1 /* 2 * 3 * Generic Bluetooth USB driver 4 * 5 * Copyright (C) 2005-2008 Marcel Holtmann <marcel@holtmann.org> 6 * 7 * 8 * This program is free software; you can redistribute it and/or modify 9 * it under the terms of the GNU General Public License as published by 10 * the Free Software Foundation; either version 2 of the License, or 11 * (at your option) any later version. 12 * 13 * This program is distributed in the hope that it will be useful, 14 * but WITHOUT ANY WARRANTY; without even the implied warranty of 15 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the 16 * GNU General Public License for more details. 17 * 18 * You should have received a copy of the GNU General Public License 19 * along with this program; if not, write to the Free Software 20 * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA 21 * 22 */ 23 24 #include <linux/module.h> 25 #include <linux/usb.h> 26 #include <linux/firmware.h> 27 28 #include <net/bluetooth/bluetooth.h> 29 #include <net/bluetooth/hci_core.h> 30 31 #define VERSION "0.6" 32 33 static bool ignore_dga; 34 static bool ignore_csr; 35 static bool ignore_sniffer; 36 static bool disable_scofix; 37 static bool force_scofix; 38 39 static bool reset = 1; 40 41 static struct usb_driver btusb_driver; 42 43 #define BTUSB_IGNORE 0x01 44 #define BTUSB_DIGIANSWER 0x02 45 #define BTUSB_CSR 0x04 46 #define BTUSB_SNIFFER 0x08 47 #define BTUSB_BCM92035 0x10 48 #define BTUSB_BROKEN_ISOC 0x20 49 #define BTUSB_WRONG_SCO_MTU 0x40 50 #define BTUSB_ATH3012 0x80 51 #define BTUSB_INTEL 0x100 52 53 static struct usb_device_id btusb_table[] = { 54 /* Generic Bluetooth USB device */ 55 { USB_DEVICE_INFO(0xe0, 0x01, 0x01) }, 56 57 /* Apple-specific (Broadcom) devices */ 58 { USB_VENDOR_AND_INTERFACE_INFO(0x05ac, 0xff, 0x01, 0x01) }, 59 60 /* MediaTek MT76x0E */ 61 { USB_DEVICE(0x0e8d, 0x763f) }, 62 63 /* Broadcom SoftSailing reporting vendor specific */ 64 { USB_DEVICE(0x0a5c, 0x21e1) }, 65 66 /* Apple MacBookPro 7,1 */ 67 { USB_DEVICE(0x05ac, 0x8213) }, 68 69 /* Apple iMac11,1 */ 70 { USB_DEVICE(0x05ac, 0x8215) }, 71 72 /* Apple MacBookPro6,2 */ 73 { USB_DEVICE(0x05ac, 0x8218) }, 74 75 /* Apple MacBookAir3,1, MacBookAir3,2 */ 76 { USB_DEVICE(0x05ac, 0x821b) }, 77 78 /* Apple MacBookAir4,1 */ 79 { USB_DEVICE(0x05ac, 0x821f) }, 80 81 /* Apple MacBookPro8,2 */ 82 { USB_DEVICE(0x05ac, 0x821a) }, 83 84 /* Apple MacMini5,1 */ 85 { USB_DEVICE(0x05ac, 0x8281) }, 86 87 /* AVM BlueFRITZ! USB v2.0 */ 88 { USB_DEVICE(0x057c, 0x3800) }, 89 90 /* Bluetooth Ultraport Module from IBM */ 91 { USB_DEVICE(0x04bf, 0x030a) }, 92 93 /* ALPS Modules with non-standard id */ 94 { USB_DEVICE(0x044e, 0x3001) }, 95 { USB_DEVICE(0x044e, 0x3002) }, 96 97 /* Ericsson with non-standard id */ 98 { USB_DEVICE(0x0bdb, 0x1002) }, 99 100 /* Canyon CN-BTU1 with HID interfaces */ 101 { USB_DEVICE(0x0c10, 0x0000) }, 102 103 /* Broadcom BCM20702A0 */ 104 { USB_DEVICE(0x0b05, 0x17b5) }, 105 { USB_DEVICE(0x04ca, 0x2003) }, 106 { USB_DEVICE(0x0489, 0xe042) }, 107 { USB_DEVICE(0x413c, 0x8197) }, 108 109 /* Foxconn - Hon Hai */ 110 { USB_VENDOR_AND_INTERFACE_INFO(0x0489, 0xff, 0x01, 0x01) }, 111 112 /*Broadcom devices with vendor specific id */ 113 { USB_VENDOR_AND_INTERFACE_INFO(0x0a5c, 0xff, 0x01, 0x01) }, 114 115 { } /* Terminating entry */ 116 }; 117 118 MODULE_DEVICE_TABLE(usb, btusb_table); 119 120 static struct usb_device_id blacklist_table[] = { 121 /* CSR BlueCore devices */ 122 { USB_DEVICE(0x0a12, 0x0001), .driver_info = BTUSB_CSR }, 123 124 /* Broadcom BCM2033 without firmware */ 125 { USB_DEVICE(0x0a5c, 0x2033), .driver_info = BTUSB_IGNORE }, 126 127 /* Atheros 3011 with sflash firmware */ 128 { USB_DEVICE(0x0cf3, 0x3002), .driver_info = BTUSB_IGNORE }, 129 { USB_DEVICE(0x0cf3, 0xe019), .driver_info = BTUSB_IGNORE }, 130 { USB_DEVICE(0x13d3, 0x3304), .driver_info = BTUSB_IGNORE }, 131 { USB_DEVICE(0x0930, 0x0215), .driver_info = BTUSB_IGNORE }, 132 { USB_DEVICE(0x0489, 0xe03d), .driver_info = BTUSB_IGNORE }, 133 { USB_DEVICE(0x0489, 0xe027), .driver_info = BTUSB_IGNORE }, 134 135 /* Atheros AR9285 Malbec with sflash firmware */ 136 { USB_DEVICE(0x03f0, 0x311d), .driver_info = BTUSB_IGNORE }, 137 138 /* Atheros 3012 with sflash firmware */ 139 { USB_DEVICE(0x0cf3, 0x0036), .driver_info = BTUSB_ATH3012 }, 140 { USB_DEVICE(0x0cf3, 0x3004), .driver_info = BTUSB_ATH3012 }, 141 { USB_DEVICE(0x0cf3, 0x3008), .driver_info = BTUSB_ATH3012 }, 142 { USB_DEVICE(0x0cf3, 0x311d), .driver_info = BTUSB_ATH3012 }, 143 { USB_DEVICE(0x0cf3, 0x817a), .driver_info = BTUSB_ATH3012 }, 144 { USB_DEVICE(0x13d3, 0x3375), .driver_info = BTUSB_ATH3012 }, 145 { USB_DEVICE(0x04ca, 0x3004), .driver_info = BTUSB_ATH3012 }, 146 { USB_DEVICE(0x04ca, 0x3005), .driver_info = BTUSB_ATH3012 }, 147 { USB_DEVICE(0x04ca, 0x3006), .driver_info = BTUSB_ATH3012 }, 148 { USB_DEVICE(0x04ca, 0x3008), .driver_info = BTUSB_ATH3012 }, 149 { USB_DEVICE(0x13d3, 0x3362), .driver_info = BTUSB_ATH3012 }, 150 { USB_DEVICE(0x0cf3, 0xe004), .driver_info = BTUSB_ATH3012 }, 151 { USB_DEVICE(0x0930, 0x0219), .driver_info = BTUSB_ATH3012 }, 152 { USB_DEVICE(0x0489, 0xe057), .driver_info = BTUSB_ATH3012 }, 153 { USB_DEVICE(0x13d3, 0x3393), .driver_info = BTUSB_ATH3012 }, 154 { USB_DEVICE(0x0489, 0xe04e), .driver_info = BTUSB_ATH3012 }, 155 { USB_DEVICE(0x0489, 0xe056), .driver_info = BTUSB_ATH3012 }, 156 { USB_DEVICE(0x0489, 0xe04d), .driver_info = BTUSB_ATH3012 }, 157 { USB_DEVICE(0x04c5, 0x1330), .driver_info = BTUSB_ATH3012 }, 158 { USB_DEVICE(0x13d3, 0x3402), .driver_info = BTUSB_ATH3012 }, 159 { USB_DEVICE(0x0cf3, 0x3121), .driver_info = BTUSB_ATH3012 }, 160 { USB_DEVICE(0x0cf3, 0xe003), .driver_info = BTUSB_ATH3012 }, 161 162 /* Atheros AR5BBU12 with sflash firmware */ 163 { USB_DEVICE(0x0489, 0xe02c), .driver_info = BTUSB_IGNORE }, 164 165 /* Atheros AR5BBU12 with sflash firmware */ 166 { USB_DEVICE(0x0489, 0xe03c), .driver_info = BTUSB_ATH3012 }, 167 { USB_DEVICE(0x0489, 0xe036), .driver_info = BTUSB_ATH3012 }, 168 169 /* Broadcom BCM2035 */ 170 { USB_DEVICE(0x0a5c, 0x2035), .driver_info = BTUSB_WRONG_SCO_MTU }, 171 { USB_DEVICE(0x0a5c, 0x200a), .driver_info = BTUSB_WRONG_SCO_MTU }, 172 { USB_DEVICE(0x0a5c, 0x2009), .driver_info = BTUSB_BCM92035 }, 173 174 /* Broadcom BCM2045 */ 175 { USB_DEVICE(0x0a5c, 0x2039), .driver_info = BTUSB_WRONG_SCO_MTU }, 176 { USB_DEVICE(0x0a5c, 0x2101), .driver_info = BTUSB_WRONG_SCO_MTU }, 177 178 /* IBM/Lenovo ThinkPad with Broadcom chip */ 179 { USB_DEVICE(0x0a5c, 0x201e), .driver_info = BTUSB_WRONG_SCO_MTU }, 180 { USB_DEVICE(0x0a5c, 0x2110), .driver_info = BTUSB_WRONG_SCO_MTU }, 181 182 /* HP laptop with Broadcom chip */ 183 { USB_DEVICE(0x03f0, 0x171d), .driver_info = BTUSB_WRONG_SCO_MTU }, 184 185 /* Dell laptop with Broadcom chip */ 186 { USB_DEVICE(0x413c, 0x8126), .driver_info = BTUSB_WRONG_SCO_MTU }, 187 188 /* Dell Wireless 370 and 410 devices */ 189 { USB_DEVICE(0x413c, 0x8152), .driver_info = BTUSB_WRONG_SCO_MTU }, 190 { USB_DEVICE(0x413c, 0x8156), .driver_info = BTUSB_WRONG_SCO_MTU }, 191 192 /* Belkin F8T012 and F8T013 devices */ 193 { USB_DEVICE(0x050d, 0x0012), .driver_info = BTUSB_WRONG_SCO_MTU }, 194 { USB_DEVICE(0x050d, 0x0013), .driver_info = BTUSB_WRONG_SCO_MTU }, 195 196 /* Asus WL-BTD202 device */ 197 { USB_DEVICE(0x0b05, 0x1715), .driver_info = BTUSB_WRONG_SCO_MTU }, 198 199 /* Kensington Bluetooth USB adapter */ 200 { USB_DEVICE(0x047d, 0x105e), .driver_info = BTUSB_WRONG_SCO_MTU }, 201 202 /* RTX Telecom based adapters with buggy SCO support */ 203 { USB_DEVICE(0x0400, 0x0807), .driver_info = BTUSB_BROKEN_ISOC }, 204 { USB_DEVICE(0x0400, 0x080a), .driver_info = BTUSB_BROKEN_ISOC }, 205 206 /* CONWISE Technology based adapters with buggy SCO support */ 207 { USB_DEVICE(0x0e5e, 0x6622), .driver_info = BTUSB_BROKEN_ISOC }, 208 209 /* Digianswer devices */ 210 { USB_DEVICE(0x08fd, 0x0001), .driver_info = BTUSB_DIGIANSWER }, 211 { USB_DEVICE(0x08fd, 0x0002), .driver_info = BTUSB_IGNORE }, 212 213 /* CSR BlueCore Bluetooth Sniffer */ 214 { USB_DEVICE(0x0a12, 0x0002), .driver_info = BTUSB_SNIFFER }, 215 216 /* Frontline ComProbe Bluetooth Sniffer */ 217 { USB_DEVICE(0x16d3, 0x0002), .driver_info = BTUSB_SNIFFER }, 218 219 /* Intel Bluetooth device */ 220 { USB_DEVICE(0x8087, 0x07dc), .driver_info = BTUSB_INTEL }, 221 222 { } /* Terminating entry */ 223 }; 224 225 #define BTUSB_MAX_ISOC_FRAMES 10 226 227 #define BTUSB_INTR_RUNNING 0 228 #define BTUSB_BULK_RUNNING 1 229 #define BTUSB_ISOC_RUNNING 2 230 #define BTUSB_SUSPENDING 3 231 #define BTUSB_DID_ISO_RESUME 4 232 233 struct btusb_data { 234 struct hci_dev *hdev; 235 struct usb_device *udev; 236 struct usb_interface *intf; 237 struct usb_interface *isoc; 238 239 spinlock_t lock; 240 241 unsigned long flags; 242 243 struct work_struct work; 244 struct work_struct waker; 245 246 struct usb_anchor tx_anchor; 247 struct usb_anchor intr_anchor; 248 struct usb_anchor bulk_anchor; 249 struct usb_anchor isoc_anchor; 250 struct usb_anchor deferred; 251 int tx_in_flight; 252 spinlock_t txlock; 253 254 struct usb_endpoint_descriptor *intr_ep; 255 struct usb_endpoint_descriptor *bulk_tx_ep; 256 struct usb_endpoint_descriptor *bulk_rx_ep; 257 struct usb_endpoint_descriptor *isoc_tx_ep; 258 struct usb_endpoint_descriptor *isoc_rx_ep; 259 260 __u8 cmdreq_type; 261 262 unsigned int sco_num; 263 int isoc_altsetting; 264 int suspend_count; 265 }; 266 267 static int inc_tx(struct btusb_data *data) 268 { 269 unsigned long flags; 270 int rv; 271 272 spin_lock_irqsave(&data->txlock, flags); 273 rv = test_bit(BTUSB_SUSPENDING, &data->flags); 274 if (!rv) 275 data->tx_in_flight++; 276 spin_unlock_irqrestore(&data->txlock, flags); 277 278 return rv; 279 } 280 281 static void btusb_intr_complete(struct urb *urb) 282 { 283 struct hci_dev *hdev = urb->context; 284 struct btusb_data *data = hci_get_drvdata(hdev); 285 int err; 286 287 BT_DBG("%s urb %p status %d count %d", hdev->name, 288 urb, urb->status, urb->actual_length); 289 290 if (!test_bit(HCI_RUNNING, &hdev->flags)) 291 return; 292 293 if (urb->status == 0) { 294 hdev->stat.byte_rx += urb->actual_length; 295 296 if (hci_recv_fragment(hdev, HCI_EVENT_PKT, 297 urb->transfer_buffer, 298 urb->actual_length) < 0) { 299 BT_ERR("%s corrupted event packet", hdev->name); 300 hdev->stat.err_rx++; 301 } 302 } 303 304 if (!test_bit(BTUSB_INTR_RUNNING, &data->flags)) 305 return; 306 307 usb_mark_last_busy(data->udev); 308 usb_anchor_urb(urb, &data->intr_anchor); 309 310 err = usb_submit_urb(urb, GFP_ATOMIC); 311 if (err < 0) { 312 /* -EPERM: urb is being killed; 313 * -ENODEV: device got disconnected */ 314 if (err != -EPERM && err != -ENODEV) 315 BT_ERR("%s urb %p failed to resubmit (%d)", 316 hdev->name, urb, -err); 317 usb_unanchor_urb(urb); 318 } 319 } 320 321 static int btusb_submit_intr_urb(struct hci_dev *hdev, gfp_t mem_flags) 322 { 323 struct btusb_data *data = hci_get_drvdata(hdev); 324 struct urb *urb; 325 unsigned char *buf; 326 unsigned int pipe; 327 int err, size; 328 329 BT_DBG("%s", hdev->name); 330 331 if (!data->intr_ep) 332 return -ENODEV; 333 334 urb = usb_alloc_urb(0, mem_flags); 335 if (!urb) 336 return -ENOMEM; 337 338 size = le16_to_cpu(data->intr_ep->wMaxPacketSize); 339 340 buf = kmalloc(size, mem_flags); 341 if (!buf) { 342 usb_free_urb(urb); 343 return -ENOMEM; 344 } 345 346 pipe = usb_rcvintpipe(data->udev, data->intr_ep->bEndpointAddress); 347 348 usb_fill_int_urb(urb, data->udev, pipe, buf, size, 349 btusb_intr_complete, hdev, 350 data->intr_ep->bInterval); 351 352 urb->transfer_flags |= URB_FREE_BUFFER; 353 354 usb_anchor_urb(urb, &data->intr_anchor); 355 356 err = usb_submit_urb(urb, mem_flags); 357 if (err < 0) { 358 if (err != -EPERM && err != -ENODEV) 359 BT_ERR("%s urb %p submission failed (%d)", 360 hdev->name, urb, -err); 361 usb_unanchor_urb(urb); 362 } 363 364 usb_free_urb(urb); 365 366 return err; 367 } 368 369 static void btusb_bulk_complete(struct urb *urb) 370 { 371 struct