1 /* 2 * 3 * Generic Bluetooth USB driver 4 * 5 * Copyright (C) 2005-2008 Marcel Holtmann <marcel@holtmann.org> 6 * 7 * 8 * This program is free software; you can redistribute it and/or modify 9 * it under the terms of the GNU General Public License as published by 10 * the Free Software Foundation; either version 2 of the License, or 11 * (at your option) any later version. 12 * 13 * This program is distributed in the hope that it will be useful, 14 * but WITHOUT ANY WARRANTY; without even the implied warranty of 15 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the 16 * GNU General Public License for more details. 17 * 18 * You should have received a copy of the GNU General Public License 19 * along with this program; if not, write to the Free Software 20 * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA 21 * 22 */ 23 24 #include <linux/dmi.h> 25 #include <linux/module.h> 26 #include <linux/usb.h> 27 #include <linux/usb/quirks.h> 28 #include <linux/firmware.h> 29 #include <linux/of_device.h> 30 #include <linux/of_irq.h> 31 #include <linux/suspend.h> 32 #include <asm/unaligned.h> 33 34 #include <net/bluetooth/bluetooth.h> 35 #include <net/bluetooth/hci_core.h> 36 37 #include "btintel.h" 38 #include "btbcm.h" 39 #include "btrtl.h" 40 41 #define VERSION "0.8" 42 43 static bool disable_scofix; 44 static bool force_scofix; 45 static bool enable_autosuspend = IS_ENABLED(CONFIG_BT_HCIBTUSB_AUTOSUSPEND); 46 47 static bool reset = true; 48 49 static struct usb_driver btusb_driver; 50 51 #define BTUSB_IGNORE 0x01 52 #define BTUSB_DIGIANSWER 0x02 53 #define BTUSB_CSR 0x04 54 #define BTUSB_SNIFFER 0x08 55 #define BTUSB_BCM92035 0x10 56 #define BTUSB_BROKEN_ISOC 0x20 57 #define BTUSB_WRONG_SCO_MTU 0x40 58 #define BTUSB_ATH3012 0x80 59 #define BTUSB_INTEL 0x100 60 #define BTUSB_INTEL_BOOT 0x200 61 #define BTUSB_BCM_PATCHRAM 0x400 62 #define BTUSB_MARVELL 0x800 63 #define BTUSB_SWAVE 0x1000 64 #define BTUSB_INTEL_NEW 0x2000 65 #define BTUSB_AMP 0x4000 66 #define BTUSB_QCA_ROME 0x8000 67 #define BTUSB_BCM_APPLE 0x10000 68 #define BTUSB_REALTEK 0x20000 69 #define BTUSB_BCM2045 0x40000 70 #define BTUSB_IFNUM_2 0x80000 71 #define BTUSB_CW6622 0x100000 72 73 static const struct usb_device_id btusb_table[] = { 74 /* Generic Bluetooth USB device */ 75 { USB_DEVICE_INFO(0xe0, 0x01, 0x01) }, 76 77 /* Generic Bluetooth AMP device */ 78 { USB_DEVICE_INFO(0xe0, 0x01, 0x04), .driver_info = BTUSB_AMP }, 79 80 /* Generic Bluetooth USB interface */ 81 { USB_INTERFACE_INFO(0xe0, 0x01, 0x01) }, 82 83 /* Apple-specific (Broadcom) devices */ 84 { USB_VENDOR_AND_INTERFACE_INFO(0x05ac, 0xff, 0x01, 0x01), 85 .driver_info = BTUSB_BCM_APPLE | BTUSB_IFNUM_2 }, 86 87 /* MediaTek MT76x0E */ 88 { USB_DEVICE(0x0e8d, 0x763f) }, 89 90 /* Broadcom SoftSailing reporting vendor specific */ 91 { USB_DEVICE(0x0a5c, 0x21e1) }, 92 93 /* Apple MacBookPro 7,1 */ 94 { USB_DEVICE(0x05ac, 0x8213) }, 95 96 /* Apple iMac11,1 */ 97 { USB_DEVICE(0x05ac, 0x8215) }, 98 99 /* Apple MacBookPro6,2 */ 100 { USB_DEVICE(0x05ac, 0x8218) }, 101 102 /* Apple MacBookAir3,1, MacBookAir3,2 */ 103 { USB_DEVICE(0x05ac, 0x821b) }, 104 105 /* Apple MacBookAir4,1 */ 106 { USB_DEVICE(0x05ac, 0x821f) }, 107 108 /* Apple MacBookPro8,2 */ 109 { USB_DEVICE(0x05ac, 0x821a) }, 110 111 /* Apple MacMini5,1 */ 112 { USB_DEVICE(0x05ac, 0x8281) }, 113 114 /* AVM BlueFRITZ! USB v2.0 */ 115 { USB_DEVICE(0x057c, 0x3800), .driver_info = BTUSB_SWAVE }, 116 117 /* Bluetooth Ultraport Module from IBM */ 118 { USB_DEVICE(0x04bf, 0x030a) }, 119 120 /* ALPS Modules with non-standard id */ 121 { USB_DEVICE(0x044e, 0x3001) }, 122 { USB_DEVICE(0x044e, 0x3002) }, 123 124 /* Ericsson with non-standard id */ 125 { USB_DEVICE(0x0bdb, 0x1002) }, 126 127 /* Canyon CN-BTU1 with HID interfaces */ 128 { USB_DEVICE(0x0c10, 0x0000) }, 129 130 /* Broadcom BCM20702A0 */ 131 { USB_DEVICE(0x413c, 0x8197) }, 132 133 /* Broadcom BCM20702B0 (Dynex/Insignia) */ 134 { USB_DEVICE(0x19ff, 0x0239), .driver_info = BTUSB_BCM_PATCHRAM }, 135 136 /* Broadcom BCM43142A0 (Foxconn/Lenovo) */ 137 { USB_VENDOR_AND_INTERFACE_INFO(0x105b, 0xff, 0x01, 0x01), 138 .driver_info = BTUSB_BCM_PATCHRAM }, 139 140 /* Broadcom BCM920703 (HTC Vive) */ 141 { USB_VENDOR_AND_INTERFACE_INFO(0x0bb4, 0xff, 0x01, 0x01), 142 .driver_info = BTUSB_BCM_PATCHRAM }, 143 144 /* Foxconn - Hon Hai */ 145 { USB_VENDOR_AND_INTERFACE_INFO(0x0489, 0xff, 0x01, 0x01), 146 .driver_info = BTUSB_BCM_PATCHRAM }, 147 148 /* Lite-On Technology - Broadcom based */ 149 { USB_VENDOR_AND_INTERFACE_INFO(0x04ca, 0xff, 0x01, 0x01), 150 .driver_info = BTUSB_BCM_PATCHRAM }, 151 152 /* Broadcom devices with vendor specific id */ 153 { USB_VENDOR_AND_INTERFACE_INFO(0x0a5c, 0xff, 0x01, 0x01), 154 .driver_info = BTUSB_BCM_PATCHRAM }, 155 156 /* ASUSTek Computer - Broadcom based */ 157 { USB_VENDOR_AND_INTERFACE_INFO(0x0b05, 0xff, 0x01, 0x01), 158 .driver_info = BTUSB_BCM_PATCHRAM }, 159 160 /* Belkin F8065bf - Broadcom based */ 161 { USB_VENDOR_AND_INTERFACE_INFO(0x050d, 0xff, 0x01, 0x01), 162 .driver_info = BTUSB_BCM_PATCHRAM }, 163 164 /* IMC Networks - Broadcom based */ 165 { USB_VENDOR_AND_INTERFACE_INFO(0x13d3, 0xff, 0x01, 0x01), 166 .driver_info = BTUSB_BCM_PATCHRAM }, 167 168 /* Dell Computer - Broadcom based */ 169 { USB_VENDOR_AND_INTERFACE_INFO(0x413c, 0xff, 0x01, 0x01), 170 .driver_info = BTUSB_BCM_PATCHRAM }, 171 172 /* Toshiba Corp - Broadcom based */ 173 { USB_VENDOR_AND_INTERFACE_INFO(0x0930, 0xff, 0x01, 0x01), 174 .driver_info = BTUSB_BCM_PATCHRAM }, 175 176 /* Intel Bluetooth USB Bootloader (RAM module) */ 177 { USB_DEVICE(0x8087, 0x0a5a), 178 .driver_info = BTUSB_INTEL_BOOT | BTUSB_BROKEN_ISOC }, 179 180 { } /* Terminating entry */ 181 }; 182 183 MODULE_DEVICE_TABLE(usb, btusb_table); 184 185 static const struct usb_device_id blacklist_table[] = { 186 /* CSR BlueCore devices */ 187 { USB_DEVICE(0x0a12, 0x0001), .driver_info = BTUSB_CSR }, 188 189 /* Broadcom BCM2033 without firmware */ 190 { USB_DEVICE(0x0a5c, 0x2033), .driver_info = BTUSB_IGNORE }, 191 192 /* Broadcom BCM2045 devices */ 193 { USB_DEVICE(0x0a5c, 0x2045), .driver_info = BTUSB_BCM2045 }, 194 195 /* Atheros 3011 with sflash firmware */ 196 { USB_DEVICE(0x0489, 0xe027), .driver_info = BTUSB_IGNORE }, 197 { USB_DEVICE(0x0489, 0xe03d), .driver_info = BTUSB_IGNORE }, 198 { USB_DEVICE(0x04f2, 0xaff1), .driver_info = BTUSB_IGNORE }, 199 { USB_DEVICE(0x0930, 0x0215), .driver_info = BTUSB_IGNORE }, 200 { USB_DEVICE(0x0cf3, 0x3002), .driver_info = BTUSB_IGNORE }, 201 { USB_DEVICE(0x0cf3, 0xe019), .driver_info = BTUSB_IGNORE }, 202 { USB_DEVICE(0x13d3, 0x3304), .driver_info = BTUSB_IGNORE }, 203 204 /* Atheros AR9285 Malbec with sflash firmware */ 205 { USB_DEVICE(0x03f0, 0x311d), .driver_info = BTUSB_IGNORE }, 206 207 /* Atheros 3012 with sflash firmware */ 208 { USB_DEVICE(0x0489, 0xe04d), .driver_info = BTUSB_ATH3012 }, 209 { USB_DEVICE(0x0489, 0xe04e), .driver_info = BTUSB_ATH3012 }, 210 { USB_DEVICE(0x0489, 0xe056), .driver_info = BTUSB_ATH3012 }, 211 { USB_DEVICE(0x0489, 0xe057), .driver_info = BTUSB_ATH3012 }, 212 { USB_DEVICE(0x0489, 0xe05f), .driver_info = BTUSB_ATH3012 }, 213 { USB_DEVICE(0x0489, 0xe076), .driver_info = BTUSB_ATH3012 }, 214 { USB_DEVICE(0x0489, 0xe078), .driver_info = BTUSB_ATH3012 }, 215 { USB_DEVICE(0x0489, 0xe095), .driver_info = BTUSB_ATH3012 }, 216 { USB_DEVICE(0x04c5, 0x1330), .driver_info = BTUSB_ATH3012 }, 217 { USB_DEVICE(0x04ca, 0x3004), .driver_info = BTUSB_ATH3012 }, 218 { USB_DEVICE(0x04ca, 0x3005), .driver_info = BTUSB_ATH3012 }, 219 { USB_DEVICE(0x04ca, 0x3006), .driver_info = BTUSB_ATH3012 }, 220 { USB_DEVICE(0x04ca, 0x3007), .driver_info = BTUSB_ATH3012 }, 221 { USB_DEVICE(0x04ca, 0x3008), .driver_info = BTUSB_ATH3012 }, 222 { USB_DEVICE(0x04ca, 0x300b), .driver_info = BTUSB_ATH3012 }, 223 { USB_DEVICE(0x04ca, 0x300d), .driver_info = BTUSB_ATH3012 }, 224 { USB_DEVICE(0x04ca, 0x300f), .driver_info = BTUSB_ATH3012 }, 225 { USB_DEVICE(0x04ca, 0x3010), .driver_info = BTUSB_ATH3012 }, 226 { USB_DEVICE(0x04ca, 0x3014), .driver_info = BTUSB_ATH3012 }, 227 { USB_DEVICE(0x04ca, 0x3018), .driver_info = BTUSB_ATH3012 }, 228 { USB_DEVICE(0x0930, 0x0219), .driver_info = BTUSB_ATH3012 }, 229 { USB_DEVICE(0x0930, 0x021c), .driver_info = BTUSB_ATH3012 }, 230 { USB_DEVICE(0x0930, 0x0220), .driver_info = BTUSB_ATH3012 }, 231 { USB_DEVICE(0x0930, 0x0227), .driver_info = BTUSB_ATH3012 }, 232 { USB_DEVICE(0x0b05, 0x17d0), .driver_info = BTUSB_ATH3012 }, 233 { USB_DEVICE(0x0cf3, 0x0036), .driver_info = BTUSB_ATH3012 }, 234 { USB_DEVICE(0x0cf3, 0x3004), .driver_info = BTUSB_ATH3012 }, 235 { USB_DEVICE(0x0cf3, 0x3008), .driver_info = BTUSB_ATH3012 }, 236 { USB_DEVICE(0x0cf3, 0x311d), .driver_info = BTUSB_ATH3012 }, 237 { USB_DEVICE(0x0cf3, 0x311e), .driver_info = BTUSB_ATH3012 }, 238 { USB_DEVICE(0x0cf3, 0x311f), .driver_info = BTUSB_ATH3012 }, 239 { USB_DEVICE(0x0cf3, 0x3121), .driver_info = BTUSB_ATH3012 }, 240 { USB_DEVICE(0x0cf3, 0x817a), .driver_info = BTUSB_ATH3012 }, 241 { USB_DEVICE(0x0cf3, 0x817b), .driver_info = BTUSB_ATH3012 }, 242 { USB_DEVICE(0x0cf3, 0xe003), .driver_info = BTUSB_ATH3012 }, 243 { USB_DEVICE(0x0cf3, 0xe004), .driver_info = BTUSB_ATH3012 }, 244 { USB_DEVICE(0x0cf3, 0xe005), .driver_info = BTUSB_ATH3012 }, 245 { USB_DEVICE(0x0cf3, 0xe006), .driver_info = BTUSB_ATH3012 }, 246 { USB_DEVICE(0x13d3, 0x3362), .driver_info = BTUSB_ATH3012 }, 247 { USB_DEVICE(0x13d3, 0x3375), .driver_info = BTUSB_ATH3012 }, 248 { USB_DEVICE(0x13d3, 0x3393), .driver_info = BTUSB_ATH3012 }, 249 { USB_DEVICE(0x13d3, 0x3395), .driver_info = BTUSB_ATH3012 }, 250 { USB_DEVICE(0x13d3, 0x3402), .driver_info = BTUSB_ATH3012 }, 251 { USB_DEVICE(0x13d3, 0x3408), .driver_info = BTUSB_ATH3012 }, 252 { USB_DEVICE(0x13d3, 0x3423), .driver_info = BTUSB_ATH3012 }, 253 { USB_DEVICE(0x13d3, 0x3432), .driver_info = BTUSB_ATH3012 }, 254 { USB_DEVICE(0x13d3, 0x3472), .driver_info = BTUSB_ATH3012 }, 255 { USB_DEVICE(0x13d3, 0x3474), .driver_info = BTUSB_ATH3012 }, 256 { USB_DEVICE(0x13d3, 0x3487), .driver_info = BTUSB_ATH3012 }, 257 { USB_DEVICE(0x13d3, 0x3490), .driver_info = BTUSB_ATH3012 }, 258 259 /* Atheros AR5BBU12 with sflash firmware */ 260 { USB_DEVICE(0x0489, 0xe02c), .driver_info = BTUSB_IGNORE }, 261 262 /* Atheros AR5BBU12 with sflash firmware */ 263 { USB_DEVICE(0x0489, 0xe036), .driver_info = BTUSB_ATH3012 }, 264 { USB_DEVICE(0x0489, 0xe03c), .driver_info = BTUSB_ATH3012 }, 265 266 /* QCA ROME chipset */ 267 { USB_DEVICE(0x0cf3, 0x535b), .driver_info = BTUSB_QCA_ROME }, 268 { USB_DEVICE(0x0cf3, 0xe007), .driver_info = BTUSB_QCA_ROME }, 269 { USB_DEVICE(0x0cf3, 0xe009), .driver_info = BTUSB_QCA_ROME }, 270 { USB_DEVICE(0x0cf3, 0xe010), .driver_info = BTUSB_QCA_ROME }, 271 { USB_DEVICE(0x0cf3, 0xe300), .driver_info = BTUSB_QCA_ROME }, 272 { USB_DEVICE(0x0cf3, 0xe301), .driver_info = BTUSB_QCA_ROME }, 273 { USB_DEVICE(0x0cf3, 0xe360), .driver_info = BTUSB_QCA_ROME }, 274 { USB_DEVICE(0x0489, 0xe092), .driver_info = BTUSB_QCA_ROME }, 275 { USB_DEVICE(0x0489, 0xe09f), .driver_info = BTUSB_QCA_ROME }, 276 { USB_DEVICE(0x0489, 0xe0a2), .driver_info = BTUSB_QCA_ROME }, 277 { USB_DEVICE(0x04ca, 0x3011), .driver_info = BTUSB_QCA_ROME }, 278 { USB_DEVICE(0x04ca, 0x3015), .driver_info = BTUSB_QCA_ROME }, 279 { USB_DEVICE(0x04ca, 0x3016), .driver_info = BTUSB_QCA_ROME }, 280 { USB_DEVICE(0x04ca, 0x301a), .driver_info = BTUSB_QCA_ROME }, 281 { USB_DEVICE(0x13d3, 0x3496), .driver_info = BTUSB_QCA_ROME }, 282 283 /* Broadcom BCM2035 */ 284 { USB_DEVICE(0x0a5c, 0x2009), .driver_info = BTUSB_BCM92035 }, 285 { USB_DEVICE(0x0a5c, 0x200a), .driver_info = BTUSB_WRONG_SCO_MTU }, 286 { USB_DEVICE(0x0a5c, 0x2035), .driver_info = BTUSB_WRONG_SCO_MTU }, 287 288 /* Broadcom BCM2045 */ 289 { USB_DEVICE(0x0a5c, 0x2039), .driver_info = BTUSB_WRONG_SCO_MTU }, 290 { USB_DEVICE(0x0a5c, 0x2101), .driver_info = BTUSB_WRONG_SCO_MTU }, 291 292 /* IBM/Lenovo ThinkPad with Broadcom chip */ 293 { USB_DEVICE(0x0a5c, 0x201e), .driver_info = BTUSB_WRONG_SCO_MTU }, 294 { USB_DEVICE(0x0a5c, 0x2110), .driver_info = BTUSB_WRONG_SCO_MTU }, 295 296 /* HP laptop with Broadcom chip */ 297 { USB_DEVICE(0x03f0, 0x171d), .driver_info = BTUSB_WRONG_SCO_MTU }, 298 299 /* Dell laptop with Broadcom chip */ 300 { USB_DEVICE(0x413c, 0x8126), .driver_info = BTUSB_WRONG_SCO_MTU }, 301 302 /* Dell Wireless 370 and 410 devices */ 303 { USB_DEVICE(0x413c, 0x8152), .driver_info = BTUSB_WRONG_SCO_MTU }, 304 { USB_DEVICE(0x413c, 0x8156), .driver_info = BTUSB_WRONG_SCO_MTU }, 305 306 /* Belkin F8T012 and F8T013 devices */ 307 { USB_DEVICE(0x050d, 0x0012), .driver_info = BTUSB_WRONG_SCO_MTU }, 308 { USB_DEVICE(0x050d, 0x0013), .driver_info = BTUSB_WRONG_SCO_MTU }, 309 310 /* Asus WL-BTD202 device */ 311 { USB_DEVICE(0x0b05, 0x1715), .driver_info = BTUSB_WRONG_SCO_MTU }, 312 313 /* Kensington Bluetooth USB adapter */ 314 { USB_DEVICE(0x047d, 0x105e), .driver_info = BTUSB_WRONG_SCO_MTU }, 315 316 /* RTX Telecom based adapters with buggy SCO support */ 317 { USB_DEVICE(0x0400, 0x0807), .driver_info = BTUSB_BROKEN_ISOC }, 318 { USB_DEVICE(0x0400, 0x080a), .driver_info = BTUSB_BROKEN_ISOC }, 319 320 /* CONWISE Technology based adapters with buggy SCO support */ 321 { USB_DEVICE(0x0e5e, 0x6622), 322 .driver_info = BTUSB_BROKEN_ISOC | BTUSB_CW6622}, 323 324 /* Roper Class 1 Bluetooth Dongle (Silicon Wave based) */ 325 { USB_DEVICE(0x1310, 0x0001), .driver_info = BTUSB_SWAVE }, 326 327 /* Digianswer devices */ 328 { USB_DEVICE(0x08fd, 0x0001), .driver_info = BTUSB_DIGIANSWER }, 329 { USB_DEVICE(0x08fd, 0x0002), .driver_info = BTUSB_IGNORE }, 330 331 /* CSR BlueCore Bluetooth Sniffer */ 332 { USB_DEVICE(0x0a12, 0x0002), 333 .driver_info = BTUSB_SNIFFER | BTUSB_BROKEN_ISOC }, 334 335 /* Frontline ComProbe Bluetooth Sniffer */ 336 { USB_DEVICE(0x16d3, 0x0002), 337 .driver_info = BTUSB_SNIFFER | BTUSB_BROKEN_ISOC }, 338 339 /* Marvell Bluetooth devices */ 340 { USB_DEVICE(0x1286, 0x2044), .driver_info = BTUSB_MARVELL }, 341 { USB_DEVICE(0x1286, 0x2046), .driver_info = BTUSB_MARVELL }, 342 { USB_DEVICE(0x1286, 0x204e), .driver_info = BTUSB_MARVELL }, 343 344 /* Intel Bluetooth devices */ 345 { USB_DEVICE(0x8087, 0x0025), .driver_info = BTUSB_INTEL_NEW }, 346 { USB_DEVICE(0x8087, 0x0026), .driver_info = BTUSB_INTEL_NEW }, 347 { USB_DEVICE(0x8087, 0x07da), .driver_info = BTUSB_CSR }, 348 { USB_DEVICE(0x8087, 0x07dc), .driver_info = BTUSB_INTEL }, 349 { USB_DEVICE(0x8087, 0x0a2a), .driver_info = BTUSB_INTEL }, 350 { USB_DEVICE(0x8087, 0x0a2b), .driver_info = BTUSB_INTEL_NEW }, 351 { USB_DEVICE(0x8087, 0x0aa7), .driver_info = BTUSB_INTEL }, 352 { USB_DEVICE(0x8087, 0x0aaa), .driver_info = BTUSB_INTEL_NEW }, 353 354 /* Other Intel Bluetooth devices */ 355 { USB_VENDOR_AND_INTERFACE_INFO(0x8087, 0xe0, 0x01, 0x01), 356 .driver_info = BTUSB_IGNORE }, 357 358 /* Realtek Bluetooth devices */ 359 { USB_VENDOR_AND_INTERFACE_INFO(0x0bda, 0xe0, 0x01, 0x01), 360 .driver_info = BTUSB_REALTEK }, 361 362 /* Additional Realtek 8723AE Bluetooth devices */ 363 { USB_DEVICE(0x0930, 0x021d), .driver_info = BTUSB_REALTEK }, 364 { USB_DEVICE(0x13d3, 0x3394), .driver_info = BTUSB_REALTEK }, 365 366 /* Additional Realtek 8723BE Bluetooth devices */ 367 { USB_DEVICE(0x0489, 0xe085), .driver_info = BTUSB_REALTEK }, 368 { USB_DEVICE(0x0489, 0xe08b), .driver_info = BTUSB_REALTEK }, 369 { USB_DEVICE(0x13d3, 0x3410), .driver_info = BTUSB_REALTEK }, 370 { USB_DEVICE(0x13d3, 0x3416), .driver_info = BTUSB_REALTEK }, 371 { USB_DEVICE(0x13d3, 0x3459), .driver_info = BTUSB_REALTEK }, 372 { USB_DEVICE(0x13d3, 0x3494), .driver_info = BTUSB_REALTEK }, 373 374 /* Additional Realtek 8723BU Bluetooth devices */ 375 { USB_DEVICE(0x7392, 0xa611), .driver_info = BTUSB_REALTEK }, 376 377 /* Additional Realtek 8723DE Bluetooth devices */ 378 { USB_DEVICE(0x0bda, 0xb009), .driver_info = BTUSB_REALTEK }, 379 { USB_DEVICE(0x2ff8, 0xb011), .driver_info = BTUSB_REALTEK }, 380 381 /* Additional Realtek 8821AE Bluetooth devices */ 382 { USB_DEVICE(0x0b05, 0x17dc), .driver_info = BTUSB_REALTEK }, 383 { USB_DEVICE(0x13d3, 0x3414), .driver_info = BTUSB_REALTEK }, 384 { USB_DEVICE(0x13d3, 0x3458), .driver_info = BTUSB_REALTEK }, 385 { USB_DEVICE(0x13d3, 0x3461), .driver_info = BTUSB_REALTEK }, 386 { USB_DEVICE(0x13d3, 0x3462), .driver_info = BTUSB_REALTEK }, 387 388 /* Additional Realtek 8822BE Bluetooth devices */ 389 { USB_DEVICE(0x13d3, 0x3526), .driver_info = BTUSB_REALTEK }, 390 { USB_DEVICE(0x0b05, 0x185c), .driver_info = BTUSB_REALTEK }, 391 392 /* Silicon Wave based devices */ 393 { USB_DEVICE(0x0c10, 0x0000), .driver_info = BTUSB_SWAVE }, 394 395 { } /* Terminating entry */ 396 }; 397 398 /* The Bluetooth USB module build into some devices needs to be reset on resume, 399 * this is a problem with the platform (likely shutting off all power) not with 400 * the module itself. So we use a DMI list to match known broken platforms. 401 */ 402 static const struct dmi_system_id btusb_needs_reset_resume_table[] = { 403 { 404 /* Dell OptiPlex 3060 (QCA ROME device 0cf3:e007) */ 405 .matches = { 406 DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."), 407 DMI_MATCH(DMI_PRODUCT_NAME, "OptiPlex 3060"), 408 }, 409 }, 410 { 411 /* Dell XPS 9360 (QCA ROME device 0cf3:e300) */ 412 .matches = { 413 DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."), 414 DMI_MATCH(DMI_PRODUCT_NAME, "XPS 13 9360"), 415 }, 416 }, 417 { 418 /* Dell Inspiron 5565 (QCA ROME device 0cf3:e009) */ 419 .matches = { 420 DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."), 421 DMI_MATCH(DMI_PRODUCT_NAME, "Inspiron 5565"), 422 }, 423 }, 424 {} 425 }; 426 427 #define BTUSB_MAX_ISOC_FRAMES 10 428 429 #define BTUSB_INTR_RUNNING 0 430 #define BTUSB_BULK_RUNNING 1 431 #define BTUSB_ISOC_RUNNING 2 432 #define BTUSB_SUSPENDING 3 433 #define BTUSB_DID_ISO_RESUME 4 434 #define BTUSB_BOOTLOADER 5 435 #define BTUSB_DOWNLOADING 6 436 #define BTUSB_FIRMWARE_LOADED 7 437 #define BTUSB_FIRMWARE_FAILED 8 438 #define BTUSB_BOOTING 9 439 #define BTUSB_DIAG_RUNNING 10 440 #define BTUSB_OOB_WAKE_ENABLED 11 441 442 struct btusb_data { 443 struct hci_dev *hdev; 444 struct usb_device *udev; 445 struct usb_interface *intf; 446 struct usb_interface *isoc; 447 struct usb_interface *diag; 448 unsigned isoc_ifnum; 449 450 unsigned long flags; 451 452 struct work_struct work; 453 struct work_struct waker; 454 455 struct usb_anchor deferred; 456 struct usb_anchor tx_anchor; 457 int tx_in_flight; 458 spinlock_t txlock; 459 460 struct usb_anchor intr_anchor; 461 struct usb_anchor bulk_anchor; 462 struct usb_anchor isoc_anchor; 463 struct usb_anchor diag_anchor; 464 spinlock_t rxlock; 465 466 struct sk_buff *evt_skb; 467 struct sk_buff *acl_skb; 468 struct sk_buff *sco_skb; 469 470 struct usb_endpoint_descriptor *intr_ep; 471 struct usb_endpoint_descriptor *bulk_tx_ep; 472 struct usb_endpoint_descriptor *bulk_rx_ep; 473 struct usb_endpoint_descriptor *isoc_tx_ep; 474 struct usb_endpoint_descriptor *isoc_rx_ep; 475 struct usb_endpoint_descriptor *diag_tx_ep; 476 struct usb_endpoint_descriptor *diag_rx_ep; 477 478 __u8 cmdreq_type; 479 __u8 cmdreq; 480 481 unsigned int sco_num; 482 int isoc_altsetting; 483 int suspend_count; 484 485 int (*recv_event)(struct hci_dev *hdev, struct sk_buff *skb); 486 int (*recv_bulk)(struct btusb_data *data, void *buffer, int count); 487 488 int (*setup_on_usb)(struct hci_dev *hdev); 489 490 int oob_wake_irq; /* irq for out-of-band wake-on-bt */ 491 }; 492 493 static inline void btusb_free_frags(struct btusb_data *data) 494 { 495 unsigned long flags; 496 497 spin_lock_irqsave(&data->rxlock, flags); 498 499 kfree_skb(data->evt_skb); 500 data->evt_skb = NULL; 501 502 kfree_skb(data->acl_skb); 503 data->acl_skb = NULL; 504 505 kfree_skb(data->sco_skb); 506 data->sco_skb = NULL; 507 508 spin_unlock_irqrestore(&data->rxlock, flags); 509 } 510 511 static int btusb_recv_intr(struct btusb_data *data, void *buffer, int count) 512 { 513 struct sk_buff *skb; 514 unsigned long flags; 515 int err = 0; 516 517 spin_lock_irqsave(&data->rxlock, flags); 518 skb = data->evt_skb; 519 520 while (count) { 521 int len; 522 523 if (!skb) { 524 skb = bt_skb_alloc(HCI_MAX_EVENT_SIZE, GFP_ATOMIC); 525 if (!skb) { 526 err = -ENOMEM; 527 break; 528 } 529 530 hci_skb_pkt_type(skb) = HCI_EVENT_PKT; 531 hci_skb_expect(skb) = HCI_EVENT_HDR_SIZE; 532 } 533 534 len = min_t(uint, hci_skb_expect(skb), count); 535 skb_put_data(skb, buffer, len); 536 537 count -= len; 538 buffer += len; 539 hci_skb_expect(skb) -= len; 540 541 if (skb->len == HCI_EVENT_HDR_SIZE) { 542 /* Complete event header */ 543 hci_skb_expect(skb) = hci_event_hdr(skb)->plen; 544 545 if (skb_tailroom(skb) < hci_skb_expect(skb)) { 546 kfree_skb(skb); 547 skb = NULL; 548 549 err = -EILSEQ; 550 break; 551 } 552 } 553 554 if (!hci_skb_expect(skb)) { 555 /* Complete frame */ 556 data->recv_event(data->hdev, skb); 557 skb = NULL; 558 } 559 } 560 561 data->evt_skb = skb; 562 spin_unlock_irqrestore(&data->rxlock, flags); 563 564 return err; 565 } 566 567 static int btusb_recv_bulk(struct btusb_data *data, void *buffer, int count) 568 { 569 struct sk_buff *skb; 570 unsigned long flags; 571 int err = 0; 572 573 spin_lock_irqsave(&data->rxlock, flags); 574 skb = data->acl_skb; 575 576 while (count) { 577 int len; 578 579 if (!skb) { 580 skb = bt_skb_alloc(HCI_MAX_FRAME_SIZE, GFP_ATOMIC); 581 if (!skb) { 582 err = -ENOMEM; 583 break; 584 } 585 586 hci_skb_pkt_type(skb) = HCI_ACLDATA_PKT; 587 hci_skb_expect(skb) = HCI_ACL_HDR_SIZE; 588 } 589 590 len = min_t(uint, hci_skb_expect(skb), count); 591 skb_put_data(skb, buffer, len); 592 593 count -= len; 594 buffer += len; 595 hci_skb_expect(skb) -= len; 596 597 if (skb->len == HCI_ACL_HDR_SIZE) { 598 __le16 dlen = hci_acl_hdr(skb)->dlen; 599 600 /* Complete ACL header */ 601 hci_skb_expect(skb) = __le16_to_cpu(dlen); 602 603 if (skb_tailroom(skb) < hci_skb_expect(skb)) { 604 kfree_skb(skb); 605 skb = NULL; 606 607 err = -EILSEQ; 608 break; 609 } 610 } 611 612 if (!hci_skb_expect(skb)) { 613 /* Complete frame */ 614 hci_recv_frame(data->hdev, skb); 615 skb = NULL; 616 } 617 } 618 619 data->acl_skb = skb; 620 spin_unlock_irqrestore(&data->rxlock, flags); 621 622 return err; 623 } 624 625 static int btusb_recv_isoc(struct btusb_data *data, void *buffer, int count) 626 { 627 struct sk_buff *skb; 628 unsigned long flags; 629 int err = 0; 630 631 spin_lock_irqsave(&data->rxlock, flags); 632 skb = data->sco_skb; 633 634 while (count) { 635 int len; 636 637 if (!skb) { 638 skb = bt_skb_alloc(HCI_MAX_SCO_SIZE, GFP_ATOMIC); 639 if (!skb) { 640 err = -ENOMEM; 641 break; 642 } 643 644 hci_skb_pkt_type(skb) = HCI_SCODATA_PKT; 645 hci_skb_expect(skb) = HCI_SCO_HDR_SIZE; 646 } 647 648 len = min_t(uint, hci_skb_expect(skb), count); 649 skb_put_data(skb, buffer, len); 650 651 count -= len; 652 buffer += len; 653 hci_skb_expect(skb) -= len; 654 655 if (skb->len == HCI_SCO_HDR_SIZE) { 656 /* Complete SCO header */ 657 hci_skb_expect(skb) = hci_sco_hdr(skb)->dlen; 658 659 if (skb_tailroom(skb) < hci_skb_expect(skb)) { 660 kfree_skb(skb); 661 skb = NULL; 662 663 err = -EILSEQ; 664 break; 665 } 666 } 667 668 if (!hci_skb_expect(skb)) { 669 /* Complete frame */ 670 hci_recv_frame(data->hdev, skb); 671 skb = NULL; 672 } 673 } 674 675 data->sco_skb = skb; 676 spin_unlock_irqrestore(&data->rxlock, flags); 677 678 return err; 679 } 680 681 static void btusb_intr_complete(struct urb *urb) 682 { 683 struct hci_dev *hdev = urb->context; 684 struct btusb_data *data = hci_get_drvdata(hdev); 685 int err; 686 687 BT_DBG("%s urb %p status %d count %d", hdev->name, urb, urb->status, 688 urb->actual_length); 689 690 if (!test_bit(HCI_RUNNING, &hdev->flags)) 691 return; 692 693 if (urb->status == 0) { 694 hdev->stat.byte_rx += urb->actual_length; 695 696 if (btusb_recv_intr(data, urb->transfer_buffer, 697 urb->actual_length) < 0) { 698 bt_dev_err(hdev, "corrupted event packet"); 699 hdev->stat.err_rx++; 700 } 701 } else if (urb->status == -ENOENT) { 702 /* Avoid suspend failed when usb_kill_urb */ 703 return; 704 } 705 706 if (!test_bit(BTUSB_INTR_RUNNING, &data->flags)) 707 return; 708 709 usb_mark_last_busy(data->udev); 710 usb_anchor_urb(urb, &data->intr_anchor); 711 712 err = usb_submit_urb(urb, GFP_ATOMIC); 713 if (err < 0) { 714 /* -EPERM: urb is being killed; 715 * -ENODEV: device got disconnected 716 */ 717 if (err != -EPERM && err != -ENODEV) 718 bt_dev_err(hdev, "urb %p failed to resubmit (%d)", 719 urb, -err); 720 usb_unanchor_urb(urb); 721 } 722 } 723 724 static int btusb_submit_intr_urb(struct hci_dev *hdev, gfp_t mem_flags) 725 { 726 struct btusb_data *data = hci_get_drvdata(hdev); 727 struct urb *urb; 728 unsigned char *buf; 729 unsigned int pipe; 730 int err, size; 731 732 BT_DBG("%s", hdev->name); 733 734 if (!data->intr_ep) 735 return -ENODEV; 736 737 urb = usb_alloc_urb(0, mem_flags); 738 if (!urb) 739 return -ENOMEM; 740 741 size = le16_to_cpu(data->intr_ep->wMaxPacketSize); 742 743 buf = kmalloc(size, mem_flags); 744 if (!buf) { 745 usb_free_urb(urb); 746 return -ENOMEM; 747 } 748 749 pipe = usb_rcvintpipe(data->udev, data->intr_ep->bEndpointAddress); 750 751 usb_fill_int_urb(urb, data->udev, pipe, buf, size, 752 btusb_intr_complete, hdev, data->intr_ep->bInterval); 753 754 urb->transfer_flags |= URB_FREE_BUFFER; 755 756 usb_anchor_urb(urb, &data->intr_anchor); 757 758 err = usb_submit_urb(urb, mem_flags); 759 if (err < 0) { 760 if (err != -EPERM && err != -ENODEV) 761 bt_dev_err(hdev, "urb %p submission failed (%d)", 762 urb, -err); 763 usb_unanchor_urb(urb); 764 } 765 766 