1 // SPDX-License-Identifier: GPL-2.0-or-later 2 /* 3 * 4 * Generic Bluetooth USB driver 5 * 6 * Copyright (C) 2005-2008 Marcel Holtmann <marcel@holtmann.org> 7 */ 8 9 #include <linux/dmi.h> 10 #include <linux/module.h> 11 #include <linux/usb.h> 12 #include <linux/usb/quirks.h> 13 #include <linux/firmware.h> 14 #include <linux/iopoll.h> 15 #include <linux/of_device.h> 16 #include <linux/of_irq.h> 17 #include <linux/suspend.h> 18 #include <linux/gpio/consumer.h> 19 #include <linux/debugfs.h> 20 #include <asm/unaligned.h> 21 22 #include <net/bluetooth/bluetooth.h> 23 #include <net/bluetooth/hci_core.h> 24 25 #include "btintel.h" 26 #include "btbcm.h" 27 #include "btrtl.h" 28 #include "btmtk.h" 29 30 #define VERSION "0.8" 31 32 static bool disable_scofix; 33 static bool force_scofix; 34 static bool enable_autosuspend = IS_ENABLED(CONFIG_BT_HCIBTUSB_AUTOSUSPEND); 35 static bool reset = true; 36 37 static struct usb_driver btusb_driver; 38 39 #define BTUSB_IGNORE BIT(0) 40 #define BTUSB_DIGIANSWER BIT(1) 41 #define BTUSB_CSR BIT(2) 42 #define BTUSB_SNIFFER BIT(3) 43 #define BTUSB_BCM92035 BIT(4) 44 #define BTUSB_BROKEN_ISOC BIT(5) 45 #define BTUSB_WRONG_SCO_MTU BIT(6) 46 #define BTUSB_ATH3012 BIT(7) 47 #define BTUSB_INTEL_COMBINED BIT(8) 48 #define BTUSB_INTEL_BOOT BIT(9) 49 #define BTUSB_BCM_PATCHRAM BIT(10) 50 #define BTUSB_MARVELL BIT(11) 51 #define BTUSB_SWAVE BIT(12) 52 #define BTUSB_AMP BIT(13) 53 #define BTUSB_QCA_ROME BIT(14) 54 #define BTUSB_BCM_APPLE BIT(15) 55 #define BTUSB_REALTEK BIT(16) 56 #define BTUSB_BCM2045 BIT(17) 57 #define BTUSB_IFNUM_2 BIT(18) 58 #define BTUSB_CW6622 BIT(19) 59 #define BTUSB_MEDIATEK BIT(20) 60 #define BTUSB_WIDEBAND_SPEECH BIT(21) 61 #define BTUSB_VALID_LE_STATES BIT(22) 62 #define BTUSB_QCA_WCN6855 BIT(23) 63 #define BTUSB_INTEL_BROKEN_SHUTDOWN_LED BIT(24) 64 #define BTUSB_INTEL_BROKEN_INITIAL_NCMD BIT(25) 65 #define BTUSB_INTEL_NO_WBS_SUPPORT BIT(26) 66 67 static const struct usb_device_id btusb_table[] = { 68 /* Generic Bluetooth USB device */ 69 { USB_DEVICE_INFO(0xe0, 0x01, 0x01) }, 70 71 /* Generic Bluetooth AMP device */ 72 { USB_DEVICE_INFO(0xe0, 0x01, 0x04), .driver_info = BTUSB_AMP }, 73 74 /* Generic Bluetooth USB interface */ 75 { USB_INTERFACE_INFO(0xe0, 0x01, 0x01) }, 76 77 /* Apple-specific (Broadcom) devices */ 78 { USB_VENDOR_AND_INTERFACE_INFO(0x05ac, 0xff, 0x01, 0x01), 79 .driver_info = BTUSB_BCM_APPLE | BTUSB_IFNUM_2 }, 80 81 /* MediaTek MT76x0E */ 82 { USB_DEVICE(0x0e8d, 0x763f) }, 83 84 /* Broadcom SoftSailing reporting vendor specific */ 85 { USB_DEVICE(0x0a5c, 0x21e1) }, 86 87 /* Apple MacBookPro 7,1 */ 88 { USB_DEVICE(0x05ac, 0x8213) }, 89 90 /* Apple iMac11,1 */ 91 { USB_DEVICE(0x05ac, 0x8215) }, 92 93 /* Apple MacBookPro6,2 */ 94 { USB_DEVICE(0x05ac, 0x8218) }, 95 96 /* Apple MacBookAir3,1, MacBookAir3,2 */ 97 { USB_DEVICE(0x05ac, 0x821b) }, 98 99 /* Apple MacBookAir4,1 */ 100 { USB_DEVICE(0x05ac, 0x821f) }, 101 102 /* Apple MacBookPro8,2 */ 103 { USB_DEVICE(0x05ac, 0x821a) }, 104 105 /* Apple MacMini5,1 */ 106 { USB_DEVICE(0x05ac, 0x8281) }, 107 108 /* AVM BlueFRITZ! USB v2.0 */ 109 { USB_DEVICE(0x057c, 0x3800), .driver_info = BTUSB_SWAVE }, 110 111 /* Bluetooth Ultraport Module from IBM */ 112 { USB_DEVICE(0x04bf, 0x030a) }, 113 114 /* ALPS Modules with non-standard id */ 115 { USB_DEVICE(0x044e, 0x3001) }, 116 { USB_DEVICE(0x044e, 0x3002) }, 117 118 /* Ericsson with non-standard id */ 119 { USB_DEVICE(0x0bdb, 0x1002) }, 120 121 /* Canyon CN-BTU1 with HID interfaces */ 122 { USB_DEVICE(0x0c10, 0x0000) }, 123 124 /* Broadcom BCM20702B0 (Dynex/Insignia) */ 125 { USB_DEVICE(0x19ff, 0x0239), .driver_info = BTUSB_BCM_PATCHRAM }, 126 127 /* Broadcom BCM43142A0 (Foxconn/Lenovo) */ 128 { USB_VENDOR_AND_INTERFACE_INFO(0x105b, 0xff, 0x01, 0x01), 129 .driver_info = BTUSB_BCM_PATCHRAM }, 130 131 /* Broadcom BCM920703 (HTC Vive) */ 132 { USB_VENDOR_AND_INTERFACE_INFO(0x0bb4, 0xff, 0x01, 0x01), 133 .driver_info = BTUSB_BCM_PATCHRAM }, 134 135 /* Foxconn - Hon Hai */ 136 { USB_VENDOR_AND_INTERFACE_INFO(0x0489, 0xff, 0x01, 0x01), 137 .driver_info = BTUSB_BCM_PATCHRAM }, 138 139 /* Lite-On Technology - Broadcom based */ 140 { USB_VENDOR_AND_INTERFACE_INFO(0x04ca, 0xff, 0x01, 0x01), 141 .driver_info = BTUSB_BCM_PATCHRAM }, 142 143 /* Broadcom devices with vendor specific id */ 144 { USB_VENDOR_AND_INTERFACE_INFO(0x0a5c, 0xff, 0x01, 0x01), 145 .driver_info = BTUSB_BCM_PATCHRAM }, 146 147 /* ASUSTek Computer - Broadcom based */ 148 { USB_VENDOR_AND_INTERFACE_INFO(0x0b05, 0xff, 0x01, 0x01), 149 .driver_info = BTUSB_BCM_PATCHRAM }, 150 151 /* Belkin F8065bf - Broadcom based */ 152 { USB_VENDOR_AND_INTERFACE_INFO(0x050d, 0xff, 0x01, 0x01), 153 .driver_info = BTUSB_BCM_PATCHRAM }, 154 155 /* IMC Networks - Broadcom based */ 156 { USB_VENDOR_AND_INTERFACE_INFO(0x13d3, 0xff, 0x01, 0x01), 157 .driver_info = BTUSB_BCM_PATCHRAM }, 158 159 /* Dell Computer - Broadcom based */ 160 { USB_VENDOR_AND_INTERFACE_INFO(0x413c, 0xff, 0x01, 0x01), 161 .driver_info = BTUSB_BCM_PATCHRAM }, 162 163 /* Toshiba Corp - Broadcom based */ 164 { USB_VENDOR_AND_INTERFACE_INFO(0x0930, 0xff, 0x01, 0x01), 165 .driver_info = BTUSB_BCM_PATCHRAM }, 166 167 /* Intel Bluetooth USB Bootloader (RAM module) */ 168 { USB_DEVICE(0x8087, 0x0a5a), 169 .driver_info = BTUSB_INTEL_BOOT | BTUSB_BROKEN_ISOC }, 170 171 { } /* Terminating entry */ 172 }; 173 174 MODULE_DEVICE_TABLE(usb, btusb_table); 175 176 static const struct usb_device_id blacklist_table[] = { 177 /* CSR BlueCore devices */ 178 { USB_DEVICE(0x0a12, 0x0001), .driver_info = BTUSB_CSR }, 179 180 /* Broadcom BCM2033 without firmware */ 181 { USB_DEVICE(0x0a5c, 0x2033), .driver_info = BTUSB_IGNORE }, 182 183 /* Broadcom BCM2045 devices */ 184 { USB_DEVICE(0x0a5c, 0x2045), .driver_info = BTUSB_BCM2045 }, 185 186 /* Atheros 3011 with sflash firmware */ 187 { USB_DEVICE(0x0489, 0xe027), .driver_info = BTUSB_IGNORE }, 188 { USB_DEVICE(0x0489, 0xe03d), .driver_info = BTUSB_IGNORE }, 189 { USB_DEVICE(0x04f2, 0xaff1), .driver_info = BTUSB_IGNORE }, 190 { USB_DEVICE(0x0930, 0x0215), .driver_info = BTUSB_IGNORE }, 191 { USB_DEVICE(0x0cf3, 0x3002), .driver_info = BTUSB_IGNORE }, 192 { USB_DEVICE(0x0cf3, 0xe019), .driver_info = BTUSB_IGNORE }, 193 { USB_DEVICE(0x13d3, 0x3304), .driver_info = BTUSB_IGNORE }, 194 195 /* Atheros AR9285 Malbec with sflash firmware */ 196 { USB_DEVICE(0x03f0, 0x311d), .driver_info = BTUSB_IGNORE }, 197 198 /* Atheros 3012 with sflash firmware */ 199 { USB_DEVICE(0x0489, 0xe04d), .driver_info = BTUSB_ATH3012 }, 200 { USB_DEVICE(0x0489, 0xe04e), .driver_info = BTUSB_ATH3012 }, 201 { USB_DEVICE(0x0489, 0xe056), .driver_info = BTUSB_ATH3012 }, 202 { USB_DEVICE(0x0489, 0xe057), .driver_info = BTUSB_ATH3012 }, 203 { USB_DEVICE(0x0489, 0xe05f), .driver_info = BTUSB_ATH3012 }, 204 { USB_DEVICE(0x0489, 0xe076), .driver_info = BTUSB_ATH3012 }, 205 { USB_DEVICE(0x0489, 0xe078), .driver_info = BTUSB_ATH3012 }, 206 { USB_DEVICE(0x0489, 0xe095), .driver_info = BTUSB_ATH3012 }, 207 { USB_DEVICE(0x04c5, 0x1330), .driver_info = BTUSB_ATH3012 }, 208 { USB_DEVICE(0x04ca, 0x3004), .driver_info = BTUSB_ATH3012 }, 209 { USB_DEVICE(0x04ca, 0x3005), .driver_info = BTUSB_ATH3012 }, 210 { USB_DEVICE(0x04ca, 0x3006), .driver_info = BTUSB_ATH3012 }, 211 { USB_DEVICE(0x04ca, 0x3007), .driver_info = BTUSB_ATH3012 }, 212 { USB_DEVICE(0x04ca, 0x3008), .driver_info = BTUSB_ATH3012 }, 213 { USB_DEVICE(0x04ca, 0x300b), .driver_info = BTUSB_ATH3012 }, 214 { USB_DEVICE(0x04ca, 0x300d), .driver_info = BTUSB_ATH3012 }, 215 { USB_DEVICE(0x04ca, 0x300f), .driver_info = BTUSB_ATH3012 }, 216 { USB_DEVICE(0x04ca, 0x3010), .driver_info = BTUSB_ATH3012 }, 217 { USB_DEVICE(0x04ca, 0x3014), .driver_info = BTUSB_ATH3012 }, 218 { USB_DEVICE(0x04ca, 0x3018), .driver_info = BTUSB_ATH3012 }, 219 { USB_DEVICE(0x0930, 0x0219), .driver_info = BTUSB_ATH3012 }, 220 { USB_DEVICE(0x0930, 0x021c), .driver_info = BTUSB_ATH3012 }, 221 { USB_DEVICE(0x0930, 0x0220), .driver_info = BTUSB_ATH3012 }, 222 { USB_DEVICE(0x0930, 0x0227), .driver_info = BTUSB_ATH3012 }, 223 { USB_DEVICE(0x0b05, 0x17d0), .driver_info = BTUSB_ATH3012 }, 224 { USB_DEVICE(0x0cf3, 0x0036), .driver_info = BTUSB_ATH3012 }, 225 { USB_DEVICE(0x0cf3, 0x3004), .driver_info = BTUSB_ATH3012 }, 226 { USB_DEVICE(0x0cf3, 0x3008), .driver_info = BTUSB_ATH3012 }, 227 { USB_DEVICE(0x0cf3, 0x311d), .driver_info = BTUSB_ATH3012 }, 228 { USB_DEVICE(0x0cf3, 0x311e), .driver_info = BTUSB_ATH3012 }, 229 { USB_DEVICE(0x0cf3, 0x311f), .driver_info = BTUSB_ATH3012 }, 230 { USB_DEVICE(0x0cf3, 0x3121), .driver_info = BTUSB_ATH3012 }, 231 { USB_DEVICE(0x0cf3, 0x817a), .driver_info = BTUSB_ATH3012 }, 232 { USB_DEVICE(0x0cf3, 0x817b), .driver_info = BTUSB_ATH3012 }, 233 { USB_DEVICE(0x0cf3, 0xe003), .driver_info = BTUSB_ATH3012 }, 234 { USB_DEVICE(0x0cf3, 0xe004), .driver_info = BTUSB_ATH3012 }, 235 { USB_DEVICE(0x0cf3, 0xe005), .driver_info = BTUSB_ATH3012 }, 236 { USB_DEVICE(0x0cf3, 0xe006), .driver_info = BTUSB_ATH3012 }, 237 { USB_DEVICE(0x13d3, 0x3362), .driver_info = BTUSB_ATH3012 }, 238 { USB_DEVICE(0x13d3, 0x3375), .driver_info = BTUSB_ATH3012 }, 239 { USB_DEVICE(0x13d3, 0x3393), .driver_info = BTUSB_ATH3012 }, 240 { USB_DEVICE(0x13d3, 0x3395), .driver_info = BTUSB_ATH3012 }, 241 { USB_DEVICE(0x13d3, 0x3402), .driver_info = BTUSB_ATH3012 }, 242 { USB_DEVICE(0x13d3, 0x3408), .driver_info = BTUSB_ATH3012 }, 243 { USB_DEVICE(0x13d3, 0x3423), .driver_info = BTUSB_ATH3012 }, 244 { USB_DEVICE(0x13d3, 0x3432), .driver_info = BTUSB_ATH3012 }, 245 { USB_DEVICE(0x13d3, 0x3472), .driver_info = BTUSB_ATH3012 }, 246 { USB_DEVICE(0x13d3, 0x3474), .driver_info = BTUSB_ATH3012 }, 247 { USB_DEVICE(0x13d3, 0x3487), .driver_info = BTUSB_ATH3012 }, 248 { USB_DEVICE(0x13d3, 0x3490), .driver_info = BTUSB_ATH3012 }, 249 250 /* Atheros AR5BBU12 with sflash firmware */ 251 { USB_DEVICE(0x0489, 0xe02c), .driver_info = BTUSB_IGNORE }, 252 253 /* Atheros AR5BBU12 with sflash firmware */ 254 { USB_DEVICE(0x0489, 0xe036), .driver_info = BTUSB_ATH3012 }, 255 { USB_DEVICE(0x0489, 0xe03c), .driver_info = BTUSB_ATH3012 }, 256 257 /* QCA ROME chipset */ 258 { USB_DEVICE(0x0cf3, 0x535b), .driver_info = BTUSB_QCA_ROME | 259 BTUSB_WIDEBAND_SPEECH }, 260 { USB_DEVICE(0x0cf3, 0xe007), .driver_info = BTUSB_QCA_ROME | 261 BTUSB_WIDEBAND_SPEECH }, 262 { USB_DEVICE(0x0cf3, 0xe009), .driver_info = BTUSB_QCA_ROME | 263 BTUSB_WIDEBAND_SPEECH }, 264 { USB_DEVICE(0x0cf3, 0xe010), .driver_info = BTUSB_QCA_ROME | 265 BTUSB_WIDEBAND_SPEECH }, 266 { USB_DEVICE(0x0cf3, 0xe300), .driver_info = BTUSB_QCA_ROME | 267 BTUSB_WIDEBAND_SPEECH }, 268 { USB_DEVICE(0x0cf3, 0xe301), .driver_info = BTUSB_QCA_ROME | 269 BTUSB_WIDEBAND_SPEECH }, 270 { USB_DEVICE(0x0cf3, 0xe360), .driver_info = BTUSB_QCA_ROME | 271 BTUSB_WIDEBAND_SPEECH }, 272 { USB_DEVICE(0x0cf3, 0xe500), .driver_info = BTUSB_QCA_ROME | 273 BTUSB_WIDEBAND_SPEECH }, 274 { USB_DEVICE(0x0489, 0xe092), .driver_info = BTUSB_QCA_ROME | 275 BTUSB_WIDEBAND_SPEECH }, 276 { USB_DEVICE(0x0489, 0xe09f), .driver_info = BTUSB_QCA_ROME | 277 BTUSB_WIDEBAND_SPEECH }, 278 { USB_DEVICE(0x0489, 0xe0a2), .driver_info = BTUSB_QCA_ROME | 279 BTUSB_WIDEBAND_SPEECH }, 280 { USB_DEVICE(0x04ca, 0x3011), .driver_info = BTUSB_QCA_ROME | 281 BTUSB_WIDEBAND_SPEECH }, 282 { USB_DEVICE(0x04ca, 0x3015), .driver_info = BTUSB_QCA_ROME | 283 BTUSB_WIDEBAND_SPEECH }, 284 { USB_DEVICE(0x04ca, 0x3016), .driver_info = BTUSB_QCA_ROME | 285 BTUSB_WIDEBAND_SPEECH }, 286 { USB_DEVICE(0x04ca, 0x301a), .driver_info = BTUSB_QCA_ROME | 287 BTUSB_WIDEBAND_SPEECH }, 288 { USB_DEVICE(0x04ca, 0x3021), .driver_info = BTUSB_QCA_ROME | 289 BTUSB_WIDEBAND_SPEECH }, 290 { USB_DEVICE(0x13d3, 0x3491), .driver_info = BTUSB_QCA_ROME | 291 BTUSB_WIDEBAND_SPEECH }, 292 { USB_DEVICE(0x13d3, 0x3496), .driver_info = BTUSB_QCA_ROME | 293 BTUSB_WIDEBAND_SPEECH }, 294 { USB_DEVICE(0x13d3, 0x3501), .driver_info = BTUSB_QCA_ROME | 295 BTUSB_WIDEBAND_SPEECH }, 296 297 /* QCA WCN6855 chipset */ 298 { USB_DEVICE(0x0cf3, 0xe600), .driver_info = BTUSB_QCA_WCN6855 | 299 BTUSB_WIDEBAND_SPEECH | 300 BTUSB_VALID_LE_STATES }, 301 { USB_DEVICE(0x0489, 0xe0cc), .driver_info = BTUSB_QCA_WCN6855 | 302 BTUSB_WIDEBAND_SPEECH | 303 BTUSB_VALID_LE_STATES }, 304 { USB_DEVICE(0x0489, 0xe0d6), .driver_info = BTUSB_QCA_WCN6855 | 305 BTUSB_WIDEBAND_SPEECH | 306 BTUSB_VALID_LE_STATES }, 307 { USB_DEVICE(0x0489, 0xe0e3), .driver_info = BTUSB_QCA_WCN6855 | 308 BTUSB_WIDEBAND_SPEECH | 309 BTUSB_VALID_LE_STATES }, 310 { USB_DEVICE(0x10ab, 0x9309), .driver_info = BTUSB_QCA_WCN6855 | 311 BTUSB_WIDEBAND_SPEECH | 312 BTUSB_VALID_LE_STATES }, 313 { USB_DEVICE(0x10ab, 0x9409), .driver_info = BTUSB_QCA_WCN6855 | 314 BTUSB_WIDEBAND_SPEECH | 315 BTUSB_VALID_LE_STATES }, 316 { USB_DEVICE(0x0489, 0xe0d0), .driver_info = BTUSB_QCA_WCN6855 | 317 BTUSB_WIDEBAND_SPEECH | 318 BTUSB_VALID_LE_STATES }, 319 320 /* QCA WCN785x chipset */ 321 { USB_DEVICE(0x0cf3, 0xe700), .driver_info = BTUSB_QCA_WCN6855 | 322 BTUSB_WIDEBAND_SPEECH | 323 BTUSB_VALID_LE_STATES }, 324 325 /* Broadcom BCM2035 */ 326 { USB_DEVICE(0x0a5c, 0x2009), .driver_info = BTUSB_BCM92035 }, 327 { USB_DEVICE(0x0a5c, 0x200a), .driver_info = BTUSB_WRONG_SCO_MTU }, 328 { USB_DEVICE(0x0a5c, 0x2035), .driver_info = BTUSB_WRONG_SCO_MTU }, 329 330 /* Broadcom BCM2045 */ 331 { USB_DEVICE(0x0a5c, 0x2039), .driver_info = BTUSB_WRONG_SCO_MTU }, 332 { USB_DEVICE(0x0a5c, 0x2101), .driver_info = BTUSB_WRONG_SCO_MTU }, 333 334 /* IBM/Lenovo ThinkPad with Broadcom chip */ 335 { USB_DEVICE(0x0a5c, 0x201e), .driver_info = BTUSB_WRONG_SCO_MTU }, 336 { USB_DEVICE(0x0a5c, 0x2110), .driver_info = BTUSB_WRONG_SCO_MTU }, 337 338 /* HP laptop with Broadcom chip */ 339 { USB_DEVICE(0x03f0, 0x171d), .driver_info = BTUSB_WRONG_SCO_MTU }, 340 341 /* Dell laptop with Broadcom chip */ 342 { USB_DEVICE(0x413c, 0x8126), .driver_info = BTUSB_WRONG_SCO_MTU }, 343 344 /* Dell Wireless 370 and 410 devices */ 345 { USB_DEVICE(0x413c, 0x8152), .driver_info = BTUSB_WRONG_SCO_MTU }, 346 { USB_DEVICE(0x413c, 0x8156), .driver_info = BTUSB_WRONG_SCO_MTU }, 347 348 /* Belkin F8T012 and F8T013 devices */ 349 { USB_DEVICE(0x050d, 0x0012), .driver_info = BTUSB_WRONG_SCO_MTU }, 350 { USB_DEVICE(0x050d, 0x0013), .driver_info = BTUSB_WRONG_SCO_MTU }, 351 352 /* Asus WL-BTD202 device */ 353 { USB_DEVICE(0x0b05, 0x1715), .driver_info = BTUSB_WRONG_SCO_MTU }, 354 355 /* Kensington Bluetooth USB adapter */ 356 { USB_DEVICE(0x047d, 0x105e), .driver_info = BTUSB_WRONG_SCO_MTU }, 357 358 /* RTX Telecom based adapters with buggy SCO support */ 359 { USB_DEVICE(0x0400, 0x0807), .driver_info = BTUSB_BROKEN_ISOC }, 360 { USB_DEVICE(0x0400, 0x080a), .driver_info = BTUSB_BROKEN_ISOC }, 361 362 /* CONWISE Technology based adapters with buggy SCO support */ 363 { USB_DEVICE(0x0e5e, 0x6622), 364 .driver_info = BTUSB_BROKEN_ISOC | BTUSB_CW6622}, 365 366 /* Roper Class 1 Bluetooth Dongle (Silicon Wave based) */ 367 { USB_DEVICE(0x1310, 0x0001), .driver_info = BTUSB_SWAVE }, 368 369 /* Digianswer devices */ 370 { USB_DEVICE(0x08fd, 0x0001), .driver_info = BTUSB_DIGIANSWER }, 371 { USB_DEVICE(0x08fd, 0x0002), .driver_info = BTUSB_IGNORE }, 372 373 /* CSR BlueCore Bluetooth Sniffer */ 374 { USB_DEVICE(0x0a12, 0x0002), 375 .driver_info = BTUSB_SNIFFER | BTUSB_BROKEN_ISOC }, 376 377 /* Frontline ComProbe Bluetooth Sniffer */ 378 { USB_DEVICE(0x16d3, 0x0002), 379 .driver_info = BTUSB_SNIFFER | BTUSB_BROKEN_ISOC }, 380 381 /* Marvell Bluetooth devices */ 382 { USB_DEVICE(0x1286, 0x2044), .driver_info = BTUSB_MARVELL }, 383 { USB_DEVICE(0x1286, 0x2046), .driver_info = BTUSB_MARVELL }, 384 { USB_DEVICE(0x1286, 0x204e), .driver_info = BTUSB_MARVELL }, 385 386 /* Intel Bluetooth devices */ 387 { USB_DEVICE(0x8087, 0x0025), .driver_info = BTUSB_INTEL_COMBINED }, 388 { USB_DEVICE(0x8087, 0x0026), .driver_info = BTUSB_INTEL_COMBINED }, 389 { USB_DEVICE(0x8087, 0x0029), .driver_info = BTUSB_INTEL_COMBINED }, 390 { USB_DEVICE(0x8087, 0x0032), .driver_info = BTUSB_INTEL_COMBINED }, 391 { USB_DEVICE(0x8087, 0x0033), .driver_info = BTUSB_INTEL_COMBINED }, 392 { USB_DEVICE(0x8087, 0x0035), .driver_info = BTUSB_INTEL_COMBINED }, 393 { USB_DEVICE(0x8087, 0x07da), .driver_info = BTUSB_CSR }, 394 { USB_DEVICE(0x8087, 0x07dc), .driver_info = BTUSB_INTEL_COMBINED | 395 BTUSB_INTEL_NO_WBS_SUPPORT | 396 BTUSB_INTEL_BROKEN_INITIAL_NCMD | 397 BTUSB_INTEL_BROKEN_SHUTDOWN_LED }, 398 { USB_DEVICE(0x8087, 0x0a2a), .driver_info = BTUSB_INTEL_COMBINED | 399 BTUSB_INTEL_NO_WBS_SUPPORT | 400 BTUSB_INTEL_BROKEN_SHUTDOWN_LED }, 401 { USB_DEVICE(0x8087, 0x0a2b), .driver_info = BTUSB_INTEL_COMBINED }, 402 { USB_DEVICE(0x8087, 0x0aa7), .driver_info = BTUSB_INTEL_COMBINED | 403 BTUSB_INTEL_BROKEN_SHUTDOWN_LED }, 404 { USB_DEVICE(0x8087, 0x0aaa), .driver_info = BTUSB_INTEL_COMBINED }, 405 406 /* Other Intel Bluetooth devices */ 407 { USB_VENDOR_AND_INTERFACE_INFO(0x8087, 0xe0, 0x01, 0x01), 408 .driver_info = BTUSB_IGNORE }, 409 410 /* Realtek 8822CE Bluetooth devices */ 411 { USB_DEVICE(0x0bda, 0xb00c), .driver_info = BTUSB_REALTEK | 412 BTUSB_WIDEBAND_SPEECH }, 413 { USB_DEVICE(0x0bda, 0xc822), .driver_info = BTUSB_REALTEK | 414 BTUSB_WIDEBAND_SPEECH }, 415 416 /* Realtek 8852AE Bluetooth devices */ 417 { USB_DEVICE(0x0bda, 0x2852), .driver_info = BTUSB_REALTEK | 418 BTUSB_WIDEBAND_SPEECH }, 419 { USB_DEVICE(0x0bda, 0xc852), .driver_info = BTUSB_REALTEK | 420 BTUSB_WIDEBAND_SPEECH }, 421 { USB_DEVICE(0x0bda, 0x385a), .driver_info = BTUSB_REALTEK | 422 BTUSB_WIDEBAND_SPEECH }, 423 { USB_DEVICE(0x0bda, 0x4852), .driver_info = BTUSB_REALTEK | 424 BTUSB_WIDEBAND_SPEECH }, 425 { USB_DEVICE(0x04c5, 0x165c), .driver_info = BTUSB_REALTEK | 426 BTUSB_WIDEBAND_SPEECH }, 427 { USB_DEVICE(0x04ca, 0x4006), .driver_info = BTUSB_REALTEK | 428 BTUSB_WIDEBAND_SPEECH }, 429 430 /* Realtek 8852CE Bluetooth devices */ 431 { USB_DEVICE(0x04ca, 0x4007), .driver_info = BTUSB_REALTEK | 432 BTUSB_WIDEBAND_SPEECH }, 433 { USB_DEVICE(0x04c5, 0x1675), .driver_info = BTUSB_REALTEK | 434 BTUSB_WIDEBAND_SPEECH }, 435 { USB_DEVICE(0x0cb8, 0xc558), .driver_info = BTUSB_REALTEK | 436 BTUSB_WIDEBAND_SPEECH }, 437 { USB_DEVICE(0x13d3, 0x3587), .driver_info = BTUSB_REALTEK | 438 BTUSB_WIDEBAND_SPEECH }, 439 { USB_DEVICE(0x13d3, 0x3586), .driver_info = BTUSB_REALTEK | 440 BTUSB_WIDEBAND_SPEECH }, 441 442 /* Realtek Bluetooth devices */ 443 { USB_VENDOR_AND_INTERFACE_INFO(0x0bda, 0xe0, 0x01, 0x01), 444 .driver_info = BTUSB_REALTEK }, 445 446 /* MediaTek Bluetooth devices */ 447 { USB_VENDOR_AND_INTERFACE_INFO(0x0e8d, 0xe0, 0x01, 0x01), 448 .driver_info = BTUSB_MEDIATEK | 449 BTUSB_WIDEBAND_SPEECH | 450 BTUSB_VALID_LE_STATES }, 451 452 /* Additional MediaTek MT7615E Bluetooth devices */ 453 { USB_DEVICE(0x13d3, 0x3560), .driver_info = BTUSB_MEDIATEK}, 454 455 /* Additional MediaTek MT7663 Bluetooth devices */ 456 { USB_DEVICE(0x043e, 0x310c), .driver_info = BTUSB_MEDIATEK | 457 BTUSB_WIDEBAND_SPEECH | 458 BTUSB_VALID_LE_STATES }, 459 460 /* Additional MediaTek MT7668 Bluetooth devices */ 461 { USB_DEVICE(0x043e, 0x3109), .driver_info = BTUSB_MEDIATEK | 462 BTUSB_WIDEBAND_SPEECH | 463 BTUSB_VALID_LE_STATES }, 464 465 /* Additional MediaTek MT7921 Bluetooth devices */ 466 { USB_DEVICE(0x0489, 0xe0c8), .driver_info = BTUSB_MEDIATEK | 467 BTUSB_WIDEBAND_SPEECH | 468 BTUSB_VALID_LE_STATES }, 469 { USB_DEVICE(0x04ca, 0x3802), .driver_info = BTUSB_MEDIATEK | 470 BTUSB_WIDEBAND_SPEECH | 471 BTUSB_VALID_LE_STATES }, 472 { USB_DEVICE(0x13d3, 0x3563), .driver_info = BTUSB_MEDIATEK | 473 BTUSB_WIDEBAND_SPEECH | 474 BTUSB_VALID_LE_STATES }, 475 { USB_DEVICE(0x13d3, 0x3564), .driver_info = BTUSB_MEDIATEK | 476 BTUSB_WIDEBAND_SPEECH | 477 BTUSB_VALID_LE_STATES }, 478 { USB_DEVICE(0x13d3, 0x3567), .driver_info = BTUSB_MEDIATEK | 479 BTUSB_WIDEBAND_SPEECH | 480 BTUSB_VALID_LE_STATES }, 481 { USB_DEVICE(0x0489, 0xe0cd), .driver_info = BTUSB_MEDIATEK | 482 BTUSB_WIDEBAND_SPEECH | 483 BTUSB_VALID_LE_STATES }, 484 485 /* MediaTek MT7922A Bluetooth devices */ 486 { USB_DEVICE(0x0489, 0xe0d8), .driver_info = BTUSB_MEDIATEK | 487 BTUSB_WIDEBAND_SPEECH | 488 BTUSB_VALID_LE_STATES }, 489 { USB_DEVICE(0x0489, 0xe0d9), .driver_info = BTUSB_MEDIATEK | 490 BTUSB_WIDEBAND_SPEECH | 491 BTUSB_VALID_LE_STATES }, 492 { USB_DEVICE(0x13d3, 0x3568), .driver_info = BTUSB_MEDIATEK | 493 BTUSB_WIDEBAND_SPEECH | 494 BTUSB_VALID_LE_STATES }, 495 { USB_DEVICE(0x0489, 0xe0e2), .driver_info = BTUSB_MEDIATEK | 496 BTUSB_WIDEBAND_SPEECH | 497 BTUSB_VALID_LE_STATES }, 498 499 /* Additional Realtek 8723AE Bluetooth devices */ 500 { USB_DEVICE(0x0930, 0x021d), .driver_info = BTUSB_REALTEK }, 501 { USB_DEVICE(0x13d3, 0x3394), .driver_info = BTUSB_REALTEK }, 502 503 /* Additional Realtek 8723BE Bluetooth devices */ 504 { USB_DEVICE(0x0489, 0xe085), .driver_info = BTUSB_REALTEK }, 505 { USB_DEVICE(0x0489, 0xe08b), .driver_info = BTUSB_REALTEK }, 506 { USB_DEVICE(0x04f2, 0xb49f), .driver_info = BTUSB_REALTEK }, 507 { USB_DEVICE(0x13d3, 0x3410), .driver_info = BTUSB_REALTEK }, 508 { USB_DEVICE(0x13d3, 0x3416), .driver_info = BTUSB_REALTEK }, 509 { USB_DEVICE(0x13d3, 0x3459), .driver_info = BTUSB_REALTEK }, 510 { USB_DEVICE(0x13d3, 0x3494), .driver_info = BTUSB_REALTEK }, 511 512 /* Additional Realtek 8723BU Bluetooth devices */ 513 { USB_DEVICE(0x7392, 0xa611), .driver_info = BTUSB_REALTEK }, 514 515 /* Additional Realtek 8723DE Bluetooth devices */ 516 { USB_DEVICE(0x0bda, 0xb009), .driver_info = BTUSB_REALTEK }, 517 { USB_DEVICE(0x2ff8, 0xb011), .driver_info = BTUSB_REALTEK }, 518 519 /* Additional Realtek 8761B Bluetooth devices */ 520 { USB_DEVICE(0x2357, 0x0604), .driver_info = BTUSB_REALTEK | 521 BTUSB_WIDEBAND_SPEECH }, 522 523 /* Additional Realtek 8761BU Bluetooth devices */ 524 { USB_DEVICE(0x0b05, 0x190e), .driver_info = BTUSB_REALTEK | 525 BTUSB_WIDEBAND_SPEECH }, 526 { USB_DEVICE(0x2550, 0x8761), .driver_info = BTUSB_REALTEK | 527 BTUSB_WIDEBAND_SPEECH }, 528 529 /* Additional Realtek 8761BUV Bluetooth devices */ 530 { USB_DEVICE(0x0bda, 0x8771), .driver_info = BTUSB_REALTEK | 531 BTUSB_WIDEBAND_SPEECH }, 532 533 /* Additional Realtek 8821AE Bluetooth devices */ 534 { USB_DEVICE(0x0b05, 0x17dc), .driver_info = BTUSB_REALTEK }, 535 { USB_DEVICE(0x13d3, 0x3414), .driver_info = BTUSB_REALTEK }, 536 { USB_DEVICE(0x13d3, 0x3458), .driver_info = BTUSB_REALTEK }, 537 { USB_DEVICE(0x13d3, 0x3461), .driver_info = BTUSB_REALTEK }, 538 { USB_DEVICE(0x13d3, 0x3462), .driver_info = BTUSB_REALTEK }, 539 540 /* Additional Realtek 8822BE Bluetooth devices */ 541 { USB_DEVICE(0x13d3, 0x3526), .driver_info = BTUSB_REALTEK }, 542 { USB_DEVICE(0x0b05, 0x185c), .driver_info = BTUSB_REALTEK }, 543 544 /* Additional Realtek 8822CE Bluetooth devices */ 545 { USB_DEVICE(0x04ca, 0x4005), .driver_info = BTUSB_REALTEK | 546 BTUSB_WIDEBAND_SPEECH }, 547 { USB_DEVICE(0x04c5, 0x161f), .driver_info = BTUSB_REALTEK | 548 BTUSB_WIDEBAND_SPEECH }, 549 { USB_DEVICE(0x0b05, 0x18ef), .driver_info = BTUSB_REALTEK | 550 BTUSB_WIDEBAND_SPEECH }, 551 { USB_DEVICE(0x13d3, 0x3548), .driver_info = BTUSB_REALTEK | 552 BTUSB_WIDEBAND_SPEECH }, 553 { USB_DEVICE(0x13d3, 0x3549), .driver_info = BTUSB_REALTEK | 554 BTUSB_WIDEBAND_SPEECH }, 555 { USB_DEVICE(0x13d3, 0x3553), .driver_info = BTUSB_REALTEK | 556 BTUSB_WIDEBAND_SPEECH }, 557 { USB_DEVICE(0x13d3, 0x3555), .driver_info = BTUSB_REALTEK | 558 BTUSB_WIDEBAND_SPEECH }, 559 { USB_DEVICE(0x2ff8, 0x3051), .driver_info = BTUSB_REALTEK | 560 BTUSB_WIDEBAND_SPEECH }, 561 { USB_DEVICE(0x1358, 0xc123), .driver_info = BTUSB_REALTEK | 562 BTUSB_WIDEBAND_SPEECH }, 563 { USB_DEVICE(0x0bda, 0xc123), .driver_info = BTUSB_REALTEK | 564 BTUSB_WIDEBAND_SPEECH }, 565 { USB_DEVICE(0x0cb5, 0xc547), .driver_info = BTUSB_REALTEK | 566 BTUSB_WIDEBAND_SPEECH }, 567 568 /* Silicon Wave based devices */ 569 { USB_DEVICE(0x0c10, 0x0000), .driver_info = BTUSB_SWAVE }, 570 571 { } /* Terminating entry */ 572 }; 573 574 /* The Bluetooth USB module build into some devices needs to be reset on resume, 575 * this is a problem with the platform (likely shutting off all power) not with 576 * the module itself. So we use a DMI list to match known broken platforms. 577 */ 578 static const struct dmi_system_id btusb_needs_reset_resume_table[] = { 579 { 580 /* Dell OptiPlex 3060 (QCA ROME device 0cf3:e007) */ 581 .matches = { 582 DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."), 583 DMI_MATCH(DMI_PRODUCT_NAME, "OptiPlex 3060"), 584 }, 585 }, 586 { 587 /* Dell XPS 9360 (QCA ROME device 0cf3:e300) */ 588 .matches = { 589 DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."), 590 DMI_MATCH(DMI_PRODUCT_NAME, "XPS 13 9360"), 591 }, 592 }, 593 { 594 /* Dell Inspiron 5565 (QCA ROME device 0cf3:e009) */ 595 .matches = { 596 DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."), 597 DMI_MATCH(DMI_PRODUCT_NAME, "Inspiron 5565"), 598 }, 599 }, 600 {} 601 }; 602 603 #define BTUSB_MAX_ISOC_FRAMES 10 604 605 #define BTUSB_INTR_RUNNING 0 606 #define BTUSB_BULK_RUNNING 1 607 #define BTUSB_ISOC_RUNNING 2 608 #define BTUSB_SUSPENDING 3 609 #define BTUSB_DID_ISO_RESUME 4 610 #define BTUSB_BOOTLOADER 5 611 #define BTUSB_DOWNLOADING 6 612 #define BTUSB_FIRMWARE_LOADED 7 613 #define BTUSB_FIRMWARE_FAILED 8 614 #define BTUSB_BOOTING 9 615 #define BTUSB_DIAG_RUNNING 10 616 #define BTUSB_OOB_WAKE_ENABLED 11 617 #define BTUSB_HW_RESET_ACTIVE 12 618 #define BTUSB_TX_WAIT_VND_EVT 13 619 #define BTUSB_WAKEUP_AUTOSUSPEND 14 620 #define BTUSB_USE_ALT3_FOR_WBS 15 621 622 struct btusb_data { 623 struct hci_dev *hdev; 624 struct usb_device *udev; 625 struct usb_interface *intf; 626 struct usb_interface *isoc; 627 struct usb_interface *diag; 628 unsigned isoc_ifnum; 629 630 unsigned long flags; 631 632 bool poll_sync; 633 int intr_interval; 634 struct work_struct work; 635 struct work_struct waker; 636 struct delayed_work rx_work; 637 638 struct sk_buff_head acl_q; 639 640 struct usb_anchor deferred; 641 struct usb_anchor tx_anchor; 642 int tx_in_flight; 643 spinlock_t txlock; 644 645 struct usb_anchor intr_anchor; 646 struct usb_anchor bulk_anchor; 647 struct usb_anchor isoc_anchor; 648 struct usb_anchor diag_anchor; 649 struct usb_anchor ctrl_anchor; 650 spinlock_t rxlock; 651 652 struct sk_buff *evt_skb; 653 struct sk_buff *acl_skb; 654 struct sk_buff *sco_skb; 655 656 struct usb_endpoint_descriptor *intr_ep; 657 struct usb_endpoint_descriptor *bulk_tx_ep; 658 struct usb_endpoint_descriptor *bulk_rx_ep; 659 struct usb_endpoint_descriptor *isoc_tx_ep; 660 struct usb_endpoint_descriptor *isoc_rx_ep; 661 struct usb_endpoint_descriptor *diag_tx_ep; 662 struct usb_endpoint_descriptor *diag_rx_ep; 663 664 struct gpio_desc *reset_gpio; 665 666 __u8 cmdreq_type; 667 __u8 cmdreq; 668 669 unsigned int sco_num; 670 unsigned int air_mode; 671 bool usb_alt6_packet_flow; 672 int isoc_altsetting; 673 int suspend_count; 674 675 int (*recv_event)(struct hci_dev *hdev, struct sk_buff *skb); 676 int (*recv_acl)(struct hci_dev *hdev, struct sk_buff *skb); 677 int (*recv_bulk)(struct btusb_data *data, void *buffer, int count); 678 679 int (*setup_on_usb)(struct hci_dev *hdev); 680 681 int oob_wake_irq; /* irq for out-of-band wake-on-bt */ 682 unsigned cmd_timeout_cnt; 683 }; 684 685 static void btusb_intel_cmd_timeout(struct hci_dev *hdev) 686 { 687 struct btusb_data *data = hci_get_drvdata(hdev); 688 struct gpio_desc *reset_gpio = data->reset_gpio; 689 690 if (++data->cmd_timeout_cnt < 5) 691 return; 692 693 if (!reset_gpio) { 694 bt_dev_err(hdev, "No way to reset. Ignoring and continuing"); 695 return; 696 } 697 698 /* 699 * Toggle the hard reset line if the platform provides one. The reset 700 * is going to yank the device off the USB and then replug. So doing 701 * once is enough. The cleanup is handled correctly on the way out 702 * (standard USB disconnect), and the new device is detected cleanly 703 * and bound to the driver again like it should be. 704 */ 705 if (test_and_set_bit(BTUSB_HW_RESET_ACTIVE, &data->flags)) { 706 bt_dev_err(hdev, "last reset failed? Not resetting again"); 707 return; 708 } 709 710 bt_dev_err(hdev, "Initiating HW reset via gpio"); 711 gpiod_set_value_cansleep(reset_gpio, 1); 712 msleep(100); 713 gpiod_set_value_cansleep(reset_gpio, 0); 714 } 715 716 static void btusb_rtl_cmd_timeout(struct hci_dev *hdev) 717 { 718 struct btusb_data *data = hci_get_drvdata(hdev); 719 struct gpio_desc *reset_gpio = data->reset_gpio; 720 721 if (++data->cmd_timeout_cnt < 5) 722 return; 723 724 if (!reset_gpio) { 725 bt_dev_err(hdev, "No gpio to reset Realtek device, ignoring"); 726 return; 727 } 728 729 /* Toggle the hard reset line. The Realtek device is going to 730 * yank itself off the USB and then replug. The cleanup is handled 731 * correctly on the way out (standard USB disconnect), and the new 732 * device is detected cleanly and bound to the driver again like 733 * it should be. 734 */ 735 if (test_and_set_bit(BTUSB_HW_RESET_ACTIVE, &data->flags)) { 736 bt_dev_err(hdev, "last reset failed? Not resetting again"); 737 return; 738 } 739 740 bt_dev_err(hdev, "Reset Realtek device via gpio"); 741 gpiod_set_value_cansleep(reset_gpio, 1); 742 msleep(200); 743 gpiod_set_value_cansleep(reset_gpio, 0); 744 } 745 746 static void btusb_qca_cmd_timeout(struct hci_dev *hdev) 747 { 748 struct btusb_data *data = hci_get_drvdata(hdev); 749 struct gpio_desc *reset_gpio = data->reset_gpio; 750 int err; 751 752 if (++data->cmd_timeout_cnt < 5) 753 return; 754 755 if (reset_gpio) { 756 bt_dev_err(hdev, "Reset qca device via bt_en gpio"); 757 758 /* Toggle the hard reset line. The qca bt device is going to 759 * yank itself off the USB and then replug. The cleanup is handled 760 * correctly on the way out (standard USB disconnect), and the new 761 * device is detected cleanly and bound to the driver again like 762 * it should be. 763 */ 764 if (test_and_set_bit(BTUSB_HW_RESET_ACTIVE, &data->flags)) { 765 bt_dev_err(hdev, "last reset failed? Not resetting again"); 766 return; 767 } 768 769 gpiod_set_value_cansleep(reset_gpio, 0); 770 msleep(200); 771 gpiod_set_value_cansleep(reset_gpio, 1); 772 773 return; 774 } 775 776 bt_dev_err(hdev, "Multiple cmd timeouts seen. Resetting usb device."); 777 /* This is not an unbalanced PM reference since the device will reset */ 778 err = usb_autopm_get_interface(data->intf); 779 if (!err) 780 usb_queue_reset_device(data->intf); 781 else 782 bt_dev_err(hdev, "Failed usb_autopm_get_interface with %d", err); 783 } 784 785 static inline void btusb_free_frags(struct btusb_data *data) 786 { 787 unsigned long flags; 788 789 spin_lock_irqsave(&data->rxlock, flags); 790 791 kfree_skb(data->evt_skb); 792 data->evt_skb = NULL; 793 794 kfree_skb(data->acl_skb); 795 data->acl_skb = NULL; 796 797 kfree_skb(data->sco_skb); 798 data->sco_skb = NULL; 799 800 spin_unlock_irqrestore(&data->rxlock, flags); 801 } 802 803 static int btusb_recv_event(struct btusb_data *data, struct sk_buff *skb) 804 { 805 if (data->intr_interval) { 806 /* Trigger dequeue immediatelly if an event is received */ 807 schedule_delayed_work(&data->rx_work, 0); 808 } 809 810 return data->recv_event(data->hdev, skb); 811 } 812 813 static int btusb_recv_intr(struct btusb_data *data, void *buffer, int count) 814 { 815 struct sk_buff *skb; 816 unsigned long flags; 817 int err = 0; 818 819 spin_lock_irqsave(&data->rxlock, flags); 820 skb = data->evt_skb; 821 822 while (count) { 823 int len; 824 825 if (!skb) { 826 skb = bt_skb_alloc(HCI_MAX_EVENT_SIZE, GFP_ATOMIC); 827 if (!skb) { 828 err = -ENOMEM; 829 break; 830 } 831 832 hci_skb_pkt_type(skb) = HCI_EVENT_PKT; 833 hci_skb_expect(skb) = HCI_EVENT_HDR_SIZE; 834 } 835 836 len = min_t(uint, hci_skb_expect(skb), count); 837 skb_put_data(skb, buffer, len); 838 839 count -= len; 840 buffer += len; 841 hci_skb_expect(skb) -= len; 842 843 if (skb->len == HCI_EVENT_HDR_SIZE) { 844 /* Complete event header */ 845 hci_skb_expect(skb) = hci_event_hdr(skb)->plen; 846 847 if (skb_tailroom(skb) < hci_skb_expect(skb)) { 848 kfree_skb(skb); 849 skb = NULL; 850 851 err = -EILSEQ; 852 break; 853 } 854 } 855 856 if (!hci_skb_expect(skb)) { 857 /* Complete frame */ 858 btusb_recv_event(data, skb); 859 skb = NULL; 860 } 861 } 862 863 data->evt_skb = skb; 864 spin_unlock_irqrestore(&data->rxlock, flags); 865 866 return err; 867 } 868 869 static int btusb_recv_acl(struct btusb_data *data, struct sk_buff *skb) 870 { 871 /* Only queue ACL packet if intr_interval is set as it means 872 * force_poll_sync has been enabled. 