hci_dev *hdev = urb->context; 372 struct btusb_data *data = hci_get_drvdata(hdev); 373 int err; 374 375 BT_DBG("%s urb %p status %d count %d", hdev->name, 376 urb, urb->status, urb->actual_length); 377 378 if (!test_bit(HCI_RUNNING, &hdev->flags)) 379 return; 380 381 if (urb->status == 0) { 382 hdev->stat.byte_rx += urb->actual_length; 383 384 if (hci_recv_fragment(hdev, HCI_ACLDATA_PKT, 385 urb->transfer_buffer, 386 urb->actual_length) < 0) { 387 BT_ERR("%s corrupted ACL packet", hdev->name); 388 hdev->stat.err_rx++; 389 } 390 } 391 392 if (!test_bit(BTUSB_BULK_RUNNING, &data->flags)) 393 return; 394 395 usb_anchor_urb(urb, &data->bulk_anchor); 396 usb_mark_last_busy(data->udev); 397 398 err = usb_submit_urb(urb, GFP_ATOMIC); 399 if (err < 0) { 400 /* -EPERM: urb is being killed; 401 * -ENODEV: device got disconnected */ 402 if (err != -EPERM && err != -ENODEV) 403 BT_ERR("%s urb %p failed to resubmit (%d)", 404 hdev->name, urb, -err); 405 usb_unanchor_urb(urb); 406 } 407 } 408 409 static int btusb_submit_bulk_urb(struct hci_dev *hdev, gfp_t mem_flags) 410 { 411 struct btusb_data *data = hci_get_drvdata(hdev); 412 struct urb *urb; 413 unsigned char *buf; 414 unsigned int pipe; 415 int err, size = HCI_MAX_FRAME_SIZE; 416 417 BT_DBG("%s", hdev->name); 418 419 if (!data->bulk_rx_ep) 420 return -ENODEV; 421 422 urb = usb_alloc_urb(0, mem_flags); 423 if (!urb) 424 return -ENOMEM; 425 426 buf = kmalloc(size, mem_flags); 427 if (!buf) { 428 usb_free_urb(urb); 429 return -ENOMEM; 430 } 431 432 pipe = usb_rcvbulkpipe(data->udev, data->bulk_rx_ep->bEndpointAddress); 433 434 usb_fill_bulk_urb(urb, data->udev, pipe, 435 buf, size, btusb_bulk_complete, hdev); 436 437 urb->transfer_flags |= URB_FREE_BUFFER; 438 439 usb_mark_last_busy(data->udev); 440 usb_anchor_urb(urb, &data->bulk_anchor); 441 442 err = usb_submit_urb(urb, mem_flags); 443 if (err < 0) { 444 if (err != -EPERM && err != -ENODEV) 445 BT_ERR("%s urb %p submission failed (%d)", 446 hdev->name, urb, -err); 447 usb_unanchor_urb(urb); 448 } 449 450 usb_free_urb(urb); 451 452 return err; 453 } 454 455 static void btusb_isoc_complete(struct urb *urb) 456 { 457 struct hci_dev *hdev = urb->context; 458 struct btusb_data *data = hci_get_drvdata(hdev); 459 int i, err; 460 461 BT_DBG("%s urb %p status %d count %d", hdev->name, 462 urb, urb->status, urb->actual_length); 463 464 if (!test_bit(HCI_RUNNING, &hdev->flags)) 465 return; 466 467 if (urb->status == 0) { 468 for (i = 0; i < urb->number_of_packets; i++) { 469 unsigned int offset = urb->iso_frame_desc[i].offset; 470 unsigned int length = urb->iso_frame_desc[i].actual_length; 471 472 if (urb->iso_frame_desc[i].status) 473 continue; 474 475 hdev->stat.byte_rx += length; 476 477 if (hci_recv_fragment(hdev, HCI_SCODATA_PKT, 478 urb->transfer_buffer + offset, 479 length) < 0) { 480 BT_ERR("%s corrupted SCO packet", hdev->name); 481 hdev->stat.err_rx++; 482 } 483 } 484 } 485 486 if (!test_bit(BTUSB_ISOC_RUNNING, &data->flags)) 487 return; 488 489 usb_anchor_urb(urb, &data->isoc_anchor); 490 491 err = usb_submit_urb(urb, GFP_ATOMIC); 492 if (err < 0) { 493 /* -EPERM: urb is being killed; 494 * -ENODEV: device got disconnected */ 495 if (err != -EPERM && err != -ENODEV) 496 BT_ERR("%s urb %p failed to resubmit (%d)", 497 hdev->name, urb, -err); 498 usb_unanchor_urb(urb); 499 } 500 } 501 502 static inline void __fill_isoc_descriptor(struct urb *urb, int len, int mtu) 503 { 504 int i, offset = 0; 505 506 BT_DBG("len %d mtu %d", len, mtu); 507 508 for (i = 0; i < BTUSB_MAX_ISOC_FRAMES && len >= mtu; 509 i++, offset += mtu, len -= mtu) { 510 urb->iso_frame_desc[i].offset = offset; 511 urb->iso_frame_desc[i].length = mtu; 512 } 513 514 if (len && i < BTUSB_MAX_ISOC_FRAMES) { 515 urb->iso_frame_desc[i].offset = offset; 516 urb->iso_frame_desc[i].length = len; 517 i++; 518 } 519 520 urb->number_of_packets = i; 521 } 522 523 static int btusb_submit_isoc_urb(struct hci_dev *hdev, gfp_t mem_flags) 524 { 525 struct btusb_data *data = hci_get_drvdata(hdev); 526 struct urb *urb; 527 unsigned char *buf; 528 unsigned int pipe; 529 int err, size; 530 531 BT_DBG("%s", hdev->name); 532 533 if (!data->isoc_rx_ep) 534 return -ENODEV; 535 536 urb = usb_alloc_urb(BTUSB_MAX_ISOC_FRAMES, mem_flags); 537 if (!urb) 538 return -ENOMEM; 539 540 size = le16_to_cpu(data->isoc_rx_ep->wMaxPacketSize) * 541 BTUSB_MAX_ISOC_FRAMES; 542 543 buf = kmalloc(size, mem_flags); 544 if (!buf) { 545 usb_free_urb(urb); 546 return -ENOMEM; 547 } 548 549 pipe = usb_rcvisocpipe(data->udev, data->isoc_rx_ep->bEndpointAddress); 550 551 usb_fill_int_urb(urb, data->udev, pipe, buf, size, btusb_isoc_complete, 552 hdev, data->isoc_rx_ep->bInterval); 553 554 urb->transfer_flags = URB_FREE_BUFFER | URB_ISO_ASAP; 555 556 __fill_isoc_descriptor(urb, size, 557 le16_to_cpu(data->isoc_rx_ep->wMaxPacketSize)); 558 559 usb_anchor_urb(urb, &data->isoc_anchor); 560 561 err = usb_submit_urb(urb, mem_flags); 562 if (err < 0) { 563 if (err != -EPERM && err != -ENODEV) 564 BT_ERR("%s urb %p submission failed (%d)", 565 hdev->name, urb, -err); 566 usb_unanchor_urb(urb); 567 } 568 569 usb_free_urb(urb); 570 571 return err; 572 } 573 574 static void btusb_tx_complete(struct urb *urb) 575 { 576 struct sk_buff *skb = urb->context; 577 struct hci_dev *hdev = (struct hci_dev *) skb->dev; 578 struct btusb_data *data = hci_get_drvdata(hdev); 579 580 BT_DBG("%s urb %p status %d count %d", hdev->name, 581 urb, urb->status, urb->actual_length); 582 583 if (!test_bit(HCI_RUNNING, &hdev->flags)) 584 goto done; 585 586 if (!urb->status) 587 hdev->stat.byte_tx += urb->transfer_buffer_length; 588 else 589 hdev->stat.err_tx++; 590 591 done: 592 spin_lock(&data->txlock); 593 data->tx_in_flight--; 594 spin_unlock(&data->txlock); 595 596 kfree(urb->setup_packet); 597 598 kfree_skb(skb); 599 } 600 601 static void btusb_isoc_tx_complete(struct urb *urb) 602 { 603 struct sk_buff *skb = urb->context; 604 struct hci_dev *hdev = (struct hci_dev *) skb->dev; 605 606 BT_DBG("%s urb %p status %d count %d", hdev->name, 607 urb, urb->status, urb->actual_length); 608 609 if (!test_bit(HCI_RUNNING, &hdev->flags)) 610 goto done; 611 612 if (!urb->status) 613 hdev->stat.byte_tx += urb->transfer_buffer_length; 614 else 615 hdev->stat.err_tx++; 616 617 done: 618 kfree(urb->setup_packet); 619 620 kfree_skb(skb); 621 } 622 623 static int btusb_open(struct hci_dev *hdev) 624 { 625 struct btusb_data *data = hci_get_drvdata(hdev); 626 int err; 627 628 BT_DBG("%s", hdev->name); 629 630 err = usb_autopm_get_interface(data->intf); 631 if (err < 0) 632 return err; 633 634 data->intf->needs_remote_wakeup = 1; 635 636 if (test_and_set_bit(HCI_RUNNING, &hdev->flags)) 637 goto done; 638 639 if (test_and_set_bit(BTUSB_INTR_RUNNING, &data->flags)) 640 goto done; 641 642 err = btusb_submit_intr_urb(hdev, GFP_KERNEL); 643 if (err < 0) 644 goto failed; 645 646 err = btusb_submit_bulk_urb(hdev, GFP_KERNEL); 647 if (err < 0) { 648 usb_kill_anchored_urbs(&data->intr_anchor); 649 goto failed; 650 } 651 652 set_bit(BTUSB_BULK_RUNNING, &data->flags); 653 btusb_submit_bulk_urb(hdev, GFP_KERNEL); 654 655 done: 656 usb_autopm_put_interface(data->intf); 657 return 0; 658 659 failed: 660 clear_bit(BTUSB_INTR_RUNNING, &data->flags); 661 clear_bit(HCI_RUNNING, &hdev->flags); 662 usb_autopm_put_interface(data->intf); 663 return err; 664 } 665 666 static void btusb_stop_traffic(struct btusb_data *data) 667 { 668 usb_kill_anchored_urbs(&data->intr_anchor); 669 usb_kill_anchored_urbs(&data->bulk_anchor); 670 usb_kill_anchored_urbs(&data->isoc_anchor); 671 } 672 673 static int btusb_close(struct hci_dev *hdev) 674 { 675 struct btusb_data *data = hci_get_drvdata(hdev); 676 int err; 677 678 BT_DBG("%s", hdev->name); 679 680 if (!test_and_clear_bit(HCI_RUNNING, &hdev->flags)) 681 return 0; 682 683 cancel_work_sync(&data->work); 684 cancel_work_sync(&data->waker); 685 686 clear_bit(BTUSB_ISOC_RUNNING, &data->flags); 687 clear_bit(BTUSB_BULK_RUNNING, &data->flags); 688 clear_bit(BTUSB_INTR_RUNNING, &data->flags); 689 690 btusb_stop_traffic(data); 691 err = usb_autopm_get_interface(data->intf); 692 if (err < 0) 693 goto failed; 694 695 data->intf->needs_remote_wakeup = 0; 696 usb_autopm_put_interface(data->intf); 697 698 failed: 699 usb_scuttle_anchored_urbs(&data->deferred); 700 return 0; 701 } 702 703 static int btusb_flush(struct hci_dev *hdev) 704 { 705 struct btusb_data *data = hci_get_drvdata(hdev); 706 707 BT_DBG("%s", hdev->name); 708 709 usb_kill_anchored_urbs(&data->tx_anchor); 710 711 return 0; 712 } 713 714 static int btusb_send_frame(struct sk_buff *skb) 715 { 716 struct hci_dev *hdev = (struct hci_dev *) skb->dev; 717 struct btusb_data *data = hci_get_drvdata(hdev); 718 struct usb_ctrlrequest *dr; 719 struct urb *urb; 720 unsigned int pipe; 721 int err; 722 723 BT_DBG("%s", hdev->name); 724 725 if (!test_bit(HCI_RUNNING, &hdev->flags)) 726 return -EBUSY; 727 728 switch (bt_cb(skb)->pkt_type) { 729 case HCI_COMMAND_PKT: 730 urb = usb_alloc_urb(0, GFP_ATOMIC); 731 if (!urb) 732 return -ENOMEM; 733 734 dr = kmalloc(sizeof(*dr), GFP_ATOMIC); 735 if (!dr) { 736 usb_free_urb(urb); 737 return -ENOMEM; 738 } 739 740 dr->bRequestType = data->cmdreq_type; 741 dr->bRequest = 0; 742 dr->wIndex = 0; 743 dr->wValue = 0; 744 dr->wLength = __cpu_to_le16(skb->len); 745 746 pipe = usb_sndctrlpipe(data->udev, 0x00); 747 748 usb_fill_control_urb(urb, data->udev, pipe, (void *) dr, 749 skb->data, skb->len, btusb_tx_complete, skb); 750 751 hdev->stat.cmd_tx++; 752 break; 753 754 case HCI_ACLDATA_PKT: 755 if (!data->bulk_tx_ep) 756 return -ENODEV; 757 758 urb = usb_alloc_urb(0, GFP_ATOMIC); 759 if (!urb) 760 return -ENOMEM; 761 762 pipe = usb_sndbulkpipe(data->udev, 763 data->bulk_tx_ep->bEndpointAddress); 764 765 usb_fill_bulk_urb(urb, data->udev, pipe, 766 skb->data, skb->len, btusb_tx_complete, skb); 767 768 hdev->stat.acl_tx++; 769 break; 770 771 case HCI_SCODATA_PKT: 772 if (!data->isoc_tx_ep || hdev->conn_hash.sco_num < 1) 773 return -ENODEV; 774 775 urb = usb_alloc_urb(BTUSB_MAX_ISOC_FRAMES, GFP_ATOMIC); 776 if (!urb) 777 return -ENOMEM; 778 779 pipe = usb_sndisocpipe(data->udev, 780 data->isoc_tx_ep->bEndpointAddress); 781 782 usb_fill_int_urb(urb, data->udev, pipe, 783 skb->data, skb->len, btusb_isoc_tx_complete, 784 skb, data->isoc_tx_ep->bInterval); 785 786 urb->transfer_flags = URB_ISO_ASAP; 787 788 __fill_isoc_descriptor(urb, skb->len, 789 le16_to_cpu(data->isoc_tx_ep->wMaxPacketSize)); 790 791 hdev->stat.sco_tx++; 792 goto skip_waking; 793 794 default: 795 return -EILSEQ; 796 } 797 798 err = inc_tx(data); 799 if (err) { 800 usb_anchor_urb(urb, &data->deferred); 801 schedule_work(&data->waker); 802 err = 0; 803 goto done; 804 } 805 806 skip_waking: 807 usb_anchor_urb(urb, &data->tx_anchor); 808 809 err = usb_submit_urb(urb, GFP_ATOMIC); 810 if (err < 0) { 811 if (err != -EPERM && err != -ENODEV) 812 BT_ERR("%s urb %p submission failed (%d)", 813 hdev->name, urb, -err); 814 kfree(urb->setup_packet); 815 usb_unanchor_urb(urb); 816 } else { 817 usb_mark_last_busy(data->udev); 818 } 819 820 done: 821 usb_free_urb(urb); 822 return err; 823 } 824 825 static void btusb_notify(struct hci_dev *hdev, unsigned int evt) 826 { 827 struct btusb_data *data = hci_get_drvdata(hdev); 828 829 BT_DBG("%s evt %d", hdev->name, evt); 830 831 if (hdev->conn_hash.sco_num != data->sco_num) { 832 data->sco_num = hdev->conn_hash.sco_num; 833 schedule_work(&data->work); 834 } 835 } 836 837 static inline int __set_isoc_interface(struct hci_dev *hdev, int altsetting) 838 { 839 struct btusb_data *data = hci_get_drvdata(hdev); 840 struct usb_interface *intf = data->isoc; 841 struct usb_endpoint_descriptor *ep_desc; 842 int i, err; 843 844 if (!data->isoc) 845 return -ENODEV; 846 847 err = usb_set_interface(data->udev, 1, altsetting); 848 if (err < 0) { 849 BT_ERR("%s setting interface failed (%d)", hdev->name, -err); 850 return err; 851 } 852 853 data->isoc_altsetting = altsetting; 854 855 data->isoc_tx_ep = NULL; 856 data->isoc_rx_ep = NULL; 857 858 for (i = 0; i < intf->cur_altsetting->desc.bNumEndpoints; i++) { 859 ep_desc = &intf->cur_altsetting->endpoint[i].desc; 860 861 if (!data->isoc_tx_ep && usb_endpoint_is_isoc_out(ep_desc)) { 862 data->isoc_tx_ep = ep_desc; 863 continue; 864 } 865 866 if (!data->isoc_rx_ep && usb_endpoint_is_isoc_in(ep_desc)) { 867 data->isoc_rx_ep = ep_desc; 868 continue; 869 } 870 } 871 872 if (!data->isoc_tx_ep || !data->isoc_rx_ep) { 873 BT_ERR("%s invalid SCO descriptors", hdev->name); 874 return -ENODEV; 875 } 876 877 return 0; 878 } 879 880 static void btusb_work(struct work_struct *work) 881 { 882 struct btusb_data *data = container_of(work, struct btusb_data, work); 883 struct hci_dev *hdev = data->hdev; 884 int new_alts; 885 int err; 886 887 if (hdev->conn_hash.sco_num > 0) { 888 if (!test_bit(BTUSB_DID_ISO_RESUME, &data->flags)) { 889 err = usb_autopm_get_interface(data->isoc ? data->isoc : data->intf); 890 if (err < 0) { 891 clear_bit(BTUSB_ISOC_RUNNING, &data->flags); 892 usb_kill_anchored_urbs(&data->isoc_anchor); 893 return; 894 } 895 896 set_bit(BTUSB_DID_ISO_RESUME, &data->flags); 897 } 898 899 if (hdev->voice_setting & 0x0020) { 900 static const int alts[3] = { 2, 4, 5 }; 901 new_alts = alts[hdev->conn_hash.sco_num - 1]; 902 } else { 903 new_alts = hdev->conn_hash.sco_num; 904 } 905 906 if (data->isoc_altsetting != new_alts) { 907 clear_bit(BTUSB_ISOC_RUNNING, &data->flags); 908 usb_kill_anchored_urbs(&data->isoc_anchor); 909 910 if (__set_isoc_interface(hdev, new_alts) < 0) 911 return; 912 } 913 914 if (!test_and_set_bit(BTUSB_ISOC_RUNNING, &data->flags)) { 915 if (btusb_submit_isoc_urb(hdev, GFP_KERNEL) < 0) 916 clear_bit(BTUSB_ISOC_RUNNING, &data->flags); 917 else 918 btusb_submit_isoc_urb(hdev, GFP_KERNEL); 919 } 920 } else { 921 clear_bit(BTUSB_ISOC_RUNNING, &data->flags); 922 usb_kill_anchored_urbs(&data->isoc_anchor); 923 924 __set_isoc_interface(hdev, 0); 925 if (test_and_clear_bit(BTUSB_DID_ISO_RESUME, &data->flags)) 926 usb_autopm_put_interface(data->isoc ? data->isoc : data->intf); 927 } 928 } 929 930 static void btusb_waker(struct work_struct *work) 931 { 932 struct btusb_data *data = container_of(work, struct btusb_data, waker); 933 int err; 934 935 err = usb_autopm_get_interface(data->intf); 936 if (err < 0) 937 return; 938 939 usb_autopm_put_interface(data->intf); 940 } 941 942 static int btusb_setup_bcm92035(struct hci_dev *hdev) 943 { 944 struct sk_buff *skb; 945 u8 val = 0x00; 946 947 BT_DBG("%s", hdev->name); 948 949 skb = __hci_cmd_sync(hdev, 0xfc3b, 1, &val, HCI_INIT_TIMEOUT); 950 if (IS_ERR(skb)) 951 BT_ERR("BCM92035 command failed (%ld)", -PTR_ERR(skb)); 952 else 953 kfree_skb(skb); 954 955 return 0; 956 } 957 958 struct intel_version { 959 u8 status; 960 u8 hw_platform; 961 u8 hw_variant; 962 u8 hw_revision; 963 u8 fw_variant; 964 u8 fw_revision; 965 u8 fw_build_num; 966 u8 fw_build_ww; 967 u8 fw_build_yy; 968 u8 fw_patch_num; 969 } __packed; 970 971 static const struct firmware *btusb_setup_intel_get_fw(struct hci_dev *hdev, 972 struct intel_version *ver) 973 { 974 const struct firmware *fw; 975 char fwname[64]; 976 int ret; 977 978 snprintf(fwname, sizeof(fwname), 979 "intel/ibt-hw-%x.%x.%x-fw-%x.%x.%x.%x.%x.bseq", 980 ver->hw_platform, ver->hw_variant, ver->hw_revision, 981 ver->fw_variant, ver->fw_revision, ver->fw_build_num, 982 ver->fw_build_ww, ver->fw_build_yy); 983 984 ret = request_firmware(&fw, fwname, &hdev->dev); 985 if (ret < 0) { 986 if (ret == -EINVAL) { 987 BT_ERR("%s Intel firmware file request failed (%d)", 988 hdev->name, ret); 989 return NULL; 990 } 991 992 BT_ERR("%s failed to open Intel firmware file: %s(%d)", 993 hdev->name, fwname, ret); 994 995 /* If the correct firmware patch file is not found, use the 996 * default firmware patch file instead 997 */ 998 snprintf(fwname, sizeof(fwname), "intel/ibt-hw-%x.%x.bseq", 999 ver->hw_platform, ver->hw_variant); 1000 if (request_firmware(&fw, fwname, &hdev->dev) < 0) { 1001 BT_ERR("%s failed to open default Intel fw file: %s", 1002 hdev->name, fwname); 1003 return NULL; 1004 } 1005 } 1006 1007 BT_INFO("%s: Intel Bluetooth firmware file: %s", hdev->name, fwname); 1008 1009 return fw; 1010 } 1011 1012 static int btusb_setup_intel_patching(struct hci_dev *hdev, 1013 const struct firmware *fw, 1014 const u8 **fw_ptr, int *disable_patch) 1015 { 1016 struct sk_buff *skb; 1017 struct hci_command_hdr *cmd; 1018 const u8 *cmd_param; 1019 struct hci_event_hdr *evt = NULL; 1020 const u8 *evt_param = NULL; 1021 int remain = fw->size - (*fw_ptr - fw->data); 1022 1023 /* The first byte indicates the types of the patch command or event. 1024 * 0x01 means HCI command and 0x02 is HCI event. If the first bytes 1025 * in the current firmware buffer doesn't start with 0x01 or 1026 * the size of remain buffer is smaller than HCI command header, 1027 * the firmware file is corrupted and it should stop the patching 1028 * process. 1029 */ 1030 if (remain > HCI_COMMAND_HDR_SIZE && *fw_ptr[0] != 0x01) { 1031 BT_ERR("%s Intel fw corrupted: invalid cmd read", hdev->name); 1032 return -EINVAL; 1033 } 1034 (*fw_ptr)++; 1035 remain--; 1036 1037 cmd = (struct hci_command_hdr *)(*fw_ptr); 1038 *fw_ptr += sizeof(*cmd); 1039 remain -= sizeof(*cmd); 1040 1041 /* Ensure that the remain firmware data is long enough than the length 1042 * of command parameter. If not, the firmware file is corrupted. 1043 */ 1044 if (remain < cmd->plen) { 1045 BT_ERR("%s Intel fw corrupted: invalid cmd len", hdev->name); 1046 return -EFAULT; 1047 } 1048 1049 /* If there is a command that loads a patch in the firmware 1050 * file, then enable the patch upon success, otherwise just 1051 * disable the manufacturer mode, for example patch activation 1052 * is not required when the default firmware patch file is used 1053 * because there are no patch data to load. 1054 */ 1055 if (*disable_patch && le16_to_cpu(cmd->opcode) == 0xfc8e) 1056 *disable_patch = 0; 1057 1058 cmd_param = *fw_ptr; 1059 *fw_ptr += cmd->plen; 1060 remain -= cmd->plen; 1061 1062 /* This reads the expected events when the above command is sent to the 1063 * device. Some vendor commands expects more than one events, for 1064 * example command status event followed by vendor specific event. 