1 /* 2 * 3 * Generic Bluetooth USB driver 4 * 5 * Copyright (C) 2005-2008 Marcel Holtmann <marcel@holtmann.org> 6 * 7 * 8 * This program is free software; you can redistribute it and/or modify 9 * it under the terms of the GNU General Public License as published by 10 * the Free Software Foundation; either version 2 of the License, or 11 * (at your option) any later version. 12 * 13 * This program is distributed in the hope that it will be useful, 14 * but WITHOUT ANY WARRANTY; without even the implied warranty of 15 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the 16 * GNU General Public License for more details. 17 * 18 * You should have received a copy of the GNU General Public License 19 * along with this program; if not, write to the Free Software 20 * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA 21 * 22 */ 23 24 #include <linux/module.h> 25 #include <linux/usb.h> 26 #include <linux/firmware.h> 27 #include <asm/unaligned.h> 28 29 #include <net/bluetooth/bluetooth.h> 30 #include <net/bluetooth/hci_core.h> 31 32 #include "btintel.h" 33 #include "btbcm.h" 34 35 #define VERSION "0.8" 36 37 static bool disable_scofix; 38 static bool force_scofix; 39 40 static bool reset = 1; 41 42 static struct usb_driver btusb_driver; 43 44 #define BTUSB_IGNORE 0x01 45 #define BTUSB_DIGIANSWER 0x02 46 #define BTUSB_CSR 0x04 47 #define BTUSB_SNIFFER 0x08 48 #define BTUSB_BCM92035 0x10 49 #define BTUSB_BROKEN_ISOC 0x20 50 #define BTUSB_WRONG_SCO_MTU 0x40 51 #define BTUSB_ATH3012 0x80 52 #define BTUSB_INTEL 0x100 53 #define BTUSB_INTEL_BOOT 0x200 54 #define BTUSB_BCM_PATCHRAM 0x400 55 #define BTUSB_MARVELL 0x800 56 #define BTUSB_SWAVE 0x1000 57 #define BTUSB_INTEL_NEW 0x2000 58 #define BTUSB_AMP 0x4000 59 #define BTUSB_QCA_ROME 0x8000 60 #define BTUSB_BCM_APPLE 0x10000 61 #define BTUSB_REALTEK 0x20000 62 63 static const struct usb_device_id btusb_table[] = { 64 /* Generic Bluetooth USB device */ 65 { USB_DEVICE_INFO(0xe0, 0x01, 0x01) }, 66 67 /* Generic Bluetooth AMP device */ 68 { USB_DEVICE_INFO(0xe0, 0x01, 0x04), .driver_info = BTUSB_AMP }, 69 70 /* Apple-specific (Broadcom) devices */ 71 { USB_VENDOR_AND_INTERFACE_INFO(0x05ac, 0xff, 0x01, 0x01), 72 .driver_info = BTUSB_BCM_APPLE }, 73 74 /* MediaTek MT76x0E */ 75 { USB_DEVICE(0x0e8d, 0x763f) }, 76 77 /* Broadcom SoftSailing reporting vendor specific */ 78 { USB_DEVICE(0x0a5c, 0x21e1) }, 79 80 /* Apple MacBookPro 7,1 */ 81 { USB_DEVICE(0x05ac, 0x8213) }, 82 83 /* Apple iMac11,1 */ 84 { USB_DEVICE(0x05ac, 0x8215) }, 85 86 /* Apple MacBookPro6,2 */ 87 { USB_DEVICE(0x05ac, 0x8218) }, 88 89 /* Apple MacBookAir3,1, MacBookAir3,2 */ 90 { USB_DEVICE(0x05ac, 0x821b) }, 91 92 /* Apple MacBookAir4,1 */ 93 { USB_DEVICE(0x05ac, 0x821f) }, 94 95 /* Apple MacBookPro8,2 */ 96 { USB_DEVICE(0x05ac, 0x821a) }, 97 98 /* Apple MacMini5,1 */ 99 { USB_DEVICE(0x05ac, 0x8281) }, 100 101 /* AVM BlueFRITZ! USB v2.0 */ 102 { USB_DEVICE(0x057c, 0x3800), .driver_info = BTUSB_SWAVE }, 103 104 /* Bluetooth Ultraport Module from IBM */ 105 { USB_DEVICE(0x04bf, 0x030a) }, 106 107 /* ALPS Modules with non-standard id */ 108 { USB_DEVICE(0x044e, 0x3001) }, 109 { USB_DEVICE(0x044e, 0x3002) }, 110 111 /* Ericsson with non-standard id */ 112 { USB_DEVICE(0x0bdb, 0x1002) }, 113 114 /* Canyon CN-BTU1 with HID interfaces */ 115 { USB_DEVICE(0x0c10, 0x0000) }, 116 117 /* Broadcom BCM20702A0 */ 118 { USB_DEVICE(0x413c, 0x8197) }, 119 120 /* Broadcom BCM20702B0 (Dynex/Insignia) */ 121 { USB_DEVICE(0x19ff, 0x0239), .driver_info = BTUSB_BCM_PATCHRAM }, 122 123 /* Foxconn - Hon Hai */ 124 { USB_VENDOR_AND_INTERFACE_INFO(0x0489, 0xff, 0x01, 0x01), 125 .driver_info = BTUSB_BCM_PATCHRAM }, 126 127 /* Lite-On Technology - Broadcom based */ 128 { USB_VENDOR_AND_INTERFACE_INFO(0x04ca, 0xff, 0x01, 0x01), 129 .driver_info = BTUSB_BCM_PATCHRAM }, 130 131 /* Broadcom devices with vendor specific id */ 132 { USB_VENDOR_AND_INTERFACE_INFO(0x0a5c, 0xff, 0x01, 0x01), 133 .driver_info = BTUSB_BCM_PATCHRAM }, 134 135 /* ASUSTek Computer - Broadcom based */ 136 { USB_VENDOR_AND_INTERFACE_INFO(0x0b05, 0xff, 0x01, 0x01), 137 .driver_info = BTUSB_BCM_PATCHRAM }, 138 139 /* Belkin F8065bf - Broadcom based */ 140 { USB_VENDOR_AND_INTERFACE_INFO(0x050d, 0xff, 0x01, 0x01), 141 .driver_info = BTUSB_BCM_PATCHRAM }, 142 143 /* IMC Networks - Broadcom based */ 144 { USB_VENDOR_AND_INTERFACE_INFO(0x13d3, 0xff, 0x01, 0x01), 145 .driver_info = BTUSB_BCM_PATCHRAM }, 146 147 /* Intel Bluetooth USB Bootloader (RAM module) */ 148 { USB_DEVICE(0x8087, 0x0a5a), 149 .driver_info = BTUSB_INTEL_BOOT | BTUSB_BROKEN_ISOC }, 150 151 { } /* Terminating entry */ 152 }; 153 154 MODULE_DEVICE_TABLE(usb, btusb_table); 155 156 static const struct usb_device_id blacklist_table[] = { 157 /* CSR BlueCore devices */ 158 { USB_DEVICE(0x0a12, 0x0001), .driver_info = BTUSB_CSR }, 159 160 /* Broadcom BCM2033 without firmware */ 161 { USB_DEVICE(0x0a5c, 0x2033), .driver_info = BTUSB_IGNORE }, 162 163 /* Atheros 3011 with sflash firmware */ 164 { USB_DEVICE(0x0489, 0xe027), .driver_info = BTUSB_IGNORE }, 165 { USB_DEVICE(0x0489, 0xe03d), .driver_info = BTUSB_IGNORE }, 166 { USB_DEVICE(0x04f2, 0xaff1), .driver_info = BTUSB_IGNORE }, 167 { USB_DEVICE(0x0930, 0x0215), .driver_info = BTUSB_IGNORE }, 168 { USB_DEVICE(0x0cf3, 0x3002), .driver_info = BTUSB_IGNORE }, 169 { USB_DEVICE(0x0cf3, 0xe019), .driver_info = BTUSB_IGNORE }, 170 { USB_DEVICE(0x13d3, 0x3304), .driver_info = BTUSB_IGNORE }, 171 172 /* Atheros AR9285 Malbec with sflash firmware */ 173 { USB_DEVICE(0x03f0, 0x311d), .driver_info = BTUSB_IGNORE }, 174 175 /* Atheros 3012 with sflash firmware */ 176 { USB_DEVICE(0x0489, 0xe04d), .driver_info = BTUSB_ATH3012 }, 177 { USB_DEVICE(0x0489, 0xe04e), .driver_info = BTUSB_ATH3012 }, 178 { USB_DEVICE(0x0489, 0xe056), .driver_info = BTUSB_ATH3012 }, 179 { USB_DEVICE(0x0489, 0xe057), .driver_info = BTUSB_ATH3012 }, 180 { USB_DEVICE(0x0489, 0xe05f), .driver_info = BTUSB_ATH3012 }, 181 { USB_DEVICE(0x0489, 0xe078), .driver_info = BTUSB_ATH3012 }, 182 { USB_DEVICE(0x04c5, 0x1330), .driver_info = BTUSB_ATH3012 }, 183 { USB_DEVICE(0x04ca, 0x3004), .driver_info = BTUSB_ATH3012 }, 184 { USB_DEVICE(0x04ca, 0x3005), .driver_info = BTUSB_ATH3012 }, 185 { USB_DEVICE(0x04ca, 0x3006), .driver_info = BTUSB_ATH3012 }, 186 { USB_DEVICE(0x04ca, 0x3007), .driver_info = BTUSB_ATH3012 }, 187 { USB_DEVICE(0x04ca, 0x3008), .driver_info = BTUSB_ATH3012 }, 188 { USB_DEVICE(0x04ca, 0x300b), .driver_info = BTUSB_ATH3012 }, 189 { USB_DEVICE(0x04ca, 0x300f), .driver_info = BTUSB_ATH3012 }, 190 { USB_DEVICE(0x04ca, 0x3010), .driver_info = BTUSB_ATH3012 }, 191 { USB_DEVICE(0x0930, 0x0219), .driver_info = BTUSB_ATH3012 }, 192 { USB_DEVICE(0x0930, 0x0220), .driver_info = BTUSB_ATH3012 }, 193 { USB_DEVICE(0x0930, 0x0227), .driver_info = BTUSB_ATH3012 }, 194 { USB_DEVICE(0x0b05, 0x17d0), .driver_info = BTUSB_ATH3012 }, 195 { USB_DEVICE(0x0cf3, 0x0036), .driver_info = BTUSB_ATH3012 }, 196 { USB_DEVICE(0x0cf3, 0x3004), .driver_info = BTUSB_ATH3012 }, 197 { USB_DEVICE(0x0cf3, 0x3008), .driver_info = BTUSB_ATH3012 }, 198 { USB_DEVICE(0x0cf3, 0x311d), .driver_info = BTUSB_ATH3012 }, 199 { USB_DEVICE(0x0cf3, 0x311e), .driver_info = BTUSB_ATH3012 }, 200 { USB_DEVICE(0x0cf3, 0x311f), .driver_info = BTUSB_ATH3012 }, 201 { USB_DEVICE(0x0cf3, 0x3121), .driver_info = BTUSB_ATH3012 }, 202 { USB_DEVICE(0x0cf3, 0x817a), .driver_info = BTUSB_ATH3012 }, 203 { USB_DEVICE(0x0cf3, 0xe003), .driver_info = BTUSB_ATH3012 }, 204 { USB_DEVICE(0x0cf3, 0xe004), .driver_info = BTUSB_ATH3012 }, 205 { USB_DEVICE(0x0cf3, 0xe005), .driver_info = BTUSB_ATH3012 }, 206 { USB_DEVICE(0x0cf3, 0xe006), .driver_info = BTUSB_ATH3012 }, 207 { USB_DEVICE(0x13d3, 0x3362), .driver_info = BTUSB_ATH3012 }, 208 { USB_DEVICE(0x13d3, 0x3375), .driver_info = BTUSB_ATH3012 }, 209 { USB_DEVICE(0x13d3, 0x3393), .driver_info = BTUSB_ATH3012 }, 210 { USB_DEVICE(0x13d3, 0x3402), .driver_info = BTUSB_ATH3012 }, 211 { USB_DEVICE(0x13d3, 0x3408), .driver_info = BTUSB_ATH3012 }, 212 { USB_DEVICE(0x13d3, 0x3423), .driver_info = BTUSB_ATH3012 }, 213 { USB_DEVICE(0x13d3, 0x3432), .driver_info = BTUSB_ATH3012 }, 214 215 /* Atheros AR5BBU12 with sflash firmware */ 216 { USB_DEVICE(0x0489, 0xe02c), .driver_info = BTUSB_IGNORE }, 217 218 /* Atheros AR5BBU12 with sflash firmware */ 219 { USB_DEVICE(0x0489, 0xe036), .driver_info = BTUSB_ATH3012 }, 220 { USB_DEVICE(0x0489, 0xe03c), .driver_info = BTUSB_ATH3012 }, 221 222 /* QCA ROME chipset */ 223 { USB_DEVICE(0x0cf3, 0xe007), .driver_info = BTUSB_QCA_ROME }, 224 { USB_DEVICE(0x0cf3, 0xe300), .driver_info = BTUSB_QCA_ROME }, 225 { USB_DEVICE(0x0cf3, 0xe360), .driver_info = BTUSB_QCA_ROME }, 226 227 /* Broadcom BCM2035 */ 228 { USB_DEVICE(0x0a5c, 0x2009), .driver_info = BTUSB_BCM92035 }, 229 { USB_DEVICE(0x0a5c, 0x200a), .driver_info = BTUSB_WRONG_SCO_MTU }, 230 { USB_DEVICE(0x0a5c, 0x2035), .driver_info = BTUSB_WRONG_SCO_MTU }, 231 232 /* Broadcom BCM2045 */ 233 { USB_DEVICE(0x0a5c, 0x2039), .driver_info = BTUSB_WRONG_SCO_MTU }, 234 { USB_DEVICE(0x0a5c, 0x2101), .driver_info = BTUSB_WRONG_SCO_MTU }, 235 236 /* IBM/Lenovo ThinkPad with Broadcom chip */ 237 { USB_DEVICE(0x0a5c, 0x201e), .driver_info = BTUSB_WRONG_SCO_MTU }, 238 { USB_DEVICE(0x0a5c, 0x2110), .driver_info = BTUSB_WRONG_SCO_MTU }, 239 240 /* HP laptop with Broadcom chip */ 241 { USB_DEVICE(0x03f0, 0x171d), .driver_info = BTUSB_WRONG_SCO_MTU }, 242 243 /* Dell laptop with Broadcom chip */ 244 { USB_DEVICE(0x413c, 0x8126), .driver_info = BTUSB_WRONG_SCO_MTU }, 245 246 /* Dell Wireless 370 and 410 devices */ 247 { USB_DEVICE(0x413c, 0x8152), .driver_info = BTUSB_WRONG_SCO_MTU }, 248 { USB_DEVICE(0x413c, 0x8156), .driver_info = BTUSB_WRONG_SCO_MTU }, 249 250 /* Belkin F8T012 and F8T013 devices */ 251 { USB_DEVICE(0x050d, 0x0012), .driver_info = BTUSB_WRONG_SCO_MTU }, 252 { USB_DEVICE(0x050d, 0x0013), .driver_info = BTUSB_WRONG_SCO_MTU }, 253 254 /* Asus WL-BTD202 device */ 255 { USB_DEVICE(0x0b05, 0x1715), .driver_info = BTUSB_WRONG_SCO_MTU }, 256 257 /* Kensington Bluetooth USB adapter */ 258 { USB_DEVICE(0x047d, 0x105e), .driver_info = BTUSB_WRONG_SCO_MTU }, 259 260 /* RTX Telecom based adapters with buggy SCO support */ 261 { USB_DEVICE(0x0400, 0x0807), .driver_info = BTUSB_BROKEN_ISOC }, 262 { USB_DEVICE(0x0400, 0x080a), .driver_info = BTUSB_BROKEN_ISOC }, 263 264 /* CONWISE Technology based adapters with buggy SCO support */ 265 { USB_DEVICE(0x0e5e, 0x6622), .driver_info = BTUSB_BROKEN_ISOC }, 266 267 /* Roper Class 1 Bluetooth Dongle (Silicon Wave based) */ 268 { USB_DEVICE(0x1300, 0x0001), .driver_info = BTUSB_SWAVE }, 269 270 /* Digianswer devices */ 271 { USB_DEVICE(0x08fd, 0x0001), .driver_info = BTUSB_DIGIANSWER }, 272 { USB_DEVICE(0x08fd, 0x0002), .driver_info = BTUSB_IGNORE }, 273 274 /* CSR BlueCore Bluetooth Sniffer */ 275 { USB_DEVICE(0x0a12, 0x0002), 276 .driver_info = BTUSB_SNIFFER | BTUSB_BROKEN_ISOC }, 277 278 /* Frontline ComProbe Bluetooth Sniffer */ 279 { USB_DEVICE(0x16d3, 0x0002), 280 .driver_info = BTUSB_SNIFFER | BTUSB_BROKEN_ISOC }, 281 282 /* Marvell Bluetooth devices */ 283 { USB_DEVICE(0x1286, 0x2044), .driver_info = BTUSB_MARVELL }, 284 { USB_DEVICE(0x1286, 0x2046), .driver_info = BTUSB_MARVELL }, 285 286 /* Intel Bluetooth devices */ 287 { USB_DEVICE(0x8087, 0x07da), .driver_info = BTUSB_CSR }, 288 { USB_DEVICE(0x8087, 0x07dc), .driver_info = BTUSB_INTEL }, 289 { USB_DEVICE(0x8087, 0x0a2a), .driver_info = BTUSB_INTEL }, 290 { USB_DEVICE(0x8087, 0x0a2b), .driver_info = BTUSB_INTEL_NEW }, 291 292 /* Other Intel Bluetooth devices */ 293 { USB_VENDOR_AND_INTERFACE_INFO(0x8087, 0xe0, 0x01, 0x01), 294 .driver_info = BTUSB_IGNORE }, 295 296 /* Realtek Bluetooth devices */ 297 { USB_VENDOR_AND_INTERFACE_INFO(0x0bda, 0xe0, 0x01, 0x01), 298 .driver_info = BTUSB_REALTEK }, 299 300 /* Additional Realtek 8723AE Bluetooth devices */ 301 { USB_DEVICE(0x0930, 0x021d), .driver_info = BTUSB_REALTEK }, 302 { USB_DEVICE(0x13d3, 0x3394), .driver_info = BTUSB_REALTEK }, 303 304 /* Additional Realtek 8723BE Bluetooth devices */ 305 { USB_DEVICE(0x0489, 0xe085), .driver_info = BTUSB_REALTEK }, 306 { USB_DEVICE(0x0489, 0xe08b), .driver_info = BTUSB_REALTEK }, 307 { USB_DEVICE(0x13d3, 0x3410), .driver_info = BTUSB_REALTEK }, 308 { USB_DEVICE(0x13d3, 0x3416), .driver_info = BTUSB_REALTEK }, 309 { USB_DEVICE(0x13d3, 0x3459), .driver_info = BTUSB_REALTEK }, 310 311 /* Additional Realtek 8821AE Bluetooth devices */ 312 { USB_DEVICE(0x0b05, 0x17dc), .driver_info = BTUSB_REALTEK }, 313 { USB_DEVICE(0x13d3, 0x3414), .driver_info = BTUSB_REALTEK }, 314 { USB_DEVICE(0x13d3, 0x3458), .driver_info = BTUSB_REALTEK }, 315 { USB_DEVICE(0x13d3, 0x3461), .driver_info = BTUSB_REALTEK }, 316 { USB_DEVICE(0x13d3, 0x3462), .driver_info = BTUSB_REALTEK }, 317 318 { } /* Terminating entry */ 319 }; 320 321 #define BTUSB_MAX_ISOC_FRAMES 10 322 323 #define BTUSB_INTR_RUNNING 0 324 #define BTUSB_BULK_RUNNING 1 325 #define BTUSB_ISOC_RUNNING 2 326 #define BTUSB_SUSPENDING 3 327 #define BTUSB_DID_ISO_RESUME 4 328 #define BTUSB_BOOTLOADER 5 329 #define BTUSB_DOWNLOADING 6 330 #define BTUSB_FIRMWARE_LOADED 7 331 #define BTUSB_FIRMWARE_FAILED 8 332 #define BTUSB_BOOTING 9 333 334 struct btusb_data { 335 struct hci_dev *hdev; 336 struct usb_device *udev; 337 struct usb_interface *intf; 338 struct usb_interface *isoc; 339 340 unsigned long flags; 341 342 struct work_struct work; 343 struct work_struct waker; 344 345 struct usb_anchor deferred; 346 struct usb_anchor tx_anchor; 347 int tx_in_flight; 348 spinlock_t txlock; 349 350 struct usb_anchor intr_anchor; 351 struct usb_anchor bulk_anchor; 352 struct usb_anchor isoc_anchor; 353 spinlock_t rxlock; 354 355 struct sk_buff *evt_skb; 356 struct sk_buff *acl_skb; 357 struct sk_buff *sco_skb; 358 359 struct usb_endpoint_descriptor *intr_ep; 360 struct usb_endpoint_descriptor *bulk_tx_ep; 361 struct usb_endpoint_descriptor *bulk_rx_ep; 362 struct usb_endpoint_descriptor *isoc_tx_ep; 363 struct usb_endpoint_descriptor *isoc_rx_ep; 364 365 __u8 cmdreq_type; 366 __u8 cmdreq; 367 368 unsigned int sco_num; 369 int isoc_altsetting; 370 int suspend_count; 371 372 int (*recv_event)(struct hci_dev *hdev, struct sk_buff *skb); 373 int (*recv_bulk)(struct btusb_data *data, void *buffer, int count); 374 375 int (*setup_on_usb)(struct hci_dev *hdev); 376 }; 377 378 static inline void btusb_free_frags(struct btusb_data *data) 379 { 380 unsigned long flags; 381 382 spin_lock_irqsave(&data->rxlock, flags); 383 384 kfree_skb(data->evt_skb); 385 data->evt_skb = NULL; 386 387 kfree_skb(data->acl_skb); 388 data->acl_skb = NULL; 389 390 kfree_skb(data->sco_skb); 391 data->sco_skb = NULL; 392 393 spin_unlock_irqrestore(&data->rxlock, flags); 394 } 395 396 static int btusb_recv_intr(struct btusb_data *data, void *buffer, int count) 397 { 398 struct sk_buff *skb; 399 int err = 0; 400 401 spin_lock(&data->rxlock); 402 skb = data->evt_skb; 403 404 while (count) { 405 int len; 406 407 if (!skb) { 408 skb = bt_skb_alloc(HCI_MAX_EVENT_SIZE, GFP_ATOMIC); 409 if (!skb) { 410 err = -ENOMEM; 411 break; 412 } 413 414 bt_cb(skb)->pkt_type = HCI_EVENT_PKT; 415 bt_cb(skb)->expect = HCI_EVENT_HDR_SIZE; 416 } 417 418 len = min_t(uint, bt_cb(skb)->expect, count); 419 memcpy(skb_put(skb, len), buffer, len); 420 421 count -= len; 422 buffer += len; 423 bt_cb(skb)->expect -= len; 424 425 if (skb->len == HCI_EVENT_HDR_SIZE) { 426 /* Complete event header */ 427 bt_cb(skb)->expect = hci_event_hdr(skb)->plen; 428 429 if (skb_tailroom(skb) < bt_cb(skb)->expect) { 430 kfree_skb(skb); 431 skb = NULL; 432 433 err = -EILSEQ; 434 break; 435 } 436 } 437 438 if (bt_cb(skb)->expect == 0) { 439 /* Complete frame */ 440 data->recv_event(data->hdev, skb); 441 skb = NULL; 442 } 443 } 444 445 data->evt_skb = skb; 446 spin_unlock(&data->rxlock); 447 448 return err; 449 } 450 451 static int btusb_recv_bulk(struct btusb_data *data, void *buffer, int count) 452 { 453 struct sk_buff *skb; 454 int err = 0; 455 456 spin_lock(&data->rxlock); 457 skb = data->acl_skb; 458 459 while (count) { 460 int len; 461 462 if (!skb) { 463 skb = bt_skb_alloc(HCI_MAX_FRAME_SIZE, GFP_ATOMIC); 464 if (!skb) { 465 err = -ENOMEM; 466 break; 467 } 468 469 bt_cb(skb)->pkt_type = HCI_ACLDATA_PKT; 470 bt_cb(skb)->expect = HCI_ACL_HDR_SIZE; 471 } 472 473 len = min_t(uint, bt_cb(skb)->expect, count); 474 memcpy(skb_put(skb, len), buffer, len); 475 476 count -= len; 477 buffer += len; 478 bt_cb(skb)->expect -= len; 479 480 if (skb->len == HCI_ACL_HDR_SIZE) { 481 __le16 dlen = hci_acl_hdr(skb)->dlen; 482 483 /* Complete ACL header */ 484 bt_cb(skb)->expect = __le16_to_cpu(dlen); 485 486 if (skb_tailroom(skb) < bt_cb(skb)->expect) { 487 kfree_skb(skb); 488 skb = NULL; 489 490 err = -EILSEQ; 491 break; 492 } 493 } 494 495 if (bt_cb(skb)->expect == 0) { 496 /* Complete frame */ 497 hci_recv_frame(data->hdev, skb); 498 skb = NULL; 499 } 500 } 501 502 data->acl_skb = skb; 503 spin_unlock(&data->rxlock); 504 505 return err; 506 } 507 508 static int btusb_recv_isoc(struct btusb_data *data, void *buffer, int count) 509 { 510 struct sk_buff *skb; 511 int err = 0; 512 513 spin_lock(&data->rxlock); 514 skb = data->sco_skb; 515 516 while (count) { 517 int len; 518 519 if (!skb) { 520 skb = bt_skb_alloc(HCI_MAX_SCO_SIZE, GFP_ATOMIC); 521 if (!skb) { 522 err = -ENOMEM; 523 break; 524 } 525 526 bt_cb(skb)->pkt_type = HCI_SCODATA_PKT; 527 bt_cb(skb)->expect = HCI_SCO_HDR_SIZE; 528 } 529 530 len = min_t(uint, bt_cb(skb)->expect, count); 531 memcpy(skb_put(skb, len), buffer, len); 532 533 count -= len; 534 buffer += len; 535 bt_cb(skb)->expect -= len; 536 537 if (skb->len == HCI_SCO_HDR_SIZE) { 538 /* Complete SCO header */ 539 bt_cb(skb)->expect = hci_sco_hdr(skb)->dlen; 540 541 if (skb_tailroom(skb) < bt_cb(skb)->expect) { 542 kfree_skb(skb); 543 skb = NULL; 544 545 err = -EILSEQ; 546 break; 547 } 548 } 549 550 if (bt_cb(skb)->expect == 0) { 551 /* Complete frame */ 552 hci_recv_frame(data->hdev, skb); 553 skb = NULL; 554 } 555 } 556 557 data->sco_skb = skb; 558 spin_unlock(&data->rxlock); 559 560 return err; 561 } 562 563 static void btusb_intr_complete(struct urb *urb) 564 { 565 struct hci_dev *hdev = urb->context; 566 struct btusb_data *data = hci_get_drvdata(hdev); 567 int err; 568 569 BT_DBG("%s urb %p status %d count %d", hdev->name, urb, urb->status, 570 urb->actual_length); 571 572 if (!test_bit(HCI_RUNNING, &hdev->flags)) 573 return; 574 575 if (urb->status == 0) { 576 hdev->stat.byte_rx += urb->actual_length; 577 578 if (btusb_recv_intr(data, urb->transfer_buffer, 579 urb->actual_length) < 0) { 580 BT_ERR("%s corrupted event packet", hdev->name); 581 hdev->stat.err_rx++; 582 } 583 } else if (urb->status == -ENOENT) { 584 /* Avoid suspend failed when usb_kill_urb */ 585 return; 586 } 587 588 if (!test_bit(BTUSB_INTR_RUNNING, &data->flags)) 589 return; 590 591 usb_mark_last_busy(data->udev); 592 usb_anchor_urb(urb, &data->intr_anchor); 593 594 err = usb_submit_urb(urb, GFP_ATOMIC); 595 if (err < 0) { 596 /* -EPERM: urb is being killed; 597 * -ENODEV: device got disconnected */ 598 if (err != -EPERM && err != -ENODEV) 599 BT_ERR("%s urb %p failed to resubmit (%d)", 600 hdev->name, urb, -err); 601 usb_unanchor_urb(urb); 602 } 603 } 604 605 static int btusb_submit_intr_urb(struct hci_dev *hdev, gfp_t mem_flags) 606 { 607 struct btusb_data *data = hci_get_drvdata(hdev); 608 struct urb *urb; 609 unsigned char *buf; 610 unsigned int pipe; 611 int err, size; 612 613 BT_DBG("%s", hdev->name); 614 615 if (!data->intr_ep) 616 return -ENODEV; 617 618 urb = usb_alloc_urb(0, mem_flags); 619 if (!urb) 620 return -ENOMEM; 621 622 size = le16_to_cpu(data->intr_ep->wMaxPacketSize); 623 624 buf = kmalloc(size, mem_flags); 625 if (!buf) { 626 usb_free_urb(urb); 627 return -ENOMEM; 628 } 629 630 pipe = usb_rcvintpipe(data->udev, data->intr_ep->bEndpointAddress); 631 632 usb_fill_int_urb(urb, data->udev, pipe, buf, size, 633 btusb_intr_complete, hdev, data->intr_ep->bInterval); 634 635 urb->transfer_flags |= URB_FREE_BUFFER; 636 637 usb_anchor_urb(urb, &data->intr_anchor); 638 639 err = usb_submit_urb(urb, mem_flags); 640 if (err < 0) { 641 if (err != -EPERM && err != -ENODEV) 642 BT_ERR("%s urb %p submission failed (%d)", 643 hdev->name, urb, -err); 644 usb_unanchor_urb(urb); 645 } 646 647 usb_free_urb(urb); 648 649 return err; 650 } 651 652 static void btusb_bulk_complete(struct urb *urb) 653 { 654 struct hci_dev *hdev = urb->context; 655 struct btusb_data *data = hci_get_drvdata(hdev); 656 int err; 657 658 BT_DBG("%s urb %p status %d count %d", hdev->name, urb, urb->status, 659 urb->actual_length); 660 661 if (!test_bit(HCI_RUNNING, &hdev->flags)) 662 return; 663 664 if (urb->status == 0) { 665 hdev->stat.byte_rx += urb->actual_length; 666 667 if (data->recv_bulk(data, urb->transfer_buffer, 668 urb->actual_length) < 0) { 669 BT_ERR("%s corrupted ACL packet", hdev->name); 670 hdev->stat.err_rx++; 671 } 672 } else if (urb->status == -ENOENT) { 673 /* Avoid suspend failed when usb_kill_urb */ 674 return; 675 } 676 677 if (!test_bit(BTUSB_BULK_RUNNING, &data->flags)) 678 return; 679 680 usb_anchor_urb(urb, &data->bulk_anchor); 681 usb_mark_last_busy(data->udev); 682 683 err = usb_submit_urb(urb, GFP_ATOMIC); 684 if (err < 0) { 685 /* -EPERM: urb is being killed; 686 * -ENODEV: device got disconnected */ 687 if (err != -EPERM && err != -ENODEV) 688 BT_ERR("%s urb %p failed to resubmit (%d)", 689 hdev->name, urb, -err); 690 usb_unanchor_urb(urb); 691 } 692 } 693 694 static int btusb_submit_bulk_urb(struct hci_dev *hdev, gfp_t mem_flags) 695 { 696 struct btusb_data *data = hci_get_drvdata(hdev); 697 struct urb *urb; 698 unsigned char *buf; 699 unsigned int pipe; 700 int err, size = HCI_MAX_FRAME_SIZE; 701 702 BT_DBG("%s", hdev->name); 703 704 if (!data->bulk_rx_ep) 705 return -ENODEV; 706 707 urb = usb_alloc_urb(0, mem_flags); 708 if (!urb) 709 return -ENOMEM; 710 711 buf = kmalloc(size, mem_flags); 712 if (!buf) { 713 usb_free_urb(urb); 714 return -ENOMEM; 715 } 716 717 pipe = usb_rcvbulkpipe(data->udev, data->bulk_rx_ep->bEndpointAddress); 718 719 usb_fill_bulk_urb(urb, data->udev, pipe, buf, size, 720 btusb_bulk_complete, hdev); 721 722 urb->transfer_flags |= URB_FREE_BUFFER; 723 724 usb_mark_last_busy(data->udev); 725 usb_anchor_urb(urb, &data->bulk_anchor); 726 727 err = usb_submit_urb(urb, mem_flags); 728 if (err < 0) { 729 if (err != -EPERM && err != -ENODEV) 730 BT_ERR("%s urb %p submission failed (%d)", 731 hdev->name, urb, -err); 732 usb_unanchor_urb(urb); 733 } 734 735 usb_free_urb(urb); 736 737 return err; 738 } 739 740 static void btusb_isoc_complete(struct urb *urb) 741 { 742 struct hci_dev *hdev = urb->context; 743 struct btusb_data *data = hci_get_drvdata(hdev); 744 int i, err; 745 746 BT_DBG("%s urb %p status %d count %d", hdev->name, urb, urb->status, 747 urb->actual_length); 748 749 if (!test_bit(HCI_RUNNING, &hdev->flags)) 750 return; 751 752 if (urb->status == 0) { 753 for (i = 0; i < urb->number_of_packets; i++) { 754 unsigned int offset = urb->iso_frame_desc[i].offset; 755 unsigned int length = urb->iso_frame_desc[i].actual_length; 756 757 if (urb->iso_frame_desc[i].status) 758 continue; 759 760 hdev->stat.byte_rx += length; 761 762 if (btusb_recv_isoc(data, urb->transfer_buffer + offset, 763 length) < 0) { 764 BT_ERR("%s corrupted SCO packet", hdev->name); 765 hdev->stat.err_rx++; 766 } 767 } 768 } else if (urb->status == -ENOENT) { 769 /* Avoid suspend failed when usb_kill_urb */ 770 return; 771 } 772 773 if (!test_bit(BTUSB_ISOC_RUNNING, &data->flags)) 774 return; 775 776 usb_anchor_urb(urb, &data->isoc_anchor); 777 778 err = usb_submit_urb(urb, GFP_ATOMIC); 779 if (err < 0) { 780 /* -EPERM: urb is being killed; 781 * -ENODEV: device got disconnected */ 782 if (err != -EPERM && err != -ENODEV) 783 BT_ERR("%s urb %p failed to resubmit (%d)", 784 hdev->name, urb, -err); 785 usb_unanchor_urb(urb); 786 } 787 } 788 789 static inline void __fill_isoc_descriptor(struct urb *urb, int len, int mtu) 790 { 791 int i, offset = 0; 792 793 BT_DBG("len %d mtu %d", len, mtu); 794 795 for (i = 0; i < BTUSB_MAX_ISOC_FRAMES && len >= mtu; 796 i++, offset += mtu, len -= mtu) { 797 urb->iso_frame_desc[i].offset = offset; 798 urb->iso_frame_desc[i].length = mtu; 799 } 800 801 if (len && i < BTUSB_MAX_ISOC_FRAMES) { 802 urb->iso_frame_desc[i].offset = offset; 803 urb->iso_frame_desc[i].length = len; 804 i++; 805 } 806 807 urb->number_of_packets = i; 808 } 809 810 static int btusb_submit_isoc_urb(struct hci_dev *hdev, gfp_t mem_flags) 811 { 812 struct btusb_data *data = hci_get_drvdata(hdev); 813 struct urb *urb; 814 unsigned char *buf; 815 unsigned int pipe; 816 int err, size; 817 818 BT_DBG("%s", hdev->name); 819 820 if (!data->isoc_rx_ep) 821 return -ENODEV; 822 823 urb = usb_alloc_urb(BTUSB_MAX_ISOC_FRAMES, mem_flags); 824 if (!urb) 825 return -ENOMEM; 826 827 size = le16_to_cpu(data->isoc_rx_ep->wMaxPacketSize) * 828 BTUSB_MAX_ISOC_FRAMES; 829 830 buf = kmalloc(size, mem_flags); 831 if (!buf) { 832 usb_free_urb(urb); 833 return -ENOMEM; 834 } 835 836 pipe = usb_rcvisocpipe(data->udev, data->isoc_rx_ep->bEndpointAddress); 837 838 usb_fill_int_urb(urb, data->udev, pipe, buf, size, btusb_isoc_complete, 839 hdev, data->isoc_rx_ep->bInterval); 840 841 urb->transfer_flags = URB_FREE_BUFFER | URB_ISO_ASAP; 842 843 __fill_isoc_descriptor(urb, size, 844 le16_to_cpu(data->isoc_rx_ep->wMaxPacketSize)); 845 846 usb_anchor_urb(urb, &data->isoc_anchor); 847 848 err = usb_submit_urb(urb, mem_flags); 849 if (err < 0) { 850 if (err != -EPERM && err != -ENODEV) 851 BT_ERR("%s urb %p submission failed (%d)", 852 hdev->name, urb, -err); 853 usb_unanchor_urb(urb); 854 } 855 856 usb_free_urb(urb); 857 858 return err; 859 } 860 861 static void btusb_tx_complete(struct urb *urb) 862 { 863 struct sk_buff *skb = urb->context; 864 struct hci_dev *hdev = (struct hci_dev *)skb->dev; 865 struct btusb_data *data = hci_get_drvdata(hdev); 866 867 BT_DBG("%s urb %p status %d count %d", hdev->name, urb, urb->status, 868 urb->actual_length); 869 870 if (!test_bit(HCI_RUNNING, &hdev->flags)) 871 goto done; 872 873 if (!urb->status) 874 hdev->stat.byte_tx += urb->transfer_buffer_length; 875 else 876 hdev->stat.err_tx++; 877 878 done: 879 spin_lock(&data->txlock); 880 data->tx_in_flight--; 881 spin_unlock(&data->txlock); 882 883 kfree(urb->setup_packet); 884 885 kfree_skb(skb); 886 } 887 888 static void btusb_isoc_tx_complete(struct urb *urb) 889 { 890 struct sk_buff *skb = urb->context; 891 struct hci_dev *hdev = (struct hci_dev *)skb->dev; 892 893 BT_DBG("%s urb %p status %d count %d", hdev->name, urb, urb->status, 894 urb->actual_length); 895 896 if (!test_bit(HCI_RUNNING, &hdev->flags)) 897 goto done; 898 899 if (!urb->status) 900 hdev->stat.byte_tx += urb->transfer_buffer_length; 901 else 902 hdev->stat.err_tx++; 903 904 done: 905 kfree(urb->setup_packet); 906 907 kfree_skb(skb); 908 } 909 910 static int btusb_open(struct hci_dev *hdev) 911 { 912 struct btusb_data *data = hci_get_drvdata(hdev); 913 int err; 914 915 BT_DBG("%s", hdev->name); 916 917 /* Patching USB firmware files prior to starting any URBs of HCI path 918 * It is more safe to use USB bulk channel for downloading USB patch 919 */ 920 if (data->setup_on_usb) { 921 err = data->setup_on_usb(hdev); 922 if (err < 0) 923 return err; 924 } 925 926 err = usb_autopm_get_interface(data->intf); 927 if (err < 0) 928 return err; 929 930 data->intf->needs_remote_wakeup = 1; 931 932 if (test_and_set_bit(HCI_RUNNING, &hdev->flags)) 933 goto done; 934 935 if (test_and_set_bit(BTUSB_INTR_RUNNING, &data->flags)) 936 goto done; 937 938 err = btusb_submit_intr_urb(hdev, GFP_KERNEL); 939 if (err < 0) 940 goto failed; 941 942 err = btusb_submit_bulk_urb(hdev, GFP_KERNEL); 943 if (err < 0) { 944 usb_kill_anchored_urbs(&data->intr_anchor); 945 goto failed; 946 } 947 948 set_bit(BTUSB_BULK_RUNNING, &data->flags); 949 btusb_submit_bulk_urb(hdev, GFP_KERNEL); 950 951 done: 952 usb_autopm_put_interface(data->intf); 953 return 0; 954 955 failed: 956 clear_bit(BTUSB_INTR_RUNNING, &data->flags); 957 clear_bit(HCI_RUNNING, &hdev->flags); 958 usb_autopm_put_interface(data->intf); 959 return err; 960 } 961 962 static void btusb_stop_traffic(struct btusb_data *data) 963 { 964 usb_kill_anchored_urbs(&data->intr_anchor); 965 usb_kill_anchored_urbs(&data->bulk_anchor); 966 usb_kill_anchored_urbs(&data->isoc_anchor); 967 } 968 969 static int btusb_close(struct hci_dev *hdev) 970 { 971 struct btusb_data *data = hci_get_drvdata(hdev); 972 int err; 973 974 BT_DBG("%s", hdev->name); 975 976 if (!test_and_clear_bit(HCI_RUNNING, &hdev->flags)) 977 return 0; 978 979 cancel_work_sync(&data->work); 980 cancel_work_sync(&data->waker); 981 982 clear_bit(BTUSB_ISOC_RUNNING, &data->flags); 983 clear_bit(BTUSB_BULK_RUNNING, &data->flags); 984 clear_bit(BTUSB_INTR_RUNNING, &data->flags); 985 986 btusb_stop_traffic(data); 987 btusb_free_frags(data); 988 989 err = usb_autopm_get_interface(data->intf); 990 if (err < 0) 991 goto failed; 992 993 data->intf->needs_remote_wakeup = 0; 994 usb_autopm_put_interface(data->intf); 995 996 failed: 997 usb_scuttle_anchored_urbs(&data->deferred); 998 return 0; 999 } 1000 1001 static int btusb_flush(struct hci_dev *hdev) 1002 { 1003 struct btusb_data *data = hci_get_drvdata(hdev); 1004 1005 BT_DBG("%s", hdev->name); 1006 1007 usb_kill_anchored_urbs(&data->tx_anchor); 1008 btusb_free_frags(data); 1009 1010 return 0; 1011 } 1012 1013 static struct urb *alloc_ctrl_urb(struct hci_dev *hdev, struct sk_buff *skb) 1014 { 1015 struct btusb_data *data = hci_get_drvdata(hdev); 1016 struct usb_ctrlrequest *dr; 1017 struct urb *urb; 1018 unsigned int pipe; 1019 1020 urb = usb_alloc_urb(0, GFP_KERNEL); 1021 if (!urb) 1022 return ERR_PTR(-ENOMEM); 1023 1024 dr = kmalloc(sizeof(*dr), GFP_KERNEL); 1025 if (!dr) { 1026 usb_free_urb(urb); 1027 return ERR_PTR(-ENOMEM); 1028 } 1029 1030 dr->bRequestType = data->cmdreq_type; 1031 dr->bRequest = data->cmdreq; 1032 dr->wIndex = 0; 1033 dr->wValue = 0; 1034 dr->wLength = __cpu_to_le16(skb->len); 1035 1036 pipe = usb_sndctrlpipe(data->udev, 0x00); 1037 1038 usb_fill_control_urb(urb, data->udev, pipe, (void *)dr, 1039 skb->data, skb->len, btusb_tx_complete, skb); 1040 1041 skb->dev = (void *)hdev; 1042 1043 return urb; 1044 } 1045 1046 static struct urb *alloc_bulk_urb(struct hci_dev *hdev, struct sk_buff *skb) 1047 { 1048 struct btusb_data *data = hci_get_drvdata(hdev); 1049 struct urb *urb; 1050 unsigned int pipe; 1051 1052 if (!data->bulk_tx_ep) 1053 return ERR_PTR(-ENODEV); 1054 1055 urb = usb_alloc_urb(0, GFP_KERNEL); 1056 if (!urb) 1057 return ERR_PTR(-ENOMEM); 1058 1059 pipe = usb_sndbulkpipe(data->udev, data->bulk_tx_ep->bEndpointAddress); 1060 1061 usb_fill_bulk_urb(urb, data->udev, pipe, 1062 skb->data, skb->len, btusb_tx_complete, skb); 1063 1064 skb->dev = (void *)hdev; 1065 1066 return urb; 1067 } 1068 1069 static struct urb *alloc_isoc_urb(struct hci_dev *hdev, struct sk_buff *skb) 1070 { 1071 struct btusb_data *data = hci_get_drvdata(hdev); 1072 struct urb *urb; 1073 unsigned int pipe; 1074 1075 if (!data->isoc_tx_ep) 1076 return ERR_PTR(-ENODEV); 1077 1078 urb = usb_alloc_urb(BTUSB_MAX_ISOC_FRAMES, GFP_KERNEL); 1079 if (!urb) 1080 return ERR_PTR(-ENOMEM); 1081 1082 pipe = usb_sndisocpipe(data->udev, data->isoc_tx_ep->bEndpointAddress); 1083 1084 usb_fill_int_urb(urb, data->udev, pipe, 1085 skb->data, skb->len, btusb_isoc_tx_complete, 1086 skb, data->isoc_tx_ep->bInterval); 1087 1088 urb->transfer_flags = URB_ISO_ASAP; 1089 1090 __fill_isoc_descriptor(urb, skb->len, 1091 le16_to_cpu(data->isoc_tx_ep->wMaxPacketSize)); 1092 1093 skb->dev = (void *)hdev; 1094 1095 return urb; 1096 } 1097 1098 static int submit_tx_urb(struct hci_dev *hdev, struct urb *urb) 1099 { 1100 struct btusb_data *data = hci_get_drvdata(hdev); 1101 int err; 1102 1103 usb_anchor_urb(urb, &data->tx_anchor); 1104 1105 err = usb_submit_urb(urb, GFP_KERNEL); 1106 if (err < 0) { 1107 if (err != -EPERM && err != -ENODEV) 1108 BT_ERR("%s urb %p submission failed (%d)", 1109 hdev->name, urb, -err); 1110 kfree(urb->setup_packet); 1111 usb_unanchor_urb(urb); 1112 } else { 1113 usb_mark_last_busy(data->udev); 1114 } 1115 1116 usb_free_urb(urb); 1117 return err; 1118 } 1119 1120 static int submit_or_queue_tx_urb(struct hci_dev *hdev, struct urb *urb) 1121 { 1122 struct btusb_data *data = hci_get_drvdata(hdev); 1123 unsigned long flags; 1124 bool suspending; 1125 1126 spin_lock_irqsave(&data->txlock, flags); 1127 suspending = test_bit(BTUSB_SUSPENDING, &data->flags); 1128 if (!suspending) 1129 data->tx_in_flight++; 1130 spin_unlock_irqrestore(&data->txlock, flags); 1131 1132 if (!suspending) 1133 return submit_tx_urb(hdev, urb); 1134 1135 usb_anchor_urb(urb, &data->deferred); 1136 schedule_work(&data->waker); 1137 1138 usb_free_urb(urb); 1139 return 0; 1140 } 1141 1142 static int btusb_send_frame(struct hci_dev *hdev, struct sk_buff *skb) 1143 { 1144 struct urb *urb; 1145 1146 BT_DBG("%s", hdev->name); 1147 1148 if (!test_bit(HCI_RUNNING, &hdev->flags)) 1149 return -EBUSY; 1150 1151 switch (bt_cb(skb)->pkt_type) { 1152 case HCI_COMMAND_PKT: 1153 urb = alloc_ctrl_urb(hdev, skb); 1154 if (IS_ERR(urb)) 1155 return PTR_ERR(urb); 1156 1157 hdev->stat.cmd_tx++; 1158 return submit_or_queue_tx_urb(hdev, urb); 1159 1160 case HCI_ACLDATA_PKT: 1161 urb = alloc_bulk_urb(hdev, skb); 1162 if (IS_ERR(urb)) 1163 return PTR_ERR(urb); 1164 1165 hdev->stat.acl_tx++; 1166 return submit_or_queue_tx_urb(hdev, urb); 1167 1168 case HCI_SCODATA_PKT: 1169 if (hci_conn_num(hdev, SCO_LINK) < 1) 1170 return -ENODEV; 1171 1172 urb = alloc_isoc_urb(hdev, skb); 1173 if (IS_ERR(urb)) 1174 return PTR_ERR(urb); 1175 1176 hdev->stat.sco_tx++; 1177 return submit_tx_urb(hdev, urb); 1178 } 1179 1180 return -EILSEQ; 1181 } 1182 1183 static void btusb_notify(struct hci_dev *hdev, unsigned int evt) 1184 { 1185 struct btusb_data *data = hci_get_drvdata(hdev); 1186 1187 BT_DBG("%s evt %d", hdev->name, evt); 1188 1189 if (hci_conn_num(hdev, SCO_LINK) != data->sco_num) { 1190 data->sco_num = hci_conn_num(hdev, SCO_LINK); 1191 schedule_work(&data->work); 1192 } 1193 } 1194 1195 static inline int __set_isoc_interface(struct hci_dev *hdev, int altsetting) 1196 { 1197 struct btusb_data *data = hci_get_drvdata(hdev); 1198 struct usb_interface *intf = data->isoc; 1199 struct usb_endpoint_descriptor *ep_desc; 1200 int i, err; 1201 1202 if (!data->isoc) 1203 return -ENODEV; 1204 1205 err = usb_set_interface(data->udev, 1, altsetting); 1206 if (err < 0) { 1207 BT_ERR("%s setting interface failed (%d)", hdev->name, -err); 1208 return err; 1209 } 1210 1211 data->isoc_altsetting = altsetting; 1212 1213 data->isoc_tx_ep = NULL; 1214 data->isoc_rx_ep = NULL; 1215 1216 for (i = 0; i < intf->cur_altsetting->desc.bNumEndpoints; i++) { 1217 ep_desc = &intf->cur_altsetting->endpoint[i].desc; 1218 1219 if (!data->isoc_tx_ep && usb_endpoint_is_isoc_out(ep_desc)) { 1220 data->isoc_tx_ep = ep_desc; 1221 continue; 1222 } 1223 1224 if (!data->isoc_rx_ep && usb_endpoint_is_isoc_in(ep_desc)) { 1225 data->isoc_rx_ep = ep_desc; 1226 continue; 1227 } 1228 } 1229 1230 if (!data->isoc_tx_ep || !data->isoc_rx_ep) { 1231 BT_ERR("%s invalid SCO descriptors", hdev->name); 1232 return -ENODEV; 1233 } 1234 1235 return 0; 1236 } 1237 1238 static void btusb_work(struct work_struct *work) 1239 { 1240 struct btusb_data *data = container_of(work, struct btusb_data, work); 1241 struct hci_dev *hdev = data->hdev; 1242 int new_alts; 1243 int err; 1244 1245 if (data->sco_num > 0) { 1246 if (!test_bit(BTUSB_DID_ISO_RESUME, &data->flags)) { 1247 err = usb_autopm_get_interface(data->isoc ? data->isoc : data->intf); 1248 if (err < 0) { 1249 clear_bit(BTUSB_ISOC_RUNNING, &data->flags); 1250 usb_kill_anchored_urbs(&data->isoc_anchor); 1251 return; 1252 } 1253 1254 set_bit(BTUSB_DID_ISO_RESUME, &data->flags); 1255 } 1256 1257 if (hdev->voice_setting & 0x0020) { 1258 static const int alts[3] = { 2, 4, 5 }; 1259 1260 new_alts = alts[data->sco_num - 1]; 1261 } else { 1262 new_alts = data->sco_num; 1263 } 1264 1265 if (data->isoc_altsetting != new_alts) { 1266 clear_bit(BTUSB_ISOC_RUNNING, &data->flags); 1267 usb_kill_anchored_urbs(&data->isoc_anchor); 1268 1269 if (__set_isoc_interface(hdev, new_alts) < 0) 1270 return; 1271 } 1272 1273 if (!test_and_set_bit(BTUSB_ISOC_RUNNING, &data->flags)) { 1274 if (btusb_submit_isoc_urb(hdev, GFP_KERNEL) < 0) 1275 clear_bit(BTUSB_ISOC_RUNNING, &data->flags); 1276 else 1277 btusb_submit_isoc_urb(hdev, GFP_KERNEL); 1278 } 1279 } else { 1280 clear_bit(BTUSB_ISOC_RUNNING, &data->flags); 1281 usb_kill_anchored_urbs(&data->isoc_anchor); 1282 1283 __set_isoc_interface(hdev, 0); 1284 if (test_and_clear_bit(BTUSB_DID_ISO_RESUME, &data->flags)) 1285 usb_autopm_put_interface(data->isoc ? data->isoc : data->intf); 1286 } 1287 } 1288 1289 static void btusb_waker(struct work_struct *work) 1290 { 1291 struct btusb_data *data = container_of(work, struct btusb_data, waker); 1292 int err; 1293 1294 err = usb_autopm_get_interface(data->intf); 1295 if (err < 0) 1296 return; 1297 1298 usb_autopm_put_interface(data->intf); 1299 } 1300 1301 static struct sk_buff *btusb_read_local_version(struct