873 */ 874 if (!data->intr_interval) 875 return data->recv_acl(data->hdev, skb); 876 877 skb_queue_tail(&data->acl_q, skb); 878 schedule_delayed_work(&data->rx_work, data->intr_interval); 879 880 return 0; 881 } 882 883 static int btusb_recv_bulk(struct btusb_data *data, void *buffer, int count) 884 { 885 struct sk_buff *skb; 886 unsigned long flags; 887 int err = 0; 888 889 spin_lock_irqsave(&data->rxlock, flags); 890 skb = data->acl_skb; 891 892 while (count) { 893 int len; 894 895 if (!skb) { 896 skb = bt_skb_alloc(HCI_MAX_FRAME_SIZE, GFP_ATOMIC); 897 if (!skb) { 898 err = -ENOMEM; 899 break; 900 } 901 902 hci_skb_pkt_type(skb) = HCI_ACLDATA_PKT; 903 hci_skb_expect(skb) = HCI_ACL_HDR_SIZE; 904 } 905 906 len = min_t(uint, hci_skb_expect(skb), count); 907 skb_put_data(skb, buffer, len); 908 909 count -= len; 910 buffer += len; 911 hci_skb_expect(skb) -= len; 912 913 if (skb->len == HCI_ACL_HDR_SIZE) { 914 __u16 handle = __le16_to_cpu(hci_acl_hdr(skb)->handle); 915 __le16 dlen = hci_acl_hdr(skb)->dlen; 916 __u8 type; 917 918 /* Complete ACL header */ 919 hci_skb_expect(skb) = __le16_to_cpu(dlen); 920 921 /* Detect if ISO packet has been sent over bulk */ 922 if (hci_conn_num(data->hdev, ISO_LINK)) { 923 type = hci_conn_lookup_type(data->hdev, 924 hci_handle(handle)); 925 if (type == ISO_LINK) 926 hci_skb_pkt_type(skb) = HCI_ISODATA_PKT; 927 } 928 929 if (skb_tailroom(skb) < hci_skb_expect(skb)) { 930 kfree_skb(skb); 931 skb = NULL; 932 933 err = -EILSEQ; 934 break; 935 } 936 } 937 938 if (!hci_skb_expect(skb)) { 939 /* Complete frame */ 940 btusb_recv_acl(data, skb); 941 skb = NULL; 942 } 943 } 944 945 data->acl_skb = skb; 946 spin_unlock_irqrestore(&data->rxlock, flags); 947 948 return err; 949 } 950 951 static int btusb_recv_isoc(struct btusb_data *data, void *buffer, int count) 952 { 953 struct sk_buff *skb; 954 unsigned long flags; 955 int err = 0; 956 957 spin_lock_irqsave(&data->rxlock, flags); 958 skb = data->sco_skb; 959 960 while (count) { 961 int len; 962 963 if (!skb) { 964 skb = bt_skb_alloc(HCI_MAX_SCO_SIZE, GFP_ATOMIC); 965 if (!skb) { 966 err = -ENOMEM; 967 break; 968 } 969 970 hci_skb_pkt_type(skb) = HCI_SCODATA_PKT; 971 hci_skb_expect(skb) = HCI_SCO_HDR_SIZE; 972 } 973 974 len = min_t(uint, hci_skb_expect(skb), count); 975 skb_put_data(skb, buffer, len); 976 977 count -= len; 978 buffer += len; 979 hci_skb_expect(skb) -= len; 980 981 if (skb->len == HCI_SCO_HDR_SIZE) { 982 /* Complete SCO header */ 983 hci_skb_expect(skb) = hci_sco_hdr(skb)->dlen; 984 985 if (skb_tailroom(skb) < hci_skb_expect(skb)) { 986 kfree_skb(skb); 987 skb = NULL; 988 989 err = -EILSEQ; 990 break; 991 } 992 } 993 994 if (!hci_skb_expect(skb)) { 995 /* Complete frame */ 996 hci_recv_frame(data->hdev, skb); 997 skb = NULL; 998 } 999 } 1000 1001 data->sco_skb = skb; 1002 spin_unlock_irqrestore(&data->rxlock, flags); 1003 1004 return err; 1005 } 1006 1007 static void btusb_intr_complete(struct urb *urb) 1008 { 1009 struct hci_dev *hdev = urb->context; 1010 struct btusb_data *data = hci_get_drvdata(hdev); 1011 int err; 1012 1013 BT_DBG("%s urb %p status %d count %d", hdev->name, urb, urb->status, 1014 urb->actual_length); 1015 1016 if (!test_bit(HCI_RUNNING, &hdev->flags)) 1017 return; 1018 1019 if (urb->status == 0) { 1020 hdev->stat.byte_rx += urb->actual_length; 1021 1022 if (btusb_recv_intr(data, urb->transfer_buffer, 1023 urb->actual_length) < 0) { 1024 bt_dev_err(hdev, "corrupted event packet"); 1025 hdev->stat.err_rx++; 1026 } 1027 } else if (urb->status == -ENOENT) { 1028 /* Avoid suspend failed when usb_kill_urb */ 1029 return; 1030 } 1031 1032 if (!test_bit(BTUSB_INTR_RUNNING, &data->flags)) 1033 return; 1034 1035 usb_mark_last_busy(data->udev); 1036 usb_anchor_urb(urb, &data->intr_anchor); 1037 1038 err = usb_submit_urb(urb, GFP_ATOMIC); 1039 if (err < 0) { 1040 /* -EPERM: urb is being killed; 1041 * -ENODEV: device got disconnected 1042 */ 1043 if (err != -EPERM && err != -ENODEV) 1044 bt_dev_err(hdev, "urb %p failed to resubmit (%d)", 1045 urb, -err); 1046 if (err != -EPERM) 1047 hci_cmd_sync_cancel(hdev, -err); 1048 usb_unanchor_urb(urb); 1049 } 1050 } 1051 1052 static int btusb_submit_intr_urb(struct hci_dev *hdev, gfp_t mem_flags) 1053 { 1054 struct btusb_data *data = hci_get_drvdata(hdev); 1055 struct urb *urb; 1056 unsigned char *buf; 1057 unsigned int pipe; 1058 int err, size; 1059 1060 BT_DBG("%s", hdev->name); 1061 1062 if (!data->intr_ep) 1063 return -ENODEV; 1064 1065 urb = usb_alloc_urb(0, mem_flags); 1066 if (!urb) 1067 return -ENOMEM; 1068 1069 size = le16_to_cpu(data->intr_ep->wMaxPacketSize); 1070 1071 buf = kmalloc(size, mem_flags); 1072 if (!buf) { 1073 usb_free_urb(urb); 1074 return -ENOMEM; 1075 } 1076 1077 pipe = usb_rcvintpipe(data->udev, data->intr_ep->bEndpointAddress); 1078 1079 usb_fill_int_urb(urb, data->udev, pipe, buf, size, 1080 btusb_intr_complete, hdev, data->intr_ep->bInterval); 1081 1082 urb->transfer_flags |= URB_FREE_BUFFER; 1083 1084 usb_anchor_urb(urb, &data->intr_anchor); 1085 1086 err = usb_submit_urb(urb, mem_flags); 1087 if (err < 0) { 1088 if (err != -EPERM && err != -ENODEV) 1089 bt_dev_err(hdev, "urb %p submission failed (%d)", 1090 urb, -err); 1091 if (err != -EPERM) 1092 hci_cmd_sync_cancel(hdev, -err); 1093 usb_unanchor_urb(urb); 1094 } 1095 1096 /* Only initialize intr_interval if URB poll sync is enabled */ 1097 if (!data->poll_sync) 1098 goto done; 1099 1100 /* The units are frames (milliseconds) for full and low speed devices, 1101 * and microframes (1/8 millisecond) for highspeed and SuperSpeed 1102 * devices. 1103 * 1104 * This is done once on open/resume so it shouldn't change even if 1105 * force_poll_sync changes. 1106 */ 1107 switch (urb->dev->speed) { 1108 case USB_SPEED_SUPER_PLUS: 1109 case USB_SPEED_SUPER: /* units are 125us */ 1110 data->intr_interval = usecs_to_jiffies(urb->interval * 125); 1111 break; 1112 default: 1113 data->intr_interval = msecs_to_jiffies(urb->interval); 1114 break; 1115 } 1116 1117 done: 1118 usb_free_urb(urb); 1119 1120 return err; 1121 } 1122 1123 static void btusb_bulk_complete(struct urb *urb) 1124 { 1125 struct hci_dev *hdev = urb->context; 1126 struct btusb_data *data = hci_get_drvdata(hdev); 1127 int err; 1128 1129 BT_DBG("%s urb %p status %d count %d", hdev->name, urb, urb->status, 1130 urb->actual_length); 1131 1132 if (!test_bit(HCI_RUNNING, &hdev->flags)) 1133 return; 1134 1135 if (urb->status == 0) { 1136 hdev->stat.byte_rx += urb->actual_length; 1137 1138 if (data->recv_bulk(data, urb->transfer_buffer, 1139 urb->actual_length) < 0) { 1140 bt_dev_err(hdev, "corrupted ACL packet"); 1141 hdev->stat.err_rx++; 1142 } 1143 } else if (urb->status == -ENOENT) { 1144 /* Avoid suspend failed when usb_kill_urb */ 1145 return; 1146 } 1147 1148 if (!test_bit(BTUSB_BULK_RUNNING, &data->flags)) 1149 return; 1150 1151 usb_anchor_urb(urb, &data->bulk_anchor); 1152 usb_mark_last_busy(data->udev); 1153 1154 err = usb_submit_urb(urb, GFP_ATOMIC); 1155 if (err < 0) { 1156 /* -EPERM: urb is being killed; 1157 * -ENODEV: device got disconnected 1158 */ 1159 if (err != -EPERM && err != -ENODEV) 1160 bt_dev_err(hdev, "urb %p failed to resubmit (%d)", 1161 urb, -err); 1162 usb_unanchor_urb(urb); 1163 } 1164 } 1165 1166 static int btusb_submit_bulk_urb(struct hci_dev *hdev, gfp_t mem_flags) 1167 { 1168 struct btusb_data *data = hci_get_drvdata(hdev); 1169 struct urb *urb; 1170 unsigned char *buf; 1171 unsigned int pipe; 1172 int err, size = HCI_MAX_FRAME_SIZE; 1173 1174 BT_DBG("%s", hdev->name); 1175 1176 if (!data->bulk_rx_ep) 1177 return -ENODEV; 1178 1179 urb = usb_alloc_urb(0, mem_flags); 1180 if (!urb) 1181 return -ENOMEM; 1182 1183 buf = kmalloc(size, mem_flags); 1184 if (!buf) { 1185 usb_free_urb(urb); 1186 return -ENOMEM; 1187 } 1188 1189 pipe = usb_rcvbulkpipe(data->udev, data->bulk_rx_ep->bEndpointAddress); 1190 1191 usb_fill_bulk_urb(urb, data->udev, pipe, buf, size, 1192 btusb_bulk_complete, hdev); 1193 1194 urb->transfer_flags |= URB_FREE_BUFFER; 1195 1196 usb_mark_last_busy(data->udev); 1197 usb_anchor_urb(urb, &data->bulk_anchor); 1198 1199 err = usb_submit_urb(urb, mem_flags); 1200 if (err < 0) { 1201 if (err != -EPERM && err != -ENODEV) 1202 bt_dev_err(hdev, "urb %p submission failed (%d)", 1203 urb, -err); 1204 usb_unanchor_urb(urb); 1205 } 1206 1207 usb_free_urb(urb); 1208 1209 return err; 1210 } 1211 1212 static void btusb_isoc_complete(struct urb *urb) 1213 { 1214 struct hci_dev *hdev = urb->context; 1215 struct btusb_data *data = hci_get_drvdata(hdev); 1216 int i, err; 1217 1218 BT_DBG("%s urb %p status %d count %d", hdev->name, urb, urb->status, 1219 urb->actual_length); 1220 1221 if (!test_bit(HCI_RUNNING, &hdev->flags)) 1222 return; 1223 1224 if (urb->status == 0) { 1225 for (i = 0; i < urb->number_of_packets; i++) { 1226 unsigned int offset = urb->iso_frame_desc[i].offset; 1227 unsigned int length = urb->iso_frame_desc[i].actual_length; 1228 1229 if (urb->iso_frame_desc[i].status) 1230 continue; 1231 1232 hdev->stat.byte_rx += length; 1233 1234 if (btusb_recv_isoc(data, urb->transfer_buffer + offset, 1235 length) < 0) { 1236 bt_dev_err(hdev, "corrupted SCO packet"); 1237 hdev->stat.err_rx++; 1238 } 1239 } 1240 } else if (urb->status == -ENOENT) { 1241 /* Avoid suspend failed when usb_kill_urb */ 1242 return; 1243 } 1244 1245 if (!test_bit(BTUSB_ISOC_RUNNING, &data->flags)) 1246 return; 1247 1248 usb_anchor_urb(urb, &data->isoc_anchor); 1249 1250 err = usb_submit_urb(urb, GFP_ATOMIC); 1251 if (err < 0) { 1252 /* -EPERM: urb is being killed; 1253 * -ENODEV: device got disconnected 1254 */ 1255 if (err != -EPERM && err != -ENODEV) 1256 bt_dev_err(hdev, "urb %p failed to resubmit (%d)", 1257 urb, -err); 1258 usb_unanchor_urb(urb); 1259 } 1260 } 1261 1262 static inline void __fill_isoc_descriptor_msbc(struct urb *urb, int len, 1263 int mtu, struct btusb_data *data) 1264 { 1265 int i, offset = 0; 1266 unsigned int interval; 1267 1268 BT_DBG("len %d mtu %d", len, mtu); 1269 1270 /* For mSBC ALT 6 setting the host will send the packet at continuous 1271 * flow. As per core spec 5, vol 4, part B, table 2.1. For ALT setting 1272 * 6 the HCI PACKET INTERVAL should be 7.5ms for every usb packets. 