1065 * For this case, it only keeps the last expected event. so the command 1066 * can be sent with __hci_cmd_sync_ev() which returns the sk_buff of 1067 * last expected event. 1068 */ 1069 while (remain > HCI_EVENT_HDR_SIZE && *fw_ptr[0] == 0x02) { 1070 (*fw_ptr)++; 1071 remain--; 1072 1073 evt = (struct hci_event_hdr *)(*fw_ptr); 1074 *fw_ptr += sizeof(*evt); 1075 remain -= sizeof(*evt); 1076 1077 if (remain < evt->plen) { 1078 BT_ERR("%s Intel fw corrupted: invalid evt len", 1079 hdev->name); 1080 return -EFAULT; 1081 } 1082 1083 evt_param = *fw_ptr; 1084 *fw_ptr += evt->plen; 1085 remain -= evt->plen; 1086 } 1087 1088 /* Every HCI commands in the firmware file has its correspond event. 1089 * If event is not found or remain is smaller than zero, the firmware 1090 * file is corrupted. 1091 */ 1092 if (!evt || !evt_param || remain < 0) { 1093 BT_ERR("%s Intel fw corrupted: invalid evt read", hdev->name); 1094 return -EFAULT; 1095 } 1096 1097 skb = __hci_cmd_sync_ev(hdev, le16_to_cpu(cmd->opcode), cmd->plen, 1098 cmd_param, evt->evt, HCI_INIT_TIMEOUT); 1099 if (IS_ERR(skb)) { 1100 BT_ERR("%s sending Intel patch command (0x%4.4x) failed (%ld)", 1101 hdev->name, cmd->opcode, PTR_ERR(skb)); 1102 return PTR_ERR(skb); 1103 } 1104 1105 /* It ensures that the returned event matches the event data read from 1106 * the firmware file. At fist, it checks the length and then 1107 * the contents of the event. 1108 */ 1109 if (skb->len != evt->plen) { 1110 BT_ERR("%s mismatch event length (opcode 0x%4.4x)", hdev->name, 1111 le16_to_cpu(cmd->opcode)); 1112 kfree_skb(skb); 1113 return -EFAULT; 1114 } 1115 1116 if (memcmp(skb->data, evt_param, evt->plen)) { 1117 BT_ERR("%s mismatch event parameter (opcode 0x%4.4x)", 1118 hdev->name, le16_to_cpu(cmd->opcode)); 1119 kfree_skb(skb); 1120 return -EFAULT; 1121 } 1122 kfree_skb(skb); 1123 1124 return 0; 1125 } 1126 1127 static int btusb_setup_intel(struct hci_dev *hdev) 1128 { 1129 struct sk_buff *skb; 1130 const struct firmware *fw; 1131 const u8 *fw_ptr; 1132 int disable_patch; 1133 struct intel_version *ver; 1134 1135 const u8 mfg_enable[] = { 0x01, 0x00 }; 1136 const u8 mfg_disable[] = { 0x00, 0x00 }; 1137 const u8 mfg_reset_deactivate[] = { 0x00, 0x01 }; 1138 const u8 mfg_reset_activate[] = { 0x00, 0x02 }; 1139 1140 BT_DBG("%s", hdev->name); 1141 1142 /* The controller has a bug with the first HCI command sent to it 1143 * returning number of completed commands as zero. This would stall the 1144 * command processing in the Bluetooth core. 1145 * 1146 * As a workaround, send HCI Reset command first which will reset the 1147 * number of completed commands and allow normal command processing 1148 * from now on. 1149 */ 1150 skb = __hci_cmd_sync(hdev, HCI_OP_RESET, 0, NULL, HCI_INIT_TIMEOUT); 1151 if (IS_ERR(skb)) { 1152 BT_ERR("%s sending initial HCI reset command failed (%ld)", 1153 hdev->name, PTR_ERR(skb)); 1154 return PTR_ERR(skb); 1155 } 1156 kfree_skb(skb); 1157 1158 /* Read Intel specific controller version first to allow selection of 1159 * which firmware file to load. 1160 * 1161 * The returned information are hardware variant and revision plus 1162 * firmware variant, revision and build number. 1163 */ 1164 skb = __hci_cmd_sync(hdev, 0xfc05, 0, NULL, HCI_INIT_TIMEOUT); 1165 if (IS_ERR(skb)) { 1166 BT_ERR("%s reading Intel fw version command failed (%ld)", 1167 hdev->name, PTR_ERR(skb)); 1168 return PTR_ERR(skb); 1169 } 1170 1171 if (skb->len != sizeof(*ver)) { 1172 BT_ERR("%s Intel version event length mismatch", hdev->name); 1173 kfree_skb(skb); 1174 return -EIO; 1175 } 1176 1177 ver = (struct intel_version *)skb->data; 1178 if (ver->status) { 1179 BT_ERR("%s Intel fw version event failed (%02x)", hdev->name, 1180 ver->status); 1181 kfree_skb(skb); 1182 return -bt_to_errno(ver->status); 1183 } 1184 1185 BT_INFO("%s: read Intel version: %02x%02x%02x%02x%02x%02x%02x%02x%02x", 1186 hdev->name, ver->hw_platform, ver->hw_variant, 1187 ver->hw_revision, ver->fw_variant, ver->fw_revision, 1188 ver->fw_build_num, ver->fw_build_ww, ver->fw_build_yy, 1189 ver->fw_patch_num); 1190 1191 /* fw_patch_num indicates the version of patch the device currently 1192 * have. If there is no patch data in the device, it is always 0x00. 1193 * So, if it is other than 0x00, no need to patch the deivce again. 1194 */ 1195 if (ver->fw_patch_num) { 1196 BT_INFO("%s: Intel device is already patched. patch num: %02x", 1197 hdev->name, ver->fw_patch_num); 1198 kfree_skb(skb); 1199 return 0; 1200 } 1201 1202 /* Opens the firmware patch file based on the firmware version read 1203 * from the controller. If it fails to open the matching firmware 1204 * patch file, it tries to open the default firmware patch file. 1205 * If no patch file is found, allow the device to operate without 1206 * a patch. 1207 */ 1208 fw = btusb_setup_intel_get_fw(hdev, ver); 1209 if (!fw) { 1210 kfree_skb(skb); 1211 return 0; 1212 } 1213 fw_ptr = fw->data; 1214 1215 /* This Intel specific command enables the manufacturer mode of the 1216 * controller. 1217 * 1218 * Only while this mode is enabled, the driver can download the 1219 * firmware patch data and configuration parameters. 1220 */ 1221 skb = __hci_cmd_sync(hdev, 0xfc11, 2, mfg_enable, HCI_INIT_TIMEOUT); 1222 if (IS_ERR(skb)) { 1223 BT_ERR("%s entering Intel manufacturer mode failed (%ld)", 1224 hdev->name, PTR_ERR(skb)); 1225 release_firmware(fw); 1226 return PTR_ERR(skb); 1227 } 1228 1229 if (skb->data[0]) { 1230 u8 evt_status = skb->data[0]; 1231 BT_ERR("%s enable Intel manufacturer mode event failed (%02x)", 1232 hdev->name, evt_status); 1233 kfree_skb(skb); 1234 release_firmware(fw); 1235 return -bt_to_errno(evt_status); 1236 } 1237 kfree_skb(skb); 1238 1239 disable_patch = 1; 1240 1241 /* The firmware data file consists of list of Intel specific HCI 1242 * commands and its expected events. The first byte indicates the 1243 * type of the message, either HCI command or HCI event. 