1 /* 2 * 3 * Generic Bluetooth USB driver 4 * 5 * Copyright (C) 2005-2008 Marcel Holtmann <marcel@holtmann.org> 6 * 7 * 8 * This program is free software; you can redistribute it and/or modify 9 * it under the terms of the GNU General Public License as published by 10 * the Free Software Foundation; either version 2 of the License, or 11 * (at your option) any later version. 12 * 13 * This program is distributed in the hope that it will be useful, 14 * but WITHOUT ANY WARRANTY; without even the implied warranty of 15 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the 16 * GNU General Public License for more details. 17 * 18 * You should have received a copy of the GNU General Public License 19 * along with this program; if not, write to the Free Software 20 * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA 21 * 22 */ 23 24 #include <linux/module.h> 25 #include <linux/usb.h> 26 #include <linux/firmware.h> 27 28 #include <net/bluetooth/bluetooth.h> 29 #include <net/bluetooth/hci_core.h> 30 31 #define VERSION "0.6" 32 33 static bool ignore_dga; 34 static bool ignore_csr; 35 static bool ignore_sniffer; 36 static bool disable_scofix; 37 static bool force_scofix; 38 39 static bool reset = 1; 40 41 static struct usb_driver btusb_driver; 42 43 #define BTUSB_IGNORE 0x01 44 #define BTUSB_DIGIANSWER 0x02 45 #define BTUSB_CSR 0x04 46 #define BTUSB_SNIFFER 0x08 47 #define BTUSB_BCM92035 0x10 48 #define BTUSB_BROKEN_ISOC 0x20 49 #define BTUSB_WRONG_SCO_MTU 0x40 50 #define BTUSB_ATH3012 0x80 51 #define BTUSB_INTEL 0x100 52 #define BTUSB_BCM_PATCHRAM 0x200 53 54 static const struct usb_device_id btusb_table[] = { 55 /* Generic Bluetooth USB device */ 56 { USB_DEVICE_INFO(0xe0, 0x01, 0x01) }, 57 58 /* Apple-specific (Broadcom) devices */ 59 { USB_VENDOR_AND_INTERFACE_INFO(0x05ac, 0xff, 0x01, 0x01) }, 60 61 /* MediaTek MT76x0E */ 62 { USB_DEVICE(0x0e8d, 0x763f) }, 63 64 /* Broadcom SoftSailing reporting vendor specific */ 65 { USB_DEVICE(0x0a5c, 0x21e1) }, 66 67 /* Apple MacBookPro 7,1 */ 68 { USB_DEVICE(0x05ac, 0x8213) }, 69 70 /* Apple iMac11,1 */ 71 { USB_DEVICE(0x05ac, 0x8215) }, 72 73 /* Apple MacBookPro6,2 */ 74 { USB_DEVICE(0x05ac, 0x8218) }, 75 76 /* Apple MacBookAir3,1, MacBookAir3,2 */ 77 { USB_DEVICE(0x05ac, 0x821b) }, 78 79 /* Apple MacBookAir4,1 */ 80 { USB_DEVICE(0x05ac, 0x821f) }, 81 82 /* Apple MacBookPro8,2 */ 83 { USB_DEVICE(0x05ac, 0x821a) }, 84 85 /* Apple MacMini5,1 */ 86 { USB_DEVICE(0x05ac, 0x8281) }, 87 88 /* AVM BlueFRITZ! USB v2.0 */ 89 { USB_DEVICE(0x057c, 0x3800) }, 90 91 /* Bluetooth Ultraport Module from IBM */ 92 { USB_DEVICE(0x04bf, 0x030a) }, 93 94 /* ALPS Modules with non-standard id */ 95 { USB_DEVICE(0x044e, 0x3001) }, 96 { USB_DEVICE(0x044e, 0x3002) }, 97 98 /* Ericsson with non-standard id */ 99 { USB_DEVICE(0x0bdb, 0x1002) }, 100 101 /* Canyon CN-BTU1 with HID interfaces */ 102 { USB_DEVICE(0x0c10, 0x0000) }, 103 104 /* Broadcom BCM20702A0 */ 105 { USB_DEVICE(0x0489, 0xe042) }, 106 { USB_DEVICE(0x04ca, 0x2003) }, 107 { USB_DEVICE(0x0b05, 0x17b5) }, 108 { USB_DEVICE(0x0b05, 0x17cb) }, 109 { USB_DEVICE(0x413c, 0x8197) }, 110 111 /* Foxconn - Hon Hai */ 112 { USB_VENDOR_AND_INTERFACE_INFO(0x0489, 0xff, 0x01, 0x01) }, 113 114 /* Broadcom devices with vendor specific id */ 115 { USB_VENDOR_AND_INTERFACE_INFO(0x0a5c, 0xff, 0x01, 0x01), 116 .driver_info = BTUSB_BCM_PATCHRAM }, 117 118 /* Belkin F8065bf - Broadcom based */ 119 { USB_VENDOR_AND_INTERFACE_INFO(0x050d, 0xff, 0x01, 0x01) }, 120 121 /* IMC Networks - Broadcom based */ 122 { USB_VENDOR_AND_INTERFACE_INFO(0x13d3, 0xff, 0x01, 0x01) }, 123 124 { } /* Terminating entry */ 125 }; 126 127 MODULE_DEVICE_TABLE(usb, btusb_table); 128 129 static const struct usb_device_id blacklist_table[] = { 130 /* CSR BlueCore devices */ 131 { USB_DEVICE(0x0a12, 0x0001), .driver_info = BTUSB_CSR }, 132 133 /* Broadcom BCM2033 without firmware */ 134 { USB_DEVICE(0x0a5c, 0x2033), .driver_info = BTUSB_IGNORE }, 135 136 /* Atheros 3011 with sflash firmware */ 137 { USB_DEVICE(0x0489, 0xe027), .driver_info = BTUSB_IGNORE }, 138 { USB_DEVICE(0x0489, 0xe03d), .driver_info = BTUSB_IGNORE }, 139 { USB_DEVICE(0x0930, 0x0215), .driver_info = BTUSB_IGNORE }, 140 { USB_DEVICE(0x0cf3, 0x3002), .driver_info = BTUSB_IGNORE }, 141 { USB_DEVICE(0x0cf3, 0xe019), .driver_info = BTUSB_IGNORE }, 142 { USB_DEVICE(0x13d3, 0x3304), .driver_info = BTUSB_IGNORE }, 143 144 /* Atheros AR9285 Malbec with sflash firmware */ 145 { USB_DEVICE(0x03f0, 0x311d), .driver_info = BTUSB_IGNORE }, 146 147 /* Atheros 3012 with sflash firmware */ 148 { USB_DEVICE(0x0489, 0xe04d), .driver_info = BTUSB_ATH3012 }, 149 { USB_DEVICE(0x0489, 0xe04e), .driver_info = BTUSB_ATH3012 }, 150 { USB_DEVICE(0x0489, 0xe056), .driver_info = BTUSB_ATH3012 }, 151 { USB_DEVICE(0x0489, 0xe057), .driver_info = BTUSB_ATH3012 }, 152 { USB_DEVICE(0x0489, 0xe05f), .driver_info = BTUSB_ATH3012 }, 153 { USB_DEVICE(0x04c5, 0x1330), .driver_info = BTUSB_ATH3012 }, 154 { USB_DEVICE(0x04ca, 0x3004), .driver_info = BTUSB_ATH3012 }, 155 { USB_DEVICE(0x04ca, 0x3005), .driver_info = BTUSB_ATH3012 }, 156 { USB_DEVICE(0x04ca, 0x3006), .driver_info = BTUSB_ATH3012 }, 157 { USB_DEVICE(0x04ca, 0x3007), .driver_info = BTUSB_ATH3012 }, 158 { USB_DEVICE(0x04ca, 0x3008), .driver_info = BTUSB_ATH3012 }, 159 { USB_DEVICE(0x04ca, 0x300b), .driver_info = BTUSB_ATH3012 }, 160 { USB_DEVICE(0x0930, 0x0219), .driver_info = BTUSB_ATH3012 }, 161 { USB_DEVICE(0x0930, 0x0220), .driver_info = BTUSB_ATH3012 }, 162 { USB_DEVICE(0x0b05, 0x17d0), .driver_info = BTUSB_ATH3012 }, 163 { USB_DEVICE(0x0cf3, 0x0036), .driver_info = BTUSB_ATH3012 }, 164 { USB_DEVICE(0x0cf3, 0x3004), .driver_info = BTUSB_ATH3012 }, 165 { USB_DEVICE(0x0cf3, 0x3005), .driver_info = BTUSB_ATH3012 }, 166 { USB_DEVICE(0x0cf3, 0x3008), .driver_info = BTUSB_ATH3012 }, 167 { USB_DEVICE(0x0cf3, 0x311d), .driver_info = BTUSB_ATH3012 }, 168 { USB_DEVICE(0x0cf3, 0x311e), .driver_info = BTUSB_ATH3012 }, 169 { USB_DEVICE(0x0cf3, 0x311f), .driver_info = BTUSB_ATH3012 }, 170 { USB_DEVICE(0x0cf3, 0x3121), .driver_info = BTUSB_ATH3012 }, 171 { USB_DEVICE(0x0cf3, 0x817a), .driver_info = BTUSB_ATH3012 }, 172 { USB_DEVICE(0x0cf3, 0xe003), .driver_info = BTUSB_ATH3012 }, 173 { USB_DEVICE(0x0cf3, 0xe004), .driver_info = BTUSB_ATH3012 }, 174 { USB_DEVICE(0x0cf3, 0xe005), .driver_info = BTUSB_ATH3012 }, 175 { USB_DEVICE(0x13d3, 0x3362), .driver_info = BTUSB_ATH3012 }, 176 { USB_DEVICE(0x13d3, 0x3375), .driver_info = BTUSB_ATH3012 }, 177 { USB_DEVICE(0x13d3, 0x3393), .driver_info = BTUSB_ATH3012 }, 178 { USB_DEVICE(0x13d3, 0x3402), .driver_info = BTUSB_ATH3012 }, 179 180 /* Atheros AR5BBU12 with sflash firmware */ 181 { USB_DEVICE(0x0489, 0xe02c), .driver_info = BTUSB_IGNORE }, 182 183 /* Atheros AR5BBU12 