1273 * To maintain the rate we send 63bytes of usb packets alternatively for 1274 * 7ms and 8ms to maintain the rate as 7.5ms. 1275 */ 1276 if (data->usb_alt6_packet_flow) { 1277 interval = 7; 1278 data->usb_alt6_packet_flow = false; 1279 } else { 1280 interval = 6; 1281 data->usb_alt6_packet_flow = true; 1282 } 1283 1284 for (i = 0; i < interval; i++) { 1285 urb->iso_frame_desc[i].offset = offset; 1286 urb->iso_frame_desc[i].length = offset; 1287 } 1288 1289 if (len && i < BTUSB_MAX_ISOC_FRAMES) { 1290 urb->iso_frame_desc[i].offset = offset; 1291 urb->iso_frame_desc[i].length = len; 1292 i++; 1293 } 1294 1295 urb->number_of_packets = i; 1296 } 1297 1298 static inline void __fill_isoc_descriptor(struct urb *urb, int len, int mtu) 1299 { 1300 int i, offset = 0; 1301 1302 BT_DBG("len %d mtu %d", len, mtu); 1303 1304 for (i = 0; i < BTUSB_MAX_ISOC_FRAMES && len >= mtu; 1305 i++, offset += mtu, len -= mtu) { 1306 urb->iso_frame_desc[i].offset = offset; 1307 urb->iso_frame_desc[i].length = mtu; 1308 } 1309 1310 if (len && i < BTUSB_MAX_ISOC_FRAMES) { 1311 urb->iso_frame_desc[i].offset = offset; 1312 urb->iso_frame_desc[i].length = len; 1313 i++; 1314 } 1315 1316 urb->number_of_packets = i; 1317 } 1318 1319 static int btusb_submit_isoc_urb(struct hci_dev *hdev, gfp_t mem_flags) 1320 { 1321 struct btusb_data *data = hci_get_drvdata(hdev); 1322 struct urb *urb; 1323 unsigned char *buf; 1324 unsigned int pipe; 1325 int err, size; 1326 1327 BT_DBG("%s", hdev->name); 1328 1329 if (!data->isoc_rx_ep) 1330 return -ENODEV; 1331 1332 urb = usb_alloc_urb(BTUSB_MAX_ISOC_FRAMES, mem_flags); 1333 if (!urb) 1334 return -ENOMEM; 1335 1336 size = le16_to_cpu(data->isoc_rx_ep->wMaxPacketSize) * 1337 BTUSB_MAX_ISOC_FRAMES; 1338 1339 buf = kmalloc(size, mem_flags); 1340 if (!buf) { 1341 usb_free_urb(urb); 1342 return -ENOMEM; 1343 } 1344 1345 pipe = usb_rcvisocpipe(data->udev, data->isoc_rx_ep->bEndpointAddress); 1346 1347 usb_fill_int_urb(urb, data->udev, pipe, buf, size, btusb_isoc_complete, 1348 hdev, data->isoc_rx_ep->bInterval); 1349 1350 urb->transfer_flags = URB_FREE_BUFFER | URB_ISO_ASAP; 1351 1352 __fill_isoc_descriptor(urb, size, 1353 le16_to_cpu(data->isoc_rx_ep->wMaxPacketSize)); 1354 1355 usb_anchor_urb(urb, &data->isoc_anchor); 1356 1357 err = usb_submit_urb(urb, mem_flags); 1358 if (err < 0) { 1359 if (err != -EPERM && err != -ENODEV) 1360 bt_dev_err(hdev, "urb %p submission failed (%d)", 1361 urb, -err); 1362 usb_unanchor_urb(urb); 1363 } 1364 1365 usb_free_urb(urb); 1366 1367 return err; 1368 } 1369 1370 static void btusb_diag_complete(struct urb *urb) 1371 { 1372 struct hci_dev *hdev = urb->context; 1373 struct btusb_data *data = hci_get_drvdata(hdev); 1374 int err; 1375 1376 BT_DBG("%s urb %p status %d count %d", hdev->name, urb, urb->status, 1377 urb->actual_length); 1378 1379 if (urb->status == 0) { 1380 struct sk_buff *skb; 1381 1382 skb = bt_skb_alloc(urb->actual_length, GFP_ATOMIC); 1383 if (skb) { 1384 skb_put_data(skb, urb->transfer_buffer, 1385 urb->actual_length); 1386 hci_recv_diag(hdev, skb); 1387 } 1388 } else if (urb->status == -ENOENT) { 1389 /* Avoid suspend failed when usb_kill_urb */ 1390 return; 1391 } 1392 1393 if (!test_bit(BTUSB_DIAG_RUNNING, &data->flags)) 1394 return; 1395 1396 usb_anchor_urb(urb, &data->diag_anchor); 1397 usb_mark_last_busy(data->udev); 1398 1399 err = usb_submit_urb(urb, GFP_ATOMIC); 1400 if (err < 0) { 1401 /* -EPERM: urb is being killed; 1402 * -ENODEV: device got disconnected 1403 */ 1404 if (err != -EPERM && err != -ENODEV) 1405 bt_dev_err(hdev, "urb %p failed to resubmit (%d)", 1406 urb, -err); 1407 usb_unanchor_urb(urb); 1408 } 1409 } 1410 1411 static int btusb_submit_diag_urb(struct hci_dev *hdev, gfp_t mem_flags) 1412 { 1413 struct btusb_data *data = hci_get_drvdata(hdev); 1414 struct urb *urb; 1415 unsigned char *buf; 1416 unsigned int pipe; 1417 int err, size = HCI_MAX_FRAME_SIZE; 1418 1419 BT_DBG("%s", hdev->name); 1420 1421 if (!data->diag_rx_ep) 1422 return -ENODEV; 1423 1424 urb = usb_alloc_urb(0, mem_flags); 1425 if (!urb) 1426 return -ENOMEM; 1427 1428 buf = kmalloc(size, mem_flags); 1429 if (!buf) { 1430 usb_free_urb(urb); 1431 return -ENOMEM; 1432 } 1433 1434 pipe = usb_rcvbulkpipe(data->udev, data->diag_rx_ep->bEndpointAddress); 1435 1436 usb_fill_bulk_urb(urb, data->udev, pipe, buf, size, 1437 btusb_diag_complete, hdev); 1438 1439 urb->transfer_flags |= URB_FREE_BUFFER; 1440 1441 usb_mark_last_busy(data->udev); 1442 usb_anchor_urb(urb, &data->diag_anchor); 1443 1444 err = usb_submit_urb(urb, mem_flags); 1445 if (err < 0) { 1446 if (err != -EPERM && err != -ENODEV) 1447 bt_dev_err(hdev, "urb %p submission failed (%d)", 1448 urb, -err); 1449 usb_unanchor_urb(urb); 1450 } 1451 1452 usb_free_urb(urb); 1453 1454 return err; 1455 } 1456 1457 static void btusb_tx_complete(struct urb *urb) 1458 { 1459 struct sk_buff *skb = urb->context; 1460 struct hci_dev *hdev = (struct hci_dev *)skb->dev; 1461 struct btusb_data *data = hci_get_drvdata(hdev); 1462 unsigned long flags; 1463 1464 BT_DBG("%s urb %p status %d count %d", hdev->name, urb, urb->status, 1465 urb->actual_length); 1466 1467 if (!test_bit(HCI_RUNNING, &hdev->flags)) 1468 goto done; 1469 1470 if (!urb->status) { 1471 hdev->stat.byte_tx += urb->transfer_buffer_length; 1472 } else { 1473 if (hci_skb_pkt_type(skb) == HCI_COMMAND_PKT) 1474 hci_cmd_sync_cancel(hdev, -urb->status); 1475 hdev->stat.err_tx++; 1476 } 1477 1478 done: 1479 spin_lock_irqsave(&data->txlock, flags); 1480 data->tx_in_flight--; 1481 spin_unlock_irqrestore(&data->txlock, flags); 1482 1483 kfree(urb->setup_packet); 1484 1485 kfree_skb(skb); 1486 } 1487 1488 static void btusb_isoc_tx_complete(struct urb *urb) 1489 { 1490 struct sk_buff *skb = urb->context; 1491 struct hci_dev *hdev = (struct hci_dev *)skb->dev; 1492 1493 BT_DBG("%s urb %p status %d count %d", hdev->name, urb, urb->status, 1494 urb->actual_length); 1495 1496 if (!test_bit(HCI_RUNNING, &hdev->flags)) 1497 goto done; 1498 1499 if (!urb->status) 1500 hdev->stat.byte_tx += urb->transfer_buffer_length; 1501 else 1502 hdev->stat.err_tx++; 1503 1504 done: 1505 kfree(urb->setup_packet); 1506 1507 kfree_skb(skb); 1508 } 1509 1510 static int btusb_open(struct hci_dev *hdev) 1511 { 1512 struct btusb_data *data = hci_get_drvdata(hdev); 1513 int err; 1514 1515 BT_DBG("%s", hdev->name); 1516 1517 err = usb_autopm_get_interface(data->intf); 1518 if (err < 0) 1519 return err; 1520 1521 /* Patching USB firmware files prior to starting any URBs of HCI path 1522 * It is more safe to use USB bulk channel for downloading USB patch 1523 */ 1524 if (data->setup_on_usb) { 1525 err = data->setup_on_usb(hdev); 1526 if (err < 0) 1527 goto setup_fail; 1528 } 1529 1530 data->intf->needs_remote_wakeup = 1; 1531 1532 if (test_and_set_bit(BTUSB_INTR_RUNNING, &data->flags)) 1533 goto done; 1534 1535 err = btusb_submit_intr_urb(hdev, GFP_KERNEL); 1536 if (err < 0) 1537 goto failed; 1538 1539 err = btusb_submit_bulk_urb(hdev, GFP_KERNEL); 1540 if (err < 0) { 1541 usb_kill_anchored_urbs(&data->intr_anchor); 1542 goto failed; 1543 } 1544 1545 set_bit(BTUSB_BULK_RUNNING, &data->flags); 1546 btusb_submit_bulk_urb(hdev, GFP_KERNEL); 1547 1548 if (data->diag) { 1549 if (!btusb_submit_diag_urb(hdev, GFP_KERNEL)) 1550 set_bit(BTUSB_DIAG_RUNNING, &data->flags); 1551 } 1552 1553 done: 1554 usb_autopm_put_interface(data->intf); 1555 return 0; 1556 1557 failed: 1558 clear_bit(BTUSB_INTR_RUNNING, &data->flags); 1559 setup_fail: 1560 usb_autopm_put_interface(data->intf); 1561 return err; 1562 } 1563 1564 static void btusb_stop_traffic(struct btusb_data *data) 1565 { 1566 usb_kill_anchored_urbs(&data->intr_anchor); 1567 usb_kill_anchored_urbs(&data->bulk_anchor); 1568 usb_kill_anchored_urbs(&data->isoc_anchor); 1569 usb_kill_anchored_urbs(&data->diag_anchor); 1570 usb_kill_anchored_urbs(&data->ctrl_anchor); 1571 } 1572 1573 static int btusb_close(struct hci_dev *hdev) 1574 { 1575 struct btusb_data *data = hci_get_drvdata(hdev); 1576 int err; 1577 1578 BT_DBG("%s", hdev->name); 1579 1580 cancel_delayed_work(&data->rx_work); 1581 cancel_work_sync(&data->work); 1582 cancel_work_sync(&data->waker); 1583 1584 skb_queue_purge(&data->acl_q); 1585 1586 clear_bit(BTUSB_ISOC_RUNNING, &data->flags); 1587 clear_bit(BTUSB_BULK_RUNNING, &data->flags); 1588 clear_bit(BTUSB_INTR_RUNNING, &data->flags); 1589 clear_bit(BTUSB_DIAG_RUNNING, &data->flags); 1590 1591 btusb_stop_traffic(data); 1592 btusb_free_frags(data); 1593 1594 err = usb_autopm_get_interface(data->intf); 1595 if (err < 0) 1596 goto failed; 1597 1598 data->intf->needs_remote_wakeup = 0; 1599 1600 /* Enable remote wake up for auto-suspend */ 1601 if (test_bit(BTUSB_WAKEUP_AUTOSUSPEND, &data->flags)) 1602 data->intf->needs_remote_wakeup = 1; 1603 1604 usb_autopm_put_interface(data->intf); 1605 1606 failed: 1607 usb_scuttle_anchored_urbs(&data->deferred); 1608 return 0; 1609 } 1610 1611 static int btusb_flush(struct hci_dev *hdev) 1612 { 1613 struct btusb_data *data = hci_get_drvdata(hdev); 1614 1615 BT_DBG("%s", hdev->name); 1616 1617 cancel_delayed_work(&data->rx_work); 1618 1619 skb_queue_purge(&data->acl_q); 1620 1621 usb_kill_anchored_urbs(&data->tx_anchor); 1622 btusb_free_frags(data); 1623 1624 return 0; 1625 } 1626 1627 static struct urb *alloc_ctrl_urb(struct hci_dev *hdev, struct sk_buff *skb) 1628 { 1629 struct btusb_data *data = hci_get_drvdata(hdev); 1630 struct usb_ctrlrequest *dr; 1631 struct urb *urb; 1632 unsigned int pipe; 1633 1634 urb = usb_alloc_urb(0, GFP_KERNEL); 1635 if (!urb) 1636 return ERR_PTR(-ENOMEM); 1637 1638 dr = kmalloc(sizeof(*dr), GFP_KERNEL); 1639 if (!dr) { 1640 usb_free_urb(urb); 1641 return ERR_PTR(-ENOMEM); 1642 } 1643 1644 dr->bRequestType = data->cmdreq_type; 1645 dr->bRequest = data->cmdreq; 1646 dr->wIndex = 0; 1647 dr->wValue = 0; 1648 dr->wLength = __cpu_to_le16(skb->len); 1649 1650 pipe = usb_sndctrlpipe(data->udev, 0x00); 1651 1652 usb_fill_control_urb(urb, data->udev, pipe, (void *)dr, 1653 skb->data, skb->len, btusb_tx_complete, skb); 1654 1655 skb->dev = (void *)hdev; 1656 1657 return urb; 1658 } 1659 1660 static struct urb *alloc_bulk_urb(struct hci_dev *hdev, struct sk_buff *skb) 1661 { 1662 struct btusb_data *data = hci_get_drvdata(hdev); 1663 struct urb *urb; 1664 unsigned int pipe; 1665 1666 if (!data->bulk_tx_ep) 1667 return ERR_PTR(-ENODEV); 1668 1669 urb = usb_alloc_urb(0, GFP_KERNEL); 1670 if (!urb) 1671 return ERR_PTR(-ENOMEM); 1672 1673 pipe = usb_sndbulkpipe(data->udev, data->bulk_tx_ep->bEndpointAddress); 1674 1675 usb_fill_bulk_urb(urb, data->udev, pipe, 1676 skb->data, skb->len, btusb_tx_complete, skb); 1677 1678 skb->dev = (void *)hdev; 1679 1680 return urb; 1681 } 1682 1683 static struct urb *alloc_isoc_urb(struct hci_dev *hdev, struct sk_buff *skb) 1684 { 1685 struct btusb_data *data = hci_get_drvdata(hdev); 1686 struct urb *urb; 1687 unsigned int pipe; 1688 1689 if (!data->isoc_tx_ep) 1690 return ERR_PTR(-ENODEV); 1691 1692 urb = usb_alloc_urb(BTUSB_MAX_ISOC_FRAMES, GFP_KERNEL); 1693 if (!urb) 1694 return ERR_PTR(-ENOMEM); 1695 1696 pipe = usb_sndisocpipe(data->udev, data->isoc_tx_ep->bEndpointAddress); 1697 1698 usb_fill_int_urb(urb, data->udev, pipe, 1699 skb->data, skb->len, btusb_isoc_tx_complete, 1700 skb, data->isoc_tx_ep->bInterval); 1701 1702 urb->transfer_flags = URB_ISO_ASAP; 1703 1704 if (data->isoc_altsetting == 6) 1705 __fill_isoc_descriptor_msbc(urb, skb->len, 1706 le16_to_cpu(data->isoc_tx_ep->wMaxPacketSize), 1707 data); 1708 else 1709 __fill_isoc_descriptor(urb, skb->len, 1710 le16_to_cpu(data->isoc_tx_ep->wMaxPacketSize)); 1711 skb->dev = (void *)hdev; 1712 1713 return urb; 1714 } 1715 1716 static int submit_tx_urb(struct hci_dev *hdev, struct urb *urb) 1717 { 1718 struct btusb_data *data = hci_get_drvdata(hdev); 1719 int err; 1720 1721 usb_anchor_urb(urb, &data->tx_anchor); 1722 1723 err = usb_submit_urb(urb, GFP_KERNEL); 1724 if (err < 0) { 1725 if (err != -EPERM && err != -ENODEV) 1726 bt_dev_err(hdev, "urb %p submission failed (%d)", 1727 urb, -err); 1728 kfree(urb->setup_packet); 1729 usb_unanchor_urb(urb); 1730 } else { 1731 usb_mark_last_busy(data->udev); 1732 } 1733 1734 usb_free_urb(urb); 1735 return err; 1736 } 1737 1738 static int submit_or_queue_tx_urb(struct hci_dev *hdev, struct urb *urb) 1739 { 1740 struct btusb_data *data = hci_get_drvdata(hdev); 1741 unsigned long flags; 1742 bool suspending; 1743 1744 spin_lock_irqsave(&data->txlock, flags); 1745 suspending = test_bit(BTUSB_SUSPENDING, &data->flags); 1746 if (!suspending) 1747 data->tx_in_flight++; 1748 spin_unlock_irqrestore(&data->txlock, flags); 1749 1750 if (!suspending) 1751 return submit_tx_urb(hdev, urb); 1752 1753 