1244 * 1245 * It reads the command and its expected event from the firmware file, 1246 * and send to the controller. Once __hci_cmd_sync_ev() returns, 1247 * the returned event is compared with the event read from the firmware 1248 * file and it will continue until all the messages are downloaded to 1249 * the controller. 1250 * 1251 * Once the firmware patching is completed successfully, 1252 * the manufacturer mode is disabled with reset and activating the 1253 * downloaded patch. 1254 * 1255 * If the firmware patching fails, the manufacturer mode is 1256 * disabled with reset and deactivating the patch. 1257 * 1258 * If the default patch file is used, no reset is done when disabling 1259 * the manufacturer. 1260 */ 1261 while (fw->size > fw_ptr - fw->data) { 1262 int ret; 1263 1264 ret = btusb_setup_intel_patching(hdev, fw, &fw_ptr, 1265 &disable_patch); 1266 if (ret < 0) 1267 goto exit_mfg_deactivate; 1268 } 1269 1270 release_firmware(fw); 1271 1272 if (disable_patch) 1273 goto exit_mfg_disable; 1274 1275 /* Patching completed successfully and disable the manufacturer mode 1276 * with reset and activate the downloaded firmware patches. 1277 */ 1278 skb = __hci_cmd_sync(hdev, 0xfc11, sizeof(mfg_reset_activate), 1279 mfg_reset_activate, HCI_INIT_TIMEOUT); 1280 if (IS_ERR(skb)) { 1281 BT_ERR("%s exiting Intel manufacturer mode failed (%ld)", 1282 hdev->name, PTR_ERR(skb)); 1283 return PTR_ERR(skb); 1284 } 1285 kfree_skb(skb); 1286 1287 BT_INFO("%s: Intel Bluetooth firmware patch completed and activated", 1288 hdev->name); 1289 1290 return 0; 1291 1292 exit_mfg_disable: 1293 /* Disable the manufacturer mode without reset */ 1294 skb = __hci_cmd_sync(hdev, 0xfc11, sizeof(mfg_disable), mfg_disable, 1295 HCI_INIT_TIMEOUT); 1296 if (IS_ERR(skb)) { 1297 BT_ERR("%s exiting Intel manufacturer mode failed (%ld)", 1298 hdev->name, PTR_ERR(skb)); 1299 return PTR_ERR(skb); 1300 } 1301 kfree_skb(skb); 1302 1303 BT_INFO("%s: Intel Bluetooth firmware patch completed", hdev->name); 1304 return 0; 1305 1306 exit_mfg_deactivate: 1307 release_firmware(fw); 1308 1309 /* Patching failed. Disable the manufacturer mode with reset and 1310 * deactivate the downloaded firmware patches. 1311 */ 1312 skb = __hci_cmd_sync(hdev, 0xfc11, sizeof(mfg_reset_deactivate), 1313 mfg_reset_deactivate, HCI_INIT_TIMEOUT); 1314 if (IS_ERR(skb)) { 1315 BT_ERR("%s exiting Intel manufacturer mode failed (%ld)", 1316 hdev->name, PTR_ERR(skb)); 1317 return PTR_ERR(skb); 1318 } 1319 kfree_skb(skb); 1320 1321 BT_INFO("%s: Intel Bluetooth firmware patch completed and deactivated", 1322 hdev->name); 1323 1324 return 0; 1325 } 1326 1327 static int btusb_probe(struct usb_interface *intf, 1328 const struct usb_device_id *id) 1329 { 1330 struct usb_endpoint_descriptor *ep_desc; 1331 struct btusb_data *data; 1332 struct hci_dev *hdev; 1333 int i, err; 1334 1335 BT_DBG("intf %p id %p", intf, id); 1336 1337 /* interface numbers are hardcoded in the spec */ 1338 if (intf->cur_altsetting->desc.bInterfaceNumber != 0) 1339 return -ENODEV; 1340 1341 if (!id->driver_info) { 1342 const struct usb_device_id *match; 1343 match = usb_match_id(intf, blacklist_table); 1344 if (match) 1345 id = match; 1346 } 1347 1348 if (id->driver_info == BTUSB_IGNORE) 1349 return -ENODEV; 1350 1351 if (ignore_dga && id->driver_info & BTUSB_DIGIANSWER) 1352 return -ENODEV; 1353 1354 if (ignore_csr && id->driver_info & BTUSB_CSR) 1355 return -ENODEV; 1356 1357 if (ignore_sniffer && id->driver_info & BTUSB_SNIFFER) 1358 return -ENODEV; 1359 1360 if (id->driver_info & BTUSB_ATH3012) { 1361 struct usb_device *udev = interface_to_usbdev(intf); 1362 1363 /* Old firmware would otherwise let ath3k driver load 1364 * patch and sysconfig files */ 1365 if (le16_to_cpu(udev->descriptor.bcdDevice) <= 0x0001) 1366 return -ENODEV; 1367 } 1368 1369 data = devm_kzalloc(&intf->dev, sizeof(*data), GFP_KERNEL); 1370 if (!data) 1371 return -ENOMEM; 1372 1373 for (i = 0; i < intf->cur_altsetting->desc.bNumEndpoints; i++) { 1374 ep_desc = &intf->cur_altsetting->endpoint[i].desc; 1375 1376 if (!data->intr_ep && usb_endpoint_is_int_in(ep_desc)) { 1377 data->intr_ep = ep_desc; 1378 continue; 1379 } 1380 1381 if (!data->bulk_tx_ep && usb_endpoint_is_bulk_out(ep_desc)) { 1382 data->bulk_tx_ep = ep_desc; 1383 continue; 1384 } 1385 1386 if (!data->bulk_rx_ep && usb_endpoint_is_bulk_in(ep_desc)) { 1387 data->bulk_rx_ep = ep_desc; 1388 continue; 1389 } 1390 } 1391 1392 if (!data->intr_ep || !data->bulk_tx_ep || !data->bulk_rx_ep) 1393 return -ENODEV; 1394 1395 data->cmdreq_type = USB_TYPE_CLASS; 1396 1397 data->udev = interface_to_usbdev(intf); 1398 data->intf = intf; 1399 1400 spin_lock_init(&data->lock); 1401 1402 INIT_WORK(&data->work, btusb_work); 1403 INIT_WORK(&data->waker, btusb_waker); 1404 spin_lock_init(&data->txlock); 1405 1406 init_usb_anchor(&data->tx_anchor); 1407 init_usb_anchor(&data->intr_anchor); 1408 init_usb_anchor(&data->bulk_anchor); 1409 init_usb_anchor(&data->isoc_anchor); 1410 init_usb_anchor(&data->deferred); 1411 1412 hdev = hci_alloc_dev(); 1413 if (!hdev) 1414 return -ENOMEM; 1415 1416 hdev->bus = HCI_USB; 1417 hci_set_drvdata(hdev, data); 1418 1419 data->hdev = hdev; 1420 1421 SET_HCIDEV_DEV(hdev, &intf->dev); 1422 1423 hdev->open = btusb_open; 1424 hdev->close = btusb_close; 1425 hdev->flush = btusb_flush; 1426 hdev->send = btusb_send_frame; 1427 hdev->notify = btusb_notify; 1428 1429 if (id->driver_info & BTUSB_BCM92035) 1430 hdev->setup = btusb_setup_bcm92035; 1431 1432 if (id->driver_info & BTUSB_INTEL) 1433 hdev->setup = btusb_setup_intel; 1434 1435 /* Interface numbers are hardcoded in the