usb_free_urb(urb); 767 768 return err; 769 } 770 771 static void btusb_bulk_complete(struct urb *urb) 772 { 773 struct hci_dev *hdev = urb->context; 774 struct btusb_data *data = hci_get_drvdata(hdev); 775 int err; 776 777 BT_DBG("%s urb %p status %d count %d", hdev->name, urb, urb->status, 778 urb->actual_length); 779 780 if (!test_bit(HCI_RUNNING, &hdev->flags)) 781 return; 782 783 if (urb->status == 0) { 784 hdev->stat.byte_rx += urb->actual_length; 785 786 if (data->recv_bulk(data, urb->transfer_buffer, 787 urb->actual_length) < 0) { 788 bt_dev_err(hdev, "corrupted ACL packet"); 789 hdev->stat.err_rx++; 790 } 791 } else if (urb->status == -ENOENT) { 792 /* Avoid suspend failed when usb_kill_urb */ 793 return; 794 } 795 796 if (!test_bit(BTUSB_BULK_RUNNING, &data->flags)) 797 return; 798 799 usb_anchor_urb(urb, &data->bulk_anchor); 800 usb_mark_last_busy(data->udev); 801 802 err = usb_submit_urb(urb, GFP_ATOMIC); 803 if (err < 0) { 804 /* -EPERM: urb is being killed; 805 * -ENODEV: device got disconnected 806 */ 807 if (err != -EPERM && err != -ENODEV) 808 bt_dev_err(hdev, "urb %p failed to resubmit (%d)", 809 urb, -err); 810 usb_unanchor_urb(urb); 811 } 812 } 813 814 static int btusb_submit_bulk_urb(struct hci_dev *hdev, gfp_t mem_flags) 815 { 816 struct btusb_data *data = hci_get_drvdata(hdev); 817 struct urb *urb; 818 unsigned char *buf; 819 unsigned int pipe; 820 int err, size = HCI_MAX_FRAME_SIZE; 821 822 BT_DBG("%s", hdev->name); 823 824 if (!data->bulk_rx_ep) 825 return -ENODEV; 826 827 urb = usb_alloc_urb(0, mem_flags); 828 if (!urb) 829 return -ENOMEM; 830 831 buf = kmalloc(size, mem_flags); 832 if (!buf) { 833 usb_free_urb(urb); 834 return -ENOMEM; 835 } 836 837 pipe = usb_rcvbulkpipe(data->udev, data->bulk_rx_ep->bEndpointAddress); 838 839 usb_fill_bulk_urb(urb, data->udev, pipe, buf, size, 840 btusb_bulk_complete, hdev); 841 842 urb->transfer_flags |= URB_FREE_BUFFER; 843 844 usb_mark_last_busy(data->udev); 845 usb_anchor_urb(urb, &data->bulk_anchor); 846 847 err = usb_submit_urb(urb, mem_flags); 848 if (err < 0) { 849 if (err != -EPERM && err != -ENODEV) 850 bt_dev_err(hdev, "urb %p submission failed (%d)", 851 urb, -err); 852 usb_unanchor_urb(urb); 853 } 854 855 usb_free_urb(urb); 856 857 return err; 858 } 859 860 static void btusb_isoc_complete(struct urb *urb) 861 { 862 struct hci_dev *hdev = urb->context; 863 struct btusb_data *data = hci_get_drvdata(hdev); 864 int i, err; 865 866 BT_DBG("%s urb %p status %d count %d", hdev->name, urb, urb->status, 867 urb->actual_length); 868 869 if (!test_bit(HCI_RUNNING, &hdev->flags)) 870 return; 871 872 if (urb->status == 0) { 873 for (i = 0; i < urb->number_of_packets; i++) { 874 unsigned int offset = urb->iso_frame_desc[i].offset; 875 unsigned int length = urb->iso_frame_desc[i].actual_length; 876 877 if (urb->iso_frame_desc[i].status) 878 continue; 879 880 hdev->stat.byte_rx += length; 881 882 if (btusb_recv_isoc(data, urb->transfer_buffer + offset, 883 length) < 0) { 884 bt_dev_err(hdev, "corrupted SCO packet"); 885 hdev->stat.err_rx++; 886 } 887 } 888 } else if (urb->status == -ENOENT) { 889 /* Avoid suspend failed when usb_kill_urb */ 890 return; 891 } 892 893 if (!test_bit(BTUSB_ISOC_RUNNING, &data->flags)) 894 return; 895 896 usb_anchor_urb(urb, &data->isoc_anchor); 897 898 err = usb_submit_urb(urb, GFP_ATOMIC); 899 if (err < 0) { 900 /* -EPERM: urb is being killed; 901 * -ENODEV: device got disconnected 902 */ 903 if (err != -EPERM && err != -ENODEV) 904 bt_dev_err(hdev, "urb %p failed to resubmit (%d)", 905 urb, -err); 906 usb_unanchor_urb(urb); 907 } 908 } 909 910 static inline void __fill_isoc_descriptor(struct urb *urb, int len, int mtu) 911 { 912 int i, offset = 0; 913 914 BT_DBG("len %d mtu %d", len, mtu); 915 916 for (i = 0; i < BTUSB_MAX_ISOC_FRAMES && len >= mtu; 917 i++, offset += mtu, len -= mtu) { 918 urb->iso_frame_desc[i].offset = offset; 919 urb->iso_frame_desc[i].length = mtu; 920 } 921 922 if (len && i < BTUSB_MAX_ISOC_FRAMES) { 923 urb->iso_frame_desc[i].offset = offset; 924 urb->iso_frame_desc[i].length = len; 925 i++; 926 } 927 928 urb->number_of_packets = i; 929 } 930 931 static int btusb_submit_isoc_urb(struct hci_dev *hdev, gfp_t mem_flags) 932 { 933 struct btusb_data *data = hci_get_drvdata(hdev); 934 struct urb *urb; 935 unsigned char *buf; 936 unsigned int pipe; 937 int err, size; 938 939 BT_DBG("%s", hdev->name); 940 941 if (!data->isoc_rx_ep) 942 return -ENODEV; 943 944 urb = usb_alloc_urb(BTUSB_MAX_ISOC_FRAMES, mem_flags); 945 if (!urb) 946 return -ENOMEM; 947 948 size = le16_to_cpu(data->isoc_rx_ep->wMaxPacketSize) * 949 BTUSB_MAX_ISOC_FRAMES; 950 951 buf = kmalloc(size, mem_flags); 952 if (!buf) { 953 usb_free_urb(urb); 954 return -ENOMEM; 955 } 956 957 pipe = usb_rcvisocpipe(data->udev, data->isoc_rx_ep->bEndpointAddress); 958 959 usb_fill_int_urb(urb, data->udev, pipe, buf, size, btusb_isoc_complete, 960 hdev, data->isoc_rx_ep->bInterval); 961 962 urb->transfer_flags = URB_FREE_BUFFER | URB_ISO_ASAP; 963 964 __fill_isoc_descriptor(urb, size, 965 le16_to_cpu(data->isoc_rx_ep->wMaxPacketSize)); 966 967 usb_anchor_urb(urb, &data->isoc_anchor); 968 969 err = usb_submit_urb(urb, mem_flags); 970 if (err < 0) { 971 if (err != -EPERM && err != -ENODEV) 972 bt_dev_err(hdev, "urb %p submission failed (%d)", 973 urb, -err); 974 usb_unanchor_urb(urb); 975 } 976 977 usb_free_urb(urb); 978 979 return err; 980 } 981 982 static void btusb_diag_complete(struct urb *urb) 983 { 984 struct hci_dev *hdev = urb->context; 985 struct btusb_data *data = hci_get_drvdata(hdev); 986 int err; 987 988 BT_DBG("%s urb %p status %d count %d", hdev->name, urb, urb->status, 989 urb->actual_length); 990 991 if (urb->status == 0) { 992 struct sk_buff *skb; 993 994 skb = bt_skb_alloc(urb->actual_length, GFP_ATOMIC); 995 if (skb) { 996 skb_put_data(skb, urb->transfer_buffer, 997 urb->actual_length); 998 hci_recv_diag(hdev, skb); 999 } 1000 } else if (urb->status == -ENOENT) { 1001 /* Avoid suspend failed when usb_kill_urb */ 1002 return; 1003 } 1004 1005 if (!test_bit(BTUSB_DIAG_RUNNING, &data->flags)) 1006 return; 1007 1008 usb_anchor_urb(urb, &data->diag_anchor); 1009 usb_mark_last_busy(data->udev); 1010 1011 err = usb_submit_urb(urb, GFP_ATOMIC); 1012 if (err < 0) { 1013 /* -EPERM: urb is being killed; 1014 * -ENODEV: device got disconnected 1015 */ 1016 if (err != -EPERM && err != -ENODEV) 1017 bt_dev_err(hdev, "urb %p failed to resubmit (%d)", 1018 urb, -err); 1019 usb_unanchor_urb(urb); 1020 } 1021 } 1022 1023 static int btusb_submit_diag_urb(struct hci_dev *hdev, gfp_t mem_flags) 1024 { 1025 struct btusb_data *data = hci_get_drvdata(hdev); 1026 struct urb *urb; 1027 unsigned char *buf; 1028 unsigned int pipe; 1029 int err, size = HCI_MAX_FRAME_SIZE; 1030 1031 BT_DBG("%s", hdev->name); 1032 1033 if (!data->diag_rx_ep) 1034 return -ENODEV; 1035 1036 urb = usb_alloc_urb(0, mem_flags); 1037 if (!urb) 1038 return -ENOMEM; 1039 1040 buf = kmalloc(size, mem_flags); 1041 if (!buf) { 1042 usb_free_urb(urb); 1043 return -ENOMEM; 1044 } 1045 1046 pipe = usb_rcvbulkpipe(data->udev, data->diag_rx_ep->bEndpointAddress); 1047 1048 usb_fill_bulk_urb(urb, data->udev, pipe, buf, size, 1049 btusb_diag_complete, hdev); 1050 1051 urb->transfer_flags |= URB_FREE_BUFFER; 1052 1053 usb_mark_last_busy(data->udev); 1054 usb_anchor_urb(urb, &data->diag_anchor); 1055 1056 err = usb_submit_urb(urb, mem_flags); 1057 if (err < 0) { 1058 if (err != -EPERM && err != -ENODEV) 1059 bt_dev_err(hdev, "urb %p submission failed (%d)", 1060 urb, -err); 1061 usb_unanchor_urb(urb); 1062 } 1063 1064 usb_free_urb(urb); 1065 1066 return err; 1067 } 1068 1069 static void btusb_tx_complete(struct urb *urb) 1070 { 1071 struct sk_buff *skb = urb->context; 1072 struct hci_dev *hdev = (struct hci_dev *)skb->dev; 1073 struct btusb_data *data = hci_get_drvdata(hdev); 1074 unsigned long flags; 1075 1076 BT_DBG("%s urb %p status %d count %d", hdev->name, urb, urb->status, 1077 urb->actual_length); 1078 1079 if (!test_bit(HCI_RUNNING, &hdev->flags)) 1080 goto done; 1081 1082 if (!urb->status) 1083 hdev->stat.byte_tx += urb->transfer_buffer_length; 1084 else 1085 hdev->stat.err_tx++; 1086 1087 done: 1088 spin_lock_irqsave(&data->txlock, flags); 1089 data->tx_in_flight--; 1090 spin_unlock_irqrestore(&data->txlock, flags); 1091 1092 kfree(urb->setup_packet); 1093 1094 kfree_skb(skb); 1095 } 1096 1097 static void btusb_isoc_tx_complete(struct urb *urb) 1098 { 1099 struct sk_buff *skb = urb->context; 1100 struct hci_dev *hdev = (struct hci_dev *)skb->dev; 1101 1102 BT_DBG("%s urb %p status %d count %d", hdev->name, urb, urb->status, 1103 urb->actual_length); 1104 1105 if (!test_bit(HCI_RUNNING, &hdev->flags)) 1106 goto done; 1107 1108 if (!urb->status) 1109 hdev->stat.byte_tx += urb->transfer_buffer_length; 1110 else 1111 hdev->stat.err_tx++; 1112 1113 done: 1114 kfree(urb->setup_packet); 1115 1116 kfree_skb(skb); 1117 } 1118 1119 static int btusb_open(struct hci_dev *hdev) 1120 { 1121 struct btusb_data *data = hci_get_drvdata(hdev); 1122 int err; 1123 1124 BT_DBG("%s", hdev->name); 1125 1126 err = usb_autopm_get_interface(data->intf); 1127 if (err < 0) 1128 return err; 1129 1130 /* Patching USB firmware files prior to starting any URBs of HCI path 1131 * It is more safe to use USB bulk channel for downloading USB patch 1132 */ 1133 if (data->setup_on_usb) { 1134 err = data->setup_on_usb(hdev); 1135 if (err < 0) 1136 return err; 1137 } 1138 1139 data->intf->needs_remote_wakeup = 1; 1140 /* device specific wakeup source enabled and required for USB 1141 * remote wakeup while host is suspended 1142 */ 1143 device_wakeup_enable(&data->udev->dev); 1144 1145 if (test_and_set_bit(BTUSB_INTR_RUNNING, &data->flags)) 1146 goto done; 1147 1148 err = btusb_submit_intr_urb(hdev, GFP_KERNEL); 1149 if (err < 0) 1150 goto failed; 1151 1152 err = btusb_submit_bulk_urb(hdev, GFP_KERNEL); 1153 if (err < 0) { 1154 usb_kill_anchored_urbs(&data->intr_anchor); 1155 goto failed; 1156 } 1157 1158 set_bit(BTUSB_BULK_RUNNING, &data->flags); 1159 btusb_submit_bulk_urb(hdev, GFP_KERNEL); 1160 1161 if (data->diag) { 1162 if (!btusb_submit_diag_urb(hdev, GFP_KERNEL)) 1163 set_bit(BTUSB_DIAG_RUNNING, &data->flags); 1164 } 1165 1166 done: 1167 usb_autopm_put_interface(data->intf); 1168 return 0; 1169 1170 failed: 1171 clear_bit(BTUSB_INTR_RUNNING, &data->flags); 1172 usb_autopm_put_interface(data->intf); 1173 return err; 1174 } 1175 1176 static void btusb_stop_traffic(struct btusb_data *data) 1177 { 1178 usb_kill_anchored_urbs(&data->intr_anchor); 1179 usb_kill_anchored_urbs(&data->bulk_anchor); 1180 usb_kill_anchored_urbs(&data->isoc_anchor); 1181 usb_kill_anchored_urbs(&data->diag_anchor); 1182 } 1183 1184 static int btusb_close(struct hci_dev *hdev) 1185 { 1186 struct btusb_data *data = hci_get_drvdata(hdev); 1187 int err; 1188 1189 BT_DBG("%s", hdev->name); 1190 1191 cancel_work_sync(&data->work); 1192 cancel_work_sync(&data->waker); 1193 1194 clear_bit(BTUSB_ISOC_RUNNING, &data->flags); 1195 clear_bit(BTUSB_BULK_RUNNING, &data->flags); 1196 clear_bit(BTUSB_INTR_RUNNING, &data->flags); 1197 clear_bit(BTUSB_DIAG_RUNNING, &data->flags); 1198 1199 btusb_stop_traffic(data); 1200 btusb_free_frags(data); 1201 1202 err = usb_autopm_get_interface(data->intf); 1203 if (err < 0) 1204 goto failed; 1205 1206 data->intf->needs_remote_wakeup = 0; 1207 device_wakeup_disable(&data->udev->dev); 1208 usb_autopm_put_interface(data->intf); 1209 1210 failed: 1211 usb_scuttle_anchored_urbs(&data->deferred); 1212 return 0; 1213 } 1214 1215 static int btusb_flush(struct hci_dev *hdev) 1216 { 1217 struct btusb_data *data = hci_get_drvdata(hdev); 1218 1219 BT_DBG("%s", hdev->name); 1220 1221 usb_kill_anchored_urbs(&data->tx_anchor); 1222 btusb_free_frags(data); 1223 1224 return 0; 1225 } 1226 1227 static struct urb *alloc_ctrl_urb(struct hci_dev *hdev, struct sk_buff *skb) 1228 { 1229 struct btusb_data *data = hci_get_drvdata(hdev); 1230 struct usb_ctrlrequest *dr; 1231 struct urb *urb; 1232 unsigned int pipe; 1233 1234 urb = usb_alloc_urb(0, GFP_KERNEL); 1235 if (!urb) 1236 return ERR_PTR(-ENOMEM); 1237 1238 dr = kmalloc(sizeof(*dr), GFP_KERNEL); 1239 if (!dr) { 1240 usb_free_urb(urb); 1241 return ERR_PTR(-ENOMEM); 1242 } 1243 1244 dr->bRequestType = data->cmdreq_type; 1245 dr->bRequest = data->cmdreq; 1246 dr->wIndex = 0; 1247 dr->wValue = 0; 1248 dr->wLength = __cpu_to_le16(skb->len); 1249 1250 pipe = usb_sndctrlpipe(data->udev, 0x00); 1251 1252 usb_fill_control_urb(urb, data->udev, pipe, (void *)dr, 1253 skb->data, skb->len, btusb_tx_complete, skb); 1254 1255 skb->dev = (void *)hdev; 1256 1257 return urb; 1258 } 1259 1260 static struct urb *alloc_bulk_urb(struct hci_dev *hdev, struct sk_buff *skb) 1261 { 1262 struct btusb_data *data = hci_get_drvdata(hdev); 1263 struct urb *urb; 1264 unsigned int pipe; 1265 1266 if (!data->bulk_tx_ep) 1267 return ERR_PTR(-ENODEV); 1268 1269 urb = usb_alloc_urb(0, GFP_KERNEL); 1270 if (!urb) 1271 return ERR_PTR(-ENOMEM); 1272 1273 pipe = usb_sndbulkpipe(data->udev, data->bulk_tx_ep->bEndpointAddress); 1274 1275 usb_fill_bulk_urb(urb, data->udev, pipe, 1276 skb->data, skb->len, btusb_tx_complete, skb); 1277 1278 skb->dev = (void *)hdev; 1279 1280 return urb; 1281 } 1282 1283 static struct urb *alloc_isoc_urb(struct hci_dev *hdev, struct sk_buff *skb) 1284 { 1285 struct btusb_data *data = hci_get_drvdata(hdev); 1286 struct urb *urb; 1287 unsigned int pipe; 1288 1289 if (!data->isoc_tx_ep) 1290 return ERR_PTR(-ENODEV); 1291 1292 urb = usb_alloc_urb(BTUSB_MAX_ISOC_FRAMES, GFP_KERNEL); 1293 if (!urb) 1294 return ERR_PTR(-ENOMEM); 1295 1296 pipe = usb_sndisocpipe(data->udev, data->isoc_tx_ep->bEndpointAddress); 1297 1298 usb_fill_int_urb(urb, data->udev, pipe, 1299 skb->data, skb->len, btusb_isoc_tx_complete, 1300 skb, data->isoc_tx_ep->bInterval); 1301 1302 urb->transfer_flags = URB_ISO_ASAP; 1303 1304 __fill_isoc_descriptor(urb, skb->len, 1305 le16_to_cpu(data->isoc_tx_ep->wMaxPacketSize)); 1306 1307 skb->dev = (void *)hdev; 1308 1309 return urb; 1310 } 1311 1312 static int submit_tx_urb(struct hci_dev *hdev, struct urb *urb) 1313 { 1314 struct btusb_data *data = hci_get_drvdata(hdev); 1315 int err; 1316 1317 usb_anchor_urb(urb, &data->tx_anchor); 1318 1319 err = usb_submit_urb(urb, GFP_KERNEL); 1320 if (err < 0) { 1321 if (err != -EPERM && err != -ENODEV) 1322 bt_dev_err(hdev, "urb %p submission failed (%d)", 1323 urb, -err); 1324 kfree(urb->setup_packet); 1325 usb_unanchor_urb(urb); 1326 } else { 1327 usb_mark_last_busy(data->udev); 1328 } 1329 1330 usb_free_urb(urb); 1331 return err; 1332 } 1333 1334 static int submit_or_queue_tx_urb(struct hci_dev *hdev, struct urb *urb) 1335 { 1336 struct btusb_data *data = hci_get_drvdata(hdev); 1337 unsigned long flags; 1338 bool suspending; 1339 1340 spin_lock_irqsave(&data->txlock, flags); 1341 suspending = test_bit(BTUSB_SUSPENDING, &data->flags); 1342 if (!suspending) 1343 data->tx_in_flight++; 1344 spin_unlock_irqrestore(&data->txlock, flags); 1345 1346 if (!suspending) 1347 return submit_tx_urb(hdev, urb); 1348 1349 usb_anchor_urb(urb, &data->deferred); 1350 schedule_work(&data->waker); 1351 1352 usb_free_urb(urb); 1353 return 0; 1354 } 1355 1356 static int btusb_send_frame(struct hci_dev *hdev, struct sk_buff *skb) 1357 { 1358 struct urb *urb; 1359 1360 BT_DBG("%s", hdev->name); 1361 1362 switch (hci_skb_pkt_type(skb)) { 1363 case HCI_COMMAND_PKT: 1364 urb = alloc_ctrl_urb(hdev, skb); 1365 if (IS_ERR(urb)) 1366 return PTR_ERR(urb); 1367 1368 hdev->stat.cmd_tx++; 1369 return submit_or_queue_tx_urb(hdev, urb); 1370 1371 case HCI_ACLDATA_PKT: 1372 urb = alloc_bulk_urb(hdev, skb); 1373 if (IS_ERR(urb)) 1374 return PTR_ERR(urb); 1375 1376 hdev->stat.acl_tx++; 1377 return submit_or_queue_tx_urb(hdev, urb); 1378 1379 case HCI_SCODATA_PKT: 1380 if (hci_conn_num(hdev, SCO_LINK) < 1) 1381 return -ENODEV; 1382 1383 urb = alloc_isoc_urb(hdev, skb); 1384 if (IS_ERR(urb)) 1385 return PTR_ERR(urb); 1386 1387 hdev->stat.sco_tx++; 1388 return submit_tx_urb(hdev, urb); 1389 } 1390 1391 return -EILSEQ; 1392 } 1393 1394 static void btusb_notify(struct hci_dev *hdev, unsigned int evt) 1395 { 1396 struct btusb_data *data = hci_get_drvdata(hdev); 1397 1398 BT_DBG("%s evt %d", hdev->name, evt); 1399 1400 if (hci_conn_num(hdev, SCO_LINK) != data->sco_num) { 1401 data->sco_num = hci_conn_num(hdev, SCO_LINK); 1402 schedule_work(&data->work); 1403 } 1404 } 1405 1406 static inline int __set_isoc_interface(struct hci_dev *hdev, int altsetting) 1407 { 1408 struct btusb_data *data = hci_get_drvdata(hdev); 1409 struct usb_interface *intf = data->isoc; 1410 struct usb_endpoint_descriptor *ep_desc; 1411 int i, err; 1412 1413 if (!data->isoc) 1414 return -ENODEV; 1415 1416 err = usb_set_interface(data->udev, data->isoc_ifnum, altsetting); 1417 if (err < 0) { 1418 bt_dev_err(hdev, "setting interface failed (%d)", -err); 1419 return err; 1420 } 1421 1422 data->isoc_altsetting = altsetting; 1423 1424 data->isoc_tx_ep = NULL; 1425 data->isoc_rx_ep = NULL; 1426 1427 for (i = 0; i < intf->cur_altsetting->desc.bNumEndpoints; i++) { 1428 ep_desc = &intf->cur_altsetting->endpoint[i].desc; 1429 1430 if (!data->isoc_tx_ep && usb_endpoint_is_isoc_out(ep_desc)) { 1431 data->isoc_tx_ep = ep_desc; 1432 continue; 1433 } 1434 1435 if (!data->isoc_rx_ep && usb_endpoint_is_isoc_in(ep_desc)) { 1436 data->isoc_rx_ep = ep_desc; 1437 continue; 1438 } 1439 } 1440 1441 if (!data->isoc_tx_ep || !data->isoc_rx_ep) { 1442 bt_dev_err(hdev, "invalid SCO descriptors"); 1443 return -ENODEV; 1444 } 1445 1446 return 0; 1447 } 1448 1449 static void btusb_work(struct work_struct *work) 1450 { 1451 struct btusb_data *data = container_of(work, struct btusb_data, work); 1452 struct hci_dev *hdev = data->hdev; 1453 int new_alts; 1454 int err; 1455 1456 if (data->sco_num > 0) { 1457 if (!test_bit(BTUSB_DID_ISO_RESUME, &data->flags)) { 1458 err = usb_autopm_get_interface(data->isoc ? data->isoc : data->intf); 1459 if (err < 0) { 1460 clear_bit(BTUSB_ISOC_RUNNING, &data->flags); 1461 usb_kill_anchored_urbs(&data->isoc_anchor); 1462 return; 1463 } 1464 1465 set_bit(BTUSB_DID_ISO_RESUME, &data->flags); 1466 } 1467 1468 if (hdev->voice_setting & 0x0020) { 1469 static const int alts[3] = { 2, 4, 5 }; 1470 1471 new_alts = alts[data->sco_num - 1]; 1472 } else { 1473 new_alts = data->sco_num; 1474 } 1475 1476 if (data->isoc_altsetting != new_alts) { 1477 unsigned long flags; 1478 1479 clear_bit(BTUSB_ISOC_RUNNING, &data->flags); 1480 usb_kill_anchored_urbs(&data->isoc_anchor); 1481 1482 /* When isochronous alternate setting needs to be 1483 * changed, because SCO connection has been added 1484 * or removed, a packet fragment may be left in the 1485 * reassembling state. This could lead to wrongly 1486 * assembled fragments. 1487 * 1488 * Clear outstanding fragment when selecting a new 1489 * alternate setting. 1490 */ 1491 spin_lock_irqsave(&data->rxlock, flags); 1492 kfree_skb(data->sco_skb); 1493 data->sco_skb = NULL; 1494 spin_unlock_irqrestore(&data->rxlock, flags); 1495 1496 if (__set_isoc_interface(hdev, new_alts) < 0) 1497 return; 1498 } 1499 1500 if (!test_and_set_bit(BTUSB_ISOC_RUNNING, &data->flags)) { 1501 if (btusb_submit_isoc_urb(hdev, GFP_KERNEL) < 0) 1502 clear_bit(BTUSB_ISOC_RUNNING, &data->flags); 1503 else 1504 btusb_submit_isoc_urb(hdev, GFP_KERNEL); 1505 } 1506 } else { 1507 clear_bit(BTUSB_ISOC_RUNNING, &data->flags); 1508 usb_kill_anchored_urbs(&data->isoc_anchor); 1509 1510 __set_isoc_interface(hdev, 0); 1511 if (test_and_clear_bit(BTUSB_DID_ISO_RESUME, &data->flags)) 1512 usb_autopm_put_interface(data->isoc ? data->isoc : data->intf); 1513 } 1514 } 1515 1516 static void btusb_waker(struct work_struct *work) 1517 { 1518 struct btusb_data *data = container_of(work, struct btusb_data, waker); 1519 int err; 1520 1521 err = usb_autopm_get_interface(data->intf); 1522 if (err < 0) 1523 return; 1524 1525 usb_autopm_put_interface(data->intf); 1526 } 1527 1528 static int btusb_setup_bcm92035(struct hci_dev *hdev) 1529 { 1530 struct sk_buff *skb; 1531 u8 val = 0x00; 1532 1533 BT_DBG("%s", hdev->name); 1534 1535 skb = __hci_cmd_sync(hdev, 0xfc3b, 1, &val, HCI_INIT_TIMEOUT); 1536 if (IS_ERR(skb)) 1537 bt_dev_err(hdev, "BCM92035 command failed (%ld)", PTR_ERR(skb)); 1538 else 1539 kfree_skb(skb); 1540 1541 return 0; 1542 } 1543 1544 static int btusb_setup_csr(struct hci_dev *hdev) 1545 { 1546 struct hci_rp_read_local_version *rp; 1547 struct sk_buff *skb; 1548 1549 BT_DBG("%s", hdev->name); 1550 1551 skb = __hci_cmd_sync(hdev, HCI_OP_READ_LOCAL_VERSION, 0, NULL, 1552 HCI_INIT_TIMEOUT); 1553 if (IS_ERR(skb)) { 1554 int err = PTR_ERR(skb); 1555 bt_dev_err(hdev, "CSR: Local version failed (%d)", err); 1556 return err; 1557 } 1558 1559 if (skb->len != sizeof(struct hci_rp_read_local_version)) { 1560 bt_dev_err(hdev, "CSR: Local version length mismatch"); 1561 kfree_skb(skb); 1562 return -EIO; 1563 } 1564 1565 rp = (struct hci_rp_read_local_version *)skb->data; 1566 1567 /* Detect controllers which aren't real CSR ones. */ 1568 if (le16_to_cpu(rp->manufacturer) != 10 || 1569 le16_to_cpu(rp->lmp_subver) == 0x0c5c) { 1570 /* Clear the reset quirk since this is not an actual 1571 * early Bluetooth 1.1 device from CSR. 1572 */ 1573 clear_bit(HCI_QUIRK_RESET_ON_CLOSE, &hdev->quirks); 1574 1575 /* These fake CSR controllers have all a broken 1576 * stored link key handling and so just disable it. 1577 */ 1578 set_bit(HCI_QUIRK_BROKEN_STORED_LINK_KEY, &hdev->quirks); 1579 } 1580 1581 kfree_skb(skb); 1582 1583 return 0; 1584 } 1585 1586 static const struct firmware *btusb_setup_intel_get_fw(struct hci_dev *hdev, 1587 struct intel_version *ver) 1588 { 1589 const struct firmware *fw; 1590 char fwname[64]; 1591 int ret; 1592 1593 snprintf(fwname, sizeof(fwname), 1594 "intel/ibt-hw-%x.%x.%x-fw-%x.%x.%x.%x.%x.bseq", 1595 ver->hw_platform, ver->hw_variant, ver->hw_revision, 1596 ver->fw_variant, ver->fw_revision, ver->fw_build_num, 1597 ver->fw_build_ww, ver->fw_build_yy); 1598 1599 ret = request_firmware(&fw, fwname, &hdev->dev); 1600 if (ret < 0) { 1601 if (ret == -EINVAL) { 1602 bt_dev_err(hdev, "Intel firmware file request failed (%d)", 1603 ret); 1604 return NULL; 1605 } 1606 1607 bt_dev_err(hdev, "failed to open Intel firmware file: %s (%d)", 1608 fwname, ret); 1609 1610 /* If the correct firmware patch file is not found, use the 1611 * default firmware patch file instead 1612 */ 1613 snprintf(fwname, sizeof(fwname), "intel/ibt-hw-%x.%x.bseq", 1614 ver->hw_platform, ver->hw_variant); 1615 if (request_firmware(&fw, fwname, &hdev->dev) < 0) { 1616 bt_dev_err(hdev, "failed to open default fw file: %s", 1617 fwname); 1618 return NULL; 1619 } 1620 } 1621 1622 bt_dev_info(hdev, "Intel Bluetooth firmware file: %s", fwname); 1623 1624 return fw; 1625 } 1626 1627 static int btusb_setup_intel_patching(struct hci_dev *hdev, 1628 const struct firmware *fw, 1629 const u8 **fw_ptr, int *disable_patch) 1630 { 1631 struct sk_buff *skb; 1632 struct hci_command_hdr *cmd; 1633 const u8 *cmd_param; 1634 struct hci_event_hdr *evt = NULL; 1635 const u8 *evt_param = NULL; 1636 int remain = fw->size - (*fw_ptr - fw->data); 1637 1638 /* The first byte indicates the types of the patch command or event. 1639 * 0x01 means HCI command and 0x02 is HCI event. If the first bytes 1640 * in the current firmware buffer doesn't start with 0x01 or 1641 * the size of remain buffer is smaller than HCI command header, 1642 * the firmware file is corrupted and it should stop the patching 1643 * process. 1644 */ 1645 if (remain > HCI_COMMAND_HDR_SIZE && *fw_ptr[0] != 0x01) { 1646 bt_dev_err(hdev, "Intel fw corrupted: invalid cmd read"); 1647 return -EINVAL; 1648 } 1649 (*fw_ptr)++; 1650 remain--; 1651 1652 cmd = (struct hci_command_hdr *)(*fw_ptr); 1653 *fw_ptr += sizeof(*cmd); 1654 remain -= sizeof(*cmd); 1655 1656 /* Ensure that the remain firmware data is long enough than the length 1657 * of command parameter. If not, the firmware file is corrupted. 1658 */ 1659 if (remain < cmd->plen) { 1660 bt_dev_err(hdev, "Intel fw corrupted: invalid cmd len"); 1661 return -EFAULT; 1662 } 1663 1664 /* If there is a command that loads a patch in the firmware 1665 * file, then enable the patch upon success, otherwise just 1666 * disable the manufacturer mode, for example patch activation 1667 * is not required when the default firmware patch file is used 1668 * because there are no patch data to load. 1669 */ 1670 if (*disable_patch && le16_to_cpu(cmd->opcode) == 0xfc8e) 1671 *disable_patch = 0; 1672 1673 cmd_param = *fw_ptr; 1674 *fw_ptr += cmd->plen; 1675 remain -= cmd->plen; 1676 1677 /* This reads the expected events when the above command is sent to the 1678 * device. Some vendor commands expects more than one events, for 1679 * example command status event followed by vendor specific event. 1680 * For this case, it only keeps the last expected event. so the command 1681 * can be sent with __hci_cmd_sync_ev() which returns the sk_buff of 1682 * last expected event. 1683 */ 1684 while (remain > HCI_EVENT_HDR_SIZE && *fw_ptr[0] == 0x02) { 1685 (*fw_ptr)++; 1686 remain--; 1687 1688 evt = (struct hci_event_hdr *)(*fw_ptr); 1689 *fw_ptr += sizeof(*evt); 1690 remain -= sizeof(*evt); 1691 1692 if (remain < evt->plen) { 1693 bt_dev_err(hdev, "Intel fw corrupted: invalid evt len"); 1694 return -EFAULT; 1695 } 1696 1697 evt_param = *fw_ptr; 1698 *fw_ptr += evt->plen; 1699 remain -= evt->plen; 1700 } 1701 1702 /* Every HCI commands in the firmware file has its correspond event. 