hci_dev *hdev) 1302 { 1303 struct sk_buff *skb; 1304 1305 skb = __hci_cmd_sync(hdev, HCI_OP_READ_LOCAL_VERSION, 0, NULL, 1306 HCI_INIT_TIMEOUT); 1307 if (IS_ERR(skb)) { 1308 BT_ERR("%s: HCI_OP_READ_LOCAL_VERSION failed (%ld)", 1309 hdev->name, PTR_ERR(skb)); 1310 return skb; 1311 } 1312 1313 if (skb->len != sizeof(struct hci_rp_read_local_version)) { 1314 BT_ERR("%s: HCI_OP_READ_LOCAL_VERSION event length mismatch", 1315 hdev->name); 1316 kfree_skb(skb); 1317 return ERR_PTR(-EIO); 1318 } 1319 1320 return skb; 1321 } 1322 1323 static int btusb_setup_bcm92035(struct hci_dev *hdev) 1324 { 1325 struct sk_buff *skb; 1326 u8 val = 0x00; 1327 1328 BT_DBG("%s", hdev->name); 1329 1330 skb = __hci_cmd_sync(hdev, 0xfc3b, 1, &val, HCI_INIT_TIMEOUT); 1331 if (IS_ERR(skb)) 1332 BT_ERR("BCM92035 command failed (%ld)", -PTR_ERR(skb)); 1333 else 1334 kfree_skb(skb); 1335 1336 return 0; 1337 } 1338 1339 static int btusb_setup_csr(struct hci_dev *hdev) 1340 { 1341 struct hci_rp_read_local_version *rp; 1342 struct sk_buff *skb; 1343 int ret; 1344 1345 BT_DBG("%s", hdev->name); 1346 1347 skb = btusb_read_local_version(hdev); 1348 if (IS_ERR(skb)) 1349 return -PTR_ERR(skb); 1350 1351 rp = (struct hci_rp_read_local_version *)skb->data; 1352 1353 if (!rp->status) { 1354 if (le16_to_cpu(rp->manufacturer) != 10) { 1355 /* Clear the reset quirk since this is not an actual 1356 * early Bluetooth 1.1 device from CSR. 1357 */ 1358 clear_bit(HCI_QUIRK_RESET_ON_CLOSE, &hdev->quirks); 1359 1360 /* These fake CSR controllers have all a broken 1361 * stored link key handling and so just disable it. 1362 */ 1363 set_bit(HCI_QUIRK_BROKEN_STORED_LINK_KEY, 1364 &hdev->quirks); 1365 } 1366 } 1367 1368 ret = -bt_to_errno(rp->status); 1369 1370 kfree_skb(skb); 1371 1372 return ret; 1373 } 1374 1375 #define RTL_FRAG_LEN 252 1376 1377 struct rtl_download_cmd { 1378 __u8 index; 1379 __u8 data[RTL_FRAG_LEN]; 1380 } __packed; 1381 1382 struct rtl_download_response { 1383 __u8 status; 1384 __u8 index; 1385 } __packed; 1386 1387 struct rtl_rom_version_evt { 1388 __u8 status; 1389 __u8 version; 1390 } __packed; 1391 1392 struct rtl_epatch_header { 1393 __u8 signature[8]; 1394 __le32 fw_version; 1395 __le16 num_patches; 1396 } __packed; 1397 1398 #define RTL_EPATCH_SIGNATURE "Realtech" 1399 #define RTL_ROM_LMP_3499 0x3499 1400 #define RTL_ROM_LMP_8723A 0x1200 1401 #define RTL_ROM_LMP_8723B 0x8723 1402 #define RTL_ROM_LMP_8821A 0x8821 1403 #define RTL_ROM_LMP_8761A 0x8761 1404 1405 static int rtl_read_rom_version(struct hci_dev *hdev, u8 *version) 1406 { 1407 struct rtl_rom_version_evt *rom_version; 1408 struct sk_buff *skb; 1409 int ret; 1410 1411 /* Read RTL ROM version command */ 1412 skb = __hci_cmd_sync(hdev, 0xfc6d, 0, NULL, HCI_INIT_TIMEOUT); 1413 if (IS_ERR(skb)) { 1414 BT_ERR("%s: Read ROM version failed (%ld)", 1415 hdev->name, PTR_ERR(skb)); 1416 return PTR_ERR(skb); 1417 } 1418 1419 if (skb->len != sizeof(*rom_version)) { 1420 BT_ERR("%s: RTL version event length mismatch", hdev->name); 1421 kfree_skb(skb); 1422 return -EIO; 1423 } 1424 1425 rom_version = (struct rtl_rom_version_evt *)skb->data; 1426 BT_INFO("%s: rom_version status=%x version=%x", 1427 hdev->name, rom_version->status, rom_version->version); 1428 1429 ret = rom_version->status; 1430 if (ret == 0) 1431 *version = rom_version->version; 1432 1433 kfree_skb(skb); 1434 return ret; 1435 } 1436 1437 static int rtl8723b_parse_firmware(struct hci_dev *hdev, u16 lmp_subver, 1438 const struct firmware *fw, 1439 unsigned char **_buf) 1440 { 1441 const u8 extension_sig[] = { 0x51, 0x04, 0xfd, 0x77 }; 1442 struct rtl_epatch_header *epatch_info; 1443 unsigned char *buf; 1444 int i, ret, len; 1445 size_t min_size; 1446 u8 opcode, length, data, rom_version = 0; 1447 int project_id = -1; 1448 const unsigned char *fwptr, *chip_id_base; 1449 const unsigned char *patch_length_base, *patch_offset_base; 1450 u32 patch_offset = 0; 1451 u16 patch_length, num_patches; 1452 const u16 project_id_to_lmp_subver[] = { 1453 RTL_ROM_LMP_8723A, 1454 RTL_ROM_LMP_8723B, 1455 RTL_ROM_LMP_8821A, 1456 RTL_ROM_LMP_8761A 1457 }; 1458 1459 ret = rtl_read_rom_version(hdev, &rom_version); 1460 if (ret) 1461 return -bt_to_errno(ret); 1462 1463 min_size = sizeof(struct rtl_epatch_header) + sizeof(extension_sig) + 3; 1464 if (fw->size < min_size) 1465 return -EINVAL; 1466 1467 fwptr = fw->data + fw->size - sizeof(extension_sig); 1468 if (memcmp(fwptr, extension_sig, sizeof(extension_sig)) != 0) { 1469 BT_ERR("%s: extension section signature mismatch", hdev->name); 1470 return -EINVAL; 1471 } 1472 1473 /* Loop from the end of the firmware parsing instructions, until 1474 * we find an instruction that identifies the "project ID" for the 1475 * hardware supported by this firwmare file. 1476 * Once we have that, we double-check that that project_id is suitable 1477 * for the hardware we are working with. 1478 */ 1479 while (fwptr >= fw->data + (sizeof(struct rtl_epatch_header) + 3)) { 1480 opcode = *--fwptr; 1481 length = *--fwptr; 1482 data = *--fwptr; 1483 1484 BT_DBG("check op=%x len=%x data=%x", opcode, length, data); 1485 1486 if (opcode == 0xff) /* EOF */ 1487 break; 1488 1489 if (length == 0) { 1490 BT_ERR("%s: found instruction with length 0", 1491 hdev->name); 1492 return -EINVAL; 1493 } 1494 1495 if (opcode == 0 && length == 1) { 1496 project_id = data; 1497 break; 1498 } 1499 1500 fwptr -= length; 1501 } 1502 1503 if (project_id < 0) { 1504 BT_ERR("%s: failed to find version instruction", hdev->name); 1505 return -EINVAL; 1506 } 1507 1508 if (project_id >= ARRAY_SIZE(project_id_to_lmp_subver)) { 1509 BT_ERR("%s: unknown project id %d", hdev->name, project_id); 1510 return -EINVAL; 1511 } 1512 1513 if (lmp_subver != project_id_to_lmp_subver[project_id]) { 1514 BT_ERR("%s: firmware is for %x but this is a %x", hdev->name, 1515 project_id_to_lmp_subver[project_id], lmp_subver); 1516 return -EINVAL; 1517 } 1518 1519 epatch_info = (struct rtl_epatch_header *)fw->data; 1520 if (memcmp(epatch_info->signature, RTL_EPATCH_SIGNATURE, 8) != 0) { 1521 BT_ERR("%s: bad EPATCH signature", hdev->name); 1522 return -EINVAL; 1523 } 1524 1525 num_patches = le16_to_cpu(epatch_info->num_patches); 1526 BT_DBG("fw_version=%x, num_patches=%d", 1527 le32_to_cpu(epatch_info->fw_version), num_patches); 1528 1529 /* After the rtl_epatch_header there is a funky patch metadata section. 1530 * Assuming 2 patches, the layout is: 1531 * ChipID1 ChipID2 PatchLength1 PatchLength2 PatchOffset1 PatchOffset2 1532 * 1533 * Find the right patch for this chip. 1534 */ 1535 min_size += 8 * num_patches; 1536 if (fw->size < min_size) 1537 return -EINVAL; 1538 1539 chip_id_base = fw->data + sizeof(struct rtl_epatch_header); 1540 patch_length_base = chip_id_base + (sizeof(u16) * num_patches); 1541 patch_offset_base = patch_length_base + (sizeof(u16) * num_patches); 1542 for (i = 0; i < num_patches; i++) { 1543 u16 chip_id = get_unaligned_le16(chip_id_base + 1544 (i * sizeof(u16))); 1545 if (chip_id == rom_version + 1) { 1546 patch_length = get_unaligned_le16(patch_length_base + 1547 (i * sizeof(u16))); 1548 patch_offset = get_unaligned_le32(patch_offset_base + 1549 (i * sizeof(u32))); 1550 break; 1551 } 1552 } 1553 1554 if (!patch_offset) { 1555 BT_ERR("%s: didn't find patch for chip id %d", 1556 hdev->name, rom_version); 1557 return -EINVAL; 1558 } 1559 1560 BT_DBG("length=%x offset=%x index %d", patch_length, patch_offset, i); 1561 min_size = patch_offset + patch_length; 1562 if (fw->size < min_size) 1563 return -EINVAL; 1564 1565 /* Copy the firmware into a new buffer and write the version at 1566 * the end. 1567 */ 1568 len = patch_length; 1569 buf = kmemdup(fw->data + patch_offset, patch_length, GFP_KERNEL); 1570 if (!buf) 1571 return -ENOMEM; 1572 1573 memcpy(buf + patch_length - 4, &epatch_info->fw_version, 4); 1574 1575 *_buf = buf; 1576 return len; 1577 } 1578 1579 static int rtl_download_firmware(struct hci_dev *hdev, 1580 const unsigned char *data, int fw_len) 1581 { 1582 struct rtl_download_cmd *dl_cmd; 1583 int frag_num = fw_len / RTL_FRAG_LEN + 1; 1584 int frag_len = RTL_FRAG_LEN; 1585 int ret = 0; 1586 int i; 1587 1588 dl_cmd = kmalloc(sizeof(struct rtl_download_cmd), GFP_KERNEL); 1589 if (!dl_cmd) 1590 return -ENOMEM; 1591 1592 for (i = 0; i < frag_num; i++) { 1593 struct rtl_download_response *dl_resp; 1594 struct sk_buff *skb; 1595 1596 BT_DBG("download fw (%d/%d)", i, frag_num); 1597 1598 dl_cmd->index = i; 1599 if (i == (frag_num - 1)) { 1600 dl_cmd->index |= 0x80; /* data end */ 1601 frag_len = fw_len % RTL_FRAG_LEN; 1602 } 1603 memcpy(dl_cmd->data, data, frag_len); 1604 1605 /* Send download command */ 1606 skb = __hci_cmd_sync(hdev, 0xfc20, frag_len + 1, dl_cmd, 1607 HCI_INIT_TIMEOUT); 1608 if (IS_ERR(skb)) { 1609 BT_ERR("%s: download fw command failed (%ld)", 1610 hdev->name, PTR_ERR(skb)); 1611 ret = -PTR_ERR(skb); 1612 goto out; 1613 } 1614 1615 if (skb->len != sizeof(*dl_resp)) { 1616 BT_ERR("%s: download fw event length mismatch", 1617 hdev->name); 1618 kfree_skb(skb); 1619 ret = -EIO; 1620 goto out; 1621 } 1622 1623 dl_resp = (struct rtl_download_response *)skb->data; 1624 if (dl_resp->status != 0) { 1625 kfree_skb(skb); 1626 ret = bt_to_errno(dl_resp->status); 1627 goto out; 1628 } 1629 1630 kfree_skb(skb); 1631 data += RTL_FRAG_LEN; 1632 } 1633 1634 out: 1635 kfree(dl_cmd); 1636 return ret; 1637 } 1638 1639 static int btusb_setup_rtl8723a(struct hci_dev *hdev) 1640 { 1641 struct btusb_data *data = dev_get_drvdata(&hdev->dev); 1642 struct usb_device *udev = interface_to_usbdev(data->intf); 1643 const struct firmware *fw; 1644 int ret; 1645 1646 BT_INFO("%s: rtl: loading rtl_bt/rtl8723a_fw.bin", hdev->name); 1647 ret = request_firmware(&fw, "rtl_bt/rtl8723a_fw.bin", &udev->dev); 1648 if (ret < 0) { 1649 BT_ERR("%s: Failed to load rtl_bt/rtl8723a_fw.bin", hdev->name); 1650 return ret; 1651 } 1652 1653 if (fw->size < 8) { 1654 ret = -EINVAL; 1655 goto out; 1656 } 1657 1658 /* Check that the firmware doesn't have the epatch signature 1659 * (which is only for RTL8723B and newer). 1660 */ 1661 if (!memcmp(fw->data, RTL_EPATCH_SIGNATURE, 8)) { 1662 BT_ERR("%s: unexpected EPATCH signature!", hdev->name); 1663 ret = -EINVAL; 1664 goto out; 1665 } 1666 1667 ret = rtl_download_firmware(hdev, fw->data, fw->size); 1668 1669 out: 1670 release_firmware(fw); 1671 return ret; 1672 } 1673 1674 static int btusb_setup_rtl8723b(struct hci_dev *hdev, u16 lmp_subver, 1675 const char *fw_name) 1676 { 1677 struct btusb_data *data = dev_get_drvdata(&hdev->dev); 1678 struct usb_device *udev = interface_to_usbdev(data->intf); 1679 unsigned char *fw_data = NULL; 1680 const struct firmware *fw; 1681 int ret; 1682 1683 BT_INFO("%s: rtl: loading %s", hdev->name, fw_name); 1684 ret = request_firmware(&fw, fw_name, &udev->dev); 1685 if (ret < 0) { 1686 BT_ERR("%s: Failed to load %s", hdev->name, fw_name); 1687 return ret; 1688 } 1689 1690 ret = rtl8723b_parse_firmware(hdev, lmp_subver, fw, &fw_data); 1691 if (ret < 0) 1692 goto out; 1693 1694 ret = rtl_download_firmware(hdev, fw_data, ret); 1695 kfree(fw_data); 1696 if (ret < 0) 1697 goto out; 1698 1699 out: 1700 release_firmware(fw); 1701 return ret; 1702 } 1703 1704 static int btusb_setup_realtek(struct hci_dev *hdev) 1705 { 1706 struct sk_buff *skb; 1707 struct hci_rp_read_local_version *resp; 1708 u16 lmp_subver; 1709 1710 skb = btusb_read_local_version(hdev); 1711 if (IS_ERR(skb)) 1712 return -PTR_ERR(skb); 1713 1714 resp = (struct hci_rp_read_local_version *)skb->data; 1715 BT_INFO("%s: rtl: examining hci_ver=%02x hci_rev=%04x lmp_ver=%02x " 1716 "lmp_subver=%04x", hdev->name, resp->hci_ver, resp->hci_rev, 1717 resp->lmp_ver, resp->lmp_subver); 1718 1719 lmp_subver = le16_to_cpu(resp->lmp_subver); 1720 kfree_skb(skb); 1721 1722 /* Match a set of subver values that correspond to stock firmware, 1723 * which is not compatible with standard btusb. 1724 * If matched, upload an alternative firmware that does conform to 1725 * standard btusb. Once that firmware is uploaded, the subver changes 1726 * to a different value. 