specification */ 1436 data->isoc = usb_ifnum_to_if(data->udev, 1); 1437 1438 if (!reset) 1439 set_bit(HCI_QUIRK_RESET_ON_CLOSE, &hdev->quirks); 1440 1441 if (force_scofix || id->driver_info & BTUSB_WRONG_SCO_MTU) { 1442 if (!disable_scofix) 1443 set_bit(HCI_QUIRK_FIXUP_BUFFER_SIZE, &hdev->quirks); 1444 } 1445 1446 if (id->driver_info & BTUSB_BROKEN_ISOC) 1447 data->isoc = NULL; 1448 1449 if (id->driver_info & BTUSB_DIGIANSWER) { 1450 data->cmdreq_type = USB_TYPE_VENDOR; 1451 set_bit(HCI_QUIRK_RESET_ON_CLOSE, &hdev->quirks); 1452 } 1453 1454 if (id->driver_info & BTUSB_CSR) { 1455 struct usb_device *udev = data->udev; 1456 1457 /* Old firmware would otherwise execute USB reset */ 1458 if (le16_to_cpu(udev->descriptor.bcdDevice) < 0x117) 1459 set_bit(HCI_QUIRK_RESET_ON_CLOSE, &hdev->quirks); 1460 } 1461 1462 if (id->driver_info & BTUSB_SNIFFER) { 1463 struct usb_device *udev = data->udev; 1464 1465 /* New sniffer firmware has crippled HCI interface */ 1466 if (le16_to_cpu(udev->descriptor.bcdDevice) > 0x997) 1467 set_bit(HCI_QUIRK_RAW_DEVICE, &hdev->quirks); 1468 1469 data->isoc = NULL; 1470 } 1471 1472 if (data->isoc) { 1473 err = usb_driver_claim_interface(&btusb_driver, 1474 data->isoc, data); 1475 if (err < 0) { 1476 hci_free_dev(hdev); 1477 return err; 1478 } 1479 } 1480 1481 err = hci_register_dev(hdev); 1482 if (err < 0) { 1483 hci_free_dev(hdev); 1484 return err; 1485 } 1486 1487 usb_set_intfdata(intf, data); 1488 1489 return 0; 1490 } 1491 1492 static void btusb_disconnect(struct usb_interface *intf) 1493 { 1494 struct btusb_data *data = usb_get_intfdata(intf); 1495 struct hci_dev *hdev; 1496 1497 BT_DBG("intf %p", intf); 1498 1499 if (!data) 1500 return; 1501 1502 hdev = data->hdev; 1503 usb_set_intfdata(data->intf, NULL); 1504 1505 if (data->isoc) 1506 usb_set_intfdata(data->isoc, NULL); 1507 1508 hci_unregister_dev(hdev); 1509 1510 if (intf == data->isoc) 1511 usb_driver_release_interface(&btusb_driver, data->intf); 1512 else if (data->isoc) 1513 usb_driver_release_interface(&btusb_driver, data->isoc); 1514 1515 hci_free_dev(hdev); 1516 } 1517 1518 #ifdef CONFIG_PM 1519 static int btusb_suspend(struct usb_interface *intf, pm_message_t message) 1520 { 1521 struct btusb_data *data = usb_get_intfdata(intf); 1522 1523 BT_DBG("intf %p", intf); 1524 1525 if (data->suspend_count++) 1526 return 0; 1527 1528 spin_lock_irq(&data->txlock); 1529 if (!(PMSG_IS_AUTO(message) && data->tx_in_flight)) { 1530 set_bit(BTUSB_SUSPENDING, &data->flags); 1531 spin_unlock_irq(&data->txlock); 1532 } else { 1533 spin_unlock_irq(&data->txlock); 1534 data->suspend_count--; 1535 return -EBUSY; 1536 } 1537 1538 cancel_work_sync(&data->work); 1539 1540 btusb_stop_traffic(data); 1541 usb_kill_anchored_urbs(&data->tx_anchor); 1542 1543 return 0; 1544 } 1545 1546 static void play_deferred(struct btusb_data *data) 1547 { 1548 struct urb *urb; 1549 int err; 1550 1551 while ((urb = usb_get_from_anchor(&data->deferred))) { 1552 err = usb_submit_urb(urb, GFP_ATOMIC); 1553 if (err < 0) 1554 break; 1555 1556 data->tx_in_flight++; 1557 } 1558 usb_scuttle_anchored_urbs(&data->deferred); 1559 } 1560 1561 static int btusb_resume(struct usb_interface *intf) 1562 { 1563 struct btusb_data *data = usb_get_intfdata(intf); 1564 struct hci_dev *hdev = data->hdev; 1565 int err = 0; 1566 1567 BT_DBG("intf %p", intf); 1568 1569 if (--data->suspend_count) 1570 return 0; 1571 1572 if (!test_bit(HCI_RUNNING, &hdev->flags)) 1573 goto done; 1574 1575 if (test_bit(BTUSB_INTR_RUNNING, &data->flags)) { 1576 err = btusb_submit_intr_urb(hdev, GFP_NOIO); 1577 if (err < 0) { 1578 clear_bit(BTUSB_INTR_RUNNING, &data->flags); 1579 goto failed; 1580 } 1581 } 1582 1583 if (test_bit(BTUSB_BULK_RUNNING, &data->flags)) { 1584 err = btusb_submit_bulk_urb(hdev, GFP_NOIO); 1585 if (err < 0) { 1586 clear_bit(BTUSB_BULK_RUNNING, &data->flags); 1587 goto failed; 1588 } 1589 1590 btusb_submit_bulk_urb(hdev, GFP_NOIO); 1591 } 1592 1593 if (test_bit(BTUSB_ISOC_RUNNING, &data->flags)) { 1594 if (btusb_submit_isoc_urb(hdev, GFP_NOIO) < 0) 1595 clear_bit(BTUSB_ISOC_RUNNING, &data->flags); 1596 else 1597 btusb_submit_isoc_urb(hdev, GFP_NOIO); 1598 } 1599 1600 spin_lock_irq(&data->txlock); 1601 play_deferred(data); 1602 clear_bit(BTUSB_SUSPENDING, &data->flags); 1603 spin_unlock_irq(&data->txlock); 1604 schedule_work(&data->work); 1605 1606 return 0; 1607 1608 failed: 1609 usb_scuttle_anchored_urbs(&data->deferred); 1610 done: 1611 spin_lock_irq(&data->txlock); 1612 clear_bit(BTUSB_SUSPENDING, &data->flags); 1613 spin_unlock_irq(&data->txlock); 1614 1615 return err; 1616 } 1617 #endif 1618 1619 static struct usb_driver btusb_driver = { 1620 .name = "btusb", 1621 .probe = btusb_probe, 1622 .disconnect = btusb_disconnect, 1623 #ifdef CONFIG_PM 1624 .suspend = btusb_suspend, 1625 .resume = btusb_resume, 1626 .reset_resume = btusb_resume, 1627 #endif 1628 .id_table = btusb_table, 1629 .supports_autosuspend = 1, 1630 .disable_hub_initiated_lpm = 1, 1631 }; 1632 1633 module_usb_driver(btusb_driver); 1634 1635 module_param(ignore_dga, bool, 0644); 1636 MODULE_PARM_DESC(ignore_dga, "Ignore devices with id 08fd:0001"); 1637 1638 module_param(ignore_csr, bool, 0644); 1639 MODULE_PARM_DESC(ignore_csr, "Ignore devices with id 0a12:0001"); 1640 1641 module_param(ignore_sniffer, bool, 0644); 1642 MODULE_PARM_DESC(ignore_sniffer, "Ignore devices with id 0a12:0002"); 1643 1644 module_param(disable_scofix, bool, 0644); 1645 MODULE_PARM_DESC(disable_scofix, "Disable fixup of wrong SCO buffer size"); 1646 1647 module_param(force_scofix, bool, 0644); 1648 MODULE_PARM_DESC(force_scofix, "Force fixup of wrong SCO buffers size"); 1649 1650 module_param(reset, bool, 0644); 1651 MODULE_PARM_DESC(reset, "Send HCI reset command on initialization"); 1652 1653 MODULE_AUTHOR("Marcel Holtmann <marcel@holtmann.org>"); 1654 MODULE_DESCRIPTION("Generic Bluetooth USB driver ver " VERSION); 1655 MODULE_VERSION(VERSION); 1656 MODULE_LICENSE("GPL"); 1657