1/* 2 * 3 * Generic Bluetooth USB driver 4 * 5 * Copyright (C) 2005-2008 Marcel Holtmann <marcel@holtmann.org> 6 * 7 * 8 * This program is free software; you can redistribute it and/or modify 9 * it under the terms of the GNU General Public License as published by 10 * the Free Software Foundation; either version 2 of the License, or 11 * (at your option) any later version. 12 * 13 * This program is distributed in the hope that it will be useful, 14 * but WITHOUT ANY WARRANTY; without even the implied warranty of 15 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the 16 * GNU General Public License for more details. 17 * 18 * You should have received a copy of the GNU General Public License 19 * along with this program; if not, write to the Free Software 20 * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA 21 * 22 */ 23 24#include <linux/module.h> 25#include <linux/usb.h> 26#include <linux/firmware.h> 27#include <asm/unaligned.h> 28 29#include <net/bluetooth/bluetooth.h> 30#include <net/bluetooth/hci_core.h> 31 32#include "btintel.h" 33#include "btbcm.h" 34 35#define VERSION "0.8" 36 37static bool disable_scofix; 38static bool force_scofix; 39 40static bool reset = 1; 41 42static struct usb_driver btusb_driver; 43 44#define BTUSB_IGNORE 0x01 45#define BTUSB_DIGIANSWER 0x02 46#define BTUSB_CSR 0x04 47#define BTUSB_SNIFFER 0x08 48#define BTUSB_BCM92035 0x10 49#define BTUSB_BROKEN_ISOC 0x20 50#define BTUSB_WRONG_SCO_MTU 0x40 51#define BTUSB_ATH3012 0x80 52#define BTUSB_INTEL 0x100 53#define BTUSB_INTEL_BOOT 0x200 54#define BTUSB_BCM_PATCHRAM 0x400 55#define BTUSB_MARVELL 0x800 56#define BTUSB_SWAVE 0x1000 57#define BTUSB_INTEL_NEW 0x2000 58#define BTUSB_AMP 0x4000 59#define BTUSB_QCA_ROME 0x8000 60#define BTUSB_BCM_APPLE 0x10000 61#define BTUSB_REALTEK 0x20000 62 63static const struct usb_device_id btusb_table[] = { 64 /* Generic Bluetooth USB device */ 65 { USB_DEVICE_INFO(0xe0, 0x01, 0x01) }, 66 67 /* Generic Bluetooth AMP device */ 68 { USB_DEVICE_INFO(0xe0, 0x01, 0x04), .driver_info = BTUSB_AMP }, 69 70 /* Apple-specific (Broadcom) devices */ 71 { USB_VENDOR_AND_INTERFACE_INFO(0x05ac, 0xff, 0x01, 0x01), 72 .driver_info = BTUSB_BCM_APPLE }, 73 74 /* MediaTek MT76x0E */ 75 { USB_DEVICE(0x0e8d, 0x763f) }, 76 77 /* Broadcom SoftSailing reporting vendor specific */ 78 { USB_DEVICE(0x0a5c, 0x21e1) }, 79 80 /* Apple MacBookPro 7,1 */ 81 { USB_DEVICE(0x05ac, 0x8213) }, 82 83 /* Apple iMac11,1 */ 84 { USB_DEVICE(0x05ac, 0x8215) }, 85 86 /* Apple MacBookPro6,2 */ 87 { USB_DEVICE(0x05ac, 0x8218) }, 88 89 /* Apple MacBookAir3,1, MacBookAir3,2 */ 90 { USB_DEVICE(0x05ac, 0x821b) }, 91 92 /* Apple MacBookAir4,1 */ 93 { USB_DEVICE(0x05ac, 0x821f) }, 94 95 /* Apple MacBookPro8,2 */ 96 { USB_DEVICE(0x05ac, 0x821a) }, 97 98 /* Apple MacMini5,1 */ 99 { USB_DEVICE(0x05ac, 0x8281) }, 100 101 /* AVM BlueFRITZ! USB v2.0 */ 102 { USB_DEVICE(0x057c, 0x3800), .driver_info = BTUSB_SWAVE }, 103 104 /* Bluetooth Ultraport Module from IBM */ 105 { USB_DEVICE(0x04bf, 0x030a) }, 106 107 /* ALPS Modules with non-standard id */ 108 { USB_DEVICE(0x044e, 0x3001) }, 109 { USB_DEVICE(0x044e, 0x3002) }, 110 111 /* Ericsson with non-standard id */ 112 { USB_DEVICE(0x0bdb, 0x1002) }, 113 114 /* Canyon CN-BTU1 with HID interfaces */ 115 { USB_DEVICE(0x0c10, 0x0000) }, 116 117 /* Broadcom BCM20702A0 */ 118 { USB_DEVICE(0x413c, 0x8197) }, 119 120 /* Broadcom BCM20702B0 (Dynex/Insignia) */ 121 { USB_DEVICE(0x19ff, 0x0239), .driver_info = BTUSB_BCM_PATCHRAM }, 122 123 /* Foxconn - Hon Hai */ 124 { USB_VENDOR_AND_INTERFACE_INFO(0x0489, 0xff, 0x01, 0x01), 125 .driver_info = BTUSB_BCM_PATCHRAM }, 126 127 /* Lite-On Technology - Broadcom based */ 128 { USB_VENDOR_AND_INTERFACE_INFO(0x04ca, 0xff, 0x01, 0x01), 129 .driver_info = BTUSB_BCM_PATCHRAM }, 130 131 /* Broadcom devices with vendor specific id */ 132 { USB_VENDOR_AND_INTERFACE_INFO(0x0a5c, 0xff, 0x01, 0x01), 133 .driver_info = BTUSB_BCM_PATCHRAM }, 134 135 /* ASUSTek Computer - Broadcom based */ 136 { USB_VENDOR_AND_INTERFACE_INFO(0x0b05, 0xff, 0x01, 0x01), 137 .driver_info = BTUSB_BCM_PATCHRAM }, 138 139 /* Belkin F8065bf - Broadcom based */ 140 { USB_VENDOR_AND_INTERFACE_INFO(0x050d, 0xff, 0x01, 0x01), 141 .driver_info = BTUSB_BCM_PATCHRAM }, 142 143 /* IMC Networks - Broadcom based */ 144 { USB_VENDOR_AND_INTERFACE_INFO(0x13d3, 0xff, 0x01, 0x01), 145 .driver_info = BTUSB_BCM_PATCHRAM }, 146 147 /* Toshiba Corp - Broadcom based */ 148 { USB_VENDOR_AND_INTERFACE_INFO(0x0930, 0xff, 0x01, 0x01), 149 .driver_info = BTUSB_BCM_PATCHRAM }, 150 151 /* Intel Bluetooth USB Bootloader (RAM module) */ 152 { USB_DEVICE(0x8087, 0x0a5a), 153 .driver_info = BTUSB_INTEL_BOOT | BTUSB_BROKEN_ISOC }, 154 155 { } /* Terminating entry */ 156}; 157 158MODULE_DEVICE_TABLE(usb, btusb_table); 159 160static const struct usb_device_id blacklist_table[] = { 161 /* CSR BlueCore devices */ 162 { USB_DEVICE(0x0a12, 0x0001), .driver_info = BTUSB_CSR }, 163 164 /* Broadcom BCM2033 without firmware */ 165 { USB_DEVICE(0x0a5c, 0x2033), .driver_info = BTUSB_IGNORE }, 166 167 /* Atheros 3011 with sflash firmware */ 168 { USB_DEVICE(0x0489, 0xe027), .driver_info = BTUSB_IGNORE }, 169 { USB_DEVICE(0x0489, 0xe03d), .driver_info = BTUSB_IGNORE }, 170 { USB_DEVICE(0x04f2, 0xaff1), .driver_info = BTUSB_IGNORE }, 171 { USB_DEVICE(0x0930, 0x0215), .driver_info = BTUSB_IGNORE }, 172 { USB_DEVICE(0x0cf3, 0x3002), .driver_info = BTUSB_IGNORE }, 173 { USB_DEVICE(0x0cf3, 0xe019), .driver_info = BTUSB_IGNORE }, 174 { USB_DEVICE(0x13d3, 0x3304), .driver_info = BTUSB_IGNORE }, 175 176 /* Atheros AR9285 Malbec with sflash firmware */ 177 { USB_DEVICE(0x03f0, 0x311d), .driver_info = BTUSB_IGNORE }, 178 179 /* Atheros 3012 with sflash firmware */ 180 { USB_DEVICE(0x0489, 0xe04d), .driver_info = BTUSB_ATH3012 }, 181 { USB_DEVICE(0x0489, 0xe04e), .driver_info = BTUSB_ATH3012 }, 182 { USB_DEVICE(0x0489, 0xe056), .driver_info = BTUSB_ATH3012 }, 183 { USB_DEVICE(0x0489, 0xe057), .driver_info = BTUSB_ATH3012 }, 184 { USB_DEVICE(0x0489, 0xe05f), .driver_info = BTUSB_ATH3012 }, 185 { USB_DEVICE(0x0489, 0xe076), .driver_info = BTUSB_ATH3012 }, 186 { USB_DEVICE(0x0489, 0xe078), .driver_info = BTUSB_ATH3012 }, 187 { USB_DEVICE(0x0489, 0xe095), .driver_info = BTUSB_ATH3012 }, 188 { USB_DEVICE(0x04c5, 0x1330), .driver_info = BTUSB_ATH3012 }, 189 { USB_DEVICE(0x04ca, 0x3004), .driver_info = BTUSB_ATH3012 }, 190 { USB_DEVICE(0x04ca, 0x3005), .driver_info = BTUSB_ATH3012 }, 191 { USB_DEVICE(0x04ca, 0x3006), .driver_info = BTUSB_ATH3012 }, 192 { USB_DEVICE(0x04ca, 0x3007), .driver_info = BTUSB_ATH3012 }, 193 { USB_DEVICE(0x04ca, 0x3008), .driver_info = BTUSB_ATH3012 }, 194 { USB_DEVICE(0x04ca, 0x300b), .driver_info = BTUSB_ATH3012 }, 195 { USB_DEVICE(0x04ca, 0x300d), .driver_info = BTUSB_ATH3012 }, 196 { USB_DEVICE(0x04ca, 0x300f), .driver_info = BTUSB_ATH3012 }, 197 { USB_DEVICE(0x04ca, 0x3010), .driver_info = BTUSB_ATH3012 }, 198 { USB_DEVICE(0x04ca, 0x3014), .driver_info = BTUSB_ATH3012 }, 199 { USB_DEVICE(0x0930, 0x0219), .driver_info = BTUSB_ATH3012 }, 200 { USB_DEVICE(0x0930, 0x021c), .driver_info = BTUSB_ATH3012 }, 201 { USB_DEVICE(0x0930, 0x0220), .driver_info = BTUSB_ATH3012 }, 202 { USB_DEVICE(0x0930, 0x0227), .driver_info = BTUSB_ATH3012 }, 203 { USB_DEVICE(0x0b05, 0x17d0), .driver_info = BTUSB_ATH3012 }, 204 { USB_DEVICE(0x0cf3, 0x0036), .driver_info = BTUSB_ATH3012 }, 205 { USB_DEVICE(0x0cf3, 0x3004), .driver_info = BTUSB_ATH3012 }, 206 { USB_DEVICE(0x0cf3, 0x3008), .driver_info = BTUSB_ATH3012 }, 207 { USB_DEVICE(0x0cf3, 0x311d), .driver_info = BTUSB_ATH3012 }, 208 { USB_DEVICE(0x0cf3, 0x311e), .driver_info = BTUSB_ATH3012 }, 209 { USB_DEVICE(0x0cf3, 0x311f), .driver_info = BTUSB_ATH3012 }, 210 { USB_DEVICE(0x0cf3, 0x3121), .driver_info = BTUSB_ATH3012 }, 211 { USB_DEVICE(0x0cf3, 0x817a), .driver_info = BTUSB_ATH3012 }, 212 { USB_DEVICE(0x0cf3, 0x817b), .driver_info = BTUSB_ATH3012 }, 213 { USB_DEVICE(0x0cf3, 0xe003), .driver_info = BTUSB_ATH3012 }, 214 { USB_DEVICE(0x0cf3, 0xe004), .driver_info = BTUSB_ATH3012 }, 215 { USB_DEVICE(0x0cf3, 0xe005), .driver_info = BTUSB_ATH3012 }, 216 { USB_DEVICE(0x0cf3, 0xe006), .driver_info = BTUSB_ATH3012 }, 217 { USB_DEVICE(0x13d3, 0x3362), .driver_info = BTUSB_ATH3012 }, 218 { USB_DEVICE(0x13d3, 0x3375), .driver_info = BTUSB_ATH3012 }, 219 { USB_DEVICE(0x13d3, 0x3393), .driver_info = BTUSB_ATH3012 }, 220 { USB_DEVICE(0x13d3, 0x3395), .driver_info = BTUSB_ATH3012 }, 221 { USB_DEVICE(0x13d3, 0x3402), .driver_info = BTUSB_ATH3012 }, 222 { USB_DEVICE(0x13d3, 0x3408), .driver_info = BTUSB_ATH3012 }, 223 { USB_DEVICE(0x13d3, 0x3423), .driver_info = BTUSB_ATH3012 }, 224 { USB_DEVICE(0x13d3, 0x3432), .driver_info = BTUSB_ATH3012 }, 225 { USB_DEVICE(0x13d3, 0x3472), .driver_info = BTUSB_ATH3012 }, 226 { USB_DEVICE(0x13d3, 0x3474), .driver_info = BTUSB_ATH3012 }, 227 228 /* Atheros AR5BBU12 with sflash firmware */ 229 { USB_DEVICE(0x0489, 0xe02c), .driver_info = BTUSB_IGNORE }, 230 231 /* Atheros AR5BBU12 with sflash firmware */ 232 { USB_DEVICE(0x0489, 0xe036), .driver_info = BTUSB_ATH3012 }, 233 { USB_DEVICE(0x0489, 0xe03c), .driver_info = BTUSB_ATH3012 }, 234 235 /* QCA ROME chipset */ 236 { USB_DEVICE(0x0cf3, 0xe007), .driver_info = BTUSB_QCA_ROME }, 237 { USB_DEVICE(0x0cf3, 0xe300), .driver_info = BTUSB_QCA_ROME }, 238 { USB_DEVICE(0x0cf3, 0xe360), .driver_info = BTUSB_QCA_ROME }, 239 240 /* Broadcom BCM2035 */ 241 { USB_DEVICE(0x0a5c, 0x2009), .driver_info = BTUSB_BCM92035 }, 242 { USB_DEVICE(0x0a5c, 0x200a), .driver_info = BTUSB_WRONG_SCO_MTU }, 243 { USB_DEVICE(0x0a5c, 0x2035), .driver_info = BTUSB_WRONG_SCO_MTU }, 244 245 /* Broadcom BCM2045 */ 246 { USB_DEVICE(0x0a5c, 0x2039), .driver_info = BTUSB_WRONG_SCO_MTU }, 247 { USB_DEVICE(0x0a5c, 0x2101), .driver_info = BTUSB_WRONG_SCO_MTU }, 248 249 /* IBM/Lenovo ThinkPad with Broadcom chip */ 250 { USB_DEVICE(0x0a5c, 0x201e), .driver_info = BTUSB_WRONG_SCO_MTU }, 251 { USB_DEVICE(0x0a5c, 0x2110), .driver_info = BTUSB_WRONG_SCO_MTU }, 252 253 /* HP laptop with Broadcom chip */ 254 { USB_DEVICE(0x03f0, 0x171d), .driver_info = BTUSB_WRONG_SCO_MTU }, 255 256 /* Dell laptop with Broadcom chip */ 257 { USB_DEVICE(0x413c, 0x8126), .driver_info = BTUSB_WRONG_SCO_MTU }, 258 259 /* Dell Wireless 370 and 410 devices */ 260 { USB_DEVICE(0x413c, 0x8152), .driver_info = BTUSB_WRONG_SCO_MTU }, 261 { USB_DEVICE(0x413c, 0x8156), .driver_info = BTUSB_WRONG_SCO_MTU }, 262 263 /* Belkin F8T012 and F8T013 devices */ 264 { USB_DEVICE(0x050d, 0x0012), .driver_info = BTUSB_WRONG_SCO_MTU }, 265 { USB_DEVICE(0x050d, 0x0013), .driver_info = BTUSB_WRONG_SCO_MTU }, 266 267 /* Asus WL-BTD202 device */ 268 { USB_DEVICE(0x0b05, 0x1715), .driver_info = BTUSB_WRONG_SCO_MTU }, 269 270 /* Kensington Bluetooth USB adapter */ 271 { USB_DEVICE(0x047d, 0x105e), .driver_info = BTUSB_WRONG_SCO_MTU }, 272 273 /* RTX Telecom based adapters with buggy SCO support */ 274 { USB_DEVICE(0x0400, 0x0807), .driver_info = BTUSB_BROKEN_ISOC }, 275 { USB_DEVICE(0x0400, 0x080a), .driver_info = BTUSB_BROKEN_ISOC }, 276 277 /* CONWISE Technology based adapters with buggy SCO support */ 278 { USB_DEVICE(0x0e5e, 0x6622), .driver_info = BTUSB_BROKEN_ISOC }, 279 280 /* Roper Class 1 Bluetooth Dongle (Silicon Wave based) */ 281 { USB_DEVICE(0x1310, 0x0001), .driver_info = BTUSB_SWAVE }, 282 283 /* Digianswer devices */ 284 { USB_DEVICE(0x08fd, 0x0001), .driver_info = BTUSB_DIGIANSWER }, 285 { USB_DEVICE(0x08fd, 0x0002), .driver_info = BTUSB_IGNORE }, 286 287 /* CSR BlueCore Bluetooth Sniffer */ 288 { USB_DEVICE(0x0a12, 0x0002), 289 .driver_info = BTUSB_SNIFFER | BTUSB_BROKEN_ISOC }, 290 291 /* Frontline ComProbe Bluetooth Sniffer */ 292 { USB_DEVICE(0x16d3, 0x0002), 293 .driver_info = BTUSB_SNIFFER | BTUSB_BROKEN_ISOC }, 294 295 /* Marvell Bluetooth devices */ 296 { USB_DEVICE(0x1286, 0x2044), .driver_info = BTUSB_MARVELL }, 297 { USB_DEVICE(0x1286, 0x2046), .driver_info = BTUSB_MARVELL }, 298 299 /* Intel Bluetooth devices */ 300 { USB_DEVICE(0x8087, 0x07da), .driver_info = BTUSB_CSR }, 301 { USB_DEVICE(0x8087, 0x07dc), .driver_info = BTUSB_INTEL }, 302 { USB_DEVICE(0x8087, 0x0a2a), .driver_info = BTUSB_INTEL }, 303 { USB_DEVICE(0x8087, 0x0a2b), .driver_info = BTUSB_INTEL_NEW }, 304 305 /* Other Intel Bluetooth devices */ 306 { USB_VENDOR_AND_INTERFACE_INFO(0x8087, 0xe0, 0x01, 0x01), 307 .driver_info = BTUSB_IGNORE }, 308 309 /* Realtek Bluetooth devices */ 310 { USB_VENDOR_AND_INTERFACE_INFO(0x0bda, 0xe0, 0x01, 0x01), 311 .driver_info = BTUSB_REALTEK }, 312 313 /* Additional Realtek 8723AE Bluetooth devices */ 314 { USB_DEVICE(0x0930, 0x021d), .driver_info = BTUSB_REALTEK }, 315 { USB_DEVICE(0x13d3, 0x3394), .driver_info = BTUSB_REALTEK }, 316 317 /* Additional Realtek 8723BE Bluetooth devices */ 318 { USB_DEVICE(0x0489, 0xe085), .driver_info = BTUSB_REALTEK }, 319 { USB_DEVICE(0x0489, 0xe08b), .driver_info = BTUSB_REALTEK }, 320 { USB_DEVICE(0x13d3, 0x3410), .driver_info = BTUSB_REALTEK }, 321 { USB_DEVICE(0x13d3, 0x3416), .driver_info = BTUSB_REALTEK }, 322 { USB_DEVICE(0x13d3, 0x3459), .driver_info = BTUSB_REALTEK }, 323 324 /* Additional Realtek 8821AE Bluetooth devices */ 325 { USB_DEVICE(0x0b05, 0x17dc), .driver_info = BTUSB_REALTEK }, 326 { USB_DEVICE(0x13d3, 0x3414), .driver_info = BTUSB_REALTEK }, 327 { USB_DEVICE(0x13d3, 0x3458), .driver_info = BTUSB_REALTEK }, 328 { USB_DEVICE(0x13d3, 0x3461), .driver_info = BTUSB_REALTEK }, 329 { USB_DEVICE(0x13d3, 0x3462), .driver_info = BTUSB_REALTEK }, 330 331 { } /* Terminating entry */ 332}; 333 334#define BTUSB_MAX_ISOC_FRAMES 10 335 336#define BTUSB_INTR_RUNNING 0 337#define BTUSB_BULK_RUNNING 1 338#define BTUSB_ISOC_RUNNING 2 339#define BTUSB_SUSPENDING 3 340#define BTUSB_DID_ISO_RESUME 4 341#define BTUSB_BOOTLOADER 5 342#define BTUSB_DOWNLOADING 6 343#define BTUSB_FIRMWARE_LOADED 7 344#define BTUSB_FIRMWARE_FAILED 8 345#define BTUSB_BOOTING 9 346 347struct btusb_data { 348 struct hci_dev *hdev; 349 struct usb_device *udev; 350 struct usb_interface *intf; 351 struct usb_interface *isoc; 352 353 unsigned long flags; 354 355 struct work_struct work; 356 struct work_struct waker; 357 358 struct usb_anchor deferred; 359 struct usb_anchor tx_anchor; 360 int tx_in_flight; 361 spinlock_t txlock; 362 363 struct usb_anchor intr_anchor; 364 struct usb_anchor bulk_anchor; 365 struct usb_anchor isoc_anchor; 366 spinlock_t rxlock; 367 368 struct sk_buff *evt_skb; 369 struct sk_buff *acl_skb; 370 struct sk_buff *sco_skb; 371 372 struct usb_endpoint_descriptor *intr_ep; 373 struct usb_endpoint_descriptor *bulk_tx_ep; 374 struct usb_endpoint_descriptor *bulk_rx_ep; 375 struct usb_endpoint_descriptor *isoc_tx_ep; 376 struct usb_endpoint_descriptor *isoc_rx_ep; 377 378 __u8 cmdreq_type; 379 __u8 cmdreq; 380 381 unsigned int sco_num; 382 int isoc_altsetting; 383 int suspend_count; 384 385 int (*recv_event)(struct hci_dev *hdev, struct sk_buff *skb); 386 int (*recv_bulk)(struct btusb_data *data, void *buffer, int count); 387 388 int (*setup_on_usb)(struct hci_dev *hdev); 389}; 390 391static inline void btusb_free_frags(struct btusb_data *data) 392{ 393 unsigned long flags; 394 395 spin_lock_irqsave(&data->rxlock, flags); 396 397 kfree_skb(data->evt_skb); 398 data->evt_skb = NULL; 399 400 kfree_skb(data->acl_skb); 401 data->acl_skb = NULL; 402 403 kfree_skb(data->sco_skb); 404 data->sco_skb = NULL; 405 406 spin_unlock_irqrestore(&data->rxlock, flags); 407} 408 409static int btusb_recv_intr(struct btusb_data *data, void *buffer, int count) 410{ 411 struct sk_buff *skb; 412 int err = 0; 413 414 spin_lock(&data->rxlock); 415 skb = data->evt_skb; 416 417 while (count) { 418 int len; 419 420 if (!skb) { 421 skb = bt_skb_alloc(HCI_MAX_EVENT_SIZE, GFP_ATOMIC); 422 if (!skb) { 423 err = -ENOMEM; 424 break; 425 } 426 427 bt_cb(skb)->pkt_type = HCI_EVENT_PKT; 428 bt_cb(skb)->expect = HCI_EVENT_HDR_SIZE; 429 } 430 431 len = min_t(uint, bt_cb(skb)->expect, count); 432 memcpy(skb_put(skb, len), buffer, len); 433 434 count -= len; 435 buffer += len; 436 bt_cb(skb)->expect -= len; 437 438 if (skb->len == HCI_EVENT_HDR_SIZE) { 439 /* Complete event header */ 440 bt_cb(skb)->expect = hci_event_hdr(skb)->plen; 441 442 if (skb_tailroom(skb) < bt_cb(skb)->expect) { 443 kfree_skb(skb); 444 skb = NULL; 445 446 err = -EILSEQ; 447 break; 448 } 449 } 450 451 if (bt_cb(skb)->expect == 0) { 452 /* Complete frame */ 453 data->recv_event(data->hdev, skb); 454 skb = NULL; 455 } 456 } 457 458 data->evt_skb = skb; 459 spin_unlock(&data->rxlock); 460 461 return err; 462} 463 464static int btusb_recv_bulk(struct btusb_data *data, void *buffer, int count) 465{ 466 struct sk_buff *skb; 467 int err = 0; 468 469 spin_lock(&data->rxlock); 470 skb = data->acl_skb; 471 472 while (count) { 473 int len; 474 475 if (!skb) { 476 skb = bt_skb_alloc(HCI_MAX_FRAME_SIZE, GFP_ATOMIC); 477 if (!skb) { 478 err = -ENOMEM; 479 break; 480 } 481 482 bt_cb(skb)->pkt_type = HCI_ACLDATA_PKT; 483 bt_cb(skb)->expect = HCI_ACL_HDR_SIZE; 484 } 485 486 len = min_t(uint, bt_cb(skb)->expect, count); 487 memcpy(skb_put(skb, len), buffer, len); 488 489 count -= len; 490 buffer += len; 491 bt_cb(skb)->expect -= len; 492 493 if (skb->len == HCI_ACL_HDR_SIZE) { 494 __le16 dlen = hci_acl_hdr(skb)->dlen; 495 496 /* Complete ACL header */ 497 bt_cb(skb)->expect = __le16_to_cpu(dlen); 498 499 if (skb_tailroom(skb) < bt_cb(skb)->expect) { 500 kfree_skb(skb); 501 skb = NULL; 502 503 err = -EILSEQ; 504 break; 505 } 506 } 507 508 if (bt_cb(skb)->expect == 0) { 509 /* Complete frame */ 510 hci_recv_frame(data->hdev, skb); 511 skb = NULL; 512 } 513 } 514 515 data->acl_skb = skb; 516 spin_unlock(&data->rxlock); 517 518 return err; 519} 520 521static int btusb_recv_isoc(struct btusb_data *data, void *buffer, int count) 522{ 523 struct sk_buff *skb; 524 int err = 0; 525 526 spin_lock(&data->rxlock); 527 skb = data->sco_skb; 528 529 while (count) { 530 int len; 531 532 if (!skb) { 533 skb = bt_skb_alloc(HCI_MAX_SCO_SIZE, GFP_ATOMIC); 534 if (!skb) { 535 err = -ENOMEM; 536 break; 537 } 538 539 bt_cb(skb)->pkt_type = HCI_SCODATA_PKT; 540 bt_cb(skb)->expect = HCI_SCO_HDR_SIZE; 541 } 542 543 len = min_t(uint, bt_cb(skb)->expect, count); 544 memcpy(skb_put(skb, len), buffer, len); 545 546 count -= len; 547 buffer += len; 548 bt_cb(skb)->expect -= len; 549 550 if (skb->len == HCI_SCO_HDR_SIZE) { 551 /* Complete SCO header */ 552 bt_cb(skb)->expect = hci_sco_hdr(skb)->dlen; 553 554 if (skb_tailroom(skb) < bt_cb(skb)->expect) { 555 kfree_skb(skb); 556 skb = NULL; 557 558 err = -EILSEQ; 559 break; 560 } 561 } 562 563 if (bt_cb(skb)->expect == 0) { 564 /* Complete frame */ 565 hci_recv_frame(data->hdev, skb); 566 skb = NULL; 567 } 568 } 569 570 data->sco_skb = skb; 571 spin_unlock(&data->rxlock); 572 573 return err; 574} 575 576static void btusb_intr_complete(struct urb *urb) 577{ 578 struct hci_dev *hdev = urb->context; 579 struct btusb_data *data = hci_get_drvdata(hdev); 580 int err; 581 582 BT_DBG("%s urb %p status %d count %d", hdev->name, urb, urb->status, 583 urb->actual_length); 584 585 if (!test_bit(HCI_RUNNING, &hdev->flags)) 586 return; 587 588 if (urb->status == 0) { 589 hdev->stat.byte_rx += urb->actual_length; 590 591 if (btusb_recv_intr(data, urb->transfer_buffer, 592 urb->actual_length) < 0) { 593 BT_ERR("%s corrupted event packet", hdev->name); 594 hdev->stat.err_rx++; 595 } 596 } else if (urb->status == -ENOENT) { 597 /* Avoid suspend failed when usb_kill_urb */ 598 return; 599 } 600 601 if (!test_bit(BTUSB_INTR_RUNNING, &data->flags)) 602 return; 603 604 usb_mark_last_busy(data->udev); 605 usb_anchor_urb(urb, &data->intr_anchor); 606 607 err = usb_submit_urb(urb, GFP_ATOMIC); 608 if (err < 0) { 609 /* -EPERM: urb is being killed; 610 * -ENODEV: device got disconnected */ 611 if (err != -EPERM && err != -ENODEV) 612 BT_ERR("%s urb %p failed to resubmit (%d)", 613 hdev->name, urb, -err); 614 usb_unanchor_urb(urb); 615 } 616} 617 618static int btusb_submit_intr_urb(struct hci_dev *hdev, gfp_t mem_flags) 619{ 620 struct btusb_data *data = hci_get_drvdata(hdev); 621 struct urb *urb; 622 unsigned char *buf; 623 unsigned int pipe; 624 int err, size; 625 626 BT_DBG("%s", hdev->name); 627 628 if (!data->intr_ep) 629 return -ENODEV; 630 631 urb = usb_alloc_urb(0, mem_flags); 632 if (!urb) 633 return -ENOMEM; 634 635 size = le16_to_cpu(data->intr_ep->wMaxPacketSize); 636 637 buf = kmalloc(size, mem_flags); 638 if (!buf) { 639 usb_free_urb(urb); 640 return -ENOMEM; 641 } 642 643 pipe = usb_rcvintpipe(data->udev, data->intr_ep->bEndpointAddress); 644 645 usb_fill_int_urb(urb, data->udev, pipe, buf, size, 646 btusb_intr_complete, hdev, data->intr_ep->bInterval); 647 648 urb->transfer_flags |= URB_FREE_BUFFER; 649 650 usb_anchor_urb(urb, &data->intr_anchor); 651 652 err = usb_submit_urb(urb, mem_flags); 653 if (err < 0) { 654 if (err != -EPERM && err != -ENODEV) 655 BT_ERR("%s urb %p submission failed (%d)", 656 hdev->name, urb, -err); 657 usb_unanchor_urb(urb); 658 } 659 660 usb_free_urb(urb); 661 662 return err; 663} 664 665static void btusb_bulk_complete(struct urb *urb) 666{ 667 struct hci_dev *hdev = urb->context; 668 struct btusb_data *data = hci_get_drvdata(hdev); 669 int err; 670 671 BT_DBG("%s urb %p status %d count %d", hdev->name, urb, urb->status, 672 urb->actual_length); 673 674 if (!test_bit(HCI_RUNNING, &hdev->flags)) 675 return; 676 677 if (urb->status == 0) { 678 hdev->stat.byte_rx += urb->actual_length; 679 680 if (data->recv_bulk(data, urb->transfer_buffer, 681 urb->actual_length) < 0) { 682 BT_ERR("%s corrupted ACL packet", hdev->name); 683 hdev->stat.err_rx++; 684 } 685 } else if (urb->status == -ENOENT) { 686 /* Avoid suspend failed when usb_kill_urb */ 687 return; 688 } 689 690 if (!test_bit(BTUSB_BULK_RUNNING, &data->flags)) 691 return; 692 693 usb_anchor_urb(urb, &data->bulk_anchor); 694 usb_mark_last_busy(data->udev); 695 696 err = usb_submit_urb(urb, GFP_ATOMIC); 697 if (err < 0) { 698 /* -EPERM: urb is being killed; 699 * -ENODEV: device got disconnected */ 700 if (err != -EPERM && err != -ENODEV) 701 BT_ERR("%s urb %p failed to resubmit (%d)", 702 hdev->name, urb, -err); 703 usb_unanchor_urb(urb); 704 } 705} 706 707static int btusb_submit_bulk_urb(struct hci_dev *hdev, gfp_t mem_flags) 708{ 709 struct btusb_data *data = hci_get_drvdata(hdev); 710 struct urb *urb; 711 unsigned char *buf; 712 unsigned int pipe; 713 int err, size = HCI_MAX_FRAME_SIZE; 714 715 BT_DBG("%s", hdev->name); 716 717 if (!data->bulk_rx_ep) 718 return -ENODEV; 719 720 urb = usb_alloc_urb(0, mem_flags); 721 if (!urb) 722 return -ENOMEM; 723 724 buf = kmalloc(size, mem_flags); 725 if (!buf) { 726 usb_free_urb(urb); 727 return -ENOMEM; 728 } 729 730 pipe = usb_rcvbulkpipe(data->udev, data->bulk_rx_ep->bEndpointAddress); 731 732 usb_fill_bulk_urb(urb, data->udev, pipe, buf, size, 733 btusb_bulk_complete, hdev); 734 735 urb->transfer_flags |= URB_FREE_BUFFER; 736 737 usb_mark_last_busy(data->udev); 738 usb_anchor_urb(urb, &data->bulk_anchor); 739 740 err = usb_submit_urb(urb, mem_flags); 741 if (err < 0) { 742 if (err != -EPERM && err != -ENODEV) 743 BT_ERR("%s urb %p submission failed (%d)", 744 hdev->name, urb, -err); 745 usb_unanchor_urb(urb); 746 } 747 748 usb_free_urb(urb); 749 750 return err; 751} 752 753static void btusb_isoc_complete(struct urb *urb) 754{ 755 struct hci_dev *hdev = urb->context; 756 struct btusb_data *data = hci_get_drvdata(hdev); 757 int i, err; 758 759 BT_DBG("%s urb %p status %d count %d", hdev->name, urb, urb->status, 760 urb->actual_length); 761 762 if (!test_bit(HCI_RUNNING, &hdev->flags)) 763 return; 764 765 if (urb->status == 0) { 766 for (i = 0; i < urb->number_of_packets; i++) { 767 unsigned int offset = urb->iso_frame_desc[i].offset; 768 unsigned int length = urb->iso_frame_desc[i].actual_length; 769 770 if (urb->iso_frame_desc[i].status) 771 continue; 772 773 hdev->stat.byte_rx += length; 774 775 if (btusb_recv_isoc(data, urb->transfer_buffer + offset, 776 length) < 0) { 777 BT_ERR("%s corrupted SCO packet", hdev->name); 778 hdev->stat.err_rx++; 779 } 780 } 781 } else if (urb->status == -ENOENT) { 782 /* Avoid suspend failed when usb_kill_urb */ 783 return; 784 } 785 786 if (!test_bit(BTUSB_ISOC_RUNNING, &data->flags)) 787 return; 788 789 usb_anchor_urb(urb, &data->isoc_anchor); 790 791 err = usb_submit_urb(urb, GFP_ATOMIC); 792 if (err < 0) { 793 /* -EPERM: urb is being killed; 794 * -ENODEV: device got disconnected */ 795 if (err != -EPERM && err != -ENODEV) 796 BT_ERR("%s urb %p failed to resubmit (%d)", 797 hdev->name, urb, -err); 798 usb_unanchor_urb(urb); 799 } 800} 801 802static inline void __fill_isoc_descriptor(struct urb *urb, int len, int mtu) 803{ 804 int i, offset = 0; 805 806 BT_DBG("len %d mtu %d", len, mtu); 807 808 for (i = 0; i < BTUSB_MAX_ISOC_FRAMES && len >= mtu; 809 i++, offset += mtu, len -= mtu) { 810 urb->iso_frame_desc[i].offset = offset; 811 urb->iso_frame_desc[i].length = mtu; 812 } 813 814 if (len && i < BTUSB_MAX_ISOC_FRAMES) { 815 urb->iso_frame_desc[i].offset = offset; 816 urb->iso_frame_desc[i].length = len; 817 i++; 818 } 819 820 urb->number_of_packets = i; 821} 822 823static int btusb_submit_isoc_urb(struct hci_dev *hdev, gfp_t mem_flags) 824{ 825 struct btusb_data *data = hci_get_drvdata(hdev); 826 struct urb *urb; 827 unsigned char *buf; 828 unsigned int pipe; 829 int err, size; 830 831 BT_DBG("%s", hdev->name); 832 833 if (!data->isoc_rx_ep) 834 return -ENODEV; 835 836 urb = usb_alloc_urb(BTUSB_MAX_ISOC_FRAMES, mem_flags); 837 if (!urb) 838 return -ENOMEM; 839 840 size = le16_to_cpu(data->isoc_rx_ep->wMaxPacketSize) * 841 BTUSB_MAX_ISOC_FRAMES; 842 843 buf = kmalloc(size, mem_flags); 844 if (!buf) { 845 usb_free_urb(urb); 846 return -ENOMEM; 847 } 848 849 pipe = usb_rcvisocpipe(data->udev, data->isoc_rx_ep->bEndpointAddress); 850 851 usb_fill_int_urb(urb, data->udev, pipe, buf, size, btusb_isoc_complete, 852 hdev, data->isoc_rx_ep->bInterval); 853 854 urb->transfer_flags = URB_FREE_BUFFER | URB_ISO_ASAP; 855 856 __fill_isoc_descriptor(urb, size, 857 le16_to_cpu(data->isoc_rx_ep->wMaxPacketSize)); 858 859 usb_anchor_urb(urb, &data->isoc_anchor); 860 861 err = usb_submit_urb(urb, mem_flags); 862 if (err < 0) { 863 if (err != -EPERM && err != -ENODEV) 864 BT_ERR("%s urb %p submission failed (%d)", 865 hdev->name, urb, -err); 866 usb_unanchor_urb(urb); 867 } 868 869 usb_free_urb(urb); 870 871 return err; 872} 873 874static void btusb_tx_complete(struct urb *urb) 875{ 876 struct sk_buff *skb = urb->context; 877 struct hci_dev *hdev = (struct hci_dev *)skb->dev; 878 struct btusb_data *data = hci_get_drvdata(hdev); 879 880 BT_DBG("%s urb %p status %d count %d", hdev->name, urb, urb->status, 881 urb->actual_length); 882 883 if (!test_bit(HCI_RUNNING, &hdev->flags)) 884 goto done; 885 886 if (!urb->status) 887 hdev->stat.byte_tx += urb->transfer_buffer_length; 888 else 889 hdev->stat.err_tx++; 890 891done: 892 spin_lock(&data->txlock); 893 data->tx_in_flight--; 894 spin_unlock(&data->txlock); 895 896 kfree(urb->setup_packet); 897 898 kfree_skb(skb); 899} 900 901static void btusb_isoc_tx_complete(struct urb *urb) 902{ 903 struct sk_buff *skb = urb->context; 904 struct hci_dev *hdev = (struct hci_dev *)skb->dev; 905 906 BT_DBG("%s urb %p status %d count %d", hdev->name, urb, urb->status, 907 urb->actual_length); 908 909 if (!test_bit(HCI_RUNNING, &hdev->flags)) 910 goto done; 911 912 if (!urb->status) 913 hdev->stat.byte_tx += urb->transfer_buffer_length; 914 else 915 hdev->stat.err_tx++; 916 917done: 918 kfree(urb->setup_packet); 919 920 kfree_skb(skb); 921} 922 923static int btusb_open(struct hci_dev *hdev) 924{ 925 struct btusb_data *data = hci_get_drvdata(hdev); 926 int err; 927 928 BT_DBG("%s", hdev->name); 929 930 /* Patching USB firmware files prior to starting any URBs of HCI path 931 * It is more safe to use USB bulk channel for downloading USB patch 932 */ 933 if (data->setup_on_usb) { 934 err = data->setup_on_usb(hdev); 935 if (err < 0) 936 return err; 937 } 938 939 err = usb_autopm_get_interface(data->intf); 940 if (err < 0) 941 return err; 942 943 data->intf->needs_remote_wakeup = 1; 944 945 if (test_and_set_bit(HCI_RUNNING, &hdev->flags)) 946 goto done; 947 948 if (test_and_set_bit(BTUSB_INTR_RUNNING, &data->flags)) 949 goto done; 950 951 err = btusb_submit_intr_urb(hdev, GFP_KERNEL); 952 if (err < 0) 953 goto failed; 954 955 err = btusb_submit_bulk_urb(hdev, GFP_KERNEL); 956 if (err < 0) { 957 usb_kill_anchored_urbs(&data->intr_anchor); 958 goto failed; 959 } 960 961 set_bit(BTUSB_BULK_RUNNING, &data->flags); 962 btusb_submit_bulk_urb(hdev, GFP_KERNEL); 963 964done: 965 usb_autopm_put_interface(data->intf); 966 return 0; 967 968failed: 969 clear_bit(BTUSB_INTR_RUNNING, &data->flags); 970 clear_bit(HCI_RUNNING, &hdev->flags); 971 usb_autopm_put_interface(data->intf); 972 return err; 973} 974 975static void btusb_stop_traffic(struct btusb_data *data) 976{ 977 usb_kill_anchored_urbs(&data->intr_anchor); 978 usb_kill_anchored_urbs(&data->bulk_anchor); 979 usb_kill_anchored_urbs(&data->isoc_anchor); 980} 981 982static int btusb_close(struct hci_dev *hdev) 983{ 984 struct btusb_data *data = hci_get_drvdata(hdev); 985 int err; 986 987 BT_DBG("%s", hdev->name); 988 989 if (!test_and_clear_bit(HCI_RUNNING, &hdev->flags)) 990 return 0; 991 992 cancel_work_sync(&data->work); 993 cancel_work_sync(&data->waker); 994 995 clear_bit(BTUSB_ISOC_RUNNING, &data->flags); 996 clear_bit(BTUSB_BULK_RUNNING, &data->flags); 997 clear_bit(BTUSB_INTR_RUNNING, &data->flags); 998 999 btusb_stop_traffic(data); 1000 btusb_free_frags(data); 1001 1002 err = usb_autopm_get_interface(data->intf); 1003 if (err < 0) 1004 goto failed; 1005 1006 data->intf->needs_remote_wakeup = 0; 1007 usb_autopm_put_interface(data->intf); 1008 1009failed: 1010 usb_scuttle_anchored_urbs(&data->deferred); 1011 return 0; 1012} 1013 1014static int btusb_flush(struct hci_dev *hdev) 1015{ 1016 struct btusb_data *data = hci_get_drvdata(hdev); 1017 1018 BT_DBG("%s", hdev->name); 1019 1020 usb_kill_anchored_urbs(&data->tx_anchor); 1021 btusb_free_frags(data); 1022 1023 return 0; 1024} 1025 1026static struct urb *alloc_ctrl_urb(struct hci_dev *hdev, struct sk_buff *skb) 1027{ 1028 struct btusb_data *data = hci_get_drvdata(hdev); 1029 struct usb_ctrlrequest *dr; 1030 struct urb *urb; 1031 unsigned int pipe; 1032 1033 urb = usb_alloc_urb(0, GFP_KERNEL); 1034 if (!urb) 1035 return ERR_PTR(-ENOMEM); 1036 1037 dr = kmalloc(sizeof(*dr), GFP_KERNEL); 1038 if (!dr) { 1039 usb_free_urb(urb); 1040 return ERR_PTR(-ENOMEM); 1041 } 1042 1043 dr->bRequestType = data->cmdreq_type; 1044 dr->bRequest = data->cmdreq; 1045 dr->wIndex = 0; 1046 dr->wValue = 0; 1047 dr->wLength = __cpu_to_le16(skb->len); 1048 1049 pipe = usb_sndctrlpipe(data->udev, 0x00); 1050 1051 usb_fill_control_urb(urb, data->udev, pipe, (void *)dr, 1052 skb->data, skb->len, btusb_tx_complete, skb); 1053 1054 skb->dev = (void *)hdev; 1055 1056 return urb; 1057} 1058 1059static struct urb *alloc_bulk_urb(struct hci_dev *hdev, struct sk_buff *skb) 1060{ 1061 struct btusb_data *data = hci_get_drvdata(hdev); 1062 struct urb *urb; 1063 unsigned int pipe; 1064 1065 if (!data->bulk_tx_ep) 1066 return ERR_PTR(-ENODEV); 1067 1068 urb = usb_alloc_urb(0, GFP_KERNEL); 1069 if (!urb) 1070 return ERR_PTR(-ENOMEM); 1071 1072 pipe = usb_sndbulkpipe(data->udev, data->bulk_tx_ep->bEndpointAddress); 1073 1074 usb_fill_bulk_urb(urb, data->udev, pipe, 1075 skb->data, skb->len, btusb_tx_complete, skb); 1076 1077 skb->dev = (void *)hdev; 1078 1079 return urb; 1080} 1081 1082static struct urb *alloc_isoc_urb(struct hci_dev *hdev, struct sk_buff *skb) 1083{ 1084 struct btusb_data *data = hci_get_drvdata(hdev); 1085 struct urb *urb; 1086 unsigned int pipe; 1087 1088 if (!data->isoc_tx_ep) 1089 return ERR_PTR(-ENODEV); 1090 1091 urb = usb_alloc_urb(BTUSB_MAX_ISOC_FRAMES, GFP_KERNEL); 1092 if (!urb) 1093 return ERR_PTR(-ENOMEM); 1094 1095 pipe = usb_sndisocpipe(data->udev, data->isoc_tx_ep->bEndpointAddress); 1096 1097 usb_fill_int_urb(urb, data->udev, pipe, 1098 skb->data, skb->len, btusb_isoc_tx_complete, 1099 skb, data->isoc_tx_ep->bInterval); 1100 1101 urb->transfer_flags = URB_ISO_ASAP; 1102 1103 __fill_isoc_descriptor(urb, skb->len, 1104 le16_to_cpu(data->isoc_tx_ep->wMaxPacketSize)); 1105 1106 skb->dev = (void *)hdev; 1107 1108 return urb; 1109} 1110 1111static int submit_tx_urb(struct hci_dev *hdev, struct urb *urb) 1112{ 1113 struct btusb_data *data = hci_get_drvdata(hdev); 1114 int err; 1115 1116 usb_anchor_urb(urb, &data->tx_anchor); 1117 1118 err = usb_submit_urb(urb, GFP_KERNEL); 1119 if (err < 0) { 1120 if (err != -EPERM && err != -ENODEV) 1121 BT_ERR("%s urb %p submission failed (%d)", 1122 hdev->name, urb, -err); 1123 kfree(urb->setup_packet); 1124 usb_unanchor_urb(urb); 1125 } else { 1126 usb_mark_last_busy(data->udev); 1127 } 1128 1129 usb_free_urb(urb); 1130 return err; 1131} 1132 1133static int submit_or_queue_tx_urb(struct hci_dev *hdev, struct urb *urb) 1134{ 1135 struct btusb_data *data = hci_get_drvdata(hdev); 1136 unsigned long flags; 1137 bool suspending; 1138 1139 spin_lock_irqsave(&data->txlock, flags); 1140 suspending = test_bit(BTUSB_SUSPENDING, &data->flags); 1141 if (!suspending) 1142 data->tx_in_flight++; 1143 spin_unlock_irqrestore(&data->txlock, flags); 1144 1145 if (!suspending) 1146 return submit_tx_urb(hdev, urb); 1147 1148 usb_anchor_urb(urb, &data->deferred); 1149 schedule_work(&data->waker); 1150 1151 usb_free_urb(urb); 1152 return 0; 1153} 1154 1155static int btusb_send_frame(struct hci_dev *hdev, struct sk_buff *skb) 1156{ 1157 struct urb *urb; 1158 1159 BT_DBG("%s", hdev->name); 1160 1161 if (!test_bit(HCI_RUNNING, &hdev->flags)) 1162 return -EBUSY; 1163 1164 switch (bt_cb(skb)->pkt_type) { 1165 case HCI_COMMAND_PKT: 1166 urb = alloc_ctrl_urb(hdev, skb); 1167 if (IS_ERR(urb)) 1168 return PTR_ERR(urb); 1169 1170 hdev->stat.cmd_tx++; 1171 return submit_or_queue_tx_urb(hdev, urb); 1172 1173 case HCI_ACLDATA_PKT: 1174 urb = alloc_bulk_urb(hdev, skb); 1175 if (IS_ERR(urb)) 1176 return PTR_ERR(urb); 1177 1178 hdev->stat.acl_tx++; 1179 return submit_or_queue_tx_urb(hdev, urb); 1180 1181 case HCI_SCODATA_PKT: 1182 if (hci_conn_num(hdev, SCO_LINK) < 1) 1183 return -ENODEV; 1184 1185 urb = alloc_isoc_urb(hdev, skb); 1186 if (IS_ERR(urb)) 1187 return PTR_ERR(urb); 1188 1189 hdev->stat.sco_tx++; 1190 return submit_tx_urb(hdev, urb); 1191 } 1192 1193 return -EILSEQ; 1194} 1195 1196static void btusb_notify(struct hci_dev *hdev, unsigned int evt) 1197{ 1198 struct btusb_data *data = hci_get_drvdata(hdev); 1199 1200 BT_DBG("%s evt %d", hdev->name, evt); 1201 1202 if (hci_conn_num(hdev, SCO_LINK) != data->sco_num) { 1203 data->sco_num = hci_conn_num(hdev, SCO_LINK); 1204 schedule_work(&data->work); 1205 } 1206} 1207 1208static inline int __set_isoc_interface(struct hci_dev *hdev, int altsetting) 1209{ 1210 struct btusb_data *data = hci_get_drvdata(hdev); 1211 struct usb_interface *intf = data->isoc; 1212 struct usb_endpoint_descriptor *ep_desc; 1213 int i, err; 1214 1215 if (!data->isoc) 1216 return -ENODEV; 1217 1218 err = usb_set_interface(data->udev, 1, altsetting); 1219 if (err < 0) { 1220 BT_ERR("%s setting interface failed (%d)", hdev->name, -err); 1221 return err; 1222 } 1223 1224 data->isoc_altsetting = altsetting; 1225 1226 data->isoc_tx_ep = NULL; 1227 data->isoc_rx_ep = NULL; 1228 1229 for (i = 0; i < intf->cur_altsetting->desc.bNumEndpoints; i++) { 1230 ep_desc = &intf->cur_altsetting->endpoint[i].desc; 1231 1232 if (!data->isoc_tx_ep && usb_endpoint_is_isoc_out(ep_desc)) { 1233 data->isoc_tx_ep = ep_desc; 1234 continue; 1235 } 1236 1237 if (!data->isoc_rx_ep && usb_endpoint_is_isoc_in(ep_desc)) { 1238 data->isoc_rx_ep = ep_desc; 1239 continue; 1240 } 1241 } 1242 1243 if (!data->isoc_tx_ep || !data->isoc_rx_ep) { 1244 BT_ERR("%s invalid SCO descriptors", hdev->name); 1245 return -ENODEV; 1246 } 1247 1248 return 0; 1249} 1250 1251static void btusb_work(struct work_struct *work) 1252{ 1253 struct btusb_data *data = container_of(work, struct btusb_data, work); 1254 struct hci_dev *hdev = data->hdev; 1255 int new_alts; 1256 int err; 1257 1258 if (data->sco_num > 0) { 1259 if (!test_bit(BTUSB_DID_ISO_RESUME, &data->flags)) { 1260 err = usb_autopm_get_interface(data->isoc ? data->isoc : data->intf); 1261 if (err < 0) { 1262 clear_bit(BTUSB_ISOC_RUNNING, &data->flags); 1263 usb_kill_anchored_urbs(&data->isoc_anchor); 1264 return; 1265 } 1266 1267 set_bit(BTUSB_DID_ISO_RESUME, &data->flags); 1268 } 1269 1270 if (hdev->voice_setting & 0x0020) { 1271 static const int alts[3] = { 2, 4, 5 }; 1272 1273 new_alts = alts[data->sco_num - 1]; 1274 } else { 1275 new_alts = data->sco_num; 1276 } 1277 1278 if (data->isoc_altsetting != new_alts) { 1279 clear_bit(BTUSB_ISOC_RUNNING, &data->flags); 1280 usb_kill_anchored_urbs(&data->isoc_anchor); 1281 1282 if (__set_isoc_interface(hdev, new_alts) < 0) 1283 return; 1284 } 1285 1286 if (!test_and_set_bit(BTUSB_ISOC_RUNNING, &data->flags)) { 1287 if (btusb_submit_isoc_urb(hdev, GFP_KERNEL) < 0) 1288 clear_bit(BTUSB_ISOC_RUNNING, &data->flags); 1289 else 1290 btusb_submit_isoc_urb(hdev, GFP_KERNEL); 1291 } 1292 } else { 1293 clear_bit(BTUSB_ISOC_RUNNING, &data->flags); 1294 usb_kill_anchored_urbs(&data->isoc_anchor); 1295 1296 __set_isoc_interface(hdev, 0); 1297 if (test_and_clear_bit(BTUSB_DID_ISO_RESUME, &data->flags)) 1298 usb_autopm_put_interface(data->isoc ? data->isoc : data->intf); 1299 } 1300} 1301 1302static void btusb_waker(struct work_struct *work) 1303{ 1304 struct btusb_data *data = container_of(work, struct btusb_data, waker); 1305 int err; 1306 1307 err = usb_autopm_get_interface(data->intf); 1308 if (err < 0) 1309 return; 1310 1311 usb_autopm_put_interface(data->intf); 1312} 1313 1314static struct sk_buff *btusb_read_local_version(struct hci_dev *hdev) 1315{ 1316 struct sk_buff *skb; 1317 1318 skb = __hci_cmd_sync(hdev, HCI_OP_READ_LOCAL_VERSION, 0, NULL, 1319 HCI_INIT_TIMEOUT); 1320 if (IS_ERR(skb)) { 1321 BT_ERR("%s: HCI_OP_READ_LOCAL_VERSION failed (%ld)", 1322 hdev->name, PTR_ERR(skb)); 1323 return skb; 1324 } 1325 1326 if (skb->len != sizeof(struct hci_rp_read_local_version)) { 1327 BT_ERR("%s: HCI_OP_READ_LOCAL_VERSION event length mismatch", 1328 hdev->name); 1329 kfree_skb(skb); 1330 return ERR_PTR(-EIO); 1331 } 1332 1333 return skb; 1334} 1335 1336static int btusb_setup_bcm92035(struct hci_dev *hdev) 1337{ 1338 struct sk_buff *skb; 1339 u8 val = 0x00; 1340 1341 BT_DBG("%s", hdev->name); 1342 1343 skb = __hci_cmd_sync(hdev, 0xfc3b, 1, &val, HCI_INIT_TIMEOUT); 1344 if (IS_ERR(skb)) 1345 BT_ERR("BCM92035 command failed (%ld)", -PTR_ERR(skb)); 1346 else 1347 kfree_skb(skb); 1348 1349 return 0; 1350} 1351 1352static int btusb_setup_csr(struct hci_dev *hdev) 1353{ 1354 struct hci_rp_read_local_version *rp; 1355 struct sk_buff *skb; 1356 int ret; 1357 1358 BT_DBG("%s", hdev->name); 1359 1360 skb = btusb_read_local_version(hdev); 1361 if (IS_ERR(skb)) 1362 return -PTR_ERR(skb); 1363 1364 rp = (struct hci_rp_read_local_version *)skb->data; 1365 1366 if (!rp->status) { 1367 if (le16_to_cpu(rp->manufacturer) != 10) { 1368 /* Clear the reset quirk since this is not an actual 1369 * early Bluetooth 1.1 device from CSR. 1370 */ 1371 clear_bit(HCI_QUIRK_RESET_ON_CLOSE, &hdev->quirks); 1372 1373 /* These fake CSR controllers have all a broken 1374 * stored link key handling and so just disable it. 1375 */ 1376 set_bit(HCI_QUIRK_BROKEN_STORED_LINK_KEY, 1377 &hdev->quirks); 1378 } 1379 } 1380 1381 ret = -bt_to_errno(rp->status); 1382 1383 kfree_skb(skb); 1384 1385 return ret; 1386} 1387 1388#define RTL_FRAG_LEN 252 1389 1390struct rtl_download_cmd { 1391 __u8 index; 1392 __u8 data[RTL_FRAG_LEN]; 1393} __packed; 1394 1395struct rtl_download_response { 1396 __u8 status; 1397 __u8 index; 1398} __packed; 1399 1400struct rtl_rom_version_evt { 1401 __u8 status; 1402 __u8 version; 1403} __packed; 1404 1405struct rtl_epatch_header { 1406 __u8 signature[8]; 1407 __le32 fw_version; 1408 __le16 num_patches; 1409} __packed; 1410 1411#define RTL_EPATCH_SIGNATURE "Realtech" 1412#define RTL_ROM_LMP_3499 0x3499 1413#define RTL_ROM_LMP_8723A 0x1200 1414#define RTL_ROM_LMP_8723B 0x8723 1415#define RTL_ROM_LMP_8821A 0x8821 1416#define RTL_ROM_LMP_8761A 0x8761 1417 1418static int rtl_read_rom_version(struct hci_dev *hdev, u8 *version) 1419{ 1420 struct rtl_rom_version_evt *rom_version; 1421 struct sk_buff *skb; 1422 int ret; 1423 1424 /* Read RTL ROM version command */ 1425 skb = __hci_cmd_sync(hdev, 0xfc6d, 0, NULL, HCI_INIT_TIMEOUT); 1426 if (IS_ERR(skb)) { 1427 BT_ERR("%s: Read ROM version failed (%ld)", 1428 hdev->name, PTR_ERR(skb)); 1429 return PTR_ERR(skb); 1430 } 1431 1432 if (skb->len != sizeof(*rom_version)) { 1433 BT_ERR("%s: RTL version event length mismatch", hdev->name); 1434 kfree_skb(skb); 1435 return -EIO; 1436 } 1437 1438 rom_version = (struct rtl_rom_version_evt *)skb->data; 1439 BT_INFO("%s: rom_version status=%x version=%x", 1440 hdev->name, rom_version->status, rom_version->version); 1441 1442 ret = rom_version->status; 1443 if (ret == 0) 1444 *version = rom_version->version; 1445 1446 kfree_skb(skb); 1447 return ret; 1448} 1449 1450static int rtl8723b_parse_firmware(struct hci_dev *hdev, u16 lmp_subver, 1451 const struct firmware *fw, 1452 unsigned char **_buf) 1453{ 1454 const u8 extension_sig[] = { 0x51, 0x04, 0xfd, 0x77 }; 1455 struct rtl_epatch_header *epatch_info; 1456 unsigned char *buf; 1457 int i, ret, len; 1458 size_t min_size; 1459 u8 opcode, length, data, rom_version = 0; 1460 int project_id = -1; 1461 const unsigned char *fwptr, *chip_id_base; 1462 const unsigned char *patch_length_base, *patch_offset_base; 1463 u32 patch_offset = 0; 1464 u16 patch_length, num_patches; 1465 const u16 project_id_to_lmp_subver[] = { 1466 RTL_ROM_LMP_8723A, 1467 RTL_ROM_LMP_8723B, 1468 RTL_ROM_LMP_8821A, 1469 RTL_ROM_LMP_8761A 1470 }; 1471 1472 ret = rtl_read_rom_version(hdev, &rom_version); 1473 if (ret) 1474 return -bt_to_errno(ret); 1475 1476 min_size = sizeof(struct rtl_epatch_header) + sizeof(extension_sig) + 3; 1477 if (fw->size < min_size) 1478 return -EINVAL; 1479 1480 fwptr = fw->data + fw->size - sizeof(extension_sig); 1481 if (memcmp(fwptr, extension_sig, sizeof(extension_sig)) != 0) { 1482 BT_ERR("%s: extension section signature mismatch", hdev->name); 1483 return -EINVAL; 1484 } 1485 1486 /* Loop from the end of the firmware parsing instructions, until 1487 * we find an instruction that identifies the "project ID" for the 1488 * hardware supported by this firwmare file. 1489 * Once we have that, we double-check that that project_id is suitable 1490 * for the hardware we are working with. 1491 */ 1492 while (fwptr >= fw->data + (sizeof(struct rtl_epatch_header) + 3)) { 1493 opcode = *--fwptr; 1494 length = *--fwptr; 1495 data = *--fwptr; 1496 1497 BT_DBG("check op=%x len=%x data=%x", opcode, length, data); 1498 1499 if (opcode == 0xff) /* EOF */ 1500 break; 1501 1502 if (length == 0) { 1503 BT_ERR("%s: found instruction with length 0", 1504 hdev->name); 1505 return -EINVAL; 1506 } 1507 1508 if (opcode == 0 && length == 1) { 1509 project_id = data; 1510 break; 1511 } 1512 1513 fwptr -= length; 1514 } 1515 1516 if (project_id < 0) { 1517 BT_ERR("%s: failed to find version instruction", hdev->name); 1518 return -EINVAL; 1519 } 1520 1521 if (project_id >= ARRAY_SIZE(project_id_to_lmp_subver)) { 1522 BT_ERR("%s: unknown project id %d", hdev->name, project_id); 1523 return -EINVAL; 1524 } 1525 1526 if (lmp_subver != project_id_to_lmp_subver[project_id]) { 1527 BT_ERR("%s: firmware is for %x but this is a %x", hdev->name, 1528 project_id_to_lmp_subver[project_id], lmp_subver); 1529 return -EINVAL; 1530 } 1531 1532 epatch_info = (struct rtl_epatch_header *)fw->data; 1533 if (memcmp(epatch_info->signature, RTL_EPATCH_SIGNATURE, 8) != 0) { 1534 BT_ERR("%s: bad EPATCH signature", hdev->name); 1535 return -EINVAL; 1536 } 1537 1538 num_patches = le16_to_cpu(epatch_info->num_patches); 1539 BT_DBG("fw_version=%x, num_patches=%d", 1540 le32_to_cpu(epatch_info->fw_version), num_patches); 1541 1542 /* After the rtl_epatch_header there is a funky patch metadata section. 1543 * Assuming 2 patches, the layout is: 1544 * ChipID1 ChipID2 PatchLength1 PatchLength2 PatchOffset1 PatchOffset2 1545 * 1546 * Find the right patch for this chip. 1547 */ 1548 min_size += 8 * num_patches; 1549 if (fw->size < min_size) 1550 return -EINVAL; 1551 1552 chip_id_base = fw->data + sizeof(struct rtl_epatch_header); 1553 patch_length_base = chip_id_base + (sizeof(u16) * num_patches); 1554 patch_offset_base = patch_length_base + (sizeof(u16) * num_patches); 1555 for (i = 0; i < num_patches; i++) { 1556 u16 chip_id = get_unaligned_le16(chip_id_base + 1557 (i * sizeof(u16))); 1558 if (chip_id == rom_version + 1) { 1559 patch_length = get_unaligned_le16(patch_length_base + 1560 (i * sizeof(u16))); 1561 patch_offset = get_unaligned_le32(patch_offset_base + 1562 (i * sizeof(u32))); 1563 break; 1564 } 1565 } 1566 1567 if (!patch_offset) { 1568 BT_ERR("%s: didn't find patch for chip id %d", 1569 hdev->name, rom_version); 1570 return -EINVAL; 1571 } 1572 1573 BT_DBG("length=%x offset=%x index %d", patch_length, patch_offset, i); 1574 min_size = patch_offset + patch_length; 1575 if (fw->size < min_size) 1576 return -EINVAL; 1577 1578 /* Copy the firmware into a new buffer and write the version at 1579 * the end. 1580 */ 1581 len = patch_length; 1582 buf = kmemdup(fw->data + patch_offset, patch_length, GFP_KERNEL); 1583 if (!buf) 1584 return -ENOMEM; 1585 1586 memcpy(buf + patch_length - 4, &epatch_info->fw_version, 4); 1587 1588 *_buf = buf; 1589 return len; 1590} 1591 1592static int rtl_download_firmware(struct hci_dev *hdev, 1593 const unsigned char *data, int fw_len) 1594{ 1595 struct rtl_download_cmd *dl_cmd; 1596 int frag_num = fw_len / RTL_FRAG_LEN + 1; 1597 int frag_len = RTL_FRAG_LEN; 1598 int ret = 0; 1599 int i; 1600 1601 dl_cmd = kmalloc(sizeof(struct rtl_download_cmd), GFP_KERNEL); 1602 if (!dl_cmd) 1603 return -ENOMEM; 1604 1605 for (i = 0; i < frag_num; i++) { 1606 struct rtl_download_response *dl_resp; 1607 struct sk_buff *skb; 1608 1609 BT_DBG("download fw (%d/%d)", i, frag_num); 1610 1611 dl_cmd->index = i; 1612 if (i == (frag_num - 1)) { 1613 dl_cmd->index |= 0x80; /* data end */ 1614 frag_len = fw_len % RTL_FRAG_LEN; 1615 } 1616 memcpy(dl_cmd->data, data, frag_len); 1617 1618 /* Send download command */ 1619 skb = __hci_cmd_sync(hdev, 0xfc20, frag_len + 1, dl_cmd, 1620 HCI_INIT_TIMEOUT); 1621 if (IS_ERR(skb)) { 1622 BT_ERR("%s: download fw command failed (%ld)", 1623 hdev->name, PTR_ERR(skb)); 1624 ret = -PTR_ERR(skb); 1625 goto out; 1626 } 1627 1628 if (skb->len != sizeof(*dl_resp)) { 1629 BT_ERR("%s: download fw event length mismatch", 1630 hdev->name); 1631 kfree_skb(skb); 1632 ret = -EIO; 1633 goto out; 1634 } 1635 1636 dl_resp = (struct rtl_download_response *)skb->data; 1637 if (dl_resp->status != 0) { 1638 kfree_skb(skb); 1639 ret = bt_to_errno(dl_resp->status); 1640 goto out; 1641 } 1642 1643 kfree_skb(skb); 1644 data += RTL_FRAG_LEN; 1645 } 1646 1647out: 1648 kfree(dl_cmd); 1649 return ret; 1650} 1651 1652static int btusb_setup_rtl8723a(struct hci_dev *hdev) 1653{ 1654 struct btusb_data *data = dev_get_drvdata(&hdev->dev); 1655 struct usb_device *udev = interface_to_usbdev(data->intf); 1656 const struct firmware *fw; 1657 int ret; 1658 1659 BT_INFO("%s: rtl: loading rtl_bt/rtl8723a_fw.bin", hdev->name); 1660 ret = request_firmware(&fw, "rtl_bt/rtl8723a_fw.bin", &udev->dev); 1661 if (ret < 0) { 1662 BT_ERR("%s: Failed to load rtl_bt/rtl8723a_fw.bin", hdev->name); 1663 return ret; 1664 } 1665 1666 if (fw->size < 8) { 1667 ret = -EINVAL; 1668 goto out; 1669 } 1670 1671 /* Check that the firmware doesn't have the epatch signature 1672 * (which is only for RTL8723B and newer). 1673 */ 1674 if (!memcmp(fw->data, RTL_EPATCH_SIGNATURE, 8)) { 1675 BT_ERR("%s: unexpected EPATCH signature!", hdev->name); 1676 ret = -EINVAL; 1677 goto out; 1678 } 1679 1680 ret = rtl_download_firmware(hdev, fw->data, fw->size); 1681 1682out: 1683 release_firmware(fw); 1684 return ret; 1685} 1686 1687static int btusb_setup_rtl8723b(struct hci_dev *hdev, u16 lmp_subver, 1688 const char *fw_name) 1689{ 1690 struct btusb_data *data = dev_get_drvdata(&hdev->dev); 1691 struct usb_device *udev = interface_to_usbdev(data->intf); 1692 unsigned char *fw_data = NULL; 1693 const struct firmware *fw; 1694 int ret; 1695 1696 BT_INFO("%s: rtl: loading %s", hdev->name, fw_name); 1697 ret = request_firmware(&fw, fw_name, &udev->dev); 1698 if (ret < 0) { 1699 BT_ERR("%s: Failed to load %s", hdev->name, fw_name); 1700 return ret; 1701 } 1702 1703 ret = rtl8723b_parse_firmware(hdev, lmp_subver, fw, &fw_data); 1704 if (ret < 0) 1705 goto out; 1706 1707 ret = rtl_download_firmware(hdev, fw_data, ret); 1708 kfree(fw_data); 1709 if (ret < 0) 1710 goto out; 1711 1712out: 1713 release_firmware(fw); 1714 return ret; 1715} 1716 1717static int btusb_setup_realtek(struct hci_dev *hdev) 1718{ 1719 struct sk_buff *skb; 1720 struct hci_rp_read_local_version *resp; 1721 u16 lmp_subver; 1722 1723 skb = btusb_read_local_version(hdev); 1724 if (IS_ERR(skb)) 1725 return -PTR_ERR(skb); 1726 1727 resp = (struct hci_rp_read_local_version *)skb->data; 1728 BT_INFO("%s: rtl: examining hci_ver=%02x hci_rev=%04x lmp_ver=%02x " 1729 "lmp_subver=%04x", hdev->name, resp->hci_ver, resp->hci_rev, 1730 resp->lmp_ver, resp->lmp_subver); 1731 1732 lmp_subver = le16_to_cpu(resp->lmp_subver); 1733 kfree_skb(skb); 1734 1735 /* Match a set of subver values that correspond to stock firmware, 1736 * which is not compatible with standard btusb. 1737 * If matched, upload an alternative firmware that does conform to 1738 * standard btusb. Once that firmware is uploaded, the subver changes 1739 * to a different value. 