1 // SPDX-License-Identifier: GPL-2.0-or-later 2 /* 3 * 4 * Generic Bluetooth USB driver 5 * 6 * Copyright (C) 2005-2008 Marcel Holtmann <marcel@holtmann.org> 7 */ 8 9 #include <linux/dmi.h> 10 #include <linux/module.h> 11 #include <linux/usb.h> 12 #include <linux/usb/quirks.h> 13 #include <linux/firmware.h> 14 #include <linux/iopoll.h> 15 #include <linux/of_device.h> 16 #include <linux/of_irq.h> 17 #include <linux/suspend.h> 18 #include <linux/gpio/consumer.h> 19 #include <asm/unaligned.h> 20 21 #include <net/bluetooth/bluetooth.h> 22 #include <net/bluetooth/hci_core.h> 23 24 #include "btintel.h" 25 #include "btbcm.h" 26 #include "btrtl.h" 27 28 #define VERSION "0.8" 29 30 static bool disable_scofix; 31 static bool force_scofix; 32 static bool enable_autosuspend = IS_ENABLED(CONFIG_BT_HCIBTUSB_AUTOSUSPEND); 33 34 static bool reset = true; 35 36 static struct usb_driver btusb_driver; 37 38 #define BTUSB_IGNORE 0x01 39 #define BTUSB_DIGIANSWER 0x02 40 #define BTUSB_CSR 0x04 41 #define BTUSB_SNIFFER 0x08 42 #define BTUSB_BCM92035 0x10 43 #define BTUSB_BROKEN_ISOC 0x20 44 #define BTUSB_WRONG_SCO_MTU 0x40 45 #define BTUSB_ATH3012 0x80 46 #define BTUSB_INTEL 0x100 47 #define BTUSB_INTEL_BOOT 0x200 48 #define BTUSB_BCM_PATCHRAM 0x400 49 #define BTUSB_MARVELL 0x800 50 #define BTUSB_SWAVE 0x1000 51 #define BTUSB_INTEL_NEW 0x2000 52 #define BTUSB_AMP 0x4000 53 #define BTUSB_QCA_ROME 0x8000 54 #define BTUSB_BCM_APPLE 0x10000 55 #define BTUSB_REALTEK 0x20000 56 #define BTUSB_BCM2045 0x40000 57 #define BTUSB_IFNUM_2 0x80000 58 #define BTUSB_CW6622 0x100000 59 #define BTUSB_MEDIATEK 0x200000 60 #define BTUSB_WIDEBAND_SPEECH 0x400000 61 #define BTUSB_VALID_LE_STATES 0x800000 62 #define BTUSB_QCA_WCN6855 0x1000000 63 #define BTUSB_INTEL_NEWGEN 0x2000000 64 65 static const struct usb_device_id btusb_table[] = { 66 /* Generic Bluetooth USB device */ 67 { USB_DEVICE_INFO(0xe0, 0x01, 0x01) }, 68 69 /* Generic Bluetooth AMP device */ 70 { USB_DEVICE_INFO(0xe0, 0x01, 0x04), .driver_info = BTUSB_AMP }, 71 72 /* Generic Bluetooth USB interface */ 73 { USB_INTERFACE_INFO(0xe0, 0x01, 0x01) }, 74 75 /* Apple-specific (Broadcom) devices */ 76 { USB_VENDOR_AND_INTERFACE_INFO(0x05ac, 0xff, 0x01, 0x01), 77 .driver_info = BTUSB_BCM_APPLE | BTUSB_IFNUM_2 }, 78 79 /* MediaTek MT76x0E */ 80 { USB_DEVICE(0x0e8d, 0x763f) }, 81 82 /* Broadcom SoftSailing reporting vendor specific */ 83 { USB_DEVICE(0x0a5c, 0x21e1) }, 84 85 /* Apple MacBookPro 7,1 */ 86 { USB_DEVICE(0x05ac, 0x8213) }, 87 88 /* Apple iMac11,1 */ 89 { USB_DEVICE(0x05ac, 0x8215) }, 90 91 /* Apple MacBookPro6,2 */ 92 { USB_DEVICE(0x05ac, 0x8218) }, 93 94 /* Apple MacBookAir3,1, MacBookAir3,2 */ 95 { USB_DEVICE(0x05ac, 0x821b) }, 96 97 /* Apple MacBookAir4,1 */ 98 { USB_DEVICE(0x05ac, 0x821f) }, 99 100 /* Apple MacBookPro8,2 */ 101 { USB_DEVICE(0x05ac, 0x821a) }, 102 103 /* Apple MacMini5,1 */ 104 { USB_DEVICE(0x05ac, 0x8281) }, 105 106 /* AVM BlueFRITZ! USB v2.0 */ 107 { USB_DEVICE(0x057c, 0x3800), .driver_info = BTUSB_SWAVE }, 108 109 /* Bluetooth Ultraport Module from IBM */ 110 { USB_DEVICE(0x04bf, 0x030a) }, 111 112 /* ALPS Modules with non-standard id */ 113 { USB_DEVICE(0x044e, 0x3001) }, 114 { USB_DEVICE(0x044e, 0x3002) }, 115 116 /* Ericsson with non-standard id */ 117 { USB_DEVICE(0x0bdb, 0x1002) }, 118 119 /* Canyon CN-BTU1 with HID interfaces */ 120 { USB_DEVICE(0x0c10, 0x0000) }, 121 122 /* Broadcom BCM20702A0 */ 123 { USB_DEVICE(0x413c, 0x8197) }, 124 125 /* Broadcom BCM20702B0 (Dynex/Insignia) */ 126 { USB_DEVICE(0x19ff, 0x0239), .driver_info = BTUSB_BCM_PATCHRAM }, 127 128 /* Broadcom BCM43142A0 (Foxconn/Lenovo) */ 129 { USB_VENDOR_AND_INTERFACE_INFO(0x105b, 0xff, 0x01, 0x01), 130 .driver_info = BTUSB_BCM_PATCHRAM }, 131 132 /* Broadcom BCM920703 (HTC Vive) */ 133 { USB_VENDOR_AND_INTERFACE_INFO(0x0bb4, 0xff, 0x01, 0x01), 134 .driver_info = BTUSB_BCM_PATCHRAM }, 135 136 /* Foxconn - Hon Hai */ 137 { USB_VENDOR_AND_INTERFACE_INFO(0x0489, 0xff, 0x01, 0x01), 138 .driver_info = BTUSB_BCM_PATCHRAM }, 139 140 /* Lite-On Technology - Broadcom based */ 141 { USB_VENDOR_AND_INTERFACE_INFO(0x04ca, 0xff, 0x01, 0x01), 142 .driver_info = BTUSB_BCM_PATCHRAM }, 143 144 /* Broadcom devices with vendor specific id */ 145 { USB_VENDOR_AND_INTERFACE_INFO(0x0a5c, 0xff, 0x01, 0x01), 146 .driver_info = BTUSB_BCM_PATCHRAM }, 147 148 /* ASUSTek Computer - Broadcom based */ 149 { USB_VENDOR_AND_INTERFACE_INFO(0x0b05, 0xff, 0x01, 0x01), 150 .driver_info = BTUSB_BCM_PATCHRAM }, 151 152 /* Belkin F8065bf - Broadcom based */ 153 { USB_VENDOR_AND_INTERFACE_INFO(0x050d, 0xff, 0x01, 0x01), 154 .driver_info = BTUSB_BCM_PATCHRAM }, 155 156 /* IMC Networks - Broadcom based */ 157 { USB_VENDOR_AND_INTERFACE_INFO(0x13d3, 0xff, 0x01, 0x01), 158 .driver_info = BTUSB_BCM_PATCHRAM }, 159 160 /* Dell Computer - Broadcom based */ 161 { USB_VENDOR_AND_INTERFACE_INFO(0x413c, 0xff, 0x01, 0x01), 162 .driver_info = BTUSB_BCM_PATCHRAM }, 163 164 /* Toshiba Corp - Broadcom based */ 165 { USB_VENDOR_AND_INTERFACE_INFO(0x0930, 0xff, 0x01, 0x01), 166 .driver_info = BTUSB_BCM_PATCHRAM }, 167 168 /* Intel Bluetooth USB Bootloader (RAM module) */ 169 { USB_DEVICE(0x8087, 0x0a5a), 170 .driver_info = BTUSB_INTEL_BOOT | BTUSB_BROKEN_ISOC }, 171 172 { } /* Terminating entry */ 173 }; 174 175 MODULE_DEVICE_TABLE(usb, btusb_table); 176 177 static const struct usb_device_id blacklist_table[] = { 178 /* CSR BlueCore devices */ 179 { USB_DEVICE(0x0a12, 0x0001), .driver_info = BTUSB_CSR }, 180 181 /* Broadcom BCM2033 without firmware */ 182 { USB_DEVICE(0x0a5c, 0x2033), .driver_info = BTUSB_IGNORE }, 183 184 /* Broadcom BCM2045 devices */ 185 { USB_DEVICE(0x0a5c, 0x2045), .driver_info = BTUSB_BCM2045 }, 186 187 /* Atheros 3011 with sflash firmware */ 188 { USB_DEVICE(0x0489, 0xe027), .driver_info = BTUSB_IGNORE }, 189 { USB_DEVICE(0x0489, 0xe03d), .driver_info = BTUSB_IGNORE }, 190 { USB_DEVICE(0x04f2, 0xaff1), .driver_info = BTUSB_IGNORE }, 191 { USB_DEVICE(0x0930, 0x0215), .driver_info = BTUSB_IGNORE }, 192 { USB_DEVICE(0x0cf3, 0x3002), .driver_info = BTUSB_IGNORE }, 193 { USB_DEVICE(0x0cf3, 0xe019), .driver_info = BTUSB_IGNORE }, 194 { USB_DEVICE(0x13d3, 0x3304), .driver_info = BTUSB_IGNORE }, 195 196 /* Atheros AR9285 Malbec with sflash firmware */ 197 { USB_DEVICE(0x03f0, 0x311d), .driver_info = BTUSB_IGNORE }, 198 199 /* Atheros 3012 with sflash firmware */ 200 { USB_DEVICE(0x0489, 0xe04d), .driver_info = BTUSB_ATH3012 }, 201 { USB_DEVICE(0x0489, 0xe04e), .driver_info = BTUSB_ATH3012 }, 202 { USB_DEVICE(0x0489, 0xe056), .driver_info = BTUSB_ATH3012 }, 203 { USB_DEVICE(0x0489, 0xe057), .driver_info = BTUSB_ATH3012 }, 204 { USB_DEVICE(0x0489, 0xe05f), .driver_info = BTUSB_ATH3012 }, 205 { USB_DEVICE(0x0489, 0xe076), .driver_info = BTUSB_ATH3012 }, 206 { USB_DEVICE(0x0489, 0xe078), .driver_info = BTUSB_ATH3012 }, 207 { USB_DEVICE(0x0489, 0xe095), .driver_info = BTUSB_ATH3012 }, 208 { USB_DEVICE(0x04c5, 0x1330), .driver_info = BTUSB_ATH3012 }, 209 { USB_DEVICE(0x04ca, 0x3004), .driver_info = BTUSB_ATH3012 }, 210 { USB_DEVICE(0x04ca, 0x3005), .driver_info = BTUSB_ATH3012 }, 211 { USB_DEVICE(0x04ca, 0x3006), .driver_info = BTUSB_ATH3012 }, 212 { USB_DEVICE(0x04ca, 0x3007), .driver_info = BTUSB_ATH3012 }, 213 { USB_DEVICE(0x04ca, 0x3008), .driver_info = BTUSB_ATH3012 }, 214 { USB_DEVICE(0x04ca, 0x300b), .driver_info = BTUSB_ATH3012 }, 215 { USB_DEVICE(0x04ca, 0x300d), .driver_info = BTUSB_ATH3012 }, 216 { USB_DEVICE(0x04ca, 0x300f), .driver_info = BTUSB_ATH3012 }, 217 { USB_DEVICE(0x04ca, 0x3010), .driver_info = BTUSB_ATH3012 }, 218 { USB_DEVICE(0x04ca, 0x3014), .driver_info = BTUSB_ATH3012 }, 219 { USB_DEVICE(0x04ca, 0x3018), .driver_info = BTUSB_ATH3012 }, 220 { USB_DEVICE(0x0930, 0x0219), .driver_info = BTUSB_ATH3012 }, 221 { USB_DEVICE(0x0930, 0x021c), .driver_info = BTUSB_ATH3012 }, 222 { USB_DEVICE(0x0930, 0x0220), .driver_info = BTUSB_ATH3012 }, 223 { USB_DEVICE(0x0930, 0x0227), .driver_info = BTUSB_ATH3012 }, 224 { USB_DEVICE(0x0b05, 0x17d0), .driver_info = BTUSB_ATH3012 }, 225 { USB_DEVICE(0x0cf3, 0x0036), .driver_info = BTUSB_ATH3012 }, 226 { USB_DEVICE(0x0cf3, 0x3004), .driver_info = BTUSB_ATH3012 }, 227 { USB_DEVICE(0x0cf3, 0x3008), .driver_info = BTUSB_ATH3012 }, 228 { USB_DEVICE(0x0cf3, 0x311d), .driver_info = BTUSB_ATH3012 }, 229 { USB_DEVICE(0x0cf3, 0x311e), .driver_info = BTUSB_ATH3012 }, 230 { USB_DEVICE(0x0cf3, 0x311f), .driver_info = BTUSB_ATH3012 }, 231 { USB_DEVICE(0x0cf3, 0x3121), .driver_info = BTUSB_ATH3012 }, 232 { USB_DEVICE(0x0cf3, 0x817a), .driver_info = BTUSB_ATH3012 }, 233 { USB_DEVICE(0x0cf3, 0x817b), .driver_info = BTUSB_ATH3012 }, 234 { USB_DEVICE(0x0cf3, 0xe003), .driver_info = BTUSB_ATH3012 }, 235 { USB_DEVICE(0x0cf3, 0xe004), .driver_info = BTUSB_ATH3012 }, 236 { USB_DEVICE(0x0cf3, 0xe005), .driver_info = BTUSB_ATH3012 }, 237 { USB_DEVICE(0x0cf3, 0xe006), .driver_info = BTUSB_ATH3012 }, 238 { USB_DEVICE(0x13d3, 0x3362), .driver_info = BTUSB_ATH3012 }, 239 { USB_DEVICE(0x13d3, 0x3375), .driver_info = BTUSB_ATH3012 }, 240 { USB_DEVICE(0x13d3, 0x3393), .driver_info = BTUSB_ATH3012 }, 241 { USB_DEVICE(0x13d3, 0x3395), .driver_info = BTUSB_ATH3012 }, 242 { USB_DEVICE(0x13d3, 0x3402), .driver_info = BTUSB_ATH3012 }, 243 { USB_DEVICE(0x13d3, 0x3408), .driver_info = BTUSB_ATH3012 }, 244 { USB_DEVICE(0x13d3, 0x3423), .driver_info = BTUSB_ATH3012 }, 245 { USB_DEVICE(0x13d3, 0x3432), .driver_info = BTUSB_ATH3012 }, 246 { USB_DEVICE(0x13d3, 0x3472), .driver_info = BTUSB_ATH3012 }, 247 { USB_DEVICE(0x13d3, 0x3474), .driver_info = BTUSB_ATH3012 }, 248 { USB_DEVICE(0x13d3, 0x3487), .driver_info = BTUSB_ATH3012 }, 249 { USB_DEVICE(0x13d3, 0x3490), .driver_info = BTUSB_ATH3012 }, 250 251 /* Atheros AR5BBU12 with sflash firmware */ 252 { USB_DEVICE(0x0489, 0xe02c), .driver_info = BTUSB_IGNORE }, 253 254 /* Atheros AR5BBU12 with sflash firmware */ 255 { USB_DEVICE(0x0489, 0xe036), .driver_info = BTUSB_ATH3012 }, 256 { USB_DEVICE(0x0489, 0xe03c), .driver_info = BTUSB_ATH3012 }, 257 258 /* QCA ROME chipset */ 259 { USB_DEVICE(0x0cf3, 0x535b), .driver_info = BTUSB_QCA_ROME | 260 BTUSB_WIDEBAND_SPEECH }, 261 { USB_DEVICE(0x0cf3, 0xe007), .driver_info = BTUSB_QCA_ROME | 262 BTUSB_WIDEBAND_SPEECH }, 263 { USB_DEVICE(0x0cf3, 0xe009), .driver_info = BTUSB_QCA_ROME | 264 BTUSB_WIDEBAND_SPEECH }, 265 { USB_DEVICE(0x0cf3, 0xe010), .driver_info = BTUSB_QCA_ROME | 266 BTUSB_WIDEBAND_SPEECH }, 267 { USB_DEVICE(0x0cf3, 0xe300), .driver_info = BTUSB_QCA_ROME | 268 BTUSB_WIDEBAND_SPEECH }, 269 { USB_DEVICE(0x0cf3, 0xe301), .driver_info = BTUSB_QCA_ROME | 270 BTUSB_WIDEBAND_SPEECH }, 271 { USB_DEVICE(0x0cf3, 0xe360), .driver_info = BTUSB_QCA_ROME | 272 BTUSB_WIDEBAND_SPEECH }, 273 { USB_DEVICE(0x0cf3, 0xe500), .driver_info = BTUSB_QCA_ROME | 274 BTUSB_WIDEBAND_SPEECH }, 275 { USB_DEVICE(0x0489, 0xe092), .driver_info = BTUSB_QCA_ROME | 276 BTUSB_WIDEBAND_SPEECH }, 277 { USB_DEVICE(0x0489, 0xe09f), .driver_info = BTUSB_QCA_ROME | 278 BTUSB_WIDEBAND_SPEECH }, 279 { USB_DEVICE(0x0489, 0xe0a2), .driver_info = BTUSB_QCA_ROME | 280 BTUSB_WIDEBAND_SPEECH }, 281 { USB_DEVICE(0x04ca, 0x3011), .driver_info = BTUSB_QCA_ROME | 282 BTUSB_WIDEBAND_SPEECH }, 283 { USB_DEVICE(0x04ca, 0x3015), .driver_info = BTUSB_QCA_ROME | 284 BTUSB_WIDEBAND_SPEECH }, 285 { USB_DEVICE(0x04ca, 0x3016), .driver_info = BTUSB_QCA_ROME | 286 BTUSB_WIDEBAND_SPEECH }, 287 { USB_DEVICE(0x04ca, 0x301a), .driver_info = BTUSB_QCA_ROME | 288 BTUSB_WIDEBAND_SPEECH }, 289 { USB_DEVICE(0x04ca, 0x3021), .driver_info = BTUSB_QCA_ROME | 290 BTUSB_WIDEBAND_SPEECH }, 291 { USB_DEVICE(0x13d3, 0x3491), .driver_info = BTUSB_QCA_ROME | 292 BTUSB_WIDEBAND_SPEECH }, 293 { USB_DEVICE(0x13d3, 0x3496), .driver_info = BTUSB_QCA_ROME | 294 BTUSB_WIDEBAND_SPEECH }, 295 { USB_DEVICE(0x13d3, 0x3501), .driver_info = BTUSB_QCA_ROME | 296 BTUSB_WIDEBAND_SPEECH }, 297 298 /* QCA WCN6855 chipset */ 299 { USB_DEVICE(0x0cf3, 0xe600), .driver_info = BTUSB_QCA_WCN6855 | 300 BTUSB_WIDEBAND_SPEECH }, 301 302 /* Broadcom BCM2035 */ 303 { USB_DEVICE(0x0a5c, 0x2009), .driver_info = BTUSB_BCM92035 }, 304 { USB_DEVICE(0x0a5c, 0x200a), .driver_info = BTUSB_WRONG_SCO_MTU }, 305 { USB_DEVICE(0x0a5c, 0x2035), .driver_info = BTUSB_WRONG_SCO_MTU }, 306 307 /* Broadcom BCM2045 */ 308 { USB_DEVICE(0x0a5c, 0x2039), .driver_info = BTUSB_WRONG_SCO_MTU }, 309 { USB_DEVICE(0x0a5c, 0x2101), .driver_info = BTUSB_WRONG_SCO_MTU }, 310 311 /* IBM/Lenovo ThinkPad with Broadcom chip */ 312 { USB_DEVICE(0x0a5c, 0x201e), .driver_info = BTUSB_WRONG_SCO_MTU }, 313 { USB_DEVICE(0x0a5c, 0x2110), .driver_info = BTUSB_WRONG_SCO_MTU }, 314 315 /* HP laptop with Broadcom chip */ 316 { USB_DEVICE(0x03f0, 0x171d), .driver_info = BTUSB_WRONG_SCO_MTU }, 317 318 /* Dell laptop with Broadcom chip */ 319 { USB_DEVICE(0x413c, 0x8126), .driver_info = BTUSB_WRONG_SCO_MTU }, 320 321 /* Dell Wireless 370 and 410 devices */ 322 { USB_DEVICE(0x413c, 0x8152), .driver_info = BTUSB_WRONG_SCO_MTU }, 323 { USB_DEVICE(0x413c, 0x8156), .driver_info = BTUSB_WRONG_SCO_MTU }, 324 325 /* Belkin F8T012 and F8T013 devices */ 326 { USB_DEVICE(0x050d, 0x0012), .driver_info = BTUSB_WRONG_SCO_MTU }, 327 { USB_DEVICE(0x050d, 0x0013), .driver_info = BTUSB_WRONG_SCO_MTU }, 328 329 /* Asus WL-BTD202 device */ 330 { USB_DEVICE(0x0b05, 0x1715), .driver_info = BTUSB_WRONG_SCO_MTU }, 331 332 /* Kensington Bluetooth USB adapter */ 333 { USB_DEVICE(0x047d, 0x105e), .driver_info = BTUSB_WRONG_SCO_MTU }, 334 335 /* RTX Telecom based adapters with buggy SCO support */ 336 { USB_DEVICE(0x0400, 0x0807), .driver_info = BTUSB_BROKEN_ISOC }, 337 { USB_DEVICE(0x0400, 0x080a), .driver_info = BTUSB_BROKEN_ISOC }, 338 339 /* CONWISE Technology based adapters with buggy SCO support */ 340 { USB_DEVICE(0x0e5e, 0x6622), 341 .driver_info = BTUSB_BROKEN_ISOC | BTUSB_CW6622}, 342 343 /* Roper Class 1 Bluetooth Dongle (Silicon Wave based) */ 344 { USB_DEVICE(0x1310, 0x0001), .driver_info = BTUSB_SWAVE }, 345 346 /* Digianswer devices */ 347 { USB_DEVICE(0x08fd, 0x0001), .driver_info = BTUSB_DIGIANSWER }, 348 { USB_DEVICE(0x08fd, 0x0002), .driver_info = BTUSB_IGNORE }, 349 350 /* CSR BlueCore Bluetooth Sniffer */ 351 { USB_DEVICE(0x0a12, 0x0002), 352 .driver_info = BTUSB_SNIFFER | BTUSB_BROKEN_ISOC }, 353 354 /* Frontline ComProbe Bluetooth Sniffer */ 355 { USB_DEVICE(0x16d3, 0x0002), 356 .driver_info = BTUSB_SNIFFER | BTUSB_BROKEN_ISOC }, 357 358 /* Marvell Bluetooth devices */ 359 { USB_DEVICE(0x1286, 0x2044), .driver_info = BTUSB_MARVELL }, 360 { USB_DEVICE(0x1286, 0x2046), .driver_info = BTUSB_MARVELL }, 361 { USB_DEVICE(0x1286, 0x204e), .driver_info = BTUSB_MARVELL }, 362 363 /* Intel Bluetooth devices */ 364 { USB_DEVICE(0x8087, 0x0025), .driver_info = BTUSB_INTEL_NEW | 365 BTUSB_WIDEBAND_SPEECH | 366 BTUSB_VALID_LE_STATES }, 367 { USB_DEVICE(0x8087, 0x0026), .driver_info = BTUSB_INTEL_NEW | 368 BTUSB_WIDEBAND_SPEECH }, 369 { USB_DEVICE(0x8087, 0x0029), .driver_info = BTUSB_INTEL_NEW | 370 BTUSB_WIDEBAND_SPEECH }, 371 { USB_DEVICE(0x8087, 0x0032), .driver_info = BTUSB_INTEL_NEWGEN | 372 BTUSB_WIDEBAND_SPEECH}, 373 { USB_DEVICE(0x8087, 0x0033), .driver_info = BTUSB_INTEL_NEWGEN | 374 BTUSB_WIDEBAND_SPEECH}, 375 { USB_DEVICE(0x8087, 0x07da), .driver_info = BTUSB_CSR }, 376 { USB_DEVICE(0x8087, 0x07dc), .driver_info = BTUSB_INTEL }, 377 { USB_DEVICE(0x8087, 0x0a2a), .driver_info = BTUSB_INTEL }, 378 { USB_DEVICE(0x8087, 0x0a2b), .driver_info = BTUSB_INTEL_NEW | 379 BTUSB_WIDEBAND_SPEECH }, 380 { USB_DEVICE(0x8087, 0x0aa7), .driver_info = BTUSB_INTEL | 381 BTUSB_WIDEBAND_SPEECH }, 382 { USB_DEVICE(0x8087, 0x0aaa), .driver_info = BTUSB_INTEL_NEW | 383 BTUSB_WIDEBAND_SPEECH | 384 BTUSB_VALID_LE_STATES }, 385 386 /* Other Intel Bluetooth devices */ 387 { USB_VENDOR_AND_INTERFACE_INFO(0x8087, 0xe0, 0x01, 0x01), 388 .driver_info = BTUSB_IGNORE }, 389 390 /* Realtek 8822CE Bluetooth devices */ 391 { USB_DEVICE(0x0bda, 0xb00c), .driver_info = BTUSB_REALTEK | 392 BTUSB_WIDEBAND_SPEECH }, 393 { USB_DEVICE(0x0bda, 0xc822), .driver_info = BTUSB_REALTEK | 394 BTUSB_WIDEBAND_SPEECH }, 395 396 /* Realtek 8852AE Bluetooth devices */ 397 { USB_DEVICE(0x0bda, 0xc852), .driver_info = BTUSB_REALTEK | 398 BTUSB_WIDEBAND_SPEECH }, 399 400 /* Realtek Bluetooth devices */ 401 { USB_VENDOR_AND_INTERFACE_INFO(0x0bda, 0xe0, 0x01, 0x01), 402 .driver_info = BTUSB_REALTEK }, 403 404 /* MediaTek Bluetooth devices */ 405 { USB_VENDOR_AND_INTERFACE_INFO(0x0e8d, 0xe0, 0x01, 0x01), 406 .driver_info = BTUSB_MEDIATEK | 407 BTUSB_WIDEBAND_SPEECH | 408 BTUSB_VALID_LE_STATES }, 409 410 /* Additional MediaTek MT7615E Bluetooth devices */ 411 { USB_DEVICE(0x13d3, 0x3560), .driver_info = BTUSB_MEDIATEK}, 412 413 /* Additional MediaTek MT7921 Bluetooth devices */ 414 { USB_DEVICE(0x04ca, 0x3802), .driver_info = BTUSB_MEDIATEK | 415 BTUSB_WIDEBAND_SPEECH | 416 BTUSB_VALID_LE_STATES }, 417 418 /* Additional Realtek 8723AE Bluetooth devices */ 419 { USB_DEVICE(0x0930, 0x021d), .driver_info = BTUSB_REALTEK }, 420 { USB_DEVICE(0x13d3, 0x3394), .driver_info = BTUSB_REALTEK }, 421 422 /* Additional Realtek 8723BE Bluetooth devices */ 423 { USB_DEVICE(0x0489, 0xe085), .driver_info = BTUSB_REALTEK }, 424 { USB_DEVICE(0x0489, 0xe08b), .driver_info = BTUSB_REALTEK }, 425 { USB_DEVICE(0x13d3, 0x3410), .driver_info = BTUSB_REALTEK }, 426 { USB_DEVICE(0x13d3, 0x3416), .driver_info = BTUSB_REALTEK }, 427 { USB_DEVICE(0x13d3, 0x3459), .driver_info = BTUSB_REALTEK }, 428 { USB_DEVICE(0x13d3, 0x3494), .driver_info = BTUSB_REALTEK }, 429 430 /* Additional Realtek 8723BU Bluetooth devices */ 431 { USB_DEVICE(0x7392, 0xa611), .driver_info = BTUSB_REALTEK }, 432 433 /* Additional Realtek 8723DE Bluetooth devices */ 434 { USB_DEVICE(0x0bda, 0xb009), .driver_info = BTUSB_REALTEK }, 435 { USB_DEVICE(0x2ff8, 0xb011), .driver_info = BTUSB_REALTEK }, 436 437 /* Additional Realtek 8761BU Bluetooth devices */ 438 { USB_DEVICE(0x0b05, 0x190e), .driver_info = BTUSB_REALTEK | 439 BTUSB_WIDEBAND_SPEECH }, 440 441 /* Additional Realtek 8821AE Bluetooth devices */ 442 { USB_DEVICE(0x0b05, 0x17dc), .driver_info = BTUSB_REALTEK }, 443 { USB_DEVICE(0x13d3, 0x3414), .driver_info = BTUSB_REALTEK }, 444 { USB_DEVICE(0x13d3, 0x3458), .driver_info = BTUSB_REALTEK }, 445 { USB_DEVICE(0x13d3, 0x3461), .driver_info = BTUSB_REALTEK }, 446 { USB_DEVICE(0x13d3, 0x3462), .driver_info = BTUSB_REALTEK }, 447 448 /* Additional Realtek 8822BE Bluetooth devices */ 449 { USB_DEVICE(0x13d3, 0x3526), .driver_info = BTUSB_REALTEK }, 450 { USB_DEVICE(0x0b05, 0x185c), .driver_info = BTUSB_REALTEK }, 451 452 /* Additional Realtek 8822CE Bluetooth devices */ 453 { USB_DEVICE(0x04ca, 0x4005), .driver_info = BTUSB_REALTEK | 454 BTUSB_WIDEBAND_SPEECH }, 455 { USB_DEVICE(0x04c5, 0x161f), .driver_info = BTUSB_REALTEK | 456 BTUSB_WIDEBAND_SPEECH }, 457 { USB_DEVICE(0x0b05, 0x18ef), .driver_info = BTUSB_REALTEK | 458 BTUSB_WIDEBAND_SPEECH }, 459 { USB_DEVICE(0x13d3, 0x3548), .driver_info = BTUSB_REALTEK | 460 BTUSB_WIDEBAND_SPEECH }, 461 { USB_DEVICE(0x13d3, 0x3549), .driver_info = BTUSB_REALTEK | 462 BTUSB_WIDEBAND_SPEECH }, 463 { USB_DEVICE(0x13d3, 0x3553), .driver_info = BTUSB_REALTEK | 464 BTUSB_WIDEBAND_SPEECH }, 465 { USB_DEVICE(0x13d3, 0x3555), .driver_info = BTUSB_REALTEK | 466 BTUSB_WIDEBAND_SPEECH }, 467 { USB_DEVICE(0x2ff8, 0x3051), .driver_info = BTUSB_REALTEK | 468 BTUSB_WIDEBAND_SPEECH }, 469 { USB_DEVICE(0x1358, 0xc123), .driver_info = BTUSB_REALTEK | 470 BTUSB_WIDEBAND_SPEECH }, 471 { USB_DEVICE(0x0bda, 0xc123), .driver_info = BTUSB_REALTEK | 472 BTUSB_WIDEBAND_SPEECH }, 473 { USB_DEVICE(0x0cb5, 0xc547), .driver_info = BTUSB_REALTEK | 474 BTUSB_WIDEBAND_SPEECH }, 475 476 /* Silicon Wave based devices */ 477 { USB_DEVICE(0x0c10, 0x0000), .driver_info = BTUSB_SWAVE }, 478 479 { } /* Terminating entry */ 480 }; 481 482 /* The Bluetooth USB module build into some devices needs to be reset on resume, 483 * this is a problem with the platform (likely shutting off all power) not with 484 * the module itself. So we use a DMI list to match known broken platforms. 