drivers/bluetooth/btusb.c

   1 /*
   2  *
   3  *  Generic Bluetooth USB driver
   4  *
   5  *  Copyright (C) 2005-2008  Marcel Holtmann <marcel@holtmann.org>
   6  *
   7  *
   8  *  This program is free software; you can redistribute it and/or modify
   9  *  it under the terms of the GNU General Public License as published by
  10  *  the Free Software Foundation; either version 2 of the License, or
  11  *  (at your option) any later version.
  12  *
  13  *  This program is distributed in the hope that it will be useful,
  14  *  but WITHOUT ANY WARRANTY; without even the implied warranty of
  15  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  16  *  GNU General Public License for more details.
  17  *
  18  *  You should have received a copy of the GNU General Public License
  19  *  along with this program; if not, write to the Free Software
  20  *  Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
  21  *
  22  */
  23
  24 #include <linux/module.h>
  25 #include <linux/usb.h>
  26 #include <linux/firmware.h>
  27
  28 #include <net/bluetooth/bluetooth.h>
  29 #include <net/bluetooth/hci_core.h>
  30
  31 #define VERSION "0.6"
  32
  33 static bool disable_scofix;
  34 static bool force_scofix;
  35
  36 static bool reset = 1;
  37
  38 static struct usb_driver btusb_driver;
  39
  40 #define BTUSB_IGNORE            0x01
  41 #define BTUSB_DIGIANSWER        0x02
  42 #define BTUSB_CSR               0x04
  43 #define BTUSB_SNIFFER           0x08
  44 #define BTUSB_BCM92035          0x10
  45 #define BTUSB_BROKEN_ISOC       0x20
  46 #define BTUSB_WRONG_SCO_MTU     0x40
  47 #define BTUSB_ATH3012           0x80
  48 #define BTUSB_INTEL             0x100
  49 #define BTUSB_INTEL_BOOT        0x200
  50 #define BTUSB_BCM_PATCHRAM      0x400
  51 #define BTUSB_MARVELL           0x800
  52
  53 static const struct usb_device_id btusb_table[] = {
  54         /* Generic Bluetooth USB device */
  55         { USB_DEVICE_INFO(0xe0, 0x01, 0x01) },
  56
  57         /* Apple-specific (Broadcom) devices */
  58         { USB_VENDOR_AND_INTERFACE_INFO(0x05ac, 0xff, 0x01, 0x01) },
  59
  60         /* MediaTek MT76x0E */
  61         { USB_DEVICE(0x0e8d, 0x763f) },
  62
  63         /* Broadcom SoftSailing reporting vendor specific */
  64         { USB_DEVICE(0x0a5c, 0x21e1) },
  65
  66         /* Apple MacBookPro 7,1 */
  67         { USB_DEVICE(0x05ac, 0x8213) },
  68
  69         /* Apple iMac11,1 */
  70         { USB_DEVICE(0x05ac, 0x8215) },
  71
  72         /* Apple MacBookPro6,2 */
  73         { USB_DEVICE(0x05ac, 0x8218) },
  74
  75         /* Apple MacBookAir3,1, MacBookAir3,2 */
  76         { USB_DEVICE(0x05ac, 0x821b) },
  77
  78         /* Apple MacBookAir4,1 */
  79         { USB_DEVICE(0x05ac, 0x821f) },
  80
  81         /* Apple MacBookPro8,2 */
  82         { USB_DEVICE(0x05ac, 0x821a) },
  83
  84         /* Apple MacMini5,1 */
  85         { USB_DEVICE(0x05ac, 0x8281) },
  86
  87         /* AVM BlueFRITZ! USB v2.0 */
  88         { USB_DEVICE(0x057c, 0x3800) },
  89
  90         /* Bluetooth Ultraport Module from IBM */
  91         { USB_DEVICE(0x04bf, 0x030a) },
  92
  93         /* ALPS Modules with non-standard id */
  94         { USB_DEVICE(0x044e, 0x3001) },
  95         { USB_DEVICE(0x044e, 0x3002) },
  96
  97         /* Ericsson with non-standard id */
  98         { USB_DEVICE(0x0bdb, 0x1002) },
  99
 100         /* Canyon CN-BTU1 with HID interfaces */
 101         { USB_DEVICE(0x0c10, 0x0000) },
 102
 103         /* Broadcom BCM20702A0 */
 104         { USB_DEVICE(0x0489, 0xe042) },
 105         { USB_DEVICE(0x04ca, 0x2003) },
 106         { USB_DEVICE(0x0b05, 0x17b5) },
 107         { USB_DEVICE(0x0b05, 0x17cb) },
 108         { USB_DEVICE(0x413c, 0x8197) },
 109
 110         /* Foxconn - Hon Hai */
 111         { USB_VENDOR_AND_INTERFACE_INFO(0x0489, 0xff, 0x01, 0x01) },
 112
 113         /* Broadcom devices with vendor specific id */
 114         { USB_VENDOR_AND_INTERFACE_INFO(0x0a5c, 0xff, 0x01, 0x01),
 115           .driver_info = BTUSB_BCM_PATCHRAM },
 116
 117         /* ASUSTek Computer - Broadcom based */
 118         { USB_VENDOR_AND_INTERFACE_INFO(0x0b05, 0xff, 0x01, 0x01) },
 119
 120         /* Belkin F8065bf - Broadcom based */
 121         { USB_VENDOR_AND_INTERFACE_INFO(0x050d, 0xff, 0x01, 0x01) },
 122
 123         /* IMC Networks - Broadcom based */
 124         { USB_VENDOR_AND_INTERFACE_INFO(0x13d3, 0xff, 0x01, 0x01) },
 125
 126         /* Intel Bluetooth USB Bootloader (RAM module) */
 127         { USB_DEVICE(0x8087, 0x0a5a),
 128           .driver_info = BTUSB_INTEL_BOOT | BTUSB_BROKEN_ISOC },
 129
 130         { }     /* Terminating entry */
 131 };
 132
 133 MODULE_DEVICE_TABLE(usb, btusb_table);
 134
 135 static const struct usb_device_id blacklist_table[] = {
 136         /* CSR BlueCore devices */
 137         { USB_DEVICE(0x0a12, 0x0001), .driver_info = BTUSB_CSR },
 138
 139         /* Broadcom BCM2033 without firmware */
 140         { USB_DEVICE(0x0a5c, 0x2033), .driver_info = BTUSB_IGNORE },
 141
 142         /* Atheros 3011 with sflash firmware */
 143         { USB_DEVICE(0x0489, 0xe027), .driver_info = BTUSB_IGNORE },
 144         { USB_DEVICE(0x0489, 0xe03d), .driver_info = BTUSB_IGNORE },
 145         { USB_DEVICE(0x0930, 0x0215), .driver_info = BTUSB_IGNORE },
 146         { USB_DEVICE(0x0cf3, 0x3002), .driver_info = BTUSB_IGNORE },
 147         { USB_DEVICE(0x0cf3, 0xe019), .driver_info = BTUSB_IGNORE },
 148         { USB_DEVICE(0x13d3, 0x3304), .driver_info = BTUSB_IGNORE },
 149
 150         /* Atheros AR9285 Malbec with sflash firmware */
 151         { USB_DEVICE(0x03f0, 0x311d), .driver_info = BTUSB_IGNORE },
 152
 153         /* Atheros 3012 with sflash firmware */
 154         { USB_DEVICE(0x0489, 0xe04d), .driver_info = BTUSB_ATH3012 },
 155         { USB_DEVICE(0x0489, 0xe04e), .driver_info = BTUSB_ATH3012 },
 156         { USB_DEVICE(0x0489, 0xe056), .driver_info = BTUSB_ATH3012 },
 157         { USB_DEVICE(0x0489, 0xe057), .driver_info = BTUSB_ATH3012 },
 158         { USB_DEVICE(0x0489, 0xe05f), .driver_info = BTUSB_ATH3012 },
 159         { USB_DEVICE(0x04c5, 0x1330), .driver_info = BTUSB_ATH3012 },
 160         { USB_DEVICE(0x04ca, 0x3004), .driver_info = BTUSB_ATH3012 },
 161         { USB_DEVICE(0x04ca, 0x3005), .driver_info = BTUSB_ATH3012 },
 162         { USB_DEVICE(0x04ca, 0x3006), .driver_info = BTUSB_ATH3012 },
 163         { USB_DEVICE(0x04ca, 0x3007), .driver_info = BTUSB_ATH3012 },
 164         { USB_DEVICE(0x04ca, 0x3008), .driver_info = BTUSB_ATH3012 },
 165         { USB_DEVICE(0x04ca, 0x300b), .driver_info = BTUSB_ATH3012 },
 166         { USB_DEVICE(0x0930, 0x0219), .driver_info = BTUSB_ATH3012 },
 167         { USB_DEVICE(0x0930, 0x0220), .driver_info = BTUSB_ATH3012 },
 168         { USB_DEVICE(0x0930, 0x0227), .driver_info = BTUSB_ATH3012 },
 169         { USB_DEVICE(0x0b05, 0x17d0), .driver_info = BTUSB_ATH3012 },
 170         { USB_DEVICE(0x0cf3, 0x0036), .driver_info = BTUSB_ATH3012 },
 171         { USB_DEVICE(0x0cf3, 0x3004), .driver_info = BTUSB_ATH3012 },
 172         { USB_DEVICE(0x0cf3, 0x3008), .driver_info = BTUSB_ATH3012 },
 173         { USB_DEVICE(0x0cf3, 0x311d), .driver_info = BTUSB_ATH3012 },
 174         { USB_DEVICE(0x0cf3, 0x311e), .driver_info = BTUSB_ATH3012 },
 175         { USB_DEVICE(0x0cf3, 0x311f), .driver_info = BTUSB_ATH3012 },
 176         { USB_DEVICE(0x0cf3, 0x3121), .driver_info = BTUSB_ATH3012 },
 177         { USB_DEVICE(0x0cf3, 0x817a), .driver_info = BTUSB_ATH3012 },
 178         { USB_DEVICE(0x0cf3, 0xe003), .driver_info = BTUSB_ATH3012 },
 179         { USB_DEVICE(0x0cf3, 0xe004), .driver_info = BTUSB_ATH3012 },
 180         { USB_DEVICE(0x0cf3, 0xe005), .driver_info = BTUSB_ATH3012 },
 181         { USB_DEVICE(0x13d3, 0x3362), .driver_info = BTUSB_ATH3012 },
 182         { USB_DEVICE(0x13d3, 0x3375), .driver_info = BTUSB_ATH3012 },
 183         { USB_DEVICE(0x13d3, 0x3393), .driver_info = BTUSB_ATH3012 },
 184         { USB_DEVICE(0x13d3, 0x3402), .driver_info = BTUSB_ATH3012 },
 185         { USB_DEVICE(0x13d3, 0x3432), .driver_info = BTUSB_ATH3012 },
 186
 187         /* Atheros AR5BBU12 with sflash firmware */
 188         { USB_DEVICE(0x0489, 0xe02c), .driver_info = BTUSB_IGNORE },
 189
 190         /* Atheros AR5BBU12 with sflash firmware */
 191         { USB_DEVICE(0x0489, 0xe036), .driver_info = BTUSB_ATH3012 },
 192         { USB_DEVICE(0x0489, 0xe03c), .driver_info = BTUSB_ATH3012 },
 193
 194         /* Broadcom BCM2035 */
 195         { USB_DEVICE(0x0a5c, 0x2009), .driver_info = BTUSB_BCM92035 },
 196         { USB_DEVICE(0x0a5c, 0x200a), .driver_info = BTUSB_WRONG_SCO_MTU },
 197         { USB_DEVICE(0x0a5c, 0x2035), .driver_info = BTUSB_WRONG_SCO_MTU },
 198
 199         /* Broadcom BCM2045 */
 200         { USB_DEVICE(0x0a5c, 0x2039), .driver_info = BTUSB_WRONG_SCO_MTU },
 201         { USB_DEVICE(0x0a5c, 0x2101), .driver_info = BTUSB_WRONG_SCO_MTU },
 202
 203         /* IBM/Lenovo ThinkPad with Broadcom chip */
 204         { USB_DEVICE(0x0a5c, 0x201e), .driver_info = BTUSB_WRONG_SCO_MTU },
 205         { USB_DEVICE(0x0a5c, 0x2110), .driver_info = BTUSB_WRONG_SCO_MTU },
 206
 207         /* HP laptop with Broadcom chip */
 208         { USB_DEVICE(0x03f0, 0x171d), .driver_info = BTUSB_WRONG_SCO_MTU },
 209
 210         /* Dell laptop with Broadcom chip */
 211         { USB_DEVICE(0x413c, 0x8126), .driver_info = BTUSB_WRONG_SCO_MTU },
 212
 213         /* Dell Wireless 370 and 410 devices */
 214         { USB_DEVICE(0x413c, 0x8152), .driver_info = BTUSB_WRONG_SCO_MTU },
 215         { USB_DEVICE(0x413c, 0x8156), .driver_info = BTUSB_WRONG_SCO_MTU },
 216
 217         /* Belkin F8T012 and F8T013 devices */
 218         { USB_DEVICE(0x050d, 0x0012), .driver_info = BTUSB_WRONG_SCO_MTU },
 219         { USB_DEVICE(0x050d, 0x0013), .driver_info = BTUSB_WRONG_SCO_MTU },
 220
 221         /* Asus WL-BTD202 device */
 222         { USB_DEVICE(0x0b05, 0x1715), .driver_info = BTUSB_WRONG_SCO_MTU },
 223
 224         /* Kensington Bluetooth USB adapter */
 225         { USB_DEVICE(0x047d, 0x105e), .driver_info = BTUSB_WRONG_SCO_MTU },
 226
 227         /* RTX Telecom based adapters with buggy SCO support */
 228         { USB_DEVICE(0x0400, 0x0807), .driver_info = BTUSB_BROKEN_ISOC },
 229         { USB_DEVICE(0x0400, 0x080a), .driver_info = BTUSB_BROKEN_ISOC },
 230
