1 /* 2 * 3 * Generic Bluetooth USB driver 4 * 5 * Copyright (C) 2005-2008 Marcel Holtmann <marcel@holtmann.org> 6 * 7 * 8 * This program is free software; you can redistribute it and/or modify 9 * it under the terms of the GNU General Public License as published by 10 * the Free Software Foundation; either version 2 of the License, or 11 * (at your option) any later version. 12 * 13 * This program is distributed in the hope that it will be useful, 14 * but WITHOUT ANY WARRANTY; without even the implied warranty of 15 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the 16 * GNU General Public License for more details. 17 * 18 * You should have received a copy of the GNU General Public License 19 * along with this program; if not, write to the Free Software 20 * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA 21 * 22 */ 23 24 #include <linux/module.h> 25 #include <linux/usb.h> 26 #include <linux/firmware.h> 27 28 #include <net/bluetooth/bluetooth.h> 29 #include <net/bluetooth/hci_core.h> 30 31 #define VERSION "0.6" 32 33 static bool ignore_dga; 34 static bool ignore_csr; 35 static bool ignore_sniffer; 36 static bool disable_scofix; 37 static bool force_scofix; 38 39 static bool reset = 1; 40 41 static struct usb_driver btusb_driver; 42 43 #define BTUSB_IGNORE 0x01 44 #define BTUSB_DIGIANSWER 0x02 45 #define BTUSB_CSR 0x04 46 #define BTUSB_SNIFFER 0x08 47 #define BTUSB_BCM92035 0x10 48 #define BTUSB_BROKEN_ISOC 0x20 49 #define BTUSB_WRONG_SCO_MTU 0x40 50 #define BTUSB_ATH3012 0x80 51 #define BTUSB_INTEL 0x100 52 53 static const struct usb_device_id btusb_table[] = { 54 /* Generic Bluetooth USB device */ 55 { USB_DEVICE_INFO(0xe0, 0x01, 0x01) }, 56 57 /* Apple-specific (Broadcom) devices */ 58 { USB_VENDOR_AND_INTERFACE_INFO(0x05ac, 0xff, 0x01, 0x01) }, 59 60 /* MediaTek MT76x0E */ 61 { USB_DEVICE(0x0e8d, 0x763f) }, 62 63 /* Broadcom SoftSailing reporting vendor specific */ 64 { USB_DEVICE(0x0a5c, 0x21e1) }, 65 66 /* Apple MacBookPro 7,1 */ 67 { USB_DEVICE(0x05ac, 0x8213) }, 68 69 /* Apple iMac11,1 */ 70 { USB_DEVICE(0x05ac, 0x8215) }, 71 72 /* Apple MacBookPro6,2 */ 73 { USB_DEVICE(0x05ac, 0x8218) }, 74 75 /* Apple MacBookAir3,1, MacBookAir3,2 */ 76 { USB_DEVICE(0x05ac, 0x821b) }, 77 78 /* Apple MacBookAir4,1 */ 79 { USB_DEVICE(0x05ac, 0x821f) }, 80 81 /* Apple MacBookPro8,2 */ 82 { USB_DEVICE(0x05ac, 0x821a) }, 83 84 /* Apple MacMini5,1 */ 85 { USB_DEVICE(0x05ac, 0x8281) }, 86 87 /* AVM BlueFRITZ! USB v2.0 */ 88 { USB_DEVICE(0x057c, 0x3800) }, 89 90 /* Bluetooth Ultraport Module from IBM */ 91 { USB_DEVICE(0x04bf, 0x030a) }, 92 93 /* ALPS Modules with non-standard id */ 94 { USB_DEVICE(0x044e, 0x3001) }, 95 { USB_DEVICE(0x044e, 0x3002) }, 96 97 /* Ericsson with non-standard id */ 98 { USB_DEVICE(0x0bdb, 0x1002) }, 99 100 /* Canyon CN-BTU1 with HID interfaces */ 101 { USB_DEVICE(0x0c10, 0x0000) }, 102 103 /* Broadcom BCM20702A0 */ 104 { USB_DEVICE(0x0489, 0xe042) }, 105 { USB_DEVICE(0x04ca, 0x2003) }, 106 { USB_DEVICE(0x0b05, 0x17b5) }, 107 { USB_DEVICE(0x0b05, 0x17cb) }, 108 { USB_DEVICE(0x413c, 0x8197) }, 109 110 /* Foxconn - Hon Hai */ 111 { USB_VENDOR_AND_INTERFACE_INFO(0x0489, 0xff, 0x01, 0x01) }, 112 113 /* Broadcom devices with vendor specific id */ 114 { USB_VENDOR_AND_INTERFACE_INFO(0x0a5c, 0xff, 0x01, 0x01) }, 115 116 /* Belkin F8065bf - Broadcom based */ 117 { USB_VENDOR_AND_INTERFACE_INFO(0x050d, 0xff, 0x01, 0x01) }, 118 119 /* IMC Networks - Broadcom based */ 120 { USB_VENDOR_AND_INTERFACE_INFO(0x13d3, 0xff, 0x01, 0x01) }, 121 122 { } /* Terminating entry */ 123 }; 124 125 MODULE_DEVICE_TABLE(usb, btusb_table); 126 127 static const struct usb_device_id blacklist_table[] = { 128 /* CSR BlueCore devices */ 129 { USB_DEVICE(0x0a12, 0x0001), .driver_info = BTUSB_CSR }, 130 131 /* Broadcom BCM2033 without firmware */ 132 { USB_DEVICE(0x0a5c, 0x2033), .driver_info = BTUSB_IGNORE }, 133 134 /* Atheros 3011 with sflash firmware */ 135 { USB_DEVICE(0x0489, 0xe027), .driver_info = BTUSB_IGNORE }, 136 { USB_DEVICE(0x0489, 0xe03d), .driver_info = BTUSB_IGNORE }, 137 { USB_DEVICE(0x0930, 0x0215), .driver_info = BTUSB_IGNORE }, 138 { USB_DEVICE(0x0cf3, 0x3002), .driver_info = BTUSB_IGNORE }, 139 { USB_DEVICE(0x0cf3, 0xe019), .driver_info = BTUSB_IGNORE }, 140 { USB_DEVICE(0x13d3, 0x3304), .driver_info = BTUSB_IGNORE }, 141 142 /* Atheros AR9285 Malbec with sflash firmware */ 143 { USB_DEVICE(0x03f0, 0x311d), .driver_info = BTUSB_IGNORE }, 144 145 /* Atheros 3012 with sflash firmware */ 146 { USB_DEVICE(0x0489, 0xe04d), .driver_info = BTUSB_ATH3012 }, 147 { USB_DEVICE(0x0489, 0xe04e), .driver_info = BTUSB_ATH3012 }, 148 { USB_DEVICE(0x0489, 0xe056), .driver_info = BTUSB_ATH3012 }, 149 { USB_DEVICE(0x0489, 0xe057), .driver_info = BTUSB_ATH3012 }, 150 { USB_DEVICE(0x0489, 0xe05f), .driver_info = BTUSB_ATH3012 }, 151 { USB_DEVICE(0x04c5, 0x1330), .driver_info = BTUSB_ATH3012 }, 152 { USB_DEVICE(0x04ca, 0x3004), .driver_info = BTUSB_ATH3012 }, 153 { USB_DEVICE(0x04ca, 0x3005), .driver_info = BTUSB_ATH3012 }, 154 { USB_DEVICE(0x04ca, 0x3006), .driver_info = BTUSB_ATH3012 }, 155 { USB_DEVICE(0x04ca, 0x3008), .driver_info = BTUSB_ATH3012 }, 156 { USB_DEVICE(0x04ca, 0x300b), .driver_info = BTUSB_ATH3012 }, 157 { USB_DEVICE(0x0930, 0x0219), .driver_info = BTUSB_ATH3012 }, 158 { USB_DEVICE(0x0930, 0x0220), .driver_info = BTUSB_ATH3012 }, 159 { USB_DEVICE(0x0b05, 0x17d0), .driver_info = BTUSB_ATH3012 }, 160 { USB_DEVICE(0x0cf3, 0x0036), .driver_info = BTUSB_ATH3012 }, 161 { USB_DEVICE(0x0cf3, 0x3004), .driver_info = BTUSB_ATH3012 }, 162 { USB_DEVICE(0x0cf3, 0x3005), .driver_info = BTUSB_ATH3012 }, 163 { USB_DEVICE(0x0cf3, 0x3008), .driver_info = BTUSB_ATH3012 }, 164 { USB_DEVICE(0x0cf3, 0x311d), .driver_info = BTUSB_ATH3012 }, 165 { USB_DEVICE(0x0cf3, 0x311e), .driver_info = BTUSB_ATH3012 }, 166 { USB_DEVICE(0x0cf3, 0x311f), .driver_info = BTUSB_ATH3012 }, 167 { USB_DEVICE(0x0cf3, 0x3121), .driver_info = BTUSB_ATH3012 }, 168 { USB_DEVICE(0x0cf3, 0x817a), .driver_info = BTUSB_ATH3012 }, 169 { USB_DEVICE(0x0cf3, 0xe003), .driver_info = BTUSB_ATH3012 }, 170 { USB_DEVICE(0x0cf3, 0xe004), .driver_info = BTUSB_ATH3012 }, 171 { USB_DEVICE(0x0cf3, 0xe005), .driver_info = BTUSB_ATH3012 }, 172 { USB_DEVICE(0x13d3, 0x3362), .driver_info = BTUSB_ATH3012 }, 173 { USB_DEVICE(0x13d3, 0x3375), .driver_info = BTUSB_ATH3012 }, 174 { USB_DEVICE(0x13d3, 0x3393), .driver_info = BTUSB_ATH3012 }, 175 { USB_DEVICE(0x13d3, 0x3402), .driver_info = BTUSB_ATH3012 }, 176 177 /* Atheros AR5BBU12 with sflash firmware */ 178 { USB_DEVICE(0x0489, 0xe02c), .driver_info = BTUSB_IGNORE }, 179 180 /* Atheros AR5BBU12 with sflash firmware */ 181 { USB_DEVICE(0x0489, 0xe036), .driver_info = BTUSB_ATH3012 }, 182 { USB_DEVICE(0x0489, 0xe03c), .driver_info = BTUSB_ATH3012 }, 183 184 /* Broadcom BCM2035 */ 185 { USB_DEVICE(0x0a5c, 0x2009), .driver_info = BTUSB_BCM92035 }, 186 { USB_DEVICE(0x0a5c, 0x200a), .driver_info = BTUSB_WRONG_SCO_MTU }, 187 { USB_DEVICE(0x0a5c, 0x2035), .driver_info = BTUSB_WRONG_SCO_MTU }, 188 189 /* Broadcom BCM2045 */ 190 { USB_DEVICE(0x0a5c, 0x2039), .driver_info = BTUSB_WRONG_SCO_MTU }, 191 { USB_DEVICE(0x0a5c, 0x2101), .driver_info = BTUSB_WRONG_SCO_MTU }, 192 193 /* IBM/Lenovo ThinkPad with Broadcom chip */ 194 { USB_DEVICE(0x0a5c, 0x201e), .driver_info = BTUSB_WRONG_SCO_MTU }, 195 { USB_DEVICE(0x0a5c, 0x2110), .driver_info = BTUSB_WRONG_SCO_MTU }, 196 197 /* HP laptop with Broadcom chip */ 198 { USB_DEVICE(0x03f0, 0x171d), .driver_info = BTUSB_WRONG_SCO_MTU }, 199 200 /* Dell laptop with Broadcom chip */ 201 { USB_DEVICE(0x413c, 0x8126), .driver_info = BTUSB_WRONG_SCO_MTU }, 202 203 /* Dell Wireless 370 and 410 devices */ 204 { USB_DEVICE(0x413c, 0x8152), .driver_info = BTUSB_WRONG_SCO_MTU }, 205 { USB_DEVICE(0x413c, 0x8156), .driver_info = BTUSB_WRONG_SCO_MTU }, 206 207 /* Belkin F8T012 and F8T013 devices */ 208 { USB_DEVICE(0x050d, 0x0012), .driver_info = BTUSB_WRONG_SCO_MTU }, 209 { USB_DEVICE(0x050d, 0x0013), .driver_info = BTUSB_WRONG_SCO_MTU }, 210 211 /* Asus WL-BTD202 device */ 212 { USB_DEVICE(0x0b05, 0x1715), .driver_info = BTUSB_WRONG_SCO_MTU }, 213 214 /* Kensington Bluetooth USB adapter */ 215 { USB_DEVICE(0x047d, 0x105e), .driver_info = BTUSB_WRONG_SCO_MTU }, 216 217 /* RTX Telecom based adapters with buggy SCO support */ 218 { USB_DEVICE(0x0400, 0x0807), .driver_info = BTUSB_BROKEN_ISOC }, 219 { USB_DEVICE(0x0400, 0x080a), .driver_info = BTUSB_BROKEN_ISOC }, 220 221 /* CONWISE Technology based adapters with buggy SCO support */ 222 { USB_DEVICE(0x0e5e, 0x6622), .driver_info = BTUSB_BROKEN_ISOC }, 223 224 /* Digianswer devices */ 225 { USB_DEVICE(0x08fd, 0x0001), .driver_info = BTUSB_DIGIANSWER }, 226 { USB_DEVICE(0x08fd, 0x0002), .driver_info = BTUSB_IGNORE }, 227 228 /* CSR BlueCore Bluetooth Sniffer */ 229 { USB_DEVICE(0x0a12, 0x0002), .driver_info = BTUSB_SNIFFER }, 230 231 /* Frontline ComProbe Bluetooth Sniffer */ 232 { USB_DEVICE(0x16d3, 0x0002), .driver_info = BTUSB_SNIFFER }, 233 234 /* Intel Bluetooth device */ 235 { USB_DEVICE(0x8087, 0x07dc), .driver_info = BTUSB_INTEL }, 236 { USB_DEVICE(0x8087, 0x0a2a), .driver_info = BTUSB_INTEL }, 237 238 { } /* Terminating entry */ 239 }; 240 241 #define BTUSB_MAX_ISOC_FRAMES 10 242 243 #define BTUSB_INTR_RUNNING 0 244 #define BTUSB_BULK_RUNNING 1 245 #define BTUSB_ISOC_RUNNING 2 246 #define BTUSB_SUSPENDING 3 247 #define BTUSB_DID_ISO_RESUME 4 248 249 struct btusb_data { 250 struct hci_dev *hdev; 251 struct usb_device *udev; 252 struct usb_interface *intf; 253 struct usb_interface *isoc; 254 255 spinlock_t lock; 256 257 unsigned long flags; 258 259 struct work_struct work; 260 struct work_struct waker; 261 262 struct usb_anchor tx_anchor; 263 struct usb_anchor intr_anchor; 264 struct usb_anchor bulk_anchor; 265 struct usb_anchor isoc_anchor; 266 struct usb_anchor deferred; 267 int tx_in_flight; 268 spinlock_t txlock; 269 270 struct usb_endpoint_descriptor *intr_ep; 271 struct usb_endpoint_descriptor *bulk_tx_ep; 272 struct usb_endpoint_descriptor *bulk_rx_ep; 273 struct usb_endpoint_descriptor *isoc_tx_ep; 274 struct usb_endpoint_descriptor *isoc_rx_ep; 275 276 __u8 cmdreq_type; 277 278 unsigned int sco_num; 279 int isoc_altsetting; 280 int suspend_count; 281 }; 282 283 static int inc_tx(struct btusb_data *data) 284 { 285 unsigned long flags; 286 int rv; 287 288 spin_lock_irqsave(&data->txlock, flags); 289 rv = test_bit(BTUSB_SUSPENDING, &data->flags); 290 if (!rv) 291 data->tx_in_flight++; 292 spin_unlock_irqrestore(&data->txlock, flags); 293 294 return rv; 295 } 296 297 static void btusb_intr_complete(struct urb *urb) 298 { 299 struct hci_dev *hdev = urb->context; 300 struct btusb_data *data = hci_get_drvdata(hdev); 301 int err; 302 303 BT_DBG("%s urb %p status %d count %d", hdev->name, 304 urb, urb->status, urb->actual_length); 305 306 if (!test_bit(HCI_RUNNING, &hdev->flags)) 307 return; 308 309 if (urb->status == 0) { 310 hdev->stat.byte_rx += urb->actual_length; 311 312 if (hci_recv_fragment(hdev, HCI_EVENT_PKT, 313 urb->transfer_buffer, 314 urb->actual_length) < 0) { 315 BT_ERR("%s corrupted event packet", hdev->name); 316 hdev->stat.err_rx++; 317 } 318 } 319 320 if (!test_bit(BTUSB_INTR_RUNNING, &data->flags)) 321 return; 322 323 usb_mark_last_busy(data->udev); 324 usb_anchor_urb(urb, &data->intr_anchor); 325 326 err = usb_submit_urb(urb, GFP_ATOMIC); 327 if (err < 0) { 328 /* -EPERM: urb is being killed; 329 * -ENODEV: device got disconnected */ 330 if (err != -EPERM && err != -ENODEV) 331 BT_ERR("%s urb %p failed to resubmit (%d)", 332 hdev->name, urb, -err); 333 usb_unanchor_urb(urb); 334 } 335 } 336 337 static int btusb_submit_intr_urb(struct hci_dev *hdev, gfp_t mem_flags) 338 { 339 struct btusb_data *data = hci_get_drvdata(hdev); 340 struct urb *urb; 341 unsigned char *buf; 342 unsigned int pipe; 343 int err, size; 344 345 BT_DBG("%s", hdev->name); 346 347 if (!data->intr_ep) 348 return -ENODEV; 349 350 urb = usb_alloc_urb(0, mem_flags); 351 if (!urb) 352 return -ENOMEM; 353 354 size = le16_to_cpu(data->intr_ep->wMaxPacketSize); 355 356 buf = kmalloc(size, mem_flags); 357 if (!buf) { 358 usb_free_urb(urb); 359 return -ENOMEM; 360 } 361 362 pipe = usb_rcvintpipe(data->udev, data->intr_ep->bEndpointAddress); 363 364 usb_fill_int_urb(urb, data->udev, pipe, buf, size, 365 btusb_intr_complete, hdev, 366 data->intr_ep->bInterval); 367 368 urb->transfer_flags |= URB_FREE_BUFFER; 369 370 usb_anchor_urb(urb, &data->intr_anchor); 