485 */ 486 static const struct dmi_system_id btusb_needs_reset_resume_table[] = { 487 { 488 /* Dell OptiPlex 3060 (QCA ROME device 0cf3:e007) */ 489 .matches = { 490 DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."), 491 DMI_MATCH(DMI_PRODUCT_NAME, "OptiPlex 3060"), 492 }, 493 }, 494 { 495 /* Dell XPS 9360 (QCA ROME device 0cf3:e300) */ 496 .matches = { 497 DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."), 498 DMI_MATCH(DMI_PRODUCT_NAME, "XPS 13 9360"), 499 }, 500 }, 501 { 502 /* Dell Inspiron 5565 (QCA ROME device 0cf3:e009) */ 503 .matches = { 504 DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."), 505 DMI_MATCH(DMI_PRODUCT_NAME, "Inspiron 5565"), 506 }, 507 }, 508 {} 509 }; 510 511 #define BTUSB_MAX_ISOC_FRAMES 10 512 513 #define BTUSB_INTR_RUNNING 0 514 #define BTUSB_BULK_RUNNING 1 515 #define BTUSB_ISOC_RUNNING 2 516 #define BTUSB_SUSPENDING 3 517 #define BTUSB_DID_ISO_RESUME 4 518 #define BTUSB_BOOTLOADER 5 519 #define BTUSB_DOWNLOADING 6 520 #define BTUSB_FIRMWARE_LOADED 7 521 #define BTUSB_FIRMWARE_FAILED 8 522 #define BTUSB_BOOTING 9 523 #define BTUSB_DIAG_RUNNING 10 524 #define BTUSB_OOB_WAKE_ENABLED 11 525 #define BTUSB_HW_RESET_ACTIVE 12 526 #define BTUSB_TX_WAIT_VND_EVT 13 527 #define BTUSB_WAKEUP_DISABLE 14 528 529 struct btusb_data { 530 struct hci_dev *hdev; 531 struct usb_device *udev; 532 struct usb_interface *intf; 533 struct usb_interface *isoc; 534 struct usb_interface *diag; 535 unsigned isoc_ifnum; 536 537 unsigned long flags; 538 539 struct work_struct work; 540 struct work_struct waker; 541 542 struct usb_anchor deferred; 543 struct usb_anchor tx_anchor; 544 int tx_in_flight; 545 spinlock_t txlock; 546 547 struct usb_anchor intr_anchor; 548 struct usb_anchor bulk_anchor; 549 struct usb_anchor isoc_anchor; 550 struct usb_anchor diag_anchor; 551 struct usb_anchor ctrl_anchor; 552 spinlock_t rxlock; 553 554 struct sk_buff *evt_skb; 555 struct sk_buff *acl_skb; 556 struct sk_buff *sco_skb; 557 558 struct usb_endpoint_descriptor *intr_ep; 559 struct usb_endpoint_descriptor *bulk_tx_ep; 560 struct usb_endpoint_descriptor *bulk_rx_ep; 561 struct usb_endpoint_descriptor *isoc_tx_ep; 562 struct usb_endpoint_descriptor *isoc_rx_ep; 563 struct usb_endpoint_descriptor *diag_tx_ep; 564 struct usb_endpoint_descriptor *diag_rx_ep; 565 566 struct gpio_desc *reset_gpio; 567 568 __u8 cmdreq_type; 569 __u8 cmdreq; 570 571 unsigned int sco_num; 572 unsigned int air_mode; 573 bool usb_alt6_packet_flow; 574 int isoc_altsetting; 575 int suspend_count; 576 577 int (*recv_event)(struct hci_dev *hdev, struct sk_buff *skb); 578 int (*recv_bulk)(struct btusb_data *data, void *buffer, int count); 579 580 int (*setup_on_usb)(struct hci_dev *hdev); 581 582 int oob_wake_irq; /* irq for out-of-band wake-on-bt */ 583 unsigned cmd_timeout_cnt; 584 }; 585 586 static void btusb_intel_cmd_timeout(struct hci_dev *hdev) 587 { 588 struct btusb_data *data = hci_get_drvdata(hdev); 589 struct gpio_desc *reset_gpio = data->reset_gpio; 590 591 if (++data->cmd_timeout_cnt < 5) 592 return; 593 594 if (!reset_gpio) { 595 bt_dev_err(hdev, "No way to reset. Ignoring and continuing"); 596 return; 597 } 598 599 /* 600 * Toggle the hard reset line if the platform provides one. The reset 601 * is going to yank the device off the USB and then replug. So doing 602 * once is enough. The cleanup is handled correctly on the way out 603 * (standard USB disconnect), and the new device is detected cleanly 604 * and bound to the driver again like it should be. 605 */ 606 if (test_and_set_bit(BTUSB_HW_RESET_ACTIVE, &data->flags)) { 607 bt_dev_err(hdev, "last reset failed? Not resetting again"); 608 return; 609 } 610 611 bt_dev_err(hdev, "Initiating HW reset via gpio"); 612 gpiod_set_value_cansleep(reset_gpio, 1); 613 msleep(100); 614 gpiod_set_value_cansleep(reset_gpio, 0); 615 } 616 617 static void btusb_rtl_cmd_timeout(struct hci_dev *hdev) 618 { 619 struct btusb_data *data = hci_get_drvdata(hdev); 620 struct gpio_desc *reset_gpio = data->reset_gpio; 621 622 if (++data->cmd_timeout_cnt < 5) 623 return; 624 625 if (!reset_gpio) { 626 bt_dev_err(hdev, "No gpio to reset Realtek device, ignoring"); 627 return; 628 } 629 630 /* Toggle the hard reset line. The Realtek device is going to 631 * yank itself off the USB and then replug. The cleanup is handled 632 * correctly on the way out (standard USB disconnect), and the new 633 * device is detected cleanly and bound to the driver again like 634 * it should be. 635 */ 636 if (test_and_set_bit(BTUSB_HW_RESET_ACTIVE, &data->flags)) { 637 bt_dev_err(hdev, "last reset failed? Not resetting again"); 638 return; 639 } 640 641 bt_dev_err(hdev, "Reset Realtek device via gpio"); 642 gpiod_set_value_cansleep(reset_gpio, 1); 643 msleep(200); 644 gpiod_set_value_cansleep(reset_gpio, 0); 645 } 646 647 static void btusb_qca_cmd_timeout(struct hci_dev *hdev) 648 { 649 struct btusb_data *data = hci_get_drvdata(hdev); 650 int err; 651 652 if (++data->cmd_timeout_cnt < 5) 653 return; 654 655 bt_dev_err(hdev, "Multiple cmd timeouts seen. Resetting usb device."); 656 /* This is not an unbalanced PM reference since the device will reset */ 657 err = usb_autopm_get_interface(data->intf); 658 if (!err) 659 usb_queue_reset_device(data->intf); 660 else 661 bt_dev_err(hdev, "Failed usb_autopm_get_interface with %d", err); 662 } 663 664 static inline void btusb_free_frags(struct btusb_data *data) 665 { 666 unsigned long flags; 667 668 spin_lock_irqsave(&data->rxlock, flags); 669 670 kfree_skb(data->evt_skb); 671 data->evt_skb = NULL; 672 673 kfree_skb(data->acl_skb); 674 data->acl_skb = NULL; 675 676 kfree_skb(data->sco_skb); 677 data->sco_skb = NULL; 678 679 spin_unlock_irqrestore(&data->rxlock, flags); 680 } 681 682 static int btusb_recv_intr(struct btusb_data *data, void *buffer, int count) 683 { 684 struct sk_buff *skb; 685 unsigned long flags; 686 int err = 0; 687 688 spin_lock_irqsave(&data->rxlock, flags); 689 skb = data->evt_skb; 690 691 while (count) { 692 int len; 693 694 if (!skb) { 695 skb = bt_skb_alloc(HCI_MAX_EVENT_SIZE, GFP_ATOMIC); 696 if (!skb) { 697 err = -ENOMEM; 698 break; 699 } 700 701 hci_skb_pkt_type(skb) = HCI_EVENT_PKT; 702 hci_skb_expect(skb) = HCI_EVENT_HDR_SIZE; 703 } 704 705 len = min_t(uint, hci_skb_expect(skb), count); 706 skb_put_data(skb, buffer, len); 707 708 count -= len; 709 buffer += len; 710 hci_skb_expect(skb) -= len; 711 712 if (skb->len == HCI_EVENT_HDR_SIZE) { 713 /* Complete event header */ 714 hci_skb_expect(skb) = hci_event_hdr(skb)->plen; 715 716 if (skb_tailroom(skb) < hci_skb_expect(skb)) { 717 kfree_skb(skb); 718 skb = NULL; 719 720 err = -EILSEQ; 721 break; 722 } 723 } 724 725 if (!hci_skb_expect(skb)) { 726 /* Complete frame */ 727 data->recv_event(data->hdev, skb); 728 skb = NULL; 729 } 730 } 731 732 data->evt_skb = skb; 733 spin_unlock_irqrestore(&data->rxlock, flags); 734 735 return err; 736 } 737 738 static int btusb_recv_bulk(struct btusb_data *data, void *buffer, int count) 739 { 740 struct sk_buff *skb; 741 unsigned long flags; 742 int err = 0; 743 744 spin_lock_irqsave(&data->rxlock, flags); 745 skb = data->acl_skb; 746 747 while (count) { 748 int len; 749 750 if (!skb) { 751 skb = bt_skb_alloc(HCI_MAX_FRAME_SIZE, GFP_ATOMIC); 752 if (!skb) { 753 err = -ENOMEM; 754 break; 755 } 756 757 hci_skb_pkt_type(skb) = HCI_ACLDATA_PKT; 758 hci_skb_expect(skb) = HCI_ACL_HDR_SIZE; 759 } 760 761 len = min_t(uint, hci_skb_expect(skb), count); 762 skb_put_data(skb, buffer, len); 763 764 count -= len; 765 buffer += len; 766 hci_skb_expect(skb) -= len; 767 768 if (skb->len == HCI_ACL_HDR_SIZE) { 769 __le16 dlen = hci_acl_hdr(skb)->dlen; 770 771 /* Complete ACL header */ 772 hci_skb_expect(skb) = __le16_to_cpu(dlen); 773 774 if (skb_tailroom(skb) < hci_skb_expect(skb)) { 775 kfree_skb(skb); 776 skb = NULL; 777 778 err = -EILSEQ; 779 break; 780 } 781 } 782 783 if (!hci_skb_expect(skb)) { 784 /* Complete frame */ 785 hci_recv_frame(data->hdev, skb); 786 skb = NULL; 787 } 788 } 789 790 data->acl_skb = skb; 791 spin_unlock_irqrestore(&data->rxlock, flags); 792 793 return err; 794 } 795 796 static int btusb_recv_isoc(struct btusb_data *data, void *buffer, int count) 797 { 798 struct sk_buff *skb; 799 unsigned long flags; 800 int err = 0; 801 802 spin_lock_irqsave(&data->rxlock, flags); 803 skb = data->sco_skb; 804 805 while (count) { 806 int len; 807 808 if (!skb) { 809 skb = bt_skb_alloc(HCI_MAX_SCO_SIZE, GFP_ATOMIC); 810 if (!skb) { 811 err = -ENOMEM; 812 break; 813 } 814 815 hci_skb_pkt_type(skb) = HCI_SCODATA_PKT; 816 hci_skb_expect(skb) = HCI_SCO_HDR_SIZE; 817 } 818 819 len = min_t(uint, hci_skb_expect(skb), count); 820 skb_put_data(skb, buffer, len); 821 822 count -= len; 823 buffer += len; 824 hci_skb_expect(skb) -= len; 825 826 if (skb->len == HCI_SCO_HDR_SIZE) { 827 /* Complete SCO header */ 828 hci_skb_expect(skb) = hci_sco_hdr(skb)->dlen; 829 830 if (skb_tailroom(skb) < hci_skb_expect(skb)) { 831 kfree_skb(skb); 832 skb = NULL; 833 834 err = -EILSEQ; 835 break; 836 } 837 } 838 839 if (!hci_skb_expect(skb)) { 840 /* Complete frame */ 841 hci_recv_frame(data->hdev, skb); 842 skb = NULL; 843 } 844 } 845 846 data->sco_skb = skb; 847 spin_unlock_irqrestore(&data->rxlock, flags); 848 849 return err; 850 } 851 852 static void btusb_intr_complete(struct urb *urb) 853 { 854 struct hci_dev *hdev = urb->context; 855 struct btusb_data *data = hci_get_drvdata(hdev); 856 int err; 857 858 BT_DBG("%s urb %p status %d count %d", hdev->name, urb, urb->status, 859 urb->actual_length); 860 861 if (!test_bit(HCI_RUNNING, &hdev->flags)) 862 return; 863 864 if (urb->status == 0) { 865 hdev->stat.byte_rx += urb->actual_length; 866 867 if (btusb_recv_intr(data, urb->transfer_buffer, 868 urb->actual_length) < 0) { 869 bt_dev_err(hdev, "corrupted event packet"); 870 hdev->stat.err_rx++; 871 } 872 } else if (urb->status == -ENOENT) { 873 /* Avoid suspend failed when usb_kill_urb */ 874 return; 875 } 876 877 if (!test_bit(BTUSB_INTR_RUNNING, &data->flags)) 878 return; 879 880 usb_mark_last_busy(data->udev); 881 usb_anchor_urb(urb, &data->intr_anchor); 882 883 err = usb_submit_urb(urb, GFP_ATOMIC); 884 if (err < 0) { 885 /* -EPERM: urb is being killed; 886 * -ENODEV: device got disconnected 887 */ 888 if (err != -EPERM && err != -ENODEV) 889 bt_dev_err(hdev, "urb %p failed to resubmit (%d)", 890 urb, -err); 891 usb_unanchor_urb(urb); 892 } 893 } 894 895 static int btusb_submit_intr_urb(struct hci_dev *hdev, gfp_t mem_flags) 896 { 897 struct btusb_data *data = hci_get_drvdata(hdev); 898 struct urb *urb; 899 unsigned char *buf; 900 unsigned int pipe; 901 int err, size; 902 903 BT_DBG("%s", hdev->name); 904 905 if (!data->intr_ep) 906 return -ENODEV; 907 908 urb = usb_alloc_urb(0, mem_flags); 909 if (!urb) 910 return -ENOMEM; 911 912 size = le16_to_cpu(data->intr_ep->wMaxPacketSize); 913 914 buf = kmalloc(size, mem_flags); 915 if (!buf) { 916 usb_free_urb(urb); 917 return -ENOMEM; 918 } 919 920 pipe = usb_rcvintpipe(data->udev, data->intr_ep->bEndpointAddress); 921 922 usb_fill_int_urb(urb, data->udev, pipe, buf, size, 923 btusb_intr_complete, hdev, data->intr_ep->bInterval); 924 925 urb->transfer_flags |= URB_FREE_BUFFER; 926 927 usb_anchor_urb(urb, &data->intr_anchor); 928 929 err = usb_submit_urb(urb, mem_flags); 930 if (err < 0) { 931 if (err != -EPERM && err != -ENODEV) 932 bt_dev_err(hdev, "urb %p submission failed (%d)", 933 urb, -err); 934 usb_unanchor_urb(urb); 935 } 936 937 usb_free_urb(urb); 938 939 return err; 940 } 941 942 static void btusb_bulk_complete(struct urb *urb) 943 { 944 struct hci_dev *hdev = urb->context; 945 struct btusb_data *data = hci_get_drvdata(hdev); 946 int err; 947 948 BT_DBG("%s urb %p status %d count %d", hdev->name, urb, urb->status, 949 urb->actual_length); 950 951 if (!test_bit(HCI_RUNNING, &hdev->flags)) 952 return; 953 954 if (urb->status == 0) { 955 hdev->stat.byte_rx += urb->actual_length; 956 957 if (data->recv_bulk(data, urb->transfer_buffer, 958 urb->actual_length) < 0) { 959 bt_dev_err(hdev, "corrupted ACL packet"); 960 hdev->stat.err_rx++; 961 } 962 } else if (urb->status == -ENOENT) { 963 /* Avoid suspend failed when usb_kill_urb */ 964 return; 965 } 966 967 if (!test_bit(BTUSB_BULK_RUNNING, &data->flags)) 968 return; 969 970 usb_anchor_urb(urb, &data->bulk_anchor); 971 usb_mark_last_busy(data->udev); 972 973 err = usb_submit_urb(urb, GFP_ATOMIC); 974 if (err < 0) { 975 /* -EPERM: urb is being killed; 976 * -ENODEV: device got disconnected 977 */ 978 if (err != -EPERM && err != -ENODEV) 979 bt_dev_err(hdev, "urb %p failed to resubmit (%d)", 980 urb, -err); 981 usb_unanchor_urb(urb); 982 } 983 } 984 985 static int btusb_submit_bulk_urb(struct hci_dev *hdev, gfp_t mem_flags) 986 { 987 struct btusb_data *data = hci_get_drvdata(hdev); 988 struct urb *urb; 989 unsigned char *buf; 990 unsigned int pipe; 991 int err, size = HCI_MAX_FRAME_SIZE; 992 993 BT_DBG("%s", hdev->name); 994 995 if (!data->bulk_rx_ep) 996 return -ENODEV; 997 998 urb = usb_alloc_urb(0, mem_flags); 999 if (!urb) 1000 return -ENOMEM; 1001 1002 buf = kmalloc(size, mem_flags); 1003 if (!buf) { 1004 usb_free_urb(urb); 1005 return -ENOMEM; 1006 } 1007 1008 pipe = usb_rcvbulkpipe(data->udev, data->bulk_rx_ep->bEndpointAddress); 1009 1010 usb_fill_bulk_urb(urb, data->udev, pipe, buf, size, 1011 btusb_bulk_complete, hdev); 1012 1013 urb->transfer_flags |= URB_FREE_BUFFER; 1014 1015 usb_mark_last_busy(data->udev); 1016 usb_anchor_urb(urb, &data->bulk_anchor); 1017 1018 err = usb_submit_urb(urb, mem_flags); 1019 if (err < 0) { 1020 if (err != -EPERM && err != -ENODEV) 1021 bt_dev_err(hdev, "urb %p submission failed (%d)", 1022 urb, -err); 1023 usb_unanchor_urb(urb); 1024 } 1025 1026 usb_free_urb(urb); 1027 1028 return err; 1029 } 1030 1031 static void btusb_isoc_complete(struct urb *urb) 1032 { 1033 struct hci_dev *hdev = urb->context; 1034 struct btusb_data *data = hci_get_drvdata(hdev); 1035 int i, err; 1036 1037 BT_DBG("%s urb %p status %d count %d", hdev->name, urb, urb->status, 1038 urb->actual_length); 1039 1040 if (!test_bit(HCI_RUNNING, &hdev->flags)) 1041 return; 1042 1043 if (urb->status == 0) { 1044 for (i = 0; i < urb->number_of_packets; i++) { 1045 unsigned int offset = urb->iso_frame_desc[i].offset; 1046 unsigned int length = urb->iso_frame_desc[i].actual_length; 1047 1048 if (urb->iso_frame_desc[i].status) 1049 continue; 1050 1051 hdev->stat.byte_rx += length; 1052 1053 if (btusb_recv_isoc(data, urb->transfer_buffer + offset, 1054 length) < 0) { 1055 bt_dev_err(hdev, "corrupted SCO packet"); 1056 hdev->stat.err_rx++; 1057 } 1058 } 1059 } else if (urb->status == -ENOENT) { 1060 /* Avoid suspend failed when usb_kill_urb */ 1061 return; 1062 } 1063 1064 if (!test_bit(BTUSB_ISOC_RUNNING, &data->flags)) 1065 return; 1066 1067 usb_anchor_urb(urb, &data->isoc_anchor); 1068 1069 err = usb_submit_urb(urb, GFP_ATOMIC); 1070 if (err < 0) { 1071 /* -EPERM: urb is being killed; 1072 * -ENODEV: device got disconnected 1073 */ 1074 if (err != -EPERM && err != -ENODEV) 1075 bt_dev_err(hdev, "urb %p failed to resubmit (%d)", 1076 urb, -err); 1077 usb_unanchor_urb(urb); 1078 } 1079 } 1080 1081 static inline void __fill_isoc_descriptor_msbc(struct urb *urb, int len, 1082 int mtu, struct btusb_data *data) 1083 { 1084 int i, offset = 0; 1085 unsigned int interval; 1086 1087 BT_DBG("len %d mtu %d", len, mtu); 1088 1089 /* For mSBC ALT 6 setting the host will send the packet at continuous 1090 * flow. As per core spec 5, vol 4, part B, table 2.1. For ALT setting 1091 * 6 the HCI PACKET INTERVAL should be 7.5ms for every usb packets. 