with sflash firmware */ 184 { USB_DEVICE(0x0489, 0xe036), .driver_info = BTUSB_ATH3012 }, 185 { USB_DEVICE(0x0489, 0xe03c), .driver_info = BTUSB_ATH3012 }, 186 187 /* Broadcom BCM2035 */ 188 { USB_DEVICE(0x0a5c, 0x2009), .driver_info = BTUSB_BCM92035 }, 189 { USB_DEVICE(0x0a5c, 0x200a), .driver_info = BTUSB_WRONG_SCO_MTU }, 190 { USB_DEVICE(0x0a5c, 0x2035), .driver_info = BTUSB_WRONG_SCO_MTU }, 191 192 /* Broadcom BCM2045 */ 193 { USB_DEVICE(0x0a5c, 0x2039), .driver_info = BTUSB_WRONG_SCO_MTU }, 194 { USB_DEVICE(0x0a5c, 0x2101), .driver_info = BTUSB_WRONG_SCO_MTU }, 195 196 /* IBM/Lenovo ThinkPad with Broadcom chip */ 197 { USB_DEVICE(0x0a5c, 0x201e), .driver_info = BTUSB_WRONG_SCO_MTU }, 198 { USB_DEVICE(0x0a5c, 0x2110), .driver_info = BTUSB_WRONG_SCO_MTU }, 199 200 /* HP laptop with Broadcom chip */ 201 { USB_DEVICE(0x03f0, 0x171d), .driver_info = BTUSB_WRONG_SCO_MTU }, 202 203 /* Dell laptop with Broadcom chip */ 204 { USB_DEVICE(0x413c, 0x8126), .driver_info = BTUSB_WRONG_SCO_MTU }, 205 206 /* Dell Wireless 370 and 410 devices */ 207 { USB_DEVICE(0x413c, 0x8152), .driver_info = BTUSB_WRONG_SCO_MTU }, 208 { USB_DEVICE(0x413c, 0x8156), .driver_info = BTUSB_WRONG_SCO_MTU }, 209 210 /* Belkin F8T012 and F8T013 devices */ 211 { USB_DEVICE(0x050d, 0x0012), .driver_info = BTUSB_WRONG_SCO_MTU }, 212 { USB_DEVICE(0x050d, 0x0013), .driver_info = BTUSB_WRONG_SCO_MTU }, 213 214 /* Asus WL-BTD202 device */ 215 { USB_DEVICE(0x0b05, 0x1715), .driver_info = BTUSB_WRONG_SCO_MTU }, 216 217 /* Kensington Bluetooth USB adapter */ 218 { USB_DEVICE(0x047d, 0x105e), .driver_info = BTUSB_WRONG_SCO_MTU }, 219 220 /* RTX Telecom based adapters with buggy SCO support */ 221 { USB_DEVICE(0x0400, 0x0807), .driver_info = BTUSB_BROKEN_ISOC }, 222 { USB_DEVICE(0x0400, 0x080a), .driver_info = BTUSB_BROKEN_ISOC }, 223 224 /* CONWISE Technology based adapters with buggy SCO support */ 225 { USB_DEVICE(0x0e5e, 0x6622), .driver_info = BTUSB_BROKEN_ISOC }, 226 227 /* Digianswer devices */ 228 { USB_DEVICE(0x08fd, 0x0001), .driver_info = BTUSB_DIGIANSWER }, 229 { USB_DEVICE(0x08fd, 0x0002), .driver_info = BTUSB_IGNORE }, 230 231 /* CSR BlueCore Bluetooth Sniffer */ 232 { USB_DEVICE(0x0a12, 0x0002), .driver_info = BTUSB_SNIFFER }, 233 234 /* Frontline ComProbe Bluetooth Sniffer */ 235 { USB_DEVICE(0x16d3, 0x0002), .driver_info = BTUSB_SNIFFER }, 236 237 /* Intel Bluetooth device */ 238 { USB_DEVICE(0x8087, 0x07dc), .driver_info = BTUSB_INTEL }, 239 { USB_DEVICE(0x8087, 0x0a2a), .driver_info = BTUSB_INTEL }, 240 241 { } /* Terminating entry */ 242 }; 243 244 #define BTUSB_MAX_ISOC_FRAMES 10 245 246 #define BTUSB_INTR_RUNNING 0 247 #define BTUSB_BULK_RUNNING 1 248 #define BTUSB_ISOC_RUNNING 2 249 #define BTUSB_SUSPENDING 3 250 #define BTUSB_DID_ISO_RESUME 4 251 252 struct btusb_data { 253 struct hci_dev *hdev; 254 struct usb_device *udev; 255 struct usb_interface *intf; 256 struct usb_interface *isoc; 257 258 spinlock_t lock; 259 260 unsigned long flags; 261 262 struct work_struct work; 263 struct work_struct waker; 264 265 struct usb_anchor tx_anchor; 266 struct usb_anchor intr_anchor; 267 struct usb_anchor bulk_anchor; 268 struct usb_anchor isoc_anchor; 269 struct usb_anchor deferred; 270 int tx_in_flight; 271 spinlock_t txlock; 272 273 struct usb_endpoint_descriptor *intr_ep; 274 struct usb_endpoint_descriptor *bulk_tx_ep; 275 struct usb_endpoint_descriptor *bulk_rx_ep; 276 struct usb_endpoint_descriptor *isoc_tx_ep; 277 struct usb_endpoint_descriptor *isoc_rx_ep; 278 279 __u8 cmdreq_type; 280 281 unsigned int sco_num; 282 int isoc_altsetting; 283 int suspend_count; 284 }; 285 286 static int inc_tx(struct btusb_data *data) 287 { 288 unsigned long flags; 289 int rv; 290 291 spin_lock_irqsave(&data->txlock, flags); 292 rv = test_bit(BTUSB_SUSPENDING, &data->flags); 293 if (!rv) 294 data->tx_in_flight++; 295 spin_unlock_irqrestore(&data->txlock, flags); 296 297 return rv; 298 } 299 300 static void btusb_intr_complete(struct urb *urb) 301 { 302 struct hci_dev *hdev = urb->context; 303 struct btusb_data *data = hci_get_drvdata(hdev); 304 int err; 305 306 BT_DBG("%s urb %p status %d count %d", hdev->name, 307 urb, urb->status, urb->actual_length); 308 309 if (!test_bit(HCI_RUNNING, &hdev->flags)) 310 return; 311 312 if (urb->status == 0) { 313 hdev->stat.byte_rx += urb->actual_length; 314 315 if (hci_recv_fragment(hdev, HCI_EVENT_PKT, 316 urb->transfer_buffer, 317 urb->actual_length) < 0) { 318 BT_ERR("%s corrupted event packet", hdev->name); 319 hdev->stat.err_rx++; 320 } 321 } 322 323 if (!test_bit(BTUSB_INTR_RUNNING, &data->flags)) 324 return; 325 326 usb_mark_last_busy(data->udev); 327 usb_anchor_urb(urb, &data->intr_anchor); 328 329 err = usb_submit_urb(urb, GFP_ATOMIC); 330 if (err < 0) { 331 /* -EPERM: urb is being killed; 332 * -ENODEV: device got disconnected */ 333 if (err != -EPERM && err != -ENODEV) 334 BT_ERR("%s urb %p failed to resubmit (%d)", 335 hdev->name, urb, -err); 336 usb_unanchor_urb(urb); 337 } 338 } 339 340 static int btusb_submit_intr_urb(struct hci_dev *hdev, gfp_t mem_flags) 341 { 342 struct btusb_data *data = hci_get_drvdata(hdev); 343 struct urb *urb; 344 unsigned char *buf; 345 unsigned int pipe; 346 int err, size; 347 348 BT_DBG("%s", hdev->name); 349 350 if (!data->intr_ep) 351 return -ENODEV; 352 353 urb = usb_alloc_urb(0, mem_flags); 354 if (!urb) 355 return -ENOMEM; 356 357 size = le16_to_cpu(data->intr_ep->wMaxPacketSize); 358 359 buf = kmalloc(size, mem_flags); 360 if (!buf) { 361 usb_free_urb(urb); 362 return -ENOMEM; 363 } 364 365 pipe = usb_rcvintpipe(data->udev, data->intr_ep->bEndpointAddress); 366 367 usb_fill_int_urb(urb, data->udev, pipe, buf, size, 368 btusb_intr_complete, hdev, 369 data->intr_ep->bInterval); 370 371 urb->transfer_flags |= URB_FREE_BUFFER; 372 373 usb_anchor_urb(urb, &data->intr_anchor); 374 375 err = usb_submit_urb(urb, mem_flags); 376 if (err < 0) { 377 if (err != -EPERM && err != -ENODEV) 378 BT_ERR("%s urb %p submission failed (%d)", 379 hdev->name, urb, -err); 380 usb_unanchor_urb(urb); 381 } 382 383 usb_free_urb(urb); 384 385 return err; 386 } 387 388 static void btusb_bulk_complete(struct urb *urb) 389 { 390 struct hci_dev *hdev = urb->context; 391 struct btusb_data *data = hci_get_drvdata(hdev); 392 int err; 393 394 BT_DBG("%s urb %p status %d count %d", hdev->name, 395 urb, urb->status, urb->actual_length); 396 397 if (!test_bit(HCI_RUNNING, &hdev->flags)) 398 return; 399 400 if (urb->status == 0) { 401 hdev->stat.byte_rx += urb->actual_length; 402 403 if (hci_recv_fragment(hdev, HCI_ACLDATA_PKT, 404 urb->transfer_buffer, 405 urb->actual_length) < 0) { 406 BT_ERR("%s corrupted ACL packet", hdev->name); 407 hdev->stat.err_rx++; 408 } 409 } 410 411 if (!test_bit(BTUSB_BULK_RUNNING, &data->flags)) 