371 372 err = usb_submit_urb(urb, mem_flags); 373 if (err < 0) { 374 if (err != -EPERM && err != -ENODEV) 375 BT_ERR("%s urb %p submission failed (%d)", 376 hdev->name, urb, -err); 377 usb_unanchor_urb(urb); 378 } 379 380 usb_free_urb(urb); 381 382 return err; 383 } 384 385 static void btusb_bulk_complete(struct urb *urb) 386 { 387 struct hci_dev *hdev = urb->context; 388 struct btusb_data *data = hci_get_drvdata(hdev); 389 int err; 390 391 BT_DBG("%s urb %p status %d count %d", hdev->name, 392 urb, urb->status, urb->actual_length); 393 394 if (!test_bit(HCI_RUNNING, &hdev->flags)) 395 return; 396 397 if (urb->status == 0) { 398 hdev->stat.byte_rx += urb->actual_length; 399 400 if (hci_recv_fragment(hdev, HCI_ACLDATA_PKT, 401 urb->transfer_buffer, 402 urb->actual_length) < 0) { 403 BT_ERR("%s corrupted ACL packet", hdev->name); 404 hdev->stat.err_rx++; 405 } 406 } 407 408 if (!test_bit(BTUSB_BULK_RUNNING, &data->flags)) 409 return; 410 411 usb_anchor_urb(urb, &data->bulk_anchor); 412 usb_mark_last_busy(data->udev); 413 414 err = usb_submit_urb(urb, GFP_ATOMIC); 415 if (err < 0) { 416 /* -EPERM: urb is being killed; 417 * -ENODEV: device got disconnected */ 418 if (err != -EPERM && err != -ENODEV) 419 BT_ERR("%s urb %p failed to resubmit (%d)", 420 hdev->name, urb, -err); 421 usb_unanchor_urb(urb); 422 } 423 } 424 425 static int btusb_submit_bulk_urb(struct hci_dev *hdev, gfp_t mem_flags) 426 { 427 struct btusb_data *data = hci_get_drvdata(hdev); 428 struct urb *urb; 429 unsigned char *buf; 430 unsigned int pipe; 431 int err, size = HCI_MAX_FRAME_SIZE; 432 433 BT_DBG("%s", hdev->name); 434 435 if (!data->bulk_rx_ep) 436 return -ENODEV; 437 438 urb = usb_alloc_urb(0, mem_flags); 439 if (!urb) 440 return -ENOMEM; 441 442 buf = kmalloc(size, mem_flags); 443 if (!buf) { 444 usb_free_urb(urb); 445 return -ENOMEM; 446 } 447 448 pipe = usb_rcvbulkpipe(data->udev, data->bulk_rx_ep->bEndpointAddress); 449 450 usb_fill_bulk_urb(urb, data->udev, pipe, 451 buf, size, btusb_bulk_complete, hdev); 452 453 urb->transfer_flags |= URB_FREE_BUFFER; 454 455 usb_mark_last_busy(data->udev); 456 usb_anchor_urb(urb, &data->bulk_anchor); 457 458 err = usb_submit_urb(urb, mem_flags); 459 if (err < 0) { 460 if (err != -EPERM && err != -ENODEV) 461 BT_ERR("%s urb %p submission failed (%d)", 462 hdev->name, urb, -err); 463 usb_unanchor_urb(urb); 464 } 465 466 usb_free_urb(urb); 467 468 return err; 469 } 470 471 static void btusb_isoc_complete(struct urb *urb) 472 { 473 struct hci_dev *hdev = urb->context; 474 struct btusb_data *data = hci_get_drvdata(hdev); 475 int i, err; 476 477 BT_DBG("%s urb %p status %d count %d", hdev->name, 478 urb, urb->status, urb->actual_length); 479 480 if (!test_bit(HCI_RUNNING, &hdev->flags)) 481 return; 482 483 if (urb->status == 0) { 484 for (i = 0; i < urb->number_of_packets; i++) { 485 unsigned int offset = urb->iso_frame_desc[i].offset; 486 unsigned int length = urb->iso_frame_desc[i].actual_length; 487 488 if (urb->iso_frame_desc[i].status) 489 continue; 490 491 hdev->stat.byte_rx += length; 492 493 if (hci_recv_fragment(hdev, HCI_SCODATA_PKT, 494 urb->transfer_buffer + offset, 495 length) < 0) { 496 BT_ERR("%s corrupted SCO packet", hdev->name); 497 hdev->stat.err_rx++; 498 } 499 } 500 } 501 502 if (!test_bit(BTUSB_ISOC_RUNNING, &data->flags)) 503 return; 504 505 usb_anchor_urb(urb, &data->isoc_anchor); 506 507 err = usb_submit_urb(urb, GFP_ATOMIC); 508 if (err < 0) { 509 /* -EPERM: urb is being killed; 510 * -ENODEV: device got disconnected */ 511 if (err != -EPERM && err != -ENODEV) 512 BT_ERR("%s urb %p failed to resubmit (%d)", 513 hdev->name, urb, -err); 514 usb_unanchor_urb(urb); 515 } 516 } 517 518 static inline void __fill_isoc_descriptor(struct urb *urb, int len, int mtu) 519 { 520 int i, offset = 0; 521 522 BT_DBG("len %d mtu %d", len, mtu); 523 524 for (i = 0; i < BTUSB_MAX_ISOC_FRAMES && len >= mtu; 525 i++, offset += mtu, len -= mtu) { 526 urb->iso_frame_desc[i].offset = offset; 527 urb->iso_frame_desc[i].length = mtu; 528 } 529 530 if (len && i < BTUSB_MAX_ISOC_FRAMES) { 531 urb->iso_frame_desc[i].offset = offset; 532 urb->iso_frame_desc[i].length = len; 533 i++; 534 } 535 536 urb->number_of_packets = i; 537 } 538 539 static int btusb_submit_isoc_urb(struct hci_dev *hdev, gfp_t mem_flags) 540 { 541 struct btusb_data *data = hci_get_drvdata(hdev); 542 struct urb *urb; 543 unsigned char *buf; 544 unsigned int pipe; 545 int err, size; 546 547 BT_DBG("%s", hdev->name); 548 549 if (!data->isoc_rx_ep) 550 return -ENODEV; 551 552 urb = usb_alloc_urb(BTUSB_MAX_ISOC_FRAMES, mem_flags); 553 if (!urb) 554 return -ENOMEM; 555 556 size = le16_to_cpu(data->isoc_rx_ep->wMaxPacketSize) * 557 BTUSB_MAX_ISOC_FRAMES; 558 559 buf = kmalloc(size, mem_flags); 560 if (!buf) { 561 usb_free_urb(urb); 562 return -ENOMEM; 563 } 564 565 pipe = usb_rcvisocpipe(data->udev, data->isoc_rx_ep->bEndpointAddress); 566 567 usb_fill_int_urb(urb, data->udev, pipe, buf, size, btusb_isoc_complete, 568 hdev, data->isoc_rx_ep->bInterval); 569 570 urb->transfer_flags = URB_FREE_BUFFER | URB_ISO_ASAP; 571 572 __fill_isoc_descriptor(urb, size, 573 le16_to_cpu(data->isoc_rx_ep->wMaxPacketSize)); 574 575 usb_anchor_urb(urb, &data->isoc_anchor); 576 577 err = usb_submit_urb(urb, mem_flags); 578 if (err < 0) { 579 if (err != -EPERM && err != -ENODEV) 580 BT_ERR("%s urb %p submission failed (%d)", 581 hdev->name, urb, -err); 582 usb_unanchor_urb(urb); 583 } 584 585 usb_free_urb(urb); 586 587 return err; 588 } 589 590 static void btusb_tx_complete(struct urb *urb) 591 { 592 struct sk_buff *skb = urb->context; 593 struct hci_dev *hdev = (struct hci_dev *) skb->dev; 594 struct btusb_data *data = hci_get_drvdata(hdev); 595 596 BT_DBG("%s urb %p status %d count %d", hdev->name, 597 urb, urb->status, urb->actual_length); 598 599 if (!test_bit(HCI_RUNNING, &hdev->flags)) 600 goto done; 601 602 if (!urb->status) 603 hdev->stat.byte_tx += urb->transfer_buffer_length; 604 else 605 hdev->stat.err_tx++; 606 607 done: 608 spin_lock(&data->txlock); 609 data->tx_in_flight--; 610 spin_unlock(&data->txlock); 611 612 kfree(urb->setup_packet); 613 614 kfree_skb(skb); 615 } 616 617 static void btusb_isoc_tx_complete(struct urb *urb) 618 { 619 struct sk_buff *skb = urb->context; 620 struct hci_dev *hdev = (struct hci_dev *) skb->dev; 621 622 BT_DBG("%s urb %p status %d count %d", hdev->name, 623 urb, urb->status, urb->actual_length); 624 625 if (!test_bit(HCI_RUNNING, &hdev->flags)) 626 goto done; 627 628 if (!urb->status) 629 hdev->stat.byte_tx += urb->transfer_buffer_length; 630 else 631 hdev->stat.err_tx++; 632 633 done: 634 kfree(urb->setup_packet); 635 636 kfree_skb(skb); 637 } 638 639 static int btusb_open(struct hci_dev *hdev) 640 { 641 struct btusb_data *data = hci_get_drvdata(hdev); 642 int err; 643 644 BT_DBG("%s", hdev->name); 645 646 err = usb_autopm_get_interface(data->intf); 647 if (err < 0) 648 return err; 649 650 data->intf->needs_remote_wakeup = 1; 651 652 if (test_and_set_bit(HCI_RUNNING, &hdev->flags)) 653 goto done; 654 655 if (test_and_set_bit(BTUSB_INTR_RUNNING, &data->flags)) 656 goto done; 657 658 err = btusb_submit_intr_urb(hdev, GFP_KERNEL); 659 if (err < 0) 660 goto failed; 661 662 err = btusb_submit_bulk_urb(hdev, GFP_KERNEL); 663 if (err < 0) { 664 usb_kill_anchored_urbs(&data->intr_anchor); 665 goto failed; 666 } 667 668 set_bit(BTUSB_BULK_RUNNING, &data->flags); 669 btusb_submit_bulk_urb(hdev, GFP_KERNEL); 670 671 done: 672 usb_autopm_put_interface(data->intf); 673 return 0; 674 675 failed: 676 clear_bit(BTUSB_INTR_RUNNING, &data->flags); 677 clear_bit(HCI_RUNNING, &hdev->flags); 678 usb_autopm_put_interface(data->intf); 679 return err; 680 } 681 682 static void btusb_stop_traffic(struct btusb_data *data) 683 { 684 usb_kill_anchored_urbs(&data->intr_anchor); 685 usb_kill_anchored_urbs(&data->bulk_anchor); 686 usb_kill_anchored_urbs(&data->isoc_anchor); 687 } 688 689 static int btusb_close(struct hci_dev *hdev) 690 { 691 struct btusb_data *data = hci_get_drvdata(hdev); 692 int err; 693 694 BT_DBG("%s", hdev->name); 695 696 if (!test_and_clear_bit(HCI_RUNNING, &hdev->flags)) 697 return 0; 698 699 cancel_work_sync(&data->work); 700 cancel_work_sync(&data->waker); 701 702 clear_bit(BTUSB_ISOC_RUNNING, &data->flags); 703 clear_bit(BTUSB_BULK_RUNNING, &data->flags); 704 clear_bit(BTUSB_INTR_RUNNING, &data->flags); 705 706 btusb_stop_traffic(data); 707 err = usb_autopm_get_interface(data->intf); 708 if (err < 0) 709 goto failed; 710 711 data->intf->needs_remote_wakeup = 0; 712 usb_autopm_put_interface(data->intf); 713 714 failed: 715 usb_scuttle_anchored_urbs(&data->deferred); 716 return 0; 717 } 718 719 static int btusb_flush(struct hci_dev *hdev) 720 { 721 struct btusb_data *data = hci_get_drvdata(hdev); 722 723 BT_DBG("%s", hdev->name); 724 725 usb_kill_anchored_urbs(&data->tx_anchor); 726 727 return 0; 728 } 729 730 static int btusb_send_frame(struct hci_dev *hdev, struct sk_buff *skb) 731 { 732 struct btusb_data *data = hci_get_drvdata(hdev); 733 struct usb_ctrlrequest *dr; 734 struct urb *urb; 735 unsigned int pipe; 736 int err; 737 738 BT_DBG("%s", hdev->name); 739 740 if (!test_bit(HCI_RUNNING, &hdev->flags)) 741 return -EBUSY; 742 743 skb->dev = (void *) hdev; 744 745 switch (bt_cb(skb)->pkt_type) { 746 case HCI_COMMAND_PKT: 747 urb = usb_alloc_urb(0, GFP_ATOMIC); 748 if (!urb) 749 return -ENOMEM; 750 751 dr = kmalloc(sizeof(*dr), GFP_ATOMIC); 752 if (!dr) { 753 usb_free_urb(urb); 754 return -ENOMEM; 755 } 756 757 dr->bRequestType = data->cmdreq_type; 758 dr->bRequest = 0; 759 dr->wIndex = 0; 760 dr->wValue = 0; 761 dr->wLength = __cpu_to_le16(skb->len); 762 763 pipe = usb_sndctrlpipe(data->udev, 0x00); 764 765 usb_fill_control_urb(urb, data->udev, pipe, (void *) dr, 766 skb->data, skb->len, btusb_tx_complete, skb); 767 768 hdev->stat.cmd_tx++; 769 break; 770 771 case HCI_ACLDATA_PKT: 772 if (!data->bulk_tx_ep) 773 return -ENODEV; 774 775 urb = usb_alloc_urb(0, GFP_ATOMIC); 776 if (!urb) 777 return -ENOMEM; 778 779 pipe = usb_sndbulkpipe(data->udev, 780 data->bulk_tx_ep->bEndpointAddress); 781 782 usb_fill_bulk_urb(urb, data->udev, pipe, 783 skb->data, skb->len, btusb_tx_complete, skb); 784 785 hdev->stat.acl_tx++; 786 break; 787 788 case HCI_SCODATA_PKT: 789 if (!data->isoc_tx_ep || hci_conn_num(hdev, SCO_LINK) < 1) 790 return -ENODEV; 791 792 urb = usb_alloc_urb(BTUSB_MAX_ISOC_FRAMES, GFP_ATOMIC); 793 if (!urb) 794 return -ENOMEM; 795 796 pipe = usb_sndisocpipe(data->udev, 797 data->isoc_tx_ep->bEndpointAddress); 798 799 usb_fill_int_urb(urb, data->udev, pipe, 800 skb->data, skb->len, btusb_isoc_tx_complete, 801 skb, data->isoc_tx_ep->bInterval); 802 803 urb->transfer_flags = URB_ISO_ASAP; 804 805 __fill_isoc_descriptor(urb, skb->len, 806 le16_to_cpu(data->isoc_tx_ep->wMaxPacketSize)); 807 808 hdev->stat.sco_tx++; 809 goto skip_waking; 810 811 default: 812 return -EILSEQ; 813 } 814 815 err = inc_tx(data); 816 if (err) { 817 usb_anchor_urb(urb, &data->deferred); 818 schedule_work(&data->waker); 819 err = 0; 820 goto done; 821 } 822 823 skip_waking: 824 usb_anchor_urb(urb, &data->tx_anchor); 825 826 err = usb_submit_urb(urb, GFP_ATOMIC); 827 if (err < 0) { 828 if (err != -EPERM && err != -ENODEV) 829 BT_ERR("%s urb %p submission failed (%d)", 830 hdev->name, urb, -err); 831 kfree(urb->setup_packet); 832 usb_unanchor_urb(urb); 833 } else { 834 usb_mark_last_busy(data->udev); 835 } 836 837 done: 838 usb_free_urb(urb); 839 return err; 840 } 841 842 static void btusb_notify(struct hci_dev *hdev, unsigned int evt) 843 { 844 struct btusb_data *data = hci_get_drvdata(hdev); 845 846 BT_DBG("%s evt %d", hdev->name, evt); 847 848 if (hci_conn_num(hdev, SCO_LINK) != data->sco_num) { 849 data->sco_num = hci_conn_num(hdev, SCO_LINK); 850 schedule_work(&data->work); 851 } 852 } 853 854 static inline int __set_isoc_interface(struct hci_dev *hdev, int altsetting) 855 { 856 struct btusb_data *data = hci_get_drvdata(hdev); 857 struct usb_interface *intf = data->isoc; 858 struct usb_endpoint_descriptor *ep_desc; 859 int i, err; 860 861 if (!data->isoc) 862 return -ENODEV; 863 864 err = usb_set_interface(data->udev, 1, altsetting); 865 if (err < 0) { 866 BT_ERR("%s setting interface failed (%d)", hdev->name, -err); 867 return err; 868 } 869 870 data->isoc_altsetting = altsetting; 871 872 data->isoc_tx_ep = NULL; 873 data->isoc_rx_ep = NULL; 874 875 for (i = 0; i < intf->cur_altsetting->desc.bNumEndpoints; i++) { 