usb_anchor_urb(urb, &data->deferred); 1754 schedule_work(&data->waker); 1755 1756 usb_free_urb(urb); 1757 return 0; 1758 } 1759 1760 static int btusb_send_frame(struct hci_dev *hdev, struct sk_buff *skb) 1761 { 1762 struct urb *urb; 1763 1764 BT_DBG("%s", hdev->name); 1765 1766 switch (hci_skb_pkt_type(skb)) { 1767 case HCI_COMMAND_PKT: 1768 urb = alloc_ctrl_urb(hdev, skb); 1769 if (IS_ERR(urb)) 1770 return PTR_ERR(urb); 1771 1772 hdev->stat.cmd_tx++; 1773 return submit_or_queue_tx_urb(hdev, urb); 1774 1775 case HCI_ACLDATA_PKT: 1776 urb = alloc_bulk_urb(hdev, skb); 1777 if (IS_ERR(urb)) 1778 return PTR_ERR(urb); 1779 1780 hdev->stat.acl_tx++; 1781 return submit_or_queue_tx_urb(hdev, urb); 1782 1783 case HCI_SCODATA_PKT: 1784 if (hci_conn_num(hdev, SCO_LINK) < 1) 1785 return -ENODEV; 1786 1787 urb = alloc_isoc_urb(hdev, skb); 1788 if (IS_ERR(urb)) 1789 return PTR_ERR(urb); 1790 1791 hdev->stat.sco_tx++; 1792 return submit_tx_urb(hdev, urb); 1793 1794 case HCI_ISODATA_PKT: 1795 urb = alloc_bulk_urb(hdev, skb); 1796 if (IS_ERR(urb)) 1797 return PTR_ERR(urb); 1798 1799 return submit_or_queue_tx_urb(hdev, urb); 1800 } 1801 1802 return -EILSEQ; 1803 } 1804 1805 static void btusb_notify(struct hci_dev *hdev, unsigned int evt) 1806 { 1807 struct btusb_data *data = hci_get_drvdata(hdev); 1808 1809 BT_DBG("%s evt %d", hdev->name, evt); 1810 1811 if (hci_conn_num(hdev, SCO_LINK) != data->sco_num) { 1812 data->sco_num = hci_conn_num(hdev, SCO_LINK); 1813 data->air_mode = evt; 1814 schedule_work(&data->work); 1815 } 1816 } 1817 1818 static inline int __set_isoc_interface(struct hci_dev *hdev, int altsetting) 1819 { 1820 struct btusb_data *data = hci_get_drvdata(hdev); 1821 struct usb_interface *intf = data->isoc; 1822 struct usb_endpoint_descriptor *ep_desc; 1823 int i, err; 1824 1825 if (!data->isoc) 1826 return -ENODEV; 1827 1828 err = usb_set_interface(data->udev, data->isoc_ifnum, altsetting); 1829 if (err < 0) { 1830 bt_dev_err(hdev, "setting interface failed (%d)", -err); 1831 return err; 1832 } 1833 1834 data->isoc_altsetting = altsetting; 1835 1836 data->isoc_tx_ep = NULL; 1837 data->isoc_rx_ep = NULL; 1838 1839 for (i = 0; i < intf->cur_altsetting->desc.bNumEndpoints; i++) { 1840 ep_desc = &intf->cur_altsetting->endpoint[i].desc; 1841 1842 if (!data->isoc_tx_ep && usb_endpoint_is_isoc_out(ep_desc)) { 1843 data->isoc_tx_ep = ep_desc; 1844 continue; 1845 } 1846 1847 if (!data->isoc_rx_ep && usb_endpoint_is_isoc_in(ep_desc)) { 1848 data->isoc_rx_ep = ep_desc; 1849 continue; 1850 } 1851 } 1852 1853 if (!data->isoc_tx_ep || !data->isoc_rx_ep) { 1854 bt_dev_err(hdev, "invalid SCO descriptors"); 1855 return -ENODEV; 1856 } 1857 1858 return 0; 1859 } 1860 1861 static int btusb_switch_alt_setting(struct hci_dev *hdev, int new_alts) 1862 { 1863 struct btusb_data *data = hci_get_drvdata(hdev); 1864 int err; 1865 1866 if (data->isoc_altsetting != new_alts) { 1867 unsigned long flags; 1868 1869 clear_bit(BTUSB_ISOC_RUNNING, &data->flags); 1870 usb_kill_anchored_urbs(&data->isoc_anchor); 1871 1872 /* When isochronous alternate setting needs to be 1873 * changed, because SCO connection has been added 1874 * or removed, a packet fragment may be left in the 1875 * reassembling state. This could lead to wrongly 1876 * assembled fragments. 1877 * 1878 * Clear outstanding fragment when selecting a new 1879 * alternate setting. 1880 */ 1881 spin_lock_irqsave(&data->rxlock, flags); 1882 kfree_skb(data->sco_skb); 1883 data->sco_skb = NULL; 1884 spin_unlock_irqrestore(&data->rxlock, flags); 1885 1886 err = __set_isoc_interface(hdev, new_alts); 1887 if (err < 0) 1888 return err; 1889 } 1890 1891 if (!test_and_set_bit(BTUSB_ISOC_RUNNING, &data->flags)) { 1892 if (btusb_submit_isoc_urb(hdev, GFP_KERNEL) < 0) 1893 clear_bit(BTUSB_ISOC_RUNNING, &data->flags); 1894 else 1895 btusb_submit_isoc_urb(hdev, GFP_KERNEL); 1896 } 1897 1898 return 0; 1899 } 1900 1901 static struct usb_host_interface *btusb_find_altsetting(struct btusb_data *data, 1902 int alt) 1903 { 1904 struct usb_interface *intf = data->isoc; 1905 int i; 1906 1907 BT_DBG("Looking for Alt no :%d", alt); 1908 1909 if (!intf) 1910 return NULL; 1911 1912 for (i = 0; i < intf->num_altsetting; i++) { 1913 if (intf->altsetting[i].desc.bAlternateSetting == alt) 1914 return &intf->altsetting[i]; 1915 } 1916 1917 return NULL; 1918 } 1919 1920 static void btusb_work(struct work_struct *work) 1921 { 1922 struct btusb_data *data = container_of(work, struct btusb_data, work); 1923 struct hci_dev *hdev = data->hdev; 1924 int new_alts = 0; 1925 int err; 1926 1927 if (data->sco_num > 0) { 1928 if (!test_bit(BTUSB_DID_ISO_RESUME, &data->flags)) { 1929 err = usb_autopm_get_interface(data->isoc ? data->isoc : data->intf); 1930 if (err < 0) { 1931 clear_bit(BTUSB_ISOC_RUNNING, &data->flags); 1932 usb_kill_anchored_urbs(&data->isoc_anchor); 1933 return; 1934 } 1935 1936 set_bit(BTUSB_DID_ISO_RESUME, &data->flags); 1937 } 1938 1939 if (data->air_mode == HCI_NOTIFY_ENABLE_SCO_CVSD) { 1940 if (hdev->voice_setting & 0x0020) { 1941 static const int alts[3] = { 2, 4, 5 }; 1942 1943 new_alts = alts[data->sco_num - 1]; 1944 } else { 1945 new_alts = data->sco_num; 1946 } 1947 } else if (data->air_mode == HCI_NOTIFY_ENABLE_SCO_TRANSP) { 1948 /* Bluetooth USB spec recommends alt 6 (63 bytes), but 1949 * many adapters do not support it. Alt 1 appears to 1950 * work for all adapters that do not have alt 6, and 1951 * which work with WBS at all. Some devices prefer 1952 * alt 3 (HCI payload >= 60 Bytes let air packet 1953 * data satisfy 60 bytes), requiring 1954 * MTU >= 3 (packets) * 25 (size) - 3 (headers) = 72 1955 * see also Core spec 5, vol 4, B 2.1.1 & Table 2.1. 1956 */ 1957 if (btusb_find_altsetting(data, 6)) 1958 new_alts = 6; 1959 else if (btusb_find_altsetting(data, 3) && 1960 hdev->sco_mtu >= 72 && 1961 test_bit(BTUSB_USE_ALT3_FOR_WBS, &data->flags)) 1962 new_alts = 3; 1963 else 1964 new_alts = 1; 1965 } 1966 1967 if (btusb_switch_alt_setting(hdev, new_alts) < 0) 1968 bt_dev_err(hdev, "set USB alt:(%d) failed!", new_alts); 1969 } else { 1970 clear_bit(BTUSB_ISOC_RUNNING, &data->flags); 1971 usb_kill_anchored_urbs(&data->isoc_anchor); 1972 1973 __set_isoc_interface(hdev, 0); 1974 if (test_and_clear_bit(BTUSB_DID_ISO_RESUME, &data->flags)) 1975 usb_autopm_put_interface(data->isoc ? data->isoc : data->intf); 1976 } 1977 } 1978 1979 static void btusb_waker(struct work_struct *work) 1980 { 1981 struct btusb_data *data = container_of(work, struct btusb_data, waker); 1982 int err; 1983 1984 err = usb_autopm_get_interface(data->intf); 1985 if (err < 0) 1986 return; 1987 1988 usb_autopm_put_interface(data->intf); 1989 } 1990 1991 static void btusb_rx_work(struct work_struct *work) 1992 { 1993 struct btusb_data *data = container_of(work, struct btusb_data, 1994 rx_work.work); 1995 struct sk_buff *skb; 1996 1997 /* Dequeue ACL data received during the interval */ 1998 while ((skb = skb_dequeue(&data->acl_q))) 1999 data->recv_acl(data->hdev, skb); 2000 } 2001 2002 static int btusb_setup_bcm92035(struct hci_dev *hdev) 2003 { 2004 struct sk_buff *skb; 2005 u8 val = 0x00; 2006 2007 BT_DBG("%s", hdev->name); 2008 2009 skb = __hci_cmd_sync(hdev, 0xfc3b, 1, &val, HCI_INIT_TIMEOUT); 2010 if (IS_ERR(skb)) 2011 bt_dev_err(hdev, "BCM92035 command failed (%ld)", PTR_ERR(skb)); 2012 else 2013 kfree_skb(skb); 2014 2015 return 0; 2016 } 2017 2018 static int btusb_setup_csr(struct hci_dev *hdev) 2019 { 2020 struct btusb_data *data = hci_get_drvdata(hdev); 2021 u16 bcdDevice = le16_to_cpu(data->udev->descriptor.bcdDevice); 2022 struct hci_rp_read_local_version *rp; 2023 struct sk_buff *skb; 2024 bool is_fake = false; 2025 int ret; 2026 2027 BT_DBG("%s", hdev->name); 2028 2029 skb = __hci_cmd_sync(hdev, HCI_OP_READ_LOCAL_VERSION, 0, NULL, 2030 HCI_INIT_TIMEOUT); 2031 if (IS_ERR(skb)) { 2032 int err = PTR_ERR(skb); 2033 bt_dev_err(hdev, "CSR: Local version failed (%d)", err); 2034 return err; 2035 } 2036 2037 if (skb->len != sizeof(struct hci_rp_read_local_version)) { 2038 bt_dev_err(hdev, "CSR: Local version length mismatch"); 2039 kfree_skb(skb); 2040 return -EIO; 2041 } 2042 2043 rp = (struct hci_rp_read_local_version *)skb->data; 2044 2045 /* Detect a wide host of Chinese controllers that aren't CSR. 2046 * 2047 * Known fake bcdDevices: 0x0100, 0x0134, 0x1915, 0x2520, 0x7558, 0x8891 2048 * 2049 * The main thing they have in common is that these are really popular low-cost 2050 * options that support newer Bluetooth versions but rely on heavy VID/PID 2051 * squatting of this poor old Bluetooth 1.1 device. Even sold as such. 2052 * 2053 * We detect actual CSR devices by checking that the HCI manufacturer code 2054 * is Cambridge Silicon Radio (10) and ensuring that LMP sub-version and 2055 * HCI rev values always match. As they both store the firmware number. 2056 */ 2057 if (le16_to_cpu(rp->manufacturer) != 10 || 2058 le16_to_cpu(rp->hci_rev) != le16_to_cpu(rp->lmp_subver)) 2059 is_fake = true; 2060 2061 /* Known legit CSR firmware build numbers and their supported BT versions: 2062 * - 1.1 (0x1) -> 0x0073, 0x020d, 0x033c, 0x034e 2063 * - 1.2 (0x2) -> 0x04d9, 0x0529 2064 * - 2.0 (0x3) -> 0x07a6, 0x07ad, 0x0c5c 2065 * - 2.1 (0x4) -> 0x149c, 0x1735, 0x1899 (0x1899 is a BlueCore4-External) 2066 * - 4.0 (0x6) -> 0x1d86, 0x2031, 0x22bb 2067 * 2068 * e.g. Real CSR dongles with LMP subversion 0x73 are old enough that 2069 * support BT 1.1 only; so it's a dead giveaway when some 2070 * third-party BT 4.0 dongle reuses it. 2071 */ 2072 else if (le16_to_cpu(rp->lmp_subver) <= 0x034e && 2073 le16_to_cpu(rp->hci_ver) > BLUETOOTH_VER_1_1) 2074 is_fake = true; 2075 2076 else if (le16_to_cpu(rp->lmp_subver) <= 0x0529 && 2077 le16_to_cpu(rp->hci_ver) > BLUETOOTH_VER_1_2) 2078 is_fake = true; 2079 2080 else if (le16_to_cpu(rp->lmp_subver) <= 0x0c5c && 2081 le16_to_cpu(rp->hci_ver) > BLUETOOTH_VER_2_0) 2082 is_fake = true; 2083 2084 else if (le16_to_cpu(rp->lmp_subver) <= 0x1899 && 2085 le16_to_cpu(rp->hci_ver) > BLUETOOTH_VER_2_1) 2086 is_fake = true; 2087 2088 else if (le16_to_cpu(rp->lmp_subver) <= 0x22bb && 2089 le16_to_cpu(rp->hci_ver) > BLUETOOTH_VER_4_0) 2090 is_fake = true; 2091 2092 /* Other clones which beat all the above checks */ 2093 else if (bcdDevice == 0x0134 && 2094 le16_to_cpu(rp->lmp_subver) == 0x0c5c && 2095 le16_to_cpu(rp->hci_ver) == BLUETOOTH_VER_2_0) 2096 is_fake = true; 2097 2098 if (is_fake) { 2099 bt_dev_warn(hdev, "CSR: Unbranded CSR clone detected; adding workarounds and force-suspending once..."); 2100 2101 /* Generally these clones have big discrepancies between 2102 * advertised features and what's actually supported. 