1092 * To maintain the rate we send 63bytes of usb packets alternatively for 1093 * 7ms and 8ms to maintain the rate as 7.5ms. 1094 */ 1095 if (data->usb_alt6_packet_flow) { 1096 interval = 7; 1097 data->usb_alt6_packet_flow = false; 1098 } else { 1099 interval = 6; 1100 data->usb_alt6_packet_flow = true; 1101 } 1102 1103 for (i = 0; i < interval; i++) { 1104 urb->iso_frame_desc[i].offset = offset; 1105 urb->iso_frame_desc[i].length = offset; 1106 } 1107 1108 if (len && i < BTUSB_MAX_ISOC_FRAMES) { 1109 urb->iso_frame_desc[i].offset = offset; 1110 urb->iso_frame_desc[i].length = len; 1111 i++; 1112 } 1113 1114 urb->number_of_packets = i; 1115 } 1116 1117 static inline void __fill_isoc_descriptor(struct urb *urb, int len, int mtu) 1118 { 1119 int i, offset = 0; 1120 1121 BT_DBG("len %d mtu %d", len, mtu); 1122 1123 for (i = 0; i < BTUSB_MAX_ISOC_FRAMES && len >= mtu; 1124 i++, offset += mtu, len -= mtu) { 1125 urb->iso_frame_desc[i].offset = offset; 1126 urb->iso_frame_desc[i].length = mtu; 1127 } 1128 1129 if (len && i < BTUSB_MAX_ISOC_FRAMES) { 1130 urb->iso_frame_desc[i].offset = offset; 1131 urb->iso_frame_desc[i].length = len; 1132 i++; 1133 } 1134 1135 urb->number_of_packets = i; 1136 } 1137 1138 static int btusb_submit_isoc_urb(struct hci_dev *hdev, gfp_t mem_flags) 1139 { 1140 struct btusb_data *data = hci_get_drvdata(hdev); 1141 struct urb *urb; 1142 unsigned char *buf; 1143 unsigned int pipe; 1144 int err, size; 1145 1146 BT_DBG("%s", hdev->name); 1147 1148 if (!data->isoc_rx_ep) 1149 return -ENODEV; 1150 1151 urb = usb_alloc_urb(BTUSB_MAX_ISOC_FRAMES, mem_flags); 1152 if (!urb) 1153 return -ENOMEM; 1154 1155 size = le16_to_cpu(data->isoc_rx_ep->wMaxPacketSize) * 1156 BTUSB_MAX_ISOC_FRAMES; 1157 1158 buf = kmalloc(size, mem_flags); 1159 if (!buf) { 1160 usb_free_urb(urb); 1161 return -ENOMEM; 1162 } 1163 1164 pipe = usb_rcvisocpipe(data->udev, data->isoc_rx_ep->bEndpointAddress); 1165 1166 usb_fill_int_urb(urb, data->udev, pipe, buf, size, btusb_isoc_complete, 1167 hdev, data->isoc_rx_ep->bInterval); 1168 1169 urb->transfer_flags = URB_FREE_BUFFER | URB_ISO_ASAP; 1170 1171 __fill_isoc_descriptor(urb, size, 1172 le16_to_cpu(data->isoc_rx_ep->wMaxPacketSize)); 1173 1174 usb_anchor_urb(urb, &data->isoc_anchor); 1175 1176 err = usb_submit_urb(urb, mem_flags); 1177 if (err < 0) { 1178 if (err != -EPERM && err != -ENODEV) 1179 bt_dev_err(hdev, "urb %p submission failed (%d)", 1180 urb, -err); 1181 usb_unanchor_urb(urb); 1182 } 1183 1184 usb_free_urb(urb); 1185 1186 return err; 1187 } 1188 1189 static void btusb_diag_complete(struct urb *urb) 1190 { 1191 struct hci_dev *hdev = urb->context; 1192 struct btusb_data *data = hci_get_drvdata(hdev); 1193 int err; 1194 1195 BT_DBG("%s urb %p status %d count %d", hdev->name, urb, urb->status, 1196 urb->actual_length); 1197 1198 if (urb->status == 0) { 1199 struct sk_buff *skb; 1200 1201 skb = bt_skb_alloc(urb->actual_length, GFP_ATOMIC); 1202 if (skb) { 1203 skb_put_data(skb, urb->transfer_buffer, 1204 urb->actual_length); 1205 hci_recv_diag(hdev, skb); 1206 } 1207 } else if (urb->status == -ENOENT) { 1208 /* Avoid suspend failed when usb_kill_urb */ 1209 return; 1210 } 1211 1212 if (!test_bit(BTUSB_DIAG_RUNNING, &data->flags)) 1213 return; 1214 1215 usb_anchor_urb(urb, &data->diag_anchor); 1216 usb_mark_last_busy(data->udev); 1217 1218 err = usb_submit_urb(urb, GFP_ATOMIC); 1219 if (err < 0) { 1220 /* -EPERM: urb is being killed; 1221 * -ENODEV: device got disconnected 1222 */ 1223 if (err != -EPERM && err != -ENODEV) 1224 bt_dev_err(hdev, "urb %p failed to resubmit (%d)", 1225 urb, -err); 1226 usb_unanchor_urb(urb); 1227 } 1228 } 1229 1230 static int btusb_submit_diag_urb(struct hci_dev *hdev, gfp_t mem_flags) 1231 { 1232 struct btusb_data *data = hci_get_drvdata(hdev); 1233 struct urb *urb; 1234 unsigned char *buf; 1235 unsigned int pipe; 1236 int err, size = HCI_MAX_FRAME_SIZE; 1237 1238 BT_DBG("%s", hdev->name); 1239 1240 if (!data->diag_rx_ep) 1241 return -ENODEV; 1242 1243 urb = usb_alloc_urb(0, mem_flags); 1244 if (!urb) 1245 return -ENOMEM; 1246 1247 buf = kmalloc(size, mem_flags); 1248 if (!buf) { 1249 usb_free_urb(urb); 1250 return -ENOMEM; 1251 } 1252 1253 pipe = usb_rcvbulkpipe(data->udev, data->diag_rx_ep->bEndpointAddress); 1254 1255 usb_fill_bulk_urb(urb, data->udev, pipe, buf, size, 1256 btusb_diag_complete, hdev); 1257 1258 urb->transfer_flags |= URB_FREE_BUFFER; 1259 1260 usb_mark_last_busy(data->udev); 1261 usb_anchor_urb(urb, &data->diag_anchor); 1262 1263 err = usb_submit_urb(urb, mem_flags); 1264 if (err < 0) { 1265 if (err != -EPERM && err != -ENODEV) 1266 bt_dev_err(hdev, "urb %p submission failed (%d)", 1267 urb, -err); 1268 usb_unanchor_urb(urb); 1269 } 1270 1271 usb_free_urb(urb); 1272 1273 return err; 1274 } 1275 1276 static void btusb_tx_complete(struct urb *urb) 1277 { 1278 struct sk_buff *skb = urb->context; 1279 struct hci_dev *hdev = (struct hci_dev *)skb->dev; 1280 struct btusb_data *data = hci_get_drvdata(hdev); 1281 unsigned long flags; 1282 1283 BT_DBG("%s urb %p status %d count %d", hdev->name, urb, urb->status, 1284 urb->actual_length); 1285 1286 if (!test_bit(HCI_RUNNING, &hdev->flags)) 1287 goto done; 1288 1289 if (!urb->status) 1290 hdev->stat.byte_tx += urb->transfer_buffer_length; 1291 else 1292 hdev->stat.err_tx++; 1293 1294 done: 1295 spin_lock_irqsave(&data->txlock, flags); 1296 data->tx_in_flight--; 1297 spin_unlock_irqrestore(&data->txlock, flags); 1298 1299 kfree(urb->setup_packet); 1300 1301 kfree_skb(skb); 1302 } 1303 1304 static void btusb_isoc_tx_complete(struct urb *urb) 1305 { 1306 struct sk_buff *skb = urb->context; 1307 struct hci_dev *hdev = (struct hci_dev *)skb->dev; 1308 1309 BT_DBG("%s urb %p status %d count %d", hdev->name, urb, urb->status, 1310 urb->actual_length); 1311 1312 if (!test_bit(HCI_RUNNING, &hdev->flags)) 1313 goto done; 1314 1315 if (!urb->status) 1316 hdev->stat.byte_tx += urb->transfer_buffer_length; 1317 else 1318 hdev->stat.err_tx++; 1319 1320 done: 1321 kfree(urb->setup_packet); 1322 1323 kfree_skb(skb); 1324 } 1325 1326 static int btusb_open(struct hci_dev *hdev) 1327 { 1328 struct btusb_data *data = hci_get_drvdata(hdev); 1329 int err; 1330 1331 BT_DBG("%s", hdev->name); 1332 1333 err = usb_autopm_get_interface(data->intf); 1334 if (err < 0) 1335 return err; 1336 1337 /* Patching USB firmware files prior to starting any URBs of HCI path 1338 * It is more safe to use USB bulk channel for downloading USB patch 1339 */ 1340 if (data->setup_on_usb) { 1341 err = data->setup_on_usb(hdev); 1342 if (err < 0) 1343 goto setup_fail; 1344 } 1345 1346 data->intf->needs_remote_wakeup = 1; 1347 1348 /* Disable device remote wakeup when host is suspended 1349 * For Realtek chips, global suspend without 1350 * SET_FEATURE (DEVICE_REMOTE_WAKEUP) can save more power in device. 1351 */ 1352 if (test_bit(BTUSB_WAKEUP_DISABLE, &data->flags)) 1353 device_wakeup_disable(&data->udev->dev); 1354 1355 if (test_and_set_bit(BTUSB_INTR_RUNNING, &data->flags)) 1356 goto done; 1357 1358 err = btusb_submit_intr_urb(hdev, GFP_KERNEL); 1359 if (err < 0) 1360 goto failed; 1361 1362 err = btusb_submit_bulk_urb(hdev, GFP_KERNEL); 1363 if (err < 0) { 1364 usb_kill_anchored_urbs(&data->intr_anchor); 1365 goto failed; 1366 } 1367 1368 set_bit(BTUSB_BULK_RUNNING, &data->flags); 1369 btusb_submit_bulk_urb(hdev, GFP_KERNEL); 1370 1371 if (data->diag) { 1372 if (!btusb_submit_diag_urb(hdev, GFP_KERNEL)) 1373 set_bit(BTUSB_DIAG_RUNNING, &data->flags); 1374 } 1375 1376 done: 1377 usb_autopm_put_interface(data->intf); 1378 return 0; 1379 1380 failed: 1381 clear_bit(BTUSB_INTR_RUNNING, &data->flags); 1382 setup_fail: 1383 usb_autopm_put_interface(data->intf); 1384 return err; 1385 } 1386 1387 static void btusb_stop_traffic(struct btusb_data *data) 1388 { 1389 usb_kill_anchored_urbs(&data->intr_anchor); 1390 usb_kill_anchored_urbs(&data->bulk_anchor); 1391 usb_kill_anchored_urbs(&data->isoc_anchor); 1392 usb_kill_anchored_urbs(&data->diag_anchor); 1393 usb_kill_anchored_urbs(&data->ctrl_anchor); 1394 } 1395 1396 static int btusb_close(struct hci_dev *hdev) 1397 { 1398 struct btusb_data *data = hci_get_drvdata(hdev); 1399 int err; 1400 1401 BT_DBG("%s", hdev->name); 1402 1403 cancel_work_sync(&data->work); 1404 cancel_work_sync(&data->waker); 1405 1406 clear_bit(BTUSB_ISOC_RUNNING, &data->flags); 1407 clear_bit(BTUSB_BULK_RUNNING, &data->flags); 1408 clear_bit(BTUSB_INTR_RUNNING, &data->flags); 1409 clear_bit(BTUSB_DIAG_RUNNING, &data->flags); 1410 1411 btusb_stop_traffic(data); 1412 btusb_free_frags(data); 1413 1414 err = usb_autopm_get_interface(data->intf); 1415 if (err < 0) 1416 goto failed; 1417 1418 data->intf->needs_remote_wakeup = 0; 1419 1420 /* Enable remote wake up for auto-suspend */ 1421 if (test_bit(BTUSB_WAKEUP_DISABLE, &data->flags)) 1422 data->intf->needs_remote_wakeup = 1; 1423 1424 usb_autopm_put_interface(data->intf); 1425 1426 failed: 1427 usb_scuttle_anchored_urbs(&data->deferred); 1428 return 0; 1429 } 1430 1431 static int btusb_flush(struct hci_dev *hdev) 1432 { 1433 struct btusb_data *data = hci_get_drvdata(hdev); 1434 1435 BT_DBG("%s", hdev->name); 1436 1437 usb_kill_anchored_urbs(&data->tx_anchor); 1438 btusb_free_frags(data); 1439 1440 return 0; 1441 } 1442 1443 static struct urb *alloc_ctrl_urb(struct hci_dev *hdev, struct sk_buff *skb) 1444 { 1445 struct btusb_data *data = hci_get_drvdata(hdev); 1446 struct usb_ctrlrequest *dr; 1447 struct urb *urb; 1448 unsigned int pipe; 1449 1450 urb = usb_alloc_urb(0, GFP_KERNEL); 1451 if (!urb) 1452 return ERR_PTR(-ENOMEM); 1453 1454 dr = kmalloc(sizeof(*dr), GFP_KERNEL); 1455 if (!dr) { 1456 usb_free_urb(urb); 1457 return ERR_PTR(-ENOMEM); 1458 } 1459 1460 dr->bRequestType = data->cmdreq_type; 1461 dr->bRequest = data->cmdreq; 1462 dr->wIndex = 0; 1463 dr->wValue = 0; 1464 dr->wLength = __cpu_to_le16(skb->len); 1465 1466 pipe = usb_sndctrlpipe(data->udev, 0x00); 1467 1468 usb_fill_control_urb(urb, data->udev, pipe, (void *)dr, 1469 skb->data, skb->len, btusb_tx_complete, skb); 1470 1471 skb->dev = (void *)hdev; 1472 1473 return urb; 1474 } 1475 1476 static struct urb *alloc_bulk_urb(struct hci_dev *hdev, struct sk_buff *skb) 1477 { 1478 struct btusb_data *data = hci_get_drvdata(hdev); 1479 struct urb *urb; 1480 unsigned int pipe; 1481 1482 if (!data->bulk_tx_ep) 1483 return ERR_PTR(-ENODEV); 1484 1485 urb = usb_alloc_urb(0, GFP_KERNEL); 1486 if (!urb) 1487 return ERR_PTR(-ENOMEM); 1488 1489 pipe = usb_sndbulkpipe(data->udev, data->bulk_tx_ep->bEndpointAddress); 1490 1491 usb_fill_bulk_urb(urb, data->udev, pipe, 1492 skb->data, skb->len, btusb_tx_complete, skb); 1493 1494 skb->dev = (void *)hdev; 1495 1496 return urb; 1497 } 1498 1499 static struct urb *alloc_isoc_urb(struct hci_dev *hdev, struct sk_buff *skb) 1500 { 1501 struct btusb_data *data = hci_get_drvdata(hdev); 1502 struct urb *urb; 1503 unsigned int pipe; 1504 1505 if (!data->isoc_tx_ep) 1506 return ERR_PTR(-ENODEV); 1507 1508 urb = usb_alloc_urb(BTUSB_MAX_ISOC_FRAMES, GFP_KERNEL); 1509 if (!urb) 1510 return ERR_PTR(-ENOMEM); 1511 1512 pipe = usb_sndisocpipe(data->udev, data->isoc_tx_ep->bEndpointAddress); 1513 1514 usb_fill_int_urb(urb, data->udev, pipe, 1515 skb->data, skb->len, btusb_isoc_tx_complete, 1516 skb, data->isoc_tx_ep->bInterval); 1517 1518 urb->transfer_flags = URB_ISO_ASAP; 1519 1520 if (data->isoc_altsetting == 6) 1521 __fill_isoc_descriptor_msbc(urb, skb->len, 1522 le16_to_cpu(data->isoc_tx_ep->wMaxPacketSize), 1523 data); 1524 else 1525 __fill_isoc_descriptor(urb, skb->len, 1526 le16_to_cpu(data->isoc_tx_ep->wMaxPacketSize)); 1527 skb->dev = (void *)hdev; 1528 1529 return urb; 1530 } 1531 1532 static int submit_tx_urb(struct hci_dev *hdev, struct urb *urb) 1533 { 1534 struct btusb_data *data = hci_get_drvdata(hdev); 1535 int err; 1536 1537 usb_anchor_urb(urb, &data->tx_anchor); 1538 1539 err = usb_submit_urb(urb, GFP_KERNEL); 1540 if (err < 0) { 1541 if (err != -EPERM && err != -ENODEV) 1542 bt_dev_err(hdev, "urb %p submission failed (%d)", 1543 urb, -err); 1544 kfree(urb->setup_packet); 1545 usb_unanchor_urb(urb); 1546 } else { 1547 usb_mark_last_busy(data->udev); 1548 } 1549 1550 usb_free_urb(urb); 1551 return err; 1552 } 1553 1554 static int submit_or_queue_tx_urb(struct hci_dev *hdev, struct urb *urb) 1555 { 1556 struct btusb_data *data = hci_get_drvdata(hdev); 1557 unsigned long flags; 1558 bool suspending; 1559 1560 spin_lock_irqsave(&data->txlock, flags); 1561 suspending = test_bit(BTUSB_SUSPENDING, &data->flags); 1562 if (!suspending) 1563 data->tx_in_flight++; 1564 spin_unlock_irqrestore(&data->txlock, flags); 1565 1566 if (!suspending) 1567 return submit_tx_urb(hdev, urb); 1568 1569 usb_anchor_urb(urb, &data->deferred); 1570 schedule_work(&data->waker); 1571 1572 usb_free_urb(urb); 1573 return 0; 1574 } 1575 1576 static int btusb_send_frame(struct hci_dev *hdev, struct sk_buff *skb) 1577 { 1578 struct urb *urb; 1579 1580 BT_DBG("%s", hdev->name); 1581 1582 switch (hci_skb_pkt_type(skb)) { 1583 case HCI_COMMAND_PKT: 1584 urb = alloc_ctrl_urb(hdev, skb); 1585 if (IS_ERR(urb)) 1586 return PTR_ERR(urb); 1587 1588 hdev->stat.cmd_tx++; 1589 return submit_or_queue_tx_urb(hdev, urb); 1590 1591 case HCI_ACLDATA_PKT: 1592 urb = alloc_bulk_urb(hdev, skb); 1593 if (IS_ERR(urb)) 1594 return PTR_ERR(urb); 1595 1596 hdev->stat.acl_tx++; 1597 return submit_or_queue_tx_urb(hdev, urb); 1598 1599 case HCI_SCODATA_PKT: 1600 if (hci_conn_num(hdev, SCO_LINK) < 1) 1601 return -ENODEV; 1602 1603 urb = alloc_isoc_urb(hdev, skb); 1604 if (IS_ERR(urb)) 1605 return PTR_ERR(urb); 1606 1607 hdev->stat.sco_tx++; 1608 return submit_tx_urb(hdev, urb); 1609 } 1610 1611 return -EILSEQ; 1612 } 1613 1614 static void btusb_notify(struct hci_dev *hdev, unsigned int evt) 1615 { 1616 struct btusb_data *data = hci_get_drvdata(hdev); 1617 1618 BT_DBG("%s evt %d", hdev->name, evt); 1619 1620 if (hci_conn_num(hdev, SCO_LINK) != data->sco_num) { 1621 data->sco_num = hci_conn_num(hdev, SCO_LINK); 1622 data->air_mode = evt; 1623 schedule_work(&data->work); 1624 } 1625 } 1626 1627 static inline int __set_isoc_interface(struct hci_dev *hdev, int altsetting) 1628 { 1629 struct btusb_data *data = hci_get_drvdata(hdev); 1630 struct usb_interface *intf = data->isoc; 1631 struct usb_endpoint_descriptor *ep_desc; 1632 int i, err; 1633 1634 if (!data->isoc) 1635 return -ENODEV; 1636 1637 err = usb_set_interface(data->udev, data->isoc_ifnum, altsetting); 1638 if (err < 0) { 1639 bt_dev_err(hdev, "setting interface failed (%d)", -err); 1640 return err; 1641 } 1642 1643 data->isoc_altsetting = altsetting; 1644 1645 data->isoc_tx_ep = NULL; 1646 data->isoc_rx_ep = NULL; 1647 1648 for (i = 0; i < intf->cur_altsetting->desc.bNumEndpoints; i++) { 1649 ep_desc = &intf->cur_altsetting->endpoint[i].desc; 1650 1651 if (!data->isoc_tx_ep && usb_endpoint_is_isoc_out(ep_desc)) { 1652 data->isoc_tx_ep = ep_desc; 1653 continue; 1654 } 1655 1656 if (!data->isoc_rx_ep && usb_endpoint_is_isoc_in(ep_desc)) { 1657 data->isoc_rx_ep = ep_desc; 1658 continue; 1659 } 1660 } 1661 1662 if (!data->isoc_tx_ep || !data->isoc_rx_ep) { 1663 bt_dev_err(hdev, "invalid SCO descriptors"); 1664 return -ENODEV; 1665 } 1666 1667 return 0; 1668 } 1669 1670 static int btusb_switch_alt_setting(struct hci_dev *hdev, int new_alts) 1671 { 1672 struct btusb_data *data = hci_get_drvdata(hdev); 1673 int err; 1674 1675 if (data->isoc_altsetting != new_alts) { 1676 unsigned long flags; 1677 1678 clear_bit(BTUSB_ISOC_RUNNING, &data->flags); 1679 usb_kill_anchored_urbs(&data->isoc_anchor); 1680 1681 /* When isochronous alternate setting needs to be 1682 * changed, because SCO connection has been added 1683 * or removed, a packet fragment may be left in the 1684 * reassembling state. This could lead to wrongly 1685 * assembled fragments. 1686 * 1687 * Clear outstanding fragment when selecting a new 1688 * alternate setting. 1689 */ 1690 spin_lock_irqsave(&data->rxlock, flags); 1691 kfree_skb(data->sco_skb); 1692 data->sco_skb = NULL; 1693 spin_unlock_irqrestore(&data->rxlock, flags); 1694 1695 err = __set_isoc_interface(hdev, new_alts); 1696 if (err < 0) 1697 return err; 1698 } 1699 1700 if (!test_and_set_bit(BTUSB_ISOC_RUNNING, &data->flags)) { 1701 if (btusb_submit_isoc_urb(hdev, GFP_KERNEL) < 0) 1702 clear_bit(BTUSB_ISOC_RUNNING, &data->flags); 1703 else 1704 btusb_submit_isoc_urb(hdev, GFP_KERNEL); 1705 } 1706 1707 return 0; 1708 } 1709 1710 static struct usb_host_interface *btusb_find_altsetting(struct btusb_data *data, 1711 int alt) 1712 { 1713 struct usb_interface *intf = data->isoc; 1714 int i; 1715 1716 BT_DBG("Looking for Alt no :%d", alt); 1717 1718 if (!intf) 1719 return NULL; 1720 1721 for (i = 0; i < intf->num_altsetting; i++) { 1722 if (intf->altsetting[i].desc.bAlternateSetting == alt) 1723 return &intf->altsetting[i]; 1724 } 1725 1726 return NULL; 1727 } 1728 1729 static void btusb_work(struct work_struct *work) 1730 { 1731 struct btusb_data *data = container_of(work, struct btusb_data, work); 1732 struct hci_dev *hdev = data->hdev; 1733 int new_alts = 0; 1734 int err; 1735 1736 if (data->sco_num > 0) { 1737 if (!test_bit(BTUSB_DID_ISO_RESUME, &data->flags)) { 1738 err = usb_autopm_get_interface(data->isoc ? data->isoc : data->intf); 1739 if (err < 0) { 1740 clear_bit(BTUSB_ISOC_RUNNING, &data->flags); 1741 usb_kill_anchored_urbs(&data->isoc_anchor); 1742 return; 1743 } 1744 1745 set_bit(BTUSB_DID_ISO_RESUME, &data->flags); 1746 } 1747 1748 if (data->air_mode == HCI_NOTIFY_ENABLE_SCO_CVSD) { 1749 if (hdev->voice_setting & 0x0020) { 1750 static const int alts[3] = { 2, 4, 5 }; 1751 1752 new_alts = alts[data->sco_num - 1]; 1753 } else { 1754 new_alts = data->sco_num; 1755 } 1756 } else if (data->air_mode == HCI_NOTIFY_ENABLE_SCO_TRANSP) { 1757 /* Bluetooth USB spec recommends alt 6 (63 bytes), but 1758 * many adapters do not support it. Alt 1 appears to 1759 * work for all adapters that do not have alt 6, and 1760 * which work with WBS at all. 1761 */ 1762 new_alts = btusb_find_altsetting(data, 6) ? 6 : 1; 1763 /* Because mSBC frames do not need to be aligned to the 1764 * SCO packet boundary. If support the Alt 3, use the 1765 * Alt 3 for HCI payload >= 60 Bytes let air packet 1766 * data satisfy 60 bytes. 1767 */ 1768 if (new_alts == 1 && btusb_find_altsetting(data, 3)) 1769 new_alts = 3; 1770 } 1771 1772 if (btusb_switch_alt_setting(hdev, new_alts) < 0) 1773 bt_dev_err(hdev, "set USB alt:(%d) failed!", new_alts); 1774 } else { 1775 clear_bit(BTUSB_ISOC_RUNNING, &data->flags); 1776 usb_kill_anchored_urbs(&data->isoc_anchor); 1777 1778 __set_isoc_interface(hdev, 0); 1779 if (test_and_clear_bit(BTUSB_DID_ISO_RESUME, &data->flags)) 1780 usb_autopm_put_interface(data->isoc ? data->isoc : data->intf); 1781 } 1782 } 1783 1784 static void btusb_waker(struct work_struct *work) 1785 { 1786 struct btusb_data *data = container_of(work, struct btusb_data, waker); 1787 int err; 1788 1789 err = usb_autopm_get_interface(data->intf); 1790 if (err < 0) 1791 return; 1792 1793 usb_autopm_put_interface(data->intf); 1794 } 1795 1796 static int btusb_setup_bcm92035(struct hci_dev *hdev) 1797 { 1798 struct sk_buff *skb; 1799 u8 val = 0x00; 1800 1801 BT_DBG("%s", hdev->name); 1802 1803 skb = __hci_cmd_sync(hdev, 0xfc3b, 1, &val, HCI_INIT_TIMEOUT); 1804 if (IS_ERR(skb)) 1805 bt_dev_err(hdev, "BCM92035 command failed (%ld)", PTR_ERR(skb)); 1806 else 1807 kfree_skb(skb); 1808 1809 return 0; 1810 } 1811 1812 static int btusb_setup_csr(struct hci_dev *hdev) 1813 { 1814 struct btusb_data *data = hci_get_drvdata(hdev); 1815 u16 bcdDevice = le16_to_cpu(data->udev->descriptor.bcdDevice); 1816 struct hci_rp_read_local_version *rp; 1817 struct sk_buff *skb; 1818 bool is_fake = false; 1819 int ret; 1820 1821 BT_DBG("%s", hdev->name); 1822 1823 skb = __hci_cmd_sync(hdev, HCI_OP_READ_LOCAL_VERSION, 0, NULL, 1824 HCI_INIT_TIMEOUT); 1825 if (IS_ERR(skb)) { 1826 int err = PTR_ERR(skb); 1827 bt_dev_err(hdev, "CSR: Local version failed (%d)", err); 1828 return err; 1829 } 1830 1831 if (skb->len != sizeof(struct hci_rp_read_local_version)) { 1832 bt_dev_err(hdev, "CSR: Local version length mismatch"); 1833 kfree_skb(skb); 1834 return -EIO; 1835 } 1836 1837 rp = (struct hci_rp_read_local_version *)skb->data; 1838 1839 /* Detect a wide host of Chinese controllers that aren't CSR. 1840 * 1841 * Known fake bcdDevices: 0x0100, 0x0134, 0x1915, 0x2520, 0x7558, 0x8891 1842 * 1843 * The main thing they have in common is that these are really popular low-cost 1844 * options that support newer Bluetooth versions but rely on heavy VID/PID 1845 * squatting of this poor old Bluetooth 1.1 device. Even sold as such. 1846 * 1847 * We detect actual CSR devices by checking that the HCI manufacturer code 1848 * is Cambridge Silicon Radio (10) and ensuring that LMP sub-version and 1849 * HCI rev values always match. As they both store the firmware number. 