 231         /* CONWISE Technology based adapters with buggy SCO support */
 232         { USB_DEVICE(0x0e5e, 0x6622), .driver_info = BTUSB_BROKEN_ISOC },
 233
 234         /* Digianswer devices */
 235         { USB_DEVICE(0x08fd, 0x0001), .driver_info = BTUSB_DIGIANSWER },
 236         { USB_DEVICE(0x08fd, 0x0002), .driver_info = BTUSB_IGNORE },
 237
 238         /* CSR BlueCore Bluetooth Sniffer */
 239         { USB_DEVICE(0x0a12, 0x0002),
 240           .driver_info = BTUSB_SNIFFER | BTUSB_BROKEN_ISOC },
 241
 242         /* Frontline ComProbe Bluetooth Sniffer */
 243         { USB_DEVICE(0x16d3, 0x0002),
 244           .driver_info = BTUSB_SNIFFER | BTUSB_BROKEN_ISOC },
 245
 246         /* Intel Bluetooth device */
 247         { USB_DEVICE(0x8087, 0x07dc), .driver_info = BTUSB_INTEL },
 248         { USB_DEVICE(0x8087, 0x0a2a), .driver_info = BTUSB_INTEL },
 249
 250         /* Marvell device */
 251         { USB_DEVICE(0x1286, 0x2044), .driver_info = BTUSB_MARVELL },
 252         { USB_DEVICE(0x1286, 0x2046), .driver_info = BTUSB_MARVELL },
 253
 254         { }     /* Terminating entry */
 255 };
 256
 257 #define BTUSB_MAX_ISOC_FRAMES   10
 258
 259 #define BTUSB_INTR_RUNNING      0
 260 #define BTUSB_BULK_RUNNING      1
 261 #define BTUSB_ISOC_RUNNING      2
 262 #define BTUSB_SUSPENDING        3
 263 #define BTUSB_DID_ISO_RESUME    4
 264
 265 struct btusb_data {
 266         struct hci_dev       *hdev;
 267         struct usb_device    *udev;
 268         struct usb_interface *intf;
 269         struct usb_interface *isoc;
 270
 271         spinlock_t lock;
 272
 273         unsigned long flags;
 274
 275         struct work_struct work;
 276         struct work_struct waker;
 277
 278         struct usb_anchor deferred;
 279         struct usb_anchor tx_anchor;
 280         int tx_in_flight;
 281         spinlock_t txlock;
 282
 283         struct usb_anchor intr_anchor;
 284         struct usb_anchor bulk_anchor;
 285         struct usb_anchor isoc_anchor;
 286         spinlock_t rxlock;
 287
 288         struct sk_buff *evt_skb;
 289         struct sk_buff *acl_skb;
 290         struct sk_buff *sco_skb;
 291
 292         struct usb_endpoint_descriptor *intr_ep;
 293         struct usb_endpoint_descriptor *bulk_tx_ep;
 294         struct usb_endpoint_descriptor *bulk_rx_ep;
 295         struct usb_endpoint_descriptor *isoc_tx_ep;
 296         struct usb_endpoint_descriptor *isoc_rx_ep;
 297
 298         __u8 cmdreq_type;
 299
 300         unsigned int sco_num;
 301         int isoc_altsetting;
 302         int suspend_count;
 303 };
 304
 305 static inline void btusb_free_frags(struct btusb_data *data)
 306 {
 307         unsigned long flags;
 308
 309         spin_lock_irqsave(&data->rxlock, flags);
 310
 311         kfree_skb(data->evt_skb);
 312         data->evt_skb = NULL;
 313
 314         kfree_skb(data->acl_skb);
 315         data->acl_skb = NULL;
 316
 317         kfree_skb(data->sco_skb);
 318         data->sco_skb = NULL;
 319
 320         spin_unlock_irqrestore(&data->rxlock, flags);
 321 }
 322
 323 static int btusb_recv_intr(struct btusb_data *data, void *buffer, int count)
 324 {
 325         struct sk_buff *skb;
 326         int err = 0;
 327
 328         spin_lock(&data->rxlock);
 329         skb = data->evt_skb;
 330
 331         while (count) {
 332                 int len;
 333
 334                 if (!skb) {
 335                         skb = bt_skb_alloc(HCI_MAX_EVENT_SIZE, GFP_ATOMIC);
 336                         if (!skb) {
 337                                 err = -ENOMEM;
 338                                 break;
 339                         }
 340
 341                         bt_cb(skb)->pkt_type = HCI_EVENT_PKT;
 342                         bt_cb(skb)->expect = HCI_EVENT_HDR_SIZE;
 343                 }
 344
 345                 len = min_t(uint, bt_cb(skb)->expect, count);
 346                 memcpy(skb_put(skb, len), buffer, len);
 347
 348                 count -= len;
 349                 buffer += len;
 350                 bt_cb(skb)->expect -= len;
 351
 352                 if (skb->len == HCI_EVENT_HDR_SIZE) {
 353                         /* Complete event header */
 354                         bt_cb(skb)->expect = hci_event_hdr(skb)->plen;
 355
 356                         if (skb_tailroom(skb) < bt_cb(skb)->expect) {
 357                                 kfree_skb(skb);
 358                                 skb = NULL;
 359
 360                                 err = -EILSEQ;
 361                                 break;
 362                         }
 363                 }
 364
 365                 if (bt_cb(skb)->expect == 0) {
 366                         /* Complete frame */
 367                         hci_recv_frame(data->hdev, skb);
 368                         skb = NULL;
 369                 }
 370         }
 371
 372         data->evt_skb = skb;
 373         spin_unlock(&data->rxlock);
 374
 375         return err;
 376 }
 377
 378 static int btusb_recv_bulk(struct btusb_data *data, void *buffer, int count)
 379 {
 380         struct sk_buff *skb;
 381         int err = 0;
 382
 383         spin_lock(&data->rxlock);
 384         skb = data->acl_skb;
 385
 386         while (count) {
 387                 int len;
 388
 389                 if (!skb) {
 390                         skb = bt_skb_alloc(HCI_MAX_FRAME_SIZE, GFP_ATOMIC);
 391                         if (!skb) {
 392                                 err = -ENOMEM;
 393                                 break;
 394                         }
 395
 396                         bt_cb(skb)->pkt_type = HCI_ACLDATA_PKT;
 397                         bt_cb(skb)->expect = HCI_ACL_HDR_SIZE;
 398                 }
 399
 400                 len = min_t(uint, bt_cb(skb)->expect, count);
 401                 memcpy(skb_put(skb, len), buffer, len);
 402
 403                 count -= len;
 404                 buffer += len;
 405                 bt_cb(skb)->expect -= len;
 406
 407                 if (skb->len == HCI_ACL_HDR_SIZE) {
 408                         __le16 dlen = hci_acl_hdr(skb)->dlen;
 409
 410                         /* Complete ACL header */
 411                         bt_cb(skb)->expect = __le16_to_cpu(dlen);
 412
 413                         if (skb_tailroom(skb) < bt_cb(skb)->expect) {
 414                                 kfree_skb(skb);
 415                                 skb = NULL;
 416
 417                                 err = -EILSEQ;
 418                                 break;
 419                         }
 420                 }
 421
 422                 if (bt_cb(skb)->expect == 0) {
 423                         /* Complete frame */
 424                         hci_recv_frame(data->hdev, skb);
 425                         skb = NULL;
 426                 }
 427         }
 428
 429         data->acl_skb = skb;
 430         spin_unlock(&data->rxlock);
 431
 432         return err;
 433 }
 434
 435 static int btusb_recv_isoc(struct btusb_data *data, void *buffer, int count)
 436 {
 437         struct sk_buff *skb;
 438         int err = 0;
 439
 440         spin_lock(&data->rxlock);
 441         skb = data->sco_skb;
 442
 443         while (count) {
 444                 int len;
 445
 446                 if (!skb) {
 447                         skb = bt_skb_alloc(HCI_MAX_SCO_SIZE, GFP_ATOMIC);
 448                         if (!skb) {
 449                                 err = -ENOMEM;
 450                                 break;
 451                         }
 452
 453                         bt_cb(skb)->pkt_type = HCI_SCODATA_PKT;
 454                         bt_cb(skb)->expect = HCI_SCO_HDR_SIZE;
 455                 }
 456
 457                 len = min_t(uint, bt_cb(skb)->expect, count);
 458                 memcpy(skb_put(skb, len), buffer, len);
 459
 460                 count -= len;
 461                 buffer += len;
 462                 bt_cb(skb)->expect -= len;
 463
 464                 if (skb->len == HCI_SCO_HDR_SIZE) {
 465                         /* Complete SCO header */
 466                         bt_cb(skb)->expect = hci_sco_hdr(skb)->dlen;
 467
 468                         if (skb_tailroom(skb) < bt_cb(skb)->expect) {
 469                                 kfree_skb(skb);
 470                                 skb = NULL;
 471
 472                                 err = -EILSEQ;
 473                                 break;
 474                         }
 475                 }
 476
 477                 if (bt_cb(skb)->expect == 0) {
 478                         /* Complete frame */
 479                         hci_recv_frame(data->hdev, skb);
 480                         skb = NULL;
 481                 }
 482         }
 483
 484         data->sco_skb = skb;
 485         spin_unlock(&data->rxlock);
 486
 487         return err;
 488 }
 489
 490 static void btusb_intr_complete(struct urb *urb)
 491 {
 492         struct hci_dev *hdev = urb->context;
 493         struct btusb_data *data = hci_get_drvdata(hdev);
 494         int err;
 495
 496         BT_DBG("%s urb %p status %d count %d", hdev->name, urb, urb->status,
 497                urb->actual_length);
 498
 499         if (!test_bit(HCI_RUNNING, &hdev->flags))
 500                 return;
 501
 502         if (urb->status == 0) {
 503                 hdev->stat.byte_rx += urb->actual_length;
 504
 505                 if (btusb_recv_intr(data, urb->transfer_buffer,
 506                                     urb->actual_length) < 0) {
 507                         BT_ERR("%s corrupted event packet", hdev->name);
 508                         hdev->stat.err_rx++;
 509                 }
 510         } else if (urb->status == -ENOENT) {
 511                 /* Avoid suspend failed when usb_kill_urb */
 512                 return;
 513         }
 514
 515         if (!test_bit(BTUSB_INTR_RUNNING, &data->flags))
 516                 return;
 517
 518         usb_mark_last_busy(data->udev);
 519         usb_anchor_urb(urb, &data->intr_anchor);
 520
 521         err = usb_submit_urb(urb, GFP_ATOMIC);
 522         if (err < 0) {
 523                 /* -EPERM: urb is being killed;
 524                  * -ENODEV: device got disconnected */
 525                 if (err != -EPERM && err != -ENODEV)
 526                         BT_ERR("%s urb %p failed to resubmit (%d)",
 527                                hdev->name, urb, -err);
 528                 usb_unanchor_urb(urb);
 529         }
 530 }
 531