1727 */ 1728 switch (lmp_subver) { 1729 case RTL_ROM_LMP_8723A: 1730 case RTL_ROM_LMP_3499: 1731 return btusb_setup_rtl8723a(hdev); 1732 case RTL_ROM_LMP_8723B: 1733 return btusb_setup_rtl8723b(hdev, lmp_subver, 1734 "rtl_bt/rtl8723b_fw.bin"); 1735 case RTL_ROM_LMP_8821A: 1736 return btusb_setup_rtl8723b(hdev, lmp_subver, 1737 "rtl_bt/rtl8821a_fw.bin"); 1738 case RTL_ROM_LMP_8761A: 1739 return btusb_setup_rtl8723b(hdev, lmp_subver, 1740 "rtl_bt/rtl8761a_fw.bin"); 1741 default: 1742 BT_INFO("rtl: assuming no firmware upload needed."); 1743 return 0; 1744 } 1745 } 1746 1747 static const struct firmware *btusb_setup_intel_get_fw(struct hci_dev *hdev, 1748 struct intel_version *ver) 1749 { 1750 const struct firmware *fw; 1751 char fwname[64]; 1752 int ret; 1753 1754 snprintf(fwname, sizeof(fwname), 1755 "intel/ibt-hw-%x.%x.%x-fw-%x.%x.%x.%x.%x.bseq", 1756 ver->hw_platform, ver->hw_variant, ver->hw_revision, 1757 ver->fw_variant, ver->fw_revision, ver->fw_build_num, 1758 ver->fw_build_ww, ver->fw_build_yy); 1759 1760 ret = request_firmware(&fw, fwname, &hdev->dev); 1761 if (ret < 0) { 1762 if (ret == -EINVAL) { 1763 BT_ERR("%s Intel firmware file request failed (%d)", 1764 hdev->name, ret); 1765 return NULL; 1766 } 1767 1768 BT_ERR("%s failed to open Intel firmware file: %s(%d)", 1769 hdev->name, fwname, ret); 1770 1771 /* If the correct firmware patch file is not found, use the 1772 * default firmware patch file instead 1773 */ 1774 snprintf(fwname, sizeof(fwname), "intel/ibt-hw-%x.%x.bseq", 1775 ver->hw_platform, ver->hw_variant); 1776 if (request_firmware(&fw, fwname, &hdev->dev) < 0) { 1777 BT_ERR("%s failed to open default Intel fw file: %s", 1778 hdev->name, fwname); 1779 return NULL; 1780 } 1781 } 1782 1783 BT_INFO("%s: Intel Bluetooth firmware file: %s", hdev->name, fwname); 1784 1785 return fw; 1786 } 1787 1788 static int btusb_setup_intel_patching(struct hci_dev *hdev, 1789 const struct firmware *fw, 1790 const u8 **fw_ptr, int *disable_patch) 1791 { 1792 struct sk_buff *skb; 1793 struct hci_command_hdr *cmd; 1794 const u8 *cmd_param; 1795 struct hci_event_hdr *evt = NULL; 1796 const u8 *evt_param = NULL; 1797 int remain = fw->size - (*fw_ptr - fw->data); 1798 1799 /* The first byte indicates the types of the patch command or event. 1800 * 0x01 means HCI command and 0x02 is HCI event. If the first bytes 1801 * in the current firmware buffer doesn't start with 0x01 or 1802 * the size of remain buffer is smaller than HCI command header, 1803 * the firmware file is corrupted and it should stop the patching 1804 * process. 1805 */ 1806 if (remain > HCI_COMMAND_HDR_SIZE && *fw_ptr[0] != 0x01) { 1807 BT_ERR("%s Intel fw corrupted: invalid cmd read", hdev->name); 1808 return -EINVAL; 1809 } 1810 (*fw_ptr)++; 1811 remain--; 1812 1813 cmd = (struct hci_command_hdr *)(*fw_ptr); 1814 *fw_ptr += sizeof(*cmd); 1815 remain -= sizeof(*cmd); 1816 1817 /* Ensure that the remain firmware data is long enough than the length 1818 * of command parameter. If not, the firmware file is corrupted. 1819 */ 1820 if (remain < cmd->plen) { 1821 BT_ERR("%s Intel fw corrupted: invalid cmd len", hdev->name); 1822 return -EFAULT; 1823 } 1824 1825 /* If there is a command that loads a patch in the firmware 1826 * file, then enable the patch upon success, otherwise just 1827 * disable the manufacturer mode, for example patch activation 1828 * is not required when the default firmware patch file is used 1829 * because there are no patch data to load. 1830 */ 1831 if (*disable_patch && le16_to_cpu(cmd->opcode) == 0xfc8e) 1832 *disable_patch = 0; 1833 1834 cmd_param = *fw_ptr; 1835 *fw_ptr += cmd->plen; 1836 remain -= cmd->plen; 1837 1838 /* This reads the expected events when the above command is sent to the 1839 * device. Some vendor commands expects more than one events, for 1840 * example command status event followed by vendor specific event. 1841 * For this case, it only keeps the last expected event. so the command 1842 * can be sent with __hci_cmd_sync_ev() which returns the sk_buff of 1843 * last expected event. 1844 */ 1845 while (remain > HCI_EVENT_HDR_SIZE && *fw_ptr[0] == 0x02) { 1846 (*fw_ptr)++; 1847 remain--; 1848 1849 evt = (struct hci_event_hdr *)(*fw_ptr); 1850 *fw_ptr += sizeof(*evt); 1851 remain -= sizeof(*evt); 1852 1853 if (remain < evt->plen) { 1854 BT_ERR("%s Intel fw corrupted: invalid evt len", 1855 hdev->name); 1856 return -EFAULT; 1857 } 1858 1859 evt_param = *fw_ptr; 1860 *fw_ptr += evt->plen; 1861 remain -= evt->plen; 1862 } 1863 1864 /* Every HCI commands in the firmware file has its correspond event. 1865 * If event is not found or remain is smaller than zero, the firmware 1866 * file is corrupted. 1867 */ 1868 if (!evt || !evt_param || remain < 0) { 1869 BT_ERR("%s Intel fw corrupted: invalid evt read", hdev->name); 1870 return -EFAULT; 1871 } 1872 1873 skb = __hci_cmd_sync_ev(hdev, le16_to_cpu(cmd->opcode), cmd->plen, 1874 cmd_param, evt->evt, HCI_INIT_TIMEOUT); 1875 if (IS_ERR(skb)) { 1876 BT_ERR("%s sending Intel patch command (0x%4.4x) failed (%ld)", 1877 hdev->name, cmd->opcode, PTR_ERR(skb)); 1878 return PTR_ERR(skb); 1879 } 1880 1881 /* It ensures that the returned event matches the event data read from 1882 * the firmware file. At fist, it checks the length and then 1883 * the contents of the event. 1884 */ 1885 if (skb->len != evt->plen) { 1886 BT_ERR("%s mismatch event length (opcode 0x%4.4x)", hdev->name, 1887 le16_to_cpu(cmd->opcode)); 1888 kfree_skb(skb); 1889 return -EFAULT; 1890 } 1891 1892 if (memcmp(skb->data, evt_param, evt->plen)) { 1893 BT_ERR("%s mismatch event parameter (opcode 0x%4.4x)", 1894 hdev->name, le16_to_cpu(cmd->opcode)); 1895 kfree_skb(skb); 1896 return -EFAULT; 1897 } 1898 kfree_skb(skb); 1899 1900 return 0; 1901 } 1902 1903 static int btusb_setup_intel(struct hci_dev *hdev) 1904 { 1905 struct sk_buff *skb; 1906 const struct firmware *fw; 1907 const u8 *fw_ptr; 1908 int disable_patch; 1909 struct intel_version *ver; 1910 1911 const u8 mfg_enable[] = { 0x01, 0x00 }; 1912 const u8 mfg_disable[] = { 0x00, 0x00 }; 1913 const u8 mfg_reset_deactivate[] = { 0x00, 0x01 }; 1914 const u8 mfg_reset_activate[] = { 0x00, 0x02 }; 1915 1916 BT_DBG("%s", hdev->name); 1917 1918 /* The controller has a bug with the first HCI command sent to it 1919 * returning number of completed commands as zero. This would stall the 1920 * command processing in the Bluetooth core. 1921 * 1922 * As a workaround, send HCI Reset command first which will reset the 1923 * number of completed commands and allow normal command processing 1924 * from now on. 1925 */ 1926 skb = __hci_cmd_sync(hdev, HCI_OP_RESET, 0, NULL, HCI_INIT_TIMEOUT); 1927 if (IS_ERR(skb)) { 1928 BT_ERR("%s sending initial HCI reset command failed (%ld)", 1929 hdev->name, PTR_ERR(skb)); 1930 return PTR_ERR(skb); 1931 } 1932 kfree_skb(skb); 1933 1934 /* Read Intel specific controller version first to allow selection of 1935 * which firmware file to load. 1936 * 1937 * The returned information are hardware variant and revision plus 1938 * firmware variant, revision and build number. 1939 */ 1940 skb = __hci_cmd_sync(hdev, 0xfc05, 0, NULL, HCI_INIT_TIMEOUT); 1941 if (IS_ERR(skb)) { 1942 BT_ERR("%s reading Intel fw version command failed (%ld)", 1943 hdev->name, PTR_ERR(skb)); 1944 return PTR_ERR(skb); 1945 } 1946 1947 if (skb->len != sizeof(*ver)) { 1948 BT_ERR("%s Intel version event length mismatch", hdev->name); 1949 kfree_skb(skb); 1950 return -EIO; 1951 } 1952 1953 ver = (struct intel_version *)skb->data; 1954 if (ver->status) { 1955 BT_ERR("%s Intel fw version event failed (%02x)", hdev->name, 1956 ver->status); 1957 kfree_skb(skb); 1958 return -bt_to_errno(ver->status); 1959 } 1960 1961 BT_INFO("%s: read Intel version: %02x%02x%02x%02x%02x%02x%02x%02x%02x", 1962 hdev->name, ver->hw_platform, ver->hw_variant, 1963 ver->hw_revision, ver->fw_variant, ver->fw_revision, 1964 ver->fw_build_num, ver->fw_build_ww, ver->fw_build_yy, 1965 ver->fw_patch_num); 1966 1967 /* fw_patch_num indicates the version of patch the device currently 1968 * have. If there is no patch data in the device, it is always 0x00. 1969 * So, if it is other than 0x00, no need to patch the deivce again. 1970 */ 1971 if (ver->fw_patch_num) { 1972 BT_INFO("%s: Intel device is already patched. patch num: %02x", 1973 hdev->name, ver->fw_patch_num); 1974 kfree_skb(skb); 1975 btintel_check_bdaddr(hdev); 1976 return 0; 1977 } 1978 1979 /* Opens the firmware patch file based on the firmware version read 1980 * from the controller. If it fails to open the matching firmware 1981 * patch file, it tries to open the default firmware patch file. 1982 * If no patch file is found, allow the device to operate without 1983 * a patch. 1984 */ 1985 fw = btusb_setup_intel_get_fw(hdev, ver); 1986 if (!fw) { 1987 kfree_skb(skb); 1988 btintel_check_bdaddr(hdev); 1989 return 0; 1990 } 1991 fw_ptr = fw->data; 1992 1993 /* This Intel specific command enables the manufacturer mode of the 1994 * controller. 1995 * 1996 * Only while this mode is enabled, the driver can download the 1997 * firmware patch data and configuration parameters. 1998 */ 1999 skb = __hci_cmd_sync(hdev, 0xfc11, 2, mfg_enable, HCI_INIT_TIMEOUT); 2000 if (IS_ERR(skb)) { 2001 BT_ERR("%s entering Intel manufacturer mode failed (%ld)", 2002 hdev->name, PTR_ERR(skb)); 2003 release_firmware(fw); 2004 return PTR_ERR(skb); 2005 } 2006 2007 if (skb->data[0]) { 2008 u8 evt_status = skb->data[0]; 2009 2010 BT_ERR("%s enable Intel manufacturer mode event failed (%02x)", 2011 hdev->name, evt_status); 2012 kfree_skb(skb); 2013 release_firmware(fw); 2014 return -bt_to_errno(evt_status); 2015 } 2016 kfree_skb(skb); 2017 2018 disable_patch = 1; 2019 2020 /* The firmware data file consists of list of Intel specific HCI 2021 * commands and its expected events. The first byte indicates the 2022 * type of the message, either HCI command or HCI event. 2023 * 2024 * It reads the command and its expected event from the firmware file, 2025 * and send to the controller. Once __hci_cmd_sync_ev() returns, 2026 * the returned event is compared with the event read from the firmware 2027 * file and it will continue until all the messages are downloaded to 2028 * the controller. 2029 * 2030 * Once the firmware patching is completed successfully, 2031 * the manufacturer mode is disabled with reset and activating the 2032 * downloaded patch. 2033 * 2034 * If the firmware patching fails, the manufacturer mode is 2035 * disabled with reset and deactivating the patch. 2036 * 2037 * If the default patch file is used, no reset is done when disabling 2038 * the manufacturer. 2039 */ 2040 while (fw->size > fw_ptr - fw->data) { 2041 int ret; 2042 2043 ret = btusb_setup_intel_patching(hdev, fw, &fw_ptr, 2044 &disable_patch); 2045 if (ret < 0) 2046 goto exit_mfg_deactivate; 2047 } 2048 2049 release_firmware(fw); 2050 2051 if (disable_patch) 2052 goto exit_mfg_disable; 2053 2054 /* Patching completed successfully and disable the manufacturer mode 2055 * with reset and activate the downloaded firmware patches. 2056 */ 2057 skb = __hci_cmd_sync(hdev, 0xfc11, sizeof(mfg_reset_activate), 2058 mfg_reset_activate, HCI_INIT_TIMEOUT); 2059 if (IS_ERR(skb)) { 2060 BT_ERR("%s exiting Intel manufacturer mode failed (%ld)", 2061 hdev->name, PTR_ERR(skb)); 2062 return PTR_ERR(skb); 2063 } 2064 kfree_skb(skb); 2065 2066 BT_INFO("%s: Intel Bluetooth firmware patch completed and activated", 2067 hdev->name); 2068 2069 btintel_check_bdaddr(hdev); 2070 return 0; 2071 2072 exit_mfg_disable: 2073 /* Disable the manufacturer mode without reset */ 2074 skb = __hci_cmd_sync(hdev, 0xfc11, sizeof(mfg_disable), mfg_disable, 2075 HCI_INIT_TIMEOUT); 2076 if (IS_ERR(skb)) { 2077 BT_ERR("%s exiting Intel manufacturer mode failed (%ld)", 2078 hdev->name, PTR_ERR(skb)); 2079 return PTR_ERR(skb); 2080 } 2081 kfree_skb(skb); 2082 2083 BT_INFO("%s: Intel Bluetooth firmware patch completed", hdev->name); 2084 2085 btintel_check_bdaddr(hdev); 2086 return 0; 2087 2088 exit_mfg_deactivate: 2089 release_firmware(fw); 2090 2091 /* Patching failed. Disable the manufacturer mode with reset and 2092 * deactivate the downloaded firmware patches. 