name, urb, -err);
5e23b923
MH		 837 kfree(urb->setup_packet);
838 usb_unanchor_urb(urb);
7bee549e
ON		 839 } else {
840 usb_mark_last_busy(data->udev);
5e23b923
MH		 841 }
842
7bee549e 843done:
54a8a79c 844 usb_free_urb(urb);
5e23b923
MH		 845 return err;
846}
847
5e23b923
MH		 848static void btusb_notify(struct hci_dev *hdev, unsigned int evt)
849{
155961e8 850 struct btusb_data *data = hci_get_drvdata(hdev);
5e23b923
MH		 851
852 BT_DBG("%s evt %d", hdev->name, evt);
853
014f7bc7
MH		 854 if (hci_conn_num(hdev, SCO_LINK) != data->sco_num) {
855 data->sco_num = hci_conn_num(hdev, SCO_LINK);
43c2e57f 856 schedule_work(&data->work);
a780efa8 857 }
5e23b923
MH		 858}
859
42b16b3f 860static inline int __set_isoc_interface(struct hci_dev *hdev, int altsetting)
9bfa35fe 861{
155961e8 862 struct btusb_data *data = hci_get_drvdata(hdev);
9bfa35fe
MH		 863 struct usb_interface *intf = data->isoc;
864 struct usb_endpoint_descriptor *ep_desc;
865 int i, err;
866
867 if (!data->isoc)
868 return -ENODEV;
869
870 err = usb_set_interface(data->udev, 1, altsetting);
871 if (err < 0) {
872 BT_ERR("%s setting interface failed (%d)", hdev->name, -err);
873 return err;
874 }
875
876 data->isoc_altsetting = altsetting;
877
878 data->isoc_tx_ep = NULL;
879 data->isoc_rx_ep = NULL;
880
881 for (i = 0; i < intf->cur_altsetting->desc.bNumEndpoints; i++) {
882 ep_desc = &intf->cur_altsetting->endpoint[i].desc;
883
884 if (!data->isoc_tx_ep && usb_endpoint_is_isoc_out(ep_desc)) {
885 data->isoc_tx_ep = ep_desc;
886 continue;
887 }
888
889 if (!data->isoc_rx_ep && usb_endpoint_is_isoc_in(ep_desc)) {
890 data->isoc_rx_ep = ep_desc;
891 continue;
892 }
893 }
894
895 if (!data->isoc_tx_ep || !data->isoc_rx_ep) {
896 BT_ERR("%s invalid SCO descriptors", hdev->name);
897 return -ENODEV;
898 }
899
900 return 0;
901}
902
5e23b923
MH		 903static void btusb_work(struct work_struct *work)
904{
905 struct btusb_data *data = container_of(work, struct btusb_data, work);
906 struct hci_dev *hdev = data->hdev;
f4001d28 907 int new_alts;
7bee549e 908 int err;
5e23b923 909
014f7bc7 910 if (data->sco_num > 0) {
08b8b6c4 911 if (!test_bit(BTUSB_DID_ISO_RESUME, &data->flags)) {
8efdd0cd 912 err = usb_autopm_get_interface(data->isoc ? data->isoc : data->intf);
7bee549e
ON		 913 if (err < 0) {
914 clear_bit(BTUSB_ISOC_RUNNING, &data->flags);
915 usb_kill_anchored_urbs(&data->isoc_anchor);
916 return;
917 }
918
08b8b6c4 919 set_bit(BTUSB_DID_ISO_RESUME, &data->flags);
7bee549e 920 }
f4001d28
MA		 921
922 if (hdev->voice_setting & 0x0020) {
923 static const int alts[3] = { 2, 4, 5 };
014f7bc7 924 new_alts = alts[data->sco_num - 1];
f4001d28 925 } else {
014f7bc7 926 new_alts = data->sco_num;
f4001d28
MA		 927 }
928
929 if (data->isoc_altsetting != new_alts) {
9bfa35fe
MH		 930 clear_bit(BTUSB_ISOC_RUNNING, &data->flags);
931 usb_kill_anchored_urbs(&data->isoc_anchor);
932
f4001d28 933 if (__set_isoc_interface(hdev, new_alts) < 0)
9bfa35fe
MH		 934 return;
935 }
936
937 if (!test_and_set_bit(BTUSB_ISOC_RUNNING, &data->flags)) {
2eda66f4 938 if (btusb_submit_isoc_urb(hdev, GFP_KERNEL) < 0)
9bfa35fe
MH		 939 clear_bit(BTUSB_ISOC_RUNNING, &data->flags);
940 else
2eda66f4 941 btusb_submit_isoc_urb(hdev, GFP_KERNEL);
9bfa35fe
MH		 942 }
943 } else {
944 clear_bit(BTUSB_ISOC_RUNNING, &data->flags);
945 usb_kill_anchored_urbs(&data->isoc_anchor);
946
947 __set_isoc_interface(hdev, 0);
08b8b6c4 948 if (test_and_clear_bit(BTUSB_DID_ISO_RESUME, &data->flags))
8efdd0cd 949 usb_autopm_put_interface(data->isoc ? data->isoc : data->intf);
5e23b923
MH		 950 }
951}
952
7bee549e
ON		 953static void btusb_waker(struct work_struct *work)
954{
955 struct btusb_data *data = container_of(work, struct btusb_data, waker);
956 int err;
957
958 err = usb_autopm_get_interface(data->intf);
959 if (err < 0)
960 return;
961
962 usb_autopm_put_interface(data->intf);
963}
964
9f8f962c
MH		 965static int btusb_setup_bcm92035(struct hci_dev *hdev)
966{
967 struct sk_buff *skb;
968 u8 val = 0x00;
969
970 BT_DBG("%s", hdev->name);
971
972 skb = __hci_cmd_sync(hdev, 0xfc3b, 1, &val, HCI_INIT_TIMEOUT);
973 if (IS_ERR(skb))
974 BT_ERR("BCM92035 command failed (%ld)", -PTR_ERR(skb));
975 else
976 kfree_skb(skb);
977
978 return 0;
979}
980
81cac64b
MH		 981static int btusb_setup_csr(struct hci_dev *hdev)
982{
983 struct hci_rp_read_local_version *rp;
984 struct sk_buff *skb;
985 int ret;
986
987 BT_DBG("%s", hdev->name);
988
989 skb = __hci_cmd_sync(hdev, HCI_OP_READ_LOCAL_VERSION, 0, NULL,
990 HCI_INIT_TIMEOUT);
991 if (IS_ERR(skb)) {
992 BT_ERR("Reading local version failed (%ld)", -PTR_ERR(skb));
993 return -PTR_ERR(skb);
994 }
995
996 rp = (struct hci_rp_read_local_version *) skb->data;
997
998 if (!rp->status) {
999 if (le16_to_cpu(rp->manufacturer) != 10) {
1000 /* Clear the reset quirk since this is not an actual
1001 * early Bluetooth 1.1 device from CSR.