 532 static int btusb_submit_intr_urb(struct hci_dev *hdev, gfp_t mem_flags)
 533 {
 534         struct btusb_data *data = hci_get_drvdata(hdev);
 535         struct urb *urb;
 536         unsigned char *buf;
 537         unsigned int pipe;
 538         int err, size;
 539
 540         BT_DBG("%s", hdev->name);
 541
 542         if (!data->intr_ep)
 543                 return -ENODEV;
 544
 545         urb = usb_alloc_urb(0, mem_flags);
 546         if (!urb)
 547                 return -ENOMEM;
 548
 549         size = le16_to_cpu(data->intr_ep->wMaxPacketSize);
 550
 551         buf = kmalloc(size, mem_flags);
 552         if (!buf) {
 553                 usb_free_urb(urb);
 554                 return -ENOMEM;
 555         }
 556
 557         pipe = usb_rcvintpipe(data->udev, data->intr_ep->bEndpointAddress);
 558
 559         usb_fill_int_urb(urb, data->udev, pipe, buf, size,
 560                          btusb_intr_complete, hdev, data->intr_ep->bInterval);
 561
 562         urb->transfer_flags |= URB_FREE_BUFFER;
 563
 564         usb_anchor_urb(urb, &data->intr_anchor);
 565
 566         err = usb_submit_urb(urb, mem_flags);
 567         if (err < 0) {
 568                 if (err != -EPERM && err != -ENODEV)
 569                         BT_ERR("%s urb %p submission failed (%d)",
 570                                hdev->name, urb, -err);
 571                 usb_unanchor_urb(urb);
 572         }
 573
 574         usb_free_urb(urb);
 575
 576         return err;
 577 }
 578
 579 static void btusb_bulk_complete(struct urb *urb)
 580 {
 581         struct hci_dev *hdev = urb->context;
 582         struct btusb_data *data = hci_get_drvdata(hdev);
 583         int err;
 584
 585         BT_DBG("%s urb %p status %d count %d", hdev->name, urb, urb->status,
 586                urb->actual_length);
 587
 588         if (!test_bit(HCI_RUNNING, &hdev->flags))
 589                 return;
 590
 591         if (urb->status == 0) {
 592                 hdev->stat.byte_rx += urb->actual_length;
 593
 594                 if (btusb_recv_bulk(data, urb->transfer_buffer,
 595                                     urb->actual_length) < 0) {
 596                         BT_ERR("%s corrupted ACL packet", hdev->name);
 597                         hdev->stat.err_rx++;
 598                 }
 599         } else if (urb->status == -ENOENT) {
 600                 /* Avoid suspend failed when usb_kill_urb */
 601                 return;
 602         }
 603
 604         if (!test_bit(BTUSB_BULK_RUNNING, &data->flags))
 605                 return;
 606
 607         usb_anchor_urb(urb, &data->bulk_anchor);
 608         usb_mark_last_busy(data->udev);
 609
 610         err = usb_submit_urb(urb, GFP_ATOMIC);
 611         if (err < 0) {
 612                 /* -EPERM: urb is being killed;
 613                  * -ENODEV: device got disconnected */
 614                 if (err != -EPERM && err != -ENODEV)
 615                         BT_ERR("%s urb %p failed to resubmit (%d)",
 616                                hdev->name, urb, -err);
 617                 usb_unanchor_urb(urb);
 618         }
 619 }
 620
 621 static int btusb_submit_bulk_urb(struct hci_dev *hdev, gfp_t mem_flags)
 622 {
 623         struct btusb_data *data = hci_get_drvdata(hdev);
 624         struct urb *urb;
 625         unsigned char *buf;
 626         unsigned int pipe;
 627         int err, size = HCI_MAX_FRAME_SIZE;
 628
 629         BT_DBG("%s", hdev->name);
 630
 631         if (!data->bulk_rx_ep)
 632                 return -ENODEV;
 633
 634         urb = usb_alloc_urb(0, mem_flags);
 635         if (!urb)
 636                 return -ENOMEM;
 637
 638         buf = kmalloc(size, mem_flags);
 639         if (!buf) {
 640                 usb_free_urb(urb);
 641                 return -ENOMEM;
 642         }
 643
 644         pipe = usb_rcvbulkpipe(data->udev, data->bulk_rx_ep->bEndpointAddress);
 645
 646         usb_fill_bulk_urb(urb, data->udev, pipe, buf, size,
 647                           btusb_bulk_complete, hdev);
 648
 649         urb->transfer_flags |= URB_FREE_BUFFER;
 650
 651         usb_mark_last_busy(data->udev);
 652         usb_anchor_urb(urb, &data->bulk_anchor);
 653
 654         err = usb_submit_urb(urb, mem_flags);
 655         if (err < 0) {
 656                 if (err != -EPERM && err != -ENODEV)
 657                         BT_ERR("%s urb %p submission failed (%d)",
 658                                hdev->name, urb, -err);
 659                 usb_unanchor_urb(urb);
 660         }
 661
 662         usb_free_urb(urb);
 663
 664         return err;
 665 }
 666
 667 static void btusb_isoc_complete(struct urb *urb)
 668 {
 669         struct hci_dev *hdev = urb->context;
 670         struct btusb_data *data = hci_get_drvdata(hdev);
 671         int i, err;
 672
 673         BT_DBG("%s urb %p status %d count %d", hdev->name, urb, urb->status,
 674                urb->actual_length);
 675
 676         if (!test_bit(HCI_RUNNING, &hdev->flags))
 677                 return;
 678
 679         if (urb->status == 0) {
 680                 for (i = 0; i < urb->number_of_packets; i++) {
 681                         unsigned int offset = urb->iso_frame_desc[i].offset;
 682                         unsigned int length = urb->iso_frame_desc[i].actual_length;
 683
 684                         if (urb->iso_frame_desc[i].status)
 685                                 continue;
 686
 687                         hdev->stat.byte_rx += length;
 688
 689                         if (btusb_recv_isoc(data, urb->transfer_buffer + offset,
 690                                             length) < 0) {
 691                                 BT_ERR("%s corrupted SCO packet", hdev->name);
 692                                 hdev->stat.err_rx++;
 693                         }
 694                 }
 695         } else if (urb->status == -ENOENT) {
 696                 /* Avoid suspend failed when usb_kill_urb */
 697                 return;
 698         }
 699
 700         if (!test_bit(BTUSB_ISOC_RUNNING, &data->flags))
 701                 return;
 702
 703         usb_anchor_urb(urb, &data->isoc_anchor);
 704
 705         err = usb_submit_urb(urb, GFP_ATOMIC);
 706         if (err < 0) {
 707                 /* -EPERM: urb is being killed;
 708                  * -ENODEV: device got disconnected */
 709                 if (err != -EPERM && err != -ENODEV)
 710                         BT_ERR("%s urb %p failed to resubmit (%d)",
 711                                hdev->name, urb, -err);
 712                 usb_unanchor_urb(urb);
 713         }
 714 }
 715
 716 static inline void __fill_isoc_descriptor(struct urb *urb, int len, int mtu)
 717 {
 718         int i, offset = 0;
 719
 720         BT_DBG("len %d mtu %d", len, mtu);
 721
 722         for (i = 0; i < BTUSB_MAX_ISOC_FRAMES && len >= mtu;
 723                                         i++, offset += mtu, len -= mtu) {
 724                 urb->iso_frame_desc[i].offset = offset;
 725                 urb->iso_frame_desc[i].length = mtu;
 726         }
 727
 728         if (len && i < BTUSB_MAX_ISOC_FRAMES) {
 729                 urb->iso_frame_desc[i].offset = offset;
 730                 urb->iso_frame_desc[i].length = len;
 731                 i++;
 732         }
 733
 734         urb->number_of_packets = i;
 735 }
 736
 737 static int btusb_submit_isoc_urb(struct hci_dev *hdev, gfp_t mem_flags)
 738 {
 739         struct btusb_data *data = hci_get_drvdata(hdev);
 740         struct urb *urb;
 741         unsigned char *buf;
 742         unsigned int pipe;
 743         int err, size;
 744
 745         BT_DBG("%s", hdev->name);
 746
 747         if (!data->isoc_rx_ep)
 748                 return -ENODEV;
 749
 750         urb = usb_alloc_urb(BTUSB_MAX_ISOC_FRAMES, mem_flags);
 751         if (!urb)
 752                 return -ENOMEM;
 753
 754         size = le16_to_cpu(data->isoc_rx_ep->wMaxPacketSize) *
 755                                                 BTUSB_MAX_ISOC_FRAMES;
 756
 757         buf = kmalloc(size, mem_flags);
 758         if (!buf) {
 759                 usb_free_urb(urb);
 760                 return -ENOMEM;
 761         }
 762
 763         pipe = usb_rcvisocpipe(data->udev, data->isoc_rx_ep->bEndpointAddress);
 764
 765         usb_fill_int_urb(urb, data->udev, pipe, buf, size, btusb_isoc_complete,
 766                          hdev, data->isoc_rx_ep->bInterval);
 767
 768         urb->transfer_flags = URB_FREE_BUFFER | URB_ISO_ASAP;
 769
 770         __fill_isoc_descriptor(urb, size,
 771                                le16_to_cpu(data->isoc_rx_ep->wMaxPacketSize));
 772
 773         usb_anchor_urb(urb, &data->isoc_anchor);
 774
 775         err = usb_submit_urb(urb, mem_flags);
 776         if (err < 0) {
 777                 if (err != -EPERM && err != -ENODEV)
 778                         BT_ERR("%s urb %p submission failed (%d)",
 779                                hdev->name, urb, -err);
 780                 usb_unanchor_urb(urb);
 781         }
 782
 783         usb_free_urb(urb);
 784
 785         return err;
 786 }
 787
 788 static void btusb_tx_complete(struct urb *urb)
 789 {
 790         struct sk_buff *skb = urb->context;
 791         struct hci_dev *hdev = (struct hci_dev *)skb->dev;
 792         struct btusb_data *data = hci_get_drvdata(hdev);
 793
 794         BT_DBG("%s urb %p status %d count %d", hdev->name, urb, urb->status,
 795                urb->actual_length);
 796
 797         if (!test_bit(HCI_RUNNING, &hdev->flags))
 798                 goto done;
 799
 800         if (!urb->status)
 801                 hdev->stat.byte_tx += urb->transfer_buffer_length;
 802         else
 803                 hdev->stat.err_tx++;
 804
 805 done:
 806         spin_lock(&data->txlock);
 807         data->tx_in_flight--;
 808         spin_unlock(&data->txlock);
 809
 810         kfree(urb->setup_packet);
 811
 812         kfree_skb(skb);
 813 }
 814
 815 static void btusb_isoc_tx_complete(struct urb *urb)
 816 {
 817         struct sk_buff *skb = urb->context;
 818         struct hci_dev *hdev = (struct hci_dev *)skb->dev;
 819
 820         BT_DBG("%s urb %p status %d count %d", hdev->name, urb, urb->status,
 821                urb->actual_length);
 822
 823         if (!test_bit(HCI_RUNNING, &hdev->flags))
 824                 goto done;
 825
 826         if (!urb->status)
 827                 hdev->stat.byte_tx += urb->transfer_buffer_length;
