projects / GitHub / mt8127 / android_kernel_alcatel_ttab.git / blame
? search:
summary | shortlog | log | commit | commitdiff | tree
blob | blame (incremental) | history | HEAD
Bluetooth: btusb: Add IMC Networks (Broadcom based)
[GitHub/mt8127/android_kernel_alcatel_ttab.git] / drivers / bluetooth / btusb.c
CommitLineData
5e23b923
MH		 1/*
2 *
3 * Generic Bluetooth USB driver
4 *
9bfa35fe 5 * Copyright (C) 2005-2008 Marcel Holtmann <marcel@holtmann.org>
5e23b923
MH		 6 *
7 *
8 * This program is free software; you can redistribute it and/or modify
9 * it under the terms of the GNU General Public License as published by
10 * the Free Software Foundation; either version 2 of the License, or
11 * (at your option) any later version.
12 *
13 * This program is distributed in the hope that it will be useful,
14 * but WITHOUT ANY WARRANTY; without even the implied warranty of
15 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
16 * GNU General Public License for more details.
17 *
18 * You should have received a copy of the GNU General Public License
19 * along with this program; if not, write to the Free Software
20 * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
21 *
22 */
23
5e23b923 24#include <linux/module.h>
5e23b923 25#include <linux/usb.h>
dffd30ee 26#include <linux/firmware.h>
5e23b923
MH		 27
28#include <net/bluetooth/bluetooth.h>
29#include <net/bluetooth/hci_core.h>
30
7bee549e 31#define VERSION "0.6"
cfeb4145 32
90ab5ee9
RR		 33static bool ignore_dga;
34static bool ignore_csr;
35static bool ignore_sniffer;
36static bool disable_scofix;
37static bool force_scofix;
7a9d4020 38
90ab5ee9 39static bool reset = 1;
cfeb4145
MH		 40
41static struct usb_driver btusb_driver;
42
43#define BTUSB_IGNORE 0x01
7a9d4020
MH		 44#define BTUSB_DIGIANSWER 0x02
45#define BTUSB_CSR 0x04
46#define BTUSB_SNIFFER 0x08
47#define BTUSB_BCM92035 0x10
48#define BTUSB_BROKEN_ISOC 0x20
49#define BTUSB_WRONG_SCO_MTU 0x40
2d25f8b4 50#define BTUSB_ATH3012 0x80
dffd30ee 51#define BTUSB_INTEL 0x100
5e23b923
MH		 52
53static struct usb_device_id btusb_table[] = {
54 /* Generic Bluetooth USB device */
55 { USB_DEVICE_INFO(0xe0, 0x01, 0x01) },
56
1fa6535f
HR		 57 /* Apple-specific (Broadcom) devices */
58 { USB_VENDOR_AND_INTERFACE_INFO(0x05ac, 0xff, 0x01, 0x01) },
59
c519774d
CYC		 60 /* MediaTek MT76x0E */
61 { USB_DEVICE(0x0e8d, 0x763f) },
62
c510eae3 63 /* Broadcom SoftSailing reporting vendor specific */
2e8b5063 64 { USB_DEVICE(0x0a5c, 0x21e1) },
c510eae3 65
3cd01976
NI		 66 /* Apple MacBookPro 7,1 */
67 { USB_DEVICE(0x05ac, 0x8213) },
68
0a79f674
CL		 69 /* Apple iMac11,1 */
70 { USB_DEVICE(0x05ac, 0x8215) },
71
9c047157
NI		 72 /* Apple MacBookPro6,2 */
73 { USB_DEVICE(0x05ac, 0x8218) },
74
3e3ede7d
EH		 75 /* Apple MacBookAir3,1, MacBookAir3,2 */
76 { USB_DEVICE(0x05ac, 0x821b) },
77
a63b723d
PAVM		 78 /* Apple MacBookAir4,1 */
79 { USB_DEVICE(0x05ac, 0x821f) },
80
88d377b6
MAP		 81 /* Apple MacBookPro8,2 */
82 { USB_DEVICE(0x05ac, 0x821a) },
83
f78b6826
JK		 84 /* Apple MacMini5,1 */
85 { USB_DEVICE(0x05ac, 0x8281) },
86
cfeb4145
MH		 87 /* AVM BlueFRITZ! USB v2.0 */
88 { USB_DEVICE(0x057c, 0x3800) },
89
90 /* Bluetooth Ultraport Module from IBM */
91 { USB_DEVICE(0x04bf, 0x030a) },
92
93 /* ALPS Modules with non-standard id */
94 { USB_DEVICE(0x044e, 0x3001) },
95 { USB_DEVICE(0x044e, 0x3002) },
96
97 /* Ericsson with non-standard id */
98 { USB_DEVICE(0x0bdb, 0x1002) },
99
100 /* Canyon CN-BTU1 with HID interfaces */
7a9d4020 101 { USB_DEVICE(0x0c10, 0x0000) },
cfeb4145 102
d13431ca 103 /* Broadcom BCM20702A0 */
1ee3ff61 104 { USB_DEVICE(0x0b05, 0x17b5) },
a7905fb9 105 { USB_DEVICE(0x0b05, 0x17cb) },
0c1abbd1 106 { USB_DEVICE(0x04ca, 0x2003) },
79cd7602 107 { USB_DEVICE(0x0489, 0xe042) },
d13431ca
WJS		 108 { USB_DEVICE(0x413c, 0x8197) },
109
98514036 110 /* Foxconn - Hon Hai */
ee66401b 111 { USB_VENDOR_AND_INTERFACE_INFO(0x0489, 0xff, 0x01, 0x01) },
98514036 112
92c385f4
GP		 113 /*Broadcom devices with vendor specific id */
114 { USB_VENDOR_AND_INTERFACE_INFO(0x0a5c, 0xff, 0x01, 0x01) },
115
7ac28a32
JK		 116 /* IMC Networks - Broadcom based */
117 { USB_VENDOR_AND_INTERFACE_INFO(0x13d3, 0xff, 0x01, 0x01) },
118
5e23b923
MH		 119 { } /* Terminating entry */
120};
121
122MODULE_DEVICE_TABLE(usb, btusb_table);
123
124static struct usb_device_id blacklist_table[] = {
cfeb4145
MH		 125 /* CSR BlueCore devices */
126 { USB_DEVICE(0x0a12, 0x0001), .driver_info = BTUSB_CSR },
127
128 /* Broadcom BCM2033 without firmware */
129 { USB_DEVICE(0x0a5c, 0x2033), .driver_info = BTUSB_IGNORE },
130
be93112a
BS		 131 /* Atheros 3011 with sflash firmware */
132 { USB_DEVICE(0x0cf3, 0x3002), .driver_info = BTUSB_IGNORE },
6eda541d 133 { USB_DEVICE(0x0cf3, 0xe019), .driver_info = BTUSB_IGNORE },
2a7bcccc 134 { USB_DEVICE(0x13d3, 0x3304), .driver_info = BTUSB_IGNORE },
8e7c3d2e 135 { USB_DEVICE(0x0930, 0x0215), .driver_info = BTUSB_IGNORE },
6b6ba88b 136 { USB_DEVICE(0x0489, 0xe03d), .driver_info = BTUSB_IGNORE },
acd94544 137 { USB_DEVICE(0x0489, 0xe027), .driver_info = BTUSB_IGNORE },
be93112a 138
509e7861
CYC		 139 /* Atheros AR9285 Malbec with sflash firmware */
140 { USB_DEVICE(0x03f0, 0x311d), .driver_info = BTUSB_IGNORE },
141
d9f51b51 142 /* Atheros 3012 with sflash firmware */
d66629c1 143 { USB_DEVICE(0x0cf3, 0x0036), .driver_info = BTUSB_ATH3012 },
2d25f8b4 144 { USB_DEVICE(0x0cf3, 0x3004), .driver_info = BTUSB_ATH3012 },
94a32d10 145 { USB_DEVICE(0x0cf3, 0x3008), .driver_info = BTUSB_ATH3012 },
07c0ea87 146 { USB_DEVICE(0x0cf3, 0x311d), .driver_info = BTUSB_ATH3012 },
a713ad60 147 { USB_DEVICE(0x0cf3, 0x311e), .driver_info = BTUSB_ATH3012 },
3672f3f2 148 { USB_DEVICE(0x0cf3, 0x311f), .driver_info = BTUSB_ATH3012 },
ebaf5795 149 { USB_DEVICE(0x0cf3, 0x817a), .driver_info = BTUSB_ATH3012 },
9498ba7a 150 { USB_DEVICE(0x13d3, 0x3375), .driver_info = BTUSB_ATH3012 },
3f63c340 151 { USB_DEVICE(0x04ca, 0x3004), .driver_info = BTUSB_ATH3012 },
55ed7d4d 152 { USB_DEVICE(0x04ca, 0x3005), .driver_info = BTUSB_ATH3012 },
2c262b2a 153 { USB_DEVICE(0x04ca, 0x3006), .driver_info = BTUSB_ATH3012 },
0d38fa9f 154 { USB_DEVICE(0x04ca, 0x3007), .driver_info = BTUSB_ATH3012 },
f4d6f7dc 155 { USB_DEVICE(0x04ca, 0x3008), .driver_info = BTUSB_ATH3012 },
87522a43 156 { USB_DEVICE(0x13d3, 0x3362), .driver_info = BTUSB_ATH3012 },
ac71311e 157 { USB_DEVICE(0x0cf3, 0xe004), .driver_info = BTUSB_ATH3012 },
877ed5f4 158 { USB_DEVICE(0x0cf3, 0xe005), .driver_info = BTUSB_ATH3012 },
6c4ae5c2 159 { USB_DEVICE(0x0930, 0x0219), .driver_info = BTUSB_ATH3012 },
2096ae6c 160 { USB_DEVICE(0x0489, 0xe057), .driver_info = BTUSB_ATH3012 },