412 return; 413 414 usb_anchor_urb(urb, &data->bulk_anchor); 415 usb_mark_last_busy(data->udev); 416 417 err = usb_submit_urb(urb, GFP_ATOMIC); 418 if (err < 0) { 419 /* -EPERM: urb is being killed; 420 * -ENODEV: device got disconnected */ 421 if (err != -EPERM && err != -ENODEV) 422 BT_ERR("%s urb %p failed to resubmit (%d)", 423 hdev->name, urb, -err); 424 usb_unanchor_urb(urb); 425 } 426 } 427 428 static int btusb_submit_bulk_urb(struct hci_dev *hdev, gfp_t mem_flags) 429 { 430 struct btusb_data *data = hci_get_drvdata(hdev); 431 struct urb *urb; 432 unsigned char *buf; 433 unsigned int pipe; 434 int err, size = HCI_MAX_FRAME_SIZE; 435 436 BT_DBG("%s", hdev->name); 437 438 if (!data->bulk_rx_ep) 439 return -ENODEV; 440 441 urb = usb_alloc_urb(0, mem_flags); 442 if (!urb) 443 return -ENOMEM; 444 445 buf = kmalloc(size, mem_flags); 446 if (!buf) { 447 usb_free_urb(urb); 448 return -ENOMEM; 449 } 450 451 pipe = usb_rcvbulkpipe(data->udev, data->bulk_rx_ep->bEndpointAddress); 452 453 usb_fill_bulk_urb(urb, data->udev, pipe, 454 buf, size, btusb_bulk_complete, hdev); 455 456 urb->transfer_flags |= URB_FREE_BUFFER; 457 458 usb_mark_last_busy(data->udev); 459 usb_anchor_urb(urb, &data->bulk_anchor); 460 461 err = usb_submit_urb(urb, mem_flags); 462 if (err < 0) { 463 if (err != -EPERM && err != -ENODEV) 464 BT_ERR("%s urb %p submission failed (%d)", 465 hdev->name, urb, -err); 466 usb_unanchor_urb(urb); 467 } 468 469 usb_free_urb(urb); 470 471 return err; 472 } 473 474 static void btusb_isoc_complete(struct urb *urb) 475 { 476 struct hci_dev *hdev = urb->context; 477 struct btusb_data *data = hci_get_drvdata(hdev); 478 int i, err; 479 480 BT_DBG("%s urb %p status %d count %d", hdev->name, 481 urb, urb->status, urb->actual_length); 482 483 if (!test_bit(HCI_RUNNING, &hdev->flags)) 484 return; 485 486 if (urb->status == 0) { 487 for (i = 0; i < urb->number_of_packets; i++) { 488 unsigned int offset = urb->iso_frame_desc[i].offset; 489 unsigned int length = urb->iso_frame_desc[i].actual_length; 490 491 if (urb->iso_frame_desc[i].status) 492 continue; 493 494 hdev->stat.byte_rx += length; 495 496 if (hci_recv_fragment(hdev, HCI_SCODATA_PKT, 497 urb->transfer_buffer + offset, 498 length) < 0) { 499 BT_ERR("%s corrupted SCO packet", hdev->name); 500 hdev->stat.err_rx++; 501 } 502 } 503 } 504 505 if (!test_bit(BTUSB_ISOC_RUNNING, &data->flags)) 506 return; 507 508 usb_anchor_urb(urb, &data->isoc_anchor); 509 510 err = usb_submit_urb(urb, GFP_ATOMIC); 511 if (err < 0) { 512 /* -EPERM: urb is being killed; 513 * -ENODEV: device got disconnected */ 514 if (err != -EPERM && err != -ENODEV) 515 BT_ERR("%s urb %p failed to resubmit (%d)", 516 hdev->name, urb, -err); 517 usb_unanchor_urb(urb); 518 } 519 } 520 521 static inline void __fill_isoc_descriptor(struct urb *urb, int len, int mtu) 522 { 523 int i, offset = 0; 524 525 BT_DBG("len %d mtu %d", len, mtu); 526 527 for (i = 0; i < BTUSB_MAX_ISOC_FRAMES && len >= mtu; 528 i++, offset += mtu, len -= mtu) { 529 urb->iso_frame_desc[i].offset = offset; 530 urb->iso_frame_desc[i].length = mtu; 531 } 532 533 if (len && i < BTUSB_MAX_ISOC_FRAMES) { 534 urb->iso_frame_desc[i].offset = offset; 535 urb->iso_frame_desc[i].length = len; 536 i++; 537 } 538 539 urb->number_of_packets = i; 540 } 541 542 static int btusb_submit_isoc_urb(struct hci_dev *hdev, gfp_t mem_flags) 543 { 544 struct btusb_data *data = hci_get_drvdata(hdev); 545 struct urb *urb; 546 unsigned char *buf; 547 unsigned int pipe; 548 int err, size; 549 550 BT_DBG("%s", hdev->name); 551 552 if (!data->isoc_rx_ep) 553 return -ENODEV; 554 555 urb = usb_alloc_urb(BTUSB_MAX_ISOC_FRAMES, mem_flags); 556 if (!urb) 557 return -ENOMEM; 558 559 size = le16_to_cpu(data->isoc_rx_ep->wMaxPacketSize) * 560 BTUSB_MAX_ISOC_FRAMES; 561 562 buf = kmalloc(size, mem_flags); 563 if (!buf) { 564 usb_free_urb(urb); 565 return -ENOMEM; 566 } 567 568 pipe = usb_rcvisocpipe(data->udev, data->isoc_rx_ep->bEndpointAddress); 569 570 usb_fill_int_urb(urb, data->udev, pipe, buf, size, btusb_isoc_complete, 571 hdev, data->isoc_rx_ep->bInterval); 572 573 urb->transfer_flags = URB_FREE_BUFFER | URB_ISO_ASAP; 574 575 __fill_isoc_descriptor(urb, size, 576 le16_to_cpu(data->isoc_rx_ep->wMaxPacketSize)); 577 578 usb_anchor_urb(urb, &data->isoc_anchor); 579 580 err = usb_submit_urb(urb, mem_flags); 581 if (err < 0) { 582 if (err != -EPERM && err != -ENODEV) 583 BT_ERR("%s urb %p submission failed (%d)", 584 hdev->name, urb, -err); 585 usb_unanchor_urb(urb); 586 } 587 588 usb_free_urb(urb); 589 590 return err; 591 } 592 593 static void btusb_tx_complete(struct urb *urb) 594 { 595 struct sk_buff *skb = urb->context; 596 struct hci_dev *hdev = (struct hci_dev *) skb->dev; 597 struct btusb_data *data = hci_get_drvdata(hdev); 598 599 BT_DBG("%s urb %p status %d count %d", hdev->name, 600 urb, urb->status, urb->actual_length); 601 602 if (!test_bit(HCI_RUNNING, &hdev->flags)) 603 goto done; 604 605 if (!urb->status) 606 hdev->stat.byte_tx += urb->transfer_buffer_length; 607 else 608 hdev->stat.err_tx++; 609 610 done: 611 spin_lock(&data->txlock); 612 data->tx_in_flight--; 613 spin_unlock(&data->txlock); 614 615 kfree(urb->setup_packet); 616 617 kfree_skb(skb); 618 } 619 620 static void btusb_isoc_tx_complete(struct urb *urb) 621 { 622 struct sk_buff *skb = urb->context; 623 struct hci_dev *hdev = (struct hci_dev *) skb->dev; 624 625 BT_DBG("%s urb %p status %d count %d", hdev->name, 626 urb, urb->status, urb->actual_length); 627 628 if (!test_bit(HCI_RUNNING, &hdev->flags)) 629 goto done; 630 631 if (!urb->status) 632 hdev->stat.byte_tx += urb->transfer_buffer_length; 633 else 634 hdev->stat.err_tx++; 635 636 done: 637 kfree(urb->setup_packet); 638 639 kfree_skb(skb); 640 } 641 642 static int btusb_open(struct hci_dev *hdev) 643 { 644 struct btusb_data *data = hci_get_drvdata(hdev); 645 int err; 646 647 BT_DBG("%s", hdev->name); 648 649 err = usb_autopm_get_interface(data->intf); 650 if (err < 0) 651 return err; 652 653 data->intf->needs_remote_wakeup = 1; 654 655 if (test_and_set_bit(HCI_RUNNING, &hdev->flags)) 656 goto done; 657 658 if (test_and_set_bit(BTUSB_INTR_RUNNING, &data->flags)) 659 goto done; 660 661 err = btusb_submit_intr_urb(hdev, GFP_KERNEL); 662 if (err < 0) 663 goto failed; 664 665 err = btusb_submit_bulk_urb(hdev, GFP_KERNEL); 666 if (err < 0) { 667 usb_kill_anchored_urbs(&data->intr_anchor); 668 goto failed; 669 } 670 671 set_bit(BTUSB_BULK_RUNNING, &data->flags); 672 btusb_submit_bulk_urb(hdev, GFP_KERNEL); 673 674 done: 675 usb_autopm_put_interface(data->intf); 676 return 0; 677 678 failed: 679 clear_bit(BTUSB_INTR_RUNNING, &data->flags); 680 clear_bit(HCI_RUNNING, &hdev->flags); 681 usb_autopm_put_interface(data->intf); 682 return