1002 */
1003 clear_bit(HCI_QUIRK_RESET_ON_CLOSE, &hdev->quirks);
1004
1005 /* These fake CSR controllers have all a broken
1006 * stored link key handling and so just disable it.
1007 */
1008 set_bit(HCI_QUIRK_BROKEN_STORED_LINK_KEY,
1009 &hdev->quirks);
1010 }
1011 }
1012
1013 ret = -bt_to_errno(rp->status);
1014
1015 kfree_skb(skb);
1016
1017 return ret;
1018}
1019
dffd30ee
THJA		 1020struct intel_version {
1021 u8 status;
1022 u8 hw_platform;
1023 u8 hw_variant;
1024 u8 hw_revision;
1025 u8 fw_variant;
1026 u8 fw_revision;
1027 u8 fw_build_num;
1028 u8 fw_build_ww;
1029 u8 fw_build_yy;
1030 u8 fw_patch_num;
1031} __packed;
1032
1033static const struct firmware *btusb_setup_intel_get_fw(struct hci_dev *hdev,
1034 struct intel_version *ver)
1035{
1036 const struct firmware *fw;
1037 char fwname[64];
1038 int ret;
1039
1040 snprintf(fwname, sizeof(fwname),
1041 "intel/ibt-hw-%x.%x.%x-fw-%x.%x.%x.%x.%x.bseq",
1042 ver->hw_platform, ver->hw_variant, ver->hw_revision,
1043 ver->fw_variant, ver->fw_revision, ver->fw_build_num,
1044 ver->fw_build_ww, ver->fw_build_yy);
1045
1046 ret = request_firmware(&fw, fwname, &hdev->dev);
1047 if (ret < 0) {
1048 if (ret == -EINVAL) {
1049 BT_ERR("%s Intel firmware file request failed (%d)",
1050 hdev->name, ret);
1051 return NULL;
1052 }
1053
1054 BT_ERR("%s failed to open Intel firmware file: %s(%d)",
1055 hdev->name, fwname, ret);
1056
1057 /* If the correct firmware patch file is not found, use the
1058 * default firmware patch file instead
1059 */
1060 snprintf(fwname, sizeof(fwname), "intel/ibt-hw-%x.%x.bseq",
1061 ver->hw_platform, ver->hw_variant);
1062 if (request_firmware(&fw, fwname, &hdev->dev) < 0) {
1063 BT_ERR("%s failed to open default Intel fw file: %s",
1064 hdev->name, fwname);
1065 return NULL;
1066 }
1067 }
1068
1069 BT_INFO("%s: Intel Bluetooth firmware file: %s", hdev->name, fwname);
1070
1071 return fw;
1072}
1073
1074static int btusb_setup_intel_patching(struct hci_dev *hdev,
1075 const struct firmware *fw,
1076 const u8 **fw_ptr, int *disable_patch)
1077{
1078 struct sk_buff *skb;
1079 struct hci_command_hdr *cmd;
1080 const u8 *cmd_param;
1081 struct hci_event_hdr *evt = NULL;
1082 const u8 *evt_param = NULL;
1083 int remain = fw->size - (*fw_ptr - fw->data);
1084
1085 /* The first byte indicates the types of the patch command or event.
1086 * 0x01 means HCI command and 0x02 is HCI event. If the first bytes
1087 * in the current firmware buffer doesn't start with 0x01 or
1088 * the size of remain buffer is smaller than HCI command header,
1089 * the firmware file is corrupted and it should stop the patching
1090 * process.
1091 */
1092 if (remain > HCI_COMMAND_HDR_SIZE && *fw_ptr[0] != 0x01) {
1093 BT_ERR("%s Intel fw corrupted: invalid cmd read", hdev->name);
1094 return -EINVAL;
1095 }
1096 (*fw_ptr)++;
1097 remain--;
1098
1099 cmd = (struct hci_command_hdr *)(*fw_ptr);
1100 *fw_ptr += sizeof(*cmd);
1101 remain -= sizeof(*cmd);
1102
1103 /* Ensure that the remain firmware data is long enough than the length
1104 * of command parameter. If not, the firmware file is corrupted.
1105 */
1106 if (remain < cmd->plen) {
1107 BT_ERR("%s Intel fw corrupted: invalid cmd len", hdev->name);
1108 return -EFAULT;
1109 }
1110
1111 /* If there is a command that loads a patch in the firmware
1112 * file, then enable the patch upon success, otherwise just
1113 * disable the manufacturer mode, for example patch activation
1114 * is not required when the default firmware patch file is used
1115 * because there are no patch data to load.
1116 */
1117 if (*disable_patch && le16_to_cpu(cmd->opcode) == 0xfc8e)
1118 *disable_patch = 0;
1119
1120 cmd_param = *fw_ptr;
1121 *fw_ptr += cmd->plen;
1122 remain -= cmd->plen;
1123
1124 /* This reads the expected events when the above command is sent to the
1125 * device. Some vendor commands expects more than one events, for
1126 * example command status event followed by vendor specific event.
1127 * For this case, it only keeps the last expected event. so the command
1128 * can be sent with __hci_cmd_sync_ev() which returns the sk_buff of
1129 * last expected event.
1130 */
1131 while (remain > HCI_EVENT_HDR_SIZE && *fw_ptr[0] == 0x02) {
1132 (*fw_ptr)++;
1133 remain--;
1134
1135 evt = (struct hci_event_hdr *)(*fw_ptr);
1136 *fw_ptr += sizeof(*evt);
1137 remain -= sizeof(*evt);
1138
1139 if (remain < evt->plen) {
1140 BT_ERR("%s Intel fw corrupted: invalid evt len",
1141 hdev->name);
1142 return -EFAULT;
1143 }
1144
1145 evt_param = *fw_ptr;
1146 *fw_ptr += evt->plen;
1147 remain -= evt->plen;
1148 }
1149
1150 /* Every HCI commands in the firmware file has its correspond event.