eed307e2 161 { USB_DEVICE(0x13d3, 0x3393), .driver_info = BTUSB_ATH3012 },
3a61eda8 162 { USB_DEVICE(0x0489, 0xe04e), .driver_info = BTUSB_ATH3012 },
2582d529 163 { USB_DEVICE(0x0489, 0xe056), .driver_info = BTUSB_ATH3012 },
0fc110f4 164 { USB_DEVICE(0x0489, 0xe04d), .driver_info = BTUSB_ATH3012 },
4008b2c7 165 { USB_DEVICE(0x04c5, 0x1330), .driver_info = BTUSB_ATH3012 },
44c4127a 166 { USB_DEVICE(0x13d3, 0x3402), .driver_info = BTUSB_ATH3012 },
df235047 167 { USB_DEVICE(0x0cf3, 0x3121), .driver_info = BTUSB_ATH3012 },
eba6a13b 168 { USB_DEVICE(0x0cf3, 0xe003), .driver_info = BTUSB_ATH3012 },
d9f51b51 169
e9036e33
CYC		 170 /* Atheros AR5BBU12 with sflash firmware */
171 { USB_DEVICE(0x0489, 0xe02c), .driver_info = BTUSB_IGNORE },
172
85d59726
MG		 173 /* Atheros AR5BBU12 with sflash firmware */
174 { USB_DEVICE(0x0489, 0xe03c), .driver_info = BTUSB_ATH3012 },
bc21fde2 175 { USB_DEVICE(0x0489, 0xe036), .driver_info = BTUSB_ATH3012 },
85d59726 176
cfeb4145 177 /* Broadcom BCM2035 */
7a9d4020
MH		 178 { USB_DEVICE(0x0a5c, 0x2035), .driver_info = BTUSB_WRONG_SCO_MTU },
179 { USB_DEVICE(0x0a5c, 0x200a), .driver_info = BTUSB_WRONG_SCO_MTU },
180 { USB_DEVICE(0x0a5c, 0x2009), .driver_info = BTUSB_BCM92035 },
cfeb4145
MH		 181
182 /* Broadcom BCM2045 */
7a9d4020
MH		 183 { USB_DEVICE(0x0a5c, 0x2039), .driver_info = BTUSB_WRONG_SCO_MTU },
184 { USB_DEVICE(0x0a5c, 0x2101), .driver_info = BTUSB_WRONG_SCO_MTU },
bdbef3d6 185
cfeb4145 186 /* IBM/Lenovo ThinkPad with Broadcom chip */
7a9d4020
MH		 187 { USB_DEVICE(0x0a5c, 0x201e), .driver_info = BTUSB_WRONG_SCO_MTU },
188 { USB_DEVICE(0x0a5c, 0x2110), .driver_info = BTUSB_WRONG_SCO_MTU },
cfeb4145
MH		 189
190 /* HP laptop with Broadcom chip */
7a9d4020 191 { USB_DEVICE(0x03f0, 0x171d), .driver_info = BTUSB_WRONG_SCO_MTU },
cfeb4145
MH		 192
193 /* Dell laptop with Broadcom chip */
7a9d4020 194 { USB_DEVICE(0x413c, 0x8126), .driver_info = BTUSB_WRONG_SCO_MTU },
cfeb4145 195
5ddd4a60 196 /* Dell Wireless 370 and 410 devices */
7a9d4020 197 { USB_DEVICE(0x413c, 0x8152), .driver_info = BTUSB_WRONG_SCO_MTU },
5ddd4a60 198 { USB_DEVICE(0x413c, 0x8156), .driver_info = BTUSB_WRONG_SCO_MTU },
cfeb4145 199
7a9d4020
MH		 200 /* Belkin F8T012 and F8T013 devices */
201 { USB_DEVICE(0x050d, 0x0012), .driver_info = BTUSB_WRONG_SCO_MTU },
202 { USB_DEVICE(0x050d, 0x0013), .driver_info = BTUSB_WRONG_SCO_MTU },
cfeb4145 203
5ddd4a60
MH		 204 /* Asus WL-BTD202 device */
205 { USB_DEVICE(0x0b05, 0x1715), .driver_info = BTUSB_WRONG_SCO_MTU },
206
207 /* Kensington Bluetooth USB adapter */
208 { USB_DEVICE(0x047d, 0x105e), .driver_info = BTUSB_WRONG_SCO_MTU },
209
cfeb4145
MH		 210 /* RTX Telecom based adapters with buggy SCO support */
211 { USB_DEVICE(0x0400, 0x0807), .driver_info = BTUSB_BROKEN_ISOC },
212 { USB_DEVICE(0x0400, 0x080a), .driver_info = BTUSB_BROKEN_ISOC },
213
214 /* CONWISE Technology based adapters with buggy SCO support */
215 { USB_DEVICE(0x0e5e, 0x6622), .driver_info = BTUSB_BROKEN_ISOC },
216
cfeb4145
MH		 217 /* Digianswer devices */
218 { USB_DEVICE(0x08fd, 0x0001), .driver_info = BTUSB_DIGIANSWER },
219 { USB_DEVICE(0x08fd, 0x0002), .driver_info = BTUSB_IGNORE },
220
221 /* CSR BlueCore Bluetooth Sniffer */
222 { USB_DEVICE(0x0a12, 0x0002), .driver_info = BTUSB_SNIFFER },
223
224 /* Frontline ComProbe Bluetooth Sniffer */
225 { USB_DEVICE(0x16d3, 0x0002), .driver_info = BTUSB_SNIFFER },
226
dffd30ee
THJA		 227 /* Intel Bluetooth device */
228 { USB_DEVICE(0x8087, 0x07dc), .driver_info = BTUSB_INTEL },
229
5e23b923
MH		 230 { } /* Terminating entry */
231};
232
9bfa35fe
MH		 233#define BTUSB_MAX_ISOC_FRAMES 10
234
5e23b923
MH		 235#define BTUSB_INTR_RUNNING 0
236#define BTUSB_BULK_RUNNING 1
9bfa35fe 237#define BTUSB_ISOC_RUNNING 2
7bee549e 238#define BTUSB_SUSPENDING 3
08b8b6c4 239#define BTUSB_DID_ISO_RESUME 4
5e23b923
MH		 240
241struct btusb_data {
242 struct hci_dev *hdev;
243 struct usb_device *udev;
5fbcd260 244 struct usb_interface *intf;
9bfa35fe 245 struct usb_interface *isoc;
5e23b923
MH		 246
247 spinlock_t lock;
248
249 unsigned long flags;
250
251 struct work_struct work;
7bee549e 252 struct work_struct waker;
5e23b923
MH		 253
254 struct usb_anchor tx_anchor;
255 struct usb_anchor intr_anchor;
256 struct usb_anchor bulk_anchor;
9bfa35fe 257 struct usb_anchor isoc_anchor;
7bee549e
ON		 258 struct usb_anchor deferred;
259 int tx_in_flight;
260 spinlock_t txlock;
5e23b923
MH		 261
262 struct usb_endpoint_descriptor *intr_ep;
263 struct usb_endpoint_descriptor *bulk_tx_ep;
264 struct usb_endpoint_descriptor *bulk_rx_ep;
9bfa35fe
MH		 265 struct usb_endpoint_descriptor *isoc_tx_ep;
266 struct usb_endpoint_descriptor *isoc_rx_ep;
267
7a9d4020
MH		 268 __u8 cmdreq_type;
269
43c2e57f 270 unsigned int sco_num;
9bfa35fe 271 int isoc_altsetting;
6a88adf2 272 int suspend_count;
5e23b923
MH		 273};
274
7bee549e
ON		 275static int inc_tx(struct btusb_data *data)
276{
277 unsigned long flags;
278 int rv;
279
280 spin_lock_irqsave(&data->txlock, flags);
281 rv = test_bit(BTUSB_SUSPENDING, &data->flags);
282 if (!rv)
283 data->tx_in_flight++;
284 spin_unlock_irqrestore(&data->txlock, flags);
285
286 return rv;
287}
288
5e23b923
MH		 289static void btusb_intr_complete(struct urb *urb)
290{
291 struct hci_dev *hdev = urb->context;
155961e8 292 struct btusb_data *data = hci_get_drvdata(hdev);
5e23b923
MH		 293 int err;
294
295 BT_DBG("%s urb %p status %d count %d", hdev->name,
296 urb, urb->status, urb->actual_length);
297
298 if (!test_bit(HCI_RUNNING, &hdev->flags))
299 return;
300
301 if (urb->status == 0) {
9bfa35fe
MH		 302 hdev->stat.byte_rx += urb->actual_length;
303
5e23b923
MH		 304 if (hci_recv_fragment(hdev, HCI_EVENT_PKT,
305 urb->transfer_buffer,
306 urb->actual_length) < 0) {
307 BT_ERR("%s corrupted event packet", hdev->name);
308 hdev->stat.err_rx++;
309 }
41ba8fa0
CC		 310 } else if (urb->status == -ENOENT) {
311 /* Avoid suspend failed when usb_kill_urb */
312 return;
5e23b923
MH		 313 }
314
315 if (!test_bit(BTUSB_INTR_RUNNING, &data->flags))
316 return;
317
7bee549e 318 usb_mark_last_busy(data->udev);
5e23b923
MH		 319 usb_anchor_urb(urb, &data->intr_anchor);
320
321 err = usb_submit_urb(urb, GFP_ATOMIC);
322 if (err < 0) {
4935f1c1
PB		 323 /* -EPERM: urb is being killed;
324 * -ENODEV: device got disconnected */
325 if (err != -EPERM && err != -ENODEV)
61faddf6 326 BT_ERR("%s urb %p failed to resubmit (%d)",
5e23b923
MH		 327 hdev->name, urb, -err);
328 usb_unanchor_urb(urb);
329 }
330}
331
2eda66f4 332static int btusb_submit_intr_urb(struct hci_dev *hdev, gfp_t mem_flags)
5e23b923 333{