1850 */ 1851 if (le16_to_cpu(rp->manufacturer) != 10 || 1852 le16_to_cpu(rp->hci_rev) != le16_to_cpu(rp->lmp_subver)) 1853 is_fake = true; 1854 1855 /* Known legit CSR firmware build numbers and their supported BT versions: 1856 * - 1.1 (0x1) -> 0x0073, 0x020d, 0x033c, 0x034e 1857 * - 1.2 (0x2) -> 0x04d9, 0x0529 1858 * - 2.0 (0x3) -> 0x07a6, 0x07ad, 0x0c5c 1859 * - 2.1 (0x4) -> 0x149c, 0x1735, 0x1899 (0x1899 is a BlueCore4-External) 1860 * - 4.0 (0x6) -> 0x1d86, 0x2031, 0x22bb 1861 * 1862 * e.g. Real CSR dongles with LMP subversion 0x73 are old enough that 1863 * support BT 1.1 only; so it's a dead giveaway when some 1864 * third-party BT 4.0 dongle reuses it. 1865 */ 1866 else if (le16_to_cpu(rp->lmp_subver) <= 0x034e && 1867 le16_to_cpu(rp->hci_ver) > BLUETOOTH_VER_1_1) 1868 is_fake = true; 1869 1870 else if (le16_to_cpu(rp->lmp_subver) <= 0x0529 && 1871 le16_to_cpu(rp->hci_ver) > BLUETOOTH_VER_1_2) 1872 is_fake = true; 1873 1874 else if (le16_to_cpu(rp->lmp_subver) <= 0x0c5c && 1875 le16_to_cpu(rp->hci_ver) > BLUETOOTH_VER_2_0) 1876 is_fake = true; 1877 1878 else if (le16_to_cpu(rp->lmp_subver) <= 0x1899 && 1879 le16_to_cpu(rp->hci_ver) > BLUETOOTH_VER_2_1) 1880 is_fake = true; 1881 1882 else if (le16_to_cpu(rp->lmp_subver) <= 0x22bb && 1883 le16_to_cpu(rp->hci_ver) > BLUETOOTH_VER_4_0) 1884 is_fake = true; 1885 1886 /* Other clones which beat all the above checks */ 1887 else if (bcdDevice == 0x0134 && 1888 le16_to_cpu(rp->lmp_subver) == 0x0c5c && 1889 le16_to_cpu(rp->hci_ver) == BLUETOOTH_VER_2_0) 1890 is_fake = true; 1891 1892 if (is_fake) { 1893 bt_dev_warn(hdev, "CSR: Unbranded CSR clone detected; adding workarounds..."); 1894 1895 /* Generally these clones have big discrepancies between 1896 * advertised features and what's actually supported. 1897 * Probably will need to be expanded in the future; 1898 * without these the controller will lock up. 1899 */ 1900 set_bit(HCI_QUIRK_BROKEN_STORED_LINK_KEY, &hdev->quirks); 1901 set_bit(HCI_QUIRK_BROKEN_ERR_DATA_REPORTING, &hdev->quirks); 1902 1903 /* Clear the reset quirk since this is not an actual 1904 * early Bluetooth 1.1 device from CSR. 1905 */ 1906 clear_bit(HCI_QUIRK_RESET_ON_CLOSE, &hdev->quirks); 1907 clear_bit(HCI_QUIRK_SIMULTANEOUS_DISCOVERY, &hdev->quirks); 1908 1909 /* 1910 * Special workaround for clones with a Barrot 8041a02 chip, 1911 * these clones are really messed-up: 1912 * 1. Their bulk rx endpoint will never report any data unless 1913 * the device was suspended at least once (yes really). 1914 * 2. They will not wakeup when autosuspended and receiving data 1915 * on their bulk rx endpoint from e.g. a keyboard or mouse 1916 * (IOW remote-wakeup support is broken for the bulk endpoint). 1917 * 1918 * To fix 1. enable runtime-suspend, force-suspend the 1919 * hci and then wake-it up by disabling runtime-suspend. 1920 * 1921 * To fix 2. clear the hci's can_wake flag, this way the hci 1922 * will still be autosuspended when it is not open. 1923 */ 1924 if (bcdDevice == 0x8891 && 1925 le16_to_cpu(rp->lmp_subver) == 0x1012 && 1926 le16_to_cpu(rp->hci_rev) == 0x0810 && 1927 le16_to_cpu(rp->hci_ver) == BLUETOOTH_VER_4_0) { 1928 bt_dev_warn(hdev, "CSR: detected a fake CSR dongle using a Barrot 8041a02 chip, this chip is very buggy and may have issues"); 1929 1930 pm_runtime_allow(&data->udev->dev); 1931 1932 ret = pm_runtime_suspend(&data->udev->dev); 1933 if (ret >= 0) 1934 msleep(200); 1935 else 1936 bt_dev_err(hdev, "Failed to suspend the device for Barrot 8041a02 receive-issue workaround"); 1937 1938 pm_runtime_forbid(&data->udev->dev); 1939 1940 device_set_wakeup_capable(&data->udev->dev, false); 1941 /* Re-enable autosuspend if this was requested */ 1942 if (enable_autosuspend) 1943 usb_enable_autosuspend(data->udev); 1944 } 1945 } 1946 1947 kfree_skb(skb); 1948 1949 return 0; 1950 } 1951 1952 static const struct firmware *btusb_setup_intel_get_fw(struct hci_dev *hdev, 1953 struct intel_version *ver) 1954 { 1955 const struct firmware *fw; 1956 char fwname[64]; 1957 int ret; 1958 1959 snprintf(fwname, sizeof(fwname), 1960 "intel/ibt-hw-%x.%x.%x-fw-%x.%x.%x.%x.%x.bseq", 1961 ver->hw_platform, ver->hw_variant, ver->hw_revision, 1962 ver->fw_variant, ver->fw_revision, ver->fw_build_num, 1963 ver->fw_build_ww, ver->fw_build_yy); 1964 1965 ret = request_firmware(&fw, fwname, &hdev->dev); 1966 if (ret < 0) { 1967 if (ret == -EINVAL) { 1968 bt_dev_err(hdev, "Intel firmware file request failed (%d)", 1969 ret); 1970 return NULL; 1971 } 1972 1973 bt_dev_err(hdev, "failed to open Intel firmware file: %s (%d)", 1974 fwname, ret); 1975 1976 /* If the correct firmware patch file is not found, use the 1977 * default firmware patch file instead 1978 */ 1979 snprintf(fwname, sizeof(fwname), "intel/ibt-hw-%x.%x.bseq", 1980 ver->hw_platform, ver->hw_variant); 1981 if (request_firmware(&fw, fwname, &hdev->dev) < 0) { 1982 bt_dev_err(hdev, "failed to open default fw file: %s", 1983 fwname); 1984 return NULL; 1985 } 1986 } 1987 1988 bt_dev_info(hdev, "Intel Bluetooth firmware file: %s", fwname); 1989 1990 return fw; 1991 } 1992 1993 static int btusb_setup_intel_patching(struct hci_dev *hdev, 1994 const struct firmware *fw, 1995 const u8 **fw_ptr, int *disable_patch) 1996 { 1997 struct sk_buff *skb; 1998 struct hci_command_hdr *cmd; 1999 const u8 *cmd_param; 2000 struct hci_event_hdr *evt = NULL; 2001 const u8 *evt_param = NULL; 2002 int remain = fw->size - (*fw_ptr - fw->data); 2003 2004 /* The first byte indicates the types of the patch command or event. 2005 * 0x01 means HCI command and 0x02 is HCI event. If the first bytes 2006 * in the current firmware buffer doesn't start with 0x01 or 2007 * the size of remain buffer is smaller than HCI command header, 2008 * the firmware file is corrupted and it should stop the patching 2009 * process. 2010 */ 2011 if (remain > HCI_COMMAND_HDR_SIZE && *fw_ptr[0] != 0x01) { 2012 bt_dev_err(hdev, "Intel fw corrupted: invalid cmd read"); 2013 return -EINVAL; 2014 } 2015 (*fw_ptr)++; 2016 remain--; 2017 2018 cmd = (struct hci_command_hdr *)(*fw_ptr); 2019 *fw_ptr += sizeof(*cmd); 2020 remain -= sizeof(*cmd); 2021 2022 /* Ensure that the remain firmware data is long enough than the length 2023 * of command parameter. If not, the firmware file is corrupted. 2024 */ 2025 if (remain < cmd->plen) { 2026 bt_dev_err(hdev, "Intel fw corrupted: invalid cmd len"); 2027 return -EFAULT; 2028 } 2029 2030 /* If there is a command that loads a patch in the firmware 2031 * file, then enable the patch upon success, otherwise just 2032 * disable the manufacturer mode, for example patch activation 2033 * is not required when the default firmware patch file is used 2034 * because there are no patch data to load. 2035 */ 2036 if (*disable_patch && le16_to_cpu(cmd->opcode) == 0xfc8e) 2037 *disable_patch = 0; 2038 2039 cmd_param = *fw_ptr; 2040 *fw_ptr += cmd->plen; 2041 remain -= cmd->plen; 2042 2043 /* This reads the expected events when the above command is sent to the 2044 * device. Some vendor commands expects more than one events, for 2045 * example command status event followed by vendor specific event. 2046 * For this case, it only keeps the last expected event. so the command 2047 * can be sent with __hci_cmd_sync_ev() which returns the sk_buff of 2048 * last expected event. 2049 */ 2050 while (remain > HCI_EVENT_HDR_SIZE && *fw_ptr[0] == 0x02) { 2051 (*fw_ptr)++; 2052 remain--; 2053 2054 evt = (struct hci_event_hdr *)(*fw_ptr); 2055 *fw_ptr += sizeof(*evt); 2056 remain -= sizeof(*evt); 2057 2058 if (remain < evt->plen) { 2059 bt_dev_err(hdev, "Intel fw corrupted: invalid evt len"); 2060 return -EFAULT; 2061 } 2062 2063 evt_param = *fw_ptr; 2064 *fw_ptr += evt->plen; 2065 remain -= evt->plen; 2066 } 2067 2068 /* Every HCI commands in the firmware file has its correspond event. 2069 * If event is not found or remain is smaller than zero, the firmware 2070 * file is corrupted. 2071 */ 2072 if (!evt || !evt_param || remain < 0) { 2073 bt_dev_err(hdev, "Intel fw corrupted: invalid evt read"); 2074 return -EFAULT; 2075 } 2076 2077 skb = __hci_cmd_sync_ev(hdev, le16_to_cpu(cmd->opcode), cmd->plen, 2078 cmd_param, evt->evt, HCI_INIT_TIMEOUT); 2079 if (IS_ERR(skb)) { 2080 bt_dev_err(hdev, "sending Intel patch command (0x%4.4x) failed (%ld)", 2081 cmd->opcode, PTR_ERR(skb)); 2082 return PTR_ERR(skb); 2083 } 2084 2085 /* It ensures that the returned event matches the event data read from 2086 * the firmware file. At fist, it checks the length and then 2087 * the contents of the event. 2088 */ 2089 if (skb->len != evt->plen) { 2090 bt_dev_err(hdev, "mismatch event length (opcode 0x%4.4x)", 2091 le16_to_cpu(cmd->opcode)); 2092 kfree_skb(skb); 2093 return -EFAULT; 2094 } 2095 2096 if (memcmp(skb->data, evt_param, evt->plen)) { 2097 bt_dev_err(hdev, "mismatch event parameter (opcode 0x%4.4x)", 2098 le16_to_cpu(cmd->opcode)); 2099 kfree_skb(skb); 2100 return -EFAULT; 2101 } 2102 kfree_skb(skb); 2103 2104 return 0; 2105 } 2106 2107 static int btusb_setup_intel(struct hci_dev *hdev) 2108 { 2109 struct sk_buff *skb; 2110 const struct firmware *fw; 2111 const u8 *fw_ptr; 2112 int disable_patch, err; 2113 struct intel_version ver; 2114 2115 BT_DBG("%s", hdev->name); 2116 2117 /* The controller has a bug with the first HCI command sent to it 2118 * returning number of completed commands as zero. This would stall the 2119 * command processing in the Bluetooth core. 2120 * 2121 * As a workaround, send HCI Reset command first which will reset the 2122 * number of completed commands and allow normal command processing 2123 * from now on. 2124 */ 2125 skb = __hci_cmd_sync(hdev, HCI_OP_RESET, 0, NULL, HCI_INIT_TIMEOUT); 2126 if (IS_ERR(skb)) { 2127 bt_dev_err(hdev, "sending initial HCI reset command failed (%ld)", 2128 PTR_ERR(skb)); 2129 return PTR_ERR(skb); 2130 } 2131 kfree_skb(skb); 2132 2133 /* Read Intel specific controller version first to allow selection of 2134 * which firmware file to load. 2135 * 2136 * The returned information are hardware variant and revision plus 2137 * firmware variant, revision and build number. 2138 */ 2139 err = btintel_read_version(hdev, &ver); 2140 if (err) 2141 return err; 2142 2143 bt_dev_info(hdev, "read Intel version: %02x%02x%02x%02x%02x%02x%02x%02x%02x", 2144 ver.hw_platform, ver.hw_variant, ver.hw_revision, 2145 ver.fw_variant, ver.fw_revision, ver.fw_build_num, 2146 ver.fw_build_ww, ver.fw_build_yy, ver.fw_patch_num); 2147 2148 /* fw_patch_num indicates the version of patch the device currently 2149 * have. If there is no patch data in the device, it is always 0x00. 2150 * So, if it is other than 0x00, no need to patch the device again. 2151 */ 2152 if (ver.fw_patch_num) { 2153 bt_dev_info(hdev, "Intel device is already patched. " 2154 "patch num: %02x", ver.fw_patch_num); 2155 goto complete; 2156 } 2157 2158 /* Opens the firmware patch file based on the firmware version read 2159 * from the controller. If it fails to open the matching firmware 2160 * patch file, it tries to open the default firmware patch file. 2161 * If no patch file is found, allow the device to operate without 2162 * a patch. 2163 */ 2164 fw = btusb_setup_intel_get_fw(hdev, &ver); 2165 if (!fw) 2166 goto complete; 2167 fw_ptr = fw->data; 2168 2169 /* Enable the manufacturer mode of the controller. 2170 * Only while this mode is enabled, the driver can download the 2171 * firmware patch data and configuration parameters. 2172 */ 2173 err = btintel_enter_mfg(hdev); 2174 if (err) { 2175 release_firmware(fw); 2176 return err; 2177 } 2178 2179 disable_patch = 1; 2180 2181 /* The firmware data file consists of list of Intel specific HCI 2182 * commands and its expected events. The first byte indicates the 2183 * type of the message, either HCI command or HCI event. 2184 * 2185 * It reads the command and its expected event from the firmware file, 2186 * and send to the controller. Once __hci_cmd_sync_ev() returns, 2187 * the returned event is compared with the event read from the firmware 2188 * file and it will continue until all the messages are downloaded to 2189 * the controller. 2190 * 2191 * Once the firmware patching is completed successfully, 2192 * the manufacturer mode is disabled with reset and activating the 2193 * downloaded patch. 2194 * 2195 * If the firmware patching fails, the manufacturer mode is 2196 * disabled with reset and deactivating the patch. 2197 * 2198 * If the default patch file is used, no reset is done when disabling 2199 * the manufacturer. 2200 */ 2201 while (fw->size > fw_ptr - fw->data) { 2202 int ret; 2203 2204 ret = btusb_setup_intel_patching(hdev, fw, &fw_ptr, 2205 &disable_patch); 2206 if (ret < 0) 2207 goto exit_mfg_deactivate; 2208 } 2209 2210 release_firmware(fw); 2211 2212 if (disable_patch) 2213 goto exit_mfg_disable; 2214 2215 /* Patching completed successfully and disable the manufacturer mode 2216 * with reset and activate the downloaded firmware patches. 2217 */ 2218 err = btintel_exit_mfg(hdev, true, true); 2219 if (err) 2220 return err; 2221 2222 /* Need build number for downloaded fw patches in 2223 * every power-on boot 2224 */ 2225 err = btintel_read_version(hdev, &ver); 2226 if (err) 2227 return err; 2228 bt_dev_info(hdev, "Intel BT fw patch 0x%02x completed & activated", 2229 ver.fw_patch_num); 2230 2231 goto complete; 2232 2233 exit_mfg_disable: 2234 /* Disable the manufacturer mode without reset */ 2235 err = btintel_exit_mfg(hdev, false, false); 2236 if (err) 2237 return err; 2238 2239 bt_dev_info(hdev, "Intel firmware patch completed"); 2240 2241 goto complete; 2242 2243 exit_mfg_deactivate: 2244 release_firmware(fw); 2245 2246 /* Patching failed. Disable the manufacturer mode with reset and 2247 * deactivate the downloaded firmware patches. 2248 */ 2249 err = btintel_exit_mfg(hdev, true, false); 2250 if (err) 2251 return err; 2252 2253 bt_dev_info(hdev, "Intel firmware patch completed and deactivated"); 2254 2255 complete: 2256 /* Set the event mask for Intel specific vendor events. This enables 2257 * a few extra events that are useful during general operation. 2258 */ 2259 btintel_set_event_mask_mfg(hdev, false); 2260 2261 btintel_check_bdaddr(hdev); 2262 return 0; 2263 } 2264 2265 static int inject_cmd_complete(struct hci_dev *hdev, __u16 opcode) 2266 { 2267 struct sk_buff *skb; 2268 struct hci_event_hdr *hdr; 2269 struct hci_ev_cmd_complete *evt; 2270 2271 skb = bt_skb_alloc(sizeof(*hdr) + sizeof(*evt) + 1, GFP_KERNEL); 2272 if (!skb) 2273 return -ENOMEM; 2274 2275 hdr = skb_put(skb, sizeof(*hdr)); 2276 hdr->evt = HCI_EV_CMD_COMPLETE; 2277 hdr->plen = sizeof(*evt) + 1; 2278 2279 evt = skb_put(skb, sizeof(*evt)); 2280 evt->ncmd = 0x01; 2281 evt->opcode = cpu_to_le16(opcode); 2282 2283 skb_put_u8(skb, 0x00); 2284 2285 hci_skb_pkt_type(skb) = HCI_EVENT_PKT; 2286 2287 return hci_recv_frame(hdev, skb); 2288 } 2289 2290 static int btusb_recv_bulk_intel(struct btusb_data *data, void *buffer, 2291 int count) 2292 { 2293 /* When the device is in bootloader mode, then it can send 2294 * events via the bulk endpoint. These events are treated the 2295 * same way as the ones received from the interrupt endpoint. 2296 */ 2297 if (test_bit(BTUSB_BOOTLOADER, &data->flags)) 2298 return btusb_recv_intr(data, buffer, count); 2299 2300 return btusb_recv_bulk(data, buffer, count); 2301 } 2302 2303 static void btusb_intel_bootup(struct btusb_data *data, const void *ptr, 2304 unsigned int len) 2305 { 2306 const struct intel_bootup *evt = ptr; 2307 2308 if (len != sizeof(*evt)) 2309 return; 2310 2311 if (test_and_clear_bit(BTUSB_BOOTING, &data->flags)) 2312 wake_up_bit(&data->flags, BTUSB_BOOTING); 2313 } 2314 2315 static void btusb_intel_secure_send_result(struct btusb_data *data, 2316 const void *ptr, unsigned int len) 2317 { 2318 const struct intel_secure_send_result *evt = ptr; 2319 2320 if (len != sizeof(*evt)) 2321 return; 2322 2323 if (evt->result) 2324 set_bit(BTUSB_FIRMWARE_FAILED, &data->flags); 2325 2326 if (test_and_clear_bit(BTUSB_DOWNLOADING, &data->flags) && 2327 test_bit(BTUSB_FIRMWARE_LOADED, &data->flags)) 2328 wake_up_bit(&data->flags, BTUSB_DOWNLOADING); 2329 } 2330 2331 static int btusb_recv_event_intel(struct hci_dev *hdev, struct sk_buff *skb) 2332 { 2333 struct btusb_data *data = hci_get_drvdata(hdev); 2334 2335 if (test_bit(BTUSB_BOOTLOADER, &data->flags)) { 2336 struct hci_event_hdr *hdr = (void *)skb->data; 2337 2338 if (skb->len > HCI_EVENT_HDR_SIZE && hdr->evt == 0xff && 2339 hdr->plen > 0) { 2340 const void *ptr = skb->data + HCI_EVENT_HDR_SIZE + 1; 2341 unsigned int len = skb->len - HCI_EVENT_HDR_SIZE - 1; 2342 2343 switch (skb->data[2]) { 2344 case 0x02: 2345 /* When switching to the operational firmware 2346 * the device sends a vendor specific event 2347 * indicating that the bootup completed. 2348 */ 2349 btusb_intel_bootup(data, ptr, len); 2350 break; 2351 case 0x06: 2352 /* When the firmware loading completes the 2353 * device sends out a vendor specific event 2354 * indicating the result of the firmware 2355 * loading. 2356 */ 2357 btusb_intel_secure_send_result(data, ptr, len); 2358 break; 2359 } 2360 } 2361 } 2362 2363 return hci_recv_frame(hdev, skb); 2364 } 2365 2366 static int btusb_send_frame_intel(struct hci_dev *hdev, struct sk_buff *skb) 2367 { 2368 struct btusb_data *data = hci_get_drvdata(hdev); 2369 struct urb *urb; 2370 2371 BT_DBG("%s", hdev->name); 2372 2373 switch (hci_skb_pkt_type(skb)) { 2374 case HCI_COMMAND_PKT: 2375 if (test_bit(BTUSB_BOOTLOADER, &data->flags)) { 2376 struct hci_command_hdr *cmd = (void *)skb->data; 2377 __u16 opcode = le16_to_cpu(cmd->opcode); 2378 2379 /* When in bootloader mode and the command 0xfc09 2380 * is received, it needs to be send down the 2381 * bulk endpoint. So allocate a bulk URB instead. 2382 */ 2383 if (opcode == 0xfc09) 2384 urb = alloc_bulk_urb(hdev, skb); 2385 else 2386 urb = alloc_ctrl_urb(hdev, skb); 2387 2388 /* When the 0xfc01 command is issued to boot into 2389 * the operational firmware, it will actually not 2390 * send a command complete event. To keep the flow 2391 * control working inject that event here. 2392 */ 2393 if (opcode == 0xfc01) 2394 inject_cmd_complete(hdev, opcode); 2395 } else { 2396 urb = alloc_ctrl_urb(hdev, skb); 2397 } 2398 if (IS_ERR(urb)) 2399 return PTR_ERR(urb); 2400 2401 hdev->stat.cmd_tx++; 2402 return submit_or_queue_tx_urb(hdev, urb); 2403 2404 case HCI_ACLDATA_PKT: 2405 urb = alloc_bulk_urb(hdev, skb); 2406 if (IS_ERR(urb)) 2407 return PTR_ERR(urb); 2408 2409 hdev->stat.acl_tx++; 2410 return submit_or_queue_tx_urb(hdev, urb); 2411 2412 case HCI_SCODATA_PKT: 2413 if (hci_conn_num(hdev, SCO_LINK) < 1) 2414 return -ENODEV; 2415 2416 urb = alloc_isoc_urb(hdev, skb); 2417 if (IS_ERR(urb)) 2418 return PTR_ERR(urb); 2419 2420 hdev->stat.sco_tx++; 2421 return submit_tx_urb(hdev, urb); 2422 } 2423 2424 return -EILSEQ; 2425 } 2426 2427 static int btusb_setup_intel_new_get_fw_name(struct intel_version *ver, 2428 struct intel_boot_params *params, 2429 char *fw_name, size_t len, 2430 const char *suffix) 2431 { 2432 switch (ver->hw_variant) { 2433 case 0x0b: /* SfP */ 2434 case 0x0c: /* WsP */ 2435 snprintf(fw_name, len, "intel/ibt-%u-%u.%s", 2436 le16_to_cpu(ver->hw_variant), 2437 le16_to_cpu(params->dev_revid), 2438 suffix); 2439 break; 2440 case 0x11: /* JfP */ 2441 case 0x12: /* ThP */ 2442 case 0x13: /* HrP */ 2443 case 0x14: /* CcP */ 2444 snprintf(fw_name, len, "intel/ibt-%u-%u-%u.