 828         else
 829                 hdev->stat.err_tx++;
 830
 831 done:
 832         kfree(urb->setup_packet);
 833
 834         kfree_skb(skb);
 835 }
 836
 837 static int btusb_open(struct hci_dev *hdev)
 838 {
 839         struct btusb_data *data = hci_get_drvdata(hdev);
 840         int err;
 841
 842         BT_DBG("%s", hdev->name);
 843
 844         err = usb_autopm_get_interface(data->intf);
 845         if (err < 0)
 846                 return err;
 847
 848         data->intf->needs_remote_wakeup = 1;
 849
 850         if (test_and_set_bit(HCI_RUNNING, &hdev->flags))
 851                 goto done;
 852
 853         if (test_and_set_bit(BTUSB_INTR_RUNNING, &data->flags))
 854                 goto done;
 855
 856         err = btusb_submit_intr_urb(hdev, GFP_KERNEL);
 857         if (err < 0)
 858                 goto failed;
 859
 860         err = btusb_submit_bulk_urb(hdev, GFP_KERNEL);
 861         if (err < 0) {
 862                 usb_kill_anchored_urbs(&data->intr_anchor);
 863                 goto failed;
 864         }
 865
 866         set_bit(BTUSB_BULK_RUNNING, &data->flags);
 867         btusb_submit_bulk_urb(hdev, GFP_KERNEL);
 868
 869 done:
 870         usb_autopm_put_interface(data->intf);
 871         return 0;
 872
 873 failed:
 874         clear_bit(BTUSB_INTR_RUNNING, &data->flags);
 875         clear_bit(HCI_RUNNING, &hdev->flags);
 876         usb_autopm_put_interface(data->intf);
 877         return err;
 878 }
 879
 880 static void btusb_stop_traffic(struct btusb_data *data)
 881 {
 882         usb_kill_anchored_urbs(&data->intr_anchor);
 883         usb_kill_anchored_urbs(&data->bulk_anchor);
 884         usb_kill_anchored_urbs(&data->isoc_anchor);
 885 }
 886
 887 static int btusb_close(struct hci_dev *hdev)
 888 {
 889         struct btusb_data *data = hci_get_drvdata(hdev);
 890         int err;
 891
 892         BT_DBG("%s", hdev->name);
 893
 894         if (!test_and_clear_bit(HCI_RUNNING, &hdev->flags))
 895                 return 0;
 896
 897         cancel_work_sync(&data->work);
 898         cancel_work_sync(&data->waker);
 899
 900         clear_bit(BTUSB_ISOC_RUNNING, &data->flags);
 901         clear_bit(BTUSB_BULK_RUNNING, &data->flags);
 902         clear_bit(BTUSB_INTR_RUNNING, &data->flags);
 903
 904         btusb_stop_traffic(data);
 905         btusb_free_frags(data);
 906
 907         err = usb_autopm_get_interface(data->intf);
 908         if (err < 0)
 909                 goto failed;
 910
 911         data->intf->needs_remote_wakeup = 0;
 912         usb_autopm_put_interface(data->intf);
 913
 914 failed:
 915         usb_scuttle_anchored_urbs(&data->deferred);
 916         return 0;
 917 }
 918
 919 static int btusb_flush(struct hci_dev *hdev)
 920 {
 921         struct btusb_data *data = hci_get_drvdata(hdev);
 922
 923         BT_DBG("%s", hdev->name);
 924
 925         usb_kill_anchored_urbs(&data->tx_anchor);
 926         btusb_free_frags(data);
 927
 928         return 0;
 929 }
 930
 931 static struct urb *alloc_ctrl_urb(struct hci_dev *hdev, struct sk_buff *skb)
 932 {
 933         struct btusb_data *data = hci_get_drvdata(hdev);
 934         struct usb_ctrlrequest *dr;
 935         struct urb *urb;
 936         unsigned int pipe;
 937
 938         urb = usb_alloc_urb(0, GFP_KERNEL);
 939         if (!urb)
 940                 return ERR_PTR(-ENOMEM);
 941
 942         dr = kmalloc(sizeof(*dr), GFP_KERNEL);
 943         if (!dr) {
 944                 usb_free_urb(urb);
 945                 return ERR_PTR(-ENOMEM);
 946         }
 947
 948         dr->bRequestType = data->cmdreq_type;
 949         dr->bRequest     = 0;
 950         dr->wIndex       = 0;
 951         dr->wValue       = 0;
 952         dr->wLength      = __cpu_to_le16(skb->len);
 953
 954         pipe = usb_sndctrlpipe(data->udev, 0x00);
 955
 956         usb_fill_control_urb(urb, data->udev, pipe, (void *)dr,
 957                              skb->data, skb->len, btusb_tx_complete, skb);
 958
 959         skb->dev = (void *)hdev;
 960
 961         return urb;
 962 }
 963
 964 static struct urb *alloc_bulk_urb(struct hci_dev *hdev, struct sk_buff *skb)
 965 {
 966         struct btusb_data *data = hci_get_drvdata(hdev);
 967         struct urb *urb;
 968         unsigned int pipe;
 969
 970         if (!data->bulk_tx_ep)
 971                 return ERR_PTR(-ENODEV);
 972
 973         urb = usb_alloc_urb(0, GFP_KERNEL);
 974         if (!urb)
 975                 return ERR_PTR(-ENOMEM);
 976
 977         pipe = usb_sndbulkpipe(data->udev, data->bulk_tx_ep->bEndpointAddress);
 978
 979         usb_fill_bulk_urb(urb, data->udev, pipe,
 980                           skb->data, skb->len, btusb_tx_complete, skb);
 981
 982         skb->dev = (void *)hdev;
 983
 984         return urb;
 985 }
 986
 987 static struct urb *alloc_isoc_urb(struct hci_dev *hdev, struct sk_buff *skb)
 988 {
 989         struct btusb_data *data = hci_get_drvdata(hdev);
 990         struct urb *urb;
 991         unsigned int pipe;
 992
 993         if (!data->isoc_tx_ep)
 994                 return ERR_PTR(-ENODEV);
 995
 996         urb = usb_alloc_urb(BTUSB_MAX_ISOC_FRAMES, GFP_KERNEL);
 997         if (!urb)
 998                 return ERR_PTR(-ENOMEM);
 999
1000         pipe = usb_sndisocpipe(data->udev, data->isoc_tx_ep->bEndpointAddress);
1001
1002         usb_fill_int_urb(urb, data->udev, pipe,
1003                          skb->data, skb->len, btusb_isoc_tx_complete,
1004                          skb, data->isoc_tx_ep->bInterval);
1005
1006         urb->transfer_flags  = URB_ISO_ASAP;
1007
1008         __fill_isoc_descriptor(urb, skb->len,
1009                                le16_to_cpu(data->isoc_tx_ep->wMaxPacketSize));
1010
1011         skb->dev = (void *)hdev;
1012
1013         return urb;
1014 }
1015
1016 static int submit_tx_urb(struct hci_dev *hdev, struct urb *urb)
1017 {
1018         struct btusb_data *data = hci_get_drvdata(hdev);
1019         int err;
1020
1021         usb_anchor_urb(urb, &data->tx_anchor);
1022
1023         err = usb_submit_urb(urb, GFP_KERNEL);
1024         if (err < 0) {
1025                 if (err != -EPERM && err != -ENODEV)
1026                         BT_ERR("%s urb %p submission failed (%d)",
1027                                hdev->name, urb, -err);
1028                 kfree(urb->setup_packet);
1029                 usb_unanchor_urb(urb);
1030         } else {
1031                 usb_mark_last_busy(data->udev);
1032         }
1033
1034         usb_free_urb(urb);
1035         return err;
1036 }
1037
1038 static int submit_or_queue_tx_urb(struct hci_dev *hdev, struct urb *urb)
1039 {
1040         struct btusb_data *data = hci_get_drvdata(hdev);
1041         unsigned long flags;
1042         bool suspending;
1043
1044         spin_lock_irqsave(&data->txlock, flags);
1045         suspending = test_bit(BTUSB_SUSPENDING, &data->flags);
1046         if (!suspending)
1047                 data->tx_in_flight++;
1048         spin_unlock_irqrestore(&data->txlock, flags);
1049
1050         if (!suspending)
1051                 return submit_tx_urb(hdev, urb);
1052
1053         usb_anchor_urb(urb, &data->deferred);
1054         schedule_work(&data->waker);
1055
1056         usb_free_urb(urb);
1057         return 0;
1058 }
1059
1060 static int btusb_send_frame(struct hci_dev *hdev, struct sk_buff *skb)
1061 {
1062         struct urb *urb;
1063
1064         BT_DBG("%s", hdev->name);
1065
1066         if (!test_bit(HCI_RUNNING, &hdev->flags))
1067                 return -EBUSY;
1068
1069         switch (bt_cb(skb)->pkt_type) {
1070         case HCI_COMMAND_PKT:
1071                 urb = alloc_ctrl_urb(hdev, skb);
1072                 if (IS_ERR(urb))
1073                         return PTR_ERR(urb);
1074
1075                 hdev->stat.cmd_tx++;
1076                 return submit_or_queue_tx_urb(hdev, urb);
1077
1078         case HCI_ACLDATA_PKT:
1079                 urb = alloc_bulk_urb(hdev, skb);
1080                 if (IS_ERR(urb))
1081                         return PTR_ERR(urb);
1082
1083                 hdev->stat.acl_tx++;
1084                 return submit_or_queue_tx_urb(hdev, urb);
1085
1086         case HCI_SCODATA_PKT:
1087                 if (hci_conn_num(hdev, SCO_LINK) < 1)
1088                         return -ENODEV;
1089
1090                 urb = alloc_isoc_urb(hdev, skb);
1091                 if (IS_ERR(urb))
1092                         return PTR_ERR(urb);
1093
1094                 hdev->stat.sco_tx++;
1095                 return submit_tx_urb(hdev, urb);
1096         }
1097
1098         return -EILSEQ;
1099 }
1100
1101 static void btusb_notify(struct hci_dev *hdev, unsigned int evt)
1102 {
1103         struct btusb_data *data = hci_get_drvdata(hdev);
1104
1105         BT_DBG("%s evt %d", hdev->name, evt);
1106
1107         if (hci_conn_num(hdev, SCO_LINK) != data->sco_num) {
1108                 data->sco_num = hci_conn_num(hdev, SCO_LINK);
1109                 schedule_work(&data->work);
1110         }
1111 }
1112
1113 static inline int __set_isoc_interface(struct hci_dev *hdev, int altsetting)
1114 {
1115         struct btusb_data *data = hci_get_drvdata(hdev);
1116         struct usb_interface *intf = data->isoc;
1117         struct usb_endpoint_descriptor *ep_desc;
1118         int i, err;
1119
1120         if (!data->isoc)
1121                 return -ENODEV;
1122
1123         err = usb_set_interface(data->udev, 1, altsetting);
1124         if (err < 0) {
1125                 BT_ERR("%s setting interface failed (%d)", hdev->name, -err);
1126                 return err;
1127         }
1128
1129         data->isoc_altsetting = altsetting;
1130
1131         data->isoc_tx_ep = NULL;
1132         data->isoc_rx_ep = NULL;
1133
1134         for (i = 0; i < intf->cur_altsetting->desc.bNumEndpoints; i++) {
1135                 ep_desc = &intf->cur_altsetting->endpoint[i].desc;
1136
1137                 if (!data->isoc_tx_ep && usb_endpoint_is_isoc_out(ep_desc)) {
1138                         data->isoc_tx_ep = ep_desc;
1139                         continue;
1140                 }
1141
1142                 if (!data->isoc_rx_ep && usb_endpoint_is_isoc_in(ep_desc)) {
1143                         data->isoc_rx_ep = ep_desc;
1144                         continue;
1145                 }
1146         }
1147
1148         if (!data->isoc_tx_ep || !data->isoc_rx_ep) {
1149                 BT_ERR("%s invalid SCO descriptors", hdev->name);