1740 */ 1741 switch (lmp_subver) { 1742 case RTL_ROM_LMP_8723A: 1743 case RTL_ROM_LMP_3499: 1744 return btusb_setup_rtl8723a(hdev); 1745 case RTL_ROM_LMP_8723B: 1746 return btusb_setup_rtl8723b(hdev, lmp_subver, 1747 "rtl_bt/rtl8723b_fw.bin"); 1748 case RTL_ROM_LMP_8821A: 1749 return btusb_setup_rtl8723b(hdev, lmp_subver, 1750 "rtl_bt/rtl8821a_fw.bin"); 1751 case RTL_ROM_LMP_8761A: 1752 return btusb_setup_rtl8723b(hdev, lmp_subver, 1753 "rtl_bt/rtl8761a_fw.bin"); 1754 default: 1755 BT_INFO("rtl: assuming no firmware upload needed."); 1756 return 0; 1757 } 1758} 1759 1760static const struct firmware *btusb_setup_intel_get_fw(struct hci_dev *hdev, 1761 struct intel_version *ver) 1762{ 1763 const struct firmware *fw; 1764 char fwname[64]; 1765 int ret; 1766 1767 snprintf(fwname, sizeof(fwname), 1768 "intel/ibt-hw-%x.%x.%x-fw-%x.%x.%x.%x.%x.bseq", 1769 ver->hw_platform, ver->hw_variant, ver->hw_revision, 1770 ver->fw_variant, ver->fw_revision, ver->fw_build_num, 1771 ver->fw_build_ww, ver->fw_build_yy); 1772 1773 ret = request_firmware(&fw, fwname, &hdev->dev); 1774 if (ret < 0) { 1775 if (ret == -EINVAL) { 1776 BT_ERR("%s Intel firmware file request failed (%d)", 1777 hdev->name, ret); 1778 return NULL; 1779 } 1780 1781 BT_ERR("%s failed to open Intel firmware file: %s(%d)", 1782 hdev->name, fwname, ret); 1783 1784 /* If the correct firmware patch file is not found, use the 1785 * default firmware patch file instead 1786 */ 1787 snprintf(fwname, sizeof(fwname), "intel/ibt-hw-%x.%x.bseq", 1788 ver->hw_platform, ver->hw_variant); 1789 if (request_firmware(&fw, fwname, &hdev->dev) < 0) { 1790 BT_ERR("%s failed to open default Intel fw file: %s", 1791 hdev->name, fwname); 1792 return NULL; 1793 } 1794 } 1795 1796 BT_INFO("%s: Intel Bluetooth firmware file: %s", hdev->name, fwname); 1797 1798 return fw; 1799} 1800 1801static int btusb_setup_intel_patching(struct hci_dev *hdev, 1802 const struct firmware *fw, 1803 const u8 **fw_ptr, int *disable_patch) 1804{ 1805 struct sk_buff *skb; 1806 struct hci_command_hdr *cmd; 1807 const u8 *cmd_param; 1808 struct hci_event_hdr *evt = NULL; 1809 const u8 *evt_param = NULL; 1810 int remain = fw->size - (*fw_ptr - fw->data); 1811 1812 /* The first byte indicates the types of the patch command or event. 1813 * 0x01 means HCI command and 0x02 is HCI event. If the first bytes 1814 * in the current firmware buffer doesn't start with 0x01 or 1815 * the size of remain buffer is smaller than HCI command header, 1816 * the firmware file is corrupted and it should stop the patching 1817 * process. 1818 */ 1819 if (remain > HCI_COMMAND_HDR_SIZE && *fw_ptr[0] != 0x01) { 1820 BT_ERR("%s Intel fw corrupted: invalid cmd read", hdev->name); 1821 return -EINVAL; 1822 } 1823 (*fw_ptr)++; 1824 remain--; 1825 1826 cmd = (struct hci_command_hdr *)(*fw_ptr); 1827 *fw_ptr += sizeof(*cmd); 1828 remain -= sizeof(*cmd); 1829 1830 /* Ensure that the remain firmware data is long enough than the length 1831 * of command parameter. If not, the firmware file is corrupted. 1832 */ 1833 if (remain < cmd->plen) { 1834 BT_ERR("%s Intel fw corrupted: invalid cmd len", hdev->name); 1835 return -EFAULT; 1836 } 1837 1838 /* If there is a command that loads a patch in the firmware 1839 * file, then enable the patch upon success, otherwise just 1840 * disable the manufacturer mode, for example patch activation 1841 * is not required when the default firmware patch file is used 1842 * because there are no patch data to load. 1843 */ 1844 if (*disable_patch && le16_to_cpu(cmd->opcode) == 0xfc8e) 1845 *disable_patch = 0; 1846 1847 cmd_param = *fw_ptr; 1848 *fw_ptr += cmd->plen; 1849 remain -= cmd->plen; 1850 1851 /* This reads the expected events when the above command is sent to the 1852 * device. Some vendor commands expects more than one events, for 1853 * example command status event followed by vendor specific event. 1854 * For this case, it only keeps the last expected event. so the command 1855 * can be sent with __hci_cmd_sync_ev() which returns the sk_buff of 1856 * last expected event. 1857 */ 1858 while (remain > HCI_EVENT_HDR_SIZE && *fw_ptr[0] == 0x02) { 1859 (*fw_ptr)++; 1860 remain--; 1861 1862 evt = (struct hci_event_hdr *)(*fw_ptr); 1863 *fw_ptr += sizeof(*evt); 1864 remain -= sizeof(*evt); 1865 1866 if (remain < evt->plen) { 1867 BT_ERR("%s Intel fw corrupted: invalid evt len", 1868 hdev->name); 1869 return -EFAULT; 1870 } 1871 1872 evt_param = *fw_ptr; 1873 *fw_ptr += evt->plen; 1874 remain -= evt->plen; 1875 } 1876 1877 /* Every HCI commands in the firmware file has its correspond event. 1878 * If event is not found or remain is smaller than zero, the firmware 1879 * file is corrupted. 1880 */ 1881 if (!evt || !evt_param || remain < 0) { 1882 BT_ERR("%s Intel fw corrupted: invalid evt read", hdev->name); 1883 return -EFAULT; 1884 } 1885 1886 skb = __hci_cmd_sync_ev(hdev, le16_to_cpu(cmd->opcode), cmd->plen, 1887 cmd_param, evt->evt, HCI_INIT_TIMEOUT); 1888 if (IS_ERR(skb)) { 1889 BT_ERR("%s sending Intel patch command (0x%4.4x) failed (%ld)", 1890 hdev->name, cmd->opcode, PTR_ERR(skb)); 1891 return PTR_ERR(skb); 1892 } 1893 1894 /* It ensures that the returned event matches the event data read from 1895 * the firmware file. At fist, it checks the length and then 1896 * the contents of the event. 1897 */ 1898 if (skb->len != evt->plen) { 1899 BT_ERR("%s mismatch event length (opcode 0x%4.4x)", hdev->name, 1900 le16_to_cpu(cmd->opcode)); 1901 kfree_skb(skb); 1902 return -EFAULT; 1903 } 1904 1905 if (memcmp(skb->data, evt_param, evt->plen)) { 1906 BT_ERR("%s mismatch event parameter (opcode 0x%4.4x)", 1907 hdev->name, le16_to_cpu(cmd->opcode)); 1908 kfree_skb(skb); 1909 return -EFAULT; 1910 } 1911 kfree_skb(skb); 1912 1913 return 0; 1914} 1915 1916static int btusb_setup_intel(struct hci_dev *hdev) 1917{ 1918 struct sk_buff *skb; 1919 const struct firmware *fw; 1920 const u8 *fw_ptr; 1921 int disable_patch; 1922 struct intel_version *ver; 1923 1924 const u8 mfg_enable[] = { 0x01, 0x00 }; 1925 const u8 mfg_disable[] = { 0x00, 0x00 }; 1926 const u8 mfg_reset_deactivate[] = { 0x00, 0x01 }; 1927 const u8 mfg_reset_activate[] = { 0x00, 0x02 }; 1928 1929 BT_DBG("%s", hdev->name); 1930 1931 /* The controller has a bug with the first HCI command sent to it 1932 * returning number of completed commands as zero. This would stall the 1933 * command processing in the Bluetooth core. 1934 * 1935 * As a workaround, send HCI Reset command first which will reset the 1936 * number of completed commands and allow normal command processing 1937 * from now on. 1938 */ 1939 skb = __hci_cmd_sync(hdev, HCI_OP_RESET, 0, NULL, HCI_INIT_TIMEOUT); 1940 if (IS_ERR(skb)) { 1941 BT_ERR("%s sending initial HCI reset command failed (%ld)", 1942 hdev->name, PTR_ERR(skb)); 1943 return PTR_ERR(skb); 1944 } 1945 kfree_skb(skb); 1946 1947 /* Read Intel specific controller version first to allow selection of 1948 * which firmware file to load. 1949 * 1950 * The returned information are hardware variant and revision plus 1951 * firmware variant, revision and build number. 1952 */ 1953 skb = __hci_cmd_sync(hdev, 0xfc05, 0, NULL, HCI_INIT_TIMEOUT); 1954 if (IS_ERR(skb)) { 1955 BT_ERR("%s reading Intel fw version command failed (%ld)", 1956 hdev->name, PTR_ERR(skb)); 1957 return PTR_ERR(skb); 1958 } 1959 1960 if (skb->len != sizeof(*ver)) { 1961 BT_ERR("%s Intel version event length mismatch", hdev->name); 1962 kfree_skb(skb); 1963 return -EIO; 1964 } 1965 1966 ver = (struct intel_version *)skb->data; 1967 if (ver->status) { 1968 BT_ERR("%s Intel fw version event failed (%02x)", hdev->name, 1969 ver->status); 1970 kfree_skb(skb); 1971 return -bt_to_errno(ver->status); 1972 } 1973 1974 BT_INFO("%s: read Intel version: %02x%02x%02x%02x%02x%02x%02x%02x%02x", 1975 hdev->name, ver->hw_platform, ver->hw_variant, 1976 ver->hw_revision, ver->fw_variant, ver->fw_revision, 1977 ver->fw_build_num, ver->fw_build_ww, ver->fw_build_yy, 1978 ver->fw_patch_num); 1979 1980 /* fw_patch_num indicates the version of patch the device currently 1981 * have. If there is no patch data in the device, it is always 0x00. 1982 * So, if it is other than 0x00, no need to patch the deivce again. 1983 */ 1984 if (ver->fw_patch_num) { 1985 BT_INFO("%s: Intel device is already patched. patch num: %02x", 1986 hdev->name, ver->fw_patch_num); 1987 kfree_skb(skb); 1988 btintel_check_bdaddr(hdev); 1989 return 0; 1990 } 1991 1992 /* Opens the firmware patch file based on the firmware version read 1993 * from the controller. If it fails to open the matching firmware 1994 * patch file, it tries to open the default firmware patch file. 1995 * If no patch file is found, allow the device to operate without 1996 * a patch. 1997 */ 1998 fw = btusb_setup_intel_get_fw(hdev, ver); 1999 if (!fw) { 2000 kfree_skb(skb); 2001 btintel_check_bdaddr(hdev); 2002 return 0; 2003 } 2004 fw_ptr = fw->data; 2005 2006 kfree_skb(skb); 2007 2008 /* This Intel specific command enables the manufacturer mode of the 2009 * controller. 2010 * 2011 * Only while this mode is enabled, the driver can download the 2012 * firmware patch data and configuration parameters. 2013 */ 2014 skb = __hci_cmd_sync(hdev, 0xfc11, 2, mfg_enable, HCI_INIT_TIMEOUT); 2015 if (IS_ERR(skb)) { 2016 BT_ERR("%s entering Intel manufacturer mode failed (%ld)", 2017 hdev->name, PTR_ERR(skb)); 2018 release_firmware(fw); 2019 return PTR_ERR(skb); 2020 } 2021 2022 if (skb->data[0]) { 2023 u8 evt_status = skb->data[0]; 2024 2025 BT_ERR("%s enable Intel manufacturer mode event failed (%02x)", 2026 hdev->name, evt_status); 2027 kfree_skb(skb); 2028 release_firmware(fw); 2029 return -bt_to_errno(evt_status); 2030 } 2031 kfree_skb(skb); 2032 2033 disable_patch = 1; 2034 2035 /* The firmware data file consists of list of Intel specific HCI 2036 * commands and its expected events. The first byte indicates the 2037 * type of the message, either HCI command or HCI event. 2038 * 2039 * It reads the command and its expected event from the firmware file, 2040 * and send to the controller. Once __hci_cmd_sync_ev() returns, 2041 * the returned event is compared with the event read from the firmware 2042 * file and it will continue until all the messages are downloaded to 2043 * the controller. 2044 * 2045 * Once the firmware patching is completed successfully, 2046 * the manufacturer mode is disabled with reset and activating the 2047 * downloaded patch. 2048 * 2049 * If the firmware patching fails, the manufacturer mode is 2050 * disabled with reset and deactivating the patch. 2051 * 2052 * If the default patch file is used, no reset is done when disabling 2053 * the manufacturer. 2054 */ 2055 while (fw->size > fw_ptr - fw->data) { 2056 int ret; 2057 2058 ret = btusb_setup_intel_patching(hdev, fw, &fw_ptr, 2059 &disable_patch); 2060 if (ret < 0) 2061 goto exit_mfg_deactivate; 2062 } 2063 2064 release_firmware(fw); 2065 2066 if (disable_patch) 2067 goto exit_mfg_disable; 2068 2069 /* Patching completed successfully and disable the manufacturer mode 2070 * with reset and activate the downloaded firmware patches. 2071 */ 2072 skb = __hci_cmd_sync(hdev, 0xfc11, sizeof(mfg_reset_activate), 2073 mfg_reset_activate, HCI_INIT_TIMEOUT); 2074 if (IS_ERR(skb)) { 2075 BT_ERR("%s exiting Intel manufacturer mode failed (%ld)", 2076 hdev->name, PTR_ERR(skb)); 2077 return PTR_ERR(skb); 2078 } 2079 kfree_skb(skb); 2080 2081 BT_INFO("%s: Intel Bluetooth firmware patch completed and activated", 2082 hdev->name); 2083 2084 btintel_check_bdaddr(hdev); 2085 return 0; 2086 2087exit_mfg_disable: 2088 /* Disable the manufacturer mode without reset */ 2089 skb = __hci_cmd_sync(hdev, 0xfc11, sizeof(mfg_disable), mfg_disable, 2090 HCI_INIT_TIMEOUT); 2091 if (IS_ERR(skb)) { 2092 BT_ERR("%s exiting Intel manufacturer mode failed (%ld)", 2093 hdev->name, PTR_ERR(skb)); 2094 return PTR_ERR(skb); 2095 } 2096 kfree_skb(skb); 2097 2098 BT_INFO("%s: Intel Bluetooth firmware patch completed", hdev->name); 2099 2100 btintel_check_bdaddr(hdev); 2101 return 0; 2102 2103exit_mfg_deactivate: 2104 release_firmware(fw); 2105 2106 /* Patching failed. Disable the manufacturer mode with reset and 2107 * deactivate the downloaded firmware patches. 