155961e8 334 struct btusb_data *data = hci_get_drvdata(hdev);
5e23b923
MH		 335 struct urb *urb;
336 unsigned char *buf;
337 unsigned int pipe;
338 int err, size;
339
340 BT_DBG("%s", hdev->name);
341
9bfa35fe
MH		 342 if (!data->intr_ep)
343 return -ENODEV;
344
2eda66f4 345 urb = usb_alloc_urb(0, mem_flags);
5e23b923
MH		 346 if (!urb)
347 return -ENOMEM;
348
349 size = le16_to_cpu(data->intr_ep->wMaxPacketSize);
350
2eda66f4 351 buf = kmalloc(size, mem_flags);
5e23b923
MH		 352 if (!buf) {
353 usb_free_urb(urb);
354 return -ENOMEM;
355 }
356
357 pipe = usb_rcvintpipe(data->udev, data->intr_ep->bEndpointAddress);
358
359 usb_fill_int_urb(urb, data->udev, pipe, buf, size,
360 btusb_intr_complete, hdev,
361 data->intr_ep->bInterval);
362
363 urb->transfer_flags |= URB_FREE_BUFFER;
364
365 usb_anchor_urb(urb, &data->intr_anchor);
366
2eda66f4 367 err = usb_submit_urb(urb, mem_flags);
5e23b923 368 if (err < 0) {
d4b8d1c9
PB		 369 if (err != -EPERM && err != -ENODEV)
370 BT_ERR("%s urb %p submission failed (%d)",
5e23b923
MH		 371 hdev->name, urb, -err);
372 usb_unanchor_urb(urb);
5e23b923
MH		 373 }
374
375 usb_free_urb(urb);
376
377 return err;
378}
379
380static void btusb_bulk_complete(struct urb *urb)
381{
382 struct hci_dev *hdev = urb->context;
155961e8 383 struct btusb_data *data = hci_get_drvdata(hdev);
5e23b923
MH		 384 int err;
385
386 BT_DBG("%s urb %p status %d count %d", hdev->name,
387 urb, urb->status, urb->actual_length);
388
389 if (!test_bit(HCI_RUNNING, &hdev->flags))
390 return;
391
392 if (urb->status == 0) {
9bfa35fe
MH		 393 hdev->stat.byte_rx += urb->actual_length;
394
5e23b923
MH		 395 if (hci_recv_fragment(hdev, HCI_ACLDATA_PKT,
396 urb->transfer_buffer,
397 urb->actual_length) < 0) {
398 BT_ERR("%s corrupted ACL packet", hdev->name);
399 hdev->stat.err_rx++;
400 }
41ba8fa0
CC		 401 } else if (urb->status == -ENOENT) {
402 /* Avoid suspend failed when usb_kill_urb */
403 return;
5e23b923
MH		 404 }
405
406 if (!test_bit(BTUSB_BULK_RUNNING, &data->flags))
407 return;
408
409 usb_anchor_urb(urb, &data->bulk_anchor);
652fd781 410 usb_mark_last_busy(data->udev);
5e23b923
MH		 411
412 err = usb_submit_urb(urb, GFP_ATOMIC);
413 if (err < 0) {
4935f1c1
PB		 414 /* -EPERM: urb is being killed;
415 * -ENODEV: device got disconnected */
416 if (err != -EPERM && err != -ENODEV)
61faddf6 417 BT_ERR("%s urb %p failed to resubmit (%d)",
5e23b923
MH		 418 hdev->name, urb, -err);
419 usb_unanchor_urb(urb);
420 }
421}
422
2eda66f4 423static int btusb_submit_bulk_urb(struct hci_dev *hdev, gfp_t mem_flags)
5e23b923 424{
155961e8 425 struct btusb_data *data = hci_get_drvdata(hdev);
5e23b923
MH		 426 struct urb *urb;
427 unsigned char *buf;
428 unsigned int pipe;
290ba200 429 int err, size = HCI_MAX_FRAME_SIZE;
5e23b923
MH		 430
431 BT_DBG("%s", hdev->name);
432
9bfa35fe
MH		 433 if (!data->bulk_rx_ep)
434 return -ENODEV;
435
2eda66f4 436 urb = usb_alloc_urb(0, mem_flags);
5e23b923
MH		 437 if (!urb)
438 return -ENOMEM;
439
2eda66f4 440 buf = kmalloc(size, mem_flags);
5e23b923
MH		 441 if (!buf) {
442 usb_free_urb(urb);
443 return -ENOMEM;
444 }
445
446 pipe = usb_rcvbulkpipe(data->udev, data->bulk_rx_ep->bEndpointAddress);
447
448 usb_fill_bulk_urb(urb, data->udev, pipe,
449 buf, size, btusb_bulk_complete, hdev);
450
451 urb->transfer_flags |= URB_FREE_BUFFER;
452
7bee549e 453 usb_mark_last_busy(data->udev);
5e23b923
MH		 454 usb_anchor_urb(urb, &data->bulk_anchor);
455
2eda66f4 456 err = usb_submit_urb(urb, mem_flags);
5e23b923 457 if (err < 0) {
d4b8d1c9
PB		 458 if (err != -EPERM && err != -ENODEV)
459 BT_ERR("%s urb %p submission failed (%d)",
5e23b923
MH		 460 hdev->name, urb, -err);
461 usb_unanchor_urb(urb);
5e23b923
MH		 462 }
463
464 usb_free_urb(urb);
465
466 return err;
467}
468
9bfa35fe
MH		 469static void btusb_isoc_complete(struct urb *urb)
470{
471 struct hci_dev *hdev = urb->context;
155961e8 472 struct btusb_data *data = hci_get_drvdata(hdev);
9bfa35fe
MH		 473 int i, err;
474
475 BT_DBG("%s urb %p status %d count %d", hdev->name,
476 urb, urb->status, urb->actual_length);
477
478 if (!test_bit(HCI_RUNNING, &hdev->flags))
479 return;
480
481 if (urb->status == 0) {
482 for (i = 0; i < urb->number_of_packets; i++) {
483 unsigned int offset = urb->iso_frame_desc[i].offset;
484 unsigned int length = urb->iso_frame_desc[i].actual_length;
485
486 if (urb->iso_frame_desc[i].status)
487 continue;
488
489 hdev->stat.byte_rx += length;
490
491 if (hci_recv_fragment(hdev, HCI_SCODATA_PKT,
492 urb->transfer_buffer + offset,
493 length) < 0) {
494 BT_ERR("%s corrupted SCO packet", hdev->name);
495 hdev->stat.err_rx++;
496 }
497 }
41ba8fa0
CC		 498 } else if (urb->status == -ENOENT) {
499 /* Avoid suspend failed when usb_kill_urb */
500 return;
9bfa35fe
MH		 501 }
502
503 if (!test_bit(BTUSB_ISOC_RUNNING, &data->flags))
504 return;
505
506 usb_anchor_urb(urb, &data->isoc_anchor);
507
508 err = usb_submit_urb(urb, GFP_ATOMIC);
509 if (err < 0) {
4935f1c1
PB		 510 /* -EPERM: urb is being killed;
511 * -ENODEV: device got disconnected */
512 if (err != -EPERM && err != -ENODEV)
61faddf6 513 BT_ERR("%s urb %p failed to resubmit (%d)",
9bfa35fe
MH		 514 hdev->name, urb, -err);
515 usb_unanchor_urb(urb);
516 }
517}
518
42b16b3f 519static inline void __fill_isoc_descriptor(struct urb *urb, int len, int mtu)
9bfa35fe
MH		 520{
521 int i, offset = 0;
522
523 BT_DBG("len %d mtu %d", len, mtu);
524
525 for (i = 0; i < BTUSB_MAX_ISOC_FRAMES && len >= mtu;
526 i++, offset += mtu, len -= mtu) {
527 urb->iso_frame_desc[i].offset = offset;
528 urb->iso_frame_desc[i].length = mtu;
529 }
530
531 if (len && i < BTUSB_MAX_ISOC_FRAMES) {
532 urb->iso_frame_desc[i].offset = offset;
533 urb->iso_frame_desc[i].length = len;
534 i++;
535 }
536
537 urb->number_of_packets = i;
538}
539
2eda66f4 540static int btusb_submit_isoc_urb(struct hci_dev *hdev, gfp_t mem_flags)
9bfa35fe 541{
155961e8 542 struct btusb_data *data = hci_get_drvdata(hdev);
9bfa35fe
MH		 543 struct urb *urb;
544 unsigned char *buf;
545 unsigned int pipe;
546 int err, size;
547
548 BT_DBG("%s", hdev->name);
549
550 if (!data->isoc_rx_ep)
551 return -ENODEV;
552
2eda66f4 553 urb = usb_alloc_urb(BTUSB_MAX_ISOC_FRAMES, mem_flags);
9bfa35fe
MH		 554 if (!urb)
555 return -ENOMEM;
556
557 size = le16_to_cpu(data->isoc_rx_ep->wMaxPacketSize) *
558 BTUSB_MAX_ISOC_FRAMES;
559
2eda66f4 560 buf = kmalloc(size, mem_flags);
9bfa35fe
MH		 561 if (!buf) {
562 usb_free_urb(urb);
563 return -ENOMEM;
564 }
565
566 pipe = usb_rcvisocpipe(data->udev, data->isoc_rx_ep->bEndpointAddress);
567
fa0fb93f
BZ		 568 usb_fill_int_urb(urb, data->udev, pipe, buf, size, btusb_isoc_complete,