1703 * If event is not found or remain is smaller than zero, the firmware 1704 * file is corrupted. 1705 */ 1706 if (!evt || !evt_param || remain < 0) { 1707 bt_dev_err(hdev, "Intel fw corrupted: invalid evt read"); 1708 return -EFAULT; 1709 } 1710 1711 skb = __hci_cmd_sync_ev(hdev, le16_to_cpu(cmd->opcode), cmd->plen, 1712 cmd_param, evt->evt, HCI_INIT_TIMEOUT); 1713 if (IS_ERR(skb)) { 1714 bt_dev_err(hdev, "sending Intel patch command (0x%4.4x) failed (%ld)", 1715 cmd->opcode, PTR_ERR(skb)); 1716 return PTR_ERR(skb); 1717 } 1718 1719 /* It ensures that the returned event matches the event data read from 1720 * the firmware file. At fist, it checks the length and then 1721 * the contents of the event. 1722 */ 1723 if (skb->len != evt->plen) { 1724 bt_dev_err(hdev, "mismatch event length (opcode 0x%4.4x)", 1725 le16_to_cpu(cmd->opcode)); 1726 kfree_skb(skb); 1727 return -EFAULT; 1728 } 1729 1730 if (memcmp(skb->data, evt_param, evt->plen)) { 1731 bt_dev_err(hdev, "mismatch event parameter (opcode 0x%4.4x)", 1732 le16_to_cpu(cmd->opcode)); 1733 kfree_skb(skb); 1734 return -EFAULT; 1735 } 1736 kfree_skb(skb); 1737 1738 return 0; 1739 } 1740 1741 static int btusb_setup_intel(struct hci_dev *hdev) 1742 { 1743 struct sk_buff *skb; 1744 const struct firmware *fw; 1745 const u8 *fw_ptr; 1746 int disable_patch, err; 1747 struct intel_version ver; 1748 1749 BT_DBG("%s", hdev->name); 1750 1751 /* The controller has a bug with the first HCI command sent to it 1752 * returning number of completed commands as zero. This would stall the 1753 * command processing in the Bluetooth core. 1754 * 1755 * As a workaround, send HCI Reset command first which will reset the 1756 * number of completed commands and allow normal command processing 1757 * from now on. 1758 */ 1759 skb = __hci_cmd_sync(hdev, HCI_OP_RESET, 0, NULL, HCI_INIT_TIMEOUT); 1760 if (IS_ERR(skb)) { 1761 bt_dev_err(hdev, "sending initial HCI reset command failed (%ld)", 1762 PTR_ERR(skb)); 1763 return PTR_ERR(skb); 1764 } 1765 kfree_skb(skb); 1766 1767 /* Read Intel specific controller version first to allow selection of 1768 * which firmware file to load. 1769 * 1770 * The returned information are hardware variant and revision plus 1771 * firmware variant, revision and build number. 1772 */ 1773 err = btintel_read_version(hdev, &ver); 1774 if (err) 1775 return err; 1776 1777 bt_dev_info(hdev, "read Intel version: %02x%02x%02x%02x%02x%02x%02x%02x%02x", 1778 ver.hw_platform, ver.hw_variant, ver.hw_revision, 1779 ver.fw_variant, ver.fw_revision, ver.fw_build_num, 1780 ver.fw_build_ww, ver.fw_build_yy, ver.fw_patch_num); 1781 1782 /* fw_patch_num indicates the version of patch the device currently 1783 * have. If there is no patch data in the device, it is always 0x00. 1784 * So, if it is other than 0x00, no need to patch the device again. 1785 */ 1786 if (ver.fw_patch_num) { 1787 bt_dev_info(hdev, "Intel device is already patched. " 1788 "patch num: %02x", ver.fw_patch_num); 1789 goto complete; 1790 } 1791 1792 /* Opens the firmware patch file based on the firmware version read 1793 * from the controller. If it fails to open the matching firmware 1794 * patch file, it tries to open the default firmware patch file. 1795 * If no patch file is found, allow the device to operate without 1796 * a patch. 1797 */ 1798 fw = btusb_setup_intel_get_fw(hdev, &ver); 1799 if (!fw) 1800 goto complete; 1801 fw_ptr = fw->data; 1802 1803 /* Enable the manufacturer mode of the controller. 1804 * Only while this mode is enabled, the driver can download the 1805 * firmware patch data and configuration parameters. 1806 */ 1807 err = btintel_enter_mfg(hdev); 1808 if (err) { 1809 release_firmware(fw); 1810 return err; 1811 } 1812 1813 disable_patch = 1; 1814 1815 /* The firmware data file consists of list of Intel specific HCI 1816 * commands and its expected events. The first byte indicates the 1817 * type of the message, either HCI command or HCI event. 1818 * 1819 * It reads the command and its expected event from the firmware file, 1820 * and send to the controller. Once __hci_cmd_sync_ev() returns, 1821 * the returned event is compared with the event read from the firmware 1822 * file and it will continue until all the messages are downloaded to 1823 * the controller. 1824 * 1825 * Once the firmware patching is completed successfully, 1826 * the manufacturer mode is disabled with reset and activating the 1827 * downloaded patch. 1828 * 1829 * If the firmware patching fails, the manufacturer mode is 1830 * disabled with reset and deactivating the patch. 1831 * 1832 * If the default patch file is used, no reset is done when disabling 1833 * the manufacturer. 1834 */ 1835 while (fw->size > fw_ptr - fw->data) { 1836 int ret; 1837 1838 ret = btusb_setup_intel_patching(hdev, fw, &fw_ptr, 1839 &disable_patch); 1840 if (ret < 0) 1841 goto exit_mfg_deactivate; 1842 } 1843 1844 release_firmware(fw); 1845 1846 if (disable_patch) 1847 goto exit_mfg_disable; 1848 1849 /* Patching completed successfully and disable the manufacturer mode 1850 * with reset and activate the downloaded firmware patches. 1851 */ 1852 err = btintel_exit_mfg(hdev, true, true); 1853 if (err) 1854 return err; 1855 1856 bt_dev_info(hdev, "Intel firmware patch completed and activated"); 1857 1858 goto complete; 1859 1860 exit_mfg_disable: 1861 /* Disable the manufacturer mode without reset */ 1862 err = btintel_exit_mfg(hdev, false, false); 1863 if (err) 1864 return err; 1865 1866 bt_dev_info(hdev, "Intel firmware patch completed"); 1867 1868 goto complete; 1869 1870 exit_mfg_deactivate: 1871 release_firmware(fw); 1872 1873 /* Patching failed. Disable the manufacturer mode with reset and 1874 * deactivate the downloaded firmware patches. 1875 */ 1876 err = btintel_exit_mfg(hdev, true, false); 1877 if (err) 1878 return err; 1879 1880 bt_dev_info(hdev, "Intel firmware patch completed and deactivated"); 1881 1882 complete: 1883 /* Set the event mask for Intel specific vendor events. This enables 1884 * a few extra events that are useful during general operation. 1885 */ 1886 btintel_set_event_mask_mfg(hdev, false); 1887 1888 btintel_check_bdaddr(hdev); 1889 return 0; 1890 } 1891 1892 static int inject_cmd_complete(struct hci_dev *hdev, __u16 opcode) 1893 { 1894 struct sk_buff *skb; 1895 struct hci_event_hdr *hdr; 1896 struct hci_ev_cmd_complete *evt; 1897 1898 skb = bt_skb_alloc(sizeof(*hdr) + sizeof(*evt) + 1, GFP_KERNEL); 1899 if (!skb) 1900 return -ENOMEM; 1901 1902 hdr = skb_put(skb, sizeof(*hdr)); 1903 hdr->evt = HCI_EV_CMD_COMPLETE; 1904 hdr->plen = sizeof(*evt) + 1; 1905 1906 evt = skb_put(skb, sizeof(*evt)); 1907 evt->ncmd = 0x01; 1908 evt->opcode = cpu_to_le16(opcode); 1909 1910 skb_put_u8(skb, 0x00); 1911 1912 hci_skb_pkt_type(skb) = HCI_EVENT_PKT; 1913 1914 return hci_recv_frame(hdev, skb); 1915 } 1916 1917 static int btusb_recv_bulk_intel(struct btusb_data *data, void *buffer, 1918 int count) 1919 { 1920 /* When the device is in bootloader mode, then it can send 1921 * events via the bulk endpoint. These events are treated the 1922 * same way as the ones received from the interrupt endpoint. 1923 */ 1924 if (test_bit(BTUSB_BOOTLOADER, &data->flags)) 1925 return btusb_recv_intr(data, buffer, count); 1926 1927 return btusb_recv_bulk(data, buffer, count); 1928 } 1929 1930 static void btusb_intel_bootup(struct btusb_data *data, const void *ptr, 1931 unsigned int len) 1932 { 1933 const struct intel_bootup *evt = ptr; 1934 1935 if (len != sizeof(*evt)) 1936 return; 1937 1938 if (test_and_clear_bit(BTUSB_BOOTING, &data->flags)) { 1939 smp_mb__after_atomic(); 1940 wake_up_bit(&data->flags, BTUSB_BOOTING); 1941 } 1942 } 1943 1944 static void btusb_intel_secure_send_result(struct btusb_data *data, 1945 const void *ptr, unsigned int len) 1946 { 1947 const struct intel_secure_send_result *evt = ptr; 1948 1949 if (len != sizeof(*evt)) 1950 return; 1951 1952 if (evt->result) 1953 set_bit(BTUSB_FIRMWARE_FAILED, &data->flags); 1954 1955 if (test_and_clear_bit(BTUSB_DOWNLOADING, &data->flags) && 1956 test_bit(BTUSB_FIRMWARE_LOADED, &data->flags)) { 1957 smp_mb__after_atomic(); 1958 wake_up_bit(&data->flags, BTUSB_DOWNLOADING); 1959 } 1960 } 1961 1962 static int btusb_recv_event_intel(struct hci_dev *hdev, struct sk_buff *skb) 1963 { 1964 struct btusb_data *data = hci_get_drvdata(hdev); 1965 1966 if (test_bit(BTUSB_BOOTLOADER, &data->flags)) { 1967 struct hci_event_hdr *hdr = (void *)skb->data; 1968 1969 if (skb->len > HCI_EVENT_HDR_SIZE && hdr->evt == 0xff && 1970 hdr->plen > 0) { 1971 const void *ptr = skb->data + HCI_EVENT_HDR_SIZE + 1; 1972 unsigned int len = skb->len - HCI_EVENT_HDR_SIZE - 1; 1973 1974 switch (skb->data[2]) { 1975 case 0x02: 1976 /* When switching to the operational firmware 1977 * the device sends a vendor specific event 1978 * indicating that the bootup completed. 1979 */ 1980 btusb_intel_bootup(data, ptr, len); 1981 break; 1982 case 0x06: 1983 /* When the firmware loading completes the 1984 * device sends out a vendor specific event 1985 * indicating the result of the firmware 1986 * loading. 1987 */ 1988 btusb_intel_secure_send_result(data, ptr, len); 1989 break; 1990 } 1991 } 1992 } 1993 1994 return hci_recv_frame(hdev, skb); 1995 } 1996 1997 static int btusb_send_frame_intel(struct hci_dev *hdev, struct sk_buff *skb) 1998 { 1999 struct btusb_data *data = hci_get_drvdata(hdev); 2000 struct urb *urb; 2001 2002 BT_DBG("%s", hdev->name); 2003 2004 switch (hci_skb_pkt_type(skb)) { 2005 case HCI_COMMAND_PKT: 2006 if (test_bit(BTUSB_BOOTLOADER, &data->flags)) { 2007 struct hci_command_hdr *cmd = (void *)skb->data; 2008 __u16 opcode = le16_to_cpu(cmd->opcode); 2009 2010 /* When in bootloader mode and the command 0xfc09 2011 * is received, it needs to be send down the 2012 * bulk endpoint. So allocate a bulk URB instead. 2013 */ 2014 if (opcode == 0xfc09) 2015 urb = alloc_bulk_urb(hdev, skb); 2016 else 2017 urb = alloc_ctrl_urb(hdev, skb); 2018 2019 /* When the 0xfc01 command is issued to boot into 2020 * the operational firmware, it will actually not 2021 * send a command complete event. To keep the flow 2022 * control working inject that event here. 2023 */ 2024 if (opcode == 0xfc01) 2025 inject_cmd_complete(hdev, opcode); 2026 } else { 2027 urb = alloc_ctrl_urb(hdev, skb); 2028 } 2029 if (IS_ERR(urb)) 2030 return PTR_ERR(urb); 2031 2032 hdev->stat.cmd_tx++; 2033 return submit_or_queue_tx_urb(hdev, urb); 2034 2035 case HCI_ACLDATA_PKT: 2036 urb = alloc_bulk_urb(hdev, skb); 2037 if (IS_ERR(urb)) 2038 return PTR_ERR(urb); 2039 2040 hdev->stat.acl_tx++; 2041 return submit_or_queue_tx_urb(hdev, urb); 2042 2043 case HCI_SCODATA_PKT: 2044 if (hci_conn_num(hdev, SCO_LINK) < 1) 2045 return -ENODEV; 2046 2047 urb = alloc_isoc_urb(hdev, skb); 2048 if (IS_ERR(urb)) 2049 return PTR_ERR(urb); 2050 2051 hdev->stat.sco_tx++; 2052 return submit_tx_urb(hdev, urb); 2053 } 2054 2055 return -EILSEQ; 2056 } 2057 2058 static int btusb_setup_intel_new(struct hci_dev *hdev) 2059 { 2060 struct btusb_data *data = hci_get_drvdata(hdev); 2061 struct intel_version ver; 2062 struct intel_boot_params params; 2063 const struct firmware *fw; 2064 u32 boot_param; 2065 char fwname[64]; 2066 ktime_t calltime, delta, rettime; 2067 unsigned long long duration; 2068 int err; 2069 2070 BT_DBG("%s", hdev->name); 2071 2072 /* Set the default boot parameter to 0x0 and it is updated to 2073 * SKU specific boot parameter after reading Intel_Write_Boot_Params 2074 * command while downloading the firmware. 2075 */ 2076 boot_param = 0x00000000; 2077 2078 calltime = ktime_get(); 2079 2080 /* Read the Intel version information to determine if the device 2081 * is in bootloader mode or if it already has operational firmware 2082 * loaded. 2083 */ 2084 err = btintel_read_version(hdev, &ver); 2085 if (err) 2086 return err; 2087 2088 /* The hardware platform number has a fixed value of 0x37 and 2089 * for now only accept this single value. 2090 */ 2091 if (ver.hw_platform != 0x37) { 2092 bt_dev_err(hdev, "Unsupported Intel hardware platform (%u)", 2093 ver.hw_platform); 2094 return -EINVAL; 2095 } 2096 2097 /* Check for supported iBT hardware variants of this firmware 2098 * loading method. 2099 * 2100 * This check has been put in place to ensure correct forward 2101 * compatibility options when newer hardware variants come along. 2102 */ 2103 switch (ver.hw_variant) { 2104 case 0x0b: /* SfP */ 2105 case 0x0c: /* WsP */ 2106 case 0x11: /* JfP */ 2107 case 0x12: /* ThP */ 2108 case 0x13: /* HrP */ 2109 case 0x14: /* QnJ, IcP */ 2110 break; 2111 default: 2112 bt_dev_err(hdev, "Unsupported Intel hardware variant (%u)", 2113 ver.hw_variant); 2114 return -EINVAL; 2115 } 2116 2117 btintel_version_info(hdev, &ver); 2118 2119 /* The firmware variant determines if the device is in bootloader 2120 * mode or is running operational firmware. The value 0x06 identifies 2121 * the bootloader and the value 0x23 identifies the operational 2122 * firmware. 