1151 * If event is not found or remain is smaller than zero, the firmware
1152 * file is corrupted.
1153 */
1154 if (!evt || !evt_param || remain < 0) {
1155 BT_ERR("%s Intel fw corrupted: invalid evt read", hdev->name);
1156 return -EFAULT;
1157 }
1158
1159 skb = __hci_cmd_sync_ev(hdev, le16_to_cpu(cmd->opcode), cmd->plen,
1160 cmd_param, evt->evt, HCI_INIT_TIMEOUT);
1161 if (IS_ERR(skb)) {
1162 BT_ERR("%s sending Intel patch command (0x%4.4x) failed (%ld)",
1163 hdev->name, cmd->opcode, PTR_ERR(skb));
d9c78e97 1164 return PTR_ERR(skb);
dffd30ee
THJA		 1165 }
1166
1167 /* It ensures that the returned event matches the event data read from
1168 * the firmware file. At fist, it checks the length and then
1169 * the contents of the event.
1170 */
1171 if (skb->len != evt->plen) {
1172 BT_ERR("%s mismatch event length (opcode 0x%4.4x)", hdev->name,
1173 le16_to_cpu(cmd->opcode));
1174 kfree_skb(skb);
1175 return -EFAULT;
1176 }
1177
1178 if (memcmp(skb->data, evt_param, evt->plen)) {
1179 BT_ERR("%s mismatch event parameter (opcode 0x%4.4x)",
1180 hdev->name, le16_to_cpu(cmd->opcode));
1181 kfree_skb(skb);
1182 return -EFAULT;
1183 }
1184 kfree_skb(skb);
1185
1186 return 0;
1187}
1188
40cb0984
MH		 1189#define BDADDR_INTEL (&(bdaddr_t) {{0x00, 0x8b, 0x9e, 0x19, 0x03, 0x00}})
1190
1191static int btusb_check_bdaddr_intel(struct hci_dev *hdev)
1192{
1193 struct sk_buff *skb;
1194 struct hci_rp_read_bd_addr *rp;
1195
1196 skb = __hci_cmd_sync(hdev, HCI_OP_READ_BD_ADDR, 0, NULL,
1197 HCI_INIT_TIMEOUT);
1198 if (IS_ERR(skb)) {
1199 BT_ERR("%s reading Intel device address failed (%ld)",
1200 hdev->name, PTR_ERR(skb));
1201 return PTR_ERR(skb);
1202 }
1203
1204 if (skb->len != sizeof(*rp)) {
1205 BT_ERR("%s Intel device address length mismatch", hdev->name);
1206 kfree_skb(skb);
1207 return -EIO;
1208 }
1209
1210 rp = (struct hci_rp_read_bd_addr *) skb->data;
1211 if (rp->status) {
1212 BT_ERR("%s Intel device address result failed (%02x)",
1213 hdev->name, rp->status);
1214 kfree_skb(skb);
1215 return -bt_to_errno(rp->status);
1216 }
1217
1218 /* For some Intel based controllers, the default Bluetooth device
1219 * address 00:03:19:9E:8B:00 can be found. These controllers are
1220 * fully operational, but have the danger of duplicate addresses
1221 * and that in turn can cause problems with Bluetooth operation.
1222 */
4739b5b1 1223 if (!bacmp(&rp->bdaddr, BDADDR_INTEL)) {
40cb0984
MH		 1224 BT_ERR("%s found Intel default device address (%pMR)",
1225 hdev->name, &rp->bdaddr);
4739b5b1
MH		 1226 set_bit(HCI_QUIRK_INVALID_BDADDR, &hdev->quirks);
1227 }
40cb0984
MH		 1228
1229 kfree_skb(skb);
1230
1231 return 0;
1232}
1233
dffd30ee
THJA		 1234static int btusb_setup_intel(struct hci_dev *hdev)
1235{
1236 struct sk_buff *skb;
1237 const struct firmware *fw;
1238 const u8 *fw_ptr;
1239 int disable_patch;
1240 struct intel_version *ver;
1241
1242 const u8 mfg_enable[] = { 0x01, 0x00 };
1243 const u8 mfg_disable[] = { 0x00, 0x00 };
1244 const u8 mfg_reset_deactivate[] = { 0x00, 0x01 };
1245 const u8 mfg_reset_activate[] = { 0x00, 0x02 };
1246
1247 BT_DBG("%s", hdev->name);
1248
1249 /* The controller has a bug with the first HCI command sent to it
1250 * returning number of completed commands as zero. This would stall the
1251 * command processing in the Bluetooth core.
1252 *
1253 * As a workaround, send HCI Reset command first which will reset the
1254 * number of completed commands and allow normal command processing
1255 * from now on.
1256 */
1257 skb = __hci_cmd_sync(hdev, HCI_OP_RESET, 0, NULL, HCI_INIT_TIMEOUT);
1258 if (IS_ERR(skb)) {
1259 BT_ERR("%s sending initial HCI reset command failed (%ld)",
1260 hdev->name, PTR_ERR(skb));
d9c78e97 1261 return PTR_ERR(skb);
dffd30ee
THJA		 1262 }
1263 kfree_skb(skb);
1264
1265 /* Read Intel specific controller version first to allow selection of
1266 * which firmware file to load.
1267 *
1268 * The returned information are hardware variant and revision plus
1269 * firmware variant, revision and build number.
1270 */
1271 skb = __hci_cmd_sync(hdev, 0xfc05, 0, NULL, HCI_INIT_TIMEOUT);
1272 if (IS_ERR(skb)) {
1273 BT_ERR("%s reading Intel fw version command failed (%ld)",
1274 hdev->name, PTR_ERR(skb));
d9c78e97 1275 return PTR_ERR(skb);
dffd30ee
THJA		 1276 }
1277
1278 if (skb->len != sizeof(*ver)) {
1279 BT_ERR("%s Intel version event length mismatch", hdev->name);
1280 kfree_skb(skb);
1281 return -EIO;
1282 }
1283
1284 ver = (struct intel_version *)skb->data;
1285 if (ver->status) {
1286 BT_ERR("%s Intel fw version event failed (%02x)", hdev->name,
1287 ver->status);
1288 kfree_skb(skb);
1289 return -bt_to_errno(ver->status);
1290 }
1291
1292 BT_INFO("%s: read Intel version: %02x%02x%02x%02x%02x%02x%02x%02x%02x",
1293 hdev->name, ver->hw_platform, ver->hw_variant,
1294 ver->hw_revision, ver->fw_variant, ver->fw_revision,
1295 ver->fw_build_num, ver->fw_build_ww, ver->fw_build_yy,
1296 ver->fw_patch_num);
1297
1298 /* fw_patch_num indicates the version of patch the device currently
1299 * have. If there is no patch data in the device, it is always 0x00.