569 hdev, data->isoc_rx_ep->bInterval);
9bfa35fe
MH		 570
571 urb->transfer_flags = URB_FREE_BUFFER | URB_ISO_ASAP;
9bfa35fe
MH		 572
573 __fill_isoc_descriptor(urb, size,
574 le16_to_cpu(data->isoc_rx_ep->wMaxPacketSize));
575
576 usb_anchor_urb(urb, &data->isoc_anchor);
577
2eda66f4 578 err = usb_submit_urb(urb, mem_flags);
9bfa35fe 579 if (err < 0) {
d4b8d1c9
PB		 580 if (err != -EPERM && err != -ENODEV)
581 BT_ERR("%s urb %p submission failed (%d)",
9bfa35fe
MH		 582 hdev->name, urb, -err);
583 usb_unanchor_urb(urb);
9bfa35fe
MH		 584 }
585
586 usb_free_urb(urb);
587
588 return err;
589}
590
5e23b923 591static void btusb_tx_complete(struct urb *urb)
7bee549e
ON		 592{
593 struct sk_buff *skb = urb->context;
594 struct hci_dev *hdev = (struct hci_dev *) skb->dev;
155961e8 595 struct btusb_data *data = hci_get_drvdata(hdev);
7bee549e
ON		 596
597 BT_DBG("%s urb %p status %d count %d", hdev->name,
598 urb, urb->status, urb->actual_length);
599
600 if (!test_bit(HCI_RUNNING, &hdev->flags))
601 goto done;
602
603 if (!urb->status)
604 hdev->stat.byte_tx += urb->transfer_buffer_length;
605 else
606 hdev->stat.err_tx++;
607
608done:
609 spin_lock(&data->txlock);
610 data->tx_in_flight--;
611 spin_unlock(&data->txlock);
612
613 kfree(urb->setup_packet);
614
615 kfree_skb(skb);
616}
617
618static void btusb_isoc_tx_complete(struct urb *urb)
5e23b923
MH		 619{
620 struct sk_buff *skb = urb->context;
621 struct hci_dev *hdev = (struct hci_dev *) skb->dev;
622
623 BT_DBG("%s urb %p status %d count %d", hdev->name,
624 urb, urb->status, urb->actual_length);
625
626 if (!test_bit(HCI_RUNNING, &hdev->flags))
627 goto done;
628
629 if (!urb->status)
630 hdev->stat.byte_tx += urb->transfer_buffer_length;
631 else
632 hdev->stat.err_tx++;
633
634done:
635 kfree(urb->setup_packet);
636
637 kfree_skb(skb);
638}
639
640static int btusb_open(struct hci_dev *hdev)
641{
155961e8 642 struct btusb_data *data = hci_get_drvdata(hdev);
5e23b923
MH		 643 int err;
644
645 BT_DBG("%s", hdev->name);
646
7bee549e
ON		 647 err = usb_autopm_get_interface(data->intf);
648 if (err < 0)
649 return err;
650
651 data->intf->needs_remote_wakeup = 1;
652
5e23b923 653 if (test_and_set_bit(HCI_RUNNING, &hdev->flags))
7bee549e 654 goto done;
5e23b923
MH		 655
656 if (test_and_set_bit(BTUSB_INTR_RUNNING, &data->flags))
7bee549e 657 goto done;
5e23b923 658
2eda66f4 659 err = btusb_submit_intr_urb(hdev, GFP_KERNEL);
43c2e57f
MH		 660 if (err < 0)
661 goto failed;
662
663 err = btusb_submit_bulk_urb(hdev, GFP_KERNEL);
5e23b923 664 if (err < 0) {
43c2e57f
MH		 665 usb_kill_anchored_urbs(&data->intr_anchor);
666 goto failed;
5e23b923
MH		 667 }
668
43c2e57f
MH		 669 set_bit(BTUSB_BULK_RUNNING, &data->flags);
670 btusb_submit_bulk_urb(hdev, GFP_KERNEL);
671
7bee549e
ON		 672done:
673 usb_autopm_put_interface(data->intf);
43c2e57f
MH		 674 return 0;
675
676failed:
677 clear_bit(BTUSB_INTR_RUNNING, &data->flags);
678 clear_bit(HCI_RUNNING, &hdev->flags);
7bee549e 679 usb_autopm_put_interface(data->intf);
5e23b923
MH		 680 return err;
681}
682
7bee549e
ON		 683static void btusb_stop_traffic(struct btusb_data *data)
684{
685 usb_kill_anchored_urbs(&data->intr_anchor);
686 usb_kill_anchored_urbs(&data->bulk_anchor);
687 usb_kill_anchored_urbs(&data->isoc_anchor);
688}
689
5e23b923
MH		 690static int btusb_close(struct hci_dev *hdev)
691{
155961e8 692 struct btusb_data *data = hci_get_drvdata(hdev);
7bee549e 693 int err;
5e23b923
MH		 694
695 BT_DBG("%s", hdev->name);
696
697 if (!test_and_clear_bit(HCI_RUNNING, &hdev->flags))
698 return 0;
699
e8c3c3d2 700 cancel_work_sync(&data->work);
404291ac 701 cancel_work_sync(&data->waker);
e8c3c3d2 702
9bfa35fe 703 clear_bit(BTUSB_ISOC_RUNNING, &data->flags);
5e23b923 704 clear_bit(BTUSB_BULK_RUNNING, &data->flags);
5e23b923 705 clear_bit(BTUSB_INTR_RUNNING, &data->flags);
7bee549e
ON		 706
707 btusb_stop_traffic(data);
708 err = usb_autopm_get_interface(data->intf);
709 if (err < 0)
7b8e2c1d 710 goto failed;
7bee549e
ON		 711
712 data->intf->needs_remote_wakeup = 0;
713 usb_autopm_put_interface(data->intf);
5e23b923 714
7b8e2c1d
ON		 715failed:
716 usb_scuttle_anchored_urbs(&data->deferred);
5e23b923
MH		 717 return 0;
718}
719
720static int btusb_flush(struct hci_dev *hdev)
721{
155961e8 722 struct btusb_data *data = hci_get_drvdata(hdev);
5e23b923
MH		 723
724 BT_DBG("%s", hdev->name);
725
726 usb_kill_anchored_urbs(&data->tx_anchor);
727
728 return 0;
729}
730
731static int btusb_send_frame(struct sk_buff *skb)
732{
733 struct hci_dev *hdev = (struct hci_dev *) skb->dev;
155961e8 734 struct btusb_data *data = hci_get_drvdata(hdev);
5e23b923
MH		 735 struct usb_ctrlrequest *dr;
736 struct urb *urb;
737 unsigned int pipe;
738 int err;
739
740 BT_DBG("%s", hdev->name);
741
742 if (!test_bit(HCI_RUNNING, &hdev->flags))
743 return -EBUSY;
744
745 switch (bt_cb(skb)->pkt_type) {
746 case HCI_COMMAND_PKT:
747 urb = usb_alloc_urb(0, GFP_ATOMIC);
748 if (!urb)
749 return -ENOMEM;
750
751 dr = kmalloc(sizeof(*dr), GFP_ATOMIC);
752 if (!dr) {
753 usb_free_urb(urb);
754 return -ENOMEM;
755 }
756
7a9d4020 757 dr->bRequestType = data->cmdreq_type;
5e23b923
MH		 758 dr->bRequest = 0;
759 dr->wIndex = 0;
760 dr->wValue = 0;
761 dr->wLength = __cpu_to_le16(skb->len);
762
763 pipe = usb_sndctrlpipe(data->udev, 0x00);
764
765 usb_fill_control_urb(urb, data->udev, pipe, (void *) dr,
766 skb->data, skb->len, btusb_tx_complete, skb);
767
768 hdev->stat.cmd_tx++;
769 break;
770
771 case HCI_ACLDATA_PKT:
9fd481e0 772 if (!data->bulk_tx_ep)
9bfa35fe
MH		 773 return -ENODEV;
774
5e23b923
MH		 775 urb = usb_alloc_urb(0, GFP_ATOMIC);
776 if (!urb)
777 return -ENOMEM;
778
779 pipe = usb_sndbulkpipe(data->udev,
780 data->bulk_tx_ep->bEndpointAddress);
781
782 usb_fill_bulk_urb(urb, data->udev, pipe,
783 skb->data, skb->len, btusb_tx_complete, skb);
784
785 hdev->stat.acl_tx++;
786 break;
787
788 case HCI_SCODATA_PKT:
9bfa35fe
MH		 789 if (!data->isoc_tx_ep || hdev->conn_hash.sco_num < 1)
790 return -ENODEV;
791
792 urb = usb_alloc_urb(BTUSB_MAX_ISOC_FRAMES, GFP_ATOMIC);
793 if (!urb)
794 return -ENOMEM;
795
796 pipe = usb_sndisocpipe(data->udev,
797 data->isoc_tx_ep->bEndpointAddress);
798
03c2d0e8
GP		 799 usb_fill_int_urb(urb, data->udev, pipe,
800 skb->data, skb->len, btusb_isoc_tx_complete,
801 skb, data->isoc_tx_ep->bInterval);
9bfa35fe
MH		 802
803 urb->transfer_flags = URB_ISO_ASAP;
9bfa35fe
MH		 804
805 __fill_isoc_descriptor(urb, skb->len,
806 le16_to_cpu(data->isoc_tx_ep->wMaxPacketSize));
807
5e23b923 808 hdev->stat.sco_tx++;
7bee549e 809 goto skip_waking;
5e23b923
MH		 810