2123 * 2124 * When the operational firmware is already present, then only 2125 * the check for valid Bluetooth device address is needed. This 2126 * determines if the device will be added as configured or 2127 * unconfigured controller. 2128 * 2129 * It is not possible to use the Secure Boot Parameters in this 2130 * case since that command is only available in bootloader mode. 2131 */ 2132 if (ver.fw_variant == 0x23) { 2133 clear_bit(BTUSB_BOOTLOADER, &data->flags); 2134 btintel_check_bdaddr(hdev); 2135 return 0; 2136 } 2137 2138 /* If the device is not in bootloader mode, then the only possible 2139 * choice is to return an error and abort the device initialization. 2140 */ 2141 if (ver.fw_variant != 0x06) { 2142 bt_dev_err(hdev, "Unsupported Intel firmware variant (%u)", 2143 ver.fw_variant); 2144 return -ENODEV; 2145 } 2146 2147 /* Read the secure boot parameters to identify the operating 2148 * details of the bootloader. 2149 */ 2150 err = btintel_read_boot_params(hdev, ¶ms); 2151 if (err) 2152 return err; 2153 2154 /* It is required that every single firmware fragment is acknowledged 2155 * with a command complete event. If the boot parameters indicate 2156 * that this bootloader does not send them, then abort the setup. 2157 */ 2158 if (params.limited_cce != 0x00) { 2159 bt_dev_err(hdev, "Unsupported Intel firmware loading method (%u)", 2160 params.limited_cce); 2161 return -EINVAL; 2162 } 2163 2164 /* If the OTP has no valid Bluetooth device address, then there will 2165 * also be no valid address for the operational firmware. 2166 */ 2167 if (!bacmp(¶ms.otp_bdaddr, BDADDR_ANY)) { 2168 bt_dev_info(hdev, "No device address configured"); 2169 set_bit(HCI_QUIRK_INVALID_BDADDR, &hdev->quirks); 2170 } 2171 2172 /* With this Intel bootloader only the hardware variant and device 2173 * revision information are used to select the right firmware for SfP 2174 * and WsP. 2175 * 2176 * The firmware filename is ibt-<hw_variant>-<dev_revid>.sfi. 2177 * 2178 * Currently the supported hardware variants are: 2179 * 11 (0x0b) for iBT3.0 (LnP/SfP) 2180 * 12 (0x0c) for iBT3.5 (WsP) 2181 * 2182 * For ThP/JfP and for future SKU's, the FW name varies based on HW 2183 * variant, HW revision and FW revision, as these are dependent on CNVi 2184 * and RF Combination. 2185 * 2186 * 17 (0x11) for iBT3.5 (JfP) 2187 * 18 (0x12) for iBT3.5 (ThP) 2188 * 2189 * The firmware file name for these will be 2190 * ibt-<hw_variant>-<hw_revision>-<fw_revision>.sfi. 2191 * 2192 */ 2193 switch (ver.hw_variant) { 2194 case 0x0b: /* SfP */ 2195 case 0x0c: /* WsP */ 2196 snprintf(fwname, sizeof(fwname), "intel/ibt-%u-%u.sfi", 2197 le16_to_cpu(ver.hw_variant), 2198 le16_to_cpu(params.dev_revid)); 2199 break; 2200 case 0x11: /* JfP */ 2201 case 0x12: /* ThP */ 2202 case 0x13: /* HrP */ 2203 case 0x14: /* QnJ, IcP */ 2204 snprintf(fwname, sizeof(fwname), "intel/ibt-%u-%u-%u.sfi", 2205 le16_to_cpu(ver.hw_variant), 2206 le16_to_cpu(ver.hw_revision), 2207 le16_to_cpu(ver.fw_revision)); 2208 break; 2209 default: 2210 bt_dev_err(hdev, "Unsupported Intel firmware naming"); 2211 return -EINVAL; 2212 } 2213 2214 err = request_firmware(&fw, fwname, &hdev->dev); 2215 if (err < 0) { 2216 bt_dev_err(hdev, "Failed to load Intel firmware file (%d)", err); 2217 return err; 2218 } 2219 2220 bt_dev_info(hdev, "Found device firmware: %s", fwname); 2221 2222 /* Save the DDC file name for later use to apply once the firmware 2223 * downloading is done. 2224 */ 2225 switch (ver.hw_variant) { 2226 case 0x0b: /* SfP */ 2227 case 0x0c: /* WsP */ 2228 snprintf(fwname, sizeof(fwname), "intel/ibt-%u-%u.ddc", 2229 le16_to_cpu(ver.hw_variant), 2230 le16_to_cpu(params.dev_revid)); 2231 break; 2232 case 0x11: /* JfP */ 2233 case 0x12: /* ThP */ 2234 case 0x13: /* HrP */ 2235 case 0x14: /* QnJ, IcP */ 2236 snprintf(fwname, sizeof(fwname), "intel/ibt-%u-%u-%u.ddc", 2237 le16_to_cpu(ver.hw_variant), 2238 le16_to_cpu(ver.hw_revision), 2239 le16_to_cpu(ver.fw_revision)); 2240 break; 2241 default: 2242 bt_dev_err(hdev, "Unsupported Intel firmware naming"); 2243 return -EINVAL; 2244 } 2245 2246 if (fw->size < 644) { 2247 bt_dev_err(hdev, "Invalid size of firmware file (%zu)", 2248 fw->size); 2249 err = -EBADF; 2250 goto done; 2251 } 2252 2253 set_bit(BTUSB_DOWNLOADING, &data->flags); 2254 2255 /* Start firmware downloading and get boot parameter */ 2256 err = btintel_download_firmware(hdev, fw, &boot_param); 2257 if (err < 0) 2258 goto done; 2259 2260 set_bit(BTUSB_FIRMWARE_LOADED, &data->flags); 2261 2262 bt_dev_info(hdev, "Waiting for firmware download to complete"); 2263 2264 /* Before switching the device into operational mode and with that 2265 * booting the loaded firmware, wait for the bootloader notification 2266 * that all fragments have been successfully received. 2267 * 2268 * When the event processing receives the notification, then the 2269 * BTUSB_DOWNLOADING flag will be cleared. 2270 * 2271 * The firmware loading should not take longer than 5 seconds 2272 * and thus just timeout if that happens and fail the setup 2273 * of this device. 2274 */ 2275 err = wait_on_bit_timeout(&data->flags, BTUSB_DOWNLOADING, 2276 TASK_INTERRUPTIBLE, 2277 msecs_to_jiffies(5000)); 2278 if (err == -EINTR) { 2279 bt_dev_err(hdev, "Firmware loading interrupted"); 2280 goto done; 2281 } 2282 2283 if (err) { 2284 bt_dev_err(hdev, "Firmware loading timeout"); 2285 err = -ETIMEDOUT; 2286 goto done; 2287 } 2288 2289 if (test_bit(BTUSB_FIRMWARE_FAILED, &data->flags)) { 2290 bt_dev_err(hdev, "Firmware loading failed"); 2291 err = -ENOEXEC; 2292 goto done; 2293 } 2294 2295 rettime = ktime_get(); 2296 delta = ktime_sub(rettime, calltime); 2297 duration = (unsigned long long) ktime_to_ns(delta) >> 10; 2298 2299 bt_dev_info(hdev, "Firmware loaded in %llu usecs", duration); 2300 2301 done: 2302 release_firmware(fw); 2303 2304 if (err < 0) 2305 return err; 2306 2307 calltime = ktime_get(); 2308 2309 set_bit(BTUSB_BOOTING, &data->flags); 2310 2311 err = btintel_send_intel_reset(hdev, boot_param); 2312 if (err) 2313 return err; 2314 2315 /* The bootloader will not indicate when the device is ready. This 2316 * is done by the operational firmware sending bootup notification. 2317 * 2318 * Booting into operational firmware should not take longer than 2319 * 1 second. However if that happens, then just fail the setup 2320 * since something went wrong. 2321 */ 2322 bt_dev_info(hdev, "Waiting for device to boot"); 2323 2324 err = wait_on_bit_timeout(&data->flags, BTUSB_BOOTING, 2325 TASK_INTERRUPTIBLE, 2326 msecs_to_jiffies(1000)); 2327 2328 if (err == -EINTR) { 2329 bt_dev_err(hdev, "Device boot interrupted"); 2330 return -EINTR; 2331 } 2332 2333 if (err) { 2334 bt_dev_err(hdev, "Device boot timeout"); 2335 return -ETIMEDOUT; 2336 } 2337 2338 rettime = ktime_get(); 2339 delta = ktime_sub(rettime, calltime); 2340 duration = (unsigned long long) ktime_to_ns(delta) >> 10; 2341 2342 bt_dev_info(hdev, "Device booted in %llu usecs", duration); 2343 2344 clear_bit(BTUSB_BOOTLOADER, &data->flags); 2345 2346 /* Once the device is running in operational mode, it needs to apply 2347 * the device configuration (DDC) parameters. 2348 * 2349 * The device can work without DDC parameters, so even if it fails 2350 * to load the file, no need to fail the setup. 2351 */ 2352 btintel_load_ddc_config(hdev, fwname); 2353 2354 /* Set the event mask for Intel specific vendor events. This enables 2355 * a few extra events that are useful during general operation. It 2356 * does not enable any debugging related events. 2357 * 2358 * The device will function correctly without these events enabled 2359 * and thus no need to fail the setup. 2360 */ 2361 btintel_set_event_mask(hdev, false); 2362 2363 return 0; 2364 } 2365 2366 static int btusb_shutdown_intel(struct hci_dev *hdev) 2367 { 2368 struct sk_buff *skb; 2369 long ret; 2370 2371 /* In the shutdown sequence where Bluetooth is turned off followed 2372 * by WiFi being turned off, turning WiFi back on causes issue with 2373 * the RF calibration. 2374 * 2375 * To ensure that any RF activity has been stopped, issue HCI Reset 2376 * command to clear all ongoing activity including advertising, 2377 * scanning etc. 2378 */ 2379 skb = __hci_cmd_sync(hdev, HCI_OP_RESET, 0, NULL, HCI_INIT_TIMEOUT); 2380 if (IS_ERR(skb)) { 2381 ret = PTR_ERR(skb); 2382 bt_dev_err(hdev, "HCI reset during shutdown failed"); 2383 return ret; 2384 } 2385 kfree_skb(skb); 2386 2387 /* Some platforms have an issue with BT LED when the interface is 2388 * down or BT radio is turned off, which takes 5 seconds to BT LED 2389 * goes off. This command turns off the BT LED immediately. 2390 */ 2391 skb = __hci_cmd_sync(hdev, 0xfc3f, 0, NULL, HCI_INIT_TIMEOUT); 2392 if (IS_ERR(skb)) { 2393 ret = PTR_ERR(skb); 2394 bt_dev_err(hdev, "turning off Intel device LED failed"); 2395 return ret; 2396 } 2397 kfree_skb(skb); 2398 2399 return 0; 2400 } 2401 2402 #ifdef CONFIG_PM 2403 /* Configure an out-of-band gpio as wake-up pin, if specified in device tree */ 2404 static int marvell_config_oob_wake(struct hci_dev *hdev) 2405 { 2406 struct sk_buff *skb; 2407 struct btusb_data *data = hci_get_drvdata(hdev); 2408 struct device *dev = &data->udev->dev; 2409 u16 pin, gap, opcode; 2410 int ret; 2411 u8 cmd[5]; 2412 2413 /* Move on if no wakeup pin specified */ 2414 if (of_property_read_u16(dev->of_node, "marvell,wakeup-pin", &pin) || 2415 of_property_read_u16(dev->of_node, "marvell,wakeup-gap-ms", &gap)) 2416 return 0; 2417 2418 /* Vendor specific command to configure a GPIO as wake-up pin */ 2419 opcode = hci_opcode_pack(0x3F, 0x59); 2420 cmd[0] = opcode & 0xFF; 2421 cmd[1] = opcode >> 8; 2422 cmd[2] = 2; /* length of parameters that follow */ 2423 cmd[3] = pin; 2424 cmd[4] = gap; /* time in ms, for which wakeup pin should be asserted */ 2425 2426 skb = bt_skb_alloc(sizeof(cmd), GFP_KERNEL); 2427 if (!skb) { 2428 bt_dev_err(hdev, "%s: No memory\n", __func__); 2429 return -ENOMEM; 2430 } 2431 2432 skb_put_data(skb, cmd, sizeof(cmd)); 2433 hci_skb_pkt_type(skb) = HCI_COMMAND_PKT; 2434 2435 ret = btusb_send_frame(hdev, skb); 2436 if (ret) { 2437 bt_dev_err(hdev, "%s: configuration failed\n", __func__); 2438 kfree_skb(skb); 2439 return ret; 2440 } 2441 2442 return 0; 2443 } 2444 #endif 2445 2446 static int btusb_set_bdaddr_marvell(struct hci_dev *hdev, 2447 const bdaddr_t *bdaddr) 2448 { 2449 struct sk_buff *skb; 2450 u8 buf[8]; 2451 long ret; 2452 2453 buf[0] = 0xfe; 2454 buf[1] = sizeof(bdaddr_t); 2455 memcpy(buf + 2, bdaddr, sizeof(bdaddr_t)); 2456 2457 skb = __hci_cmd_sync(hdev, 0xfc22, sizeof(buf), buf, HCI_INIT_TIMEOUT); 2458 if (IS_ERR(skb)) { 2459 ret = PTR_ERR(skb); 2460 bt_dev_err(hdev, "changing Marvell device address failed (%ld)", 2461 ret); 2462 return ret; 2463 } 2464 kfree_skb(skb); 2465 2466 return 0; 2467 } 2468 2469 static int btusb_set_bdaddr_ath3012(struct hci_dev *hdev, 2470 const bdaddr_t *bdaddr) 2471 { 2472 struct sk_buff *skb; 2473 u8 buf[10]; 2474 long ret; 2475 2476 buf[0] = 0x01; 2477 buf[1] = 0x01; 2478 buf[2] = 0x00; 2479 buf[3] = sizeof(bdaddr_t); 2480 memcpy(buf + 4, bdaddr, sizeof(bdaddr_t)); 2481 2482 skb = __hci_cmd_sync(hdev, 0xfc0b, sizeof(buf), buf, HCI_INIT_TIMEOUT); 2483 if (IS_ERR(skb)) { 2484 ret = PTR_ERR(skb); 2485 bt_dev_err(hdev, "Change address command failed (%ld)", ret); 2486 return ret; 2487 } 2488 kfree_skb(skb); 2489 2490 return 0; 2491 } 2492 2493 #define QCA_DFU_PACKET_LEN 4096 2494 2495 #define QCA_GET_TARGET_VERSION 0x09 2496 #define QCA_CHECK_STATUS 0x05 2497 #define QCA_DFU_DOWNLOAD 0x01 2498 2499 #define QCA_SYSCFG_UPDATED 0x40 2500 #define QCA_PATCH_UPDATED 0x80 2501 #define QCA_DFU_TIMEOUT 3000 2502 2503 struct qca_version { 2504 __le32 rom_version; 2505 __le32 patch_version; 2506 __le32 ram_version; 2507 __le32 ref_clock; 2508 __u8 reserved[4]; 2509 } __packed; 2510 2511 struct qca_rampatch_version { 2512 __le16 rom_version; 2513 __le16 patch_version; 2514 } __packed; 2515 2516 struct qca_device_info { 2517 u32 rom_version; 2518 u8 rampatch_hdr; /* length of header in rampatch */ 2519 u8 nvm_hdr; /* length of header in NVM */ 2520 u8 ver_offset; /* offset of version structure in rampatch */ 2521 }; 2522 2523 static const struct qca_device_info qca_devices_table[] = { 2524 { 0x00000100, 20, 4, 10 }, /* Rome 1.0 */ 2525 { 0x00000101, 20, 4, 10 }, /* Rome 1.1 */ 2526 { 0x00000200, 28, 4, 18 }, /* Rome 2.0 */ 2527 { 0x00000201, 28, 4, 18 }, /* Rome 2.1 */ 2528 { 0x00000300, 28, 4, 18 }, /* Rome 3.0 */ 2529 { 0x00000302, 28, 4, 18 }, /* Rome 3.2 */ 2530 }; 2531 2532 static int btusb_qca_send_vendor_req(struct usb_device *udev, u8 request, 2533 void *data, u16 size) 2534 { 2535 int pipe, err; 2536 u8 *buf; 2537 2538 buf = kmalloc(size, GFP_KERNEL); 2539 if (!buf) 2540 return -ENOMEM; 2541 2542 /* Found some of USB hosts have IOT issues with ours so that we should 2543 * not wait until HCI layer is ready. 