1300 * So, if it is other than 0x00, no need to patch the deivce again.
1301 */
1302 if (ver->fw_patch_num) {
1303 BT_INFO("%s: Intel device is already patched. patch num: %02x",
1304 hdev->name, ver->fw_patch_num);
1305 kfree_skb(skb);
40cb0984 1306 btusb_check_bdaddr_intel(hdev);
dffd30ee
THJA		 1307 return 0;
1308 }
1309
1310 /* Opens the firmware patch file based on the firmware version read
1311 * from the controller. If it fails to open the matching firmware
1312 * patch file, it tries to open the default firmware patch file.
1313 * If no patch file is found, allow the device to operate without
1314 * a patch.
1315 */
1316 fw = btusb_setup_intel_get_fw(hdev, ver);
1317 if (!fw) {
1318 kfree_skb(skb);
40cb0984 1319 btusb_check_bdaddr_intel(hdev);
dffd30ee
THJA		 1320 return 0;
1321 }
1322 fw_ptr = fw->data;
1323
1324 /* This Intel specific command enables the manufacturer mode of the
1325 * controller.
1326 *
1327 * Only while this mode is enabled, the driver can download the
1328 * firmware patch data and configuration parameters.
1329 */
1330 skb = __hci_cmd_sync(hdev, 0xfc11, 2, mfg_enable, HCI_INIT_TIMEOUT);
1331 if (IS_ERR(skb)) {
1332 BT_ERR("%s entering Intel manufacturer mode failed (%ld)",
1333 hdev->name, PTR_ERR(skb));
1334 release_firmware(fw);
d9c78e97 1335 return PTR_ERR(skb);
dffd30ee
THJA		 1336 }
1337
1338 if (skb->data[0]) {
1339 u8 evt_status = skb->data[0];
1340 BT_ERR("%s enable Intel manufacturer mode event failed (%02x)",
1341 hdev->name, evt_status);
1342 kfree_skb(skb);
1343 release_firmware(fw);
1344 return -bt_to_errno(evt_status);
1345 }
1346 kfree_skb(skb);
1347
1348 disable_patch = 1;
1349
1350 /* The firmware data file consists of list of Intel specific HCI
1351 * commands and its expected events. The first byte indicates the
1352 * type of the message, either HCI command or HCI event.
1353 *
1354 * It reads the command and its expected event from the firmware file,
1355 * and send to the controller. Once __hci_cmd_sync_ev() returns,
1356 * the returned event is compared with the event read from the firmware
1357 * file and it will continue until all the messages are downloaded to
1358 * the controller.
1359 *
1360 * Once the firmware patching is completed successfully,
1361 * the manufacturer mode is disabled with reset and activating the
1362 * downloaded patch.
1363 *
1364 * If the firmware patching fails, the manufacturer mode is
1365 * disabled with reset and deactivating the patch.
1366 *
1367 * If the default patch file is used, no reset is done when disabling
1368 * the manufacturer.
1369 */
1370 while (fw->size > fw_ptr - fw->data) {
1371 int ret;
1372
1373 ret = btusb_setup_intel_patching(hdev, fw, &fw_ptr,
1374 &disable_patch);
1375 if (ret < 0)
1376 goto exit_mfg_deactivate;
1377 }
1378
1379 release_firmware(fw);
1380
1381 if (disable_patch)
1382 goto exit_mfg_disable;
1383
1384 /* Patching completed successfully and disable the manufacturer mode
1385 * with reset and activate the downloaded firmware patches.
1386 */
1387 skb = __hci_cmd_sync(hdev, 0xfc11, sizeof(mfg_reset_activate),
1388 mfg_reset_activate, HCI_INIT_TIMEOUT);
1389 if (IS_ERR(skb)) {
1390 BT_ERR("%s exiting Intel manufacturer mode failed (%ld)",
1391 hdev->name, PTR_ERR(skb));
d9c78e97 1392 return PTR_ERR(skb);
dffd30ee
THJA		 1393 }
1394 kfree_skb(skb);
1395
1396 BT_INFO("%s: Intel Bluetooth firmware patch completed and activated",
1397 hdev->name);
1398
40cb0984 1399 btusb_check_bdaddr_intel(hdev);
dffd30ee
THJA		 1400 return 0;
1401
1402exit_mfg_disable:
1403 /* Disable the manufacturer mode without reset */
1404 skb = __hci_cmd_sync(hdev, 0xfc11, sizeof(mfg_disable), mfg_disable,
1405 HCI_INIT_TIMEOUT);
1406 if (IS_ERR(skb)) {
1407 BT_ERR("%s exiting Intel manufacturer mode failed (%ld)",
1408 hdev->name, PTR_ERR(skb));
d9c78e97 1409 return PTR_ERR(skb);
dffd30ee
THJA		 1410 }
1411 kfree_skb(skb);
1412
1413 BT_INFO("%s: Intel Bluetooth firmware patch completed", hdev->name);
40cb0984
MH		 1414
1415 btusb_check_bdaddr_intel(hdev);
dffd30ee
THJA		 1416 return 0;
1417
1418exit_mfg_deactivate:
1419 release_firmware(fw);
1420
1421 /* Patching failed. Disable the manufacturer mode with reset and
1422 * deactivate the downloaded firmware patches.