err; 683 } 684 685 static void btusb_stop_traffic(struct btusb_data *data) 686 { 687 usb_kill_anchored_urbs(&data->intr_anchor); 688 usb_kill_anchored_urbs(&data->bulk_anchor); 689 usb_kill_anchored_urbs(&data->isoc_anchor); 690 } 691 692 static int btusb_close(struct hci_dev *hdev) 693 { 694 struct btusb_data *data = hci_get_drvdata(hdev); 695 int err; 696 697 BT_DBG("%s", hdev->name); 698 699 if (!test_and_clear_bit(HCI_RUNNING, &hdev->flags)) 700 return 0; 701 702 cancel_work_sync(&data->work); 703 cancel_work_sync(&data->waker); 704 705 clear_bit(BTUSB_ISOC_RUNNING, &data->flags); 706 clear_bit(BTUSB_BULK_RUNNING, &data->flags); 707 clear_bit(BTUSB_INTR_RUNNING, &data->flags); 708 709 btusb_stop_traffic(data); 710 err = usb_autopm_get_interface(data->intf); 711 if (err < 0) 712 goto failed; 713 714 data->intf->needs_remote_wakeup = 0; 715 usb_autopm_put_interface(data->intf); 716 717 failed: 718 usb_scuttle_anchored_urbs(&data->deferred); 719 return 0; 720 } 721 722 static int btusb_flush(struct hci_dev *hdev) 723 { 724 struct btusb_data *data = hci_get_drvdata(hdev); 725 726 BT_DBG("%s", hdev->name); 727 728 usb_kill_anchored_urbs(&data->tx_anchor); 729 730 return 0; 731 } 732 733 static int btusb_send_frame(struct hci_dev *hdev, struct sk_buff *skb) 734 { 735 struct btusb_data *data = hci_get_drvdata(hdev); 736 struct usb_ctrlrequest *dr; 737 struct urb *urb; 738 unsigned int pipe; 739 int err; 740 741 BT_DBG("%s", hdev->name); 742 743 if (!test_bit(HCI_RUNNING, &hdev->flags)) 744 return -EBUSY; 745 746 skb->dev = (void *) hdev; 747 748 switch (bt_cb(skb)->pkt_type) { 749 case HCI_COMMAND_PKT: 750 urb = usb_alloc_urb(0, GFP_ATOMIC); 751 if (!urb) 752 return -ENOMEM; 753 754 dr = kmalloc(sizeof(*dr), GFP_ATOMIC); 755 if (!dr) { 756 usb_free_urb(urb); 757 return -ENOMEM; 758 } 759 760 dr->bRequestType = data->cmdreq_type; 761 dr->bRequest = 0; 762 dr->wIndex = 0; 763 dr->wValue = 0; 764 dr->wLength = __cpu_to_le16(skb->len); 765 766 pipe = usb_sndctrlpipe(data->udev, 0x00); 767 768 usb_fill_control_urb(urb, data->udev, pipe, (void *) dr, 769 skb->data, skb->len, btusb_tx_complete, skb); 770 771 hdev->stat.cmd_tx++; 772 break; 773 774 case HCI_ACLDATA_PKT: 775 if (!data->bulk_tx_ep) 776 return -ENODEV; 777 778 urb = usb_alloc_urb(0, GFP_ATOMIC); 779 if (!urb) 780 return -ENOMEM; 781 782 pipe = usb_sndbulkpipe(data->udev, 783 data->bulk_tx_ep->bEndpointAddress); 784 785 usb_fill_bulk_urb(urb, data->udev, pipe, 786 skb->data, skb->len, btusb_tx_complete, skb); 787 788 hdev->stat.acl_tx++; 789 break; 790 791 case HCI_SCODATA_PKT: 792 if (!data->isoc_tx_ep || hci_conn_num(hdev, SCO_LINK) < 1) 793 return -ENODEV; 794 795 urb = usb_alloc_urb(BTUSB_MAX_ISOC_FRAMES, GFP_ATOMIC); 796 if (!urb) 797 return -ENOMEM; 798 799 pipe = usb_sndisocpipe(data->udev, 800 data->isoc_tx_ep->bEndpointAddress); 801 802 usb_fill_int_urb(urb, data->udev, pipe, 803 skb->data, skb->len, btusb_isoc_tx_complete, 804 skb, data->isoc_tx_ep->bInterval); 805 806 urb->transfer_flags = URB_ISO_ASAP; 807 808 __fill_isoc_descriptor(urb, skb->len, 809 le16_to_cpu(data->isoc_tx_ep->wMaxPacketSize)); 810 811 hdev->stat.sco_tx++; 812 goto skip_waking; 813 814 default: 815 return -EILSEQ; 816 } 817 818 err = inc_tx(data); 819 if (err) { 820 usb_anchor_urb(urb, &data->deferred); 821 schedule_work(&data->waker); 822 err = 0; 823 goto done; 824 } 825 826 skip_waking: 827 usb_anchor_urb(urb, &data->tx_anchor); 828 829 err = usb_submit_urb(urb, GFP_ATOMIC); 830 if (err < 0) { 831 if (err != -EPERM && err != -ENODEV) 832 BT_ERR("%s urb %p submission failed (%d)", 833 hdev->name, urb, -err); 834 kfree(urb->setup_packet); 835 usb_unanchor_urb(urb); 836 } else { 837 usb_mark_last_busy(data->udev); 838 } 839 840 done: 841 usb_free_urb(urb); 842 return err; 843 } 844 845 static void btusb_notify(struct hci_dev *hdev, unsigned int evt) 846 { 847 struct btusb_data *data = hci_get_drvdata(hdev); 848 849 BT_DBG("%s evt %d", hdev->name, evt); 850 851 if (hci_conn_num(hdev, SCO_LINK) != data->sco_num) { 852 data->sco_num = hci_conn_num(hdev, SCO_LINK); 853 schedule_work(&data->work); 854 } 855 } 856 857 static inline int __set_isoc_interface(struct hci_dev *hdev, int altsetting) 858 { 859 struct btusb_data *data = hci_get_drvdata(hdev); 860 struct usb_interface *intf = data->isoc; 861 struct usb_endpoint_descriptor *ep_desc; 862 int i, err; 863 864 if (!data->isoc) 865 return -ENODEV; 866 867 err = usb_set_interface(data->udev, 1, altsetting); 868 if (err < 0) { 869 BT_ERR("%s setting interface failed (%d)", hdev->name, -err); 870 return err; 871 } 872 873 data->isoc_altsetting = altsetting; 874 875 data->isoc_tx_ep = NULL; 876 data->isoc_rx_ep = NULL; 877 878 for (i = 0; i < intf->cur_altsetting->desc.bNumEndpoints; i++) { 879 ep_desc = &intf->cur_altsetting->endpoint[i].desc; 880 881 if (!data->isoc_tx_ep && usb_endpoint_is_isoc_out(ep_desc)) { 882 data->isoc_tx_ep = ep_desc; 883 continue; 884 } 885 886 if (!data->isoc_rx_ep && usb_endpoint_is_isoc_in(ep_desc)) { 887 data->isoc_rx_ep = ep_desc; 888 continue; 889 } 890 } 891 892 if (!data->isoc_tx_ep || !data->isoc_rx_ep) { 893 BT_ERR("%s invalid SCO descriptors", hdev->name); 894 return -ENODEV; 895 } 896 897 return 0; 898 } 899 900 static void btusb_work(struct work_struct *work) 901 { 902 struct btusb_data *data = container_of(work, struct btusb_data, work); 903 struct hci_dev *hdev = data->hdev; 904 int new_alts; 905 int err; 906 907 if (data->sco_num > 0) { 908 if (!test_bit(BTUSB_DID_ISO_RESUME, &data->flags)) { 909 err = usb_autopm_get_interface(data->isoc ? data->isoc : data->intf); 910 if (err < 0) { 911 clear_bit(BTUSB_ISOC_RUNNING, &data->flags); 912 usb_kill_anchored_urbs(&data->isoc_anchor); 913 return; 914 } 915 916 set_bit(BTUSB_DID_ISO_RESUME, &data->flags); 917 } 918 919 if (hdev->voice_setting & 0x0020) { 920 static const int alts[3] = { 2, 4, 5 }; 921 new_alts = alts[data->sco_num - 1]; 922 } else { 923 new_alts = data->sco_num; 924 } 925 926 if (data->isoc_altsetting != new_alts) { 927 clear_bit(BTUSB_ISOC_RUNNING, &data->flags); 928 usb_kill_anchored_urbs(&data->isoc_anchor); 929 930 if (__set_isoc_interface(hdev, new_alts) < 0) 931 return; 932 } 933 934 if (!test_and_set_bit(BTUSB_ISOC_RUNNING, &data->flags)) { 935 if (btusb_submit_isoc_urb(hdev, GFP_KERNEL) < 0) 936 clear_bit(BTUSB_ISOC_RUNNING, &data->flags); 937 else 938 btusb_submit_isoc_urb(hdev, GFP_KERNEL); 939 } 940 } else { 941 clear_bit(BTUSB_ISOC_RUNNING, &data->flags); 942 usb_kill_anchored_urbs(&data->isoc_anchor); 943 944 __set_isoc_interface(hdev, 0); 945 if (test_and_clear_bit(BTUSB_DID_ISO_RESUME, &data->flags)) 946 usb_autopm_put_interface(data->isoc ? data->isoc : data->intf); 947 } 948 } 949 950 static void btusb_waker(struct