2544 */ 2545 pipe = usb_rcvctrlpipe(udev, 0); 2546 err = usb_control_msg(udev, pipe, request, USB_TYPE_VENDOR | USB_DIR_IN, 2547 0, 0, buf, size, USB_CTRL_SET_TIMEOUT); 2548 if (err < 0) { 2549 dev_err(&udev->dev, "Failed to access otp area (%d)", err); 2550 goto done; 2551 } 2552 2553 memcpy(data, buf, size); 2554 2555 done: 2556 kfree(buf); 2557 2558 return err; 2559 } 2560 2561 static int btusb_setup_qca_download_fw(struct hci_dev *hdev, 2562 const struct firmware *firmware, 2563 size_t hdr_size) 2564 { 2565 struct btusb_data *btdata = hci_get_drvdata(hdev); 2566 struct usb_device *udev = btdata->udev; 2567 size_t count, size, sent = 0; 2568 int pipe, len, err; 2569 u8 *buf; 2570 2571 buf = kmalloc(QCA_DFU_PACKET_LEN, GFP_KERNEL); 2572 if (!buf) 2573 return -ENOMEM; 2574 2575 count = firmware->size; 2576 2577 size = min_t(size_t, count, hdr_size); 2578 memcpy(buf, firmware->data, size); 2579 2580 /* USB patches should go down to controller through USB path 2581 * because binary format fits to go down through USB channel. 2582 * USB control path is for patching headers and USB bulk is for 2583 * patch body. 2584 */ 2585 pipe = usb_sndctrlpipe(udev, 0); 2586 err = usb_control_msg(udev, pipe, QCA_DFU_DOWNLOAD, USB_TYPE_VENDOR, 2587 0, 0, buf, size, USB_CTRL_SET_TIMEOUT); 2588 if (err < 0) { 2589 bt_dev_err(hdev, "Failed to send headers (%d)", err); 2590 goto done; 2591 } 2592 2593 sent += size; 2594 count -= size; 2595 2596 while (count) { 2597 size = min_t(size_t, count, QCA_DFU_PACKET_LEN); 2598 2599 memcpy(buf, firmware->data + sent, size); 2600 2601 pipe = usb_sndbulkpipe(udev, 0x02); 2602 err = usb_bulk_msg(udev, pipe, buf, size, &len, 2603 QCA_DFU_TIMEOUT); 2604 if (err < 0) { 2605 bt_dev_err(hdev, "Failed to send body at %zd of %zd (%d)", 2606 sent, firmware->size, err); 2607 break; 2608 } 2609 2610 if (size != len) { 2611 bt_dev_err(hdev, "Failed to get bulk buffer"); 2612 err = -EILSEQ; 2613 break; 2614 } 2615 2616 sent += size; 2617 count -= size; 2618 } 2619 2620 done: 2621 kfree(buf); 2622 return err; 2623 } 2624 2625 static int btusb_setup_qca_load_rampatch(struct hci_dev *hdev, 2626 struct qca_version *ver, 2627 const struct qca_device_info *info) 2628 { 2629 struct qca_rampatch_version *rver; 2630 const struct firmware *fw; 2631 u32 ver_rom, ver_patch; 2632 u16 rver_rom, rver_patch; 2633 char fwname[64]; 2634 int err; 2635 2636 ver_rom = le32_to_cpu(ver->rom_version); 2637 ver_patch = le32_to_cpu(ver->patch_version); 2638 2639 snprintf(fwname, sizeof(fwname), "qca/rampatch_usb_%08x.bin", ver_rom); 2640 2641 err = request_firmware(&fw, fwname, &hdev->dev); 2642 if (err) { 2643 bt_dev_err(hdev, "failed to request rampatch file: %s (%d)", 2644 fwname, err); 2645 return err; 2646 } 2647 2648 bt_dev_info(hdev, "using rampatch file: %s", fwname); 2649 2650 rver = (struct qca_rampatch_version *)(fw->data + info->ver_offset); 2651 rver_rom = le16_to_cpu(rver->rom_version); 2652 rver_patch = le16_to_cpu(rver->patch_version); 2653 2654 bt_dev_info(hdev, "QCA: patch rome 0x%x build 0x%x, " 2655 "firmware rome 0x%x build 0x%x", 2656 rver_rom, rver_patch, ver_rom, ver_patch); 2657 2658 if (rver_rom != ver_rom || rver_patch <= ver_patch) { 2659 bt_dev_err(hdev, "rampatch file version did not match with firmware"); 2660 err = -EINVAL; 2661 goto done; 2662 } 2663 2664 err = btusb_setup_qca_download_fw(hdev, fw, info->rampatch_hdr); 2665 2666 done: 2667 release_firmware(fw); 2668 2669 return err; 2670 } 2671 2672 static int btusb_setup_qca_load_nvm(struct hci_dev *hdev, 2673 struct qca_version *ver, 2674 const struct qca_device_info *info) 2675 { 2676 const struct firmware *fw; 2677 char fwname[64]; 2678 int err; 2679 2680 snprintf(fwname, sizeof(fwname), "qca/nvm_usb_%08x.bin", 2681 le32_to_cpu(ver->rom_version)); 2682 2683 err = request_firmware(&fw, fwname, &hdev->dev); 2684 if (err) { 2685 bt_dev_err(hdev, "failed to request NVM file: %s (%d)", 2686 fwname, err); 2687 return err; 2688 } 2689 2690 bt_dev_info(hdev, "using NVM file: %s", fwname); 2691 2692 err = btusb_setup_qca_download_fw(hdev, fw, info->nvm_hdr); 2693 2694 release_firmware(fw); 2695 2696 return err; 2697 } 2698 2699 /* identify the ROM version and check whether patches are needed */ 2700 static bool btusb_qca_need_patch(struct usb_device *udev) 2701 { 2702 struct qca_version ver; 2703 2704 if (btusb_qca_send_vendor_req(udev, QCA_GET_TARGET_VERSION, &ver, 2705 sizeof(ver)) < 0) 2706 return false; 2707 /* only low ROM versions need patches */ 2708 return !(le32_to_cpu(ver.rom_version) & ~0xffffU); 2709 } 2710 2711 static int btusb_setup_qca(struct hci_dev *hdev) 2712 { 2713 struct btusb_data *btdata = hci_get_drvdata(hdev); 2714 struct usb_device *udev = btdata->udev; 2715 const struct qca_device_info *info = NULL; 2716 struct qca_version ver; 2717 u32 ver_rom; 2718 u8 status; 2719 int i, err; 2720 2721 err = btusb_qca_send_vendor_req(udev, QCA_GET_TARGET_VERSION, &ver, 2722 sizeof(ver)); 2723 if (err < 0) 2724 return err; 2725 2726 ver_rom = le32_to_cpu(ver.rom_version); 2727 /* Don't care about high ROM versions */ 2728 if (ver_rom & ~0xffffU) 2729 return 0; 2730 2731 for (i = 0; i < ARRAY_SIZE(qca_devices_table); i++) { 2732 if (ver_rom == qca_devices_table[i].rom_version) 2733 info = &qca_devices_table[i]; 2734 } 2735 if (!info) { 2736 bt_dev_err(hdev, "don't support firmware rome 0x%x", ver_rom); 2737 return -ENODEV; 2738 } 2739 2740 err = btusb_qca_send_vendor_req(udev, QCA_CHECK_STATUS, &status, 2741 sizeof(status)); 2742 if (err < 0) 2743 return err; 2744 2745 if (!(status & QCA_PATCH_UPDATED)) { 2746 err = btusb_setup_qca_load_rampatch(hdev, &ver, info); 2747 if (err < 0) 2748 return err; 2749 } 2750 2751 if (!(status & QCA_SYSCFG_UPDATED)) { 2752 err = btusb_setup_qca_load_nvm(hdev, &ver, info); 2753 if (err < 0) 2754 return err; 2755 } 2756 2757 return 0; 2758 } 2759 2760 #ifdef CONFIG_BT_HCIBTUSB_BCM 2761 static inline int __set_diag_interface(struct hci_dev *hdev) 2762 { 2763 struct btusb_data *data = hci_get_drvdata(hdev); 2764 struct usb_interface *intf = data->diag; 2765 int i; 2766 2767 if (!data->diag) 2768 return -ENODEV; 2769 2770 data->diag_tx_ep = NULL; 2771 data->diag_rx_ep = NULL; 2772 2773 for (i = 0; i < intf->cur_altsetting->desc.bNumEndpoints; i++) { 2774 struct usb_endpoint_descriptor *ep_desc; 2775 2776 ep_desc = &intf->cur_altsetting->endpoint[i].desc; 2777 2778 if (!data->diag_tx_ep && usb_endpoint_is_bulk_out(ep_desc)) { 2779 data->diag_tx_ep = ep_desc; 2780 continue; 2781 } 2782 2783 if (!data->diag_rx_ep && usb_endpoint_is_bulk_in(ep_desc)) { 2784 data->diag_rx_ep = ep_desc; 2785 continue; 2786 } 2787 } 2788 2789 if (!data->diag_tx_ep || !data->diag_rx_ep) { 2790 bt_dev_err(hdev, "invalid diagnostic descriptors"); 2791 return -ENODEV; 2792 } 2793 2794 return 0; 2795 } 2796 2797 static struct urb *alloc_diag_urb(struct hci_dev *hdev, bool enable) 2798 { 2799 struct btusb_data *data = hci_get_drvdata(hdev); 2800 struct sk_buff *skb; 2801 struct urb *urb; 2802 unsigned int pipe; 2803 2804 if (!data->diag_tx_ep) 2805 return ERR_PTR(-ENODEV); 2806 2807 urb = usb_alloc_urb(0, GFP_KERNEL); 2808 if (!urb) 2809 return ERR_PTR(-ENOMEM); 2810 2811 skb = bt_skb_alloc(2, GFP_KERNEL); 2812 if (!skb) { 2813 usb_free_urb(urb); 2814 return ERR_PTR(-ENOMEM); 2815 } 2816 2817 skb_put_u8(skb, 0xf0); 2818 skb_put_u8(skb, enable); 2819 2820 pipe = usb_sndbulkpipe(data->udev, data->diag_tx_ep->bEndpointAddress); 2821 2822 usb_fill_bulk_urb(urb, data->udev, pipe, 2823 skb->data, skb->len, btusb_tx_complete, skb); 2824 2825 skb->dev = (void *)hdev; 2826 2827 return urb; 2828 } 2829 2830 static int btusb_bcm_set_diag(struct hci_dev *hdev, bool enable) 2831 { 2832 struct btusb_data *data = hci_get_drvdata(hdev); 2833 struct urb *urb; 2834 2835 if (!data->diag) 2836 return -ENODEV; 2837 2838 if (!test_bit(HCI_RUNNING, &hdev->flags)) 2839 return -ENETDOWN; 2840 2841 urb = alloc_diag_urb(hdev, enable); 2842 if (IS_ERR(urb)) 2843 return PTR_ERR(urb); 2844 2845 return submit_or_queue_tx_urb(hdev, urb); 2846 } 2847 #endif 2848 2849 #ifdef CONFIG_PM 2850 static irqreturn_t btusb_oob_wake_handler(int irq, void *priv) 2851 { 2852 struct btusb_data *data = priv; 2853 2854 pm_wakeup_event(&data->udev->dev, 0); 2855 pm_system_wakeup(); 2856 2857 /* Disable only if not already disabled (keep it balanced) */ 2858 if (test_and_clear_bit(BTUSB_OOB_WAKE_ENABLED, &data->flags)) { 2859 disable_irq_nosync(irq); 2860 disable_irq_wake(irq); 2861 } 2862 return IRQ_HANDLED; 2863 } 2864 2865 static const struct of_device_id btusb_match_table[] = { 2866 { .compatible = "usb1286,204e" }, 2867 { } 2868 }; 2869 MODULE_DEVICE_TABLE(of, btusb_match_table); 2870 2871 /* Use an oob wakeup pin? */ 2872 static int btusb_config_oob_wake(struct hci_dev *hdev) 2873 { 2874 struct btusb_data *data = hci_get_drvdata(hdev); 2875 struct device *dev = &data->udev->dev; 2876 int irq, ret; 2877 2878 clear_bit(BTUSB_OOB_WAKE_ENABLED, &data->flags); 2879 2880 if (!of_match_device(btusb_match_table, dev)) 2881 return 0; 2882 2883 /* Move on if no IRQ specified */ 2884 irq = of_irq_get_byname(dev->of_node, "wakeup"); 2885 if (irq <= 0) { 2886 bt_dev_dbg(hdev, "%s: no OOB Wakeup IRQ in DT", __func__); 2887 return 0; 2888 } 2889 2890 ret = devm_request_irq(&hdev->dev, irq, btusb_oob_wake_handler, 2891 0, "OOB Wake-on-BT", data); 2892 if (ret) { 2893 bt_dev_err(hdev, "%s: IRQ request failed", __func__); 2894 return ret; 2895 } 2896 2897 ret = device_init_wakeup(dev, true); 2898 if (ret) { 2899 bt_dev_err(hdev, "%s: failed to init_wakeup", __func__); 2900 return ret; 2901 } 2902 2903 data->oob_wake_irq = irq; 2904 disable_irq(irq); 2905 bt_dev_info(hdev, "OOB Wake-on-BT configured at IRQ %u", irq); 2906 return 0; 2907 } 2908 #endif 2909 2910 static void btusb_check_needs_reset_resume(struct usb_interface *intf) 2911 { 2912 if (dmi_check_system(btusb_needs_reset_resume_table)) 2913 interface_to_usbdev(intf)->quirks |= USB_QUIRK_RESET_RESUME; 2914 } 2915 2916 static int btusb_probe(struct usb_interface *intf, 2917 const struct usb_device_id *id) 2918 { 2919 struct usb_endpoint_descriptor *ep_desc; 2920 struct btusb_data *data; 2921 struct hci_dev *hdev; 2922 unsigned ifnum_base; 2923 int i, err; 2924 2925 BT_DBG("intf %p id %p", intf, id); 2926 2927 /* interface numbers are hardcoded in the spec */ 2928 if (intf->cur_altsetting->desc.bInterfaceNumber != 0) { 2929 if (!(id->driver_info & BTUSB_IFNUM_2)) 2930 return -ENODEV; 2931 if (intf->cur_altsetting->desc.bInterfaceNumber != 2) 2932 return -ENODEV; 2933 } 2934 2935 ifnum_base = intf->cur_altsetting->desc.bInterfaceNumber; 2936 2937 if (!id->driver_info) { 2938 const struct usb_device_id *match; 2939 2940 match = usb_match_id(intf, blacklist_table); 2941 if (match) 2942 id = match; 2943 } 2944 2945 if (id->driver_info == BTUSB_IGNORE) 2946 return -ENODEV; 2947 2948 if (id->driver_info & BTUSB_ATH3012) { 2949 struct usb_device *udev = interface_to_usbdev(intf); 2950 2951 /* Old firmware would otherwise let ath3k driver load 2952 * patch and sysconfig files 2953 */ 2954 if (le16_to_cpu(udev->descriptor.bcdDevice) <= 0x0001 && 2955 !btusb_qca_need_patch(udev)) 2956 return -ENODEV; 2957 } 2958 2959 data = devm_kzalloc(&intf->dev, sizeof(*data), GFP_KERNEL); 2960 if (!data) 2961 return -ENOMEM; 2962 2963 for (i = 0; i < intf->cur_altsetting->desc.bNumEndpoints; i++) { 2964 ep_desc = &intf->cur_altsetting->endpoint[i].desc; 2965 2966 if (!data->intr_ep && usb_endpoint_is_int_in(ep_desc)) { 2967 data->intr_ep = ep_desc; 2968 continue; 2969 } 2970 2971 if (!data->bulk_tx_ep && usb_endpoint_is_bulk_out(ep_desc)) { 2972 data->bulk_tx_ep = ep_desc; 2973 continue; 2974 } 2975 2976 if (!data->bulk_rx_ep && usb_endpoint_is_bulk_in(ep_desc)) { 2977 data->bulk_rx_ep = ep_desc; 2978 continue; 2979 } 2980 } 2981 2982 if (!data->intr_ep || !data->bulk_tx_ep || !data->bulk_rx_ep) 2983 return -ENODEV; 2984 2985 if (id->driver_info & BTUSB_AMP) { 2986 data->cmdreq_type = USB_TYPE_CLASS | 0x01; 2987 data->cmdreq = 0x2b; 2988 } else { 2989 data->cmdreq_type = USB_TYPE_CLASS; 2990 data->cmdreq = 0x00; 2991 } 2992 2993 data->udev = interface_to_usbdev(intf); 2994 data->intf = intf; 2995 2996 INIT_WORK(&data->work, btusb_work); 2997 INIT_WORK(&data->waker, btusb_waker); 2998 init_usb_anchor(&data->deferred); 2999 init_usb_anchor(&data->tx_anchor); 3000 spin_lock_init(&data->txlock); 3001 3002 init_usb_anchor(&data->intr_anchor); 3003 