811 default:
812 return -EILSEQ;
813 }
814
7bee549e
ON		 815 err = inc_tx(data);
816 if (err) {
817 usb_anchor_urb(urb, &data->deferred);
818 schedule_work(&data->waker);
819 err = 0;
820 goto done;
821 }
822
823skip_waking:
5e23b923
MH		 824 usb_anchor_urb(urb, &data->tx_anchor);
825
826 err = usb_submit_urb(urb, GFP_ATOMIC);
827 if (err < 0) {
5a9b80e2
PB		 828 if (err != -EPERM && err != -ENODEV)
829 BT_ERR("%s urb %p submission failed (%d)",
830 hdev->name, urb, -err);
5e23b923
MH		 831 kfree(urb->setup_packet);
832 usb_unanchor_urb(urb);
7bee549e
ON		 833 } else {
834 usb_mark_last_busy(data->udev);
5e23b923
MH		 835 }
836
7bee549e 837done:
54a8a79c 838 usb_free_urb(urb);
5e23b923
MH		 839 return err;
840}
841
5e23b923
MH		 842static void btusb_notify(struct hci_dev *hdev, unsigned int evt)
843{
155961e8 844 struct btusb_data *data = hci_get_drvdata(hdev);
5e23b923
MH		 845
846 BT_DBG("%s evt %d", hdev->name, evt);
847
43c2e57f
MH		 848 if (hdev->conn_hash.sco_num != data->sco_num) {
849 data->sco_num = hdev->conn_hash.sco_num;
850 schedule_work(&data->work);
a780efa8 851 }
5e23b923
MH		 852}
853
42b16b3f 854static inline int __set_isoc_interface(struct hci_dev *hdev, int altsetting)
9bfa35fe 855{
155961e8 856 struct btusb_data *data = hci_get_drvdata(hdev);
9bfa35fe
MH		 857 struct usb_interface *intf = data->isoc;
858 struct usb_endpoint_descriptor *ep_desc;
859 int i, err;
860
861 if (!data->isoc)
862 return -ENODEV;
863
864 err = usb_set_interface(data->udev, 1, altsetting);
865 if (err < 0) {
866 BT_ERR("%s setting interface failed (%d)", hdev->name, -err);
867 return err;
868 }
869
870 data->isoc_altsetting = altsetting;
871
872 data->isoc_tx_ep = NULL;
873 data->isoc_rx_ep = NULL;
874
875 for (i = 0; i < intf->cur_altsetting->desc.bNumEndpoints; i++) {
876 ep_desc = &intf->cur_altsetting->endpoint[i].desc;
877
878 if (!data->isoc_tx_ep && usb_endpoint_is_isoc_out(ep_desc)) {
879 data->isoc_tx_ep = ep_desc;
880 continue;
881 }
882
883 if (!data->isoc_rx_ep && usb_endpoint_is_isoc_in(ep_desc)) {
884 data->isoc_rx_ep = ep_desc;
885 continue;
886 }
887 }
888
889 if (!data->isoc_tx_ep || !data->isoc_rx_ep) {
890 BT_ERR("%s invalid SCO descriptors", hdev->name);
891 return -ENODEV;
892 }
893
894 return 0;
895}
896
5e23b923
MH		 897static void btusb_work(struct work_struct *work)
898{
899 struct btusb_data *data = container_of(work, struct btusb_data, work);
900 struct hci_dev *hdev = data->hdev;
f4001d28 901 int new_alts;
7bee549e 902 int err;
5e23b923 903
9bfa35fe 904 if (hdev->conn_hash.sco_num > 0) {
08b8b6c4 905 if (!test_bit(BTUSB_DID_ISO_RESUME, &data->flags)) {
8efdd0cd 906 err = usb_autopm_get_interface(data->isoc ? data->isoc : data->intf);
7bee549e
ON		 907 if (err < 0) {
908 clear_bit(BTUSB_ISOC_RUNNING, &data->flags);
909 usb_kill_anchored_urbs(&data->isoc_anchor);
910 return;
911 }
912
08b8b6c4 913 set_bit(BTUSB_DID_ISO_RESUME, &data->flags);
7bee549e 914 }
f4001d28
MA		 915
916 if (hdev->voice_setting & 0x0020) {
917 static const int alts[3] = { 2, 4, 5 };
918 new_alts = alts[hdev->conn_hash.sco_num - 1];
919 } else {
920 new_alts = hdev->conn_hash.sco_num;
921 }
922
923 if (data->isoc_altsetting != new_alts) {
9bfa35fe
MH		 924 clear_bit(BTUSB_ISOC_RUNNING, &data->flags);
925 usb_kill_anchored_urbs(&data->isoc_anchor);
926
f4001d28 927 if (__set_isoc_interface(hdev, new_alts) < 0)
9bfa35fe
MH		 928 return;
929 }
930
931 if (!test_and_set_bit(BTUSB_ISOC_RUNNING, &data->flags)) {
2eda66f4 932 if (btusb_submit_isoc_urb(hdev, GFP_KERNEL) < 0)
9bfa35fe
MH		 933 clear_bit(BTUSB_ISOC_RUNNING, &data->flags);
934 else
2eda66f4 935 btusb_submit_isoc_urb(hdev, GFP_KERNEL);
9bfa35fe
MH		 936 }
937 } else {
938 clear_bit(BTUSB_ISOC_RUNNING, &data->flags);
939 usb_kill_anchored_urbs(&data->isoc_anchor);
940
941 __set_isoc_interface(hdev, 0);
08b8b6c4 942 if (test_and_clear_bit(BTUSB_DID_ISO_RESUME, &data->flags))
8efdd0cd 943 usb_autopm_put_interface(data->isoc ? data->isoc : data->intf);
5e23b923
MH		 944 }
945}
946
7bee549e
ON		 947static void btusb_waker(struct work_struct *work)
948{
949 struct btusb_data *data = container_of(work, struct btusb_data, waker);
950 int err;
951
952 err = usb_autopm_get_interface(data->intf);
953 if (err < 0)
954 return;
955
956 usb_autopm_put_interface(data->intf);
957}
958
9f8f962c
MH		 959static int btusb_setup_bcm92035(struct hci_dev *hdev)
960{
961 struct sk_buff *skb;
962 u8 val = 0x00;
963
964 BT_DBG("%s", hdev->name);
965
966 skb = __hci_cmd_sync(hdev, 0xfc3b, 1, &val, HCI_INIT_TIMEOUT);
967 if (IS_ERR(skb))
968 BT_ERR("BCM92035 command failed (%ld)", -PTR_ERR(skb));
969 else
970 kfree_skb(skb);
971
972 return 0;
973}
974
dffd30ee
THJA		 975struct intel_version {
976 u8 status;
977 u8 hw_platform;
978 u8 hw_variant;
979 u8 hw_revision;
980 u8 fw_variant;
981 u8 fw_revision;
982 u8 fw_build_num;
983 u8 fw_build_ww;
984 u8 fw_build_yy;
985 u8 fw_patch_num;
986} __packed;
987
988static const struct firmware *btusb_setup_intel_get_fw(struct hci_dev *hdev,
989 struct intel_version *ver)
990{
991 const struct firmware *fw;
992 char fwname[64];
993 int ret;
994
995 snprintf(fwname, sizeof(fwname),
996 "intel/ibt-hw-%x.%x.%x-fw-%x.%x.%x.%x.%x.bseq",
997 ver->hw_platform, ver->hw_variant, ver->hw_revision,
998 ver->fw_variant, ver->fw_revision, ver->fw_build_num,
999 ver->fw_build_ww, ver->fw_build_yy);
1000
1001 ret = request_firmware(&fw, fwname, &hdev->dev);
1002 if (ret < 0) {
1003 if (ret == -EINVAL) {
1004 BT_ERR("%s Intel firmware file request failed (%d)",
1005 hdev->name, ret);
1006 return NULL;
1007 }
1008
1009 BT_ERR("%s failed to open Intel firmware file: %s(%d)",
1010 hdev->name, fwname, ret);
1011
1012 /* If the correct firmware patch file is not found, use the
1013 * default firmware patch file instead
1014 */
1015 snprintf(fwname, sizeof(fwname), "intel/ibt-hw-%x.%x.bseq",
1016 ver->hw_platform, ver->hw_variant);
1017 if (request_firmware(&fw, fwname, &hdev->dev) < 0) {
1018 BT_ERR("%s failed to open default Intel fw file: %s",
1019 hdev->name, fwname);
1020 return NULL;
1021 }
1022 }
1023
1024 BT_INFO("%s: Intel Bluetooth firmware file: %s", hdev->name, fwname);
1025
1026 return fw;
1027}
1028
1029static int btusb_setup_intel_patching(struct hci_dev *hdev,
1030 const struct firmware *fw,
1031 const u8 **fw_ptr, int *disable_patch)
1032{
1033 struct sk_buff *skb;
1034 struct hci_command_hdr *cmd;
1035 const u8 *cmd_param;
1036 struct hci_event_hdr *evt = NULL;
1037 const u8 *evt_param = NULL;
1038 int remain = fw->size - (*fw_ptr - fw->data);
1039
1040 /* The first byte indicates the types of the patch command or event.