1150                 return -ENODEV;
1151         }
1152
1153         return 0;
1154 }
1155
1156 static void btusb_work(struct work_struct *work)
1157 {
1158         struct btusb_data *data = container_of(work, struct btusb_data, work);
1159         struct hci_dev *hdev = data->hdev;
1160         int new_alts;
1161         int err;
1162
1163         if (data->sco_num > 0) {
1164                 if (!test_bit(BTUSB_DID_ISO_RESUME, &data->flags)) {
1165                         err = usb_autopm_get_interface(data->isoc ? data->isoc : data->intf);
1166                         if (err < 0) {
1167                                 clear_bit(BTUSB_ISOC_RUNNING, &data->flags);
1168                                 usb_kill_anchored_urbs(&data->isoc_anchor);
1169                                 return;
1170                         }
1171
1172                         set_bit(BTUSB_DID_ISO_RESUME, &data->flags);
1173                 }
1174
1175                 if (hdev->voice_setting & 0x0020) {
1176                         static const int alts[3] = { 2, 4, 5 };
1177
1178                         new_alts = alts[data->sco_num - 1];
1179                 } else {
1180                         new_alts = data->sco_num;
1181                 }
1182
1183                 if (data->isoc_altsetting != new_alts) {
1184                         clear_bit(BTUSB_ISOC_RUNNING, &data->flags);
1185                         usb_kill_anchored_urbs(&data->isoc_anchor);
1186
1187                         if (__set_isoc_interface(hdev, new_alts) < 0)
1188                                 return;
1189                 }
1190
1191                 if (!test_and_set_bit(BTUSB_ISOC_RUNNING, &data->flags)) {
1192                         if (btusb_submit_isoc_urb(hdev, GFP_KERNEL) < 0)
1193                                 clear_bit(BTUSB_ISOC_RUNNING, &data->flags);
1194                         else
1195                                 btusb_submit_isoc_urb(hdev, GFP_KERNEL);
1196                 }
1197         } else {
1198                 clear_bit(BTUSB_ISOC_RUNNING, &data->flags);
1199                 usb_kill_anchored_urbs(&data->isoc_anchor);
1200
1201                 __set_isoc_interface(hdev, 0);
1202                 if (test_and_clear_bit(BTUSB_DID_ISO_RESUME, &data->flags))
1203                         usb_autopm_put_interface(data->isoc ? data->isoc : data->intf);
1204         }
1205 }
1206
1207 static void btusb_waker(struct work_struct *work)
1208 {
1209         struct btusb_data *data = container_of(work, struct btusb_data, waker);
1210         int err;
1211
1212         err = usb_autopm_get_interface(data->intf);
1213         if (err < 0)
1214                 return;
1215
1216         usb_autopm_put_interface(data->intf);
1217 }
1218
1219 static int btusb_setup_bcm92035(struct hci_dev *hdev)
1220 {
1221         struct sk_buff *skb;
1222         u8 val = 0x00;
1223
1224         BT_DBG("%s", hdev->name);
1225
1226         skb = __hci_cmd_sync(hdev, 0xfc3b, 1, &val, HCI_INIT_TIMEOUT);
1227         if (IS_ERR(skb))
1228                 BT_ERR("BCM92035 command failed (%ld)", -PTR_ERR(skb));
1229         else
1230                 kfree_skb(skb);
1231
1232         return 0;
1233 }
1234
1235 static int btusb_setup_csr(struct hci_dev *hdev)
1236 {
1237         struct hci_rp_read_local_version *rp;
1238         struct sk_buff *skb;
1239         int ret;
1240
1241         BT_DBG("%s", hdev->name);
1242
1243         skb = __hci_cmd_sync(hdev, HCI_OP_READ_LOCAL_VERSION, 0, NULL,
1244                              HCI_INIT_TIMEOUT);
1245         if (IS_ERR(skb)) {
1246                 BT_ERR("Reading local version failed (%ld)", -PTR_ERR(skb));
1247                 return -PTR_ERR(skb);
1248         }
1249
1250         rp = (struct hci_rp_read_local_version *)skb->data;
1251
1252         if (!rp->status) {
1253                 if (le16_to_cpu(rp->manufacturer) != 10) {
1254                         /* Clear the reset quirk since this is not an actual
1255                          * early Bluetooth 1.1 device from CSR.
1256                          */
1257                         clear_bit(HCI_QUIRK_RESET_ON_CLOSE, &hdev->quirks);
1258
1259                         /* These fake CSR controllers have all a broken
1260                          * stored link key handling and so just disable it.
1261                          */
1262                         set_bit(HCI_QUIRK_BROKEN_STORED_LINK_KEY,
1263                                 &hdev->quirks);
1264                 }
1265         }
1266
1267         ret = -bt_to_errno(rp->status);
1268
1269         kfree_skb(skb);
1270
1271         return ret;
1272 }
1273
1274 struct intel_version {
1275         u8 status;
1276         u8 hw_platform;
1277         u8 hw_variant;
1278         u8 hw_revision;
1279         u8 fw_variant;
1280         u8 fw_revision;
1281         u8 fw_build_num;
1282         u8 fw_build_ww;
1283         u8 fw_build_yy;
1284         u8 fw_patch_num;
1285 } __packed;
1286
1287 static const struct firmware *btusb_setup_intel_get_fw(struct hci_dev *hdev,
1288                                                        struct intel_version *ver)
1289 {
1290         const struct firmware *fw;
1291         char fwname[64];
1292         int ret;
1293
1294         snprintf(fwname, sizeof(fwname),
1295                  "intel/ibt-hw-%x.%x.%x-fw-%x.%x.%x.%x.%x.bseq",
1296                  ver->hw_platform, ver->hw_variant, ver->hw_revision,
1297                  ver->fw_variant,  ver->fw_revision, ver->fw_build_num,
1298                  ver->fw_build_ww, ver->fw_build_yy);
1299
1300         ret = request_firmware(&fw, fwname, &hdev->dev);
1301         if (ret < 0) {
1302                 if (ret == -EINVAL) {
1303                         BT_ERR("%s Intel firmware file request failed (%d)",
1304                                hdev->name, ret);
1305                         return NULL;
1306                 }
1307
1308                 BT_ERR("%s failed to open Intel firmware file: %s(%d)",
1309                        hdev->name, fwname, ret);
1310
1311                 /* If the correct firmware patch file is not found, use the
1312                  * default firmware patch file instead
1313                  */
1314                 snprintf(fwname, sizeof(fwname), "intel/ibt-hw-%x.%x.bseq",
1315                          ver->hw_platform, ver->hw_variant);
1316                 if (request_firmware(&fw, fwname, &hdev->dev) < 0) {
1317                         BT_ERR("%s failed to open default Intel fw file: %s",
1318                                hdev->name, fwname);
1319                         return NULL;
1320                 }
1321         }
1322
1323         BT_INFO("%s: Intel Bluetooth firmware file: %s", hdev->name, fwname);
1324
1325         return fw;
1326 }
1327
1328 static int btusb_setup_intel_patching(struct hci_dev *hdev,
1329                                       const struct firmware *fw,
1330                                       const u8 **fw_ptr, int *disable_patch)
1331 {
1332         struct sk_buff *skb;
1333         struct hci_command_hdr *cmd;
1334         const u8 *cmd_param;
1335         struct hci_event_hdr *evt = NULL;
1336         const u8 *evt_param = NULL;
1337         int remain = fw->size - (*fw_ptr - fw->data);
1338
1339         /* The first byte indicates the types of the patch command or event.
1340          * 0x01 means HCI command and 0x02 is HCI event. If the first bytes
1341          * in the current firmware buffer doesn't start with 0x01 or
1342          * the size of remain buffer is smaller than HCI command header,
1343          * the firmware file is corrupted and it should stop the patching
1344          * process.
1345          */
1346         if (remain > HCI_COMMAND_HDR_SIZE && *fw_ptr[0] != 0x01) {
1347                 BT_ERR("%s Intel fw corrupted: invalid cmd read", hdev->name);
1348                 return -EINVAL;
1349         }
1350         (*fw_ptr)++;
1351         remain--;
1352
1353         cmd = (struct hci_command_hdr *)(*fw_ptr);
1354         *fw_ptr += sizeof(*cmd);
1355         remain -= sizeof(*cmd);
1356
1357         /* Ensure that the remain firmware data is long enough than the length
1358          * of command parameter. If not, the firmware file is corrupted.
1359          */
1360         if (remain < cmd->plen) {
1361                 BT_ERR("%s Intel fw corrupted: invalid cmd len", hdev->name);
1362                 return -EFAULT;
1363         }
1364
1365         /* If there is a command that loads a patch in the firmware
1366          * file, then enable the patch upon success, otherwise just
1367          * disable the manufacturer mode, for example patch activation
1368          * is not required when the default firmware patch file is used
1369          * because there are no patch data to load.
1370          */
1371         if (*disable_patch && le16_to_cpu(cmd->opcode) == 0xfc8e)
1372                 *disable_patch = 0;
1373
1374         cmd_param = *fw_ptr;
1375         *fw_ptr += cmd->plen;
1376         remain -= cmd->plen;
1377
1378         /* This reads the expected events when the above command is sent to the
1379          * device. Some vendor commands expects more than one events, for
1380          * example command status event followed by vendor specific event.
1381          * For this case, it only keeps the last expected event. so the command
1382          * can be sent with __hci_cmd_sync_ev() which returns the sk_buff of
1383          * last expected event.
1384          */
1385         while (remain > HCI_EVENT_HDR_SIZE && *fw_ptr[0] == 0x02) {
1386                 (*fw_ptr)++;
1387                 remain--;
1388
1389                 evt = (struct hci_event_hdr *)(*fw_ptr);
1390                 *fw_ptr += sizeof(*evt);
1391                 remain -= sizeof(*evt);
1392
1393                 if (remain < evt->plen) {
1394                         BT_ERR("%s Intel fw corrupted: invalid evt len",
1395                                hdev->name);
1396                         return -EFAULT;
1397                 }
1398
1399                 evt_param = *fw_ptr;
1400                 *fw_ptr += evt->plen;
1401                 remain -= evt->plen;
1402         }
1403
1404         /* Every HCI commands in the firmware file has its correspond event.
1405          * If event is not found or remain is smaller than zero, the firmware
1406          * file is corrupted.