1423 */
1424 skb = __hci_cmd_sync(hdev, 0xfc11, sizeof(mfg_reset_deactivate),
1425 mfg_reset_deactivate, HCI_INIT_TIMEOUT);
1426 if (IS_ERR(skb)) {
1427 BT_ERR("%s exiting Intel manufacturer mode failed (%ld)",
1428 hdev->name, PTR_ERR(skb));
d9c78e97 1429 return PTR_ERR(skb);
dffd30ee
THJA		 1430 }
1431 kfree_skb(skb);
1432
1433 BT_INFO("%s: Intel Bluetooth firmware patch completed and deactivated",
1434 hdev->name);
1435
40cb0984 1436 btusb_check_bdaddr_intel(hdev);
dffd30ee
THJA		 1437 return 0;
1438}
1439
cb8d6597
MH		 1440static int btusb_set_bdaddr_intel(struct hci_dev *hdev, const bdaddr_t *bdaddr)
1441{
1442 struct sk_buff *skb;
1443 long ret;
1444
1445 skb = __hci_cmd_sync(hdev, 0xfc31, 6, bdaddr, HCI_INIT_TIMEOUT);
1446 if (IS_ERR(skb)) {
1447 ret = PTR_ERR(skb);
1448 BT_ERR("%s: changing Intel device address failed (%ld)",
1449 hdev->name, ret);
1450 return ret;
1451 }
1452 kfree_skb(skb);
1453
1454 return 0;
1455}
1456
c8abb73f
MH		 1457#define BDADDR_BCM20702A0 (&(bdaddr_t) {{0x00, 0xa0, 0x02, 0x70, 0x20, 0x00}})
1458
10d4c673
PG		 1459static int btusb_setup_bcm_patchram(struct hci_dev *hdev)
1460{
1461 struct btusb_data *data = hci_get_drvdata(hdev);
1462 struct usb_device *udev = data->udev;
1463 char fw_name[64];
1464 const struct firmware *fw;
1465 const u8 *fw_ptr;
1466 size_t fw_size;
1467 const struct hci_command_hdr *cmd;
1468 const u8 *cmd_param;
1469 u16 opcode;
1470 struct sk_buff *skb;
1471 struct hci_rp_read_local_version *ver;
c8abb73f 1472 struct hci_rp_read_bd_addr *bda;
10d4c673
PG		 1473 long ret;
1474
1475 snprintf(fw_name, sizeof(fw_name), "brcm/%s-%04x-%04x.hcd",
1476 udev->product ? udev->product : "BCM",
1477 le16_to_cpu(udev->descriptor.idVendor),
1478 le16_to_cpu(udev->descriptor.idProduct));
1479
1480 ret = request_firmware(&fw, fw_name, &hdev->dev);
1481 if (ret < 0) {
c8abb73f 1482 BT_INFO("%s: BCM: patch %s not found", hdev->name, fw_name);
10d4c673
PG		 1483 return 0;
1484 }
1485
1486 /* Reset */
1487 skb = __hci_cmd_sync(hdev, HCI_OP_RESET, 0, NULL, HCI_INIT_TIMEOUT);
1488 if (IS_ERR(skb)) {
1489 ret = PTR_ERR(skb);
1490 BT_ERR("%s: HCI_OP_RESET failed (%ld)", hdev->name, ret);
1491 goto done;
1492 }
1493 kfree_skb(skb);
1494
1495 /* Read Local Version Info */
1496 skb = __hci_cmd_sync(hdev, HCI_OP_READ_LOCAL_VERSION, 0, NULL,
1497 HCI_INIT_TIMEOUT);
1498 if (IS_ERR(skb)) {
1499 ret = PTR_ERR(skb);
1500 BT_ERR("%s: HCI_OP_READ_LOCAL_VERSION failed (%ld)",
1501 hdev->name, ret);
1502 goto done;
1503 }
1504
1505 if (skb->len != sizeof(*ver)) {
1506 BT_ERR("%s: HCI_OP_READ_LOCAL_VERSION event length mismatch",
1507 hdev->name);
1508 kfree_skb(skb);
1509 ret = -EIO;
1510 goto done;
1511 }
1512
1513 ver = (struct hci_rp_read_local_version *) skb->data;
1514 BT_INFO("%s: BCM: patching hci_ver=%02x hci_rev=%04x lmp_ver=%02x "
1515 "lmp_subver=%04x", hdev->name, ver->hci_ver, ver->hci_rev,
1516 ver->lmp_ver, ver->lmp_subver);
1517 kfree_skb(skb);
1518
1519 /* Start Download */
1520 skb = __hci_cmd_sync(hdev, 0xfc2e, 0, NULL, HCI_INIT_TIMEOUT);
1521 if (IS_ERR(skb)) {
1522 ret = PTR_ERR(skb);
1523 BT_ERR("%s: BCM: Download Minidrv command failed (%ld)",
1524 hdev->name, ret);
1525 goto reset_fw;
1526 }
1527 kfree_skb(skb);
1528
1529 /* 50 msec delay after Download Minidrv completes */
1530 msleep(50);
1531
1532 fw_ptr = fw->data;
1533 fw_size = fw->size;
1534
1535 while (fw_size >= sizeof(*cmd)) {
1536 cmd = (struct hci_command_hdr *) fw_ptr;
1537 fw_ptr += sizeof(*cmd);
1538 fw_size -= sizeof(*cmd);
1539
1540 if (fw_size < cmd->plen) {
1541 BT_ERR("%s: BCM: patch %s is corrupted",
1542 hdev->name, fw_name);
1543 ret = -EINVAL;
1544 goto reset_fw;
1545 }
1546
1547 cmd_param = fw_ptr;
1548 fw_ptr += cmd->plen;
1549 fw_size -= cmd->plen;
1550
1551 opcode = le16_to_cpu(cmd->opcode);
1552
1553 skb = __hci_cmd_sync(hdev, opcode, cmd->plen, cmd_param,
1554 HCI_INIT_TIMEOUT);
1555 if (IS_ERR(skb)) {
1556 ret = PTR_ERR(skb);
1557 BT_ERR("%s: BCM: patch command %04x failed (%ld)",