2103 * Probably will need to be expanded in the future; 2104 * without these the controller will lock up. 2105 */ 2106 set_bit(HCI_QUIRK_BROKEN_STORED_LINK_KEY, &hdev->quirks); 2107 set_bit(HCI_QUIRK_BROKEN_FILTER_CLEAR_ALL, &hdev->quirks); 2108 set_bit(HCI_QUIRK_NO_SUSPEND_NOTIFIER, &hdev->quirks); 2109 2110 /* Clear the reset quirk since this is not an actual 2111 * early Bluetooth 1.1 device from CSR. 2112 */ 2113 clear_bit(HCI_QUIRK_RESET_ON_CLOSE, &hdev->quirks); 2114 clear_bit(HCI_QUIRK_SIMULTANEOUS_DISCOVERY, &hdev->quirks); 2115 2116 /* 2117 * Special workaround for these BT 4.0 chip clones, and potentially more: 2118 * 2119 * - 0x0134: a Barrot 8041a02 (HCI rev: 0x0810 sub: 0x1012) 2120 * - 0x7558: IC markings FR3191AHAL 749H15143 (HCI rev/sub-version: 0x0709) 2121 * 2122 * These controllers are really messed-up. 2123 * 2124 * 1. Their bulk RX endpoint will never report any data unless 2125 * the device was suspended at least once (yes, really). 2126 * 2. They will not wakeup when autosuspended and receiving data 2127 * on their bulk RX endpoint from e.g. a keyboard or mouse 2128 * (IOW remote-wakeup support is broken for the bulk endpoint). 2129 * 2130 * To fix 1. enable runtime-suspend, force-suspend the 2131 * HCI and then wake-it up by disabling runtime-suspend. 2132 * 2133 * To fix 2. clear the HCI's can_wake flag, this way the HCI 2134 * will still be autosuspended when it is not open. 2135 * 2136 * -- 2137 * 2138 * Because these are widespread problems we prefer generic solutions; so 2139 * apply this initialization quirk to every controller that gets here, 2140 * it should be harmless. The alternative is to not work at all. 2141 */ 2142 pm_runtime_allow(&data->udev->dev); 2143 2144 ret = pm_runtime_suspend(&data->udev->dev); 2145 if (ret >= 0) 2146 msleep(200); 2147 else 2148 bt_dev_warn(hdev, "CSR: Couldn't suspend the device for our Barrot 8041a02 receive-issue workaround"); 2149 2150 pm_runtime_forbid(&data->udev->dev); 2151 2152 device_set_wakeup_capable(&data->udev->dev, false); 2153 2154 /* Re-enable autosuspend if this was requested */ 2155 if (enable_autosuspend) 2156 usb_enable_autosuspend(data->udev); 2157 } 2158 2159 kfree_skb(skb); 2160 2161 return 0; 2162 } 2163 2164 static int inject_cmd_complete(struct hci_dev *hdev, __u16 opcode) 2165 { 2166 struct sk_buff *skb; 2167 struct hci_event_hdr *hdr; 2168 struct hci_ev_cmd_complete *evt; 2169 2170 skb = bt_skb_alloc(sizeof(*hdr) + sizeof(*evt) + 1, GFP_KERNEL); 2171 if (!skb) 2172 return -ENOMEM; 2173 2174 hdr = skb_put(skb, sizeof(*hdr)); 2175 hdr->evt = HCI_EV_CMD_COMPLETE; 2176 hdr->plen = sizeof(*evt) + 1; 2177 2178 evt = skb_put(skb, sizeof(*evt)); 2179 evt->ncmd = 0x01; 2180 evt->opcode = cpu_to_le16(opcode); 2181 2182 skb_put_u8(skb, 0x00); 2183 2184 hci_skb_pkt_type(skb) = HCI_EVENT_PKT; 2185 2186 return hci_recv_frame(hdev, skb); 2187 } 2188 2189 static int btusb_recv_bulk_intel(struct btusb_data *data, void *buffer, 2190 int count) 2191 { 2192 struct hci_dev *hdev = data->hdev; 2193 2194 /* When the device is in bootloader mode, then it can send 2195 * events via the bulk endpoint. These events are treated the 2196 * same way as the ones received from the interrupt endpoint. 2197 */ 2198 if (btintel_test_flag(hdev, INTEL_BOOTLOADER)) 2199 return btusb_recv_intr(data, buffer, count); 2200 2201 return btusb_recv_bulk(data, buffer, count); 2202 } 2203 2204 static int btusb_recv_event_intel(struct hci_dev *hdev, struct sk_buff *skb) 2205 { 2206 if (btintel_test_flag(hdev, INTEL_BOOTLOADER)) { 2207 struct hci_event_hdr *hdr = (void *)skb->data; 2208 2209 if (skb->len > HCI_EVENT_HDR_SIZE && hdr->evt == 0xff && 2210 hdr->plen > 0) { 2211 const void *ptr = skb->data + HCI_EVENT_HDR_SIZE + 1; 2212 unsigned int len = skb->len - HCI_EVENT_HDR_SIZE - 1; 2213 2214 switch (skb->data[2]) { 2215 case 0x02: 2216 /* When switching to the operational firmware 2217 * the device sends a vendor specific event 2218 * indicating that the bootup completed. 2219 */ 2220 btintel_bootup(hdev, ptr, len); 2221 break; 2222 case 0x06: 2223 /* When the firmware loading completes the 2224 * device sends out a vendor specific event 2225 * indicating the result of the firmware 2226 * loading. 2227 */ 2228 btintel_secure_send_result(hdev, ptr, len); 2229 break; 2230 } 2231 } 2232 } 2233 2234 return hci_recv_frame(hdev, skb); 2235 } 2236 2237 static int btusb_send_frame_intel(struct hci_dev *hdev, struct sk_buff *skb) 2238 { 2239 struct urb *urb; 2240 2241 BT_DBG("%s", hdev->name); 2242 2243 switch (hci_skb_pkt_type(skb)) { 2244 case HCI_COMMAND_PKT: 2245 if (btintel_test_flag(hdev, INTEL_BOOTLOADER)) { 2246 struct hci_command_hdr *cmd = (void *)skb->data; 2247 __u16 opcode = le16_to_cpu(cmd->opcode); 2248 2249 /* When in bootloader mode and the command 0xfc09 2250 * is received, it needs to be send down the 2251 * bulk endpoint. So allocate a bulk URB instead. 2252 */ 2253 if (opcode == 0xfc09) 2254 urb = alloc_bulk_urb(hdev, skb); 2255 else 2256 urb = alloc_ctrl_urb(hdev, skb); 2257 2258 /* When the 0xfc01 command is issued to boot into 2259 * the operational firmware, it will actually not 2260 * send a command complete event. To keep the flow 2261 * control working inject that event here. 2262 */ 2263 if (opcode == 0xfc01) 2264 inject_cmd_complete(hdev, opcode); 2265 } else { 2266 urb = alloc_ctrl_urb(hdev, skb); 2267 } 2268 if (IS_ERR(urb)) 2269 return PTR_ERR(urb); 2270 2271 hdev->stat.cmd_tx++; 2272 return submit_or_queue_tx_urb(hdev, urb); 2273 2274 case HCI_ACLDATA_PKT: 2275 urb = alloc_bulk_urb(hdev, skb); 2276 if (IS_ERR(urb)) 2277 return PTR_ERR(urb); 2278 2279 hdev->stat.acl_tx++; 2280 return submit_or_queue_tx_urb(hdev, urb); 2281 2282 case HCI_SCODATA_PKT: 2283 if (hci_conn_num(hdev, SCO_LINK) < 1) 2284 return -ENODEV; 2285 2286 urb = alloc_isoc_urb(hdev, skb); 2287 if (IS_ERR(urb)) 2288 return PTR_ERR(urb); 2289 2290 hdev->stat.sco_tx++; 2291 return submit_tx_urb(hdev, urb); 2292 2293 case HCI_ISODATA_PKT: 2294 urb = alloc_bulk_urb(hdev, skb); 2295 if (IS_ERR(urb)) 2296 return PTR_ERR(urb); 2297 2298 return submit_or_queue_tx_urb(hdev, urb); 2299 } 2300 2301 return -EILSEQ; 2302 } 2303 2304 /* UHW CR mapping */ 2305 #define MTK_BT_MISC 0x70002510 2306 #define MTK_BT_SUBSYS_RST 0x70002610 2307 #define MTK_UDMA_INT_STA_BT 0x74000024 2308 #define MTK_UDMA_INT_STA_BT1 0x74000308 2309 #define MTK_BT_WDT_STATUS 0x740003A0 2310 #define MTK_EP_RST_OPT 0x74011890 2311 #define MTK_EP_RST_IN_OUT_OPT 0x00010001 2312 #define MTK_BT_RST_DONE 0x00000100 2313 #define MTK_BT_RESET_WAIT_MS 100 2314 #define MTK_BT_RESET_NUM_TRIES 10 2315 2316 static void btusb_mtk_wmt_recv(struct urb *urb) 2317 { 2318 struct hci_dev *hdev = urb->context; 2319 struct btusb_data *data = hci_get_drvdata(hdev); 2320 struct sk_buff *skb; 2321 int err; 2322 2323 if (urb->status == 0 && urb->actual_length > 0) { 2324 hdev->stat.byte_rx += urb->actual_length; 2325 2326 /* WMT event shouldn't be fragmented and the size should be 2327 * less than HCI_WMT_MAX_EVENT_SIZE. 2328 */ 2329 skb = bt_skb_alloc(HCI_WMT_MAX_EVENT_SIZE, GFP_ATOMIC); 2330 if (!skb) { 2331 hdev->stat.err_rx++; 2332 kfree(urb->setup_packet); 2333 return; 2334 } 2335 2336 hci_skb_pkt_type(skb) = HCI_EVENT_PKT; 2337 skb_put_data(skb, urb->transfer_buffer, urb->actual_length); 2338 2339 /* When someone waits for the WMT event, the skb is being cloned 2340 * and being processed the events from there then. 2341 */ 2342 if (test_bit(BTUSB_TX_WAIT_VND_EVT, &data->flags)) { 2343 data->evt_skb = skb_clone(skb, GFP_ATOMIC); 2344 if (!data->evt_skb) { 2345 kfree_skb(skb); 2346 kfree(urb->setup_packet); 2347 return; 2348 } 2349 } 2350 2351 err = hci_recv_frame(hdev, skb); 2352 if (err < 0) { 2353 kfree_skb(data->evt_skb); 2354 data->evt_skb = NULL; 2355 kfree(urb->setup_packet); 2356 return; 2357 } 2358 2359 if (test_and_clear_bit(BTUSB_TX_WAIT_VND_EVT, 2360 &data->flags)) { 2361 /* Barrier to sync with other CPUs */ 2362 smp_mb__after_atomic(); 2363 wake_up_bit(&data->flags, 2364 BTUSB_TX_WAIT_VND_EVT); 2365 } 2366 kfree(urb->setup_packet); 2367 return; 2368 } else if (urb->status == -ENOENT) { 2369 /* Avoid suspend failed when usb_kill_urb */ 2370 return; 2371 } 2372 2373 usb_mark_last_busy(data->udev); 2374 2375 /* The URB complete handler is still called with urb->actual_length = 0 2376 * when the event is not available, so we should keep re-submitting 2377 * URB until WMT event returns, Also, It's necessary to wait some time 2378 * between the two consecutive control URBs to relax the target device 2379 * to generate the event. Otherwise, the WMT event cannot return from 2380 * the device successfully. 2381 */ 2382 udelay(500); 2383 2384 usb_anchor_urb(urb, &data->ctrl_anchor); 2385 err = usb_submit_urb(urb, GFP_ATOMIC); 2386 if (err < 0) { 2387 kfree(urb->setup_packet); 2388 /* -EPERM: urb is being killed; 2389 * -ENODEV: device got disconnected 2390 */ 2391 if (err != -EPERM && err != -ENODEV) 2392 bt_dev_err(hdev, "urb %p failed to resubmit (%d)", 2393 urb, -err); 2394 usb_unanchor_urb(urb); 2395 } 2396 } 2397 2398 static int btusb_mtk_submit_wmt_recv_urb(struct hci_dev *hdev) 2399 { 2400 struct btusb_data *data = hci_get_drvdata(hdev); 2401 struct usb_ctrlrequest *dr; 2402 unsigned char *buf; 2403 int err, size = 64; 2404 unsigned int pipe; 2405 struct urb *urb; 2406 2407 urb = usb_alloc_urb(0, GFP_KERNEL); 2408 if (!urb) 2409 return -ENOMEM; 2410 2411 dr = kmalloc(sizeof(*dr), GFP_KERNEL); 2412 if (!dr) { 2413 usb_free_urb(urb); 2414 return -ENOMEM; 2415 } 2416 2417 dr->bRequestType = USB_TYPE_VENDOR | USB_DIR_IN; 2418 dr->bRequest = 1; 2419 dr->wIndex = cpu_to_le16(0); 2420 dr->wValue = cpu_to_le16(48); 2421 dr->wLength = cpu_to_le16(size); 2422 2423 buf = kmalloc(size, GFP_KERNEL); 2424 if (!buf) { 2425 kfree(dr); 2426 usb_free_urb(urb); 2427 return -ENOMEM; 2428 } 2429 2430 pipe = usb_rcvctrlpipe(data->udev, 0); 2431 2432 usb_fill_control_urb(urb, data->udev, pipe, (void *)dr, 2433 buf, size, btusb_mtk_wmt_recv, hdev); 2434 2435 urb->transfer_flags |= URB_FREE_BUFFER; 2436 2437 usb_anchor_urb(urb, &data->ctrl_anchor); 2438 err = usb_submit_urb(urb, GFP_KERNEL); 2439 if (err < 0) { 2440 if (err != -EPERM && err != -ENODEV) 2441 bt_dev_err(hdev, "urb %p submission failed (%d)", 2442 urb, -err); 2443 usb_unanchor_urb(urb); 2444 } 2445 2446 usb_free_urb(urb); 2447 2448 return err; 2449 } 2450 2451 static int btusb_mtk_hci_wmt_sync(struct hci_dev *hdev, 2452 struct btmtk_hci_wmt_params *wmt_params) 2453 { 2454 struct btusb_data *data = hci_get_drvdata(hdev); 2455 struct btmtk_hci_wmt_evt_funcc *wmt_evt_funcc; 2456 u32 hlen, status = BTMTK_WMT_INVALID; 2457 struct btmtk_hci_wmt_evt *wmt_evt; 2458 struct btmtk_hci_wmt_cmd *wc; 2459 struct btmtk_wmt_hdr *hdr; 2460 int err; 2461 2462 /* Send the WMT command and wait until the WMT event returns */ 2463 hlen = sizeof(*hdr) + wmt_params->dlen; 2464 if (hlen > 255) 2465 return -EINVAL; 2466 2467 wc = kzalloc(hlen, GFP_KERNEL); 2468 if (!wc) 2469 return -ENOMEM; 2470 2471 hdr = &wc->hdr; 2472 hdr->dir = 1; 2473 hdr->op = wmt_params->op; 2474 hdr->dlen = cpu_to_le16(wmt_params->dlen + 1); 2475 hdr->flag = wmt_params->flag; 2476 memcpy(wc->data, wmt_params->data, wmt_params->dlen); 2477 2478 set_bit(BTUSB_TX_WAIT_VND_EVT, &data->flags); 2479 2480 err = __hci_cmd_send(hdev, 0xfc6f, hlen, wc); 2481 2482 if (err < 0) { 2483 clear_bit(BTUSB_TX_WAIT_VND_EVT, &data->flags); 2484 goto err_free_wc; 2485 } 2486 2487 /* Submit control IN URB on demand to process the WMT event */ 2488 err = btusb_mtk_submit_wmt_recv_urb(hdev); 2489 if (err < 0) 2490 goto err_free_wc; 2491 2492 /* The vendor specific WMT commands are all answered by a vendor 2493 * specific event and will have the Command Status or Command 2494 * Complete as with usual HCI command flow control. 