1407          */
1408         if (!evt || !evt_param || remain < 0) {
1409                 BT_ERR("%s Intel fw corrupted: invalid evt read", hdev->name);
1410                 return -EFAULT;
1411         }
1412
1413         skb = __hci_cmd_sync_ev(hdev, le16_to_cpu(cmd->opcode), cmd->plen,
1414                                 cmd_param, evt->evt, HCI_INIT_TIMEOUT);
1415         if (IS_ERR(skb)) {
1416                 BT_ERR("%s sending Intel patch command (0x%4.4x) failed (%ld)",
1417                        hdev->name, cmd->opcode, PTR_ERR(skb));
1418                 return PTR_ERR(skb);
1419         }
1420
1421         /* It ensures that the returned event matches the event data read from
1422          * the firmware file. At fist, it checks the length and then
1423          * the contents of the event.
1424          */
1425         if (skb->len != evt->plen) {
1426                 BT_ERR("%s mismatch event length (opcode 0x%4.4x)", hdev->name,
1427                        le16_to_cpu(cmd->opcode));
1428                 kfree_skb(skb);
1429                 return -EFAULT;
1430         }
1431
1432         if (memcmp(skb->data, evt_param, evt->plen)) {
1433                 BT_ERR("%s mismatch event parameter (opcode 0x%4.4x)",
1434                        hdev->name, le16_to_cpu(cmd->opcode));
1435                 kfree_skb(skb);
1436                 return -EFAULT;
1437         }
1438         kfree_skb(skb);
1439
1440         return 0;
1441 }
1442
1443 #define BDADDR_INTEL (&(bdaddr_t) {{0x00, 0x8b, 0x9e, 0x19, 0x03, 0x00}})
1444
1445 static int btusb_check_bdaddr_intel(struct hci_dev *hdev)
1446 {
1447         struct sk_buff *skb;
1448         struct hci_rp_read_bd_addr *rp;
1449
1450         skb = __hci_cmd_sync(hdev, HCI_OP_READ_BD_ADDR, 0, NULL,
1451                              HCI_INIT_TIMEOUT);
1452         if (IS_ERR(skb)) {
1453                 BT_ERR("%s reading Intel device address failed (%ld)",
1454                        hdev->name, PTR_ERR(skb));
1455                 return PTR_ERR(skb);
1456         }
1457
1458         if (skb->len != sizeof(*rp)) {
1459                 BT_ERR("%s Intel device address length mismatch", hdev->name);
1460                 kfree_skb(skb);
1461                 return -EIO;
1462         }
1463
1464         rp = (struct hci_rp_read_bd_addr *)skb->data;
1465         if (rp->status) {
1466                 BT_ERR("%s Intel device address result failed (%02x)",
1467                        hdev->name, rp->status);
1468                 kfree_skb(skb);
1469                 return -bt_to_errno(rp->status);
1470         }
1471
1472         /* For some Intel based controllers, the default Bluetooth device
1473          * address 00:03:19:9E:8B:00 can be found. These controllers are
1474          * fully operational, but have the danger of duplicate addresses
1475          * and that in turn can cause problems with Bluetooth operation.
1476          */
1477         if (!bacmp(&rp->bdaddr, BDADDR_INTEL)) {
1478                 BT_ERR("%s found Intel default device address (%pMR)",
1479                        hdev->name, &rp->bdaddr);
1480                 set_bit(HCI_QUIRK_INVALID_BDADDR, &hdev->quirks);
1481         }
1482
1483         kfree_skb(skb);
1484
1485         return 0;
1486 }
1487
1488 static int btusb_setup_intel(struct hci_dev *hdev)
1489 {
1490         struct sk_buff *skb;
1491         const struct firmware *fw;
1492         const u8 *fw_ptr;
1493         int disable_patch;
1494         struct intel_version *ver;
1495
1496         const u8 mfg_enable[] = { 0x01, 0x00 };
1497         const u8 mfg_disable[] = { 0x00, 0x00 };
1498         const u8 mfg_reset_deactivate[] = { 0x00, 0x01 };
1499         const u8 mfg_reset_activate[] = { 0x00, 0x02 };
1500
1501         BT_DBG("%s", hdev->name);
1502
1503         /* The controller has a bug with the first HCI command sent to it
1504          * returning number of completed commands as zero. This would stall the
1505          * command processing in the Bluetooth core.
1506          *
1507          * As a workaround, send HCI Reset command first which will reset the
1508          * number of completed commands and allow normal command processing
1509          * from now on.
1510          */
1511         skb = __hci_cmd_sync(hdev, HCI_OP_RESET, 0, NULL, HCI_INIT_TIMEOUT);
1512         if (IS_ERR(skb)) {
1513                 BT_ERR("%s sending initial HCI reset command failed (%ld)",
1514                        hdev->name, PTR_ERR(skb));
1515                 return PTR_ERR(skb);
1516         }
1517         kfree_skb(skb);
1518
1519         /* Read Intel specific controller version first to allow selection of
1520          * which firmware file to load.
1521          *
1522          * The returned information are hardware variant and revision plus
1523          * firmware variant, revision and build number.
1524          */
1525         skb = __hci_cmd_sync(hdev, 0xfc05, 0, NULL, HCI_INIT_TIMEOUT);
1526         if (IS_ERR(skb)) {
1527                 BT_ERR("%s reading Intel fw version command failed (%ld)",
1528                        hdev->name, PTR_ERR(skb));
1529                 return PTR_ERR(skb);
1530         }
1531
1532         if (skb->len != sizeof(*ver)) {
1533                 BT_ERR("%s Intel version event length mismatch", hdev->name);
1534                 kfree_skb(skb);
1535                 return -EIO;
1536         }
1537
1538         ver = (struct intel_version *)skb->data;
1539         if (ver->status) {
1540                 BT_ERR("%s Intel fw version event failed (%02x)", hdev->name,
1541                        ver->status);
1542                 kfree_skb(skb);
1543                 return -bt_to_errno(ver->status);
1544         }
1545
1546         BT_INFO("%s: read Intel version: %02x%02x%02x%02x%02x%02x%02x%02x%02x",
1547                 hdev->name, ver->hw_platform, ver->hw_variant,
1548                 ver->hw_revision, ver->fw_variant,  ver->fw_revision,
1549                 ver->fw_build_num, ver->fw_build_ww, ver->fw_build_yy,
1550                 ver->fw_patch_num);
1551
1552         /* fw_patch_num indicates the version of patch the device currently
1553          * have. If there is no patch data in the device, it is always 0x00.
1554          * So, if it is other than 0x00, no need to patch the deivce again.
1555          */
1556         if (ver->fw_patch_num) {
1557                 BT_INFO("%s: Intel device is already patched. patch num: %02x",
1558                         hdev->name, ver->fw_patch_num);
1559                 kfree_skb(skb);
1560                 btusb_check_bdaddr_intel(hdev);
1561                 return 0;
1562         }
1563
1564         /* Opens the firmware patch file based on the firmware version read
1565          * from the controller. If it fails to open the matching firmware
1566          * patch file, it tries to open the default firmware patch file.
1567          * If no patch file is found, allow the device to operate without
1568          * a patch.
1569          */
1570         fw = btusb_setup_intel_get_fw(hdev, ver);
1571         if (!fw) {
1572                 kfree_skb(skb);
1573                 btusb_check_bdaddr_intel(hdev);
1574                 return 0;
1575         }
1576         fw_ptr = fw->data;
1577
1578         /* This Intel specific command enables the manufacturer mode of the
1579          * controller.
1580          *
1581          * Only while this mode is enabled, the driver can download the
1582          * firmware patch data and configuration parameters.
1583          */
1584         skb = __hci_cmd_sync(hdev, 0xfc11, 2, mfg_enable, HCI_INIT_TIMEOUT);
1585         if (IS_ERR(skb)) {
1586                 BT_ERR("%s entering Intel manufacturer mode failed (%ld)",
1587                        hdev->name, PTR_ERR(skb));
1588                 release_firmware(fw);
1589                 return PTR_ERR(skb);
1590         }
1591
1592         if (skb->data[0]) {
1593                 u8 evt_status = skb->data[0];
1594
1595                 BT_ERR("%s enable Intel manufacturer mode event failed (%02x)",
1596                        hdev->name, evt_status);
1597                 kfree_skb(skb);
1598                 release_firmware(fw);
1599                 return -bt_to_errno(evt_status);
1600         }
1601         kfree_skb(skb);
1602
1603         disable_patch = 1;
1604
1605         /* The firmware data file consists of list of Intel specific HCI
1606          * commands and its expected events. The first byte indicates the
1607          * type of the message, either HCI command or HCI event.
1608          *
1609          * It reads the command and its expected event from the firmware file,
1610          * and send to the controller. Once __hci_cmd_sync_ev() returns,
1611          * the returned event is compared with the event read from the firmware
1612          * file and it will continue until all the messages are downloaded to
1613          * the controller.
1614          *
1615          * Once the firmware patching is completed successfully,
1616          * the manufacturer mode is disabled with reset and activating the
1617          * downloaded patch.
1618          *
1619          * If the firmware patching fails, the manufacturer mode is
1620          * disabled with reset and deactivating the patch.
1621          *
1622          * If the default patch file is used, no reset is done when disabling
1623          * the manufacturer.
1624          */
1625         while (fw->size > fw_ptr - fw->data) {
1626                 int ret;
1627
1628                 ret = btusb_setup_intel_patching(hdev, fw, &fw_ptr,
1629                                                  &disable_patch);
1630                 if (ret < 0)
1631                         goto exit_mfg_deactivate;
1632         }
1633
1634         release_firmware(fw);
1635
1636         if (disable_patch)
1637                 goto exit_mfg_disable;
1638
1639         /* Patching completed successfully and disable the manufacturer mode
1640          * with reset and activate the downloaded firmware patches.
1641          */
1642         skb = __hci_cmd_sync(hdev, 0xfc11, sizeof(mfg_reset_activate),
1643                              mfg_reset_activate, HCI_INIT_TIMEOUT);
1644         if (IS_ERR(skb)) {
1645                 BT_ERR("%s exiting Intel manufacturer mode failed (%ld)",
1646                        hdev->name, PTR_ERR(skb));
1647                 return PTR_ERR(skb);
1648         }
1649         kfree_skb(skb);
1650
1651         BT_INFO("%s: Intel Bluetooth firmware patch completed and activated",
1652                 hdev->name);
1653
1654         btusb_check_bdaddr_intel(hdev);
1655         return 0;
1656
1657 exit_mfg_disable:
1658         /* Disable the manufacturer mode without reset */
1659         skb = __hci_cmd_sync(hdev, 0xfc11, sizeof(mfg_disable), mfg_disable,
1660                              HCI_INIT_TIMEOUT);
1661         if (IS_ERR(skb)) {
1662                 BT_ERR("%s exiting Intel manufacturer mode failed (%ld)",
1663                        hdev->name, PTR_ERR(skb));
1664                 return PTR_ERR(skb);
1665         }
1666         kfree_skb(skb);
1667
1668         BT_INFO("%s: Intel Bluetooth firmware patch completed", hdev->name);
1669
1670         btusb_check_bdaddr_intel(hdev);
1671         return 0;
1672
1673 exit_mfg_deactivate:
1674         release_firmware(fw);
1675
1676         /* Patching failed. Disable the manufacturer mode with reset and
1677          * deactivate the downloaded firmware patches.