876 ep_desc = &intf->cur_altsetting->endpoint[i].desc; 877 878 if (!data->isoc_tx_ep && usb_endpoint_is_isoc_out(ep_desc)) { 879 data->isoc_tx_ep = ep_desc; 880 continue; 881 } 882 883 if (!data->isoc_rx_ep && usb_endpoint_is_isoc_in(ep_desc)) { 884 data->isoc_rx_ep = ep_desc; 885 continue; 886 } 887 } 888 889 if (!data->isoc_tx_ep || !data->isoc_rx_ep) { 890 BT_ERR("%s invalid SCO descriptors", hdev->name); 891 return -ENODEV; 892 } 893 894 return 0; 895 } 896 897 static void btusb_work(struct work_struct *work) 898 { 899 struct btusb_data *data = container_of(work, struct btusb_data, work); 900 struct hci_dev *hdev = data->hdev; 901 int new_alts; 902 int err; 903 904 if (data->sco_num > 0) { 905 if (!test_bit(BTUSB_DID_ISO_RESUME, &data->flags)) { 906 err = usb_autopm_get_interface(data->isoc ? data->isoc : data->intf); 907 if (err < 0) { 908 clear_bit(BTUSB_ISOC_RUNNING, &data->flags); 909 usb_kill_anchored_urbs(&data->isoc_anchor); 910 return; 911 } 912 913 set_bit(BTUSB_DID_ISO_RESUME, &data->flags); 914 } 915 916 if (hdev->voice_setting & 0x0020) { 917 static const int alts[3] = { 2, 4, 5 }; 918 new_alts = alts[data->sco_num - 1]; 919 } else { 920 new_alts = data->sco_num; 921 } 922 923 if (data->isoc_altsetting != new_alts) { 924 clear_bit(BTUSB_ISOC_RUNNING, &data->flags); 925 usb_kill_anchored_urbs(&data->isoc_anchor); 926 927 if (__set_isoc_interface(hdev, new_alts) < 0) 928 return; 929 } 930 931 if (!test_and_set_bit(BTUSB_ISOC_RUNNING, &data->flags)) { 932 if (btusb_submit_isoc_urb(hdev, GFP_KERNEL) < 0) 933 clear_bit(BTUSB_ISOC_RUNNING, &data->flags); 934 else 935 btusb_submit_isoc_urb(hdev, GFP_KERNEL); 936 } 937 } else { 938 clear_bit(BTUSB_ISOC_RUNNING, &data->flags); 939 usb_kill_anchored_urbs(&data->isoc_anchor); 940 941 __set_isoc_interface(hdev, 0); 942 if (test_and_clear_bit(BTUSB_DID_ISO_RESUME, &data->flags)) 943 usb_autopm_put_interface(data->isoc ? data->isoc : data->intf); 944 } 945 } 946 947 static void btusb_waker(struct work_struct *work) 948 { 949 struct btusb_data *data = container_of(work, struct btusb_data, waker); 950 int err; 951 952 err = usb_autopm_get_interface(data->intf); 953 if (err < 0) 954 return; 955 956 usb_autopm_put_interface(data->intf); 957 } 958 959 static int btusb_setup_bcm92035(struct hci_dev *hdev) 960 { 961 struct sk_buff *skb; 962 u8 val = 0x00; 963 964 BT_DBG("%s", hdev->name); 965 966 skb = __hci_cmd_sync(hdev, 0xfc3b, 1, &val, HCI_INIT_TIMEOUT); 967 if (IS_ERR(skb)) 968 BT_ERR("BCM92035 command failed (%ld)", -PTR_ERR(skb)); 969 else 970 kfree_skb(skb); 971 972 return 0; 973 } 974 975 static int btusb_setup_csr(struct hci_dev *hdev) 976 { 977 struct hci_rp_read_local_version *rp; 978 struct sk_buff *skb; 979 int ret; 980 981 BT_DBG("%s", hdev->name); 982 983 skb = __hci_cmd_sync(hdev, HCI_OP_READ_LOCAL_VERSION, 0, NULL, 984 HCI_INIT_TIMEOUT); 985 if (IS_ERR(skb)) { 986 BT_ERR("Reading local version failed (%ld)", -PTR_ERR(skb)); 987 return -PTR_ERR(skb); 988 } 989 990 rp = (struct hci_rp_read_local_version *) skb->data; 991 992 if (!rp->status) { 993 if (le16_to_cpu(rp->manufacturer) != 10) { 994 /* Clear the reset quirk since this is not an actual 995 * early Bluetooth 1.1 device from CSR. 996 */ 997 clear_bit(HCI_QUIRK_RESET_ON_CLOSE, &hdev->quirks); 998 999 /* These fake CSR controllers have all a broken 1000 * stored link key handling and so just disable it. 1001 */ 1002 set_bit(HCI_QUIRK_BROKEN_STORED_LINK_KEY, 1003 &hdev->quirks); 1004 } 1005 } 1006 1007 ret = -bt_to_errno(rp->status); 1008 1009 kfree_skb(skb); 1010 1011 return ret; 1012 } 1013 1014 struct intel_version { 1015 u8 status; 1016 u8 hw_platform; 1017 u8 hw_variant; 1018 u8 hw_revision; 1019 u8 fw_variant; 1020 u8 fw_revision; 1021 u8 fw_build_num; 1022 u8 fw_build_ww; 1023 u8 fw_build_yy; 1024 u8 fw_patch_num; 1025 } __packed; 1026 1027 static const struct firmware *btusb_setup_intel_get_fw(struct hci_dev *hdev, 1028 struct intel_version *ver) 1029 { 1030 const struct firmware *fw; 1031 char fwname[64]; 1032 int ret; 1033 1034 snprintf(fwname, sizeof(fwname), 1035 "intel/ibt-hw-%x.%x.%x-fw-%x.%x.%x.%x.%x.bseq", 1036 ver->hw_platform, ver->hw_variant, ver->hw_revision, 1037 ver->fw_variant, ver->fw_revision, ver->fw_build_num, 1038 ver->fw_build_ww, ver->fw_build_yy); 1039 1040 ret = request_firmware(&fw, fwname, &hdev->dev); 1041 if (ret < 0) { 1042 if (ret == -EINVAL) { 1043 BT_ERR("%s Intel firmware file request failed (%d)", 1044 hdev->name, ret); 1045 return NULL; 1046 } 1047 1048 BT_ERR("%s failed to open Intel firmware file: %s(%d)", 1049 hdev->name, fwname, ret); 1050 1051 /* If the correct firmware patch file is not found, use the 1052 * default firmware patch file instead 1053 */ 1054 snprintf(fwname, sizeof(fwname), "intel/ibt-hw-%x.%x.bseq", 1055 ver->hw_platform, ver->hw_variant); 1056 if (request_firmware(&fw, fwname, &hdev->dev) < 0) { 1057 BT_ERR("%s failed to open default Intel fw file: %s", 1058 hdev->name, fwname); 1059 return NULL; 1060 } 1061 } 1062 1063 BT_INFO("%s: Intel Bluetooth firmware file: %s", hdev->name, fwname); 1064 1065 return fw; 1066 } 1067 1068 static int btusb_setup_intel_patching(struct hci_dev *hdev, 1069 const struct firmware *fw, 1070 const u8 **fw_ptr, int *disable_patch) 1071 { 1072 struct sk_buff *skb; 1073 struct hci_command_hdr *cmd; 1074 const u8 *cmd_param; 1075 struct hci_event_hdr *evt = NULL; 1076 const u8 *evt_param = NULL; 1077 int remain = fw->size - (*fw_ptr - fw->data); 1078 1079 /* The first byte indicates the types of the patch command or event. 1080 * 0x01 means HCI command and 0x02 is HCI event. If the first bytes 1081 * in the current firmware buffer doesn't start with 0x01 or 1082 * the size of remain buffer is smaller than HCI command header, 1083 * the firmware file is corrupted and it should stop the patching 1084 * process. 1085 */ 1086 if (remain > HCI_COMMAND_HDR_SIZE && *fw_ptr[0] != 0x01) { 1087 BT_ERR("%s Intel fw corrupted: invalid cmd read", hdev->name); 1088 return -EINVAL; 1089 } 1090 (*fw_ptr)++; 1091 remain--; 1092 1093 cmd = (struct hci_command_hdr *)(*fw_ptr); 1094 *fw_ptr += sizeof(*cmd); 1095 remain -= sizeof(*cmd); 1096 1097 /* Ensure that the remain firmware data is long enough than the length 1098 * of command parameter. If not, the firmware file is corrupted. 