1041 * 0x01 means HCI command and 0x02 is HCI event. If the first bytes
1042 * in the current firmware buffer doesn't start with 0x01 or
1043 * the size of remain buffer is smaller than HCI command header,
1044 * the firmware file is corrupted and it should stop the patching
1045 * process.
1046 */
1047 if (remain > HCI_COMMAND_HDR_SIZE && *fw_ptr[0] != 0x01) {
1048 BT_ERR("%s Intel fw corrupted: invalid cmd read", hdev->name);
1049 return -EINVAL;
1050 }
1051 (*fw_ptr)++;
1052 remain--;
1053
1054 cmd = (struct hci_command_hdr *)(*fw_ptr);
1055 *fw_ptr += sizeof(*cmd);
1056 remain -= sizeof(*cmd);
1057
1058 /* Ensure that the remain firmware data is long enough than the length
1059 * of command parameter. If not, the firmware file is corrupted.
1060 */
1061 if (remain < cmd->plen) {
1062 BT_ERR("%s Intel fw corrupted: invalid cmd len", hdev->name);
1063 return -EFAULT;
1064 }
1065
1066 /* If there is a command that loads a patch in the firmware
1067 * file, then enable the patch upon success, otherwise just
1068 * disable the manufacturer mode, for example patch activation
1069 * is not required when the default firmware patch file is used
1070 * because there are no patch data to load.
1071 */
1072 if (*disable_patch && le16_to_cpu(cmd->opcode) == 0xfc8e)
1073 *disable_patch = 0;
1074
1075 cmd_param = *fw_ptr;
1076 *fw_ptr += cmd->plen;
1077 remain -= cmd->plen;
1078
1079 /* This reads the expected events when the above command is sent to the
1080 * device. Some vendor commands expects more than one events, for
1081 * example command status event followed by vendor specific event.
1082 * For this case, it only keeps the last expected event. so the command
1083 * can be sent with __hci_cmd_sync_ev() which returns the sk_buff of
1084 * last expected event.
1085 */
1086 while (remain > HCI_EVENT_HDR_SIZE && *fw_ptr[0] == 0x02) {
1087 (*fw_ptr)++;
1088 remain--;
1089
1090 evt = (struct hci_event_hdr *)(*fw_ptr);
1091 *fw_ptr += sizeof(*evt);
1092 remain -= sizeof(*evt);
1093
1094 if (remain < evt->plen) {
1095 BT_ERR("%s Intel fw corrupted: invalid evt len",
1096 hdev->name);
1097 return -EFAULT;
1098 }
1099
1100 evt_param = *fw_ptr;
1101 *fw_ptr += evt->plen;
1102 remain -= evt->plen;
1103 }
1104
1105 /* Every HCI commands in the firmware file has its correspond event.
1106 * If event is not found or remain is smaller than zero, the firmware
1107 * file is corrupted.
1108 */
1109 if (!evt || !evt_param || remain < 0) {
1110 BT_ERR("%s Intel fw corrupted: invalid evt read", hdev->name);
1111 return -EFAULT;
1112 }
1113
1114 skb = __hci_cmd_sync_ev(hdev, le16_to_cpu(cmd->opcode), cmd->plen,
1115 cmd_param, evt->evt, HCI_INIT_TIMEOUT);
1116 if (IS_ERR(skb)) {
1117 BT_ERR("%s sending Intel patch command (0x%4.4x) failed (%ld)",
1118 hdev->name, cmd->opcode, PTR_ERR(skb));
ea788759 1119 return PTR_ERR(skb);
dffd30ee
THJA		 1120 }
1121
1122 /* It ensures that the returned event matches the event data read from
1123 * the firmware file. At fist, it checks the length and then
1124 * the contents of the event.
1125 */
1126 if (skb->len != evt->plen) {
1127 BT_ERR("%s mismatch event length (opcode 0x%4.4x)", hdev->name,
1128 le16_to_cpu(cmd->opcode));
1129 kfree_skb(skb);
1130 return -EFAULT;
1131 }
1132
1133 if (memcmp(skb->data, evt_param, evt->plen)) {
1134 BT_ERR("%s mismatch event parameter (opcode 0x%4.4x)",
1135 hdev->name, le16_to_cpu(cmd->opcode));
1136 kfree_skb(skb);
1137 return -EFAULT;
1138 }
1139 kfree_skb(skb);
1140
1141 return 0;
1142}
1143
1144static int btusb_setup_intel(struct hci_dev *hdev)
1145{
1146 struct sk_buff *skb;
1147 const struct firmware *fw;
1148 const u8 *fw_ptr;
1149 int disable_patch;
1150 struct intel_version *ver;
1151
1152 const u8 mfg_enable[] = { 0x01, 0x00 };
1153 const u8 mfg_disable[] = { 0x00, 0x00 };
1154 const u8 mfg_reset_deactivate[] = { 0x00, 0x01 };
1155 const u8 mfg_reset_activate[] = { 0x00, 0x02 };
1156
1157 BT_DBG("%s", hdev->name);
1158
1159 /* The controller has a bug with the first HCI command sent to it
1160 * returning number of completed commands as zero. This would stall the
1161 * command processing in the Bluetooth core.
1162 *
1163 * As a workaround, send HCI Reset command first which will reset the
1164 * number of completed commands and allow normal command processing
1165 * from now on.
1166 */
1167 skb = __hci_cmd_sync(hdev, HCI_OP_RESET, 0, NULL, HCI_INIT_TIMEOUT);
1168 if (IS_ERR(skb)) {
1169 BT_ERR("%s sending initial HCI reset command failed (%ld)",
1170 hdev->name, PTR_ERR(skb));
ea788759 1171 return PTR_ERR(skb);
dffd30ee
THJA		 1172 }
1173 kfree_skb(skb);
1174
1175 /* Read Intel specific controller version first to allow selection of
1176 * which firmware file to load.
1177 *
1178 * The returned information are hardware variant and revision plus
1179 * firmware variant, revision and build number.
1180 */
1181 skb = __hci_cmd_sync(hdev, 0xfc05, 0, NULL, HCI_INIT_TIMEOUT);
1182 if (IS_ERR(skb)) {
1183 BT_ERR("%s reading Intel fw version command failed (%ld)",
1184 hdev->name, PTR_ERR(skb));
ea788759 1185 return PTR_ERR(skb);
dffd30ee
THJA		 1186 }
1187
1188 if (skb->len != sizeof(*ver)) {
1189 BT_ERR("%s Intel version event length mismatch", hdev->name);
1190 kfree_skb(skb);
1191 return -EIO;
1192 }
1193
1194 ver = (struct intel_version *)skb->data;
1195 if (ver->status) {
1196 BT_ERR("%s Intel fw version event failed (%02x)", hdev->name,
1197 ver->status);
1198 kfree_skb(skb);
1199 return -bt_to_errno(ver->status);
1200 }
1201
1202 BT_INFO("%s: read Intel version: %02x%02x%02x%02x%02x%02x%02x%02x%02x",
1203 hdev->name, ver->hw_platform, ver->hw_variant,
1204 ver->hw_revision, ver->fw_variant, ver->fw_revision,
1205 ver->fw_build_num, ver->fw_build_ww, ver->fw_build_yy,
1206 ver->fw_patch_num);
1207
1208 /* fw_patch_num indicates the version of patch the device currently
1209 * have. If there is no patch data in the device, it is always 0x00.
1210 * So, if it is other than 0x00, no need to patch the deivce again.
1211 */
1212 if (ver->fw_patch_num) {
1213 BT_INFO("%s: Intel device is already patched. patch num: %02x",
1214 hdev->name, ver->fw_patch_num);
1215 kfree_skb(skb);
1216 return 0;
1217 }
1218
1219 /* Opens the firmware patch file based on the firmware version read
1220 * from the controller. If it fails to open the matching firmware
1221 * patch file, it tries to open the default firmware patch file.
1222 * If no patch file is found, allow the device to operate without
1223 * a patch.
1224 */
1225 fw = btusb_setup_intel_get_fw(hdev, ver);
1226 if (!fw) {
1227 kfree_skb(skb);
1228 return 0;
1229 }
1230 fw_ptr = fw->data;
1231
1232 /* This Intel specific command enables the manufacturer mode of the
1233 * controller.
1234 *
1235 * Only while this mode is enabled, the driver can download the
1236 * firmware patch data and configuration parameters.