2108 */ 2109 skb = __hci_cmd_sync(hdev, 0xfc11, sizeof(mfg_reset_deactivate), 2110 mfg_reset_deactivate, HCI_INIT_TIMEOUT); 2111 if (IS_ERR(skb)) { 2112 BT_ERR("%s exiting Intel manufacturer mode failed (%ld)", 2113 hdev->name, PTR_ERR(skb)); 2114 return PTR_ERR(skb); 2115 } 2116 kfree_skb(skb); 2117 2118 BT_INFO("%s: Intel Bluetooth firmware patch completed and deactivated", 2119 hdev->name); 2120 2121 btintel_check_bdaddr(hdev); 2122 return 0; 2123} 2124 2125static int inject_cmd_complete(struct hci_dev *hdev, __u16 opcode) 2126{ 2127 struct sk_buff *skb; 2128 struct hci_event_hdr *hdr; 2129 struct hci_ev_cmd_complete *evt; 2130 2131 skb = bt_skb_alloc(sizeof(*hdr) + sizeof(*evt) + 1, GFP_ATOMIC); 2132 if (!skb) 2133 return -ENOMEM; 2134 2135 hdr = (struct hci_event_hdr *)skb_put(skb, sizeof(*hdr)); 2136 hdr->evt = HCI_EV_CMD_COMPLETE; 2137 hdr->plen = sizeof(*evt) + 1; 2138 2139 evt = (struct hci_ev_cmd_complete *)skb_put(skb, sizeof(*evt)); 2140 evt->ncmd = 0x01; 2141 evt->opcode = cpu_to_le16(opcode); 2142 2143 *skb_put(skb, 1) = 0x00; 2144 2145 bt_cb(skb)->pkt_type = HCI_EVENT_PKT; 2146 2147 return hci_recv_frame(hdev, skb); 2148} 2149 2150static int btusb_recv_bulk_intel(struct btusb_data *data, void *buffer, 2151 int count) 2152{ 2153 /* When the device is in bootloader mode, then it can send 2154 * events via the bulk endpoint. These events are treated the 2155 * same way as the ones received from the interrupt endpoint. 2156 */ 2157 if (test_bit(BTUSB_BOOTLOADER, &data->flags)) 2158 return btusb_recv_intr(data, buffer, count); 2159 2160 return btusb_recv_bulk(data, buffer, count); 2161} 2162 2163static void btusb_intel_bootup(struct btusb_data *data, const void *ptr, 2164 unsigned int len) 2165{ 2166 const struct intel_bootup *evt = ptr; 2167 2168 if (len != sizeof(*evt)) 2169 return; 2170 2171 if (test_and_clear_bit(BTUSB_BOOTING, &data->flags)) { 2172 smp_mb__after_atomic(); 2173 wake_up_bit(&data->flags, BTUSB_BOOTING); 2174 } 2175} 2176 2177static void btusb_intel_secure_send_result(struct btusb_data *data, 2178 const void *ptr, unsigned int len) 2179{ 2180 const struct intel_secure_send_result *evt = ptr; 2181 2182 if (len != sizeof(*evt)) 2183 return; 2184 2185 if (evt->result) 2186 set_bit(BTUSB_FIRMWARE_FAILED, &data->flags); 2187 2188 if (test_and_clear_bit(BTUSB_DOWNLOADING, &data->flags) && 2189 test_bit(BTUSB_FIRMWARE_LOADED, &data->flags)) { 2190 smp_mb__after_atomic(); 2191 wake_up_bit(&data->flags, BTUSB_DOWNLOADING); 2192 } 2193} 2194 2195static int btusb_recv_event_intel(struct hci_dev *hdev, struct sk_buff *skb) 2196{ 2197 struct btusb_data *data = hci_get_drvdata(hdev); 2198 2199 if (test_bit(BTUSB_BOOTLOADER, &data->flags)) { 2200 struct hci_event_hdr *hdr = (void *)skb->data; 2201 2202 if (skb->len > HCI_EVENT_HDR_SIZE && hdr->evt == 0xff && 2203 hdr->plen > 0) { 2204 const void *ptr = skb->data + HCI_EVENT_HDR_SIZE + 1; 2205 unsigned int len = skb->len - HCI_EVENT_HDR_SIZE - 1; 2206 2207 switch (skb->data[2]) { 2208 case 0x02: 2209 /* When switching to the operational firmware 2210 * the device sends a vendor specific event 2211 * indicating that the bootup completed. 2212 */ 2213 btusb_intel_bootup(data, ptr, len); 2214 break; 2215 case 0x06: 2216 /* When the firmware loading completes the 2217 * device sends out a vendor specific event 2218 * indicating the result of the firmware 2219 * loading. 2220 */ 2221 btusb_intel_secure_send_result(data, ptr, len); 2222 break; 2223 } 2224 } 2225 } 2226 2227 return hci_recv_frame(hdev, skb); 2228} 2229 2230static int btusb_send_frame_intel(struct hci_dev *hdev, struct sk_buff *skb) 2231{ 2232 struct btusb_data *data = hci_get_drvdata(hdev); 2233 struct urb *urb; 2234 2235 BT_DBG("%s", hdev->name); 2236 2237 if (!test_bit(HCI_RUNNING, &hdev->flags)) 2238 return -EBUSY; 2239 2240 switch (bt_cb(skb)->pkt_type) { 2241 case HCI_COMMAND_PKT: 2242 if (test_bit(BTUSB_BOOTLOADER, &data->flags)) { 2243 struct hci_command_hdr *cmd = (void *)skb->data; 2244 __u16 opcode = le16_to_cpu(cmd->opcode); 2245 2246 /* When in bootloader mode and the command 0xfc09 2247 * is received, it needs to be send down the 2248 * bulk endpoint. So allocate a bulk URB instead. 2249 */ 2250 if (opcode == 0xfc09) 2251 urb = alloc_bulk_urb(hdev, skb); 2252 else 2253 urb = alloc_ctrl_urb(hdev, skb); 2254 2255 /* When the 0xfc01 command is issued to boot into 2256 * the operational firmware, it will actually not 2257 * send a command complete event. To keep the flow 2258 * control working inject that event here. 2259 */ 2260 if (opcode == 0xfc01) 2261 inject_cmd_complete(hdev, opcode); 2262 } else { 2263 urb = alloc_ctrl_urb(hdev, skb); 2264 } 2265 if (IS_ERR(urb)) 2266 return PTR_ERR(urb); 2267 2268 hdev->stat.cmd_tx++; 2269 return submit_or_queue_tx_urb(hdev, urb); 2270 2271 case HCI_ACLDATA_PKT: 2272 urb = alloc_bulk_urb(hdev, skb); 2273 if (IS_ERR(urb)) 2274 return PTR_ERR(urb); 2275 2276 hdev->stat.acl_tx++; 2277 return submit_or_queue_tx_urb(hdev, urb); 2278 2279 case HCI_SCODATA_PKT: 2280 if (hci_conn_num(hdev, SCO_LINK) < 1) 2281 return -ENODEV; 2282 2283 urb = alloc_isoc_urb(hdev, skb); 2284 if (IS_ERR(urb)) 2285 return PTR_ERR(urb); 2286 2287 hdev->stat.sco_tx++; 2288 return submit_tx_urb(hdev, urb); 2289 } 2290 2291 return -EILSEQ; 2292} 2293 2294static int btusb_intel_secure_send(struct hci_dev *hdev, u8 fragment_type, 2295 u32 plen, const void *param) 2296{ 2297 while (plen > 0) { 2298 struct sk_buff *skb; 2299 u8 cmd_param[253], fragment_len = (plen > 252) ? 252 : plen; 2300 2301 cmd_param[0] = fragment_type; 2302 memcpy(cmd_param + 1, param, fragment_len); 2303 2304 skb = __hci_cmd_sync(hdev, 0xfc09, fragment_len + 1, 2305 cmd_param, HCI_INIT_TIMEOUT); 2306 if (IS_ERR(skb)) 2307 return PTR_ERR(skb); 2308 2309 kfree_skb(skb); 2310 2311 plen -= fragment_len; 2312 param += fragment_len; 2313 } 2314 2315 return 0; 2316} 2317 2318static void btusb_intel_version_info(struct hci_dev *hdev, 2319 struct intel_version *ver) 2320{ 2321 const char *variant; 2322 2323 switch (ver->fw_variant) { 2324 case 0x06: 2325 variant = "Bootloader"; 2326 break; 2327 case 0x23: 2328 variant = "Firmware"; 2329 break; 2330 default: 2331 return; 2332 } 2333 2334 BT_INFO("%s: %s revision %u.%u build %u week %u %u", hdev->name, 2335 variant, ver->fw_revision >> 4, ver->fw_revision & 0x0f, 2336 ver->fw_build_num, ver->fw_build_ww, 2000 + ver->fw_build_yy); 2337} 2338 2339static int btusb_setup_intel_new(struct hci_dev *hdev) 2340{ 2341 static const u8 reset_param[] = { 0x00, 0x01, 0x00, 0x01, 2342 0x00, 0x08, 0x04, 0x00 }; 2343 struct btusb_data *data = hci_get_drvdata(hdev); 2344 struct sk_buff *skb; 2345 struct intel_version *ver; 2346 struct intel_boot_params *params; 2347 const struct firmware *fw; 2348 const u8 *fw_ptr; 2349 u32 frag_len; 2350 char fwname[64]; 2351 ktime_t calltime, delta, rettime; 2352 unsigned long long duration; 2353 int err; 2354 2355 BT_DBG("%s", hdev->name); 2356 2357 calltime = ktime_get(); 2358 2359 /* Read the Intel version information to determine if the device 2360 * is in bootloader mode or if it already has operational firmware 2361 * loaded. 2362 */ 2363 skb = __hci_cmd_sync(hdev, 0xfc05, 0, NULL, HCI_INIT_TIMEOUT); 2364 if (IS_ERR(skb)) { 2365 BT_ERR("%s: Reading Intel version information failed (%ld)", 2366 hdev->name, PTR_ERR(skb)); 2367 return PTR_ERR(skb); 2368 } 2369 2370 if (skb->len != sizeof(*ver)) { 2371 BT_ERR("%s: Intel version event size mismatch", hdev->name); 2372 kfree_skb(skb); 2373 return -EILSEQ; 2374 } 2375 2376 ver = (struct intel_version *)skb->data; 2377 if (ver->status) { 2378 BT_ERR("%s: Intel version command failure (%02x)", 2379 hdev->name, ver->status); 2380 err = -bt_to_errno(ver->status); 2381 kfree_skb(skb); 2382 return err; 2383 } 2384 2385 /* The hardware platform number has a fixed value of 0x37 and 2386 * for now only accept this single value. 2387 */ 2388 if (ver->hw_platform != 0x37) { 2389 BT_ERR("%s: Unsupported Intel hardware platform (%u)", 2390 hdev->name, ver->hw_platform); 2391 kfree_skb(skb); 2392 return -EINVAL; 2393 } 2394 2395 /* At the moment only the hardware variant iBT 3.0 (LnP/SfP) is 2396 * supported by this firmware loading method. This check has been 2397 * put in place to ensure correct forward compatibility options 2398 * when newer hardware variants come along. 2399 */ 2400 if (ver->hw_variant != 0x0b) { 2401 BT_ERR("%s: Unsupported Intel hardware variant (%u)", 2402 hdev->name, ver->hw_variant); 2403 kfree_skb(skb); 2404 return -EINVAL; 2405 } 2406 2407 btusb_intel_version_info(hdev, ver); 2408 2409 /* The firmware variant determines if the device is in bootloader 2410 * mode or is running operational firmware. The value 0x06 identifies 2411 * the bootloader and the value 0x23 identifies the operational 2412 * firmware. 2413 * 2414 * When the operational firmware is already present, then only 2415 * the check for valid Bluetooth device address is needed. This 2416 * determines if the device will be added as configured or 2417 * unconfigured controller. 2418 * 2419 * It is not possible to use the Secure Boot Parameters in this 2420 * case since that command is only available in bootloader mode. 2421 */ 2422 if (ver->fw_variant == 0x23) { 2423 kfree_skb(skb); 2424 clear_bit(BTUSB_BOOTLOADER, &data->flags); 2425 btintel_check_bdaddr(hdev); 2426 return 0; 2427 } 2428 2429 /* If the device is not in bootloader mode, then the only possible 2430 * choice is to return an error and abort the device initialization. 2431 */ 2432 if (ver->fw_variant != 0x06) { 2433 BT_ERR("%s: Unsupported Intel firmware variant (%u)", 2434 hdev->name, ver->fw_variant); 2435 kfree_skb(skb); 2436 return -ENODEV; 2437 } 2438 2439 kfree_skb(skb); 2440 2441 /* Read the secure boot parameters to identify the operating 2442 * details of the bootloader. 2443 */ 2444 skb = __hci_cmd_sync(hdev, 0xfc0d, 0, NULL, HCI_INIT_TIMEOUT); 2445 if (IS_ERR(skb)) { 2446 BT_ERR("%s: Reading Intel boot parameters failed (%ld)", 2447 hdev->name, PTR_ERR(skb)); 2448 return PTR_ERR(skb); 2449 } 2450 2451 if (skb->len != sizeof(*params)) { 2452 BT_ERR("%s: Intel boot parameters size mismatch", hdev->name); 2453 kfree_skb(skb); 2454 return -EILSEQ; 2455 } 2456 2457 params = (struct intel_boot_params *)skb->data; 2458 if (params->status) { 2459 BT_ERR("%s: Intel boot parameters command failure (%02x)", 2460 hdev->name, params->status); 2461 err = -bt_to_errno(params->status); 2462 kfree_skb(skb); 2463 return err; 2464 } 2465 2466 BT_INFO("%s: Device revision is %u", hdev->name, 2467 le16_to_cpu(params->dev_revid)); 2468 2469 BT_INFO("%s: Secure boot is %s", hdev->name, 2470 params->secure_boot ? "enabled" : "disabled"); 2471 2472 BT_INFO("%s: Minimum firmware build %u week %u %u", hdev->name, 2473 params->min_fw_build_nn, params->min_fw_build_cw, 2474 2000 + params->min_fw_build_yy); 2475 2476 /* It is required that every single firmware fragment is acknowledged 2477 * with a command complete event. If the boot parameters indicate 2478 * that this bootloader does not send them, then abort the setup. 2479 */ 2480 if (params->limited_cce != 0x00) { 2481 BT_ERR("%s: Unsupported Intel firmware loading method (%u)", 2482 hdev->name, params->limited_cce); 2483 kfree_skb(skb); 2484 return -EINVAL; 2485 } 2486 2487 /* If the OTP has no valid Bluetooth device address, then there will 2488 * also be no valid address for the operational firmware. 2489 */ 2490 if (!bacmp(¶ms->otp_bdaddr, BDADDR_ANY)) { 2491 BT_INFO("%s: No device address configured", hdev->name); 2492 set_bit(HCI_QUIRK_INVALID_BDADDR, &hdev->quirks); 2493 } 2494 2495 /* With this Intel bootloader only the hardware variant and device 2496 * revision information are used to select the right firmware. 2497 * 2498 * Currently this bootloader support is limited to hardware variant 2499 * iBT 3.0 (LnP/SfP) which is identified by the value 11 (0x0b). 2500 */ 2501 snprintf(fwname, sizeof(fwname), "intel/ibt-11-%u.sfi", 2502 le16_to_cpu(params->dev_revid)); 2503 2504 err = request_firmware(&fw, fwname, &hdev->dev); 2505 if (err < 0) { 2506 BT_ERR("%s: Failed to load Intel firmware file (%d)", 2507 hdev->name, err); 2508 kfree_skb(skb); 2509 return err; 2510 } 2511 2512 BT_INFO("%s: Found device firmware: %s", hdev->name, fwname); 2513 2514 kfree_skb(skb); 2515 2516 if (fw->size < 644) { 2517 BT_ERR("%s: Invalid size of firmware file (%zu)", 2518 hdev->name, fw->size); 2519 err = -EBADF; 2520 goto done; 2521 } 2522 2523 set_bit(BTUSB_DOWNLOADING, &data->flags); 2524 2525 /* Start the firmware download transaction with the Init fragment 2526 * represented by the 128 bytes of CSS header. 2527 */ 2528 err = btusb_intel_secure_send(hdev, 0x00, 128, fw->data); 2529 if (err < 0) { 2530 BT_ERR("%s: Failed to send firmware header (%d)", 2531 hdev->name, err); 2532 goto done; 2533 } 2534 2535 /* Send the 256 bytes of public key information from the firmware 2536 * as the PKey fragment. 