1558 hdev->name, opcode, ret);
1559 goto reset_fw;
1560 }
1561 kfree_skb(skb);
1562 }
1563
1564 /* 250 msec delay after Launch Ram completes */
1565 msleep(250);
1566
1567reset_fw:
1568 /* Reset */
1569 skb = __hci_cmd_sync(hdev, HCI_OP_RESET, 0, NULL, HCI_INIT_TIMEOUT);
1570 if (IS_ERR(skb)) {
1571 ret = PTR_ERR(skb);
1572 BT_ERR("%s: HCI_OP_RESET failed (%ld)", hdev->name, ret);
1573 goto done;
1574 }
1575 kfree_skb(skb);
1576
1577 /* Read Local Version Info */
1578 skb = __hci_cmd_sync(hdev, HCI_OP_READ_LOCAL_VERSION, 0, NULL,
1579 HCI_INIT_TIMEOUT);
1580 if (IS_ERR(skb)) {
1581 ret = PTR_ERR(skb);
1582 BT_ERR("%s: HCI_OP_READ_LOCAL_VERSION failed (%ld)",
1583 hdev->name, ret);
1584 goto done;
1585 }
1586
1587 if (skb->len != sizeof(*ver)) {
1588 BT_ERR("%s: HCI_OP_READ_LOCAL_VERSION event length mismatch",
1589 hdev->name);
1590 kfree_skb(skb);
1591 ret = -EIO;
1592 goto done;
1593 }
1594
1595 ver = (struct hci_rp_read_local_version *) skb->data;
1596 BT_INFO("%s: BCM: firmware hci_ver=%02x hci_rev=%04x lmp_ver=%02x "
1597 "lmp_subver=%04x", hdev->name, ver->hci_ver, ver->hci_rev,
1598 ver->lmp_ver, ver->lmp_subver);
1599 kfree_skb(skb);
1600
c8abb73f
MH		 1601 /* Read BD Address */
1602 skb = __hci_cmd_sync(hdev, HCI_OP_READ_BD_ADDR, 0, NULL,
1603 HCI_INIT_TIMEOUT);
1604 if (IS_ERR(skb)) {
1605 ret = PTR_ERR(skb);
1606 BT_ERR("%s: HCI_OP_READ_BD_ADDR failed (%ld)",
1607 hdev->name, ret);
1608 goto done;
1609 }
1610
1611 if (skb->len != sizeof(*bda)) {
1612 BT_ERR("%s: HCI_OP_READ_BD_ADDR event length mismatch",
1613 hdev->name);
1614 kfree_skb(skb);
1615 ret = -EIO;
1616 goto done;
1617 }
1618
1619 bda = (struct hci_rp_read_bd_addr *) skb->data;
1620 if (bda->status) {
1621 BT_ERR("%s: HCI_OP_READ_BD_ADDR error status (%02x)",
1622 hdev->name, bda->status);
1623 kfree_skb(skb);
1624 ret = -bt_to_errno(bda->status);
1625 goto done;
1626 }
1627
1628 /* The address 00:20:70:02:A0:00 indicates a BCM20702A0 controller
1629 * with no configured address.
1630 */
849e5086 1631 if (!bacmp(&bda->bdaddr, BDADDR_BCM20702A0)) {
c8abb73f
MH		 1632 BT_INFO("%s: BCM: using default device address (%pMR)",
1633 hdev->name, &bda->bdaddr);
849e5086
MH		 1634 set_bit(HCI_QUIRK_INVALID_BDADDR, &hdev->quirks);
1635 }
c8abb73f
MH		 1636
1637 kfree_skb(skb);
1638
10d4c673
PG		 1639done:
1640 release_firmware(fw);
1641
1642 return ret;
1643}
1644
abbaf50e
MH		 1645static int btusb_set_bdaddr_bcm(struct hci_dev *hdev, const bdaddr_t *bdaddr)
1646{
1647 struct sk_buff *skb;
1648 long ret;
1649
1650 skb = __hci_cmd_sync(hdev, 0xfc01, 6, bdaddr, HCI_INIT_TIMEOUT);
1651 if (IS_ERR(skb)) {
1652 ret = PTR_ERR(skb);
1653 BT_ERR("%s: BCM: Change address command failed (%ld)",
1654 hdev->name, ret);
1655 return ret;
1656 }
1657 kfree_skb(skb);
1658
1659 return 0;
1660}
1661
5e23b923
MH		 1662static int btusb_probe(struct usb_interface *intf,
1663 const struct usb_device_id *id)
1664{
1665 struct usb_endpoint_descriptor *ep_desc;
1666 struct btusb_data *data;
1667 struct hci_dev *hdev;
1668 int i, err;
1669
1670 BT_DBG("intf %p id %p", intf, id);
1671
cfeb4145 1672 /* interface numbers are hardcoded in the spec */
5e23b923
MH		 1673 if (intf->cur_altsetting->desc.bInterfaceNumber != 0)
1674 return -ENODEV;
1675
1676 if (!id->driver_info) {
1677 const struct usb_device_id *match;
1678 match = usb_match_id(intf, blacklist_table);
1679 if (match)
1680 id = match;
1681 }
1682
cfeb4145
MH		 1683 if (id->driver_info == BTUSB_IGNORE)
1684 return -ENODEV;
1685
2d25f8b4
SL		 1686 if (id->driver_info & BTUSB_ATH3012) {
1687 struct usb_device *udev = interface_to_usbdev(intf);
1688
1689 /* Old firmware would otherwise let ath3k driver load
1690 * patch and sysconfig files */
1691 if (le16_to_cpu(udev->descriptor.bcdDevice) <= 0x0001)
1692 return -ENODEV;
1693 }
1694
98921dbd 1695 data = devm_kzalloc(&intf->dev, sizeof(*data), GFP_KERNEL);
5e23b923
MH		 1696 if (!data)
1697 return -ENOMEM;
1698