1678          */
1679         skb = __hci_cmd_sync(hdev, 0xfc11, sizeof(mfg_reset_deactivate),
1680                              mfg_reset_deactivate, HCI_INIT_TIMEOUT);
1681         if (IS_ERR(skb)) {
1682                 BT_ERR("%s exiting Intel manufacturer mode failed (%ld)",
1683                        hdev->name, PTR_ERR(skb));
1684                 return PTR_ERR(skb);
1685         }
1686         kfree_skb(skb);
1687
1688         BT_INFO("%s: Intel Bluetooth firmware patch completed and deactivated",
1689                 hdev->name);
1690
1691         btusb_check_bdaddr_intel(hdev);
1692         return 0;
1693 }
1694
1695 static int btusb_set_bdaddr_intel(struct hci_dev *hdev, const bdaddr_t *bdaddr)
1696 {
1697         struct sk_buff *skb;
1698         long ret;
1699
1700         skb = __hci_cmd_sync(hdev, 0xfc31, 6, bdaddr, HCI_INIT_TIMEOUT);
1701         if (IS_ERR(skb)) {
1702                 ret = PTR_ERR(skb);
1703                 BT_ERR("%s: changing Intel device address failed (%ld)",
1704                        hdev->name, ret);
1705                 return ret;
1706         }
1707         kfree_skb(skb);
1708
1709         return 0;
1710 }
1711
1712 static int btusb_set_bdaddr_marvell(struct hci_dev *hdev,
1713                                     const bdaddr_t *bdaddr)
1714 {
1715         struct sk_buff *skb;
1716         u8 buf[8];
1717         long ret;
1718
1719         buf[0] = 0xfe;
1720         buf[1] = sizeof(bdaddr_t);
1721         memcpy(buf + 2, bdaddr, sizeof(bdaddr_t));
1722
1723         skb = __hci_cmd_sync(hdev, 0xfc22, sizeof(buf), buf, HCI_INIT_TIMEOUT);
1724         if (IS_ERR(skb)) {
1725                 ret = PTR_ERR(skb);
1726                 BT_ERR("%s: changing Marvell device address failed (%ld)",
1727                        hdev->name, ret);
1728                 return ret;
1729         }
1730         kfree_skb(skb);
1731
1732         return 0;
1733 }
1734
1735 #define BDADDR_BCM20702A0 (&(bdaddr_t) {{0x00, 0xa0, 0x02, 0x70, 0x20, 0x00}})
1736
1737 static int btusb_setup_bcm_patchram(struct hci_dev *hdev)
1738 {
1739         struct btusb_data *data = hci_get_drvdata(hdev);
1740         struct usb_device *udev = data->udev;
1741         char fw_name[64];
1742         const struct firmware *fw;
1743         const u8 *fw_ptr;
1744         size_t fw_size;
1745         const struct hci_command_hdr *cmd;
1746         const u8 *cmd_param;
1747         u16 opcode;
1748         struct sk_buff *skb;
1749         struct hci_rp_read_local_version *ver;
1750         struct hci_rp_read_bd_addr *bda;
1751         long ret;
1752
1753         snprintf(fw_name, sizeof(fw_name), "brcm/%s-%04x-%04x.hcd",
1754                  udev->product ? udev->product : "BCM",
1755                  le16_to_cpu(udev->descriptor.idVendor),
1756                  le16_to_cpu(udev->descriptor.idProduct));
1757
1758         ret = request_firmware(&fw, fw_name, &hdev->dev);
1759         if (ret < 0) {
1760                 BT_INFO("%s: BCM: patch %s not found", hdev->name, fw_name);
1761                 return 0;
1762         }
1763
1764         /* Reset */
1765         skb = __hci_cmd_sync(hdev, HCI_OP_RESET, 0, NULL, HCI_INIT_TIMEOUT);
1766         if (IS_ERR(skb)) {
1767                 ret = PTR_ERR(skb);
1768                 BT_ERR("%s: HCI_OP_RESET failed (%ld)", hdev->name, ret);
1769                 goto done;
1770         }
1771         kfree_skb(skb);
1772
1773         /* Read Local Version Info */
1774         skb = __hci_cmd_sync(hdev, HCI_OP_READ_LOCAL_VERSION, 0, NULL,
1775                              HCI_INIT_TIMEOUT);
1776         if (IS_ERR(skb)) {
1777                 ret = PTR_ERR(skb);
1778                 BT_ERR("%s: HCI_OP_READ_LOCAL_VERSION failed (%ld)",
1779                        hdev->name, ret);
1780                 goto done;
1781         }
1782
1783         if (skb->len != sizeof(*ver)) {
1784                 BT_ERR("%s: HCI_OP_READ_LOCAL_VERSION event length mismatch",
1785                        hdev->name);
1786                 kfree_skb(skb);
1787                 ret = -EIO;
1788                 goto done;
1789         }
1790
1791         ver = (struct hci_rp_read_local_version *)skb->data;
1792         BT_INFO("%s: BCM: patching hci_ver=%02x hci_rev=%04x lmp_ver=%02x "
1793                 "lmp_subver=%04x", hdev->name, ver->hci_ver, ver->hci_rev,
1794                 ver->lmp_ver, ver->lmp_subver);
1795         kfree_skb(skb);
1796
1797         /* Start Download */
1798         skb = __hci_cmd_sync(hdev, 0xfc2e, 0, NULL, HCI_INIT_TIMEOUT);
1799         if (IS_ERR(skb)) {
1800                 ret = PTR_ERR(skb);
1801                 BT_ERR("%s: BCM: Download Minidrv command failed (%ld)",
1802                        hdev->name, ret);
1803                 goto reset_fw;
1804         }
1805         kfree_skb(skb);
1806
1807         /* 50 msec delay after Download Minidrv completes */
1808         msleep(50);
1809
1810         fw_ptr = fw->data;
1811         fw_size = fw->size;
1812
1813         while (fw_size >= sizeof(*cmd)) {
1814                 cmd = (struct hci_command_hdr *)fw_ptr;
1815                 fw_ptr += sizeof(*cmd);
1816                 fw_size -= sizeof(*cmd);
1817
1818                 if (fw_size < cmd->plen) {
1819                         BT_ERR("%s: BCM: patch %s is corrupted",
1820                                hdev->name, fw_name);
1821                         ret = -EINVAL;
1822                         goto reset_fw;
1823                 }
1824
1825                 cmd_param = fw_ptr;
1826                 fw_ptr += cmd->plen;
1827                 fw_size -= cmd->plen;
1828
1829                 opcode = le16_to_cpu(cmd->opcode);
1830
1831                 skb = __hci_cmd_sync(hdev, opcode, cmd->plen, cmd_param,
1832                                      HCI_INIT_TIMEOUT);
1833                 if (IS_ERR(skb)) {
1834                         ret = PTR_ERR(skb);
1835                         BT_ERR("%s: BCM: patch command %04x failed (%ld)",
1836                                hdev->name, opcode, ret);
1837                         goto reset_fw;
1838                 }
1839                 kfree_skb(skb);
1840         }
1841
1842         /* 250 msec delay after Launch Ram completes */
1843         msleep(250);
1844
1845 reset_fw:
1846         /* Reset */
1847         skb = __hci_cmd_sync(hdev, HCI_OP_RESET, 0, NULL, HCI_INIT_TIMEOUT);
1848         if (IS_ERR(skb)) {
1849                 ret = PTR_ERR(skb);
1850                 BT_ERR("%s: HCI_OP_RESET failed (%ld)", hdev->name, ret);
1851                 goto done;
1852         }
1853         kfree_skb(skb);
1854
1855         /* Read Local Version Info */
1856         skb = __hci_cmd_sync(hdev, HCI_OP_READ_LOCAL_VERSION, 0, NULL,
1857                              HCI_INIT_TIMEOUT);
1858         if (IS_ERR(skb)) {
1859                 ret = PTR_ERR(skb);
1860                 BT_ERR("%s: HCI_OP_READ_LOCAL_VERSION failed (%ld)",
1861                        hdev->name, ret);
1862                 goto done;
1863         }
1864
1865         if (skb->len != sizeof(*ver)) {
1866                 BT_ERR("%s: HCI_OP_READ_LOCAL_VERSION event length mismatch",
1867                        hdev->name);
1868                 kfree_skb(skb);
1869                 ret = -EIO;
1870                 goto done;
1871         }
1872
1873         ver = (struct hci_rp_read_local_version *)skb->data;
1874         BT_INFO("%s: BCM: firmware hci_ver=%02x hci_rev=%04x lmp_ver=%02x "
1875                 "lmp_subver=%04x", hdev->name, ver->hci_ver, ver->hci_rev,
1876                 ver->lmp_ver, ver->lmp_subver);
1877         kfree_skb(skb);
1878
1879         /* Read BD Address */
1880         skb = __hci_cmd_sync(hdev, HCI_OP_READ_BD_ADDR, 0, NULL,
1881                              HCI_INIT_TIMEOUT);
1882         if (IS_ERR(skb)) {
1883                 ret = PTR_ERR(skb);
1884                 BT_ERR("%s: HCI_OP_READ_BD_ADDR failed (%ld)",
1885                        hdev->name, ret);
1886                 goto done;
1887         }
1888
1889         if (skb->len != sizeof(*bda)) {
1890                 BT_ERR("%s: HCI_OP_READ_BD_ADDR event length mismatch",
1891                        hdev->name);
1892                 kfree_skb(skb);
1893                 ret = -EIO;
1894                 goto done;
1895         }
1896
1897         bda = (struct hci_rp_read_bd_addr *)skb->data;
1898         if (bda->status) {
1899                 BT_ERR("%s: HCI_OP_READ_BD_ADDR error status (%02x)",
1900                        hdev->name, bda->status);
1901                 kfree_skb(skb);
1902                 ret = -bt_to_errno(bda->status);
1903                 goto done;
1904         }
1905
1906         /* The address 00:20:70:02:A0:00 indicates a BCM20702A0 controller
1907          * with no configured address.