%s", 2445 le16_to_cpu(ver->hw_variant), 2446 le16_to_cpu(ver->hw_revision), 2447 le16_to_cpu(ver->fw_revision), 2448 suffix); 2449 break; 2450 default: 2451 return -EINVAL; 2452 } 2453 2454 return 0; 2455 } 2456 2457 static void btusb_setup_intel_newgen_get_fw_name(const struct intel_version_tlv *ver_tlv, 2458 char *fw_name, size_t len, 2459 const char *suffix) 2460 { 2461 /* The firmware file name for new generation controllers will be 2462 * ibt-<cnvi_top type+cnvi_top step>-<cnvr_top type+cnvr_top step> 2463 */ 2464 snprintf(fw_name, len, "intel/ibt-%04x-%04x.%s", 2465 INTEL_CNVX_TOP_PACK_SWAB(INTEL_CNVX_TOP_TYPE(ver_tlv->cnvi_top), 2466 INTEL_CNVX_TOP_STEP(ver_tlv->cnvi_top)), 2467 INTEL_CNVX_TOP_PACK_SWAB(INTEL_CNVX_TOP_TYPE(ver_tlv->cnvr_top), 2468 INTEL_CNVX_TOP_STEP(ver_tlv->cnvr_top)), 2469 suffix); 2470 } 2471 2472 static int btusb_download_wait(struct hci_dev *hdev, ktime_t calltime, int msec) 2473 { 2474 struct btusb_data *data = hci_get_drvdata(hdev); 2475 ktime_t delta, rettime; 2476 unsigned long long duration; 2477 int err; 2478 2479 set_bit(BTUSB_FIRMWARE_LOADED, &data->flags); 2480 2481 bt_dev_info(hdev, "Waiting for firmware download to complete"); 2482 2483 err = wait_on_bit_timeout(&data->flags, BTUSB_DOWNLOADING, 2484 TASK_INTERRUPTIBLE, 2485 msecs_to_jiffies(msec)); 2486 if (err == -EINTR) { 2487 bt_dev_err(hdev, "Firmware loading interrupted"); 2488 return err; 2489 } 2490 2491 if (err) { 2492 bt_dev_err(hdev, "Firmware loading timeout"); 2493 return -ETIMEDOUT; 2494 } 2495 2496 if (test_bit(BTUSB_FIRMWARE_FAILED, &data->flags)) { 2497 bt_dev_err(hdev, "Firmware loading failed"); 2498 return -ENOEXEC; 2499 } 2500 2501 rettime = ktime_get(); 2502 delta = ktime_sub(rettime, calltime); 2503 duration = (unsigned long long)ktime_to_ns(delta) >> 10; 2504 2505 bt_dev_info(hdev, "Firmware loaded in %llu usecs", duration); 2506 2507 return 0; 2508 } 2509 2510 static int btusb_intel_download_firmware_newgen(struct hci_dev *hdev, 2511 struct intel_version_tlv *ver, 2512 u32 *boot_param) 2513 { 2514 const struct firmware *fw; 2515 char fwname[64]; 2516 int err; 2517 struct btusb_data *data = hci_get_drvdata(hdev); 2518 ktime_t calltime; 2519 2520 if (!ver || !boot_param) 2521 return -EINVAL; 2522 2523 /* The firmware variant determines if the device is in bootloader 2524 * mode or is running operational firmware. The value 0x03 identifies 2525 * the bootloader and the value 0x23 identifies the operational 2526 * firmware. 2527 * 2528 * When the operational firmware is already present, then only 2529 * the check for valid Bluetooth device address is needed. This 2530 * determines if the device will be added as configured or 2531 * unconfigured controller. 2532 * 2533 * It is not possible to use the Secure Boot Parameters in this 2534 * case since that command is only available in bootloader mode. 2535 */ 2536 if (ver->img_type == 0x03) { 2537 clear_bit(BTUSB_BOOTLOADER, &data->flags); 2538 btintel_check_bdaddr(hdev); 2539 } 2540 2541 /* If the OTP has no valid Bluetooth device address, then there will 2542 * also be no valid address for the operational firmware. 2543 */ 2544 if (!bacmp(&ver->otp_bd_addr, BDADDR_ANY)) { 2545 bt_dev_info(hdev, "No device address configured"); 2546 set_bit(HCI_QUIRK_INVALID_BDADDR, &hdev->quirks); 2547 } 2548 2549 btusb_setup_intel_newgen_get_fw_name(ver, fwname, sizeof(fwname), "sfi"); 2550 err = firmware_request_nowarn(&fw, fwname, &hdev->dev); 2551 if (err < 0) { 2552 if (!test_bit(BTUSB_BOOTLOADER, &data->flags)) { 2553 /* Firmware has already been loaded */ 2554 set_bit(BTUSB_FIRMWARE_LOADED, &data->flags); 2555 return 0; 2556 } 2557 2558 bt_dev_err(hdev, "Failed to load Intel firmware file %s (%d)", 2559 fwname, err); 2560 2561 return err; 2562 } 2563 2564 bt_dev_info(hdev, "Found device firmware: %s", fwname); 2565 2566 if (fw->size < 644) { 2567 bt_dev_err(hdev, "Invalid size of firmware file (%zu)", 2568 fw->size); 2569 err = -EBADF; 2570 goto done; 2571 } 2572 2573 calltime = ktime_get(); 2574 2575 set_bit(BTUSB_DOWNLOADING, &data->flags); 2576 2577 /* Start firmware downloading and get boot parameter */ 2578 err = btintel_download_firmware_newgen(hdev, ver, fw, boot_param, 2579 INTEL_HW_VARIANT(ver->cnvi_bt), 2580 ver->sbe_type); 2581 if (err < 0) { 2582 if (err == -EALREADY) { 2583 /* Firmware has already been loaded */ 2584 set_bit(BTUSB_FIRMWARE_LOADED, &data->flags); 2585 err = 0; 2586 goto done; 2587 } 2588 2589 /* When FW download fails, send Intel Reset to retry 2590 * FW download. 2591 */ 2592 btintel_reset_to_bootloader(hdev); 2593 goto done; 2594 } 2595 2596 /* Before switching the device into operational mode and with that 2597 * booting the loaded firmware, wait for the bootloader notification 2598 * that all fragments have been successfully received. 2599 * 2600 * When the event processing receives the notification, then the 2601 * BTUSB_DOWNLOADING flag will be cleared. 2602 * 2603 * The firmware loading should not take longer than 5 seconds 2604 * and thus just timeout if that happens and fail the setup 2605 * of this device. 2606 */ 2607 err = btusb_download_wait(hdev, calltime, 5000); 2608 if (err == -ETIMEDOUT) 2609 btintel_reset_to_bootloader(hdev); 2610 2611 done: 2612 release_firmware(fw); 2613 return err; 2614 } 2615 2616 static int btusb_intel_download_firmware(struct hci_dev *hdev, 2617 struct intel_version *ver, 2618 struct intel_boot_params *params, 2619 u32 *boot_param) 2620 { 2621 const struct firmware *fw; 2622 char fwname[64]; 2623 int err; 2624 struct btusb_data *data = hci_get_drvdata(hdev); 2625 ktime_t calltime; 2626 2627 if (!ver || !params) 2628 return -EINVAL; 2629 2630 /* The firmware variant determines if the device is in bootloader 2631 * mode or is running operational firmware. The value 0x06 identifies 2632 * the bootloader and the value 0x23 identifies the operational 2633 * firmware. 2634 * 2635 * When the operational firmware is already present, then only 2636 * the check for valid Bluetooth device address is needed. This 2637 * determines if the device will be added as configured or 2638 * unconfigured controller. 2639 * 2640 * It is not possible to use the Secure Boot Parameters in this 2641 * case since that command is only available in bootloader mode. 2642 */ 2643 if (ver->fw_variant == 0x23) { 2644 clear_bit(BTUSB_BOOTLOADER, &data->flags); 2645 btintel_check_bdaddr(hdev); 2646 2647 /* SfP and WsP don't seem to update the firmware version on file 2648 * so version checking is currently possible. 2649 */ 2650 switch (ver->hw_variant) { 2651 case 0x0b: /* SfP */ 2652 case 0x0c: /* WsP */ 2653 return 0; 2654 } 2655 2656 /* Proceed to download to check if the version matches */ 2657 goto download; 2658 } 2659 2660 /* Read the secure boot parameters to identify the operating 2661 * details of the bootloader. 2662 */ 2663 err = btintel_read_boot_params(hdev, params); 2664 if (err) 2665 return err; 2666 2667 /* It is required that every single firmware fragment is acknowledged 2668 * with a command complete event. If the boot parameters indicate 2669 * that this bootloader does not send them, then abort the setup. 2670 */ 2671 if (params->limited_cce != 0x00) { 2672 bt_dev_err(hdev, "Unsupported Intel firmware loading method (%u)", 2673 params->limited_cce); 2674 return -EINVAL; 2675 } 2676 2677 /* If the OTP has no valid Bluetooth device address, then there will 2678 * also be no valid address for the operational firmware. 2679 */ 2680 if (!bacmp(¶ms->otp_bdaddr, BDADDR_ANY)) { 2681 bt_dev_info(hdev, "No device address configured"); 2682 set_bit(HCI_QUIRK_INVALID_BDADDR, &hdev->quirks); 2683 } 2684 2685 download: 2686 /* With this Intel bootloader only the hardware variant and device 2687 * revision information are used to select the right firmware for SfP 2688 * and WsP. 2689 * 2690 * The firmware filename is ibt-<hw_variant>-<dev_revid>.sfi. 2691 * 2692 * Currently the supported hardware variants are: 2693 * 11 (0x0b) for iBT3.0 (LnP/SfP) 2694 * 12 (0x0c) for iBT3.5 (WsP) 2695 * 2696 * For ThP/JfP and for future SKU's, the FW name varies based on HW 2697 * variant, HW revision and FW revision, as these are dependent on CNVi 2698 * and RF Combination. 2699 * 2700 * 17 (0x11) for iBT3.5 (JfP) 2701 * 18 (0x12) for iBT3.5 (ThP) 2702 * 2703 * The firmware file name for these will be 2704 * ibt-<hw_variant>-<hw_revision>-<fw_revision>.sfi. 2705 * 2706 */ 2707 err = btusb_setup_intel_new_get_fw_name(ver, params, fwname, 2708 sizeof(fwname), "sfi"); 2709 if (err < 0) { 2710 if (!test_bit(BTUSB_BOOTLOADER, &data->flags)) { 2711 /* Firmware has already been loaded */ 2712 set_bit(BTUSB_FIRMWARE_LOADED, &data->flags); 2713 return 0; 2714 } 2715 2716 bt_dev_err(hdev, "Unsupported Intel firmware naming"); 2717 return -EINVAL; 2718 } 2719 2720 err = firmware_request_nowarn(&fw, fwname, &hdev->dev); 2721 if (err < 0) { 2722 if (!test_bit(BTUSB_BOOTLOADER, &data->flags)) { 2723 /* Firmware has already been loaded */ 2724 set_bit(BTUSB_FIRMWARE_LOADED, &data->flags); 2725 return 0; 2726 } 2727 2728 bt_dev_err(hdev, "Failed to load Intel firmware file %s (%d)", 2729 fwname, err); 2730 return err; 2731 } 2732 2733 bt_dev_info(hdev, "Found device firmware: %s", fwname); 2734 2735 if (fw->size < 644) { 2736 bt_dev_err(hdev, "Invalid size of firmware file (%zu)", 2737 fw->size); 2738 err = -EBADF; 2739 goto done; 2740 } 2741 2742 calltime = ktime_get(); 2743 2744 set_bit(BTUSB_DOWNLOADING, &data->flags); 2745 2746 /* Start firmware downloading and get boot parameter */ 2747 err = btintel_download_firmware(hdev, ver, fw, boot_param); 2748 if (err < 0) { 2749 if (err == -EALREADY) { 2750 /* Firmware has already been loaded */ 2751 set_bit(BTUSB_FIRMWARE_LOADED, &data->flags); 2752 err = 0; 2753 goto done; 2754 } 2755 2756 /* When FW download fails, send Intel Reset to retry 2757 * FW download. 2758 */ 2759 btintel_reset_to_bootloader(hdev); 2760 goto done; 2761 } 2762 2763 /* Before switching the device into operational mode and with that 2764 * booting the loaded firmware, wait for the bootloader notification 2765 * that all fragments have been successfully received. 2766 * 2767 * When the event processing receives the notification, then the 2768 * BTUSB_DOWNLOADING flag will be cleared. 2769 * 2770 * The firmware loading should not take longer than 5 seconds 2771 * and thus just timeout if that happens and fail the setup 2772 * of this device. 2773 */ 2774 err = btusb_download_wait(hdev, calltime, 5000); 2775 if (err == -ETIMEDOUT) 2776 btintel_reset_to_bootloader(hdev); 2777 2778 done: 2779 release_firmware(fw); 2780 return err; 2781 } 2782 2783 static int btusb_boot_wait(struct hci_dev *hdev, ktime_t calltime, int msec) 2784 { 2785 struct btusb_data *data = hci_get_drvdata(hdev); 2786 ktime_t delta, rettime; 2787 unsigned long long duration; 2788 int err; 2789 2790 bt_dev_info(hdev, "Waiting for device to boot"); 2791 2792 err = wait_on_bit_timeout(&data->flags, BTUSB_BOOTING, 2793 TASK_INTERRUPTIBLE, 2794 msecs_to_jiffies(msec)); 2795 if (err == -EINTR) { 2796 bt_dev_err(hdev, "Device boot interrupted"); 2797 return -EINTR; 2798 } 2799 2800 if (err) { 2801 bt_dev_err(hdev, "Device boot timeout"); 2802 return -ETIMEDOUT; 2803 } 2804 2805 rettime = ktime_get(); 2806 delta = ktime_sub(rettime, calltime); 2807 duration = (unsigned long long) ktime_to_ns(delta) >> 10; 2808 2809 bt_dev_info(hdev, "Device booted in %llu usecs", duration); 2810 2811 return 0; 2812 } 2813 2814 static int btusb_intel_boot(struct hci_dev *hdev, u32 boot_addr) 2815 { 2816 struct btusb_data *data = hci_get_drvdata(hdev); 2817 ktime_t calltime; 2818 int err; 2819 2820 calltime = ktime_get(); 2821 2822 set_bit(BTUSB_BOOTING, &data->flags); 2823 2824 err = btintel_send_intel_reset(hdev, boot_addr); 2825 if (err) { 2826 bt_dev_err(hdev, "Intel Soft Reset failed (%d)", err); 2827 btintel_reset_to_bootloader(hdev); 2828 return err; 2829 } 2830 2831 /* The bootloader will not indicate when the device is ready. This 2832 * is done by the operational firmware sending bootup notification. 2833 * 2834 * Booting into operational firmware should not take longer than 2835 * 1 second. However if that happens, then just fail the setup 2836 * since something went wrong. 2837 */ 2838 err = btusb_boot_wait(hdev, calltime, 1000); 2839 if (err == -ETIMEDOUT) 2840 btintel_reset_to_bootloader(hdev); 2841 2842 return err; 2843 } 2844 2845 static int btusb_setup_intel_new(struct hci_dev *hdev) 2846 { 2847 struct btusb_data *data = hci_get_drvdata(hdev); 2848 struct intel_version ver; 2849 struct intel_boot_params params; 2850 u32 boot_param; 2851 char ddcname[64]; 2852 int err; 2853 struct intel_debug_features features; 2854 2855 BT_DBG("%s", hdev->name); 2856 2857 /* Set the default boot parameter to 0x0 and it is updated to 2858 * SKU specific boot parameter after reading Intel_Write_Boot_Params 2859 * command while downloading the firmware. 2860 */ 2861 boot_param = 0x00000000; 2862 2863 /* Read the Intel version information to determine if the device 2864 * is in bootloader mode or if it already has operational firmware 2865 * loaded. 2866 */ 2867 err = btintel_read_version(hdev, &ver); 2868 if (err) { 2869 bt_dev_err(hdev, "Intel Read version failed (%d)", err); 2870 btintel_reset_to_bootloader(hdev); 2871 return err; 2872 } 2873 2874 err = btintel_version_info(hdev, &ver); 2875 if (err) 2876 return err; 2877 2878 err = btusb_intel_download_firmware(hdev, &ver, ¶ms, &boot_param); 2879 if (err) 2880 return err; 2881 2882 /* controller is already having an operational firmware */ 2883 if (ver.fw_variant == 0x23) 2884 goto finish; 2885 2886 err = btusb_intel_boot(hdev, boot_param); 2887 if (err) 2888 return err; 2889 2890 clear_bit(BTUSB_BOOTLOADER, &data->flags); 2891 2892 err = btusb_setup_intel_new_get_fw_name(&ver, ¶ms, ddcname, 2893 sizeof(ddcname), "ddc"); 2894 2895 if (err < 0) { 2896 bt_dev_err(hdev, "Unsupported Intel firmware naming"); 2897 } else { 2898 /* Once the device is running in operational mode, it needs to 2899 * apply the device configuration (DDC) parameters. 2900 * 2901 * The device can work without DDC parameters, so even if it 2902 * fails to load the file, no need to fail the setup. 2903 */ 2904 btintel_load_ddc_config(hdev, ddcname); 2905 } 2906 2907 /* Read the Intel supported features and if new exception formats 2908 * supported, need to load the additional DDC config to enable. 2909 */ 2910 btintel_read_debug_features(hdev, &features); 2911 2912 /* Set DDC mask for available debug features */ 2913 btintel_set_debug_features(hdev, &features); 2914 2915 /* Read the Intel version information after loading the FW */ 2916 err = btintel_read_version(hdev, &ver); 2917 if (err) 2918 return err; 2919 2920 btintel_version_info(hdev, &ver); 2921 2922 finish: 2923 /* All Intel controllers that support the Microsoft vendor 2924 * extension are using 0xFC1E for VsMsftOpCode. 2925 */ 2926 switch (ver.hw_variant) { 2927 case 0x11: /* JfP */ 2928 case 0x12: /* ThP */ 2929 case 0x13: /* HrP */ 2930 case 0x14: /* CcP */ 2931 hci_set_msft_opcode(hdev, 0xFC1E); 2932 break; 2933 } 2934 2935 /* Set the event mask for Intel specific vendor events. This enables 2936 * a few extra events that are useful during general operation. It 2937 * does not enable any debugging related events. 2938 * 2939 * The device will function correctly without these events enabled 2940 * and thus no need to fail the setup. 2941 */ 2942 btintel_set_event_mask(hdev, false); 2943 2944 return 0; 2945 } 2946 2947 static int btusb_setup_intel_newgen(struct hci_dev *hdev) 2948 { 2949 struct btusb_data *data = hci_get_drvdata(hdev); 2950 u32 boot_param; 2951 char ddcname[64]; 2952 int err; 2953 struct intel_debug_features features; 2954 struct intel_version_tlv version; 2955 2956 bt_dev_dbg(hdev, ""); 2957 2958 /* Set the default boot parameter to 0x0 and it is updated to 2959 * SKU specific boot parameter after reading Intel_Write_Boot_Params 2960 * command while downloading the firmware. 2961 */ 2962 boot_param = 0x00000000; 2963 2964 /* Read the Intel version information to determine if the device 2965 * is in bootloader mode or if it already has operational firmware 2966 * loaded. 2967 */ 2968 err = btintel_read_version_tlv(hdev, &version); 2969 if (err) { 2970 bt_dev_err(hdev, "Intel Read version failed (%d)", err); 2971 btintel_reset_to_bootloader(hdev); 2972 return err; 2973 } 2974 2975 err = btintel_version_info_tlv(hdev, &version); 2976 if (err) 2977 return err; 2978 2979 err = btusb_intel_download_firmware_newgen(hdev, &version, &boot_param); 2980 if (err) 2981 return err; 2982 2983 /* check if controller is already having an operational firmware */ 2984 if (version.img_type == 0x03) 2985 goto finish; 2986 2987 err = btusb_intel_boot(hdev, boot_param); 2988 if (err) 2989 return err; 2990 2991 clear_bit(BTUSB_BOOTLOADER, &data->flags); 2992 2993 btusb_setup_intel_newgen_get_fw_name(&version, ddcname, sizeof(ddcname), 2994 "ddc"); 2995 /* Once the device is running in operational mode, it needs to 2996 * apply the device configuration (DDC) parameters. 2997 * 2998 * The device can work without DDC parameters, so even if it 2999 * fails to load the file, no need to fail the setup. 3000 */ 3001 btintel_load_ddc_config(hdev, ddcname); 3002 3003 /* Read the Intel supported features and if new exception formats 3004 * supported, need to load the additional DDC config to enable. 3005 */ 3006 btintel_read_debug_features(hdev, &features); 3007 3008 /* Set DDC mask for available debug features */ 3009 btintel_set_debug_features(hdev, &features); 3010 3011 /* Read the Intel version information after loading the FW */ 3012 err = btintel_read_version_tlv(hdev, &version); 3013 if (err) 3014 return err; 3015 3016 btintel_version_info_tlv(hdev, &version); 3017 3018 finish: 3019 /* Set the event mask for Intel specific vendor events. This enables 3020 * a few extra events that are useful during general operation. It 3021 * does not enable any debugging related events. 3022 * 3023 * The device will function correctly without these events enabled 3024 * and thus no need to fail the setup. 3025 */ 3026 btintel_set_event_mask(hdev, false); 3027 3028 return 0; 3029 } 3030 static int btusb_shutdown_intel(struct hci_dev *hdev) 3031 { 3032 struct sk_buff *skb; 3033 long ret; 3034 3035 /* In the shutdown sequence where Bluetooth is turned off followed 3036 * by WiFi being turned off, turning WiFi back on causes issue with 3037 * the RF calibration. 3038 * 3039 * To ensure that any RF activity has been stopped, issue HCI Reset 3040 * command to clear all ongoing activity including advertising, 3041 * scanning etc. 3042 */ 3043 skb = __hci_cmd_sync(hdev, HCI_OP_RESET, 0, NULL, HCI_INIT_TIMEOUT); 3044 if (IS_ERR(skb)) { 3045 ret = PTR_ERR(skb); 3046 bt_dev_err(hdev, "HCI reset during shutdown failed"); 3047 return ret; 3048 } 3049 kfree_skb(skb); 3050 3051 /* Some platforms have an issue with BT LED when the interface is 3052 * down or BT radio is turned off, which takes 5 seconds to BT LED 3053 * goes off. This command turns off the BT LED immediately. 