work_struct *work) 951 { 952 struct btusb_data *data = container_of(work, struct btusb_data, waker); 953 int err; 954 955 err = usb_autopm_get_interface(data->intf); 956 if (err < 0) 957 return; 958 959 usb_autopm_put_interface(data->intf); 960 } 961 962 static int btusb_setup_bcm92035(struct hci_dev *hdev) 963 { 964 struct sk_buff *skb; 965 u8 val = 0x00; 966 967 BT_DBG("%s", hdev->name); 968 969 skb = __hci_cmd_sync(hdev, 0xfc3b, 1, &val, HCI_INIT_TIMEOUT); 970 if (IS_ERR(skb)) 971 BT_ERR("BCM92035 command failed (%ld)", -PTR_ERR(skb)); 972 else 973 kfree_skb(skb); 974 975 return 0; 976 } 977 978 static int btusb_setup_csr(struct hci_dev *hdev) 979 { 980 struct hci_rp_read_local_version *rp; 981 struct sk_buff *skb; 982 int ret; 983 984 BT_DBG("%s", hdev->name); 985 986 skb = __hci_cmd_sync(hdev, HCI_OP_READ_LOCAL_VERSION, 0, NULL, 987 HCI_INIT_TIMEOUT); 988 if (IS_ERR(skb)) { 989 BT_ERR("Reading local version failed (%ld)", -PTR_ERR(skb)); 990 return -PTR_ERR(skb); 991 } 992 993 rp = (struct hci_rp_read_local_version *) skb->data; 994 995 if (!rp->status) { 996 if (le16_to_cpu(rp->manufacturer) != 10) { 997 /* Clear the reset quirk since this is not an actual 998 * early Bluetooth 1.1 device from CSR. 999 */ 1000 clear_bit(HCI_QUIRK_RESET_ON_CLOSE, &hdev->quirks); 1001 1002 /* These fake CSR controllers have all a broken 1003 * stored link key handling and so just disable it. 1004 */ 1005 set_bit(HCI_QUIRK_BROKEN_STORED_LINK_KEY, 1006 &hdev->quirks); 1007 } 1008 } 1009 1010 ret = -bt_to_errno(rp->status); 1011 1012 kfree_skb(skb); 1013 1014 return ret; 1015 } 1016 1017 struct intel_version { 1018 u8 status; 1019 u8 hw_platform; 1020 u8 hw_variant; 1021 u8 hw_revision; 1022 u8 fw_variant; 1023 u8 fw_revision; 1024 u8 fw_build_num; 1025 u8 fw_build_ww; 1026 u8 fw_build_yy; 1027 u8 fw_patch_num; 1028 } __packed; 1029 1030 static const struct firmware *btusb_setup_intel_get_fw(struct hci_dev *hdev, 1031 struct intel_version *ver) 1032 { 1033 const struct firmware *fw; 1034 char fwname[64]; 1035 int ret; 1036 1037 snprintf(fwname, sizeof(fwname), 1038 "intel/ibt-hw-%x.%x.%x-fw-%x.%x.%x.%x.%x.bseq", 1039 ver->hw_platform, ver->hw_variant, ver->hw_revision, 1040 ver->fw_variant, ver->fw_revision, ver->fw_build_num, 1041 ver->fw_build_ww, ver->fw_build_yy); 1042 1043 ret = request_firmware(&fw, fwname, &hdev->dev); 1044 if (ret < 0) { 1045 if (ret == -EINVAL) { 1046 BT_ERR("%s Intel firmware file request failed (%d)", 1047 hdev->name, ret); 1048 return NULL; 1049 } 1050 1051 BT_ERR("%s failed to open Intel firmware file: %s(%d)", 1052 hdev->name, fwname, ret); 1053 1054 /* If the correct firmware patch file is not found, use the 1055 * default firmware patch file instead 1056 */ 1057 snprintf(fwname, sizeof(fwname), "intel/ibt-hw-%x.%x.bseq", 1058 ver->hw_platform, ver->hw_variant); 1059 if (request_firmware(&fw, fwname, &hdev->dev) < 0) { 1060 BT_ERR("%s failed to open default Intel fw file: %s", 1061 hdev->name, fwname); 1062 return NULL; 1063 } 1064 } 1065 1066 BT_INFO("%s: Intel Bluetooth firmware file: %s", hdev->name, fwname); 1067 1068 return fw; 1069 } 1070 1071 static int btusb_setup_intel_patching(struct hci_dev *hdev, 1072 const struct firmware *fw, 1073 const u8 **fw_ptr, int *disable_patch) 1074 { 1075 struct sk_buff *skb; 1076 struct hci_command_hdr *cmd; 1077 const u8 *cmd_param; 1078 struct hci_event_hdr *evt = NULL; 1079 const u8 *evt_param = NULL; 1080 int remain = fw->size - (*fw_ptr - fw->data); 1081 1082 /* The first byte indicates the types of the patch command or event. 1083 * 0x01 means HCI command and 0x02 is HCI event. If the first bytes 1084 * in the current firmware buffer doesn't start with 0x01 or 1085 * the size of remain buffer is smaller than HCI command header, 1086 * the firmware file is corrupted and it should stop the patching 1087 * process. 1088 */ 1089 if (remain > HCI_COMMAND_HDR_SIZE && *fw_ptr[0] != 0x01) { 1090 BT_ERR("%s Intel fw corrupted: invalid cmd read", hdev->name); 1091 return -EINVAL; 1092 } 1093 (*fw_ptr)++; 1094 remain--; 1095 1096 cmd = (struct hci_command_hdr *)(*fw_ptr); 1097 *fw_ptr += sizeof(*cmd); 1098 remain -= sizeof(*cmd); 1099 1100 /* Ensure that the remain firmware data is long enough than the length 1101 * of command parameter. If not, the firmware file is corrupted. 1102 */ 1103 if (remain < cmd->plen) { 1104 BT_ERR("%s Intel fw corrupted: invalid cmd len", hdev->name); 1105 return -EFAULT; 1106 } 1107 1108 /* If there is a command that loads a patch in the firmware 1109 * file, then enable the patch upon success, otherwise just 1110 * disable the manufacturer mode, for example patch activation 1111 * is not required when the default firmware patch file is used 1112 * because there are no patch data to load. 1113 */ 1114 if (*disable_patch && le16_to_cpu(cmd->opcode) == 0xfc8e) 1115 *disable_patch = 0; 1116 1117 cmd_param = *fw_ptr; 1118 *fw_ptr += cmd->plen; 1119 remain -= cmd->plen; 1120 1121 /* This reads the expected events when the above command is sent to the 1122 * device. Some vendor commands expects more than one events, for 1123 * example command status event followed by vendor specific event. 1124 * For this case, it only keeps the last expected event. so the command 1125 * can be sent with __hci_cmd_sync_ev() which returns the sk_buff of 1126 * last expected event. 1127 */ 1128 while (remain > HCI_EVENT_HDR_SIZE && *fw_ptr[0] == 0x02) { 1129 (*fw_ptr)++; 1130 remain--; 1131 1132 evt = (struct hci_event_hdr *)(*fw_ptr); 1133 *fw_ptr += sizeof(*evt); 1134 remain -= sizeof(*evt); 1135 1136 if (remain < evt->plen) { 1137 BT_ERR("%s Intel fw corrupted: invalid evt len", 1138 hdev->name); 1139 return -EFAULT; 1140 } 1141 1142 evt_param = *fw_ptr; 1143 *fw_ptr += evt->plen; 1144 remain -= evt->plen; 1145 } 1146 1147 /* Every HCI commands in the firmware file has its correspond event. 1148 * If event is not found or remain is smaller than zero, the firmware 1149 * file is corrupted. 1150 */ 1151 if (!evt || !evt_param || remain < 0) { 1152 BT_ERR("%s Intel fw corrupted: invalid evt read", hdev->name); 1153 return -EFAULT; 1154 } 1155 1156 skb = __hci_cmd_sync_ev(hdev, le16_to_cpu(cmd->opcode), cmd->plen, 1157 cmd_param, evt->evt, HCI_INIT_TIMEOUT); 1158 if (IS_ERR(skb)) { 1159 BT_ERR("%s sending Intel patch command (0x%4.4x) failed (%ld)", 1160 hdev->name, cmd->opcode, PTR_ERR(skb)); 1161 return PTR_ERR(skb); 1162 } 1163 1164 /* It ensures that the returned event matches the event data read from 1165 * the firmware file. At fist, it checks the length and then 1166 * the contents of the event. 