init_usb_anchor(&data->bulk_anchor); 3004 init_usb_anchor(&data->isoc_anchor); 3005 init_usb_anchor(&data->diag_anchor); 3006 spin_lock_init(&data->rxlock); 3007 3008 if (id->driver_info & BTUSB_INTEL_NEW) { 3009 data->recv_event = btusb_recv_event_intel; 3010 data->recv_bulk = btusb_recv_bulk_intel; 3011 set_bit(BTUSB_BOOTLOADER, &data->flags); 3012 } else { 3013 data->recv_event = hci_recv_frame; 3014 data->recv_bulk = btusb_recv_bulk; 3015 } 3016 3017 hdev = hci_alloc_dev(); 3018 if (!hdev) 3019 return -ENOMEM; 3020 3021 hdev->bus = HCI_USB; 3022 hci_set_drvdata(hdev, data); 3023 3024 if (id->driver_info & BTUSB_AMP) 3025 hdev->dev_type = HCI_AMP; 3026 else 3027 hdev->dev_type = HCI_PRIMARY; 3028 3029 data->hdev = hdev; 3030 3031 SET_HCIDEV_DEV(hdev, &intf->dev); 3032 3033 hdev->open = btusb_open; 3034 hdev->close = btusb_close; 3035 hdev->flush = btusb_flush; 3036 hdev->send = btusb_send_frame; 3037 hdev->notify = btusb_notify; 3038 3039 #ifdef CONFIG_PM 3040 err = btusb_config_oob_wake(hdev); 3041 if (err) 3042 goto out_free_dev; 3043 3044 /* Marvell devices may need a specific chip configuration */ 3045 if (id->driver_info & BTUSB_MARVELL && data->oob_wake_irq) { 3046 err = marvell_config_oob_wake(hdev); 3047 if (err) 3048 goto out_free_dev; 3049 } 3050 #endif 3051 if (id->driver_info & BTUSB_CW6622) 3052 set_bit(HCI_QUIRK_BROKEN_STORED_LINK_KEY, &hdev->quirks); 3053 3054 if (id->driver_info & BTUSB_BCM2045) 3055 set_bit(HCI_QUIRK_BROKEN_STORED_LINK_KEY, &hdev->quirks); 3056 3057 if (id->driver_info & BTUSB_BCM92035) 3058 hdev->setup = btusb_setup_bcm92035; 3059 3060 #ifdef CONFIG_BT_HCIBTUSB_BCM 3061 if (id->driver_info & BTUSB_BCM_PATCHRAM) { 3062 hdev->manufacturer = 15; 3063 hdev->setup = btbcm_setup_patchram; 3064 hdev->set_diag = btusb_bcm_set_diag; 3065 hdev->set_bdaddr = btbcm_set_bdaddr; 3066 3067 /* Broadcom LM_DIAG Interface numbers are hardcoded */ 3068 data->diag = usb_ifnum_to_if(data->udev, ifnum_base + 2); 3069 } 3070 3071 if (id->driver_info & BTUSB_BCM_APPLE) { 3072 hdev->manufacturer = 15; 3073 hdev->setup = btbcm_setup_apple; 3074 hdev->set_diag = btusb_bcm_set_diag; 3075 3076 /* Broadcom LM_DIAG Interface numbers are hardcoded */ 3077 data->diag = usb_ifnum_to_if(data->udev, ifnum_base + 2); 3078 } 3079 #endif 3080 3081 if (id->driver_info & BTUSB_INTEL) { 3082 hdev->manufacturer = 2; 3083 hdev->setup = btusb_setup_intel; 3084 hdev->shutdown = btusb_shutdown_intel; 3085 hdev->set_diag = btintel_set_diag_mfg; 3086 hdev->set_bdaddr = btintel_set_bdaddr; 3087 set_bit(HCI_QUIRK_STRICT_DUPLICATE_FILTER, &hdev->quirks); 3088 set_bit(HCI_QUIRK_SIMULTANEOUS_DISCOVERY, &hdev->quirks); 3089 set_bit(HCI_QUIRK_NON_PERSISTENT_DIAG, &hdev->quirks); 3090 } 3091 3092 if (id->driver_info & BTUSB_INTEL_NEW) { 3093 hdev->manufacturer = 2; 3094 hdev->send = btusb_send_frame_intel; 3095 hdev->setup = btusb_setup_intel_new; 3096 hdev->hw_error = btintel_hw_error; 3097 hdev->set_diag = btintel_set_diag; 3098 hdev->set_bdaddr = btintel_set_bdaddr; 3099 set_bit(HCI_QUIRK_STRICT_DUPLICATE_FILTER, &hdev->quirks); 3100 set_bit(HCI_QUIRK_SIMULTANEOUS_DISCOVERY, &hdev->quirks); 3101 set_bit(HCI_QUIRK_NON_PERSISTENT_DIAG, &hdev->quirks); 3102 } 3103 3104 if (id->driver_info & BTUSB_MARVELL) 3105 hdev->set_bdaddr = btusb_set_bdaddr_marvell; 3106 3107 if (id->driver_info & BTUSB_SWAVE) { 3108 set_bit(HCI_QUIRK_FIXUP_INQUIRY_MODE, &hdev->quirks); 3109 set_bit(HCI_QUIRK_BROKEN_LOCAL_COMMANDS, &hdev->quirks); 3110 } 3111 3112 if (id->driver_info & BTUSB_INTEL_BOOT) { 3113 hdev->manufacturer = 2; 3114 set_bit(HCI_QUIRK_RAW_DEVICE, &hdev->quirks); 3115 } 3116 3117 if (id->driver_info & BTUSB_ATH3012) { 3118 data->setup_on_usb = btusb_setup_qca; 3119 hdev->set_bdaddr = btusb_set_bdaddr_ath3012; 3120 set_bit(HCI_QUIRK_SIMULTANEOUS_DISCOVERY, &hdev->quirks); 3121 set_bit(HCI_QUIRK_STRICT_DUPLICATE_FILTER, &hdev->quirks); 3122 } 3123 3124 if (id->driver_info & BTUSB_QCA_ROME) { 3125 data->setup_on_usb = btusb_setup_qca; 3126 hdev->set_bdaddr = btusb_set_bdaddr_ath3012; 3127 set_bit(HCI_QUIRK_SIMULTANEOUS_DISCOVERY, &hdev->quirks); 3128 btusb_check_needs_reset_resume(intf); 3129 } 3130 3131 #ifdef CONFIG_BT_HCIBTUSB_RTL 3132 if (id->driver_info & BTUSB_REALTEK) { 3133 hdev->setup = btrtl_setup_realtek; 3134 3135 /* Realtek devices lose their updated firmware over suspend, 3136 * but the USB hub doesn't notice any status change. 3137 * Explicitly request a device reset on resume. 3138 */ 3139 interface_to_usbdev(intf)->quirks |= USB_QUIRK_RESET_RESUME; 3140 } 3141 #endif 3142 3143 if (id->driver_info & BTUSB_AMP) { 3144 /* AMP controllers do not support SCO packets */ 3145 data->isoc = NULL; 3146 } else { 3147 /* Interface orders are hardcoded in the specification */ 3148 data->isoc = usb_ifnum_to_if(data->udev, ifnum_base + 1); 3149 data->isoc_ifnum = ifnum_base + 1; 3150 } 3151 3152 if (!reset) 3153 set_bit(HCI_QUIRK_RESET_ON_CLOSE, &hdev->quirks); 3154 3155 if (force_scofix || id->driver_info & BTUSB_WRONG_SCO_MTU) { 3156 if (!disable_scofix) 3157 set_bit(HCI_QUIRK_FIXUP_BUFFER_SIZE, &hdev->quirks); 3158 } 3159 3160 if (id->driver_info & BTUSB_BROKEN_ISOC) 3161 data->isoc = NULL; 3162 3163 if (id->driver_info & BTUSB_DIGIANSWER) { 3164 data->cmdreq_type = USB_TYPE_VENDOR; 3165 set_bit(HCI_QUIRK_RESET_ON_CLOSE, &hdev->quirks); 3166 } 3167 3168 if (id->driver_info & BTUSB_CSR) { 3169 struct usb_device *udev = data->udev; 3170 u16 bcdDevice = le16_to_cpu(udev->descriptor.bcdDevice); 3171 3172 /* Old firmware would otherwise execute USB reset */ 3173 if (bcdDevice < 0x117) 3174 set_bit(HCI_QUIRK_RESET_ON_CLOSE, &hdev->quirks); 3175 3176 /* Fake CSR devices with broken commands */ 3177 if (bcdDevice <= 0x100 || bcdDevice == 0x134) 3178 hdev->setup = btusb_setup_csr; 3179 3180 set_bit(HCI_QUIRK_SIMULTANEOUS_DISCOVERY, &hdev->quirks); 3181 } 3182 3183 if (id->driver_info & BTUSB_SNIFFER) { 3184 struct usb_device *udev = data->udev; 3185 3186 /* New sniffer firmware has crippled HCI interface */ 3187 if (le16_to_cpu(udev->descriptor.bcdDevice) > 0x997) 3188 set_bit(HCI_QUIRK_RAW_DEVICE, &hdev->quirks); 3189 } 3190 3191 if (id->driver_info & BTUSB_INTEL_BOOT) { 3192 /* A bug in the bootloader causes that interrupt interface is 3193 * only enabled after receiving SetInterface(0, AltSetting=0). 3194 */ 3195 err = usb_set_interface(data->udev, 0, 0); 3196 if (err < 0) { 3197 BT_ERR("failed to set interface 0, alt 0 %d", err); 3198 goto out_free_dev; 3199 } 3200 } 3201 3202 if (data->isoc) { 3203 err = usb_driver_claim_interface(&btusb_driver, 3204 data->isoc, data); 3205 if (err < 0) 3206 goto out_free_dev; 3207 } 3208 3209 #ifdef CONFIG_BT_HCIBTUSB_BCM 3210 if (data->diag) { 3211 if (!usb_driver_claim_interface(&btusb_driver, 3212 data->diag, data)) 3213 __set_diag_interface(hdev); 3214 else 3215 data->diag = NULL; 3216 } 3217 #endif 3218 3219 if (enable_autosuspend) 3220 usb_enable_autosuspend(data->udev); 3221 3222 err = hci_register_dev(hdev); 3223 if (err < 0) 3224 goto out_free_dev; 3225 3226 usb_set_intfdata(intf, data); 3227 3228 return 0; 3229 3230 out_free_dev: 3231 hci_free_dev(hdev); 3232 return err; 3233 } 3234 3235 static void btusb_disconnect(struct usb_interface *intf) 3236 { 3237 struct btusb_data *data = usb_get_intfdata(intf); 3238 struct hci_dev *hdev; 3239 3240 BT_DBG("intf %p", intf); 3241 3242 if (!data) 3243 return; 3244 3245 hdev = data->hdev; 3246 usb_set_intfdata(data->intf, NULL); 3247 3248 if (data->isoc) 3249 usb_set_intfdata(data->isoc, NULL); 3250 3251 if (data->diag) 3252 usb_set_intfdata(data->diag, NULL); 3253 3254 hci_unregister_dev(hdev); 3255 3256 if (intf == data->intf) { 3257 if (data->isoc) 3258 usb_driver_release_interface(&btusb_driver, data->isoc); 3259 if (data->diag) 3260 usb_driver_release_interface(&btusb_driver, data->diag); 3261 } else if (intf == data->isoc) { 3262 if (data->diag) 3263 usb_driver_release_interface(&btusb_driver, data->diag); 3264 usb_driver_release_interface(&btusb_driver, data->intf); 3265 } else if (intf == data->diag) { 3266 usb_driver_release_interface(&btusb_driver, data->intf); 3267 if (data->isoc) 3268 usb_driver_release_interface(&btusb_driver, data->isoc); 3269 } 3270 3271 if (data->oob_wake_irq) 3272 device_init_wakeup(&data->udev->dev, false); 3273 3274 hci_free_dev(hdev); 3275 } 3276 3277 #ifdef CONFIG_PM 3278 static int btusb_suspend(struct usb_interface *intf, pm_message_t message) 3279 { 3280 struct btusb_data *data = usb_get_intfdata(intf); 3281 3282 BT_DBG("intf %p", intf); 3283 3284 if (data->suspend_count++) 3285 return 0; 3286 3287 spin_lock_irq(&data->txlock); 3288 if (!(PMSG_IS_AUTO(message) && data->tx_in_flight)) { 3289 set_bit(BTUSB_SUSPENDING, &data->flags); 3290 spin_unlock_irq(&data->txlock); 3291 } else { 3292 spin_unlock_irq(&data->txlock); 3293 data->suspend_count--; 3294 return -EBUSY; 3295 } 3296 3297 cancel_work_sync(&data->work); 3298 3299 btusb_stop_traffic(data); 3300 usb_kill_anchored_urbs(&data->tx_anchor); 3301 3302 if (data->oob_wake_irq && device_may_wakeup(&data->udev->dev)) { 3303 set_bit(BTUSB_OOB_WAKE_ENABLED, &data->flags); 3304 enable_irq_wake(data->oob_wake_irq); 3305 enable_irq(data->oob_wake_irq); 3306 } 3307 3308 return 0; 3309 } 3310 3311 static void play_deferred(struct btusb_data *data) 3312 { 3313 struct urb *urb; 3314 int err; 3315 3316 while ((urb = usb_get_from_anchor(&data->deferred))) { 3317 usb_anchor_urb(urb, &data->tx_anchor); 3318 3319 err = usb_submit_urb(urb, GFP_ATOMIC); 3320 if (err < 0) { 3321 if (err != -EPERM && err != -ENODEV) 3322 BT_ERR("%s urb %p submission failed (%d)", 3323 data->hdev->name, urb, -err); 3324 kfree(urb->setup_packet); 3325 usb_unanchor_urb(urb); 3326 usb_free_urb(urb); 3327 break; 3328 } 3329 3330 data->tx_in_flight++; 3331 usb_free_urb(urb); 3332 } 3333 3334 /* Cleanup the rest deferred urbs. */ 3335 while ((urb = usb_get_from_anchor(&data->deferred))) { 3336 kfree(urb->setup_packet); 3337 usb_free_urb(urb); 3338 } 3339 } 3340 3341 static int btusb_resume(struct usb_interface *intf) 3342 { 3343 struct btusb_data *data = usb_get_intfdata(intf); 3344 struct hci_dev *hdev = data->hdev; 3345 int err = 0; 3346 3347 BT_DBG("intf %p", intf); 3348 3349 if (--data->suspend_count) 3350 return 0; 3351 3352 /* Disable only if not already disabled (keep it balanced) */ 3353 if (test_and_clear_bit(BTUSB_OOB_WAKE_ENABLED, &data->flags)) { 3354 disable_irq(data->oob_wake_irq); 3355 disable_irq_wake(data->oob_wake_irq); 3356 } 3357 3358 if (!test_bit(HCI_RUNNING, &hdev->flags)) 3359 goto done; 3360 3361 if (test_bit(BTUSB_INTR_RUNNING, &data->flags)) { 3362 err = btusb_submit_intr_urb(hdev, GFP_NOIO); 3363 if (err < 0) { 3364 clear_bit(BTUSB_INTR_RUNNING, &data->flags); 3365 goto failed; 3366 } 3367 } 3368 3369 if (test_bit(BTUSB_BULK_RUNNING, &data->flags)) { 3370 err = btusb_submit_bulk_urb(hdev, GFP_NOIO); 3371 if (err < 0) { 3372 clear_bit(BTUSB_BULK_RUNNING, &data->flags); 3373 goto failed; 3374 } 3375 3376 btusb_submit_bulk_urb(hdev, GFP_NOIO); 3377 } 3378 3379 if (test_bit(BTUSB_ISOC_RUNNING, &data->flags)) { 3380 if (btusb_submit_isoc_urb(hdev, GFP_NOIO) < 0) 3381 clear_bit(BTUSB_ISOC_RUNNING, &data->flags); 3382 else 3383 btusb_submit_isoc_urb(hdev, GFP_NOIO); 3384 } 3385 3386 spin_lock_irq(&data->txlock); 3387 play_deferred(data); 3388 clear_bit(BTUSB_SUSPENDING, &data->flags); 3389 spin_unlock_irq(&data->txlock); 3390 schedule_work(&data->work); 3391 3392 return 0; 3393 3394 failed: 3395 usb_scuttle_anchored_urbs(&data->deferred); 3396 done: 3397 spin_lock_irq(&data->txlock); 3398 clear_bit(BTUSB_SUSPENDING, &data->flags); 3399 spin_unlock_irq(&data->txlock); 3400 3401 return err; 3402 } 3403 #endif 3404 3405 static struct usb_driver btusb_driver = { 3406 .name = "btusb", 3407 .probe = btusb_probe, 3408 .disconnect = btusb_disconnect, 3409 #ifdef CONFIG_PM 3410 .suspend = btusb_suspend, 3411 .resume = btusb_resume, 3412 #endif 3413 .id_table = btusb_table, 3414 .supports_autosuspend = 1, 3415 .disable_hub_initiated_lpm = 1, 3416 }; 3417 3418 module_usb_driver(btusb_driver); 3419 3420 module_param(disable_scofix, bool, 0644); 3421 MODULE_PARM_DESC(disable_scofix, "Disable fixup of wrong SCO buffer size"); 3422 3423 module_param(force_scofix, bool, 0644); 3424 MODULE_PARM_DESC(force_scofix, "Force fixup of wrong SCO buffers size"); 3425 3426 module_param(enable_autosuspend, bool, 0644); 3427 MODULE_PARM_DESC(enable_autosuspend, "Enable USB autosuspend by default"); 3428 3429 module_param(reset, bool, 0644); 3430 MODULE_PARM_DESC(reset, "Send HCI reset command on initialization"); 3431 3432 MODULE_AUTHOR("Marcel Holtmann <marcel@holtmann.org>"); 3433 MODULE_DESCRIPTION("Generic Bluetooth USB driver ver " VERSION); 3434 MODULE_VERSION(VERSION); 3435 MODULE_LICENSE("GPL"); 3436