3054 */ 3055 skb = __hci_cmd_sync(hdev, 0xfc3f, 0, NULL, HCI_INIT_TIMEOUT); 3056 if (IS_ERR(skb)) { 3057 ret = PTR_ERR(skb); 3058 bt_dev_err(hdev, "turning off Intel device LED failed"); 3059 return ret; 3060 } 3061 kfree_skb(skb); 3062 3063 return 0; 3064 } 3065 3066 static int btusb_shutdown_intel_new(struct hci_dev *hdev) 3067 { 3068 struct sk_buff *skb; 3069 3070 /* Send HCI Reset to the controller to stop any BT activity which 3071 * were triggered. This will help to save power and maintain the 3072 * sync b/w Host and controller 3073 */ 3074 skb = __hci_cmd_sync(hdev, HCI_OP_RESET, 0, NULL, HCI_INIT_TIMEOUT); 3075 if (IS_ERR(skb)) { 3076 bt_dev_err(hdev, "HCI reset during shutdown failed"); 3077 return PTR_ERR(skb); 3078 } 3079 kfree_skb(skb); 3080 3081 return 0; 3082 } 3083 3084 #define FIRMWARE_MT7663 "mediatek/mt7663pr2h.bin" 3085 #define FIRMWARE_MT7668 "mediatek/mt7668pr2h.bin" 3086 3087 #define HCI_WMT_MAX_EVENT_SIZE 64 3088 /* It is for mt79xx download rom patch*/ 3089 #define MTK_FW_ROM_PATCH_HEADER_SIZE 32 3090 #define MTK_FW_ROM_PATCH_GD_SIZE 64 3091 #define MTK_FW_ROM_PATCH_SEC_MAP_SIZE 64 3092 #define MTK_SEC_MAP_COMMON_SIZE 12 3093 #define MTK_SEC_MAP_NEED_SEND_SIZE 52 3094 3095 enum { 3096 BTMTK_WMT_PATCH_DWNLD = 0x1, 3097 BTMTK_WMT_FUNC_CTRL = 0x6, 3098 BTMTK_WMT_RST = 0x7, 3099 BTMTK_WMT_SEMAPHORE = 0x17, 3100 }; 3101 3102 enum { 3103 BTMTK_WMT_INVALID, 3104 BTMTK_WMT_PATCH_UNDONE, 3105 BTMTK_WMT_PATCH_PROGRESS, 3106 BTMTK_WMT_PATCH_DONE, 3107 BTMTK_WMT_ON_UNDONE, 3108 BTMTK_WMT_ON_DONE, 3109 BTMTK_WMT_ON_PROGRESS, 3110 }; 3111 3112 struct btmtk_wmt_hdr { 3113 u8 dir; 3114 u8 op; 3115 __le16 dlen; 3116 u8 flag; 3117 } __packed; 3118 3119 struct btmtk_hci_wmt_cmd { 3120 struct btmtk_wmt_hdr hdr; 3121 u8 data[]; 3122 } __packed; 3123 3124 struct btmtk_hci_wmt_evt { 3125 struct hci_event_hdr hhdr; 3126 struct btmtk_wmt_hdr whdr; 3127 } __packed; 3128 3129 struct btmtk_hci_wmt_evt_funcc { 3130 struct btmtk_hci_wmt_evt hwhdr; 3131 __be16 status; 3132 } __packed; 3133 3134 struct btmtk_tci_sleep { 3135 u8 mode; 3136 __le16 duration; 3137 __le16 host_duration; 3138 u8 host_wakeup_pin; 3139 u8 time_compensation; 3140 } __packed; 3141 3142 struct btmtk_hci_wmt_params { 3143 u8 op; 3144 u8 flag; 3145 u16 dlen; 3146 const void *data; 3147 u32 *status; 3148 }; 3149 3150 struct btmtk_patch_header { 3151 u8 datetime[16]; 3152 u8 platform[4]; 3153 __le16 hwver; 3154 __le16 swver; 3155 __le32 magicnum; 3156 } __packed; 3157 3158 struct btmtk_global_desc { 3159 __le32 patch_ver; 3160 __le32 sub_sys; 3161 __le32 feature_opt; 3162 __le32 section_num; 3163 } __packed; 3164 3165 struct btmtk_section_map { 3166 __le32 sectype; 3167 __le32 secoffset; 3168 __le32 secsize; 3169 union { 3170 __le32 u4SecSpec[13]; 3171 struct { 3172 __le32 dlAddr; 3173 __le32 dlsize; 3174 __le32 seckeyidx; 3175 __le32 alignlen; 3176 __le32 sectype; 3177 __le32 dlmodecrctype; 3178 __le32 crc; 3179 __le32 reserved[6]; 3180 } bin_info_spec; 3181 }; 3182 } __packed; 3183 3184 static void btusb_mtk_wmt_recv(struct urb *urb) 3185 { 3186 struct hci_dev *hdev = urb->context; 3187 struct btusb_data *data = hci_get_drvdata(hdev); 3188 struct hci_event_hdr *hdr; 3189 struct sk_buff *skb; 3190 int err; 3191 3192 if (urb->status == 0 && urb->actual_length > 0) { 3193 hdev->stat.byte_rx += urb->actual_length; 3194 3195 /* WMT event shouldn't be fragmented and the size should be 3196 * less than HCI_WMT_MAX_EVENT_SIZE. 3197 */ 3198 skb = bt_skb_alloc(HCI_WMT_MAX_EVENT_SIZE, GFP_ATOMIC); 3199 if (!skb) { 3200 hdev->stat.err_rx++; 3201 return; 3202 } 3203 3204 hci_skb_pkt_type(skb) = HCI_EVENT_PKT; 3205 skb_put_data(skb, urb->transfer_buffer, urb->actual_length); 3206 3207 hdr = (void *)skb->data; 3208 /* Fix up the vendor event id with 0xff for vendor specific 3209 * instead of 0xe4 so that event send via monitoring socket can 3210 * be parsed properly. 3211 */ 3212 hdr->evt = 0xff; 3213 3214 /* When someone waits for the WMT event, the skb is being cloned 3215 * and being processed the events from there then. 3216 */ 3217 if (test_bit(BTUSB_TX_WAIT_VND_EVT, &data->flags)) { 3218 data->evt_skb = skb_clone(skb, GFP_ATOMIC); 3219 if (!data->evt_skb) { 3220 kfree_skb(skb); 3221 return; 3222 } 3223 } 3224 3225 err = hci_recv_frame(hdev, skb); 3226 if (err < 0) { 3227 kfree_skb(data->evt_skb); 3228 data->evt_skb = NULL; 3229 return; 3230 } 3231 3232 if (test_and_clear_bit(BTUSB_TX_WAIT_VND_EVT, 3233 &data->flags)) { 3234 /* Barrier to sync with other CPUs */ 3235 smp_mb__after_atomic(); 3236 wake_up_bit(&data->flags, 3237 BTUSB_TX_WAIT_VND_EVT); 3238 } 3239 return; 3240 } else if (urb->status == -ENOENT) { 3241 /* Avoid suspend failed when usb_kill_urb */ 3242 return; 3243 } 3244 3245 usb_mark_last_busy(data->udev); 3246 3247 /* The URB complete handler is still called with urb->actual_length = 0 3248 * when the event is not available, so we should keep re-submitting 3249 * URB until WMT event returns, Also, It's necessary to wait some time 3250 * between the two consecutive control URBs to relax the target device 3251 * to generate the event. Otherwise, the WMT event cannot return from 3252 * the device successfully. 3253 */ 3254 udelay(500); 3255 3256 usb_anchor_urb(urb, &data->ctrl_anchor); 3257 err = usb_submit_urb(urb, GFP_ATOMIC); 3258 if (err < 0) { 3259 /* -EPERM: urb is being killed; 3260 * -ENODEV: device got disconnected 3261 */ 3262 if (err != -EPERM && err != -ENODEV) 3263 bt_dev_err(hdev, "urb %p failed to resubmit (%d)", 3264 urb, -err); 3265 usb_unanchor_urb(urb); 3266 } 3267 } 3268 3269 static int btusb_mtk_submit_wmt_recv_urb(struct hci_dev *hdev) 3270 { 3271 struct btusb_data *data = hci_get_drvdata(hdev); 3272 struct usb_ctrlrequest *dr; 3273 unsigned char *buf; 3274 int err, size = 64; 3275 unsigned int pipe; 3276 struct urb *urb; 3277 3278 urb = usb_alloc_urb(0, GFP_KERNEL); 3279 if (!urb) 3280 return -ENOMEM; 3281 3282 dr = kmalloc(sizeof(*dr), GFP_KERNEL); 3283 if (!dr) { 3284 usb_free_urb(urb); 3285 return -ENOMEM; 3286 } 3287 3288 dr->bRequestType = USB_TYPE_VENDOR | USB_DIR_IN; 3289 dr->bRequest = 1; 3290 dr->wIndex = cpu_to_le16(0); 3291 dr->wValue = cpu_to_le16(48); 3292 dr->wLength = cpu_to_le16(size); 3293 3294 buf = kmalloc(size, GFP_KERNEL); 3295 if (!buf) { 3296 kfree(dr); 3297 usb_free_urb(urb); 3298 return -ENOMEM; 3299 } 3300 3301 pipe = usb_rcvctrlpipe(data->udev, 0); 3302 3303 usb_fill_control_urb(urb, data->udev, pipe, (void *)dr, 3304 buf, size, btusb_mtk_wmt_recv, hdev); 3305 3306 urb->transfer_flags |= URB_FREE_BUFFER; 3307 3308 usb_anchor_urb(urb, &data->ctrl_anchor); 3309 err = usb_submit_urb(urb, GFP_KERNEL); 3310 if (err < 0) { 3311 if (err != -EPERM && err != -ENODEV) 3312 bt_dev_err(hdev, "urb %p submission failed (%d)", 3313 urb, -err); 3314 usb_unanchor_urb(urb); 3315 } 3316 3317 usb_free_urb(urb); 3318 3319 return err; 3320 } 3321 3322 static int btusb_mtk_hci_wmt_sync(struct hci_dev *hdev, 3323 struct btmtk_hci_wmt_params *wmt_params) 3324 { 3325 struct btusb_data *data = hci_get_drvdata(hdev); 3326 struct btmtk_hci_wmt_evt_funcc *wmt_evt_funcc; 3327 u32 hlen, status = BTMTK_WMT_INVALID; 3328 struct btmtk_hci_wmt_evt *wmt_evt; 3329 struct btmtk_hci_wmt_cmd *wc; 3330 struct btmtk_wmt_hdr *hdr; 3331 int err; 3332 3333 /* Send the WMT command and wait until the WMT event returns */ 3334 hlen = sizeof(*hdr) + wmt_params->dlen; 3335 if (hlen > 255) 3336 return -EINVAL; 3337 3338 wc = kzalloc(hlen, GFP_KERNEL); 3339 if (!wc) 3340 return -ENOMEM; 3341 3342 hdr = &wc->hdr; 3343 hdr->dir = 1; 3344 hdr->op = wmt_params->op; 3345 hdr->dlen = cpu_to_le16(wmt_params->dlen + 1); 3346 hdr->flag = wmt_params->flag; 3347 memcpy(wc->data, wmt_params->data, wmt_params->dlen); 3348 3349 set_bit(BTUSB_TX_WAIT_VND_EVT, &data->flags); 3350 3351 err = __hci_cmd_send(hdev, 0xfc6f, hlen, wc); 3352 3353 if (err < 0) { 3354 clear_bit(BTUSB_TX_WAIT_VND_EVT, &data->flags); 3355 goto err_free_wc; 3356 } 3357 3358 /* Submit control IN URB on demand to process the WMT event */ 3359 err = btusb_mtk_submit_wmt_recv_urb(hdev); 3360 if (err < 0) 3361 goto err_free_wc; 3362 3363 /* The vendor specific WMT commands are all answered by a vendor 3364 * specific event and will have the Command Status or Command 3365 * Complete as with usual HCI command flow control. 3366 * 3367 * After sending the command, wait for BTUSB_TX_WAIT_VND_EVT 3368 * state to be cleared. The driver specific event receive routine 3369 * will clear that state and with that indicate completion of the 3370 * WMT command. 3371 */ 3372 err = wait_on_bit_timeout(&data->flags, BTUSB_TX_WAIT_VND_EVT, 3373 TASK_INTERRUPTIBLE, HCI_INIT_TIMEOUT); 3374 if (err == -EINTR) { 3375 bt_dev_err(hdev, "Execution of wmt command interrupted"); 3376 clear_bit(BTUSB_TX_WAIT_VND_EVT, &data->flags); 3377 goto err_free_wc; 3378 } 3379 3380 if (err) { 3381 bt_dev_err(hdev, "Execution of wmt command timed out"); 3382 clear_bit(BTUSB_TX_WAIT_VND_EVT, &data->flags); 3383 err = -ETIMEDOUT; 3384 goto err_free_wc; 3385 } 3386 3387 /* Parse and handle the return WMT event */ 3388 wmt_evt = (struct btmtk_hci_wmt_evt *)data->evt_skb->data; 3389 if (wmt_evt->whdr.op != hdr->op) { 3390 bt_dev_err(hdev, "Wrong op received %d expected %d", 3391 wmt_evt->whdr.op, hdr->op); 3392 err = -EIO; 3393 goto err_free_skb; 3394 } 3395 3396 switch (wmt_evt->whdr.op) { 3397 case BTMTK_WMT_SEMAPHORE: 3398 if (wmt_evt->whdr.flag == 2) 3399 status = BTMTK_WMT_PATCH_UNDONE; 3400 else 3401 status = BTMTK_WMT_PATCH_DONE; 3402 break; 3403 case BTMTK_WMT_FUNC_CTRL: 3404 wmt_evt_funcc = (struct btmtk_hci_wmt_evt_funcc *)wmt_evt; 3405 if (be16_to_cpu(wmt_evt_funcc->status) == 0x404) 3406 status = BTMTK_WMT_ON_DONE; 3407 else if (be16_to_cpu(wmt_evt_funcc->status) == 0x420) 3408 status = BTMTK_WMT_ON_PROGRESS; 3409 else 3410 status = BTMTK_WMT_ON_UNDONE; 3411 break; 3412 case BTMTK_WMT_PATCH_DWNLD: 3413 if (wmt_evt->whdr.flag == 2) 3414 status = BTMTK_WMT_PATCH_DONE; 3415 else if (wmt_evt->whdr.flag == 1) 3416 status = BTMTK_WMT_PATCH_PROGRESS; 3417 else 3418 status = BTMTK_WMT_PATCH_UNDONE; 3419 break; 3420 } 3421 3422 if (wmt_params->status) 3423 *wmt_params->status = status; 3424 3425 err_free_skb: 3426 kfree_skb(data->evt_skb); 3427 data->evt_skb = NULL; 3428 err_free_wc: 3429 kfree(wc); 3430 return err; 3431 } 3432 3433 static int btusb_mtk_setup_firmware_79xx(struct hci_dev *hdev, const char *fwname) 3434 { 3435 struct btmtk_hci_wmt_params wmt_params; 3436 struct btmtk_global_desc *globaldesc = NULL; 3437 struct btmtk_section_map *sectionmap; 3438 const struct firmware *fw; 3439 const u8 *fw_ptr; 3440 const u8 *fw_bin_ptr; 3441 int err, dlen, i, status; 3442 u8 flag, first_block, retry; 3443 u32 section_num, dl_size, section_offset; 3444 u8 cmd[64]; 3445 3446 err = request_firmware(&fw, fwname, &hdev->dev); 3447 if (err < 0) { 3448 bt_dev_err(hdev, "Failed to load firmware file (%d)", err); 3449 return err; 3450 } 3451 3452 fw_ptr = fw->data; 3453 fw_bin_ptr = fw_ptr; 3454 globaldesc = (struct btmtk_global_desc *)(fw_ptr + MTK_FW_ROM_PATCH_HEADER_SIZE); 3455 section_num = le32_to_cpu(globaldesc->section_num); 3456 3457 for (i = 0; i < section_num; i++) { 3458 first_block = 1; 3459 fw_ptr = fw_bin_ptr; 3460 sectionmap = (struct btmtk_section_map *)(fw_ptr + MTK_FW_ROM_PATCH_HEADER_SIZE + 3461 MTK_FW_ROM_PATCH_GD_SIZE + MTK_FW_ROM_PATCH_SEC_MAP_SIZE * i); 3462 3463 section_offset = le32_to_cpu(sectionmap->secoffset); 3464 dl_size = le32_to_cpu(sectionmap->bin_info_spec.dlsize); 3465 3466 if (dl_size > 0) { 3467 retry = 20; 3468 while (retry > 0) { 3469 cmd[0] = 0; /* 0 means legacy dl mode. */ 3470 memcpy(cmd + 1, 3471 fw_ptr + MTK_FW_ROM_PATCH_HEADER_SIZE + 3472 MTK_FW_ROM_PATCH_GD_SIZE + MTK_FW_ROM_PATCH_SEC_MAP_SIZE * i + 3473 MTK_SEC_MAP_COMMON_SIZE, 3474 MTK_SEC_MAP_NEED_SEND_SIZE + 1); 3475 3476 wmt_params.op = BTMTK_WMT_PATCH_DWNLD; 3477 wmt_params.status = &status; 3478 wmt_params.flag = 0; 3479 wmt_params.dlen = MTK_SEC_MAP_NEED_SEND_SIZE + 1; 3480 wmt_params.data = &cmd; 3481 3482 err = btusb_mtk_hci_wmt_sync(hdev, &wmt_params); 3483 if (err < 0) { 3484 bt_dev_err(hdev, "Failed to send wmt patch dwnld (%d)", 3485 err); 3486 goto err_release_fw; 3487 } 3488 3489 if (status == BTMTK_WMT_PATCH_UNDONE) { 3490 break; 3491 } else if (status == BTMTK_WMT_PATCH_PROGRESS) { 3492 msleep(100); 3493 retry--; 3494 } else if (status == BTMTK_WMT_PATCH_DONE) { 3495 goto next_section; 3496 } else { 3497 bt_dev_err(hdev, "Failed wmt patch dwnld status (%d)", 3498 status); 3499 goto err_release_fw; 3500 } 3501 } 3502 3503 fw_ptr += section_offset; 3504 wmt_params.op = BTMTK_WMT_PATCH_DWNLD; 3505 wmt_params.status = NULL; 3506 3507 while (dl_size > 0) { 3508 dlen = min_t(int, 250, dl_size); 3509 if (first_block == 1) { 3510 flag = 1; 3511 first_block = 0; 3512 } else if (dl_size - dlen <= 0) { 3513 flag = 3; 3514 } else { 3515 flag = 2; 3516 } 3517 3518 wmt_params.flag = flag; 3519 wmt_params.dlen = dlen; 3520 wmt_params.data = fw_ptr; 3521 3522 err = btusb_mtk_hci_wmt_sync(hdev, &wmt_params); 3523 if (err < 0) { 3524 bt_dev_err(hdev, "Failed to send wmt patch dwnld (%d)", 3525 err); 3526 goto err_release_fw; 3527 } 3528 3529 dl_size -= dlen; 3530 fw_ptr += dlen; 3531 } 3532 } 3533 next_section: 3534 continue; 3535 } 3536 /* Wait a few moments for firmware activation done */ 3537 usleep_range(100000, 120000); 3538 3539 err_release_fw: 3540 release_firmware(fw); 3541 3542 return err; 3543 } 3544 3545 static int btusb_mtk_setup_firmware(struct hci_dev *hdev, const char *fwname) 3546 { 3547 struct btmtk_hci_wmt_params wmt_params; 3548 const struct firmware *fw; 3549 const u8 *fw_ptr; 3550 size_t fw_size; 3551 int err, dlen; 3552 u8 flag, param; 3553 3554 err = request_firmware(&fw, fwname, &hdev->dev); 3555 if (err < 0) { 3556 bt_dev_err(hdev, "Failed to load firmware file (%d)", err); 3557 return err; 3558 } 3559 3560 /* Power on data RAM the firmware relies on. */ 3561 param = 1; 3562 wmt_params.op = BTMTK_WMT_FUNC_CTRL; 3563 wmt_params.flag = 3; 3564 wmt_params.dlen = sizeof(param); 3565 wmt_params.data = ¶m; 3566 wmt_params.status = NULL; 3567 3568 err = btusb_mtk_hci_wmt_sync(hdev, &wmt_params); 3569 if (err < 0) { 3570 bt_dev_err(hdev, "Failed to power on data RAM (%d)", err); 3571 goto err_release_fw; 3572 } 3573 3574 fw_ptr = fw->data; 3575 fw_size = fw->size; 3576 3577 /* The size of patch header is 30 bytes, should be skip */ 3578 if (fw_size < 30) { 3579 err = -EINVAL; 3580 goto err_release_fw; 3581 } 3582 3583 fw_size -= 30; 3584 fw_ptr += 30; 3585 flag = 1; 3586 3587 wmt_params.op = BTMTK_WMT_PATCH_DWNLD; 3588 wmt_params.status = NULL; 3589 3590 while (fw_size > 0) { 3591 dlen = min_t(int, 250, fw_size); 3592 3593 /* Tell device the position in sequence */ 3594 if (fw_size - dlen <= 0) 3595 flag = 3; 3596 else if (fw_size < fw->size - 30) 3597 flag = 2; 3598 3599 wmt_params.flag = flag; 3600 wmt_params.dlen = dlen; 3601 wmt_params.data = fw_ptr; 3602 3603 err = btusb_mtk_hci_wmt_sync(hdev, &wmt_params); 3604 if (err < 0) { 3605 bt_dev_err(hdev, "Failed to send wmt patch dwnld (%d)", 3606 err); 3607 goto err_release_fw; 3608 } 3609 3610 fw_size -= dlen; 3611 fw_ptr += dlen; 3612 } 3613 3614 wmt_params.op = BTMTK_WMT_RST; 3615 wmt_params.flag = 4; 3616 wmt_params.dlen = 0; 3617 wmt_params.data = NULL; 3618 wmt_params.status = NULL; 3619 3620 /* Activate funciton the firmware providing to */ 3621 err = btusb_mtk_hci_wmt_sync(hdev, &wmt_params); 3622 if (err < 0) { 3623 bt_dev_err(hdev, "Failed to send wmt rst (%d)", err); 3624 goto err_release_fw; 3625 } 3626 3627 /* Wait a few moments for firmware activation done */ 3628 usleep_range(10000, 12000); 3629 3630 err_release_fw: 3631 release_firmware(fw); 3632 3633 return err; 3634 } 3635 3636 static int btusb_mtk_func_query(struct hci_dev *hdev) 3637 { 3638 struct btmtk_hci_wmt_params wmt_params; 3639 int status, err; 3640 u8 param = 0; 3641 3642 /* Query whether the function is enabled */ 3643 wmt_params.op = BTMTK_WMT_FUNC_CTRL; 3644 wmt_params.flag = 4; 3645 wmt_params.dlen = sizeof(param); 3646 wmt_params.data = ¶m; 3647 wmt_params.status = &status; 3648 3649 err = btusb_mtk_hci_wmt_sync(hdev, &wmt_params); 3650 if (err < 0) { 3651 bt_dev_err(hdev, "Failed to query function status (%d)", err); 3652 return err; 3653 } 3654 3655 return status; 3656 } 3657 3658 static int btusb_mtk_reg_read(struct btusb_data *data, u32 reg, u32 *val) 3659 { 3660 int pipe, err, size = sizeof(u32); 3661 void *buf; 3662 3663 buf = kzalloc(size, GFP_KERNEL); 3664 if (!buf) 3665 return -ENOMEM; 3666 3667 pipe = usb_rcvctrlpipe(data->udev, 0); 3668 err = usb_control_msg(data->udev, pipe, 0x63, 3669 USB_TYPE_VENDOR | USB_DIR_IN, 3670 reg >> 16, reg & 0xffff, 3671 buf, size, USB_CTRL_SET_TIMEOUT); 3672 if (err < 0) 3673 goto err_free_buf; 3674 3675 *val = get_unaligned_le32(buf); 3676 3677 err_free_buf: 3678 kfree(buf); 3679 3680 return err; 3681 } 3682 3683 static int btusb_mtk_id_get(struct btusb_data *data, u32 reg, u32 *id) 3684 { 3685 return btusb_mtk_reg_read(data, reg, id); 3686 } 3687 3688 static int btusb_mtk_setup(struct hci_dev *hdev) 3689 { 3690 struct btusb_data *data = hci_get_drvdata(hdev); 3691 struct btmtk_hci_wmt_params wmt_params; 3692 ktime_t calltime, delta, rettime; 3693 struct btmtk_tci_sleep tci_sleep; 3694 unsigned long long duration; 3695 struct sk_buff *skb; 3696 const char *fwname; 3697 int err, status; 3698 u32 dev_id; 3699 char fw_bin_name[64]; 3700 u32 fw_version = 0; 3701 u8 param; 3702 3703 calltime = ktime_get(); 3704 3705 err = btusb_mtk_id_get(data, 0x80000008, &dev_id); 3706 if (err < 0) { 3707 bt_dev_err(hdev, "Failed to get device id (%d)", err); 3708 return err; 3709 } 3710 3711 if (!dev_id) { 3712 err = btusb_mtk_id_get(data, 0x70010200, &dev_id); 3713 if (err < 0) { 3714 bt_dev_err(hdev, "Failed to get device id (%d)", err); 3715 return err; 3716 } 3717 err = btusb_mtk_id_get(data, 0x80021004, &fw_version); 3718 if (err < 0) { 3719 bt_dev_err(hdev, "Failed to get fw version (%d)", err); 3720 return err; 3721 } 3722 } 3723 3724 switch (dev_id) { 3725 case 0x7663: 3726 fwname = FIRMWARE_MT7663; 3727 break; 3728 case 0x7668: 3729 fwname = FIRMWARE_MT7668; 3730 break; 3731 case 0x7961: 3732 snprintf(fw_bin_name, sizeof(fw_bin_name), 3733 "mediatek/BT_RAM_CODE_MT%04x_1_%x_hdr.bin", 3734 dev_id & 0xffff, (fw_version & 0xff) + 1); 3735 err = btusb_mtk_setup_firmware_79xx(hdev, fw_bin_name); 3736 3737 /* Enable Bluetooth protocol */ 3738 param = 1; 3739 wmt_params.op = BTMTK_WMT_FUNC_CTRL; 3740 wmt_params.flag = 0; 3741 wmt_params.dlen = sizeof(param); 3742 wmt_params.data = ¶m; 3743 wmt_params.status = NULL; 3744 