1167 */ 1168 if (skb->len != evt->plen) { 1169 BT_ERR("%s mismatch event length (opcode 0x%4.4x)", hdev->name, 1170 le16_to_cpu(cmd->opcode)); 1171 kfree_skb(skb); 1172 return -EFAULT; 1173 } 1174 1175 if (memcmp(skb->data, evt_param, evt->plen)) { 1176 BT_ERR("%s mismatch event parameter (opcode 0x%4.4x)", 1177 hdev->name, le16_to_cpu(cmd->opcode)); 1178 kfree_skb(skb); 1179 return -EFAULT; 1180 } 1181 kfree_skb(skb); 1182 1183 return 0; 1184 } 1185 1186 static int btusb_setup_intel(struct hci_dev *hdev) 1187 { 1188 struct sk_buff *skb; 1189 const struct firmware *fw; 1190 const u8 *fw_ptr; 1191 int disable_patch; 1192 struct intel_version *ver; 1193 1194 const u8 mfg_enable[] = { 0x01, 0x00 }; 1195 const u8 mfg_disable[] = { 0x00, 0x00 }; 1196 const u8 mfg_reset_deactivate[] = { 0x00, 0x01 }; 1197 const u8 mfg_reset_activate[] = { 0x00, 0x02 }; 1198 1199 BT_DBG("%s", hdev->name); 1200 1201 /* The controller has a bug with the first HCI command sent to it 1202 * returning number of completed commands as zero. This would stall the 1203 * command processing in the Bluetooth core. 1204 * 1205 * As a workaround, send HCI Reset command first which will reset the 1206 * number of completed commands and allow normal command processing 1207 * from now on. 1208 */ 1209 skb = __hci_cmd_sync(hdev, HCI_OP_RESET, 0, NULL, HCI_INIT_TIMEOUT); 1210 if (IS_ERR(skb)) { 1211 BT_ERR("%s sending initial HCI reset command failed (%ld)", 1212 hdev->name, PTR_ERR(skb)); 1213 return PTR_ERR(skb); 1214 } 1215 kfree_skb(skb); 1216 1217 /* Read Intel specific controller version first to allow selection of 1218 * which firmware file to load. 1219 * 1220 * The returned information are hardware variant and revision plus 1221 * firmware variant, revision and build number. 1222 */ 1223 skb = __hci_cmd_sync(hdev, 0xfc05, 0, NULL, HCI_INIT_TIMEOUT); 1224 if (IS_ERR(skb)) { 1225 BT_ERR("%s reading Intel fw version command failed (%ld)", 1226 hdev->name, PTR_ERR(skb)); 1227 return PTR_ERR(skb); 1228 } 1229 1230 if (skb->len != sizeof(*ver)) { 1231 BT_ERR("%s Intel version event length mismatch", hdev->name); 1232 kfree_skb(skb); 1233 return -EIO; 1234 } 1235 1236 ver = (struct intel_version *)skb->data; 1237 if (ver->status) { 1238 BT_ERR("%s Intel fw version event failed (%02x)", hdev->name, 1239 ver->status); 1240 kfree_skb(skb); 1241 return -bt_to_errno(ver->status); 1242 } 1243 1244 BT_INFO("%s: read Intel version: %02x%02x%02x%02x%02x%02x%02x%02x%02x", 1245 hdev->name, ver->hw_platform, ver->hw_variant, 1246 ver->hw_revision, ver->fw_variant, ver->fw_revision, 1247 ver->fw_build_num, ver->fw_build_ww, ver->fw_build_yy, 1248 ver->fw_patch_num); 1249 1250 /* fw_patch_num indicates the version of patch the device currently 1251 * have. If there is no patch data in the device, it is always 0x00. 1252 * So, if it is other than 0x00, no need to patch the deivce again. 1253 */ 1254 if (ver->fw_patch_num) { 1255 BT_INFO("%s: Intel device is already patched. patch num: %02x", 1256 hdev->name, ver->fw_patch_num); 1257 kfree_skb(skb); 1258 return 0; 1259 } 1260 1261 /* Opens the firmware patch file based on the firmware version read 1262 * from the controller. If it fails to open the matching firmware 1263 * patch file, it tries to open the default firmware patch file. 1264 * If no patch file is found, allow the device to operate without 1265 * a patch. 1266 */ 1267 fw = btusb_setup_intel_get_fw(hdev, ver); 1268 if (!fw) { 1269 kfree_skb(skb); 1270 return 0; 1271 } 1272 fw_ptr = fw->data; 1273 1274 /* This Intel specific command enables the manufacturer mode of the 1275 * controller. 1276 * 1277 * Only while this mode is enabled, the driver can download the 1278 * firmware patch data and configuration parameters. 1279 */ 1280 skb = __hci_cmd_sync(hdev, 0xfc11, 2, mfg_enable, HCI_INIT_TIMEOUT); 1281 if (IS_ERR(skb)) { 1282 BT_ERR("%s entering Intel manufacturer mode failed (%ld)", 1283 hdev->name, PTR_ERR(skb)); 1284 release_firmware(fw); 1285 return PTR_ERR(skb); 1286 } 1287 1288 if (skb->data[0]) { 1289 u8 evt_status = skb->data[0]; 1290 BT_ERR("%s enable Intel manufacturer mode event failed (%02x)", 1291 hdev->name, evt_status); 1292 kfree_skb(skb); 1293 release_firmware(fw); 1294 return -bt_to_errno(evt_status); 1295 } 1296 kfree_skb(skb); 1297 1298 disable_patch = 1; 1299 1300 /* The firmware data file consists of list of Intel specific HCI 1301 * commands and its expected events. The first byte indicates the 1302 * type of the message, either HCI command or HCI event. 1303 * 1304 * It reads the command and its expected event from the firmware file, 1305 * and send to the controller. Once __hci_cmd_sync_ev() returns, 1306 * the returned event is compared with the event read from the firmware 1307 * file and it will continue until all the messages are downloaded to 1308 * the controller. 1309 * 1310 * Once the firmware patching is completed successfully, 1311 * the manufacturer mode is disabled with reset and activating the 1312 * downloaded patch. 1313 * 1314 * If the firmware patching fails, the manufacturer mode is 1315 * disabled with reset and deactivating the patch. 1316 * 1317 * If the default patch file is used, no reset is done when disabling 1318 * the manufacturer. 1319 */ 1320 while (fw->size > fw_ptr - fw->data) { 1321 int ret; 1322 1323 ret = btusb_setup_intel_patching(hdev, fw, &fw_ptr, 1324 &disable_patch); 1325 if (ret < 0) 1326 goto exit_mfg_deactivate; 1327 } 1328 1329 release_firmware(fw); 1330 1331 if (disable_patch) 1332 goto exit_mfg_disable; 1333 1334 /* Patching completed successfully and disable the manufacturer mode 1335 * with reset and activate the downloaded firmware patches. 1336 */ 1337 skb = __hci_cmd_sync(hdev, 0xfc11, sizeof(mfg_reset_activate), 1338 mfg_reset_activate, HCI_INIT_TIMEOUT); 1339 if (IS_ERR(skb)) { 1340 BT_ERR("%s exiting Intel manufacturer mode failed (%ld)", 1341 hdev->name, PTR_ERR(skb)); 1342 return PTR_ERR(skb); 1343 } 1344 kfree_skb(skb); 1345 1346 BT_INFO("%s: Intel Bluetooth firmware patch completed and activated", 1347 hdev->name); 1348 1349 return 0; 1350 1351 exit_mfg_disable: 1352 /* Disable the manufacturer mode without reset */ 1353 skb = __hci_cmd_sync(hdev, 0xfc11, sizeof(mfg_disable), mfg_disable, 1354 HCI_INIT_TIMEOUT); 1355 if (IS_ERR(skb)) { 1356 BT_ERR("%s exiting Intel manufacturer mode failed (%ld)", 1357 hdev->name, PTR_ERR(skb)); 1358 return PTR_ERR(skb); 1359 } 1360 kfree_skb(skb); 1361 1362 BT_INFO("%s: Intel Bluetooth firmware patch completed", hdev->name); 1363 return 0; 1364 1365 exit_mfg_deactivate: 1366 release_firmware(fw); 1367 1368 /* Patching failed. Disable the manufacturer mode with reset and 1369 * deactivate the downloaded firmware patches. 