1099 */ 1100 if (remain < cmd->plen) { 1101 BT_ERR("%s Intel fw corrupted: invalid cmd len", hdev->name); 1102 return -EFAULT; 1103 } 1104 1105 /* If there is a command that loads a patch in the firmware 1106 * file, then enable the patch upon success, otherwise just 1107 * disable the manufacturer mode, for example patch activation 1108 * is not required when the default firmware patch file is used 1109 * because there are no patch data to load. 1110 */ 1111 if (*disable_patch && le16_to_cpu(cmd->opcode) == 0xfc8e) 1112 *disable_patch = 0; 1113 1114 cmd_param = *fw_ptr; 1115 *fw_ptr += cmd->plen; 1116 remain -= cmd->plen; 1117 1118 /* This reads the expected events when the above command is sent to the 1119 * device. Some vendor commands expects more than one events, for 1120 * example command status event followed by vendor specific event. 1121 * For this case, it only keeps the last expected event. so the command 1122 * can be sent with __hci_cmd_sync_ev() which returns the sk_buff of 1123 * last expected event. 1124 */ 1125 while (remain > HCI_EVENT_HDR_SIZE && *fw_ptr[0] == 0x02) { 1126 (*fw_ptr)++; 1127 remain--; 1128 1129 evt = (struct hci_event_hdr *)(*fw_ptr); 1130 *fw_ptr += sizeof(*evt); 1131 remain -= sizeof(*evt); 1132 1133 if (remain < evt->plen) { 1134 BT_ERR("%s Intel fw corrupted: invalid evt len", 1135 hdev->name); 1136 return -EFAULT; 1137 } 1138 1139 evt_param = *fw_ptr; 1140 *fw_ptr += evt->plen; 1141 remain -= evt->plen; 1142 } 1143 1144 /* Every HCI commands in the firmware file has its correspond event. 1145 * If event is not found or remain is smaller than zero, the firmware 1146 * file is corrupted. 1147 */ 1148 if (!evt || !evt_param || remain < 0) { 1149 BT_ERR("%s Intel fw corrupted: invalid evt read", hdev->name); 1150 return -EFAULT; 1151 } 1152 1153 skb = __hci_cmd_sync_ev(hdev, le16_to_cpu(cmd->opcode), cmd->plen, 1154 cmd_param, evt->evt, HCI_INIT_TIMEOUT); 1155 if (IS_ERR(skb)) { 1156 BT_ERR("%s sending Intel patch command (0x%4.4x) failed (%ld)", 1157 hdev->name, cmd->opcode, PTR_ERR(skb)); 1158 return PTR_ERR(skb); 1159 } 1160 1161 /* It ensures that the returned event matches the event data read from 1162 * the firmware file. At fist, it checks the length and then 1163 * the contents of the event. 1164 */ 1165 if (skb->len != evt->plen) { 1166 BT_ERR("%s mismatch event length (opcode 0x%4.4x)", hdev->name, 1167 le16_to_cpu(cmd->opcode)); 1168 kfree_skb(skb); 1169 return -EFAULT; 1170 } 1171 1172 if (memcmp(skb->data, evt_param, evt->plen)) { 1173 BT_ERR("%s mismatch event parameter (opcode 0x%4.4x)", 1174 hdev->name, le16_to_cpu(cmd->opcode)); 1175 kfree_skb(skb); 1176 return -EFAULT; 1177 } 1178 kfree_skb(skb); 1179 1180 return 0; 1181 } 1182 1183 static int btusb_setup_intel(struct hci_dev *hdev) 1184 { 1185 struct sk_buff *skb; 1186 const struct firmware *fw; 1187 const u8 *fw_ptr; 1188 int disable_patch; 1189 struct intel_version *ver; 1190 1191 const u8 mfg_enable[] = { 0x01, 0x00 }; 1192 const u8 mfg_disable[] = { 0x00, 0x00 }; 1193 const u8 mfg_reset_deactivate[] = { 0x00, 0x01 }; 1194 const u8 mfg_reset_activate[] = { 0x00, 0x02 }; 1195 1196 BT_DBG("%s", hdev->name); 1197 1198 /* The controller has a bug with the first HCI command sent to it 1199 * returning number of completed commands as zero. This would stall the 1200 * command processing in the Bluetooth core. 1201 * 1202 * As a workaround, send HCI Reset command first which will reset the 1203 * number of completed commands and allow normal command processing 1204 * from now on. 1205 */ 1206 skb = __hci_cmd_sync(hdev, HCI_OP_RESET, 0, NULL, HCI_INIT_TIMEOUT); 1207 if (IS_ERR(skb)) { 1208 BT_ERR("%s sending initial HCI reset command failed (%ld)", 1209 hdev->name, PTR_ERR(skb)); 1210 return PTR_ERR(skb); 1211 } 1212 kfree_skb(skb); 1213 1214 /* Read Intel specific controller version first to allow selection of 1215 * which firmware file to load. 1216 * 1217 * The returned information are hardware variant and revision plus 1218 * firmware variant, revision and build number. 1219 */ 1220 skb = __hci_cmd_sync(hdev, 0xfc05, 0, NULL, HCI_INIT_TIMEOUT); 1221 if (IS_ERR(skb)) { 1222 BT_ERR("%s reading Intel fw version command failed (%ld)", 1223 hdev->name, PTR_ERR(skb)); 1224 return PTR_ERR(skb); 1225 } 1226 1227 if (skb->len != sizeof(*ver)) { 1228 BT_ERR("%s Intel version event length mismatch", hdev->name); 1229 kfree_skb(skb); 1230 return -EIO; 1231 } 1232 1233 ver = (struct intel_version *)skb->data; 1234 if (ver->status) { 1235 BT_ERR("%s Intel fw version event failed (%02x)", hdev->name, 1236 ver->status); 1237 kfree_skb(skb); 1238 return -bt_to_errno(ver->status); 1239 } 1240 1241 BT_INFO("%s: read Intel version: %02x%02x%02x%02x%02x%02x%02x%02x%02x", 1242 hdev->name, ver->hw_platform, ver->hw_variant, 1243 ver->hw_revision, ver->fw_variant, ver->fw_revision, 1244 ver->fw_build_num, ver->fw_build_ww, ver->fw_build_yy, 1245 ver->fw_patch_num); 1246 1247 /* fw_patch_num indicates the version of patch the device currently 1248 * have. If there is no patch data in the device, it is always 0x00. 1249 * So, if it is other than 0x00, no need to patch the deivce again. 1250 */ 1251 if (ver->fw_patch_num) { 1252 BT_INFO("%s: Intel device is already patched. patch num: %02x", 1253 hdev->name, ver->fw_patch_num); 1254 kfree_skb(skb); 1255 return 0; 1256 } 1257 1258 /* Opens the firmware patch file based on the firmware version read 1259 * from the controller. If it fails to open the matching firmware 1260 * patch file, it tries to open the default firmware patch file. 1261 * If no patch file is found, allow the device to operate without 1262 * a patch. 1263 */ 1264 fw = btusb_setup_intel_get_fw(hdev, ver); 1265 if (!fw) { 1266 kfree_skb(skb); 1267 return 0; 1268 } 1269 fw_ptr = fw->data; 1270 1271 /* This Intel specific command enables the manufacturer mode of the 1272 * controller. 1273 * 1274 * Only while this mode is enabled, the driver can download the 1275 * firmware patch data and configuration parameters. 