3745 err = btusb_mtk_hci_wmt_sync(hdev, &wmt_params); 3746 if (err < 0) { 3747 bt_dev_err(hdev, "Failed to send wmt func ctrl (%d)", err); 3748 return err; 3749 } 3750 goto done; 3751 default: 3752 bt_dev_err(hdev, "Unsupported hardware variant (%08x)", 3753 dev_id); 3754 return -ENODEV; 3755 } 3756 3757 /* Query whether the firmware is already download */ 3758 wmt_params.op = BTMTK_WMT_SEMAPHORE; 3759 wmt_params.flag = 1; 3760 wmt_params.dlen = 0; 3761 wmt_params.data = NULL; 3762 wmt_params.status = &status; 3763 3764 err = btusb_mtk_hci_wmt_sync(hdev, &wmt_params); 3765 if (err < 0) { 3766 bt_dev_err(hdev, "Failed to query firmware status (%d)", err); 3767 return err; 3768 } 3769 3770 if (status == BTMTK_WMT_PATCH_DONE) { 3771 bt_dev_info(hdev, "firmware already downloaded"); 3772 goto ignore_setup_fw; 3773 } 3774 3775 /* Setup a firmware which the device definitely requires */ 3776 err = btusb_mtk_setup_firmware(hdev, fwname); 3777 if (err < 0) 3778 return err; 3779 3780 ignore_setup_fw: 3781 err = readx_poll_timeout(btusb_mtk_func_query, hdev, status, 3782 status < 0 || status != BTMTK_WMT_ON_PROGRESS, 3783 2000, 5000000); 3784 /* -ETIMEDOUT happens */ 3785 if (err < 0) 3786 return err; 3787 3788 /* The other errors happen in btusb_mtk_func_query */ 3789 if (status < 0) 3790 return status; 3791 3792 if (status == BTMTK_WMT_ON_DONE) { 3793 bt_dev_info(hdev, "function already on"); 3794 goto ignore_func_on; 3795 } 3796 3797 /* Enable Bluetooth protocol */ 3798 param = 1; 3799 wmt_params.op = BTMTK_WMT_FUNC_CTRL; 3800 wmt_params.flag = 0; 3801 wmt_params.dlen = sizeof(param); 3802 wmt_params.data = ¶m; 3803 wmt_params.status = NULL; 3804 3805 err = btusb_mtk_hci_wmt_sync(hdev, &wmt_params); 3806 if (err < 0) { 3807 bt_dev_err(hdev, "Failed to send wmt func ctrl (%d)", err); 3808 return err; 3809 } 3810 3811 ignore_func_on: 3812 /* Apply the low power environment setup */ 3813 tci_sleep.mode = 0x5; 3814 tci_sleep.duration = cpu_to_le16(0x640); 3815 tci_sleep.host_duration = cpu_to_le16(0x640); 3816 tci_sleep.host_wakeup_pin = 0; 3817 tci_sleep.time_compensation = 0; 3818 3819 skb = __hci_cmd_sync(hdev, 0xfc7a, sizeof(tci_sleep), &tci_sleep, 3820 HCI_INIT_TIMEOUT); 3821 if (IS_ERR(skb)) { 3822 err = PTR_ERR(skb); 3823 bt_dev_err(hdev, "Failed to apply low power setting (%d)", err); 3824 return err; 3825 } 3826 kfree_skb(skb); 3827 3828 done: 3829 rettime = ktime_get(); 3830 delta = ktime_sub(rettime, calltime); 3831 duration = (unsigned long long)ktime_to_ns(delta) >> 10; 3832 3833 bt_dev_info(hdev, "Device setup in %llu usecs", duration); 3834 3835 return 0; 3836 } 3837 3838 static int btusb_mtk_shutdown(struct hci_dev *hdev) 3839 { 3840 struct btmtk_hci_wmt_params wmt_params; 3841 u8 param = 0; 3842 int err; 3843 3844 /* Disable the device */ 3845 wmt_params.op = BTMTK_WMT_FUNC_CTRL; 3846 wmt_params.flag = 0; 3847 wmt_params.dlen = sizeof(param); 3848 wmt_params.data = ¶m; 3849 wmt_params.status = NULL; 3850 3851 err = btusb_mtk_hci_wmt_sync(hdev, &wmt_params); 3852 if (err < 0) { 3853 bt_dev_err(hdev, "Failed to send wmt func ctrl (%d)", err); 3854 return err; 3855 } 3856 3857 return 0; 3858 } 3859 3860 MODULE_FIRMWARE(FIRMWARE_MT7663); 3861 MODULE_FIRMWARE(FIRMWARE_MT7668); 3862 3863 #ifdef CONFIG_PM 3864 /* Configure an out-of-band gpio as wake-up pin, if specified in device tree */ 3865 static int marvell_config_oob_wake(struct hci_dev *hdev) 3866 { 3867 struct sk_buff *skb; 3868 struct btusb_data *data = hci_get_drvdata(hdev); 3869 struct device *dev = &data->udev->dev; 3870 u16 pin, gap, opcode; 3871 int ret; 3872 u8 cmd[5]; 3873 3874 /* Move on if no wakeup pin specified */ 3875 if (of_property_read_u16(dev->of_node, "marvell,wakeup-pin", &pin) || 3876 of_property_read_u16(dev->of_node, "marvell,wakeup-gap-ms", &gap)) 3877 return 0; 3878 3879 /* Vendor specific command to configure a GPIO as wake-up pin */ 3880 opcode = hci_opcode_pack(0x3F, 0x59); 3881 cmd[0] = opcode & 0xFF; 3882 cmd[1] = opcode >> 8; 3883 cmd[2] = 2; /* length of parameters that follow */ 3884 cmd[3] = pin; 3885 cmd[4] = gap; /* time in ms, for which wakeup pin should be asserted */ 3886 3887 skb = bt_skb_alloc(sizeof(cmd), GFP_KERNEL); 3888 if (!skb) { 3889 bt_dev_err(hdev, "%s: No memory", __func__); 3890 return -ENOMEM; 3891 } 3892 3893 skb_put_data(skb, cmd, sizeof(cmd)); 3894 hci_skb_pkt_type(skb) = HCI_COMMAND_PKT; 3895 3896 ret = btusb_send_frame(hdev, skb); 3897 if (ret) { 3898 bt_dev_err(hdev, "%s: configuration failed", __func__); 3899 kfree_skb(skb); 3900 return ret; 3901 } 3902 3903 return 0; 3904 } 3905 #endif 3906 3907 static int btusb_set_bdaddr_marvell(struct hci_dev *hdev, 3908 const bdaddr_t *bdaddr) 3909 { 3910 struct sk_buff *skb; 3911 u8 buf[8]; 3912 long ret; 3913 3914 buf[0] = 0xfe; 3915 buf[1] = sizeof(bdaddr_t); 3916 memcpy(buf + 2, bdaddr, sizeof(bdaddr_t)); 3917 3918 skb = __hci_cmd_sync(hdev, 0xfc22, sizeof(buf), buf, HCI_INIT_TIMEOUT); 3919 if (IS_ERR(skb)) { 3920 ret = PTR_ERR(skb); 3921 bt_dev_err(hdev, "changing Marvell device address failed (%ld)", 3922 ret); 3923 return ret; 3924 } 3925 kfree_skb(skb); 3926 3927 return 0; 3928 } 3929 3930 static int btusb_set_bdaddr_ath3012(struct hci_dev *hdev, 3931 const bdaddr_t *bdaddr) 3932 { 3933 struct sk_buff *skb; 3934 u8 buf[10]; 3935 long ret; 3936 3937 buf[0] = 0x01; 3938 buf[1] = 0x01; 3939 buf[2] = 0x00; 3940 buf[3] = sizeof(bdaddr_t); 3941 memcpy(buf + 4, bdaddr, sizeof(bdaddr_t)); 3942 3943 skb = __hci_cmd_sync(hdev, 0xfc0b, sizeof(buf), buf, HCI_INIT_TIMEOUT); 3944 if (IS_ERR(skb)) { 3945 ret = PTR_ERR(skb); 3946 bt_dev_err(hdev, "Change address command failed (%ld)", ret); 3947 return ret; 3948 } 3949 kfree_skb(skb); 3950 3951 return 0; 3952 } 3953 3954 static int btusb_set_bdaddr_wcn6855(struct hci_dev *hdev, 3955 const bdaddr_t *bdaddr) 3956 { 3957 struct sk_buff *skb; 3958 u8 buf[6]; 3959 long ret; 3960 3961 memcpy(buf, bdaddr, sizeof(bdaddr_t)); 3962 3963 skb = __hci_cmd_sync_ev(hdev, 0xfc14, sizeof(buf), buf, 3964 HCI_EV_CMD_COMPLETE, HCI_INIT_TIMEOUT); 3965 if (IS_ERR(skb)) { 3966 ret = PTR_ERR(skb); 3967 bt_dev_err(hdev, "Change address command failed (%ld)", ret); 3968 return ret; 3969 } 3970 kfree_skb(skb); 3971 3972 return 0; 3973 } 3974 3975 #define QCA_DFU_PACKET_LEN 4096 3976 3977 #define QCA_GET_TARGET_VERSION 0x09 3978 #define QCA_CHECK_STATUS 0x05 3979 #define QCA_DFU_DOWNLOAD 0x01 3980 3981 #define QCA_SYSCFG_UPDATED 0x40 3982 #define QCA_PATCH_UPDATED 0x80 3983 #define QCA_DFU_TIMEOUT 3000 3984 #define QCA_FLAG_MULTI_NVM 0x80 3985 3986 struct qca_version { 3987 __le32 rom_version; 3988 __le32 patch_version; 3989 __le32 ram_version; 3990 __le16 board_id; 3991 __le16 flag; 3992 __u8 reserved[4]; 3993 } __packed; 3994 3995 struct qca_rampatch_version { 3996 __le16 rom_version_high; 3997 __le16 rom_version_low; 3998 __le16 patch_version; 3999 } __packed; 4000 4001 struct qca_device_info { 4002 u32 rom_version; 4003 u8 rampatch_hdr; /* length of header in rampatch */ 4004 u8 nvm_hdr; /* length of header in NVM */ 4005 u8 ver_offset; /* offset of version structure in rampatch */ 4006 }; 4007 4008 static const struct qca_device_info qca_devices_table[] = { 4009 { 0x00000100, 20, 4, 8 }, /* Rome 1.0 */ 4010 { 0x00000101, 20, 4, 8 }, /* Rome 1.1 */ 4011 { 0x00000200, 28, 4, 16 }, /* Rome 2.0 */ 4012 { 0x00000201, 28, 4, 16 }, /* Rome 2.1 */ 4013 { 0x00000300, 28, 4, 16 }, /* Rome 3.0 */ 4014 { 0x00000302, 28, 4, 16 }, /* Rome 3.2 */ 4015 { 0x00130100, 40, 4, 16 }, /* WCN6855 1.0 */ 4016 { 0x00130200, 40, 4, 16 }, /* WCN6855 2.0 */ 4017 }; 4018 4019 static int btusb_qca_send_vendor_req(struct usb_device *udev, u8 request, 4020 void *data, u16 size) 4021 { 4022 int pipe, err; 4023 u8 *buf; 4024 4025 buf = kmalloc(size, GFP_KERNEL); 4026 if (!buf) 4027 return -ENOMEM; 4028 4029 /* Found some of USB hosts have IOT issues with ours so that we should 4030 * not wait until HCI layer is ready. 4031 */ 4032 pipe = usb_rcvctrlpipe(udev, 0); 4033 err = usb_control_msg(udev, pipe, request, USB_TYPE_VENDOR | USB_DIR_IN, 4034 0, 0, buf, size, USB_CTRL_SET_TIMEOUT); 4035 if (err < 0) { 4036 dev_err(&udev->dev, "Failed to access otp area (%d)", err); 4037 goto done; 4038 } 4039 4040 memcpy(data, buf, size); 4041 4042 done: 4043 kfree(buf); 4044 4045 return err; 4046 } 4047 4048 static int btusb_setup_qca_download_fw(struct hci_dev *hdev, 4049 const struct firmware *firmware, 4050 size_t hdr_size) 4051 { 4052 struct btusb_data *btdata = hci_get_drvdata(hdev); 4053 struct usb_device *udev = btdata->udev; 4054 size_t count, size, sent = 0; 4055 int pipe, len, err; 4056 u8 *buf; 4057 4058 buf = kmalloc(QCA_DFU_PACKET_LEN, GFP_KERNEL); 4059 if (!buf) 4060 return -ENOMEM; 4061 4062 count = firmware->size; 4063 4064 size = min_t(size_t, count, hdr_size); 4065 memcpy(buf, firmware->data, size); 4066 4067 /* USB patches should go down to controller through USB path 4068 * because binary format fits to go down through USB channel. 4069 * USB control path is for patching headers and USB bulk is for 4070 * patch body. 4071 */ 4072 pipe = usb_sndctrlpipe(udev, 0); 4073 err = usb_control_msg(udev, pipe, QCA_DFU_DOWNLOAD, USB_TYPE_VENDOR, 4074 0, 0, buf, size, USB_CTRL_SET_TIMEOUT); 4075 if (err < 0) { 4076 bt_dev_err(hdev, "Failed to send headers (%d)", err); 4077 goto done; 4078 } 4079 4080 sent += size; 4081 count -= size; 4082 4083 /* ep2 need time to switch from function acl to function dfu, 4084 * so we add 20ms delay here. 4085 */ 4086 msleep(20); 4087 4088 while (count) { 4089 size = min_t(size_t, count, QCA_DFU_PACKET_LEN); 4090 4091 memcpy(buf, firmware->data + sent, size); 4092 4093 pipe = usb_sndbulkpipe(udev, 0x02); 4094 err = usb_bulk_msg(udev, pipe, buf, size, &len, 4095 QCA_DFU_TIMEOUT); 4096 if (err < 0) { 4097 bt_dev_err(hdev, "Failed to send body at %zd of %zd (%d)", 4098 sent, firmware->size, err); 4099 break; 4100 } 4101 4102 if (size != len) { 4103 bt_dev_err(hdev, "Failed to get bulk buffer"); 4104 err = -EILSEQ; 4105 break; 4106 } 4107 4108 sent += size; 4109 count -= size; 4110 } 4111 4112 done: 4113 kfree(buf); 4114 return err; 4115 } 4116 4117 static int btusb_setup_qca_load_rampatch(struct hci_dev *hdev, 4118 struct qca_version *ver, 4119 const struct qca_device_info *info) 4120 { 4121 struct qca_rampatch_version *rver; 4122 const struct firmware *fw; 4123 u32 ver_rom, ver_patch, rver_rom; 4124 u16 rver_rom_low, rver_rom_high, rver_patch; 4125 char fwname[64]; 4126 int err; 4127 4128 ver_rom = le32_to_cpu(ver->rom_version); 4129 ver_patch = le32_to_cpu(ver->patch_version); 4130 4131 snprintf(fwname, sizeof(fwname), "qca/rampatch_usb_%08x.bin", ver_rom); 4132 4133 err = request_firmware(&fw, fwname, &hdev->dev); 4134 if (err) { 4135 bt_dev_err(hdev, "failed to request rampatch file: %s (%d)", 4136 fwname, err); 4137 return err; 4138 } 4139 4140 bt_dev_info(hdev, "using rampatch file: %s", fwname); 4141 4142 rver = (struct qca_rampatch_version *)(fw->data + info->ver_offset); 4143 rver_rom_low = le16_to_cpu(rver->rom_version_low); 4144 rver_patch = le16_to_cpu(rver->patch_version); 4145 4146 if (ver_rom & ~0xffffU) { 4147 rver_rom_high = le16_to_cpu(rver->rom_version_high); 4148 rver_rom = le32_to_cpu(rver_rom_high << 16 | rver_rom_low); 4149 } else { 4150 rver_rom = rver_rom_low; 4151 } 4152 4153 bt_dev_info(hdev, "QCA: patch rome 0x%x build 0x%x, " 4154 "firmware rome 0x%x build 0x%x", 4155 rver_rom, rver_patch, ver_rom, ver_patch); 4156 4157 if (rver_rom != ver_rom || rver_patch <= ver_patch) { 4158 bt_dev_err(hdev, "rampatch file version did not match with firmware"); 4159 err = -EINVAL; 4160 goto done; 4161 } 4162 4163 err = btusb_setup_qca_download_fw(hdev, fw, info->rampatch_hdr); 4164 4165 done: 4166 release_firmware(fw); 4167 4168 return err; 4169 } 4170 4171 static int btusb_setup_qca_load_nvm(struct hci_dev *hdev, 4172 struct qca_version *ver, 4173 const struct qca_device_info *info) 4174 { 4175 const struct firmware *fw; 4176 char fwname[64]; 4177 int err; 4178 4179 if (((ver->flag >> 8) & 0xff) == QCA_FLAG_MULTI_NVM) { 4180 /* if boardid equal 0, use default nvm without surfix */ 4181 if (le16_to_cpu(ver->board_id) == 0x0) { 4182 snprintf(fwname, sizeof(fwname), "qca/nvm_usb_%08x.bin", 4183 le32_to_cpu(ver->rom_version)); 4184 } else { 4185 snprintf(fwname, sizeof(fwname), "qca/nvm_usb_%08x_%04x.bin", 4186 le32_to_cpu(ver->rom_version), 4187 le16_to_cpu(ver->board_id)); 4188 } 4189 } else { 4190 snprintf(fwname, sizeof(fwname), "qca/nvm_usb_%08x.bin", 4191 le32_to_cpu(ver->rom_version)); 4192 } 4193 4194 err = request_firmware(&fw, fwname, &hdev->dev); 4195 if (err) { 4196 bt_dev_err(hdev, "failed to request NVM file: %s (%d)", 4197 fwname, err); 4198 return err; 4199 } 4200 4201 bt_dev_info(hdev, "using NVM file: %s", fwname); 4202 4203 err = btusb_setup_qca_download_fw(hdev, fw, info->nvm_hdr); 4204 4205 release_firmware(fw); 4206 4207 return err; 4208 } 4209 4210 /* identify the ROM version and check whether patches are needed */ 4211 static bool btusb_qca_need_patch(struct usb_device *udev) 4212 { 4213 struct qca_version ver; 4214 4215 if (btusb_qca_send_vendor_req(udev, QCA_GET_TARGET_VERSION, &ver, 4216 sizeof(ver)) < 0) 4217 return false; 4218 /* only low ROM versions need patches */ 4219 return !(le32_to_cpu(ver.rom_version) & ~0xffffU); 4220 } 4221 4222 static int btusb_setup_qca(struct hci_dev *hdev) 4223 { 4224 struct btusb_data *btdata = hci_get_drvdata(hdev); 4225 struct usb_device *udev = btdata->udev; 4226 const struct qca_device_info *info = NULL; 4227 struct qca_version ver; 4228 u32 ver_rom; 4229 u8 status; 4230 int i, err; 4231 4232 err = btusb_qca_send_vendor_req(udev, QCA_GET_TARGET_VERSION, &ver, 4233 sizeof(ver)); 4234 if (err < 0) 4235 return err; 4236 4237 ver_rom = le32_to_cpu(ver.rom_version); 4238 4239 for (i = 0; i < ARRAY_SIZE(qca_devices_table); i++) { 4240 if (ver_rom == qca_devices_table[i].rom_version) 4241 info = &qca_devices_table[i]; 4242 } 4243 if (!info) { 4244 /* If the rom_version is not matched in the qca_devices_table 4245 * and the high ROM version is not zero, we assume this chip no 4246 * need to load the rampatch and nvm. 4247 */ 4248 if (ver_rom & ~0xffffU) 4249 return 0; 4250 4251 bt_dev_err(hdev, "don't support firmware rome 0x%x", ver_rom); 4252 return -ENODEV; 4253 } 4254 4255 err = btusb_qca_send_vendor_req(udev, QCA_CHECK_STATUS, &status, 4256 sizeof(status)); 4257 if (err < 0) 4258 return err; 4259 4260 if (!(status & QCA_PATCH_UPDATED)) { 4261 err = btusb_setup_qca_load_rampatch(hdev, &ver, info); 4262 if (err < 0) 4263 return err; 4264 } 4265 4266 err = btusb_qca_send_vendor_req(udev, QCA_GET_TARGET_VERSION, &ver, 4267 sizeof(ver)); 4268 if (err < 0) 4269 return err; 4270 4271 if (!(status & QCA_SYSCFG_UPDATED)) { 4272 err = btusb_setup_qca_load_nvm(hdev, &ver, info); 4273 if (err < 0) 4274 return err; 4275 } 4276 4277 return 0; 4278 } 4279 4280 static inline int __set_diag_interface(struct hci_dev *hdev) 4281 { 4282 struct btusb_data *data = hci_get_drvdata(hdev); 4283 struct usb_interface *intf = data->diag; 4284 int i; 4285 4286 if (!data->diag) 4287 return -ENODEV; 4288 4289 data->diag_tx_ep = NULL; 4290 data->diag_rx_ep = NULL; 4291 4292 for (i = 0; i < intf->cur_altsetting->desc.bNumEndpoints; i++) { 4293 struct usb_endpoint_descriptor *ep_desc; 4294 4295 ep_desc = &intf->cur_altsetting->endpoint[i].desc; 4296 4297 if (!data->diag_tx_ep && usb_endpoint_is_bulk_out(ep_desc)) { 4298 data->diag_tx_ep = ep_desc; 4299 continue; 4300 } 4301 4302 if (!data->diag_rx_ep && usb_endpoint_is_bulk_in(ep_desc)) { 4303 data->diag_rx_ep = ep_desc; 4304 continue; 4305 } 4306 } 4307 4308 if (!data->diag_tx_ep || !data->diag_rx_ep) { 4309 bt_dev_err(hdev, "invalid diagnostic descriptors"); 4310 return -ENODEV; 4311 } 4312 4313 return 0; 4314 } 4315 4316 static struct urb *alloc_diag_urb(struct hci_dev *hdev, bool enable) 4317 { 4318 struct btusb_data *data = hci_get_drvdata(hdev); 4319 struct sk_buff *skb; 4320 struct urb *urb; 4321 unsigned int pipe; 4322 4323 if (!data->diag_tx_ep) 4324 return ERR_PTR(-ENODEV); 4325 4326 urb = usb_alloc_urb(0, GFP_KERNEL); 4327 if (!urb) 4328 return ERR_PTR(-ENOMEM); 4329 4330 skb = bt_skb_alloc(2, GFP_KERNEL); 4331 if (!skb) { 4332 usb_free_urb(urb); 4333 return ERR_PTR(-ENOMEM); 4334 } 4335 4336 skb_put_u8(skb, 0xf0); 4337 skb_put_u8(skb, enable); 4338 4339 pipe = usb_sndbulkpipe(data->udev, data->diag_tx_ep->bEndpointAddress); 4340 4341 usb_fill_bulk_urb(urb, data->udev, pipe, 4342 skb->data, skb->len, btusb_tx_complete, skb); 4343 4344 skb->dev = (void *)hdev; 4345 4346 return urb; 4347 } 4348 4349 static int btusb_bcm_set_diag(struct hci_dev *hdev, bool enable) 4350 { 4351 struct btusb_data *data = hci_get_drvdata(hdev); 4352 struct urb *urb; 4353 4354 if (!data->diag) 4355 return -ENODEV; 4356 4357 if (!test_bit(HCI_RUNNING, &hdev->flags)) 4358 return -ENETDOWN; 4359 4360 urb = alloc_diag_urb(hdev, enable); 4361 if (IS_ERR(urb)) 4362 return PTR_ERR(urb); 4363 4364 return submit_or_queue_tx_urb(hdev, urb); 4365 } 4366 4367 #ifdef CONFIG_PM 4368 static irqreturn_t btusb_oob_wake_handler(int irq, void *priv) 4369 { 4370 struct btusb_data *data = priv; 4371 4372 pm_wakeup_event(&data->udev->dev, 0); 4373 pm_system_wakeup(); 4374 4375 /* Disable only if not already disabled (keep it balanced) */ 4376 if (test_and_clear_bit(BTUSB_OOB_WAKE_ENABLED, &data->flags)) { 4377 disable_irq_nosync(irq); 4378 disable_irq_wake(irq); 4379 } 4380 return IRQ_HANDLED; 4381 } 4382 4383 static const struct of_device_id btusb_match_table[] = { 4384 { .compatible = "usb1286,204e" }, 4385 { .compatible = "usbcf3,e300" }, /* QCA6174A */ 4386 { .compatible = "usb4ca,301a" }, /* QCA6174A (Lite-On) */ 4387 { } 4388 }; 4389 MODULE_DEVICE_TABLE(of, btusb_match_table); 4390 4391 /* Use an oob wakeup pin? */ 4392 static int btusb_config_oob_wake(struct hci_dev *hdev) 4393 { 4394 struct btusb_data *data = hci_get_drvdata(hdev); 4395 struct device *dev = &data->udev->dev; 4396 int irq, ret; 4397 4398 clear_bit(BTUSB_OOB_WAKE_ENABLED, &data->flags); 4399 4400 if (!of_match_device(btusb_match_table, dev)) 4401 return 0; 4402 4403 /* Move on if no IRQ specified */ 4404 irq = of_irq_get_byname(dev->of_node, "wakeup"); 4405 if (irq <= 0) { 4406 bt_dev_dbg(hdev, "%s: no OOB Wakeup IRQ in DT", __func__); 4407 return 0; 4408 } 4409 4410 irq_set_status_flags(irq, IRQ_NOAUTOEN); 4411 ret = devm_request_irq(&hdev->dev, irq, btusb_oob_wake_handler, 4412 0, "OOB Wake-on-BT", data); 4413 if (ret) { 4414 bt_dev_err(hdev, "%s: IRQ request failed", __func__); 4415 return ret; 4416 } 4417 4418 ret = device_init_wakeup(dev, true); 4419 if (ret) { 4420 bt_dev_err(hdev, "%s: failed to init_wakeup", __func__); 4421 return ret; 4422 } 4423 4424 data->oob_wake_irq = irq; 4425 bt_dev_info(hdev, "OOB Wake-on-BT configured at IRQ %u", irq); 4426 return 0; 4427 } 4428 #endif 4429 4430 static void btusb_check_needs_reset_resume(struct usb_interface *intf) 4431 { 4432 if (dmi_check_system(btusb_needs_reset_resume_table)) 4433 interface_to_usbdev(intf)->quirks |= USB_QUIRK_RESET_RESUME; 4434 } 4435 4436 static bool btusb_prevent_wake(struct hci_dev *hdev) 4437 { 4438 struct btusb_data *data = hci_get_drvdata(hdev); 4439 4440 if (test_bit(BTUSB_WAKEUP_DISABLE, &data->flags)) 4441 return true; 4442 4443 return !device_may_wakeup(&data->udev->dev); 4444 } 4445 4446 static int btusb_shutdown_qca(struct hci_dev *hdev) 4447 { 4448 struct sk_buff *skb; 4449 4450 skb = __hci_cmd_sync(hdev, HCI_OP_RESET, 0, NULL, HCI_INIT_TIMEOUT); 4451 if (IS_ERR(skb)) { 4452 bt_dev_err(hdev, "HCI reset during shutdown failed"); 4453 return PTR_ERR(skb); 4454 } 4455 kfree_skb(skb); 4456 4457 return 0; 4458 } 4459 4460 static int btusb_probe(struct usb_interface *intf, 4461 const struct usb_device_id *id) 4462 { 4463 struct usb_endpoint_descriptor *ep_desc; 4464 struct gpio_desc *reset_gpio; 4465 struct btusb_data *data; 4466 struct hci_dev *hdev; 4467 unsigned ifnum_base; 4468 int i, err; 4469 4470 BT_DBG("intf %p id %p", intf, id); 4471 4472 /* interface numbers are hardcoded in the spec */ 4473 if (intf->cur_altsetting->desc.bInterfaceNumber != 0) { 4474 if (!