1699 for (i = 0; i < intf->cur_altsetting->desc.bNumEndpoints; i++) {
1700 ep_desc = &intf->cur_altsetting->endpoint[i].desc;
1701
1702 if (!data->intr_ep && usb_endpoint_is_int_in(ep_desc)) {
1703 data->intr_ep = ep_desc;
1704 continue;
1705 }
1706
1707 if (!data->bulk_tx_ep && usb_endpoint_is_bulk_out(ep_desc)) {
1708 data->bulk_tx_ep = ep_desc;
1709 continue;
1710 }
1711
1712 if (!data->bulk_rx_ep && usb_endpoint_is_bulk_in(ep_desc)) {
1713 data->bulk_rx_ep = ep_desc;
1714 continue;
1715 }
1716 }
1717
98921dbd 1718 if (!data->intr_ep || !data->bulk_tx_ep || !data->bulk_rx_ep)
5e23b923 1719 return -ENODEV;
5e23b923 1720
7a9d4020
MH		 1721 data->cmdreq_type = USB_TYPE_CLASS;
1722
5e23b923 1723 data->udev = interface_to_usbdev(intf);
5fbcd260 1724 data->intf = intf;
5e23b923
MH		 1725
1726 spin_lock_init(&data->lock);
1727
1728 INIT_WORK(&data->work, btusb_work);
7bee549e
ON		 1729 INIT_WORK(&data->waker, btusb_waker);
1730 spin_lock_init(&data->txlock);
5e23b923
MH		 1731
1732 init_usb_anchor(&data->tx_anchor);
1733 init_usb_anchor(&data->intr_anchor);
1734 init_usb_anchor(&data->bulk_anchor);
9bfa35fe 1735 init_usb_anchor(&data->isoc_anchor);
7bee549e 1736 init_usb_anchor(&data->deferred);
5e23b923
MH		 1737
1738 hdev = hci_alloc_dev();
98921dbd 1739 if (!hdev)
5e23b923 1740 return -ENOMEM;
5e23b923 1741
c13854ce 1742 hdev->bus = HCI_USB;
155961e8 1743 hci_set_drvdata(hdev, data);
5e23b923
MH		 1744
1745 data->hdev = hdev;
1746
1747 SET_HCIDEV_DEV(hdev, &intf->dev);
1748
9f8f962c
MH		 1749 hdev->open = btusb_open;
1750 hdev->close = btusb_close;
1751 hdev->flush = btusb_flush;
1752 hdev->send = btusb_send_frame;
1753 hdev->notify = btusb_notify;
1754
1755 if (id->driver_info & BTUSB_BCM92035)
1756 hdev->setup = btusb_setup_bcm92035;
5e23b923 1757
abbaf50e 1758 if (id->driver_info & BTUSB_BCM_PATCHRAM) {
10d4c673 1759 hdev->setup = btusb_setup_bcm_patchram;
abbaf50e
MH		 1760 hdev->set_bdaddr = btusb_set_bdaddr_bcm;
1761 }
10d4c673 1762
cb8d6597 1763 if (id->driver_info & BTUSB_INTEL) {
dffd30ee 1764 hdev->setup = btusb_setup_intel;
cb8d6597
MH		 1765 hdev->set_bdaddr = btusb_set_bdaddr_intel;
1766 }
dffd30ee 1767
40df783d
MH		 1768 if (id->driver_info & BTUSB_INTEL_BOOT)
1769 set_bit(HCI_QUIRK_RAW_DEVICE, &hdev->quirks);
1770
7a9d4020 1771 /* Interface numbers are hardcoded in the specification */
9bfa35fe
MH		 1772 data->isoc = usb_ifnum_to_if(data->udev, 1);
1773
7a9d4020 1774 if (!reset)
a6c511c6 1775 set_bit(HCI_QUIRK_RESET_ON_CLOSE, &hdev->quirks);
cfeb4145
MH		 1776
1777 if (force_scofix || id->driver_info & BTUSB_WRONG_SCO_MTU) {
1778 if (!disable_scofix)
1779 set_bit(HCI_QUIRK_FIXUP_BUFFER_SIZE, &hdev->quirks);
1780 }
1781
9bfa35fe
MH		 1782 if (id->driver_info & BTUSB_BROKEN_ISOC)
1783 data->isoc = NULL;
1784
7a9d4020
MH		 1785 if (id->driver_info & BTUSB_DIGIANSWER) {
1786 data->cmdreq_type = USB_TYPE_VENDOR;
a6c511c6 1787 set_bit(HCI_QUIRK_RESET_ON_CLOSE, &hdev->quirks);
7a9d4020
MH		 1788 }
1789
1790 if (id->driver_info & BTUSB_CSR) {
1791 struct usb_device *udev = data->udev;
81cac64b 1792 u16 bcdDevice = le16_to_cpu(udev->descriptor.bcdDevice);
7a9d4020
MH		 1793
1794 /* Old firmware would otherwise execute USB reset */
81cac64b 1795 if (bcdDevice < 0x117)
a6c511c6 1796 set_bit(HCI_QUIRK_RESET_ON_CLOSE, &hdev->quirks);
81cac64b
MH		 1797
1798 /* Fake CSR devices with broken commands */
1799 if (bcdDevice <= 0x100)
1800 hdev->setup = btusb_setup_csr;
7a9d4020
MH		 1801 }
1802
cfeb4145 1803 if (id->driver_info & BTUSB_SNIFFER) {
9bfa35fe 1804 struct usb_device *udev = data->udev;
cfeb4145 1805
7a9d4020 1806 /* New sniffer firmware has crippled HCI interface */
cfeb4145
MH		 1807 if (le16_to_cpu(udev->descriptor.bcdDevice) > 0x997)
1808 set_bit(HCI_QUIRK_RAW_DEVICE, &hdev->quirks);
1809 }
1810
3a5ef20c
MH		 1811 if (id->driver_info & BTUSB_INTEL_BOOT) {
1812 /* A bug in the bootloader causes that interrupt interface is
1813 * only enabled after receiving SetInterface(0, AltSetting=0).