2537 */ 2538 err = btusb_intel_secure_send(hdev, 0x03, 256, fw->data + 128); 2539 if (err < 0) { 2540 BT_ERR("%s: Failed to send firmware public key (%d)", 2541 hdev->name, err); 2542 goto done; 2543 } 2544 2545 /* Send the 256 bytes of signature information from the firmware 2546 * as the Sign fragment. 2547 */ 2548 err = btusb_intel_secure_send(hdev, 0x02, 256, fw->data + 388); 2549 if (err < 0) { 2550 BT_ERR("%s: Failed to send firmware signature (%d)", 2551 hdev->name, err); 2552 goto done; 2553 } 2554 2555 fw_ptr = fw->data + 644; 2556 frag_len = 0; 2557 2558 while (fw_ptr - fw->data < fw->size) { 2559 struct hci_command_hdr *cmd = (void *)(fw_ptr + frag_len); 2560 2561 frag_len += sizeof(*cmd) + cmd->plen; 2562 2563 /* The paramter length of the secure send command requires 2564 * a 4 byte alignment. It happens so that the firmware file 2565 * contains proper Intel_NOP commands to align the fragments 2566 * as needed. 2567 * 2568 * Send set of commands with 4 byte alignment from the 2569 * firmware data buffer as a single Data fragement. 2570 */ 2571 if (!(frag_len % 4)) { 2572 err = btusb_intel_secure_send(hdev, 0x01, frag_len, 2573 fw_ptr); 2574 if (err < 0) { 2575 BT_ERR("%s: Failed to send firmware data (%d)", 2576 hdev->name, err); 2577 goto done; 2578 } 2579 2580 fw_ptr += frag_len; 2581 frag_len = 0; 2582 } 2583 } 2584 2585 set_bit(BTUSB_FIRMWARE_LOADED, &data->flags); 2586 2587 BT_INFO("%s: Waiting for firmware download to complete", hdev->name); 2588 2589 /* Before switching the device into operational mode and with that 2590 * booting the loaded firmware, wait for the bootloader notification 2591 * that all fragments have been successfully received. 2592 * 2593 * When the event processing receives the notification, then the 2594 * BTUSB_DOWNLOADING flag will be cleared. 2595 * 2596 * The firmware loading should not take longer than 5 seconds 2597 * and thus just timeout if that happens and fail the setup 2598 * of this device. 2599 */ 2600 err = wait_on_bit_timeout(&data->flags, BTUSB_DOWNLOADING, 2601 TASK_INTERRUPTIBLE, 2602 msecs_to_jiffies(5000)); 2603 if (err == 1) { 2604 BT_ERR("%s: Firmware loading interrupted", hdev->name); 2605 err = -EINTR; 2606 goto done; 2607 } 2608 2609 if (err) { 2610 BT_ERR("%s: Firmware loading timeout", hdev->name); 2611 err = -ETIMEDOUT; 2612 goto done; 2613 } 2614 2615 if (test_bit(BTUSB_FIRMWARE_FAILED, &data->flags)) { 2616 BT_ERR("%s: Firmware loading failed", hdev->name); 2617 err = -ENOEXEC; 2618 goto done; 2619 } 2620 2621 rettime = ktime_get(); 2622 delta = ktime_sub(rettime, calltime); 2623 duration = (unsigned long long) ktime_to_ns(delta) >> 10; 2624 2625 BT_INFO("%s: Firmware loaded in %llu usecs", hdev->name, duration); 2626 2627done: 2628 release_firmware(fw); 2629 2630 if (err < 0) 2631 return err; 2632 2633 calltime = ktime_get(); 2634 2635 set_bit(BTUSB_BOOTING, &data->flags); 2636 2637 skb = __hci_cmd_sync(hdev, 0xfc01, sizeof(reset_param), reset_param, 2638 HCI_INIT_TIMEOUT); 2639 if (IS_ERR(skb)) 2640 return PTR_ERR(skb); 2641 2642 kfree_skb(skb); 2643 2644 /* The bootloader will not indicate when the device is ready. This 2645 * is done by the operational firmware sending bootup notification. 2646 * 2647 * Booting into operational firmware should not take longer than 2648 * 1 second. However if that happens, then just fail the setup 2649 * since something went wrong. 2650 */ 2651 BT_INFO("%s: Waiting for device to boot", hdev->name); 2652 2653 err = wait_on_bit_timeout(&data->flags, BTUSB_BOOTING, 2654 TASK_INTERRUPTIBLE, 2655 msecs_to_jiffies(1000)); 2656 2657 if (err == 1) { 2658 BT_ERR("%s: Device boot interrupted", hdev->name); 2659 return -EINTR; 2660 } 2661 2662 if (err) { 2663 BT_ERR("%s: Device boot timeout", hdev->name); 2664 return -ETIMEDOUT; 2665 } 2666 2667 rettime = ktime_get(); 2668 delta = ktime_sub(rettime, calltime); 2669 duration = (unsigned long long) ktime_to_ns(delta) >> 10; 2670 2671 BT_INFO("%s: Device booted in %llu usecs", hdev->name, duration); 2672 2673 clear_bit(BTUSB_BOOTLOADER, &data->flags); 2674 2675 return 0; 2676} 2677 2678static void btusb_hw_error_intel(struct hci_dev *hdev, u8 code) 2679{ 2680 struct sk_buff *skb; 2681 u8 type = 0x00; 2682 2683 BT_ERR("%s: Hardware error 0x%2.2x", hdev->name, code); 2684 2685 skb = __hci_cmd_sync(hdev, HCI_OP_RESET, 0, NULL, HCI_INIT_TIMEOUT); 2686 if (IS_ERR(skb)) { 2687 BT_ERR("%s: Reset after hardware error failed (%ld)", 2688 hdev->name, PTR_ERR(skb)); 2689 return; 2690 } 2691 kfree_skb(skb); 2692 2693 skb = __hci_cmd_sync(hdev, 0xfc22, 1, &type, HCI_INIT_TIMEOUT); 2694 if (IS_ERR(skb)) { 2695 BT_ERR("%s: Retrieving Intel exception info failed (%ld)", 2696 hdev->name, PTR_ERR(skb)); 2697 return; 2698 } 2699 2700 if (skb->len != 13) { 2701 BT_ERR("%s: Exception info size mismatch", hdev->name); 2702 kfree_skb(skb); 2703 return; 2704 } 2705 2706 if (skb->data[0] != 0x00) { 2707 BT_ERR("%s: Exception info command failure (%02x)", 2708 hdev->name, skb->data[0]); 2709 kfree_skb(skb); 2710 return; 2711 } 2712 2713 BT_ERR("%s: Exception info %s", hdev->name, (char *)(skb->data + 1)); 2714 2715 kfree_skb(skb); 2716} 2717 2718static int btusb_shutdown_intel(struct hci_dev *hdev) 2719{ 2720 struct sk_buff *skb; 2721 long ret; 2722 2723 /* Some platforms have an issue with BT LED when the interface is 2724 * down or BT radio is turned off, which takes 5 seconds to BT LED 2725 * goes off. This command turns off the BT LED immediately. 2726 */ 2727 skb = __hci_cmd_sync(hdev, 0xfc3f, 0, NULL, HCI_INIT_TIMEOUT); 2728 if (IS_ERR(skb)) { 2729 ret = PTR_ERR(skb); 2730 BT_ERR("%s: turning off Intel device LED failed (%ld)", 2731 hdev->name, ret); 2732 return ret; 2733 } 2734 kfree_skb(skb); 2735 2736 return 0; 2737} 2738 2739static int btusb_set_bdaddr_marvell(struct hci_dev *hdev, 2740 const bdaddr_t *bdaddr) 2741{ 2742 struct sk_buff *skb; 2743 u8 buf[8]; 2744 long ret; 2745 2746 buf[0] = 0xfe; 2747 buf[1] = sizeof(bdaddr_t); 2748 memcpy(buf + 2, bdaddr, sizeof(bdaddr_t)); 2749 2750 skb = __hci_cmd_sync(hdev, 0xfc22, sizeof(buf), buf, HCI_INIT_TIMEOUT); 2751 if (IS_ERR(skb)) { 2752 ret = PTR_ERR(skb); 2753 BT_ERR("%s: changing Marvell device address failed (%ld)", 2754 hdev->name, ret); 2755 return ret; 2756 } 2757 kfree_skb(skb); 2758 2759 return 0; 2760} 2761 2762static int btusb_set_bdaddr_ath3012(struct hci_dev *hdev, 2763 const bdaddr_t *bdaddr) 2764{ 2765 struct sk_buff *skb; 2766 u8 buf[10]; 2767 long ret; 2768 2769 buf[0] = 0x01; 2770 buf[1] = 0x01; 2771 buf[2] = 0x00; 2772 buf[3] = sizeof(bdaddr_t); 2773 memcpy(buf + 4, bdaddr, sizeof(bdaddr_t)); 2774 2775 skb = __hci_cmd_sync(hdev, 0xfc0b, sizeof(buf), buf, HCI_INIT_TIMEOUT); 2776 if (IS_ERR(skb)) { 2777 ret = PTR_ERR(skb); 2778 BT_ERR("%s: Change address command failed (%ld)", 2779 hdev->name, ret); 2780 return ret; 2781 } 2782 kfree_skb(skb); 2783 2784 return 0; 2785} 2786 2787#define QCA_DFU_PACKET_LEN 4096 2788 2789#define QCA_GET_TARGET_VERSION 0x09 2790#define QCA_CHECK_STATUS 0x05 2791#define QCA_DFU_DOWNLOAD 0x01 2792 2793#define QCA_SYSCFG_UPDATED 0x40 2794#define QCA_PATCH_UPDATED 0x80 2795#define QCA_DFU_TIMEOUT 3000 2796 2797struct qca_version { 2798 __le32 rom_version; 2799 __le32 patch_version; 2800 __le32 ram_version; 2801 __le32 ref_clock; 2802 __u8 reserved[4]; 2803} __packed; 2804 2805struct qca_rampatch_version { 2806 __le16 rom_version; 2807 __le16 patch_version; 2808} __packed; 2809 2810struct qca_device_info { 2811 u32 rom_version; 2812 u8 rampatch_hdr; /* length of header in rampatch */ 2813 u8 nvm_hdr; /* length of header in NVM */ 2814 u8 ver_offset; /* offset of version structure in rampatch */ 2815}; 2816 2817static const struct qca_device_info qca_devices_table[] = { 2818 { 0x00000100, 20, 4, 10 }, /* Rome 1.0 */ 2819 { 0x00000101, 20, 4, 10 }, /* Rome 1.1 */ 2820 { 0x00000201, 28, 4, 18 }, /* Rome 2.1 */ 2821 { 0x00000300, 28, 4, 18 }, /* Rome 3.0 */ 2822 { 0x00000302, 28, 4, 18 }, /* Rome 3.2 */ 2823}; 2824 2825static int btusb_qca_send_vendor_req(struct hci_dev *hdev, u8 request, 2826 void *data, u16 size) 2827{ 2828 struct btusb_data *btdata = hci_get_drvdata(hdev); 2829 struct usb_device *udev = btdata->udev; 2830 int pipe, err; 2831 u8 *buf; 2832 2833 buf = kmalloc(size, GFP_KERNEL); 2834 if (!buf) 2835 return -ENOMEM; 2836 2837 /* Found some of USB hosts have IOT issues with ours so that we should 2838 * not wait until HCI layer is ready. 2839 */ 2840 pipe = usb_rcvctrlpipe(udev, 0); 2841 err = usb_control_msg(udev, pipe, request, USB_TYPE_VENDOR | USB_DIR_IN, 2842 0, 0, buf, size, USB_CTRL_SET_TIMEOUT); 2843 if (err < 0) { 2844 BT_ERR("%s: Failed to access otp area (%d)", hdev->name, err); 2845 goto done; 2846 } 2847 2848 memcpy(data, buf, size); 2849 2850done: 2851 kfree(buf); 2852 2853 return err; 2854} 2855 2856static int btusb_setup_qca_download_fw(struct hci_dev *hdev, 2857 const struct firmware *firmware, 2858 size_t hdr_size) 2859{ 2860 struct btusb_data *btdata = hci_get_drvdata(hdev); 2861 struct usb_device *udev = btdata->udev; 2862 size_t count, size, sent = 0; 2863 int pipe, len, err; 2864 u8 *buf; 2865 2866 buf = kmalloc(QCA_DFU_PACKET_LEN, GFP_KERNEL); 2867 if (!buf) 2868 return -ENOMEM; 2869 2870 count = firmware->size; 2871 2872 size = min_t(size_t, count, hdr_size); 2873 memcpy(buf, firmware->data, size); 2874 2875 /* USB patches should go down to controller through USB path 2876 * because binary format fits to go down through USB channel. 2877 * USB control path is for patching headers and USB bulk is for 2878 * patch body. 2879 */ 2880 pipe = usb_sndctrlpipe(udev, 0); 2881 err = usb_control_msg(udev, pipe, QCA_DFU_DOWNLOAD, USB_TYPE_VENDOR, 2882 0, 0, buf, size, USB_CTRL_SET_TIMEOUT); 2883 if (err < 0) { 2884 BT_ERR("%s: Failed to send headers (%d)", hdev->name, err); 2885 goto done; 2886 } 2887 2888 sent += size; 2889 count -= size; 2890 2891 while (count) { 2892 size = min_t(size_t, count, QCA_DFU_PACKET_LEN); 2893 2894 memcpy(buf, firmware->data + sent, size); 2895 2896 pipe = usb_sndbulkpipe(udev, 0x02); 2897 err = usb_bulk_msg(udev, pipe, buf, size, &len, 2898 QCA_DFU_TIMEOUT); 2899 if (err < 0) { 2900 BT_ERR("%s: Failed to send body at %zd of %zd (%d)", 2901 hdev->name, sent, firmware->size, err); 2902 break; 2903 } 2904 2905 if (size != len) { 2906 BT_ERR("%s: Failed to get bulk buffer", hdev->name); 2907 err = -EILSEQ; 2908 break; 2909 } 2910 2911 sent += size; 2912 count -= size; 2913 } 2914 2915done: 2916 kfree(buf); 2917 return err; 2918} 2919 2920static int btusb_setup_qca_load_rampatch(struct hci_dev *hdev, 2921 struct qca_version *ver, 2922 const struct qca_device_info *info) 2923{ 2924 struct qca_rampatch_version *rver; 2925 const struct firmware *fw; 2926 u32 ver_rom, ver_patch; 2927 u16 rver_rom, rver_patch; 2928 char fwname[64]; 2929 int err; 2930 2931 ver_rom = le32_to_cpu(ver->rom_version); 2932 ver_patch = le32_to_cpu(ver->patch_version); 2933 2934 snprintf(fwname, sizeof(fwname), "qca/rampatch_usb_%08x.bin", ver_rom); 2935 2936 err = request_firmware(&fw, fwname, &hdev->dev); 2937 if (err) { 2938 BT_ERR("%s: failed to request rampatch file: %s (%d)", 2939 hdev->name, fwname, err); 2940 return err; 2941 } 2942 2943 BT_INFO("%s: using rampatch file: %s", hdev->name, fwname); 2944 2945 rver = (struct qca_rampatch_version *)(fw->data + info->ver_offset); 2946 rver_rom = le16_to_cpu(rver->rom_version); 2947 rver_patch = le16_to_cpu(rver->patch_version); 2948 2949 BT_INFO("%s: QCA: patch rome 0x%x build 0x%x, firmware rome 0x%x " 2950 "build 0x%x", hdev->name, rver_rom, rver_patch, ver_rom, 2951 ver_patch); 2952 2953 if (rver_rom != ver_rom || rver_patch <= ver_patch) { 2954 BT_ERR("%s: rampatch file version did not match with firmware", 2955 hdev->name); 2956 err = -EINVAL; 2957 goto done; 2958 } 2959 2960 err = btusb_setup_qca_download_fw(hdev, fw, info->rampatch_hdr); 2961 2962done: 2963 release_firmware(fw); 2964 2965 return err; 2966} 2967 2968static int btusb_setup_qca_load_nvm(struct hci_dev *hdev, 2969 struct qca_version *ver, 2970 const struct qca_device_info *info) 2971{ 2972 const struct firmware *fw; 2973 char fwname[64]; 2974 int err; 2975 2976 snprintf(fwname, sizeof(fwname), "qca/nvm_usb_%08x.bin", 2977 le32_to_cpu(ver->rom_version)); 2978 2979 err = request_firmware(&fw, fwname, &hdev->dev); 2980 if (err) { 2981 BT_ERR("%s: failed to request NVM file: %s (%d)", 2982 hdev->name, fwname, err); 2983 return err; 2984 } 2985 2986 BT_INFO("%s: using NVM file: %s", hdev->name, fwname); 2987 2988 err = btusb_setup_qca_download_fw(hdev, fw, info->nvm_hdr); 2989 2990 release_firmware(fw); 2991 2992 return err; 2993} 2994 2995static int btusb_setup_qca(struct hci_dev *hdev) 2996{ 2997 const struct qca_device_info *info = NULL; 2998 struct qca_version ver; 2999 u32 ver_rom; 3000 u8 status; 3001 int i, err; 3002 3003 err = btusb_qca_send_vendor_req(hdev, QCA_GET_TARGET_VERSION, &ver, 3004 sizeof(ver)); 3005 if (err < 0) 3006 return err; 3007 3008 ver_rom = le32_to_cpu(ver.rom_version); 3009 for (i = 0; i < ARRAY_SIZE(qca_devices_table); i++) { 3010 if (ver_rom == qca_devices_table[i].rom_version) 3011 info = &qca_devices_table[i]; 3012 } 3013 if (!info) { 3014 BT_ERR("%s: don't support firmware rome 0x%x", hdev->name, 3015 ver_rom); 3016 return -ENODEV; 3017 } 3018 3019 err = btusb_qca_send_vendor_req(hdev, QCA_CHECK_STATUS, &status, 3020 sizeof(status)); 3021 if (err < 0) 3022 return err; 3023 3024 if (!