1276 */ 1277 skb = __hci_cmd_sync(hdev, 0xfc11, 2, mfg_enable, HCI_INIT_TIMEOUT); 1278 if (IS_ERR(skb)) { 1279 BT_ERR("%s entering Intel manufacturer mode failed (%ld)", 1280 hdev->name, PTR_ERR(skb)); 1281 release_firmware(fw); 1282 return PTR_ERR(skb); 1283 } 1284 1285 if (skb->data[0]) { 1286 u8 evt_status = skb->data[0]; 1287 BT_ERR("%s enable Intel manufacturer mode event failed (%02x)", 1288 hdev->name, evt_status); 1289 kfree_skb(skb); 1290 release_firmware(fw); 1291 return -bt_to_errno(evt_status); 1292 } 1293 kfree_skb(skb); 1294 1295 disable_patch = 1; 1296 1297 /* The firmware data file consists of list of Intel specific HCI 1298 * commands and its expected events. The first byte indicates the 1299 * type of the message, either HCI command or HCI event. 1300 * 1301 * It reads the command and its expected event from the firmware file, 1302 * and send to the controller. Once __hci_cmd_sync_ev() returns, 1303 * the returned event is compared with the event read from the firmware 1304 * file and it will continue until all the messages are downloaded to 1305 * the controller. 1306 * 1307 * Once the firmware patching is completed successfully, 1308 * the manufacturer mode is disabled with reset and activating the 1309 * downloaded patch. 1310 * 1311 * If the firmware patching fails, the manufacturer mode is 1312 * disabled with reset and deactivating the patch. 1313 * 1314 * If the default patch file is used, no reset is done when disabling 1315 * the manufacturer. 1316 */ 1317 while (fw->size > fw_ptr - fw->data) { 1318 int ret; 1319 1320 ret = btusb_setup_intel_patching(hdev, fw, &fw_ptr, 1321 &disable_patch); 1322 if (ret < 0) 1323 goto exit_mfg_deactivate; 1324 } 1325 1326 release_firmware(fw); 1327 1328 if (disable_patch) 1329 goto exit_mfg_disable; 1330 1331 /* Patching completed successfully and disable the manufacturer mode 1332 * with reset and activate the downloaded firmware patches. 1333 */ 1334 skb = __hci_cmd_sync(hdev, 0xfc11, sizeof(mfg_reset_activate), 1335 mfg_reset_activate, HCI_INIT_TIMEOUT); 1336 if (IS_ERR(skb)) { 1337 BT_ERR("%s exiting Intel manufacturer mode failed (%ld)", 1338 hdev->name, PTR_ERR(skb)); 1339 return PTR_ERR(skb); 1340 } 1341 kfree_skb(skb); 1342 1343 BT_INFO("%s: Intel Bluetooth firmware patch completed and activated", 1344 hdev->name); 1345 1346 return 0; 1347 1348 exit_mfg_disable: 1349 /* Disable the manufacturer mode without reset */ 1350 skb = __hci_cmd_sync(hdev, 0xfc11, sizeof(mfg_disable), mfg_disable, 1351 HCI_INIT_TIMEOUT); 1352 if (IS_ERR(skb)) { 1353 BT_ERR("%s exiting Intel manufacturer mode failed (%ld)", 1354 hdev->name, PTR_ERR(skb)); 1355 return PTR_ERR(skb); 1356 } 1357 kfree_skb(skb); 1358 1359 BT_INFO("%s: Intel Bluetooth firmware patch completed", hdev->name); 1360 return 0; 1361 1362 exit_mfg_deactivate: 1363 release_firmware(fw); 1364 1365 /* Patching failed. Disable the manufacturer mode with reset and 1366 * deactivate the downloaded firmware patches. 1367 */ 1368 skb = __hci_cmd_sync(hdev, 0xfc11, sizeof(mfg_reset_deactivate), 1369 mfg_reset_deactivate, HCI_INIT_TIMEOUT); 1370 if (IS_ERR(skb)) { 1371 BT_ERR("%s exiting Intel manufacturer mode failed (%ld)", 1372 hdev->name, PTR_ERR(skb)); 1373 return PTR_ERR(skb); 1374 } 1375 kfree_skb(skb); 1376 1377 BT_INFO("%s: Intel Bluetooth firmware patch completed and deactivated", 1378 hdev->name); 1379 1380 return 0; 1381 } 1382 1383 static int btusb_probe(struct usb_interface *intf, 1384 const struct usb_device_id *id) 1385 { 1386 struct usb_endpoint_descriptor *ep_desc; 1387 struct btusb_data *data; 1388 struct hci_dev *hdev; 1389 int i, err; 1390 1391 BT_DBG("intf %p id %p", intf, id); 1392 1393 /* interface numbers are hardcoded in the spec */ 1394 if (intf->cur_altsetting->desc.bInterfaceNumber != 0) 1395 return -ENODEV; 1396 1397 if (!id->driver_info) { 1398 const struct usb_device_id *match; 1399 match = usb_match_id(intf, blacklist_table); 1400 if (match) 1401 id = match; 1402 } 1403 1404 if (id->driver_info == BTUSB_IGNORE) 1405 return -ENODEV; 1406 1407 if (ignore_dga && id->driver_info & BTUSB_DIGIANSWER) 1408 return -ENODEV; 1409 1410 if (ignore_csr && id->driver_info & BTUSB_CSR) 1411 return -ENODEV; 1412 1413 if (ignore_sniffer && id->driver_info & BTUSB_SNIFFER) 1414 return -ENODEV; 1415 1416 if (id->driver_info & BTUSB_ATH3012) { 1417 struct usb_device *udev = interface_to_usbdev(intf); 1418 1419 /* Old firmware would otherwise let ath3k driver load 1420 * patch and sysconfig files */ 1421 if (le16_to_cpu(udev->descriptor.bcdDevice) <= 0x0001) 1422 return -ENODEV; 1423 } 1424 1425 data = devm_kzalloc(&intf->dev, sizeof(*data), GFP_KERNEL); 1426 if (!data) 1427 return -ENOMEM; 1428 1429 for (i = 0; i < intf->cur_altsetting->desc.bNumEndpoints; i++) { 1430 ep_desc = &intf->cur_altsetting->endpoint[i].desc; 1431 1432 if (!data->intr_ep && usb_endpoint_is_int_in(ep_desc)) { 1433 data->intr_ep = ep_desc; 1434 continue; 1435 } 1436 1437 if (!data->bulk_tx_ep && usb_endpoint_is_bulk_out(ep_desc)) { 1438 data->bulk_tx_ep = ep_desc; 1439 continue; 1440 } 1441 1442 if (!data->bulk_rx_ep && usb_endpoint_is_bulk_in(ep_desc)) { 1443 data->bulk_rx_ep = ep_desc; 1444 continue; 1445 } 1446 } 1447 1448 if (!data->intr_ep || !data->bulk_tx_ep || !data->bulk_rx_ep) 1449 return -ENODEV; 1450 1451 data->cmdreq_type = USB_TYPE_CLASS; 1452 1453 data->udev = interface_to_usbdev(intf); 1454 data->intf = intf; 1455 1456 spin_lock_init(&data->lock); 1457 1458 INIT_WORK(&data->work, btusb_work); 1459 INIT_WORK(&data->waker, btusb_waker); 1460 spin_lock_init(&data->txlock); 1461 1462 init_usb_anchor(&data->tx_anchor); 1463 init_usb_anchor(&data->intr_anchor); 1464 init_usb_anchor(&data->bulk_anchor); 1465 init_usb_anchor(&data->isoc_anchor); 1466 init_usb_anchor(&data->deferred); 1467 1468 hdev = hci_alloc_dev(); 1469 if (!hdev) 1470 return -ENOMEM; 1471 1472 hdev->bus = HCI_USB; 1473 hci_set_drvdata(hdev, data); 1474 1475 data->hdev = hdev; 1476 1477 SET_HCIDEV_DEV(hdev, &intf->dev); 1478 1479 hdev->open = btusb_open; 1480 hdev->close = btusb_close; 1481 hdev->flush = btusb_flush; 1482 hdev->send = btusb_send_frame; 1483 hdev->notify = btusb_notify; 1484 1485 if (id->driver_info & BTUSB_BCM92035) 1486 hdev->setup = btusb_setup_bcm92035; 1487 1488 if (id->driver_info & BTUSB_INTEL) { 