(id->driver_info & BTUSB_IFNUM_2)) 4475 return -ENODEV; 4476 if (intf->cur_altsetting->desc.bInterfaceNumber != 2) 4477 return -ENODEV; 4478 } 4479 4480 ifnum_base = intf->cur_altsetting->desc.bInterfaceNumber; 4481 4482 if (!id->driver_info) { 4483 const struct usb_device_id *match; 4484 4485 match = usb_match_id(intf, blacklist_table); 4486 if (match) 4487 id = match; 4488 } 4489 4490 if (id->driver_info == BTUSB_IGNORE) 4491 return -ENODEV; 4492 4493 if (id->driver_info & BTUSB_ATH3012) { 4494 struct usb_device *udev = interface_to_usbdev(intf); 4495 4496 /* Old firmware would otherwise let ath3k driver load 4497 * patch and sysconfig files 4498 */ 4499 if (le16_to_cpu(udev->descriptor.bcdDevice) <= 0x0001 && 4500 !btusb_qca_need_patch(udev)) 4501 return -ENODEV; 4502 } 4503 4504 data = devm_kzalloc(&intf->dev, sizeof(*data), GFP_KERNEL); 4505 if (!data) 4506 return -ENOMEM; 4507 4508 for (i = 0; i < intf->cur_altsetting->desc.bNumEndpoints; i++) { 4509 ep_desc = &intf->cur_altsetting->endpoint[i].desc; 4510 4511 if (!data->intr_ep && usb_endpoint_is_int_in(ep_desc)) { 4512 data->intr_ep = ep_desc; 4513 continue; 4514 } 4515 4516 if (!data->bulk_tx_ep && usb_endpoint_is_bulk_out(ep_desc)) { 4517 data->bulk_tx_ep = ep_desc; 4518 continue; 4519 } 4520 4521 if (!data->bulk_rx_ep && usb_endpoint_is_bulk_in(ep_desc)) { 4522 data->bulk_rx_ep = ep_desc; 4523 continue; 4524 } 4525 } 4526 4527 if (!data->intr_ep || !data->bulk_tx_ep || !data->bulk_rx_ep) 4528 return -ENODEV; 4529 4530 if (id->driver_info & BTUSB_AMP) { 4531 data->cmdreq_type = USB_TYPE_CLASS | 0x01; 4532 data->cmdreq = 0x2b; 4533 } else { 4534 data->cmdreq_type = USB_TYPE_CLASS; 4535 data->cmdreq = 0x00; 4536 } 4537 4538 data->udev = interface_to_usbdev(intf); 4539 data->intf = intf; 4540 4541 INIT_WORK(&data->work, btusb_work); 4542 INIT_WORK(&data->waker, btusb_waker); 4543 init_usb_anchor(&data->deferred); 4544 init_usb_anchor(&data->tx_anchor); 4545 spin_lock_init(&data->txlock); 4546 4547 init_usb_anchor(&data->intr_anchor); 4548 init_usb_anchor(&data->bulk_anchor); 4549 init_usb_anchor(&data->isoc_anchor); 4550 init_usb_anchor(&data->diag_anchor); 4551 init_usb_anchor(&data->ctrl_anchor); 4552 spin_lock_init(&data->rxlock); 4553 4554 if (id->driver_info & BTUSB_INTEL_NEW) { 4555 data->recv_event = btusb_recv_event_intel; 4556 data->recv_bulk = btusb_recv_bulk_intel; 4557 set_bit(BTUSB_BOOTLOADER, &data->flags); 4558 } else { 4559 data->recv_event = hci_recv_frame; 4560 data->recv_bulk = btusb_recv_bulk; 4561 } 4562 4563 hdev = hci_alloc_dev(); 4564 if (!hdev) 4565 return -ENOMEM; 4566 4567 hdev->bus = HCI_USB; 4568 hci_set_drvdata(hdev, data); 4569 4570 if (id->driver_info & BTUSB_AMP) 4571 hdev->dev_type = HCI_AMP; 4572 else 4573 hdev->dev_type = HCI_PRIMARY; 4574 4575 data->hdev = hdev; 4576 4577 SET_HCIDEV_DEV(hdev, &intf->dev); 4578 4579 reset_gpio = gpiod_get_optional(&data->udev->dev, "reset", 4580 GPIOD_OUT_LOW); 4581 if (IS_ERR(reset_gpio)) { 4582 err = PTR_ERR(reset_gpio); 4583 goto out_free_dev; 4584 } else if (reset_gpio) { 4585 data->reset_gpio = reset_gpio; 4586 } 4587 4588 hdev->open = btusb_open; 4589 hdev->close = btusb_close; 4590 hdev->flush = btusb_flush; 4591 hdev->send = btusb_send_frame; 4592 hdev->notify = btusb_notify; 4593 hdev->prevent_wake = btusb_prevent_wake; 4594 4595 #ifdef CONFIG_PM 4596 err = btusb_config_oob_wake(hdev); 4597 if (err) 4598 goto out_free_dev; 4599 4600 /* Marvell devices may need a specific chip configuration */ 4601 if (id->driver_info & BTUSB_MARVELL && data->oob_wake_irq) { 4602 err = marvell_config_oob_wake(hdev); 4603 if (err) 4604 goto out_free_dev; 4605 } 4606 #endif 4607 if (id->driver_info & BTUSB_CW6622) 4608 set_bit(HCI_QUIRK_BROKEN_STORED_LINK_KEY, &hdev->quirks); 4609 4610 if (id->driver_info & BTUSB_BCM2045) 4611 set_bit(HCI_QUIRK_BROKEN_STORED_LINK_KEY, &hdev->quirks); 4612 4613 if (id->driver_info & BTUSB_BCM92035) 4614 hdev->setup = btusb_setup_bcm92035; 4615 4616 if (IS_ENABLED(CONFIG_BT_HCIBTUSB_BCM) && 4617 (id->driver_info & BTUSB_BCM_PATCHRAM)) { 4618 hdev->manufacturer = 15; 4619 hdev->setup = btbcm_setup_patchram; 4620 hdev->set_diag = btusb_bcm_set_diag; 4621 hdev->set_bdaddr = btbcm_set_bdaddr; 4622 4623 /* Broadcom LM_DIAG Interface numbers are hardcoded */ 4624 data->diag = usb_ifnum_to_if(data->udev, ifnum_base + 2); 4625 } 4626 4627 if (IS_ENABLED(CONFIG_BT_HCIBTUSB_BCM) && 4628 (id->driver_info & BTUSB_BCM_APPLE)) { 4629 hdev->manufacturer = 15; 4630 hdev->setup = btbcm_setup_apple; 4631 hdev->set_diag = btusb_bcm_set_diag; 4632 4633 /* Broadcom LM_DIAG Interface numbers are hardcoded */ 4634 data->diag = usb_ifnum_to_if(data->udev, ifnum_base + 2); 4635 } 4636 4637 if (id->driver_info & BTUSB_INTEL) { 4638 hdev->manufacturer = 2; 4639 hdev->setup = btusb_setup_intel; 4640 hdev->shutdown = btusb_shutdown_intel; 4641 hdev->set_diag = btintel_set_diag_mfg; 4642 hdev->set_bdaddr = btintel_set_bdaddr; 4643 hdev->cmd_timeout = btusb_intel_cmd_timeout; 4644 set_bit(HCI_QUIRK_STRICT_DUPLICATE_FILTER, &hdev->quirks); 4645 set_bit(HCI_QUIRK_SIMULTANEOUS_DISCOVERY, &hdev->quirks); 4646 set_bit(HCI_QUIRK_NON_PERSISTENT_DIAG, &hdev->quirks); 4647 } 4648 4649 if (id->driver_info & BTUSB_INTEL_NEW) { 4650 hdev->manufacturer = 2; 4651 hdev->send = btusb_send_frame_intel; 4652 hdev->setup = btusb_setup_intel_new; 4653 hdev->shutdown = btusb_shutdown_intel_new; 4654 hdev->hw_error = btintel_hw_error; 4655 hdev->set_diag = btintel_set_diag; 4656 hdev->set_bdaddr = btintel_set_bdaddr; 4657 hdev->cmd_timeout = btusb_intel_cmd_timeout; 4658 set_bit(HCI_QUIRK_STRICT_DUPLICATE_FILTER, &hdev->quirks); 4659 set_bit(HCI_QUIRK_SIMULTANEOUS_DISCOVERY, &hdev->quirks); 4660 set_bit(HCI_QUIRK_NON_PERSISTENT_DIAG, &hdev->quirks); 4661 } 4662 4663 if (id->driver_info & BTUSB_INTEL_NEWGEN) { 4664 hdev->manufacturer = 2; 4665 hdev->send = btusb_send_frame_intel; 4666 hdev->setup = btusb_setup_intel_newgen; 4667 hdev->shutdown = btusb_shutdown_intel_new; 4668 hdev->hw_error = btintel_hw_error; 4669 hdev->set_diag = btintel_set_diag; 4670 hdev->set_bdaddr = btintel_set_bdaddr; 4671 hdev->cmd_timeout = btusb_intel_cmd_timeout; 4672 set_bit(HCI_QUIRK_STRICT_DUPLICATE_FILTER, &hdev->quirks); 4673 set_bit(HCI_QUIRK_SIMULTANEOUS_DISCOVERY, &hdev->quirks); 4674 set_bit(HCI_QUIRK_NON_PERSISTENT_DIAG, &hdev->quirks); 4675 4676 data->recv_event = btusb_recv_event_intel; 4677 data->recv_bulk = btusb_recv_bulk_intel; 4678 set_bit(BTUSB_BOOTLOADER, &data->flags); 4679 } 4680 4681 if (id->driver_info & BTUSB_MARVELL) 4682 hdev->set_bdaddr = btusb_set_bdaddr_marvell; 4683 4684 if (IS_ENABLED(CONFIG_BT_HCIBTUSB_MTK) && 4685 (id->driver_info & BTUSB_MEDIATEK)) { 4686 hdev->setup = btusb_mtk_setup; 4687 hdev->shutdown = btusb_mtk_shutdown; 4688 hdev->manufacturer = 70; 4689 set_bit(HCI_QUIRK_NON_PERSISTENT_SETUP, &hdev->quirks); 4690 } 4691 4692 if (id->driver_info & BTUSB_SWAVE) { 4693 set_bit(HCI_QUIRK_FIXUP_INQUIRY_MODE, &hdev->quirks); 4694 set_bit(HCI_QUIRK_BROKEN_LOCAL_COMMANDS, &hdev->quirks); 4695 } 4696 4697 if (id->driver_info & BTUSB_INTEL_BOOT) { 4698 hdev->manufacturer = 2; 4699 set_bit(HCI_QUIRK_RAW_DEVICE, &hdev->quirks); 4700 } 4701 4702 if (id->driver_info & BTUSB_ATH3012) { 4703 data->setup_on_usb = btusb_setup_qca; 4704 hdev->set_bdaddr = btusb_set_bdaddr_ath3012; 4705 set_bit(HCI_QUIRK_SIMULTANEOUS_DISCOVERY, &hdev->quirks); 4706 set_bit(HCI_QUIRK_STRICT_DUPLICATE_FILTER, &hdev->quirks); 4707 } 4708 4709 if (id->driver_info & BTUSB_QCA_ROME) { 4710 data->setup_on_usb = btusb_setup_qca; 4711 hdev->set_bdaddr = btusb_set_bdaddr_ath3012; 4712 hdev->cmd_timeout = btusb_qca_cmd_timeout; 4713 set_bit(HCI_QUIRK_SIMULTANEOUS_DISCOVERY, &hdev->quirks); 4714 btusb_check_needs_reset_resume(intf); 4715 } 4716 4717 if (id->driver_info & BTUSB_QCA_WCN6855) { 4718 data->setup_on_usb = btusb_setup_qca; 4719 hdev->shutdown = btusb_shutdown_qca; 4720 hdev->set_bdaddr = btusb_set_bdaddr_wcn6855; 4721 hdev->cmd_timeout = btusb_qca_cmd_timeout; 4722 set_bit(HCI_QUIRK_SIMULTANEOUS_DISCOVERY, &hdev->quirks); 4723 } 4724 4725 if (id->driver_info & BTUSB_AMP) { 4726 /* AMP controllers do not support SCO packets */ 4727 data->isoc = NULL; 4728 } else { 4729 /* Interface orders are hardcoded in the specification */ 4730 data->isoc = usb_ifnum_to_if(data->udev, ifnum_base + 1); 4731 data->isoc_ifnum = ifnum_base + 1; 4732 } 4733 4734 if (IS_ENABLED(CONFIG_BT_HCIBTUSB_RTL) && 4735 (id->driver_info & BTUSB_REALTEK)) { 4736 hdev->setup = btrtl_setup_realtek; 4737 hdev->shutdown = btrtl_shutdown_realtek; 4738 hdev->cmd_timeout = btusb_rtl_cmd_timeout; 4739 4740 /* Realtek devices lose their updated firmware over global 4741 * suspend that means host doesn't send SET_FEATURE 4742 * (DEVICE_REMOTE_WAKEUP) 4743 */ 4744 set_bit(BTUSB_WAKEUP_DISABLE, &data->flags); 4745 } 4746 4747 if (!reset) 4748 set_bit(HCI_QUIRK_RESET_ON_CLOSE, &hdev->quirks); 4749 4750 if (force_scofix || id->driver_info & BTUSB_WRONG_SCO_MTU) { 4751 if (!disable_scofix) 4752 set_bit(HCI_QUIRK_FIXUP_BUFFER_SIZE, &hdev->quirks); 4753 } 4754 4755 if (id->driver_info & BTUSB_BROKEN_ISOC) 4756 data->isoc = NULL; 4757 4758 if (id->driver_info & BTUSB_WIDEBAND_SPEECH) 4759 set_bit(HCI_QUIRK_WIDEBAND_SPEECH_SUPPORTED, &hdev->quirks); 4760 4761 if (id->driver_info & BTUSB_VALID_LE_STATES) 4762 set_bit(HCI_QUIRK_VALID_LE_STATES, &hdev->quirks); 4763 4764 if (id->driver_info & BTUSB_DIGIANSWER) { 4765 data->cmdreq_type = USB_TYPE_VENDOR; 4766 set_bit(HCI_QUIRK_RESET_ON_CLOSE, &hdev->quirks); 4767 } 4768 4769 if (id->driver_info & BTUSB_CSR) { 4770 struct usb_device *udev = data->udev; 4771 u16 bcdDevice = le16_to_cpu(udev->descriptor.bcdDevice); 4772 4773 /* Old firmware would otherwise execute USB reset */ 4774 if (bcdDevice < 0x117) 4775 set_bit(HCI_QUIRK_RESET_ON_CLOSE, &hdev->quirks); 4776 4777 /* This must be set first in case we disable it for fakes */ 4778 set_bit(HCI_QUIRK_SIMULTANEOUS_DISCOVERY, &hdev->quirks); 4779 4780 /* Fake CSR devices with broken commands */ 4781 if (le16_to_cpu(udev->descriptor.idVendor) == 0x0a12 && 4782 le16_to_cpu(udev->descriptor.idProduct) == 0x0001) 4783 hdev->setup = btusb_setup_csr; 4784 } 4785 4786 if (id->driver_info & BTUSB_SNIFFER) { 4787 struct usb_device *udev = data->udev; 4788 4789 /* New sniffer firmware has crippled HCI interface */ 4790 if (le16_to_cpu(udev->descriptor.bcdDevice) > 0x997) 4791 set_bit(HCI_QUIRK_RAW_DEVICE, &hdev->quirks); 4792 } 4793 4794 if (id->driver_info & BTUSB_INTEL_BOOT) { 4795 /* A bug in the bootloader causes that interrupt interface is 4796 * only enabled after receiving SetInterface(0, AltSetting=0). 4797 */ 4798 err = usb_set_interface(data->udev, 0, 0); 4799 if (err < 0) { 4800 BT_ERR("failed to set interface 0, alt 0 %d", err); 4801 goto out_free_dev; 4802 } 4803 } 4804 4805 if (data->isoc) { 4806 err = usb_driver_claim_interface(&btusb_driver, 4807 data->isoc, data); 4808 if (err < 0) 4809 goto out_free_dev; 4810 } 4811 4812 if (IS_ENABLED(CONFIG_BT_HCIBTUSB_BCM) && data->diag) { 4813 if (!usb_driver_claim_interface(&btusb_driver, 4814 data->diag, data)) 4815 __set_diag_interface(hdev); 4816 else 4817 data->diag = NULL; 4818 } 4819 4820 if (enable_autosuspend) 4821 usb_enable_autosuspend(data->udev); 4822 4823 err = hci_register_dev(hdev); 4824 if (err < 0) 4825 goto out_free_dev; 4826 4827 usb_set_intfdata(intf, data); 4828 4829 return 0; 4830 4831 out_free_dev: 4832 if (data->reset_gpio) 4833 gpiod_put(data->reset_gpio); 4834 hci_free_dev(hdev); 4835 return err; 4836 } 4837 4838 static void btusb_disconnect(struct usb_interface *intf) 4839 { 4840 struct btusb_data *data = usb_get_intfdata(intf); 4841 struct hci_dev *hdev; 4842 4843 BT_DBG("intf %p", intf); 4844 4845 if (!data) 4846 return; 4847 4848 hdev = data->hdev; 4849 usb_set_intfdata(data->intf, NULL); 4850 4851 if (data->isoc) 4852 usb_set_intfdata(data->isoc, NULL); 4853 4854 if (data->diag) 4855 usb_set_intfdata(data->diag, NULL); 4856 4857 hci_unregister_dev(hdev); 4858 4859 if (intf == data->intf) { 4860 if (data->isoc) 4861 usb_driver_release_interface(&btusb_driver, data->isoc); 4862 if (data->diag) 4863 usb_driver_release_interface(&btusb_driver, data->diag); 4864 } else if (intf == data->isoc) { 4865 if (data->diag) 4866 usb_driver_release_interface(&btusb_driver, data->diag); 4867 usb_driver_release_interface(&btusb_driver, data->intf); 4868 } else if (intf == data->diag) { 4869 usb_driver_release_interface(&btusb_driver, data->intf); 4870 if (data->isoc) 4871 usb_driver_release_interface(&btusb_driver, data->isoc); 4872 } 4873 4874 if (data->oob_wake_irq) 4875 device_init_wakeup(&data->udev->dev, false); 4876 4877 if (data->reset_gpio) 4878 gpiod_put(data->reset_gpio); 4879 4880 hci_free_dev(hdev); 4881 } 4882 4883 #ifdef CONFIG_PM 4884 static int btusb_suspend(struct usb_interface *intf, pm_message_t message) 4885 { 4886 struct btusb_data *data = usb_get_intfdata(intf); 4887 4888 BT_DBG("intf %p", intf); 4889 4890 if (data->suspend_count++) 4891 return 0; 4892 4893 spin_lock_irq(&data->txlock); 4894 if (!(PMSG_IS_AUTO(message) && data->tx_in_flight)) { 4895 set_bit(BTUSB_SUSPENDING, &data->flags); 4896 spin_unlock_irq(&data->txlock); 4897 } else { 4898 spin_unlock_irq(&data->txlock); 4899 data->suspend_count--; 4900 return -EBUSY; 4901 } 4902 4903 cancel_work_sync(&data->work); 4904 4905 btusb_stop_traffic(data); 4906 usb_kill_anchored_urbs(&data->tx_anchor); 4907 4908 if (data->oob_wake_irq && device_may_wakeup(&data->udev->dev)) { 4909 set_bit(BTUSB_OOB_WAKE_ENABLED, &data->flags); 4910 enable_irq_wake(data->oob_wake_irq); 4911 enable_irq(data->oob_wake_irq); 4912 } 4913 4914 /* For global suspend, Realtek devices lose the loaded fw 4915 * in them. But for autosuspend, firmware should remain. 4916 * Actually, it depends on whether the usb host sends 4917 * set feature (enable wakeup) or not. 4918 */ 4919 if (test_bit(BTUSB_WAKEUP_DISABLE, &data->flags)) { 4920 if (PMSG_IS_AUTO(message) && 4921 device_can_wakeup(&data->udev->dev)) 4922 data->udev->do_remote_wakeup = 1; 4923 else if (!PMSG_IS_AUTO(message)) 4924 data->udev->reset_resume = 1; 4925 } 4926 4927 return 0; 4928 } 4929 4930 static void play_deferred(struct btusb_data *data) 4931 { 4932 struct urb *urb; 4933 int err; 4934 4935 while ((urb = usb_get_from_anchor(&data->deferred))) { 4936 usb_anchor_urb(urb, &data->tx_anchor); 4937 4938 err = usb_submit_urb(urb, GFP_ATOMIC); 4939 if (err < 0) { 4940 if (err != -EPERM && err != -ENODEV) 4941 BT_ERR("%s urb %p submission failed (%d)", 4942 data->hdev->name, urb, -err); 4943 kfree(urb->setup_packet); 4944 usb_unanchor_urb(urb); 4945 usb_free_urb(urb); 4946 break; 4947 } 4948 4949 data->tx_in_flight++; 4950 usb_free_urb(urb); 4951 } 4952 4953 /* Cleanup the rest deferred urbs. */ 4954 while ((urb = usb_get_from_anchor(&data->deferred))) { 4955 kfree(urb->setup_packet); 4956 usb_free_urb(urb); 4957 } 4958 } 4959 4960 static int btusb_resume(struct usb_interface *intf) 4961 { 4962 struct btusb_data *data = usb_get_intfdata(intf); 4963 struct hci_dev *hdev = data->hdev; 4964 int err = 0; 4965 4966 BT_DBG("intf %p", intf); 4967 4968 if (--data->suspend_count) 4969 return 0; 4970 4971 /* Disable only if not already disabled (keep it balanced) */ 4972 if (test_and_clear_bit(BTUSB_OOB_WAKE_ENABLED, &data->flags)) { 4973 disable_irq(data->oob_wake_irq); 4974 disable_irq_wake(data->oob_wake_irq); 4975 } 4976 4977 if (!test_bit(HCI_RUNNING, &hdev->flags)) 4978 goto done; 4979 4980 if (test_bit(BTUSB_INTR_RUNNING, &data->flags)) { 4981 err = btusb_submit_intr_urb(hdev, GFP_NOIO); 4982 if (err < 0) { 4983 clear_bit(BTUSB_INTR_RUNNING, &data->flags); 4984 goto failed; 4985 } 4986 } 4987 4988 if (test_bit(BTUSB_BULK_RUNNING, &data->flags)) { 4989 err = btusb_submit_bulk_urb(hdev, GFP_NOIO); 4990 if (err < 0) { 4991 clear_bit(BTUSB_BULK_RUNNING, &data->flags); 4992 goto failed; 4993 } 4994 4995 btusb_submit_bulk_urb(hdev, GFP_NOIO); 4996 } 4997 4998 if (test_bit(BTUSB_ISOC_RUNNING, &data->flags)) { 4999 if (btusb_submit_isoc_urb(hdev, GFP_NOIO) < 0) 5000 clear_bit(BTUSB_ISOC_RUNNING, &data->flags); 5001 else 5002 btusb_submit_isoc_urb(hdev, GFP_NOIO); 5003 } 5004 5005 spin_lock_irq(&data->txlock); 5006 play_deferred(data); 5007 clear_bit(BTUSB_SUSPENDING, &data->flags); 5008 spin_unlock_irq(&data->txlock); 5009 schedule_work(&data->work); 5010 5011 return 0; 5012 5013 failed: 5014 usb_scuttle_anchored_urbs(&data->deferred); 5015 done: 5016 spin_lock_irq(&data->txlock); 5017 clear_bit(BTUSB_SUSPENDING, &data->flags); 5018 spin_unlock_irq(&data->txlock); 5019 5020 return err; 5021 } 5022 #endif 5023 5024 static struct usb_driver btusb_driver = { 5025 .name = "btusb", 5026 .probe = btusb_probe, 5027 .disconnect = btusb_disconnect, 5028 #ifdef CONFIG_PM 5029 .suspend = btusb_suspend, 5030 .resume = btusb_resume, 5031 #endif 5032 .id_table = btusb_table, 5033 .supports_autosuspend = 1, 5034 .disable_hub_initiated_lpm = 1, 5035 }; 5036 5037 module_usb_driver(btusb_driver); 5038 5039 module_param(disable_scofix, bool, 0644); 5040 MODULE_PARM_DESC(disable_scofix, "Disable fixup of wrong SCO buffer size"); 5041 5042 module_param(force_scofix, bool, 0644); 5043 MODULE_PARM_DESC(force_scofix, "Force fixup of wrong SCO buffers size"); 5044 5045 module_param(enable_autosuspend, bool, 0644); 5046 MODULE_PARM_DESC(enable_autosuspend, "Enable USB autosuspend by default"); 5047 5048 module_param(reset, bool, 0644); 5049 MODULE_PARM_DESC(reset, "Send HCI reset command on initialization"); 5050 5051 MODULE_AUTHOR("Marcel Holtmann <marcel@holtmann.org>"); 5052 MODULE_DESCRIPTION("Generic Bluetooth USB driver ver " VERSION); 5053 MODULE_VERSION(VERSION); 5054 MODULE_LICENSE("GPL"); 5055