2093 */ 2094 skb = __hci_cmd_sync(hdev, 0xfc11, sizeof(mfg_reset_deactivate), 2095 mfg_reset_deactivate, HCI_INIT_TIMEOUT); 2096 if (IS_ERR(skb)) { 2097 BT_ERR("%s exiting Intel manufacturer mode failed (%ld)", 2098 hdev->name, PTR_ERR(skb)); 2099 return PTR_ERR(skb); 2100 } 2101 kfree_skb(skb); 2102 2103 BT_INFO("%s: Intel Bluetooth firmware patch completed and deactivated", 2104 hdev->name); 2105 2106 btintel_check_bdaddr(hdev); 2107 return 0; 2108 } 2109 2110 static int inject_cmd_complete(struct hci_dev *hdev, __u16 opcode) 2111 { 2112 struct sk_buff *skb; 2113 struct hci_event_hdr *hdr; 2114 struct hci_ev_cmd_complete *evt; 2115 2116 skb = bt_skb_alloc(sizeof(*hdr) + sizeof(*evt) + 1, GFP_ATOMIC); 2117 if (!skb) 2118 return -ENOMEM; 2119 2120 hdr = (struct hci_event_hdr *)skb_put(skb, sizeof(*hdr)); 2121 hdr->evt = HCI_EV_CMD_COMPLETE; 2122 hdr->plen = sizeof(*evt) + 1; 2123 2124 evt = (struct hci_ev_cmd_complete *)skb_put(skb, sizeof(*evt)); 2125 evt->ncmd = 0x01; 2126 evt->opcode = cpu_to_le16(opcode); 2127 2128 *skb_put(skb, 1) = 0x00; 2129 2130 bt_cb(skb)->pkt_type = HCI_EVENT_PKT; 2131 2132 return hci_recv_frame(hdev, skb); 2133 } 2134 2135 static int btusb_recv_bulk_intel(struct btusb_data *data, void *buffer, 2136 int count) 2137 { 2138 /* When the device is in bootloader mode, then it can send 2139 * events via the bulk endpoint. These events are treated the 2140 * same way as the ones received from the interrupt endpoint. 2141 */ 2142 if (test_bit(BTUSB_BOOTLOADER, &data->flags)) 2143 return btusb_recv_intr(data, buffer, count); 2144 2145 return btusb_recv_bulk(data, buffer, count); 2146 } 2147 2148 static void btusb_intel_bootup(struct btusb_data *data, const void *ptr, 2149 unsigned int len) 2150 { 2151 const struct intel_bootup *evt = ptr; 2152 2153 if (len != sizeof(*evt)) 2154 return; 2155 2156 if (test_and_clear_bit(BTUSB_BOOTING, &data->flags)) { 2157 smp_mb__after_atomic(); 2158 wake_up_bit(&data->flags, BTUSB_BOOTING); 2159 } 2160 } 2161 2162 static void btusb_intel_secure_send_result(struct btusb_data *data, 2163 const void *ptr, unsigned int len) 2164 { 2165 const struct intel_secure_send_result *evt = ptr; 2166 2167 if (len != sizeof(*evt)) 2168 return; 2169 2170 if (evt->result) 2171 set_bit(BTUSB_FIRMWARE_FAILED, &data->flags); 2172 2173 if (test_and_clear_bit(BTUSB_DOWNLOADING, &data->flags) && 2174 test_bit(BTUSB_FIRMWARE_LOADED, &data->flags)) { 2175 smp_mb__after_atomic(); 2176 wake_up_bit(&data->flags, BTUSB_DOWNLOADING); 2177 } 2178 } 2179 2180 static int btusb_recv_event_intel(struct hci_dev *hdev, struct sk_buff *skb) 2181 { 2182 struct btusb_data *data = hci_get_drvdata(hdev); 2183 2184 if (test_bit(BTUSB_BOOTLOADER, &data->flags)) { 2185 struct hci_event_hdr *hdr = (void *)skb->data; 2186 2187 if (skb->len > HCI_EVENT_HDR_SIZE && hdr->evt == 0xff && 2188 hdr->plen > 0) { 2189 const void *ptr = skb->data + HCI_EVENT_HDR_SIZE + 1; 2190 unsigned int len = skb->len - HCI_EVENT_HDR_SIZE - 1; 2191 2192 switch (skb->data[2]) { 2193 case 0x02: 2194 /* When switching to the operational firmware 2195 * the device sends a vendor specific event 2196 * indicating that the bootup completed. 2197 */ 2198 btusb_intel_bootup(data, ptr, len); 2199 break; 2200 case 0x06: 2201 /* When the firmware loading completes the 2202 * device sends out a vendor specific event 2203 * indicating the result of the firmware 2204 * loading. 2205 */ 2206 btusb_intel_secure_send_result(data, ptr, len); 2207 break; 2208 } 2209 } 2210 } 2211 2212 return hci_recv_frame(hdev, skb); 2213 } 2214 2215 static int btusb_send_frame_intel(struct hci_dev *hdev, struct sk_buff *skb) 2216 { 2217 struct btusb_data *data = hci_get_drvdata(hdev); 2218 struct urb *urb; 2219 2220 BT_DBG("%s", hdev->name); 2221 2222 if (!test_bit(HCI_RUNNING, &hdev->flags)) 2223 return -EBUSY; 2224 2225 switch (bt_cb(skb)->pkt_type) { 2226 case HCI_COMMAND_PKT: 2227 if (test_bit(BTUSB_BOOTLOADER, &data->flags)) { 2228 struct hci_command_hdr *cmd = (void *)skb->data; 2229 __u16 opcode = le16_to_cpu(cmd->opcode); 2230 2231 /* When in bootloader mode and the command 0xfc09 2232 * is received, it needs to be send down the 2233 * bulk endpoint. So allocate a bulk URB instead. 2234 */ 2235 if (opcode == 0xfc09) 2236 urb = alloc_bulk_urb(hdev, skb); 2237 else 2238 urb = alloc_ctrl_urb(hdev, skb); 2239 2240 /* When the 0xfc01 command is issued to boot into 2241 * the operational firmware, it will actually not 2242 * send a command complete event. To keep the flow 2243 * control working inject that event here. 2244 */ 2245 if (opcode == 0xfc01) 2246 inject_cmd_complete(hdev, opcode); 2247 } else { 2248 urb = alloc_ctrl_urb(hdev, skb); 2249 } 2250 if (IS_ERR(urb)) 2251 return PTR_ERR(urb); 2252 2253 hdev->stat.cmd_tx++; 2254 return submit_or_queue_tx_urb(hdev, urb); 2255 2256 case HCI_ACLDATA_PKT: 2257 urb = alloc_bulk_urb(hdev, skb); 2258 if (IS_ERR(urb)) 2259 return PTR_ERR(urb); 2260 2261 hdev->stat.acl_tx++; 2262 return submit_or_queue_tx_urb(hdev, urb); 2263 2264 case HCI_SCODATA_PKT: 2265 if (hci_conn_num(hdev, SCO_LINK) < 1) 2266 return -ENODEV; 2267 2268 urb = alloc_isoc_urb(hdev, skb); 2269 if (IS_ERR(urb)) 2270 return PTR_ERR(urb); 2271 2272 hdev->stat.sco_tx++; 2273 return submit_tx_urb(hdev, urb); 2274 } 2275 2276 return -EILSEQ; 2277 } 2278 2279 static int btusb_intel_secure_send(struct hci_dev *hdev, u8 fragment_type, 2280 u32 plen, const void *param) 2281 { 2282 while (plen > 0) { 2283 struct sk_buff *skb; 2284 u8 cmd_param[253], fragment_len = (plen > 252) ? 252 : plen; 2285 2286 cmd_param[0] = fragment_type; 2287 memcpy(cmd_param + 1, param, fragment_len); 2288 2289 skb = __hci_cmd_sync(hdev, 0xfc09, fragment_len + 1, 2290 cmd_param, HCI_INIT_TIMEOUT); 2291 if (IS_ERR(skb)) 2292 return PTR_ERR(skb); 2293 2294 kfree_skb(skb); 2295 2296 plen -= fragment_len; 2297 param += fragment_len; 2298 } 2299 2300 return 0; 2301 } 2302 2303 static void btusb_intel_version_info(struct hci_dev *hdev, 2304 struct intel_version *ver) 2305 { 2306 const char *variant; 2307 2308 switch (ver->fw_variant) { 2309 case 0x06: 2310 variant = "Bootloader"; 2311 break; 2312 case 0x23: 2313 variant = "Firmware"; 2314 break; 2315 default: 2316 return; 2317 } 2318 2319 BT_INFO("%s: %s revision %u.%u build %u week %u %u", hdev->name, 2320 variant, ver->fw_revision >> 4, ver->fw_revision & 0x0f, 2321 ver->fw_build_num, ver->fw_build_ww, 2000 + ver->fw_build_yy); 2322 } 2323 2324 static int btusb_setup_intel_new(struct hci_dev *hdev) 2325 { 2326 static const u8 reset_param[] = { 0x00, 0x01, 0x00, 0x01, 2327 0x00, 0x08, 0x04, 0x00 }; 2328 struct btusb_data *data = hci_get_drvdata(hdev); 2329 struct sk_buff *skb; 2330 struct intel_version *ver; 2331 struct intel_boot_params *params; 2332 const struct firmware *fw; 2333 const u8 *fw_ptr; 2334 char fwname[64]; 2335 ktime_t calltime, delta, rettime; 2336 unsigned long long duration; 2337 int err; 2338 2339 BT_DBG("%s", hdev->name); 2340 2341 calltime = ktime_get(); 2342 2343 /* Read the Intel version information to determine if the device 2344 * is in bootloader mode or if it already has operational firmware 2345 * loaded. 2346 */ 2347 skb = __hci_cmd_sync(hdev, 0xfc05, 0, NULL, HCI_INIT_TIMEOUT); 2348 if (IS_ERR(skb)) { 2349 BT_ERR("%s: Reading Intel version information failed (%ld)", 2350 hdev->name, PTR_ERR(skb)); 2351 return PTR_ERR(skb); 2352 } 2353 2354 if (skb->len != sizeof(*ver)) { 2355 BT_ERR("%s: Intel version event size mismatch", hdev->name); 2356 kfree_skb(skb); 2357 return -EILSEQ; 2358 } 2359 2360 ver = (struct intel_version *)skb->data; 2361 if (ver->status) { 2362 BT_ERR("%s: Intel version command failure (%02x)", 2363 hdev->name, ver->status); 2364 err = -bt_to_errno(ver->status); 2365 kfree_skb(skb); 2366 return err; 2367 } 2368 2369 /* The hardware platform number has a fixed value of 0x37 and 2370 * for now only accept this single value. 2371 */ 2372 if (ver->hw_platform != 0x37) { 2373 BT_ERR("%s: Unsupported Intel hardware platform (%u)", 2374 hdev->name, ver->hw_platform); 2375 kfree_skb(skb); 2376 return -EINVAL; 2377 } 2378 2379 /* At the moment only the hardware variant iBT 3.0 (LnP/SfP) is 2380 * supported by this firmware loading method. This check has been 2381 * put in place to ensure correct forward compatibility options 2382 * when newer hardware variants come along. 2383 */ 2384 if (ver->hw_variant != 0x0b) { 2385 BT_ERR("%s: Unsupported Intel hardware variant (%u)", 2386 hdev->name, ver->hw_variant); 2387 kfree_skb(skb); 2388 return -EINVAL; 2389 } 2390 2391 btusb_intel_version_info(hdev, ver); 2392 2393 /* The firmware variant determines if the device is in bootloader 2394 * mode or is running operational firmware. The value 0x06 identifies 2395 * the bootloader and the value 0x23 identifies the operational 2396 * firmware. 2397 * 2398 * When the operational firmware is already present, then only 2399 * the check for valid Bluetooth device address is needed. This 2400 * determines if the device will be added as configured or 2401 * unconfigured controller. 2402 * 2403 * It is not possible to use the Secure Boot Parameters in this 2404 * case since that command is only available in bootloader mode. 2405 */ 2406 if (ver->fw_variant == 0x23) { 2407 kfree_skb(skb); 2408 clear_bit(BTUSB_BOOTLOADER, &data->flags); 2409 btintel_check_bdaddr(hdev); 2410 return 0; 2411 } 2412 2413 /* If the device is not in bootloader mode, then the only possible 2414 * choice is to return an error and abort the device initialization. 2415 */ 2416 if (ver->fw_variant != 0x06) { 2417 BT_ERR("%s: Unsupported Intel firmware variant (%u)", 2418 hdev->name, ver->fw_variant); 2419 kfree_skb(skb); 2420 return -ENODEV; 2421 } 2422 2423 kfree_skb(skb); 2424 2425 /* Read the secure boot parameters to identify the operating 2426 * details of the bootloader. 2427 */ 2428 skb = __hci_cmd_sync(hdev, 0xfc0d, 0, NULL, HCI_INIT_TIMEOUT); 2429 if (IS_ERR(skb)) { 2430 BT_ERR("%s: Reading Intel boot parameters failed (%ld)", 2431 hdev->name, PTR_ERR(skb)); 2432 return PTR_ERR(skb); 2433 } 2434 2435 if (skb->len != sizeof(*params)) { 2436 BT_ERR("%s: Intel boot parameters size mismatch", hdev->name); 2437 kfree_skb(skb); 2438 return -EILSEQ; 2439 } 2440 2441 params = (struct intel_boot_params *)skb->data; 2442 if (params->status) { 2443 BT_ERR("%s: Intel boot parameters command failure (%02x)", 2444 hdev->name, params->status); 2445 err = -bt_to_errno(params->status); 2446 kfree_skb(skb); 2447 return err; 2448 } 2449 2450 BT_INFO("%s: Device revision is %u", hdev->name, 2451 le16_to_cpu(params->dev_revid)); 2452 2453 BT_INFO("%s: Secure boot is %s", hdev->name, 2454 params->secure_boot ? "enabled" : "disabled"); 2455 2456 BT_INFO("%s: Minimum firmware build %u week %u %u", hdev->name, 2457 params->min_fw_build_nn, params->min_fw_build_cw, 2458 2000 + params->min_fw_build_yy); 2459 2460 /* It is required that every single firmware fragment is acknowledged 2461 * with a command complete event. If the boot parameters indicate 2462 * that this bootloader does not send them, then abort the setup. 2463 */ 2464 if (params->limited_cce != 0x00) { 2465 BT_ERR("%s: Unsupported Intel firmware loading method (%u)", 2466 hdev->name, params->limited_cce); 2467 kfree_skb(skb); 2468 return -EINVAL; 2469 } 2470 2471 /* If the OTP has no valid Bluetooth device address, then there will 2472 * also be no valid address for the operational firmware. 2473 */ 2474 if (!bacmp(¶ms->otp_bdaddr, BDADDR_ANY)) { 2475 BT_INFO("%s: No device address configured", hdev->name); 2476 set_bit(HCI_QUIRK_INVALID_BDADDR, &hdev->quirks); 2477 } 2478 2479 /* With this Intel bootloader only the hardware variant and device 2480 * revision information are used to select the right firmware. 2481 * 2482 * Currently this bootloader support is limited to hardware variant 2483 * iBT 3.0 (LnP/SfP) which is identified by the value 11 (0x0b). 2484 */ 2485 snprintf(fwname, sizeof(fwname), "intel/ibt-11-%u.sfi", 2486 le16_to_cpu(params->dev_revid)); 2487 2488 err = request_firmware(&fw, fwname, &hdev->dev); 2489 if (err < 0) { 2490 BT_ERR("%s: Failed to load Intel firmware file (%d)", 2491 hdev->name, err); 2492 kfree_skb(skb); 2493 return err; 2494 } 2495 2496 BT_INFO("%s: Found device firmware: %s", hdev->name, fwname); 2497 2498 kfree_skb(skb); 2499 2500 if (fw->size < 644) { 2501 BT_ERR("%s: Invalid size of firmware file (%zu)", 2502 hdev->name, fw->size); 2503 err = -EBADF; 2504 goto done; 2505 } 2506 2507 set_bit(BTUSB_DOWNLOADING, &data->flags); 2508 2509 /* Start the firmware download transaction with the Init fragment 2510 * represented by the 128 bytes of CSS header. 2511 */ 2512 err = btusb_intel_secure_send(hdev, 0x00, 128, fw->data); 2513 if (err < 0) { 2514 BT_ERR("%s: Failed to send firmware header (%d)", 2515 hdev->name, err); 2516 goto done; 2517 } 2518 2519 /* Send the 256 bytes of public key information from the firmware 2520 * as the PKey fragment. 