1489 usb_enable_autosuspend(data->udev); 1490 hdev->setup = btusb_setup_intel; 1491 } 1492 1493 /* Interface numbers are hardcoded in the specification */ 1494 data->isoc = usb_ifnum_to_if(data->udev, 1); 1495 1496 if (!reset) 1497 set_bit(HCI_QUIRK_RESET_ON_CLOSE, &hdev->quirks); 1498 1499 if (force_scofix || id->driver_info & BTUSB_WRONG_SCO_MTU) { 1500 if (!disable_scofix) 1501 set_bit(HCI_QUIRK_FIXUP_BUFFER_SIZE, &hdev->quirks); 1502 } 1503 1504 if (id->driver_info & BTUSB_BROKEN_ISOC) 1505 data->isoc = NULL; 1506 1507 if (id->driver_info & BTUSB_DIGIANSWER) { 1508 data->cmdreq_type = USB_TYPE_VENDOR; 1509 set_bit(HCI_QUIRK_RESET_ON_CLOSE, &hdev->quirks); 1510 } 1511 1512 if (id->driver_info & BTUSB_CSR) { 1513 struct usb_device *udev = data->udev; 1514 u16 bcdDevice = le16_to_cpu(udev->descriptor.bcdDevice); 1515 1516 /* Old firmware would otherwise execute USB reset */ 1517 if (bcdDevice < 0x117) 1518 set_bit(HCI_QUIRK_RESET_ON_CLOSE, &hdev->quirks); 1519 1520 /* Fake CSR devices with broken commands */ 1521 if (bcdDevice <= 0x100) 1522 hdev->setup = btusb_setup_csr; 1523 } 1524 1525 if (id->driver_info & BTUSB_SNIFFER) { 1526 struct usb_device *udev = data->udev; 1527 1528 /* New sniffer firmware has crippled HCI interface */ 1529 if (le16_to_cpu(udev->descriptor.bcdDevice) > 0x997) 1530 set_bit(HCI_QUIRK_RAW_DEVICE, &hdev->quirks); 1531 1532 data->isoc = NULL; 1533 } 1534 1535 if (data->isoc) { 1536 err = usb_driver_claim_interface(&btusb_driver, 1537 data->isoc, data); 1538 if (err < 0) { 1539 hci_free_dev(hdev); 1540 return err; 1541 } 1542 } 1543 1544 err = hci_register_dev(hdev); 1545 if (err < 0) { 1546 hci_free_dev(hdev); 1547 return err; 1548 } 1549 1550 usb_set_intfdata(intf, data); 1551 1552 return 0; 1553 } 1554 1555 static void btusb_disconnect(struct usb_interface *intf) 1556 { 1557 struct btusb_data *data = usb_get_intfdata(intf); 1558 struct hci_dev *hdev; 1559 1560 BT_DBG("intf %p", intf); 1561 1562 if (!data) 1563 return; 1564 1565 hdev = data->hdev; 1566 usb_set_intfdata(data->intf, NULL); 1567 1568 if (data->isoc) 1569 usb_set_intfdata(data->isoc, NULL); 1570 1571 hci_unregister_dev(hdev); 1572 1573 if (intf == data->isoc) 1574 usb_driver_release_interface(&btusb_driver, data->intf); 1575 else if (data->isoc) 1576 usb_driver_release_interface(&btusb_driver, data->isoc); 1577 1578 hci_free_dev(hdev); 1579 } 1580 1581 #ifdef CONFIG_PM 1582 static int btusb_suspend(struct usb_interface *intf, pm_message_t message) 1583 { 1584 struct btusb_data *data = usb_get_intfdata(intf); 1585 1586 BT_DBG("intf %p", intf); 1587 1588 if (data->suspend_count++) 1589 return 0; 1590 1591 spin_lock_irq(&data->txlock); 1592 if (!(PMSG_IS_AUTO(message) && data->tx_in_flight)) { 1593 set_bit(BTUSB_SUSPENDING, &data->flags); 1594 spin_unlock_irq(&data->txlock); 1595 } else { 1596 spin_unlock_irq(&data->txlock); 1597 data->suspend_count--; 1598 return -EBUSY; 1599 } 1600 1601 cancel_work_sync(&data->work); 1602 1603 btusb_stop_traffic(data); 1604 usb_kill_anchored_urbs(&data->tx_anchor); 1605 1606 return 0; 1607 } 1608 1609 static void play_deferred(struct btusb_data *data) 1610 { 1611 struct urb *urb; 1612 int err; 1613 1614 while ((urb = usb_get_from_anchor(&data->deferred))) { 1615 err = usb_submit_urb(urb, GFP_ATOMIC); 1616 if (err < 0) 1617 break; 1618 1619 data->tx_in_flight++; 1620 } 1621 usb_scuttle_anchored_urbs(&data->deferred); 1622 } 1623 1624 static int btusb_resume(struct usb_interface *intf) 1625 { 1626 struct btusb_data *data = usb_get_intfdata(intf); 1627 struct hci_dev *hdev = data->hdev; 1628 int err = 0; 1629 1630 BT_DBG("intf %p", intf); 1631 1632 if (--data->suspend_count) 1633 return 0; 1634 1635 if (!test_bit(HCI_RUNNING, &hdev->flags)) 1636 goto done; 1637 1638 if (test_bit(BTUSB_INTR_RUNNING, &data->flags)) { 1639 err = btusb_submit_intr_urb(hdev, GFP_NOIO); 1640 if (err < 0) { 1641 clear_bit(BTUSB_INTR_RUNNING, &data->flags); 1642 goto failed; 1643 } 1644 } 1645 1646 if (test_bit(BTUSB_BULK_RUNNING, &data->flags)) { 1647 err = btusb_submit_bulk_urb(hdev, GFP_NOIO); 1648 if (err < 0) { 1649 clear_bit(BTUSB_BULK_RUNNING, &data->flags); 1650 goto failed; 1651 } 1652 1653 btusb_submit_bulk_urb(hdev, GFP_NOIO); 1654 } 1655 1656 if (test_bit(BTUSB_ISOC_RUNNING, &data->flags)) { 1657 if (btusb_submit_isoc_urb(hdev, GFP_NOIO) < 0) 1658 clear_bit(BTUSB_ISOC_RUNNING, &data->flags); 1659 else 1660 btusb_submit_isoc_urb(hdev, GFP_NOIO); 1661 } 1662 1663 spin_lock_irq(&data->txlock); 1664 play_deferred(data); 1665 clear_bit(BTUSB_SUSPENDING, &data->flags); 1666 spin_unlock_irq(&data->txlock); 1667 schedule_work(&data->work); 1668 1669 return 0; 1670 1671 failed: 1672 usb_scuttle_anchored_urbs(&data->deferred); 1673 done: 1674 spin_lock_irq(&data->txlock); 1675 clear_bit(BTUSB_SUSPENDING, &data->flags); 1676 spin_unlock_irq(&data->txlock); 1677 1678 return err; 1679 } 1680 #endif 1681 1682 static struct usb_driver btusb_driver = { 1683 .name = "btusb", 1684 .probe = btusb_probe, 1685 .disconnect = btusb_disconnect, 1686 #ifdef CONFIG_PM 1687 .suspend = btusb_suspend, 1688 .resume = btusb_resume, 1689 #endif 1690 .id_table = btusb_table, 1691 .supports_autosuspend = 1, 1692 .disable_hub_initiated_lpm = 1, 1693 }; 1694 1695 module_usb_driver(btusb_driver); 1696 1697 module_param(ignore_dga, bool, 0644); 1698 MODULE_PARM_DESC(ignore_dga, "Ignore devices with id 08fd:0001"); 1699 1700 module_param(ignore_csr, bool, 0644); 1701 MODULE_PARM_DESC(ignore_csr, "Ignore devices with id 0a12:0001"); 1702 1703 module_param(ignore_sniffer, bool, 0644); 1704 MODULE_PARM_DESC(ignore_sniffer, "Ignore devices with id 0a12:0002"); 1705 1706 module_param(disable_scofix, bool, 0644); 1707 MODULE_PARM_DESC(disable_scofix, "Disable fixup of wrong SCO buffer size"); 1708 1709 module_param(force_scofix, bool, 0644); 1710 MODULE_PARM_DESC(force_scofix, "Force fixup of wrong SCO buffers size"); 1711 1712 module_param(reset, bool, 0644); 1713 MODULE_PARM_DESC(reset, "Send HCI reset command on initialization"); 1714 1715 MODULE_AUTHOR("Marcel Holtmann <marcel@holtmann.org>"); 1716 MODULE_DESCRIPTION("Generic Bluetooth USB driver ver " VERSION); 1717 MODULE_VERSION(VERSION); 1718 MODULE_LICENSE("GPL"); 1719