(status & QCA_PATCH_UPDATED)) { 3025 err = btusb_setup_qca_load_rampatch(hdev, &ver, info); 3026 if (err < 0) 3027 return err; 3028 } 3029 3030 if (!(status & QCA_SYSCFG_UPDATED)) { 3031 err = btusb_setup_qca_load_nvm(hdev, &ver, info); 3032 if (err < 0) 3033 return err; 3034 } 3035 3036 return 0; 3037} 3038 3039static int btusb_probe(struct usb_interface *intf, 3040 const struct usb_device_id *id) 3041{ 3042 struct usb_endpoint_descriptor *ep_desc; 3043 struct btusb_data *data; 3044 struct hci_dev *hdev; 3045 int i, err; 3046 3047 BT_DBG("intf %p id %p", intf, id); 3048 3049 /* interface numbers are hardcoded in the spec */ 3050 if (intf->cur_altsetting->desc.bInterfaceNumber != 0) 3051 return -ENODEV; 3052 3053 if (!id->driver_info) { 3054 const struct usb_device_id *match; 3055 3056 match = usb_match_id(intf, blacklist_table); 3057 if (match) 3058 id = match; 3059 } 3060 3061 if (id->driver_info == BTUSB_IGNORE) 3062 return -ENODEV; 3063 3064 if (id->driver_info & BTUSB_ATH3012) { 3065 struct usb_device *udev = interface_to_usbdev(intf); 3066 3067 /* Old firmware would otherwise let ath3k driver load 3068 * patch and sysconfig files */ 3069 if (le16_to_cpu(udev->descriptor.bcdDevice) <= 0x0001) 3070 return -ENODEV; 3071 } 3072 3073 data = devm_kzalloc(&intf->dev, sizeof(*data), GFP_KERNEL); 3074 if (!data) 3075 return -ENOMEM; 3076 3077 for (i = 0; i < intf->cur_altsetting->desc.bNumEndpoints; i++) { 3078 ep_desc = &intf->cur_altsetting->endpoint[i].desc; 3079 3080 if (!data->intr_ep && usb_endpoint_is_int_in(ep_desc)) { 3081 data->intr_ep = ep_desc; 3082 continue; 3083 } 3084 3085 if (!data->bulk_tx_ep && usb_endpoint_is_bulk_out(ep_desc)) { 3086 data->bulk_tx_ep = ep_desc; 3087 continue; 3088 } 3089 3090 if (!data->bulk_rx_ep && usb_endpoint_is_bulk_in(ep_desc)) { 3091 data->bulk_rx_ep = ep_desc; 3092 continue; 3093 } 3094 } 3095 3096 if (!data->intr_ep || !data->bulk_tx_ep || !data->bulk_rx_ep) 3097 return -ENODEV; 3098 3099 if (id->driver_info & BTUSB_AMP) { 3100 data->cmdreq_type = USB_TYPE_CLASS | 0x01; 3101 data->cmdreq = 0x2b; 3102 } else { 3103 data->cmdreq_type = USB_TYPE_CLASS; 3104 data->cmdreq = 0x00; 3105 } 3106 3107 data->udev = interface_to_usbdev(intf); 3108 data->intf = intf; 3109 3110 INIT_WORK(&data->work, btusb_work); 3111 INIT_WORK(&data->waker, btusb_waker); 3112 init_usb_anchor(&data->deferred); 3113 init_usb_anchor(&data->tx_anchor); 3114 spin_lock_init(&data->txlock); 3115 3116 init_usb_anchor(&data->intr_anchor); 3117 init_usb_anchor(&data->bulk_anchor); 3118 init_usb_anchor(&data->isoc_anchor); 3119 spin_lock_init(&data->rxlock); 3120 3121 if (id->driver_info & BTUSB_INTEL_NEW) { 3122 data->recv_event = btusb_recv_event_intel; 3123 data->recv_bulk = btusb_recv_bulk_intel; 3124 set_bit(BTUSB_BOOTLOADER, &data->flags); 3125 } else { 3126 data->recv_event = hci_recv_frame; 3127 data->recv_bulk = btusb_recv_bulk; 3128 } 3129 3130 hdev = hci_alloc_dev(); 3131 if (!hdev) 3132 return -ENOMEM; 3133 3134 hdev->bus = HCI_USB; 3135 hci_set_drvdata(hdev, data); 3136 3137 if (id->driver_info & BTUSB_AMP) 3138 hdev->dev_type = HCI_AMP; 3139 else 3140 hdev->dev_type = HCI_BREDR; 3141 3142 data->hdev = hdev; 3143 3144 SET_HCIDEV_DEV(hdev, &intf->dev); 3145 3146 hdev->open = btusb_open; 3147 hdev->close = btusb_close; 3148 hdev->flush = btusb_flush; 3149 hdev->send = btusb_send_frame; 3150 hdev->notify = btusb_notify; 3151 3152 if (id->driver_info & BTUSB_BCM92035) 3153 hdev->setup = btusb_setup_bcm92035; 3154 3155#ifdef CONFIG_BT_HCIBTUSB_BCM 3156 if (id->driver_info & BTUSB_BCM_PATCHRAM) { 3157 hdev->setup = btbcm_setup_patchram; 3158 hdev->set_bdaddr = btbcm_set_bdaddr; 3159 } 3160 3161 if (id->driver_info & BTUSB_BCM_APPLE) 3162 hdev->setup = btbcm_setup_apple; 3163#endif 3164 3165 if (id->driver_info & BTUSB_INTEL) { 3166 hdev->setup = btusb_setup_intel; 3167 hdev->shutdown = btusb_shutdown_intel; 3168 hdev->set_bdaddr = btintel_set_bdaddr; 3169 set_bit(HCI_QUIRK_STRICT_DUPLICATE_FILTER, &hdev->quirks); 3170 set_bit(HCI_QUIRK_SIMULTANEOUS_DISCOVERY, &hdev->quirks); 3171 } 3172 3173 if (id->driver_info & BTUSB_INTEL_NEW) { 3174 hdev->send = btusb_send_frame_intel; 3175 hdev->setup = btusb_setup_intel_new; 3176 hdev->hw_error = btusb_hw_error_intel; 3177 hdev->set_bdaddr = btintel_set_bdaddr; 3178 set_bit(HCI_QUIRK_STRICT_DUPLICATE_FILTER, &hdev->quirks); 3179 } 3180 3181 if (id->driver_info & BTUSB_MARVELL) 3182 hdev->set_bdaddr = btusb_set_bdaddr_marvell; 3183 3184 if (id->driver_info & BTUSB_SWAVE) { 3185 set_bit(HCI_QUIRK_FIXUP_INQUIRY_MODE, &hdev->quirks); 3186 set_bit(HCI_QUIRK_BROKEN_LOCAL_COMMANDS, &hdev->quirks); 3187 } 3188 3189 if (id->driver_info & BTUSB_INTEL_BOOT) 3190 set_bit(HCI_QUIRK_RAW_DEVICE, &hdev->quirks); 3191 3192 if (id->driver_info & BTUSB_ATH3012) { 3193 hdev->set_bdaddr = btusb_set_bdaddr_ath3012; 3194 set_bit(HCI_QUIRK_SIMULTANEOUS_DISCOVERY, &hdev->quirks); 3195 set_bit(HCI_QUIRK_STRICT_DUPLICATE_FILTER, &hdev->quirks); 3196 } 3197 3198 if (id->driver_info & BTUSB_QCA_ROME) { 3199 data->setup_on_usb = btusb_setup_qca; 3200 hdev->set_bdaddr = btusb_set_bdaddr_ath3012; 3201 } 3202 3203 if (id->driver_info & BTUSB_REALTEK) 3204 hdev->setup = btusb_setup_realtek; 3205 3206 if (id->driver_info & BTUSB_AMP) { 3207 /* AMP controllers do not support SCO packets */ 3208 data->isoc = NULL; 3209 } else { 3210 /* Interface numbers are hardcoded in the specification */ 3211 data->isoc = usb_ifnum_to_if(data->udev, 1); 3212 } 3213 3214 if (!reset) 3215 set_bit(HCI_QUIRK_RESET_ON_CLOSE, &hdev->quirks); 3216 3217 if (force_scofix || id->driver_info & BTUSB_WRONG_SCO_MTU) { 3218 if (!disable_scofix) 3219 set_bit(HCI_QUIRK_FIXUP_BUFFER_SIZE, &hdev->quirks); 3220 } 3221 3222 if (id->driver_info & BTUSB_BROKEN_ISOC) 3223 data->isoc = NULL; 3224 3225 if (id->driver_info & BTUSB_DIGIANSWER) { 3226 data->cmdreq_type = USB_TYPE_VENDOR; 3227 set_bit(HCI_QUIRK_RESET_ON_CLOSE, &hdev->quirks); 3228 } 3229 3230 if (id->driver_info & BTUSB_CSR) { 3231 struct usb_device *udev = data->udev; 3232 u16 bcdDevice = le16_to_cpu(udev->descriptor.bcdDevice); 3233 3234 /* Old firmware would otherwise execute USB reset */ 3235 if (bcdDevice < 0x117) 3236 set_bit(HCI_QUIRK_RESET_ON_CLOSE, &hdev->quirks); 3237 3238 /* Fake CSR devices with broken commands */ 3239 if (bcdDevice <= 0x100) 3240 hdev->setup = btusb_setup_csr; 3241 3242 set_bit(HCI_QUIRK_SIMULTANEOUS_DISCOVERY, &hdev->quirks); 3243 } 3244 3245 if (id->driver_info & BTUSB_SNIFFER) { 3246 struct usb_device *udev = data->udev; 3247 3248 /* New sniffer firmware has crippled HCI interface */ 3249 if (le16_to_cpu(udev->descriptor.bcdDevice) > 0x997) 3250 set_bit(HCI_QUIRK_RAW_DEVICE, &hdev->quirks); 3251 } 3252 3253 if (id->driver_info & BTUSB_INTEL_BOOT) { 3254 /* A bug in the bootloader causes that interrupt interface is 3255 * only enabled after receiving SetInterface(0, AltSetting=0). 3256 */ 3257 err = usb_set_interface(data->udev, 0, 0); 3258 if (err < 0) { 3259 BT_ERR("failed to set interface 0, alt 0 %d", err); 3260 hci_free_dev(hdev); 3261 return err; 3262 } 3263 } 3264 3265 if (data->isoc) { 3266 err = usb_driver_claim_interface(&btusb_driver, 3267 data->isoc, data); 3268 if (err < 0) { 3269 hci_free_dev(hdev); 3270 return err; 3271 } 3272 } 3273 3274 err = hci_register_dev(hdev); 3275 if (err < 0) { 3276 hci_free_dev(hdev); 3277 return err; 3278 } 3279 3280 usb_set_intfdata(intf, data); 3281 3282 return 0; 3283} 3284 3285static void btusb_disconnect(struct usb_interface *intf) 3286{ 3287 struct btusb_data *data = usb_get_intfdata(intf); 3288 struct hci_dev *hdev; 3289 3290 BT_DBG("intf %p", intf); 3291 3292 if (!data) 3293 return; 3294 3295 hdev = data->hdev; 3296 usb_set_intfdata(data->intf, NULL); 3297 3298 if (data->isoc) 3299 usb_set_intfdata(data->isoc, NULL); 3300 3301 hci_unregister_dev(hdev); 3302 3303 if (intf == data->isoc) 3304 usb_driver_release_interface(&btusb_driver, data->intf); 3305 else if (data->isoc) 3306 usb_driver_release_interface(&btusb_driver, data->isoc); 3307 3308 hci_free_dev(hdev); 3309} 3310 3311#ifdef CONFIG_PM 3312static int btusb_suspend(struct usb_interface *intf, pm_message_t message) 3313{ 3314 struct btusb_data *data = usb_get_intfdata(intf); 3315 3316 BT_DBG("intf %p", intf); 3317 3318 if (data->suspend_count++) 3319 return 0; 3320 3321 spin_lock_irq(&data->txlock); 3322 if (!(PMSG_IS_AUTO(message) && data->tx_in_flight)) { 3323 set_bit(BTUSB_SUSPENDING, &data->flags); 3324 spin_unlock_irq(&data->txlock); 3325 } else { 3326 spin_unlock_irq(&data->txlock); 3327 data->suspend_count--; 3328 return -EBUSY; 3329 } 3330 3331 cancel_work_sync(&data->work); 3332 3333 btusb_stop_traffic(data); 3334 usb_kill_anchored_urbs(&data->tx_anchor); 3335 3336 return 0; 3337} 3338 3339static void play_deferred(struct btusb_data *data) 3340{ 3341 struct urb *urb; 3342 int err; 3343 3344 while ((urb = usb_get_from_anchor(&data->deferred))) { 3345 err = usb_submit_urb(urb, GFP_ATOMIC); 3346 if (err < 0) 3347 break; 3348 3349 data->tx_in_flight++; 3350 } 3351 usb_scuttle_anchored_urbs(&data->deferred); 3352} 3353 3354static int btusb_resume(struct usb_interface *intf) 3355{ 3356 struct btusb_data *data = usb_get_intfdata(intf); 3357 struct hci_dev *hdev = data->hdev; 3358 int err = 0; 3359 3360 BT_DBG("intf %p", intf); 3361 3362 if (--data->suspend_count) 3363 return 0; 3364 3365 if (!test_bit(HCI_RUNNING, &hdev->flags)) 3366 goto done; 3367 3368 if (test_bit(BTUSB_INTR_RUNNING, &data->flags)) { 3369 err = btusb_submit_intr_urb(hdev, GFP_NOIO); 3370 if (err < 0) { 3371 clear_bit(BTUSB_INTR_RUNNING, &data->flags); 3372 goto failed; 3373 } 3374 } 3375 3376 if (test_bit(BTUSB_BULK_RUNNING, &data->flags)) { 3377 err = btusb_submit_bulk_urb(hdev, GFP_NOIO); 3378 if (err < 0) { 3379 clear_bit(BTUSB_BULK_RUNNING, &data->flags); 3380 goto failed; 3381 } 3382 3383 btusb_submit_bulk_urb(hdev, GFP_NOIO); 3384 } 3385 3386 if (test_bit(BTUSB_ISOC_RUNNING, &data->flags)) { 3387 if (btusb_submit_isoc_urb(hdev, GFP_NOIO) < 0) 3388 clear_bit(BTUSB_ISOC_RUNNING, &data->flags); 3389 else 3390 btusb_submit_isoc_urb(hdev, GFP_NOIO); 3391 } 3392 3393 spin_lock_irq(&data->txlock); 3394 play_deferred(data); 3395 clear_bit(BTUSB_SUSPENDING, &data->flags); 3396 spin_unlock_irq(&data->txlock); 3397 schedule_work(&data->work); 3398 3399 return 0; 3400 3401failed: 3402 usb_scuttle_anchored_urbs(&data->deferred); 3403done: 3404 spin_lock_irq(&data->txlock); 3405 clear_bit(BTUSB_SUSPENDING, &data->flags); 3406 spin_unlock_irq(&data->txlock); 3407 3408 return err; 3409} 3410#endif 3411 3412static struct usb_driver btusb_driver = { 3413 .name = "btusb", 3414 .probe = btusb_probe, 3415 .disconnect = btusb_disconnect, 3416#ifdef CONFIG_PM 3417 .suspend = btusb_suspend, 3418 .resume = btusb_resume, 3419#endif 3420 .id_table = btusb_table, 3421 .supports_autosuspend = 1, 3422 .disable_hub_initiated_lpm = 1, 3423}; 3424 3425module_usb_driver(btusb_driver); 3426 3427module_param(disable_scofix, bool, 0644); 3428MODULE_PARM_DESC(disable_scofix, "Disable fixup of wrong SCO buffer size"); 3429 3430module_param(force_scofix, bool, 0644); 3431MODULE_PARM_DESC(force_scofix, "Force fixup of wrong SCO buffers size"); 3432 3433module_param(reset, bool, 0644); 3434MODULE_PARM_DESC(reset, "Send HCI reset command on initialization"); 3435 3436MODULE_AUTHOR("Marcel Holtmann <marcel@holtmann.org>"); 3437MODULE_DESCRIPTION("Generic Bluetooth USB driver ver " VERSION); 3438MODULE_VERSION(VERSION); 3439MODULE_LICENSE("GPL"); 3440