1908          */
1909         if (!bacmp(&bda->bdaddr, BDADDR_BCM20702A0)) {
1910                 BT_INFO("%s: BCM: using default device address (%pMR)",
1911                         hdev->name, &bda->bdaddr);
1912                 set_bit(HCI_QUIRK_INVALID_BDADDR, &hdev->quirks);
1913         }
1914
1915         kfree_skb(skb);
1916
1917 done:
1918         release_firmware(fw);
1919
1920         return ret;
1921 }
1922
1923 static int btusb_set_bdaddr_bcm(struct hci_dev *hdev, const bdaddr_t *bdaddr)
1924 {
1925         struct sk_buff *skb;
1926         long ret;
1927
1928         skb = __hci_cmd_sync(hdev, 0xfc01, 6, bdaddr, HCI_INIT_TIMEOUT);
1929         if (IS_ERR(skb)) {
1930                 ret = PTR_ERR(skb);
1931                 BT_ERR("%s: BCM: Change address command failed (%ld)",
1932                        hdev->name, ret);
1933                 return ret;
1934         }
1935         kfree_skb(skb);
1936
1937         return 0;
1938 }
1939
1940 static int btusb_probe(struct usb_interface *intf,
1941                        const struct usb_device_id *id)
1942 {
1943         struct usb_endpoint_descriptor *ep_desc;
1944         struct btusb_data *data;
1945         struct hci_dev *hdev;
1946         int i, err;
1947
1948         BT_DBG("intf %p id %p", intf, id);
1949
1950         /* interface numbers are hardcoded in the spec */
1951         if (intf->cur_altsetting->desc.bInterfaceNumber != 0)
1952                 return -ENODEV;
1953
1954         if (!id->driver_info) {
1955                 const struct usb_device_id *match;
1956
1957                 match = usb_match_id(intf, blacklist_table);
1958                 if (match)
1959                         id = match;
1960         }
1961
1962         if (id->driver_info == BTUSB_IGNORE)
1963                 return -ENODEV;
1964
1965         if (id->driver_info & BTUSB_ATH3012) {
1966                 struct usb_device *udev = interface_to_usbdev(intf);
1967
1968                 /* Old firmware would otherwise let ath3k driver load
1969                  * patch and sysconfig files */
1970                 if (le16_to_cpu(udev->descriptor.bcdDevice) <= 0x0001)
1971                         return -ENODEV;
1972         }
1973
1974         data = devm_kzalloc(&intf->dev, sizeof(*data), GFP_KERNEL);
1975         if (!data)
1976                 return -ENOMEM;
1977
1978         for (i = 0; i < intf->cur_altsetting->desc.bNumEndpoints; i++) {
1979                 ep_desc = &intf->cur_altsetting->endpoint[i].desc;
1980
1981                 if (!data->intr_ep && usb_endpoint_is_int_in(ep_desc)) {
1982                         data->intr_ep = ep_desc;
1983                         continue;
1984                 }
1985
1986                 if (!data->bulk_tx_ep && usb_endpoint_is_bulk_out(ep_desc)) {
1987                         data->bulk_tx_ep = ep_desc;
1988                         continue;
1989                 }
1990
1991                 if (!data->bulk_rx_ep && usb_endpoint_is_bulk_in(ep_desc)) {
1992                         data->bulk_rx_ep = ep_desc;
1993                         continue;
1994                 }
1995         }
1996
1997         if (!data->intr_ep || !data->bulk_tx_ep || !data->bulk_rx_ep)
1998                 return -ENODEV;
1999
2000         data->cmdreq_type = USB_TYPE_CLASS;
2001
2002         data->udev = interface_to_usbdev(intf);
2003         data->intf = intf;
2004
2005         spin_lock_init(&data->lock);
2006
2007         INIT_WORK(&data->work, btusb_work);
2008         INIT_WORK(&data->waker, btusb_waker);
2009         init_usb_anchor(&data->deferred);
2010         init_usb_anchor(&data->tx_anchor);
2011         spin_lock_init(&data->txlock);
2012
2013         init_usb_anchor(&data->intr_anchor);
2014         init_usb_anchor(&data->bulk_anchor);
2015         init_usb_anchor(&data->isoc_anchor);
2016         spin_lock_init(&data->rxlock);
2017
2018         hdev = hci_alloc_dev();
2019         if (!hdev)
2020                 return -ENOMEM;
2021
2022         hdev->bus = HCI_USB;
2023         hci_set_drvdata(hdev, data);
2024
2025         data->hdev = hdev;
2026
2027         SET_HCIDEV_DEV(hdev, &intf->dev);
2028
2029         hdev->open   = btusb_open;
2030         hdev->close  = btusb_close;
2031         hdev->flush  = btusb_flush;
2032         hdev->send   = btusb_send_frame;
2033         hdev->notify = btusb_notify;
2034
2035         if (id->driver_info & BTUSB_BCM92035)
2036                 hdev->setup = btusb_setup_bcm92035;
2037
2038         if (id->driver_info & BTUSB_BCM_PATCHRAM) {
2039                 hdev->setup = btusb_setup_bcm_patchram;
2040                 hdev->set_bdaddr = btusb_set_bdaddr_bcm;
2041         }
2042
2043         if (id->driver_info & BTUSB_INTEL) {
2044                 hdev->setup = btusb_setup_intel;
2045                 hdev->set_bdaddr = btusb_set_bdaddr_intel;
2046         }
2047
2048         if (id->driver_info & BTUSB_MARVELL)
2049                 hdev->set_bdaddr = btusb_set_bdaddr_marvell;
2050
2051         if (id->driver_info & BTUSB_INTEL_BOOT)
2052                 set_bit(HCI_QUIRK_RAW_DEVICE, &hdev->quirks);
2053
2054         /* Interface numbers are hardcoded in the specification */
2055         data->isoc = usb_ifnum_to_if(data->udev, 1);
2056
2057         if (!reset)
2058                 set_bit(HCI_QUIRK_RESET_ON_CLOSE, &hdev->quirks);
2059
2060         if (force_scofix || id->driver_info & BTUSB_WRONG_SCO_MTU) {
2061                 if (!disable_scofix)
2062                         set_bit(HCI_QUIRK_FIXUP_BUFFER_SIZE, &hdev->quirks);
2063         }
2064
2065         if (id->driver_info & BTUSB_BROKEN_ISOC)
2066                 data->isoc = NULL;
2067
2068         if (id->driver_info & BTUSB_DIGIANSWER) {
2069                 data->cmdreq_type = USB_TYPE_VENDOR;
2070                 set_bit(HCI_QUIRK_RESET_ON_CLOSE, &hdev->quirks);
2071         }
2072
2073         if (id->driver_info & BTUSB_CSR) {
2074                 struct usb_device *udev = data->udev;
2075                 u16 bcdDevice = le16_to_cpu(udev->descriptor.bcdDevice);
2076
2077                 /* Old firmware would otherwise execute USB reset */
2078                 if (bcdDevice < 0x117)
2079                         set_bit(HCI_QUIRK_RESET_ON_CLOSE, &hdev->quirks);
2080
2081                 /* Fake CSR devices with broken commands */
2082                 if (bcdDevice <= 0x100)
2083                         hdev->setup = btusb_setup_csr;
2084         }
2085
2086         if (id->driver_info & BTUSB_SNIFFER) {
2087                 struct usb_device *udev = data->udev;
2088
2089                 /* New sniffer firmware has crippled HCI interface */
2090                 if (le16_to_cpu(udev->descriptor.bcdDevice) > 0x997)
2091                         set_bit(HCI_QUIRK_RAW_DEVICE, &hdev->quirks);
2092         }
2093
2094         if (id->driver_info & BTUSB_INTEL_BOOT) {
2095                 /* A bug in the bootloader causes that interrupt interface is
2096                  * only enabled after receiving SetInterface(0, AltSetting=0).
2097                  */
2098                 err = usb_set_interface(data->udev, 0, 0);
2099                 if (err < 0) {
2100                         BT_ERR("failed to set interface 0, alt 0 %d", err);
2101                         hci_free_dev(hdev);
2102                         return err;
2103                 }
2104         }
2105
2106         if (data->isoc) {
2107                 err = usb_driver_claim_interface(&btusb_driver,
2108                                                  data->isoc, data);
2109                 if (err < 0) {
2110                         hci_free_dev(hdev);
2111                         return err;
2112                 }
2113         }
2114
2115         err = hci_register_dev(hdev);
2116         if (err < 0) {
2117                 hci_free_dev(hdev);
2118                 return err;
2119         }
2120
2121         usb_set_intfdata(intf, data);
2122
2123         return 0;
2124 }
2125
2126 static void btusb_disconnect(struct usb_interface *intf)
2127 {
2128         struct btusb_data *data = usb_get_intfdata(intf);
2129         struct hci_dev *hdev;
2130
2131         BT_DBG("intf %p", intf);
2132
2133         if (!data)
2134                 return;
2135
2136         hdev = data->hdev;
2137         usb_set_intfdata(data->intf, NULL);
2138
2139         if (data->isoc)
2140                 usb_set_intfdata(data->isoc, NULL);
2141
2142         hci_unregister_dev(hdev);
2143
2144         if (intf == data->isoc)
2145                 usb_driver_release_interface(&btusb_driver, data->intf);
2146         else if (data->isoc)
2147                 usb_driver_release_interface(&btusb_driver, data->isoc);
2148
2149         btusb_free_frags(data);
2150         hci_free_dev(hdev);
2151 }
2152
2153 #ifdef CONFIG_PM
2154 static int btusb_suspend(struct usb_interface *intf, pm_message_t message)
2155 {
2156         struct btusb_data *data = usb_get_intfdata(intf);
2157
2158         BT_DBG("intf %p", intf);
2159
2160         if (data->suspend_count++)
2161                 return 0;
2162
2163         spin_lock_irq(&data->txlock);
2164         if (!(PMSG_IS_AUTO(message) && data->tx_in_flight)) {
2165                 set_bit(BTUSB_SUSPENDING, &data->flags);
2166                 spin_unlock_irq(&data->txlock);
2167         } else {
2168                 spin_unlock_irq(&data->txlock);
2169                 data->suspend_count--;
2170                 return -EBUSY;
2171         }
2172
2173         cancel_work_sync(&data->work);
2174
2175         btusb_stop_traffic(data);
2176         usb_kill_anchored_urbs(&data->tx_anchor);
2177
2178         return 0;
2179 }
2180
2181 static void play_deferred(struct btusb_data *data)
2182 {
2183         struct urb *urb;
2184         int err;
2185
2186         while ((urb = usb_get_from_anchor(&data->deferred))) {
2187                 err = usb_submit_urb(urb, GFP_ATOMIC);
2188                 if (err < 0)
2189                         break;
2190
2191                 data->tx_in_flight++;
2192         }
2193         usb_scuttle_anchored_urbs(&data->deferred);
2194 }
2195
2196 static int btusb_resume(struct usb_interface *intf)
2197 {
2198         struct btusb_data *data = usb_get_intfdata(intf);
2199         struct hci_dev *hdev = data->hdev;
2200         int err = 0;
2201
2202         BT_DBG("intf %p", intf);
2203
2204         if (--data->suspend_count)
2205                 return 0;
2206
2207         if (!test_bit(HCI_RUNNING, &hdev->flags))
2208                 goto done;
2209
2210         if (test_bit(BTUSB_INTR_RUNNING, &data->flags)) {
2211                 err = btusb_submit_intr_urb(hdev, GFP_NOIO);
2212                 if (err < 0) {
2213                         clear_bit(BTUSB_INTR_RUNNING, &data->flags);
2214                         goto failed;
2215                 }
2216         }
2217
2218         if (test_bit(BTUSB_BULK_RUNNING, &data->flags)) {
2219                 err = btusb_submit_bulk_urb(hdev, GFP_NOIO);
2220                 if (err < 0) {
2221                         clear_bit(BTUSB_BULK_RUNNING, &data->flags);
2222                         goto failed;
2223                 }
2224
2225                 btusb_submit_bulk_urb(hdev, GFP_NOIO);
2226         }
2227
2228         if (test_bit(BTUSB_ISOC_RUNNING, &data->flags)) {
2229                 if (btusb_submit_isoc_urb(hdev, GFP_NOIO) < 0)
2230                         clear_bit(BTUSB_ISOC_RUNNING, &data->flags);
2231                 else
2232                         btusb_submit_isoc_urb(hdev, GFP_NOIO);
2233         }
2234
2235         spin_lock_irq(&data->txlock);
2236         play_deferred(data);
2237         clear_bit(BTUSB_SUSPENDING, &data->flags);
2238         spin_unlock_irq(&data->txlock);
2239         schedule_work(&data->work);
2240
2241         return 0;
2242
2243 failed:
2244         usb_scuttle_anchored_urbs(&data->deferred);
2245 done:
2246         spin_lock_irq(&data->txlock);
2247         clear_bit(BTUSB_SUSPENDING, &data->flags);
2248         spin_unlock_irq(&data->txlock);
2249
2250         return err;
2251 }
2252 #endif
2253
2254 static struct usb_driver btusb_driver = {
2255         .name           = "btusb",
2256         .probe          = btusb_probe,
2257         .disconnect     = btusb_disconnect,
2258 #ifdef CONFIG_PM
2259         .suspend        = btusb_suspend,
2260         .resume         = btusb_resume,
2261 #endif
2262         .id_table       = btusb_table,
2263         .supports_autosuspend = 1,
2264         .disable_hub_initiated_lpm = 1,
2265 };
2266
2267 module_usb_driver(btusb_driver);
2268
2269 module_param(disable_scofix, bool, 0644);
2270 MODULE_PARM_DESC(disable_scofix, "Disable fixup of wrong SCO buffer size");
2271
2272 module_param(force_scofix, bool, 0644);
2273 MODULE_PARM_DESC(force_scofix, "Force fixup of wrong SCO buffers size");
2274
2275 module_param(reset, bool, 0644);
2276 MODULE_PARM_DESC(reset, "Send HCI reset command on initialization");
2277
2278 MODULE_AUTHOR("Marcel Holtmann <marcel@holtmann.org>");
2279 MODULE_DESCRIPTION("Generic Bluetooth USB driver ver " VERSION);
2280 MODULE_VERSION(VERSION);
2281 MODULE_LICENSE("GPL");