1370 */ 1371 skb = __hci_cmd_sync(hdev, 0xfc11, sizeof(mfg_reset_deactivate), 1372 mfg_reset_deactivate, HCI_INIT_TIMEOUT); 1373 if (IS_ERR(skb)) { 1374 BT_ERR("%s exiting Intel manufacturer mode failed (%ld)", 1375 hdev->name, PTR_ERR(skb)); 1376 return PTR_ERR(skb); 1377 } 1378 kfree_skb(skb); 1379 1380 BT_INFO("%s: Intel Bluetooth firmware patch completed and deactivated", 1381 hdev->name); 1382 1383 return 0; 1384 } 1385 1386 static int btusb_setup_bcm_patchram(struct hci_dev *hdev) 1387 { 1388 struct btusb_data *data = hci_get_drvdata(hdev); 1389 struct usb_device *udev = data->udev; 1390 char fw_name[64]; 1391 const struct firmware *fw; 1392 const u8 *fw_ptr; 1393 size_t fw_size; 1394 const struct hci_command_hdr *cmd; 1395 const u8 *cmd_param; 1396 u16 opcode; 1397 struct sk_buff *skb; 1398 struct hci_rp_read_local_version *ver; 1399 long ret; 1400 1401 snprintf(fw_name, sizeof(fw_name), "brcm/%s-%04x-%04x.hcd", 1402 udev->product ? udev->product : "BCM", 1403 le16_to_cpu(udev->descriptor.idVendor), 1404 le16_to_cpu(udev->descriptor.idProduct)); 1405 1406 ret = request_firmware(&fw, fw_name, &hdev->dev); 1407 if (ret < 0) { 1408 BT_INFO("%s: BCM: patch %s not found", hdev->name, 1409 fw_name); 1410 return 0; 1411 } 1412 1413 /* Reset */ 1414 skb = __hci_cmd_sync(hdev, HCI_OP_RESET, 0, NULL, HCI_INIT_TIMEOUT); 1415 if (IS_ERR(skb)) { 1416 ret = PTR_ERR(skb); 1417 BT_ERR("%s: HCI_OP_RESET failed (%ld)", hdev->name, ret); 1418 goto done; 1419 } 1420 kfree_skb(skb); 1421 1422 /* Read Local Version Info */ 1423 skb = __hci_cmd_sync(hdev, HCI_OP_READ_LOCAL_VERSION, 0, NULL, 1424 HCI_INIT_TIMEOUT); 1425 if (IS_ERR(skb)) { 1426 ret = PTR_ERR(skb); 1427 BT_ERR("%s: HCI_OP_READ_LOCAL_VERSION failed (%ld)", 1428 hdev->name, ret); 1429 goto done; 1430 } 1431 1432 if (skb->len != sizeof(*ver)) { 1433 BT_ERR("%s: HCI_OP_READ_LOCAL_VERSION event length mismatch", 1434 hdev->name); 1435 kfree_skb(skb); 1436 ret = -EIO; 1437 goto done; 1438 } 1439 1440 ver = (struct hci_rp_read_local_version *) skb->data; 1441 BT_INFO("%s: BCM: patching hci_ver=%02x hci_rev=%04x lmp_ver=%02x " 1442 "lmp_subver=%04x", hdev->name, ver->hci_ver, ver->hci_rev, 1443 ver->lmp_ver, ver->lmp_subver); 1444 kfree_skb(skb); 1445 1446 /* Start Download */ 1447 skb = __hci_cmd_sync(hdev, 0xfc2e, 0, NULL, HCI_INIT_TIMEOUT); 1448 if (IS_ERR(skb)) { 1449 ret = PTR_ERR(skb); 1450 BT_ERR("%s: BCM: Download Minidrv command failed (%ld)", 1451 hdev->name, ret); 1452 goto reset_fw; 1453 } 1454 kfree_skb(skb); 1455 1456 /* 50 msec delay after Download Minidrv completes */ 1457 msleep(50); 1458 1459 fw_ptr = fw->data; 1460 fw_size = fw->size; 1461 1462 while (fw_size >= sizeof(*cmd)) { 1463 cmd = (struct hci_command_hdr *) fw_ptr; 1464 fw_ptr += sizeof(*cmd); 1465 fw_size -= sizeof(*cmd); 1466 1467 if (fw_size < cmd->plen) { 1468 BT_ERR("%s: BCM: patch %s is corrupted", 1469 hdev->name, fw_name); 1470 ret = -EINVAL; 1471 goto reset_fw; 1472 } 1473 1474 cmd_param = fw_ptr; 1475 fw_ptr += cmd->plen; 1476 fw_size -= cmd->plen; 1477 1478 opcode = le16_to_cpu(cmd->opcode); 1479 1480 skb = __hci_cmd_sync(hdev, opcode, cmd->plen, cmd_param, 1481 HCI_INIT_TIMEOUT); 1482 if (IS_ERR(skb)) { 1483 ret = PTR_ERR(skb); 1484 BT_ERR("%s: BCM: patch command %04x failed (%ld)", 1485 hdev->name, opcode, ret); 1486 goto reset_fw; 1487 } 1488 kfree_skb(skb); 1489 } 1490 1491 /* 250 msec delay after Launch Ram completes */ 1492 msleep(250); 1493 1494 reset_fw: 1495 /* Reset */ 1496 skb = __hci_cmd_sync(hdev, HCI_OP_RESET, 0, NULL, HCI_INIT_TIMEOUT); 1497 if (IS_ERR(skb)) { 1498 ret = PTR_ERR(skb); 1499 BT_ERR("%s: HCI_OP_RESET failed (%ld)", hdev->name, ret); 1500 goto done; 1501 } 1502 kfree_skb(skb); 1503 1504 /* Read Local Version Info */ 1505 skb = __hci_cmd_sync(hdev, HCI_OP_READ_LOCAL_VERSION, 0, NULL, 1506 HCI_INIT_TIMEOUT); 1507 if (IS_ERR(skb)) { 1508 ret = PTR_ERR(skb); 1509 BT_ERR("%s: HCI_OP_READ_LOCAL_VERSION failed (%ld)", 1510 hdev->name, ret); 1511 goto done; 1512 } 1513 1514 if (skb->len != sizeof(*ver)) { 1515 BT_ERR("%s: HCI_OP_READ_LOCAL_VERSION event length mismatch", 1516 hdev->name); 1517 kfree_skb(skb); 1518 ret = -EIO; 1519 goto done; 1520 } 1521 1522 ver = (struct hci_rp_read_local_version *) skb->data; 1523 BT_INFO("%s: BCM: firmware hci_ver=%02x hci_rev=%04x lmp_ver=%02x " 1524 "lmp_subver=%04x", hdev->name, ver->hci_ver, ver->hci_rev, 1525 ver->lmp_ver, ver->lmp_subver); 1526 kfree_skb(skb); 1527 1528 done: 1529 release_firmware(fw); 1530 1531 return ret; 1532 } 1533 1534 static int btusb_probe(struct usb_interface *intf, 1535 const struct usb_device_id *id) 1536 { 1537 struct usb_endpoint_descriptor *ep_desc; 1538 struct btusb_data *data; 1539 struct hci_dev *hdev; 1540 int i, err; 1541 1542 BT_DBG("intf %p id %p", intf, id); 1543 1544 /* interface numbers are hardcoded in the spec */ 1545 if (intf->cur_altsetting->desc.bInterfaceNumber != 0) 1546 return -ENODEV; 1547 1548 if (!id->driver_info) { 1549 const struct usb_device_id *match; 1550 match = usb_match_id(intf, blacklist_table); 1551 if (match) 1552 id = match; 1553 } 1554 1555 if (id->driver_info == BTUSB_IGNORE) 1556 return -ENODEV; 1557 1558 if (ignore_dga && id->driver_info & BTUSB_DIGIANSWER) 1559 return -ENODEV; 1560 1561 if (ignore_csr && id->driver_info & BTUSB_CSR) 1562 return -ENODEV; 1563 1564 if (ignore_sniffer && id->driver_info & BTUSB_SNIFFER) 1565 return -ENODEV; 1566 1567 if (id->driver_info & BTUSB_ATH3012) { 1568 struct usb_device *udev = interface_to_usbdev(intf); 1569 1570 /* Old firmware would otherwise let ath3k driver load 1571 * patch and sysconfig files */ 1572 if (le16_to_cpu(udev->descriptor.bcdDevice) <= 0x0001) 1573 return -ENODEV; 1574 } 1575 1576 data = devm_kzalloc(&intf->dev, sizeof(*data), GFP_KERNEL); 1577 if (!data) 1578 return -ENOMEM; 1579 1580 for (i = 0; i < intf->cur_altsetting->desc.bNumEndpoints; i++) { 1581 ep_desc = &intf->cur_altsetting->endpoint[i].desc; 1582 1583 if (!data->intr_ep && usb_endpoint_is_int_in(ep_desc)) { 1584 data->intr_ep = ep_desc; 1585 continue; 1586 } 1587 1588 if (!data->bulk_tx_ep && usb_endpoint_is_bulk_out(ep_desc)) { 1589 data->bulk_tx_ep = ep_desc; 1590 continue; 1591 } 1592 1593 if (!data->bulk_rx_ep && usb_endpoint_is_bulk_in(ep_desc)) { 1594 data->bulk_rx_ep = ep_desc; 1595 continue; 1596 } 1597 } 1598 1599 if (!data->intr_ep || !data->bulk_tx_ep || !data->bulk_rx_ep) 1600 return -ENODEV; 1601 1602 data->cmdreq_type = USB_TYPE_CLASS; 1603 1604 data->udev = interface_to_usbdev(intf); 1605 data->intf = intf; 1606 1607 spin_lock_init(&data->lock); 1608 1609 INIT_WORK(&data->work, btusb_work); 1610 INIT_WORK(&data->waker, btusb_waker); 1611 spin_lock_init(&data->txlock); 1612 1613 init_usb_anchor(&data->tx_anchor); 1614 init_usb_anchor(&data->intr_anchor); 1615 init_usb_anchor(&data->bulk_anchor); 1616 init_usb_anchor(&data->isoc_anchor); 1617 init_usb_anchor(&data->deferred); 1618 1619 hdev = hci_alloc_dev(); 