2521 */ 2522 err = btusb_intel_secure_send(hdev, 0x03, 256, fw->data + 128); 2523 if (err < 0) { 2524 BT_ERR("%s: Failed to send firmware public key (%d)", 2525 hdev->name, err); 2526 goto done; 2527 } 2528 2529 /* Send the 256 bytes of signature information from the firmware 2530 * as the Sign fragment. 2531 */ 2532 err = btusb_intel_secure_send(hdev, 0x02, 256, fw->data + 388); 2533 if (err < 0) { 2534 BT_ERR("%s: Failed to send firmware signature (%d)", 2535 hdev->name, err); 2536 goto done; 2537 } 2538 2539 fw_ptr = fw->data + 644; 2540 2541 while (fw_ptr - fw->data < fw->size) { 2542 struct hci_command_hdr *cmd = (void *)fw_ptr; 2543 u8 cmd_len; 2544 2545 cmd_len = sizeof(*cmd) + cmd->plen; 2546 2547 /* Send each command from the firmware data buffer as 2548 * a single Data fragment. 2549 */ 2550 err = btusb_intel_secure_send(hdev, 0x01, cmd_len, fw_ptr); 2551 if (err < 0) { 2552 BT_ERR("%s: Failed to send firmware data (%d)", 2553 hdev->name, err); 2554 goto done; 2555 } 2556 2557 fw_ptr += cmd_len; 2558 } 2559 2560 set_bit(BTUSB_FIRMWARE_LOADED, &data->flags); 2561 2562 BT_INFO("%s: Waiting for firmware download to complete", hdev->name); 2563 2564 /* Before switching the device into operational mode and with that 2565 * booting the loaded firmware, wait for the bootloader notification 2566 * that all fragments have been successfully received. 2567 * 2568 * When the event processing receives the notification, then the 2569 * BTUSB_DOWNLOADING flag will be cleared. 2570 * 2571 * The firmware loading should not take longer than 5 seconds 2572 * and thus just timeout if that happens and fail the setup 2573 * of this device. 2574 */ 2575 err = wait_on_bit_timeout(&data->flags, BTUSB_DOWNLOADING, 2576 TASK_INTERRUPTIBLE, 2577 msecs_to_jiffies(5000)); 2578 if (err == 1) { 2579 BT_ERR("%s: Firmware loading interrupted", hdev->name); 2580 err = -EINTR; 2581 goto done; 2582 } 2583 2584 if (err) { 2585 BT_ERR("%s: Firmware loading timeout", hdev->name); 2586 err = -ETIMEDOUT; 2587 goto done; 2588 } 2589 2590 if (test_bit(BTUSB_FIRMWARE_FAILED, &data->flags)) { 2591 BT_ERR("%s: Firmware loading failed", hdev->name); 2592 err = -ENOEXEC; 2593 goto done; 2594 } 2595 2596 rettime = ktime_get(); 2597 delta = ktime_sub(rettime, calltime); 2598 duration = (unsigned long long) ktime_to_ns(delta) >> 10; 2599 2600 BT_INFO("%s: Firmware loaded in %llu usecs", hdev->name, duration); 2601 2602 done: 2603 release_firmware(fw); 2604 2605 if (err < 0) 2606 return err; 2607 2608 calltime = ktime_get(); 2609 2610 set_bit(BTUSB_BOOTING, &data->flags); 2611 2612 skb = __hci_cmd_sync(hdev, 0xfc01, sizeof(reset_param), reset_param, 2613 HCI_INIT_TIMEOUT); 2614 if (IS_ERR(skb)) 2615 return PTR_ERR(skb); 2616 2617 kfree_skb(skb); 2618 2619 /* The bootloader will not indicate when the device is ready. This 2620 * is done by the operational firmware sending bootup notification. 2621 * 2622 * Booting into operational firmware should not take longer than 2623 * 1 second. However if that happens, then just fail the setup 2624 * since something went wrong. 2625 */ 2626 BT_INFO("%s: Waiting for device to boot", hdev->name); 2627 2628 err = wait_on_bit_timeout(&data->flags, BTUSB_BOOTING, 2629 TASK_INTERRUPTIBLE, 2630 msecs_to_jiffies(1000)); 2631 2632 if (err == 1) { 2633 BT_ERR("%s: Device boot interrupted", hdev->name); 2634 return -EINTR; 2635 } 2636 2637 if (err) { 2638 BT_ERR("%s: Device boot timeout", hdev->name); 2639 return -ETIMEDOUT; 2640 } 2641 2642 rettime = ktime_get(); 2643 delta = ktime_sub(rettime, calltime); 2644 duration = (unsigned long long) ktime_to_ns(delta) >> 10; 2645 2646 BT_INFO("%s: Device booted in %llu usecs", hdev->name, duration); 2647 2648 clear_bit(BTUSB_BOOTLOADER, &data->flags); 2649 2650 return 0; 2651 } 2652 2653 static void btusb_hw_error_intel(struct hci_dev *hdev, u8 code) 2654 { 2655 struct sk_buff *skb; 2656 u8 type = 0x00; 2657 2658 BT_ERR("%s: Hardware error 0x%2.2x", hdev->name, code); 2659 2660 skb = __hci_cmd_sync(hdev, HCI_OP_RESET, 0, NULL, HCI_INIT_TIMEOUT); 2661 if (IS_ERR(skb)) { 2662 BT_ERR("%s: Reset after hardware error failed (%ld)", 2663 hdev->name, PTR_ERR(skb)); 2664 return; 2665 } 2666 kfree_skb(skb); 2667 2668 skb = __hci_cmd_sync(hdev, 0xfc22, 1, &type, HCI_INIT_TIMEOUT); 2669 if (IS_ERR(skb)) { 2670 BT_ERR("%s: Retrieving Intel exception info failed (%ld)", 2671 hdev->name, PTR_ERR(skb)); 2672 return; 2673 } 2674 2675 if (skb->len != 13) { 2676 BT_ERR("%s: Exception info size mismatch", hdev->name); 2677 kfree_skb(skb); 2678 return; 2679 } 2680 2681 if (skb->data[0] != 0x00) { 2682 BT_ERR("%s: Exception info command failure (%02x)", 2683 hdev->name, skb->data[0]); 2684 kfree_skb(skb); 2685 return; 2686 } 2687 2688 BT_ERR("%s: Exception info %s", hdev->name, (char *)(skb->data + 1)); 2689 2690 kfree_skb(skb); 2691 } 2692 2693 static int btusb_shutdown_intel(struct hci_dev *hdev) 2694 { 2695 struct sk_buff *skb; 2696 long ret; 2697 2698 /* Some platforms have an issue with BT LED when the interface is 2699 * down or BT radio is turned off, which takes 5 seconds to BT LED 2700 * goes off. This command turns off the BT LED immediately. 2701 */ 2702 skb = __hci_cmd_sync(hdev, 0xfc3f, 0, NULL, HCI_INIT_TIMEOUT); 2703 if (IS_ERR(skb)) { 2704 ret = PTR_ERR(skb); 2705 BT_ERR("%s: turning off Intel device LED failed (%ld)", 2706 hdev->name, ret); 2707 return ret; 2708 } 2709 kfree_skb(skb); 2710 2711 return 0; 2712 } 2713 2714 static int btusb_set_bdaddr_marvell(struct hci_dev *hdev, 2715 const bdaddr_t *bdaddr) 2716 { 2717 struct sk_buff *skb; 2718 u8 buf[8]; 2719 long ret; 2720 2721 buf[0] = 0xfe; 2722 buf[1] = sizeof(bdaddr_t); 2723 memcpy(buf + 2, bdaddr, sizeof(bdaddr_t)); 2724 2725 skb = __hci_cmd_sync(hdev, 0xfc22, sizeof(buf), buf, HCI_INIT_TIMEOUT); 2726 if (IS_ERR(skb)) { 2727 ret = PTR_ERR(skb); 2728 BT_ERR("%s: changing Marvell device address failed (%ld)", 2729 hdev->name, ret); 2730 return ret; 2731 } 2732 kfree_skb(skb); 2733 2734 return 0; 2735 } 2736 2737 static int btusb_set_bdaddr_ath3012(struct hci_dev *hdev, 2738 const bdaddr_t *bdaddr) 2739 { 2740 struct sk_buff *skb; 2741 u8 buf[10]; 2742 long ret; 2743 2744 buf[0] = 0x01; 2745 buf[1] = 0x01; 2746 buf[2] = 0x00; 2747 buf[3] = sizeof(bdaddr_t); 2748 memcpy(buf + 4, bdaddr, sizeof(bdaddr_t)); 2749 2750 skb = __hci_cmd_sync(hdev, 0xfc0b, sizeof(buf), buf, HCI_INIT_TIMEOUT); 2751 if (IS_ERR(skb)) { 2752 ret = PTR_ERR(skb); 2753 BT_ERR("%s: Change address command failed (%ld)", 2754 hdev->name, ret); 2755 return ret; 2756 } 2757 kfree_skb(skb); 2758 2759 return 0; 2760 } 2761 2762 #define QCA_DFU_PACKET_LEN 4096 2763 2764 #define QCA_GET_TARGET_VERSION 0x09 2765 #define QCA_CHECK_STATUS 0x05 2766 #define QCA_DFU_DOWNLOAD 0x01 2767 2768 #define QCA_SYSCFG_UPDATED 0x40 2769 #define QCA_PATCH_UPDATED 0x80 2770 #define QCA_DFU_TIMEOUT 3000 2771 2772 struct qca_version { 2773 __le32 rom_version; 2774 __le32 patch_version; 2775 __le32 ram_version; 2776 __le32 ref_clock; 2777 __u8 reserved[4]; 2778 } __packed; 2779 2780 struct qca_rampatch_version { 2781 __le16 rom_version; 2782 __le16 patch_version; 2783 } __packed; 2784 2785 struct qca_device_info { 2786 u32 rom_version; 2787 u8 rampatch_hdr; /* length of header in rampatch */ 2788 u8 nvm_hdr; /* length of header in NVM */ 2789 u8 ver_offset; /* offset of version structure in rampatch */ 2790 }; 2791 2792 static const struct qca_device_info qca_devices_table[] = { 2793 { 0x00000100, 20, 4, 10 }, /* Rome 1.0 */ 2794 { 0x00000101, 20, 4, 10 }, /* Rome 1.1 */ 2795 { 0x00000201, 28, 4, 18 }, /* Rome 2.1 */ 2796 { 0x00000300, 28, 4, 18 }, /* Rome 3.0 */ 2797 { 0x00000302, 28, 4, 18 }, /* Rome 3.2 */ 2798 }; 2799 2800 static int btusb_qca_send_vendor_req(struct hci_dev *hdev, u8 request, 2801 void *data, u16 size) 2802 { 2803 struct btusb_data *btdata = hci_get_drvdata(hdev); 2804 struct usb_device *udev = btdata->udev; 2805 int pipe, err; 2806 u8 *buf; 2807 2808 buf = kmalloc(size, GFP_KERNEL); 2809 if (!buf) 2810 return -ENOMEM; 2811 2812 /* Found some of USB hosts have IOT issues with ours so that we should 2813 * not wait until HCI layer is ready. 2814 */ 2815 pipe = usb_rcvctrlpipe(udev, 0); 2816 err = usb_control_msg(udev, pipe, request, USB_TYPE_VENDOR | USB_DIR_IN, 2817 0, 0, buf, size, USB_CTRL_SET_TIMEOUT); 2818 if (err < 0) { 2819 BT_ERR("%s: Failed to access otp area (%d)", hdev->name, err); 2820 goto done; 2821 } 2822 2823 memcpy(data, buf, size); 2824 2825 done: 2826 kfree(buf); 2827 2828 return err; 2829 } 2830 2831 static int btusb_setup_qca_download_fw(struct hci_dev *hdev, 2832 const struct firmware *firmware, 2833 size_t hdr_size) 2834 { 2835 struct btusb_data *btdata = hci_get_drvdata(hdev); 2836 struct usb_device *udev = btdata->udev; 2837 size_t count, size, sent = 0; 2838 int pipe, len, err; 2839 u8 *buf; 2840 2841 buf = kmalloc(QCA_DFU_PACKET_LEN, GFP_KERNEL); 2842 if (!buf) 2843 return -ENOMEM; 2844 2845 count = firmware->size; 2846 2847 size = min_t(size_t, count, hdr_size); 2848 memcpy(buf, firmware->data, size); 2849 2850 /* USB patches should go down to controller through USB path 2851 * because binary format fits to go down through USB channel. 2852 * USB control path is for patching headers and USB bulk is for 2853 * patch body. 2854 */ 2855 pipe = usb_sndctrlpipe(udev, 0); 2856 err = usb_control_msg(udev, pipe, QCA_DFU_DOWNLOAD, USB_TYPE_VENDOR, 2857 0, 0, buf, size, USB_CTRL_SET_TIMEOUT); 2858 if (err < 0) { 2859 BT_ERR("%s: Failed to send headers (%d)", hdev->name, err); 2860 goto done; 2861 } 2862 2863 sent += size; 2864 count -= size; 2865 2866 while (count) { 2867 size = min_t(size_t, count, QCA_DFU_PACKET_LEN); 2868 2869 memcpy(buf, firmware->data + sent, size); 2870 2871 pipe = usb_sndbulkpipe(udev, 0x02); 2872 err = usb_bulk_msg(udev, pipe, buf, size, &len, 2873 QCA_DFU_TIMEOUT); 2874 if (err < 0) { 2875 BT_ERR("%s: Failed to send body at %zd of %zd (%d)", 2876 hdev->name, sent, firmware->size, err); 2877 break; 2878 } 2879 2880 if (size != len) { 2881 BT_ERR("%s: Failed to get bulk buffer", hdev->name); 2882 err = -EILSEQ; 2883 break; 2884 } 2885 2886 sent += size; 2887 count -= size; 2888 } 2889 2890 done: 2891 kfree(buf); 2892 return err; 2893 } 2894 2895 static int btusb_setup_qca_load_rampatch(struct hci_dev *hdev, 2896 struct qca_version *ver, 2897 const struct qca_device_info *info) 2898 { 2899 struct qca_rampatch_version *rver; 2900 const struct firmware *fw; 2901 u32 ver_rom, ver_patch; 2902 u16 rver_rom, rver_patch; 2903 char fwname[64]; 2904 int err; 2905 2906 ver_rom = le32_to_cpu(ver->rom_version); 2907 ver_patch = le32_to_cpu(ver->patch_version); 2908 2909 snprintf(fwname, sizeof(fwname), "qca/rampatch_usb_%08x.bin", ver_rom); 2910 2911 err = request_firmware(&fw, fwname, &hdev->dev); 2912 if (err) { 2913 BT_ERR("%s: failed to request rampatch file: %s (%d)", 2914 hdev->name, fwname, err); 2915 return err; 2916 } 2917 2918 BT_INFO("%s: using rampatch file: %s", hdev->name, fwname); 2919 2920 rver = (struct qca_rampatch_version *)(fw->data + info->ver_offset); 2921 rver_rom = le16_to_cpu(rver->rom_version); 2922 rver_patch = le16_to_cpu(rver->patch_version); 2923 2924 BT_INFO("%s: QCA: patch rome 0x%x build 0x%x, firmware rome 0x%x " 2925 "build 0x%x", hdev->name, rver_rom, rver_patch, ver_rom, 2926 ver_patch); 2927 2928 if (rver_rom != ver_rom || rver_patch <= ver_patch) { 2929 BT_ERR("%s: rampatch file version did not match with firmware", 2930 hdev->name); 2931 err = -EINVAL; 2932 goto done; 2933 } 2934 2935 err = btusb_setup_qca_download_fw(hdev, fw, info->rampatch_hdr); 2936 2937 done: 2938 release_firmware(fw); 2939 2940 return err; 2941 } 2942 2943 static int btusb_setup_qca_load_nvm(struct hci_dev *hdev, 2944 struct qca_version *ver, 2945 const struct qca_device_info *info) 2946 { 2947 const struct firmware *fw; 2948 char fwname[64]; 2949 int err; 2950 2951 snprintf(fwname, sizeof(fwname), "qca/nvm_usb_%08x.bin", 2952 le32_to_cpu(ver->rom_version)); 2953 2954 err = request_firmware(&fw, fwname, &hdev->dev); 2955 if (err) { 2956 BT_ERR("%s: failed to request NVM file: %s (%d)", 2957 hdev->name, fwname, err); 2958 return err; 2959 } 2960 2961 BT_INFO("%s: using NVM file: %s", hdev->name, fwname); 2962 2963 err = btusb_setup_qca_download_fw(hdev, fw, info->nvm_hdr); 2964 2965 release_firmware(fw); 2966 2967 return err; 2968 } 2969 2970 static int btusb_setup_qca(struct hci_dev *hdev) 2971 { 2972 const struct qca_device_info *info = NULL; 2973 struct qca_version ver; 2974 u32 ver_rom; 2975 u8 status; 2976 int i, err; 2977 2978 err = btusb_qca_send_vendor_req(hdev, QCA_GET_TARGET_VERSION, &ver, 2979 sizeof(ver)); 2980 if (err < 0) 2981 return err; 2982 2983 ver_rom = le32_to_cpu(ver.rom_version); 2984 for (i = 0; i < ARRAY_SIZE(qca_devices_table); i++) { 2985 if (ver_rom == qca_devices_table[i].rom_version) 2986 info = &qca_devices_table[i]; 2987 } 2988 if (!info) { 2989 BT_ERR("%s: don't support firmware rome 0x%x", hdev->name, 2990 ver_rom); 2991 return -ENODEV; 2992 } 2993 2994 err = btusb_qca_send_vendor_req(hdev, QCA_CHECK_STATUS, &status, 2995 sizeof(status)); 2996 if (err < 0) 2997 return err; 2998 2999 if (!