1237 */
1238 skb = __hci_cmd_sync(hdev, 0xfc11, 2, mfg_enable, HCI_INIT_TIMEOUT);
1239 if (IS_ERR(skb)) {
1240 BT_ERR("%s entering Intel manufacturer mode failed (%ld)",
1241 hdev->name, PTR_ERR(skb));
1242 release_firmware(fw);
ea788759 1243 return PTR_ERR(skb);
dffd30ee
THJA		 1244 }
1245
1246 if (skb->data[0]) {
1247 u8 evt_status = skb->data[0];
1248 BT_ERR("%s enable Intel manufacturer mode event failed (%02x)",
1249 hdev->name, evt_status);
1250 kfree_skb(skb);
1251 release_firmware(fw);
1252 return -bt_to_errno(evt_status);
1253 }
1254 kfree_skb(skb);
1255
1256 disable_patch = 1;
1257
1258 /* The firmware data file consists of list of Intel specific HCI
1259 * commands and its expected events. The first byte indicates the
1260 * type of the message, either HCI command or HCI event.
1261 *
1262 * It reads the command and its expected event from the firmware file,
1263 * and send to the controller. Once __hci_cmd_sync_ev() returns,
1264 * the returned event is compared with the event read from the firmware
1265 * file and it will continue until all the messages are downloaded to
1266 * the controller.
1267 *
1268 * Once the firmware patching is completed successfully,
1269 * the manufacturer mode is disabled with reset and activating the
1270 * downloaded patch.
1271 *
1272 * If the firmware patching fails, the manufacturer mode is
1273 * disabled with reset and deactivating the patch.
1274 *
1275 * If the default patch file is used, no reset is done when disabling
1276 * the manufacturer.
1277 */
1278 while (fw->size > fw_ptr - fw->data) {
1279 int ret;
1280
1281 ret = btusb_setup_intel_patching(hdev, fw, &fw_ptr,
1282 &disable_patch);
1283 if (ret < 0)
1284 goto exit_mfg_deactivate;
1285 }
1286
1287 release_firmware(fw);
1288
1289 if (disable_patch)
1290 goto exit_mfg_disable;
1291
1292 /* Patching completed successfully and disable the manufacturer mode
1293 * with reset and activate the downloaded firmware patches.
1294 */
1295 skb = __hci_cmd_sync(hdev, 0xfc11, sizeof(mfg_reset_activate),
1296 mfg_reset_activate, HCI_INIT_TIMEOUT);
1297 if (IS_ERR(skb)) {
1298 BT_ERR("%s exiting Intel manufacturer mode failed (%ld)",
1299 hdev->name, PTR_ERR(skb));
ea788759 1300 return PTR_ERR(skb);
dffd30ee
THJA		 1301 }
1302 kfree_skb(skb);
1303
1304 BT_INFO("%s: Intel Bluetooth firmware patch completed and activated",
1305 hdev->name);
1306
1307 return 0;
1308
1309exit_mfg_disable:
1310 /* Disable the manufacturer mode without reset */
1311 skb = __hci_cmd_sync(hdev, 0xfc11, sizeof(mfg_disable), mfg_disable,
1312 HCI_INIT_TIMEOUT);
1313 if (IS_ERR(skb)) {
1314 BT_ERR("%s exiting Intel manufacturer mode failed (%ld)",
1315 hdev->name, PTR_ERR(skb));
ea788759 1316 return PTR_ERR(skb);
dffd30ee
THJA		 1317 }
1318 kfree_skb(skb);
1319
1320 BT_INFO("%s: Intel Bluetooth firmware patch completed", hdev->name);
1321 return 0;
1322
1323exit_mfg_deactivate:
1324 release_firmware(fw);
1325
1326 /* Patching failed. Disable the manufacturer mode with reset and
1327 * deactivate the downloaded firmware patches.
1328 */
1329 skb = __hci_cmd_sync(hdev, 0xfc11, sizeof(mfg_reset_deactivate),
1330 mfg_reset_deactivate, HCI_INIT_TIMEOUT);
1331 if (IS_ERR(skb)) {
1332 BT_ERR("%s exiting Intel manufacturer mode failed (%ld)",
1333 hdev->name, PTR_ERR(skb));
ea788759 1334 return PTR_ERR(skb);
dffd30ee
THJA		 1335 }
1336 kfree_skb(skb);
1337
1338 BT_INFO("%s: Intel Bluetooth firmware patch completed and deactivated",
1339 hdev->name);
1340
1341 return 0;
1342}
1343
5e23b923
MH		 1344static int btusb_probe(struct usb_interface *intf,
1345 const struct usb_device_id *id)
1346{
1347 struct usb_endpoint_descriptor *ep_desc;
1348 struct btusb_data *data;
1349 struct hci_dev *hdev;
1350 int i, err;
1351
1352 BT_DBG("intf %p id %p", intf, id);
1353
cfeb4145 1354 /* interface numbers are hardcoded in the spec */
5e23b923
MH		 1355 if (intf->cur_altsetting->desc.bInterfaceNumber != 0)
1356 return -ENODEV;
1357
1358 if (!id->driver_info) {
1359 const struct usb_device_id *match;
1360 match = usb_match_id(intf, blacklist_table);
1361 if (match)
1362 id = match;
1363 }
1364
cfeb4145
MH		 1365 if (id->driver_info == BTUSB_IGNORE)
1366 return -ENODEV;
1367
1368 if (ignore_dga && id->driver_info & BTUSB_DIGIANSWER)
1369 return -ENODEV;
1370
1371 if (ignore_csr && id->driver_info & BTUSB_CSR)
1372 return -ENODEV;
1373
1374 if (ignore_sniffer && id->driver_info & BTUSB_SNIFFER)
1375 return -ENODEV;
1376
2d25f8b4
SL		 1377 if (id->driver_info & BTUSB_ATH3012) {
1378 struct usb_device *udev = interface_to_usbdev(intf);
1379
1380 /* Old firmware would otherwise let ath3k driver load
1381 * patch and sysconfig files */
1382 if (le16_to_cpu(udev->descriptor.bcdDevice) <= 0x0001)
1383 return -ENODEV;
1384 }
1385
98921dbd 1386 data = devm_kzalloc(&intf->dev, sizeof(*data), GFP_KERNEL);
5e23b923
MH		 1387 if (!data)
1388 return -ENOMEM;
1389
1390 for (i = 0; i < intf->cur_altsetting->desc.bNumEndpoints; i++) {
1391 ep_desc = &intf->cur_altsetting->endpoint[i].desc;
1392
1393 if (!data->intr_ep && usb_endpoint_is_int_in(ep_desc)) {
1394 data->intr_ep = ep_desc;
1395 continue;
1396 }
1397
1398 if (!data->bulk_tx_ep && usb_endpoint_is_bulk_out(ep_desc)) {
1399 data->bulk_tx_ep = ep_desc;
1400 continue;
1401 }
1402
1403 if (!data->bulk_rx_ep && usb_endpoint_is_bulk_in(ep_desc)) {
1404 data->bulk_rx_ep = ep_desc;
1405 continue;
1406 }
1407 }
1408
98921dbd 1409 if (!data->intr_ep || !data->bulk_tx_ep || !data->bulk_rx_ep)
5e23b923 1410 return -ENODEV;
5e23b923 1411
7a9d4020
MH		 1412 data->cmdreq_type = USB_TYPE_CLASS;
1413
5e23b923 1414 data->udev = interface_to_usbdev(intf);
5fbcd260 1415 data->intf = intf;
5e23b923
MH		 1416
1417 spin_lock_init(&data->lock);
1418
1419 INIT_WORK(&data->work, btusb_work);
7bee549e
ON		 1420 INIT_WORK(&data->waker, btusb_waker);
1421 spin_lock_init(&data->txlock);
5e23b923
MH		 1422
1423 init_usb_anchor(&data->tx_anchor);
1424 init_usb_anchor(&data->intr_anchor);
1425 init_usb_anchor(&data->bulk_anchor);
9bfa35fe 1426 init_usb_anchor(&data->isoc_anchor);
7bee549e 1427 init_usb_anchor(&data->deferred);
5e23b923
MH		 1428
1429 hdev = hci_alloc_dev();
98921dbd 1430 if (!hdev)
5e23b923 1431 return -ENOMEM;
5e23b923 1432
c13854ce 1433 hdev->bus = HCI_USB;
155961e8 1434 hci_set_drvdata(hdev, data);
5e23b923
MH		 1435
1436 data->hdev = hdev;
1437
1438 SET_HCIDEV_DEV(hdev, &intf->dev);
1439
9f8f962c
MH		 1440 hdev->open = btusb_open;
1441 hdev->close = btusb_close;
1442 hdev->flush = btusb_flush;
1443 hdev->send = btusb_send_frame;
1444 hdev->notify = btusb_notify;
1445
1446 if (id->driver_info & BTUSB_BCM92035)
1447 hdev->setup = btusb_setup_bcm92035;
5e23b923 1448
dffd30ee
THJA		 1449 if (id->driver_info & BTUSB_INTEL)
1450 hdev->setup = btusb_setup_intel;
1451