1620 if (!hdev) 1621 return -ENOMEM; 1622 1623 hdev->bus = HCI_USB; 1624 hci_set_drvdata(hdev, data); 1625 1626 data->hdev = hdev; 1627 1628 SET_HCIDEV_DEV(hdev, &intf->dev); 1629 1630 hdev->open = btusb_open; 1631 hdev->close = btusb_close; 1632 hdev->flush = btusb_flush; 1633 hdev->send = btusb_send_frame; 1634 hdev->notify = btusb_notify; 1635 1636 if (id->driver_info & BTUSB_BCM92035) 1637 hdev->setup = btusb_setup_bcm92035; 1638 1639 if (id->driver_info & BTUSB_BCM_PATCHRAM) 1640 hdev->setup = btusb_setup_bcm_patchram; 1641 1642 if (id->driver_info & BTUSB_INTEL) 1643 hdev->setup = btusb_setup_intel; 1644 1645 /* Interface numbers are hardcoded in the specification */ 1646 data->isoc = usb_ifnum_to_if(data->udev, 1); 1647 1648 if (!reset) 1649 set_bit(HCI_QUIRK_RESET_ON_CLOSE, &hdev->quirks); 1650 1651 if (force_scofix || id->driver_info & BTUSB_WRONG_SCO_MTU) { 1652 if (!disable_scofix) 1653 set_bit(HCI_QUIRK_FIXUP_BUFFER_SIZE, &hdev->quirks); 1654 } 1655 1656 if (id->driver_info & BTUSB_BROKEN_ISOC) 1657 data->isoc = NULL; 1658 1659 if (id->driver_info & BTUSB_DIGIANSWER) { 1660 data->cmdreq_type = USB_TYPE_VENDOR; 1661 set_bit(HCI_QUIRK_RESET_ON_CLOSE, &hdev->quirks); 1662 } 1663 1664 if (id->driver_info & BTUSB_CSR) { 1665 struct usb_device *udev = data->udev; 1666 u16 bcdDevice = le16_to_cpu(udev->descriptor.bcdDevice); 1667 1668 /* Old firmware would otherwise execute USB reset */ 1669 if (bcdDevice < 0x117) 1670 set_bit(HCI_QUIRK_RESET_ON_CLOSE, &hdev->quirks); 1671 1672 /* Fake CSR devices with broken commands */ 1673 if (bcdDevice <= 0x100) 1674 hdev->setup = btusb_setup_csr; 1675 } 1676 1677 if (id->driver_info & BTUSB_SNIFFER) { 1678 struct usb_device *udev = data->udev; 1679 1680 /* New sniffer firmware has crippled HCI interface */ 1681 if (le16_to_cpu(udev->descriptor.bcdDevice) > 0x997) 1682 set_bit(HCI_QUIRK_RAW_DEVICE, &hdev->quirks); 1683 1684 data->isoc = NULL; 1685 } 1686 1687 if (data->isoc) { 1688 err = usb_driver_claim_interface(&btusb_driver, 1689 data->isoc, data); 1690 if (err < 0) { 1691 hci_free_dev(hdev); 1692 return err; 1693 } 1694 } 1695 1696 err = hci_register_dev(hdev); 1697 if (err < 0) { 1698 hci_free_dev(hdev); 1699 return err; 1700 } 1701 1702 usb_set_intfdata(intf, data); 1703 1704 return 0; 1705 } 1706 1707 static void btusb_disconnect(struct usb_interface *intf) 1708 { 1709 struct btusb_data *data = usb_get_intfdata(intf); 1710 struct hci_dev *hdev; 1711 1712 BT_DBG("intf %p", intf); 1713 1714 if (!data) 1715 return; 1716 1717 hdev = data->hdev; 1718 usb_set_intfdata(data->intf, NULL); 1719 1720 if (data->isoc) 1721 usb_set_intfdata(data->isoc, NULL); 1722 1723 hci_unregister_dev(hdev); 1724 1725 if (intf == data->isoc) 1726 usb_driver_release_interface(&btusb_driver, data->intf); 1727 else if (data->isoc) 1728 usb_driver_release_interface(&btusb_driver, data->isoc); 1729 1730 hci_free_dev(hdev); 1731 } 1732 1733 #ifdef CONFIG_PM 1734 static int btusb_suspend(struct usb_interface *intf, pm_message_t message) 1735 { 1736 struct btusb_data *data = usb_get_intfdata(intf); 1737 1738 BT_DBG("intf %p", intf); 1739 1740 if (data->suspend_count++) 1741 return 0; 1742 1743 spin_lock_irq(&data->txlock); 1744 if (!(PMSG_IS_AUTO(message) && data->tx_in_flight)) { 1745 set_bit(BTUSB_SUSPENDING, &data->flags); 1746 spin_unlock_irq(&data->txlock); 1747 } else { 1748 spin_unlock_irq(&data->txlock); 1749 data->suspend_count--; 1750 return -EBUSY; 1751 } 1752 1753 cancel_work_sync(&data->work); 1754 1755 btusb_stop_traffic(data); 1756 usb_kill_anchored_urbs(&data->tx_anchor); 1757 1758 return 0; 1759 } 1760 1761 static void play_deferred(struct btusb_data *data) 1762 { 1763 struct urb *urb; 1764 int err; 1765 1766 while ((urb = usb_get_from_anchor(&data->deferred))) { 1767 err = usb_submit_urb(urb, GFP_ATOMIC); 1768 if (err < 0) 1769 break; 1770 1771 data->tx_in_flight++; 1772 } 1773 usb_scuttle_anchored_urbs(&data->deferred); 1774 } 1775 1776 static int btusb_resume(struct usb_interface *intf) 1777 { 1778 struct btusb_data *data = usb_get_intfdata(intf); 1779 struct hci_dev *hdev = data->hdev; 1780 int err = 0; 1781 1782 BT_DBG("intf %p", intf); 1783 1784 if (--data->suspend_count) 1785 return 0; 1786 1787 if (!test_bit(HCI_RUNNING, &hdev->flags)) 1788 goto done; 1789 1790 if (test_bit(BTUSB_INTR_RUNNING, &data->flags)) { 1791 err = btusb_submit_intr_urb(hdev, GFP_NOIO); 1792 if (err < 0) { 1793 clear_bit(BTUSB_INTR_RUNNING, &data->flags); 1794 goto failed; 1795 } 1796 } 1797 1798 if (test_bit(BTUSB_BULK_RUNNING, &data->flags)) { 1799 err = btusb_submit_bulk_urb(hdev, GFP_NOIO); 1800 if (err < 0) { 1801 clear_bit(BTUSB_BULK_RUNNING, &data->flags); 1802 goto failed; 1803 } 1804 1805 btusb_submit_bulk_urb(hdev, GFP_NOIO); 1806 } 1807 1808 if (test_bit(BTUSB_ISOC_RUNNING, &data->flags)) { 1809 if (btusb_submit_isoc_urb(hdev, GFP_NOIO) < 0) 1810 clear_bit(BTUSB_ISOC_RUNNING, &data->flags); 1811 else 1812 btusb_submit_isoc_urb(hdev, GFP_NOIO); 1813 } 1814 1815 spin_lock_irq(&data->txlock); 1816 play_deferred(data); 1817 clear_bit(BTUSB_SUSPENDING, &data->flags); 1818 spin_unlock_irq(&data->txlock); 1819 schedule_work(&data->work); 1820 1821 return 0; 1822 1823 failed: 1824 usb_scuttle_anchored_urbs(&data->deferred); 1825 done: 1826 spin_lock_irq(&data->txlock); 1827 clear_bit(BTUSB_SUSPENDING, &data->flags); 1828 spin_unlock_irq(&data->txlock); 1829 1830 return err; 1831 } 1832 #endif 1833 1834 static struct usb_driver btusb_driver = { 1835 .name = "btusb", 1836 .probe = btusb_probe, 1837 .disconnect = btusb_disconnect, 1838 #ifdef CONFIG_PM 1839 .suspend = btusb_suspend, 1840 .resume = btusb_resume, 1841 #endif 1842 .id_table = btusb_table, 1843 .supports_autosuspend = 1, 1844 .disable_hub_initiated_lpm = 1, 1845 }; 1846 1847 module_usb_driver(btusb_driver); 1848 1849 module_param(ignore_dga, bool, 0644); 1850 MODULE_PARM_DESC(ignore_dga, "Ignore devices with id 08fd:0001"); 1851 1852 module_param(ignore_csr, bool, 0644); 1853 MODULE_PARM_DESC(ignore_csr, "Ignore devices with id 0a12:0001"); 1854 1855 module_param(ignore_sniffer, bool, 0644); 1856 MODULE_PARM_DESC(ignore_sniffer, "Ignore devices with id 0a12:0002"); 1857 1858 module_param(disable_scofix, bool, 0644); 1859 MODULE_PARM_DESC(disable_scofix, "Disable fixup of wrong SCO buffer size"); 1860 1861 module_param(force_scofix, bool, 0644); 1862 MODULE_PARM_DESC(force_scofix, "Force fixup of wrong SCO buffers size"); 1863 1864 module_param(reset, bool, 0644); 1865 MODULE_PARM_DESC(reset, "Send HCI reset command on initialization"); 1866 1867 MODULE_AUTHOR("Marcel Holtmann <marcel@holtmann.org>"); 1868 MODULE_DESCRIPTION("Generic Bluetooth USB driver ver " VERSION); 1869 MODULE_VERSION(VERSION); 1870 MODULE_LICENSE("GPL"); 1871