1814 */
1815 err = usb_set_interface(data->udev, 0, 0);
1816 if (err < 0) {
1817 BT_ERR("failed to set interface 0, alt 0 %d", err);
1818 hci_free_dev(hdev);
1819 return err;
1820 }
1821 }
1822
9bfa35fe
MH		 1823 if (data->isoc) {
1824 err = usb_driver_claim_interface(&btusb_driver,
5fbcd260 1825 data->isoc, data);
9bfa35fe
MH		 1826 if (err < 0) {
1827 hci_free_dev(hdev);
9bfa35fe
MH		 1828 return err;
1829 }
1830 }
1831
5e23b923
MH		 1832 err = hci_register_dev(hdev);
1833 if (err < 0) {
1834 hci_free_dev(hdev);
5e23b923
MH		 1835 return err;
1836 }
1837
1838 usb_set_intfdata(intf, data);
1839
1840 return 0;
1841}
1842
1843static void btusb_disconnect(struct usb_interface *intf)
1844{
1845 struct btusb_data *data = usb_get_intfdata(intf);
1846 struct hci_dev *hdev;
1847
1848 BT_DBG("intf %p", intf);
1849
1850 if (!data)
1851 return;
1852
1853 hdev = data->hdev;
5fbcd260
MH		 1854 usb_set_intfdata(data->intf, NULL);
1855
1856 if (data->isoc)
1857 usb_set_intfdata(data->isoc, NULL);
5e23b923
MH		 1858
1859 hci_unregister_dev(hdev);
1860
5fbcd260
MH		 1861 if (intf == data->isoc)
1862 usb_driver_release_interface(&btusb_driver, data->intf);
1863 else if (data->isoc)
1864 usb_driver_release_interface(&btusb_driver, data->isoc);
1865
5e23b923
MH		 1866 hci_free_dev(hdev);
1867}
1868
7bee549e 1869#ifdef CONFIG_PM
6a88adf2
MH		 1870static int btusb_suspend(struct usb_interface *intf, pm_message_t message)
1871{
1872 struct btusb_data *data = usb_get_intfdata(intf);
1873
1874 BT_DBG("intf %p", intf);
1875
1876 if (data->suspend_count++)
1877 return 0;
1878
7bee549e 1879 spin_lock_irq(&data->txlock);
5b1b0b81 1880 if (!(PMSG_IS_AUTO(message) && data->tx_in_flight)) {
7bee549e
ON		 1881 set_bit(BTUSB_SUSPENDING, &data->flags);
1882 spin_unlock_irq(&data->txlock);
1883 } else {
1884 spin_unlock_irq(&data->txlock);
1885 data->suspend_count--;
1886 return -EBUSY;
1887 }
1888
6a88adf2
MH		 1889 cancel_work_sync(&data->work);
1890
7bee549e 1891 btusb_stop_traffic(data);
6a88adf2
MH		 1892 usb_kill_anchored_urbs(&data->tx_anchor);
1893
6a88adf2
MH		 1894 return 0;
1895}
1896
7bee549e
ON		 1897static void play_deferred(struct btusb_data *data)
1898{
1899 struct urb *urb;
1900 int err;
1901
1902 while ((urb = usb_get_from_anchor(&data->deferred))) {
1903 err = usb_submit_urb(urb, GFP_ATOMIC);
1904 if (err < 0)
1905 break;
1906
1907 data->tx_in_flight++;
1908 }
1909 usb_scuttle_anchored_urbs(&data->deferred);
1910}
1911
6a88adf2
MH		 1912static int btusb_resume(struct usb_interface *intf)
1913{
1914 struct btusb_data *data = usb_get_intfdata(intf);
1915 struct hci_dev *hdev = data->hdev;
7bee549e 1916 int err = 0;
6a88adf2
MH		 1917
1918 BT_DBG("intf %p", intf);
1919
1920 if (--data->suspend_count)
1921 return 0;
1922
1923 if (!test_bit(HCI_RUNNING, &hdev->flags))
7bee549e 1924 goto done;
6a88adf2
MH		 1925
1926 if (test_bit(BTUSB_INTR_RUNNING, &data->flags)) {
1927 err = btusb_submit_intr_urb(hdev, GFP_NOIO);
1928 if (err < 0) {
1929 clear_bit(BTUSB_INTR_RUNNING, &data->flags);
7bee549e 1930 goto failed;
6a88adf2
MH		 1931 }
1932 }
1933
1934 if (test_bit(BTUSB_BULK_RUNNING, &data->flags)) {
43c2e57f
MH		 1935 err = btusb_submit_bulk_urb(hdev, GFP_NOIO);
1936 if (err < 0) {
6a88adf2 1937 clear_bit(BTUSB_BULK_RUNNING, &data->flags);
7bee549e
ON		 1938 goto failed;
1939 }
1940
1941 btusb_submit_bulk_urb(hdev, GFP_NOIO);
6a88adf2
MH		 1942 }
1943
1944 if (test_bit(BTUSB_ISOC_RUNNING, &data->flags)) {
1945 if (btusb_submit_isoc_urb(hdev, GFP_NOIO) < 0)
1946 clear_bit(BTUSB_ISOC_RUNNING, &data->flags);
1947 else
1948 btusb_submit_isoc_urb(hdev, GFP_NOIO);
1949 }
1950
7bee549e
ON		 1951 spin_lock_irq(&data->txlock);
1952 play_deferred(data);
1953 clear_bit(BTUSB_SUSPENDING, &data->flags);
1954 spin_unlock_irq(&data->txlock);
1955 schedule_work(&data->work);
1956
6a88adf2 1957 return 0;
7bee549e
ON		 1958
1959failed:
1960 usb_scuttle_anchored_urbs(&data->deferred);
1961done:
1962 spin_lock_irq(&data->txlock);
1963 clear_bit(BTUSB_SUSPENDING, &data->flags);
1964 spin_unlock_irq(&data->txlock);
1965
1966 return err;
6a88adf2 1967}
7bee549e 1968#endif
6a88adf2 1969
5e23b923
MH		 1970static struct usb_driver btusb_driver = {
1971 .name = "btusb",
1972 .probe = btusb_probe,
1973 .disconnect = btusb_disconnect,
7bee549e 1974#ifdef CONFIG_PM
6a88adf2
MH		 1975 .suspend = btusb_suspend,
1976 .resume = btusb_resume,
7bee549e 1977#endif
5e23b923 1978 .id_table = btusb_table,
7bee549e 1979 .supports_autosuspend = 1,
e1f12eb6 1980 .disable_hub_initiated_lpm = 1,
5e23b923
MH		 1981};
1982
93f1508c 1983module_usb_driver(btusb_driver);
5e23b923 1984
cfeb4145
MH		 1985module_param(disable_scofix, bool, 0644);
1986MODULE_PARM_DESC(disable_scofix, "Disable fixup of wrong SCO buffer size");
1987
1988module_param(force_scofix, bool, 0644);
1989MODULE_PARM_DESC(force_scofix, "Force fixup of wrong SCO buffers size");
1990
1991module_param(reset, bool, 0644);
1992MODULE_PARM_DESC(reset, "Send HCI reset command on initialization");
1993
5e23b923
MH		 1994MODULE_AUTHOR("Marcel Holtmann <marcel@holtmann.org>");
1995MODULE_DESCRIPTION("Generic Bluetooth USB driver ver " VERSION);
1996MODULE_VERSION(VERSION);
1997MODULE_LICENSE("GPL");
Linux kernel - Deliverables
This page took 0.615588 seconds and 5 git commands to generate.