7a9d4020 1452 /* Interface numbers are hardcoded in the specification */
9bfa35fe
MH		 1453 data->isoc = usb_ifnum_to_if(data->udev, 1);
1454
7a9d4020 1455 if (!reset)
a6c511c6 1456 set_bit(HCI_QUIRK_RESET_ON_CLOSE, &hdev->quirks);
cfeb4145
MH		 1457
1458 if (force_scofix || id->driver_info & BTUSB_WRONG_SCO_MTU) {
1459 if (!disable_scofix)
1460 set_bit(HCI_QUIRK_FIXUP_BUFFER_SIZE, &hdev->quirks);
1461 }
1462
9bfa35fe
MH		 1463 if (id->driver_info & BTUSB_BROKEN_ISOC)
1464 data->isoc = NULL;
1465
7a9d4020
MH		 1466 if (id->driver_info & BTUSB_DIGIANSWER) {
1467 data->cmdreq_type = USB_TYPE_VENDOR;
a6c511c6 1468 set_bit(HCI_QUIRK_RESET_ON_CLOSE, &hdev->quirks);
7a9d4020
MH		 1469 }
1470
1471 if (id->driver_info & BTUSB_CSR) {
1472 struct usb_device *udev = data->udev;
1473
1474 /* Old firmware would otherwise execute USB reset */
1475 if (le16_to_cpu(udev->descriptor.bcdDevice) < 0x117)
a6c511c6 1476 set_bit(HCI_QUIRK_RESET_ON_CLOSE, &hdev->quirks);
7a9d4020
MH		 1477 }
1478
cfeb4145 1479 if (id->driver_info & BTUSB_SNIFFER) {
9bfa35fe 1480 struct usb_device *udev = data->udev;
cfeb4145 1481
7a9d4020 1482 /* New sniffer firmware has crippled HCI interface */
cfeb4145
MH		 1483 if (le16_to_cpu(udev->descriptor.bcdDevice) > 0x997)
1484 set_bit(HCI_QUIRK_RAW_DEVICE, &hdev->quirks);
9bfa35fe
MH		 1485
1486 data->isoc = NULL;
cfeb4145
MH		 1487 }
1488
9bfa35fe
MH		 1489 if (data->isoc) {
1490 err = usb_driver_claim_interface(&btusb_driver,
5fbcd260 1491 data->isoc, data);
9bfa35fe
MH		 1492 if (err < 0) {
1493 hci_free_dev(hdev);
9bfa35fe
MH		 1494 return err;
1495 }
1496 }
1497
5e23b923
MH		 1498 err = hci_register_dev(hdev);
1499 if (err < 0) {
1500 hci_free_dev(hdev);
5e23b923
MH		 1501 return err;
1502 }
1503
1504 usb_set_intfdata(intf, data);
1505
1506 return 0;
1507}
1508
1509static void btusb_disconnect(struct usb_interface *intf)
1510{
1511 struct btusb_data *data = usb_get_intfdata(intf);
1512 struct hci_dev *hdev;
1513
1514 BT_DBG("intf %p", intf);
1515
1516 if (!data)
1517 return;
1518
1519 hdev = data->hdev;
5fbcd260
MH		 1520 usb_set_intfdata(data->intf, NULL);
1521
1522 if (data->isoc)
1523 usb_set_intfdata(data->isoc, NULL);
5e23b923
MH		 1524
1525 hci_unregister_dev(hdev);
1526
5fbcd260
MH		 1527 if (intf == data->isoc)
1528 usb_driver_release_interface(&btusb_driver, data->intf);
1529 else if (data->isoc)
1530 usb_driver_release_interface(&btusb_driver, data->isoc);
1531
5e23b923
MH		 1532 hci_free_dev(hdev);
1533}
1534
7bee549e 1535#ifdef CONFIG_PM
6a88adf2
MH		 1536static int btusb_suspend(struct usb_interface *intf, pm_message_t message)
1537{
1538 struct btusb_data *data = usb_get_intfdata(intf);
1539
1540 BT_DBG("intf %p", intf);
1541
1542 if (data->suspend_count++)
1543 return 0;
1544
7bee549e 1545 spin_lock_irq(&data->txlock);
5b1b0b81 1546 if (!(PMSG_IS_AUTO(message) && data->tx_in_flight)) {
7bee549e
ON		 1547 set_bit(BTUSB_SUSPENDING, &data->flags);
1548 spin_unlock_irq(&data->txlock);
1549 } else {
1550 spin_unlock_irq(&data->txlock);
1551 data->suspend_count--;
1552 return -EBUSY;
1553 }
1554
6a88adf2
MH		 1555 cancel_work_sync(&data->work);
1556
7bee549e 1557 btusb_stop_traffic(data);
6a88adf2
MH		 1558 usb_kill_anchored_urbs(&data->tx_anchor);
1559
6a88adf2
MH		 1560 return 0;
1561}
1562
7bee549e
ON		 1563static void play_deferred(struct btusb_data *data)
1564{
1565 struct urb *urb;
1566 int err;
1567
1568 while ((urb = usb_get_from_anchor(&data->deferred))) {
1569 err = usb_submit_urb(urb, GFP_ATOMIC);
1570 if (err < 0)
1571 break;
1572
1573 data->tx_in_flight++;
1574 }
1575 usb_scuttle_anchored_urbs(&data->deferred);
1576}
1577
6a88adf2
MH		 1578static int btusb_resume(struct usb_interface *intf)
1579{
1580 struct btusb_data *data = usb_get_intfdata(intf);
1581 struct hci_dev *hdev = data->hdev;
7bee549e 1582 int err = 0;
6a88adf2
MH		 1583
1584 BT_DBG("intf %p", intf);
1585
1586 if (--data->suspend_count)
1587 return 0;
1588
1589 if (!test_bit(HCI_RUNNING, &hdev->flags))
7bee549e 1590 goto done;
6a88adf2
MH		 1591
1592 if (test_bit(BTUSB_INTR_RUNNING, &data->flags)) {
1593 err = btusb_submit_intr_urb(hdev, GFP_NOIO);
1594 if (err < 0) {
1595 clear_bit(BTUSB_INTR_RUNNING, &data->flags);
7bee549e 1596 goto failed;
6a88adf2
MH		 1597 }
1598 }
1599
1600 if (test_bit(BTUSB_BULK_RUNNING, &data->flags)) {
43c2e57f
MH		 1601 err = btusb_submit_bulk_urb(hdev, GFP_NOIO);
1602 if (err < 0) {
6a88adf2 1603 clear_bit(BTUSB_BULK_RUNNING, &data->flags);
7bee549e
ON		 1604 goto failed;
1605 }
1606
1607 btusb_submit_bulk_urb(hdev, GFP_NOIO);
6a88adf2
MH		 1608 }
1609
1610 if (test_bit(BTUSB_ISOC_RUNNING, &data->flags)) {
1611 if (btusb_submit_isoc_urb(hdev, GFP_NOIO) < 0)
1612 clear_bit(BTUSB_ISOC_RUNNING, &data->flags);
1613 else
1614 btusb_submit_isoc_urb(hdev, GFP_NOIO);
1615 }
1616
7bee549e
ON		 1617 spin_lock_irq(&data->txlock);
1618 play_deferred(data);
1619 clear_bit(BTUSB_SUSPENDING, &data->flags);
1620 spin_unlock_irq(&data->txlock);
1621 schedule_work(&data->work);
1622
6a88adf2 1623 return 0;
7bee549e
ON		 1624
1625failed:
1626 usb_scuttle_anchored_urbs(&data->deferred);
1627done:
1628 spin_lock_irq(&data->txlock);
1629 clear_bit(BTUSB_SUSPENDING, &data->flags);
1630 spin_unlock_irq(&data->txlock);
1631
1632 return err;
6a88adf2 1633}
7bee549e 1634#endif
6a88adf2 1635
5e23b923
MH		 1636static struct usb_driver btusb_driver = {
1637 .name = "btusb",
1638 .probe = btusb_probe,
1639 .disconnect = btusb_disconnect,
7bee549e 1640#ifdef CONFIG_PM
6a88adf2
MH		 1641 .suspend = btusb_suspend,
1642 .resume = btusb_resume,
7bee549e 1643#endif
5e23b923 1644 .id_table = btusb_table,
7bee549e 1645 .supports_autosuspend = 1,
e1f12eb6 1646 .disable_hub_initiated_lpm = 1,
5e23b923
MH		 1647};
1648
93f1508c 1649module_usb_driver(btusb_driver);
5e23b923 1650
cfeb4145
MH		 1651module_param(ignore_dga, bool, 0644);
1652MODULE_PARM_DESC(ignore_dga, "Ignore devices with id 08fd:0001");
1653
1654module_param(ignore_csr, bool, 0644);
1655MODULE_PARM_DESC(ignore_csr, "Ignore devices with id 0a12:0001");
1656
1657module_param(ignore_sniffer, bool, 0644);
1658MODULE_PARM_DESC(ignore_sniffer, "Ignore devices with id 0a12:0002");
1659
1660module_param(disable_scofix, bool, 0644);
1661MODULE_PARM_DESC(disable_scofix, "Disable fixup of wrong SCO buffer size");
1662
1663module_param(force_scofix, bool, 0644);
1664MODULE_PARM_DESC(force_scofix, "Force fixup of wrong SCO buffers size");
1665
1666module_param(reset, bool, 0644);
1667MODULE_PARM_DESC(reset, "Send HCI reset command on initialization");
1668
5e23b923
MH		 1669MODULE_AUTHOR("Marcel Holtmann <marcel@holtmann.org>");
1670MODULE_DESCRIPTION("Generic Bluetooth USB driver ver " VERSION);
1671MODULE_VERSION(VERSION);
1672MODULE_LICENSE("GPL");
kernel source for telekom puls (alcatel/mediatek)