(status & QCA_PATCH_UPDATED)) { 3000 err = btusb_setup_qca_load_rampatch(hdev, &ver, info); 3001 if (err < 0) 3002 return err; 3003 } 3004 3005 if (!(status & QCA_SYSCFG_UPDATED)) { 3006 err = btusb_setup_qca_load_nvm(hdev, &ver, info); 3007 if (err < 0) 3008 return err; 3009 } 3010 3011 return 0; 3012 } 3013 3014 static int btusb_probe(struct usb_interface *intf, 3015 const struct usb_device_id *id) 3016 { 3017 struct usb_endpoint_descriptor *ep_desc; 3018 struct btusb_data *data; 3019 struct hci_dev *hdev; 3020 int i, err; 3021 3022 BT_DBG("intf %p id %p", intf, id); 3023 3024 /* interface numbers are hardcoded in the spec */ 3025 if (intf->cur_altsetting->desc.bInterfaceNumber != 0) 3026 return -ENODEV; 3027 3028 if (!id->driver_info) { 3029 const struct usb_device_id *match; 3030 3031 match = usb_match_id(intf, blacklist_table); 3032 if (match) 3033 id = match; 3034 } 3035 3036 if (id->driver_info == BTUSB_IGNORE) 3037 return -ENODEV; 3038 3039 if (id->driver_info & BTUSB_ATH3012) { 3040 struct usb_device *udev = interface_to_usbdev(intf); 3041 3042 /* Old firmware would otherwise let ath3k driver load 3043 * patch and sysconfig files */ 3044 if (le16_to_cpu(udev->descriptor.bcdDevice) <= 0x0001) 3045 return -ENODEV; 3046 } 3047 3048 data = devm_kzalloc(&intf->dev, sizeof(*data), GFP_KERNEL); 3049 if (!data) 3050 return -ENOMEM; 3051 3052 for (i = 0; i < intf->cur_altsetting->desc.bNumEndpoints; i++) { 3053 ep_desc = &intf->cur_altsetting->endpoint[i].desc; 3054 3055 if (!data->intr_ep && usb_endpoint_is_int_in(ep_desc)) { 3056 data->intr_ep = ep_desc; 3057 continue; 3058 } 3059 3060 if (!data->bulk_tx_ep && usb_endpoint_is_bulk_out(ep_desc)) { 3061 data->bulk_tx_ep = ep_desc; 3062 continue; 3063 } 3064 3065 if (!data->bulk_rx_ep && usb_endpoint_is_bulk_in(ep_desc)) { 3066 data->bulk_rx_ep = ep_desc; 3067 continue; 3068 } 3069 } 3070 3071 if (!data->intr_ep || !data->bulk_tx_ep || !data->bulk_rx_ep) 3072 return -ENODEV; 3073 3074 if (id->driver_info & BTUSB_AMP) { 3075 data->cmdreq_type = USB_TYPE_CLASS | 0x01; 3076 data->cmdreq = 0x2b; 3077 } else { 3078 data->cmdreq_type = USB_TYPE_CLASS; 3079 data->cmdreq = 0x00; 3080 } 3081 3082 data->udev = interface_to_usbdev(intf); 3083 data->intf = intf; 3084 3085 INIT_WORK(&data->work, btusb_work); 3086 INIT_WORK(&data->waker, btusb_waker); 3087 init_usb_anchor(&data->deferred); 3088 init_usb_anchor(&data->tx_anchor); 3089 spin_lock_init(&data->txlock); 3090 3091 init_usb_anchor(&data->intr_anchor); 3092 init_usb_anchor(&data->bulk_anchor); 3093 init_usb_anchor(&data->isoc_anchor); 3094 spin_lock_init(&data->rxlock); 3095 3096 if (id->driver_info & BTUSB_INTEL_NEW) { 3097 data->recv_event = btusb_recv_event_intel; 3098 data->recv_bulk = btusb_recv_bulk_intel; 3099 set_bit(BTUSB_BOOTLOADER, &data->flags); 3100 } else { 3101 data->recv_event = hci_recv_frame; 3102 data->recv_bulk = btusb_recv_bulk; 3103 } 3104 3105 hdev = hci_alloc_dev(); 3106 if (!hdev) 3107 return -ENOMEM; 3108 3109 hdev->bus = HCI_USB; 3110 hci_set_drvdata(hdev, data); 3111 3112 if (id->driver_info & BTUSB_AMP) 3113 hdev->dev_type = HCI_AMP; 3114 else 3115 hdev->dev_type = HCI_BREDR; 3116 3117 data->hdev = hdev; 3118 3119 SET_HCIDEV_DEV(hdev, &intf->dev); 3120 3121 hdev->open = btusb_open; 3122 hdev->close = btusb_close; 3123 hdev->flush = btusb_flush; 3124 hdev->send = btusb_send_frame; 3125 hdev->notify = btusb_notify; 3126 3127 if (id->driver_info & BTUSB_BCM92035) 3128 hdev->setup = btusb_setup_bcm92035; 3129 3130 #ifdef CONFIG_BT_HCIBTUSB_BCM 3131 if (id->driver_info & BTUSB_BCM_PATCHRAM) { 3132 hdev->setup = btbcm_setup_patchram; 3133 hdev->set_bdaddr = btbcm_set_bdaddr; 3134 } 3135 3136 if (id->driver_info & BTUSB_BCM_APPLE) 3137 hdev->setup = btbcm_setup_apple; 3138 #endif 3139 3140 if (id->driver_info & BTUSB_INTEL) { 3141 hdev->setup = btusb_setup_intel; 3142 hdev->shutdown = btusb_shutdown_intel; 3143 hdev->set_bdaddr = btintel_set_bdaddr; 3144 set_bit(HCI_QUIRK_STRICT_DUPLICATE_FILTER, &hdev->quirks); 3145 set_bit(HCI_QUIRK_SIMULTANEOUS_DISCOVERY, &hdev->quirks); 3146 } 3147 3148 if (id->driver_info & BTUSB_INTEL_NEW) { 3149 hdev->send = btusb_send_frame_intel; 3150 hdev->setup = btusb_setup_intel_new; 3151 hdev->hw_error = btusb_hw_error_intel; 3152 hdev->set_bdaddr = btintel_set_bdaddr; 3153 set_bit(HCI_QUIRK_STRICT_DUPLICATE_FILTER, &hdev->quirks); 3154 } 3155 3156 if (id->driver_info & BTUSB_MARVELL) 3157 hdev->set_bdaddr = btusb_set_bdaddr_marvell; 3158 3159 if (id->driver_info & BTUSB_SWAVE) { 3160 set_bit(HCI_QUIRK_FIXUP_INQUIRY_MODE, &hdev->quirks); 3161 set_bit(HCI_QUIRK_BROKEN_LOCAL_COMMANDS, &hdev->quirks); 3162 } 3163 3164 if (id->driver_info & BTUSB_INTEL_BOOT) 3165 set_bit(HCI_QUIRK_RAW_DEVICE, &hdev->quirks); 3166 3167 if (id->driver_info & BTUSB_ATH3012) { 3168 hdev->set_bdaddr = btusb_set_bdaddr_ath3012; 3169 set_bit(HCI_QUIRK_SIMULTANEOUS_DISCOVERY, &hdev->quirks); 3170 set_bit(HCI_QUIRK_STRICT_DUPLICATE_FILTER, &hdev->quirks); 3171 } 3172 3173 if (id->driver_info & BTUSB_QCA_ROME) { 3174 data->setup_on_usb = btusb_setup_qca; 3175 hdev->set_bdaddr = btusb_set_bdaddr_ath3012; 3176 } 3177 3178 if (id->driver_info & BTUSB_REALTEK) 3179 hdev->setup = btusb_setup_realtek; 3180 3181 if (id->driver_info & BTUSB_AMP) { 3182 /* AMP controllers do not support SCO packets */ 3183 data->isoc = NULL; 3184 } else { 3185 /* Interface numbers are hardcoded in the specification */ 3186 data->isoc = usb_ifnum_to_if(data->udev, 1); 3187 } 3188 3189 if (!reset) 3190 set_bit(HCI_QUIRK_RESET_ON_CLOSE, &hdev->quirks); 3191 3192 if (force_scofix || id->driver_info & BTUSB_WRONG_SCO_MTU) { 3193 if (!disable_scofix) 3194 set_bit(HCI_QUIRK_FIXUP_BUFFER_SIZE, &hdev->quirks); 3195 } 3196 3197 if (id->driver_info & BTUSB_BROKEN_ISOC) 3198 data->isoc = NULL; 3199 3200 if (id->driver_info & BTUSB_DIGIANSWER) { 3201 data->cmdreq_type = USB_TYPE_VENDOR; 3202 set_bit(HCI_QUIRK_RESET_ON_CLOSE, &hdev->quirks); 3203 } 3204 3205 if (id->driver_info & BTUSB_CSR) { 3206 struct usb_device *udev = data->udev; 3207 u16 bcdDevice = le16_to_cpu(udev->descriptor.bcdDevice); 3208 3209 /* Old firmware would otherwise execute USB reset */ 3210 if (bcdDevice < 0x117) 3211 set_bit(HCI_QUIRK_RESET_ON_CLOSE, &hdev->quirks); 3212 3213 /* Fake CSR devices with broken commands */ 3214 if (bcdDevice <= 0x100) 3215 hdev->setup = btusb_setup_csr; 3216 3217 set_bit(HCI_QUIRK_SIMULTANEOUS_DISCOVERY, &hdev->quirks); 3218 } 3219 3220 if (id->driver_info & BTUSB_SNIFFER) { 3221 struct usb_device *udev = data->udev; 3222 3223 /* New sniffer firmware has crippled HCI interface */ 3224 if (le16_to_cpu(udev->descriptor.bcdDevice) > 0x997) 3225 set_bit(HCI_QUIRK_RAW_DEVICE, &hdev->quirks); 3226 } 3227 3228 if (id->driver_info & BTUSB_INTEL_BOOT) { 3229 /* A bug in the bootloader causes that interrupt interface is 3230 * only enabled after receiving SetInterface(0, AltSetting=0). 3231 */ 3232 err = usb_set_interface(data->udev, 0, 0); 3233 if (err < 0) { 3234 BT_ERR("failed to set interface 0, alt 0 %d", err); 3235 hci_free_dev(hdev); 3236 return err; 3237 } 3238 } 3239 3240 if (data->isoc) { 3241 err = usb_driver_claim_interface(&btusb_driver, 3242 data->isoc, data); 3243 if (err < 0) { 3244 hci_free_dev(hdev); 3245 return err; 3246 } 3247 } 3248 3249 err = hci_register_dev(hdev); 3250 if (err < 0) { 3251 hci_free_dev(hdev); 3252 return err; 3253 } 3254 3255 usb_set_intfdata(intf, data); 3256 3257 return 0; 3258 } 3259 3260 static void btusb_disconnect(struct usb_interface *intf) 3261 { 3262 struct btusb_data *data = usb_get_intfdata(intf); 3263 struct hci_dev *hdev; 3264 3265 BT_DBG("intf %p", intf); 3266 3267 if (!data) 3268 return; 3269 3270 hdev = data->hdev; 3271 usb_set_intfdata(data->intf, NULL); 3272 3273 if (data->isoc) 3274 usb_set_intfdata(data->isoc, NULL); 3275 3276 hci_unregister_dev(hdev); 3277 3278 if (intf == data->isoc) 3279 usb_driver_release_interface(&btusb_driver, data->intf); 3280 else if (data->isoc) 3281 usb_driver_release_interface(&btusb_driver, data->isoc); 3282 3283 hci_free_dev(hdev); 3284 } 3285 3286 #ifdef CONFIG_PM 3287 static int btusb_suspend(struct usb_interface *intf, pm_message_t message) 3288 { 3289 struct btusb_data *data = usb_get_intfdata(intf); 3290 3291 BT_DBG("intf %p", intf); 3292 3293 if (data->suspend_count++) 3294 return 0; 3295 3296 spin_lock_irq(&data->txlock); 3297 if (!(PMSG_IS_AUTO(message) && data->tx_in_flight)) { 3298 set_bit(BTUSB_SUSPENDING, &data->flags); 3299 spin_unlock_irq(&data->txlock); 3300 } else { 3301 spin_unlock_irq(&data->txlock); 3302 data->suspend_count--; 3303 return -EBUSY; 3304 } 3305 3306 cancel_work_sync(&data->work); 3307 3308 btusb_stop_traffic(data); 3309 usb_kill_anchored_urbs(&data->tx_anchor); 3310 3311 return 0; 3312 } 3313 3314 static void play_deferred(struct btusb_data *data) 3315 { 3316 struct urb *urb; 3317 int err; 3318 3319 while ((urb = usb_get_from_anchor(&data->deferred))) { 3320 err = usb_submit_urb(urb, GFP_ATOMIC); 3321 if (err < 0) 3322 break; 3323 3324 data->tx_in_flight++; 3325 } 3326 usb_scuttle_anchored_urbs(&data->deferred); 3327 } 3328 3329 static int btusb_resume(struct usb_interface *intf) 3330 { 3331 struct btusb_data *data = usb_get_intfdata(intf); 3332 struct hci_dev *hdev = data->hdev; 3333 int err = 0; 3334 3335 BT_DBG("intf %p", intf); 3336 3337 if (--data->suspend_count) 3338 return 0; 3339 3340 if (!test_bit(HCI_RUNNING, &hdev->flags)) 3341 goto done; 3342 3343 if (test_bit(BTUSB_INTR_RUNNING, &data->flags)) { 3344 err = btusb_submit_intr_urb(hdev, GFP_NOIO); 3345 if (err < 0) { 3346 clear_bit(BTUSB_INTR_RUNNING, &data->flags); 3347 goto failed; 3348 } 3349 } 3350 3351 if (test_bit(BTUSB_BULK_RUNNING, &data->flags)) { 3352 err = btusb_submit_bulk_urb(hdev, GFP_NOIO); 3353 if (err < 0) { 3354 clear_bit(BTUSB_BULK_RUNNING, &data->flags); 3355 goto failed; 3356 } 3357 3358 btusb_submit_bulk_urb(hdev, GFP_NOIO); 3359 } 3360 3361 if (test_bit(BTUSB_ISOC_RUNNING, &data->flags)) { 3362 if (btusb_submit_isoc_urb(hdev, GFP_NOIO) < 0) 3363 clear_bit(BTUSB_ISOC_RUNNING, &data->flags); 3364 else 3365 btusb_submit_isoc_urb(hdev, GFP_NOIO); 3366 } 3367 3368 spin_lock_irq(&data->txlock); 3369 play_deferred(data); 3370 clear_bit(BTUSB_SUSPENDING, &data->flags); 3371 spin_unlock_irq(&data->txlock); 3372 schedule_work(&data->work); 3373 3374 return 0; 3375 3376 failed: 3377 usb_scuttle_anchored_urbs(&data->deferred); 3378 done: 3379 spin_lock_irq(&data->txlock); 3380 clear_bit(BTUSB_SUSPENDING, &data->flags); 3381 spin_unlock_irq(&data->txlock); 3382 3383 return err; 3384 } 3385 #endif 3386 3387 static struct usb_driver btusb_driver = { 3388 .name = "btusb", 3389 .probe = btusb_probe, 3390 .disconnect = btusb_disconnect, 3391 #ifdef CONFIG_PM 3392 .suspend = btusb_suspend, 3393 .resume = btusb_resume, 3394 #endif 3395 .id_table = btusb_table, 3396 .supports_autosuspend = 1, 3397 .disable_hub_initiated_lpm = 1, 3398 }; 3399 3400 module_usb_driver(btusb_driver); 3401 3402 module_param(disable_scofix, bool, 0644); 3403 MODULE_PARM_DESC(disable_scofix, "Disable fixup of wrong SCO buffer size"); 3404 3405 module_param(force_scofix, bool, 0644); 3406 MODULE_PARM_DESC(force_scofix, "Force fixup of wrong SCO buffers size"); 3407 3408 module_param(reset, bool, 0644); 3409 MODULE_PARM_DESC(reset, "Send HCI reset command on initialization"); 3410 3411 MODULE_AUTHOR("Marcel Holtmann <marcel@holtmann.org>"); 3412 MODULE_DESCRIPTION("Generic Bluetooth USB driver ver " VERSION); 3413 MODULE_VERSION(VERSION); 3414 MODULE_LICENSE("GPL"); 3415