2495 * 2496 * After sending the command, wait for BTUSB_TX_WAIT_VND_EVT 2497 * state to be cleared. The driver specific event receive routine 2498 * will clear that state and with that indicate completion of the 2499 * WMT command. 2500 */ 2501 err = wait_on_bit_timeout(&data->flags, BTUSB_TX_WAIT_VND_EVT, 2502 TASK_INTERRUPTIBLE, HCI_INIT_TIMEOUT); 2503 if (err == -EINTR) { 2504 bt_dev_err(hdev, "Execution of wmt command interrupted"); 2505 clear_bit(BTUSB_TX_WAIT_VND_EVT, &data->flags); 2506 goto err_free_wc; 2507 } 2508 2509 if (err) { 2510 bt_dev_err(hdev, "Execution of wmt command timed out"); 2511 clear_bit(BTUSB_TX_WAIT_VND_EVT, &data->flags); 2512 err = -ETIMEDOUT; 2513 goto err_free_wc; 2514 } 2515 2516 /* Parse and handle the return WMT event */ 2517 wmt_evt = (struct btmtk_hci_wmt_evt *)data->evt_skb->data; 2518 if (wmt_evt->whdr.op != hdr->op) { 2519 bt_dev_err(hdev, "Wrong op received %d expected %d", 2520 wmt_evt->whdr.op, hdr->op); 2521 err = -EIO; 2522 goto err_free_skb; 2523 } 2524 2525 switch (wmt_evt->whdr.op) { 2526 case BTMTK_WMT_SEMAPHORE: 2527 if (wmt_evt->whdr.flag == 2) 2528 status = BTMTK_WMT_PATCH_UNDONE; 2529 else 2530 status = BTMTK_WMT_PATCH_DONE; 2531 break; 2532 case BTMTK_WMT_FUNC_CTRL: 2533 wmt_evt_funcc = (struct btmtk_hci_wmt_evt_funcc *)wmt_evt; 2534 if (be16_to_cpu(wmt_evt_funcc->status) == 0x404) 2535 status = BTMTK_WMT_ON_DONE; 2536 else if (be16_to_cpu(wmt_evt_funcc->status) == 0x420) 2537 status = BTMTK_WMT_ON_PROGRESS; 2538 else 2539 status = BTMTK_WMT_ON_UNDONE; 2540 break; 2541 case BTMTK_WMT_PATCH_DWNLD: 2542 if (wmt_evt->whdr.flag == 2) 2543 status = BTMTK_WMT_PATCH_DONE; 2544 else if (wmt_evt->whdr.flag == 1) 2545 status = BTMTK_WMT_PATCH_PROGRESS; 2546 else 2547 status = BTMTK_WMT_PATCH_UNDONE; 2548 break; 2549 } 2550 2551 if (wmt_params->status) 2552 *wmt_params->status = status; 2553 2554 err_free_skb: 2555 kfree_skb(data->evt_skb); 2556 data->evt_skb = NULL; 2557 err_free_wc: 2558 kfree(wc); 2559 return err; 2560 } 2561 2562 static int btusb_mtk_func_query(struct hci_dev *hdev) 2563 { 2564 struct btmtk_hci_wmt_params wmt_params; 2565 int status, err; 2566 u8 param = 0; 2567 2568 /* Query whether the function is enabled */ 2569 wmt_params.op = BTMTK_WMT_FUNC_CTRL; 2570 wmt_params.flag = 4; 2571 wmt_params.dlen = sizeof(param); 2572 wmt_params.data = ¶m; 2573 wmt_params.status = &status; 2574 2575 err = btusb_mtk_hci_wmt_sync(hdev, &wmt_params); 2576 if (err < 0) { 2577 bt_dev_err(hdev, "Failed to query function status (%d)", err); 2578 return err; 2579 } 2580 2581 return status; 2582 } 2583 2584 static int btusb_mtk_uhw_reg_write(struct btusb_data *data, u32 reg, u32 val) 2585 { 2586 struct hci_dev *hdev = data->hdev; 2587 int pipe, err; 2588 void *buf; 2589 2590 buf = kzalloc(4, GFP_KERNEL); 2591 if (!buf) 2592 return -ENOMEM; 2593 2594 put_unaligned_le32(val, buf); 2595 2596 pipe = usb_sndctrlpipe(data->udev, 0); 2597 err = usb_control_msg(data->udev, pipe, 0x02, 2598 0x5E, 2599 reg >> 16, reg & 0xffff, 2600 buf, 4, USB_CTRL_SET_TIMEOUT); 2601 if (err < 0) { 2602 bt_dev_err(hdev, "Failed to write uhw reg(%d)", err); 2603 goto err_free_buf; 2604 } 2605 2606 err_free_buf: 2607 kfree(buf); 2608 2609 return err; 2610 } 2611 2612 static int btusb_mtk_uhw_reg_read(struct btusb_data *data, u32 reg, u32 *val) 2613 { 2614 struct hci_dev *hdev = data->hdev; 2615 int pipe, err; 2616 void *buf; 2617 2618 buf = kzalloc(4, GFP_KERNEL); 2619 if (!buf) 2620 return -ENOMEM; 2621 2622 pipe = usb_rcvctrlpipe(data->udev, 0); 2623 err = usb_control_msg(data->udev, pipe, 0x01, 2624 0xDE, 2625 reg >> 16, reg & 0xffff, 2626 buf, 4, USB_CTRL_SET_TIMEOUT); 2627 if (err < 0) { 2628 bt_dev_err(hdev, "Failed to read uhw reg(%d)", err); 2629 goto err_free_buf; 2630 } 2631 2632 *val = get_unaligned_le32(buf); 2633 bt_dev_dbg(hdev, "reg=%x, value=0x%08x", reg, *val); 2634 2635 err_free_buf: 2636 kfree(buf); 2637 2638 return err; 2639 } 2640 2641 static int btusb_mtk_reg_read(struct btusb_data *data, u32 reg, u32 *val) 2642 { 2643 int pipe, err, size = sizeof(u32); 2644 void *buf; 2645 2646 buf = kzalloc(size, GFP_KERNEL); 2647 if (!buf) 2648 return -ENOMEM; 2649 2650 pipe = usb_rcvctrlpipe(data->udev, 0); 2651 err = usb_control_msg(data->udev, pipe, 0x63, 2652 USB_TYPE_VENDOR | USB_DIR_IN, 2653 reg >> 16, reg & 0xffff, 2654 buf, size, USB_CTRL_SET_TIMEOUT); 2655 if (err < 0) 2656 goto err_free_buf; 2657 2658 *val = get_unaligned_le32(buf); 2659 2660 err_free_buf: 2661 kfree(buf); 2662 2663 return err; 2664 } 2665 2666 static int btusb_mtk_id_get(struct btusb_data *data, u32 reg, u32 *id) 2667 { 2668 return btusb_mtk_reg_read(data, reg, id); 2669 } 2670 2671 static int btusb_mtk_setup(struct hci_dev *hdev) 2672 { 2673 struct btusb_data *data = hci_get_drvdata(hdev); 2674 struct btmtk_hci_wmt_params wmt_params; 2675 ktime_t calltime, delta, rettime; 2676 struct btmtk_tci_sleep tci_sleep; 2677 unsigned long long duration; 2678 struct sk_buff *skb; 2679 const char *fwname; 2680 int err, status; 2681 u32 dev_id; 2682 char fw_bin_name[64]; 2683 u32 fw_version = 0; 2684 u8 param; 2685 2686 calltime = ktime_get(); 2687 2688 err = btusb_mtk_id_get(data, 0x80000008, &dev_id); 2689 if (err < 0) { 2690 bt_dev_err(hdev, "Failed to get device id (%d)", err); 2691 return err; 2692 } 2693 2694 if (!dev_id) { 2695 err = btusb_mtk_id_get(data, 0x70010200, &dev_id); 2696 if (err < 0) { 2697 bt_dev_err(hdev, "Failed to get device id (%d)", err); 2698 return err; 2699 } 2700 err = btusb_mtk_id_get(data, 0x80021004, &fw_version); 2701 if (err < 0) { 2702 bt_dev_err(hdev, "Failed to get fw version (%d)", err); 2703 return err; 2704 } 2705 } 2706 2707 switch (dev_id) { 2708 case 0x7663: 2709 fwname = FIRMWARE_MT7663; 2710 break; 2711 case 0x7668: 2712 fwname = FIRMWARE_MT7668; 2713 break; 2714 case 0x7922: 2715 case 0x7961: 2716 snprintf(fw_bin_name, sizeof(fw_bin_name), 2717 "mediatek/BT_RAM_CODE_MT%04x_1_%x_hdr.bin", 2718 dev_id & 0xffff, (fw_version & 0xff) + 1); 2719 err = btmtk_setup_firmware_79xx(hdev, fw_bin_name, 2720 btusb_mtk_hci_wmt_sync); 2721 if (err < 0) { 2722 bt_dev_err(hdev, "Failed to set up firmware (%d)", err); 2723 return err; 2724 } 2725 2726 /* It's Device EndPoint Reset Option Register */ 2727 btusb_mtk_uhw_reg_write(data, MTK_EP_RST_OPT, MTK_EP_RST_IN_OUT_OPT); 2728 2729 /* Enable Bluetooth protocol */ 2730 param = 1; 2731 wmt_params.op = BTMTK_WMT_FUNC_CTRL; 2732 wmt_params.flag = 0; 2733 wmt_params.dlen = sizeof(param); 2734 wmt_params.data = ¶m; 2735 wmt_params.status = NULL; 2736 2737 err = btusb_mtk_hci_wmt_sync(hdev, &wmt_params); 2738 if (err < 0) { 2739 bt_dev_err(hdev, "Failed to send wmt func ctrl (%d)", err); 2740 return err; 2741 } 2742 2743 hci_set_msft_opcode(hdev, 0xFD30); 2744 hci_set_aosp_capable(hdev); 2745 goto done; 2746 default: 2747 bt_dev_err(hdev, "Unsupported hardware variant (%08x)", 2748 dev_id); 2749 return -ENODEV; 2750 } 2751 2752 /* Query whether the firmware is already download */ 2753 wmt_params.op = BTMTK_WMT_SEMAPHORE; 2754 wmt_params.flag = 1; 2755 wmt_params.dlen = 0; 2756 wmt_params.data = NULL; 2757 wmt_params.status = &status; 2758 2759 err = btusb_mtk_hci_wmt_sync(hdev, &wmt_params); 2760 if (err < 0) { 2761 bt_dev_err(hdev, "Failed to query firmware status (%d)", err); 2762 return err; 2763 } 2764 2765 if (status == BTMTK_WMT_PATCH_DONE) { 2766 bt_dev_info(hdev, "firmware already downloaded"); 2767 goto ignore_setup_fw; 2768 } 2769 2770 /* Setup a firmware which the device definitely requires */ 2771 err = btmtk_setup_firmware(hdev, fwname, 2772 btusb_mtk_hci_wmt_sync); 2773 if (err < 0) 2774 return err; 2775 2776 ignore_setup_fw: 2777 err = readx_poll_timeout(btusb_mtk_func_query, hdev, status, 2778 status < 0 || status != BTMTK_WMT_ON_PROGRESS, 2779 2000, 5000000); 2780 /* -ETIMEDOUT happens */ 2781 if (err < 0) 2782 return err; 2783 2784 /* The other errors happen in btusb_mtk_func_query */ 2785 if (status < 0) 2786 return status; 2787 2788 if (status == BTMTK_WMT_ON_DONE) { 2789 bt_dev_info(hdev, "function already on"); 2790 goto ignore_func_on; 2791 } 2792 2793 /* Enable Bluetooth protocol */ 2794 param = 1; 2795 wmt_params.op = BTMTK_WMT_FUNC_CTRL; 2796 wmt_params.flag = 0; 2797 wmt_params.dlen = sizeof(param); 2798 wmt_params.data = ¶m; 2799 wmt_params.status = NULL; 2800 2801 err = btusb_mtk_hci_wmt_sync(hdev, &wmt_params); 2802 if (err < 0) { 2803 bt_dev_err(hdev, "Failed to send wmt func ctrl (%d)", err); 2804 return err; 2805 } 2806 2807 ignore_func_on: 2808 /* Apply the low power environment setup */ 2809 tci_sleep.mode = 0x5; 2810 tci_sleep.duration = cpu_to_le16(0x640); 2811 tci_sleep.host_duration = cpu_to_le16(0x640); 2812 tci_sleep.host_wakeup_pin = 0; 2813 tci_sleep.time_compensation = 0; 2814 2815 skb = __hci_cmd_sync(hdev, 0xfc7a, sizeof(tci_sleep), &tci_sleep, 2816 HCI_INIT_TIMEOUT); 2817 if (IS_ERR(skb)) { 2818 err = PTR_ERR(skb); 2819 bt_dev_err(hdev, "Failed to apply low power setting (%d)", err); 2820 return err; 2821 } 2822 kfree_skb(skb); 2823 2824 done: 2825 rettime = ktime_get(); 2826 delta = ktime_sub(rettime, calltime); 2827 duration = (unsigned long long)ktime_to_ns(delta) >> 10; 2828 2829 bt_dev_info(hdev, "Device setup in %llu usecs", duration); 2830 2831 return 0; 2832 } 2833 2834 static int btusb_mtk_shutdown(struct hci_dev *hdev) 2835 { 2836 struct btmtk_hci_wmt_params wmt_params; 2837 u8 param = 0; 2838 int err; 2839 2840 /* Disable the device */ 2841 wmt_params.op = BTMTK_WMT_FUNC_CTRL; 2842 wmt_params.flag = 0; 2843 wmt_params.dlen = sizeof(param); 2844 wmt_params.data = ¶m; 2845 wmt_params.status = NULL; 2846 2847 err = btusb_mtk_hci_wmt_sync(hdev, &wmt_params); 2848 if (err < 0) { 2849 bt_dev_err(hdev, "Failed to send wmt func ctrl (%d)", err); 2850 return err; 2851 } 2852 2853 return 0; 2854 } 2855 2856 static void btusb_mtk_cmd_timeout(struct hci_dev *hdev) 2857 { 2858 struct btusb_data *data = hci_get_drvdata(hdev); 2859 u32 val; 2860 int err, retry = 0; 2861 2862 /* It's MediaTek specific bluetooth reset mechanism via USB */ 2863 if (test_and_set_bit(BTUSB_HW_RESET_ACTIVE, &data->flags)) { 2864 bt_dev_err(hdev, "last reset failed? Not resetting again"); 2865 return; 2866 } 2867 2868 err = usb_autopm_get_interface(data->intf); 2869 if (err < 0) 2870 return; 2871 2872 btusb_stop_traffic(data); 2873 usb_kill_anchored_urbs(&data->tx_anchor); 2874 2875 /* It's Device EndPoint Reset Option Register */ 2876 bt_dev_dbg(hdev, "Initiating reset mechanism via uhw"); 2877 btusb_mtk_uhw_reg_write(data, MTK_EP_RST_OPT, MTK_EP_RST_IN_OUT_OPT); 2878 btusb_mtk_uhw_reg_read(data, MTK_BT_WDT_STATUS, &val); 2879 2880 /* Reset the bluetooth chip via USB interface. */ 2881 btusb_mtk_uhw_reg_write(data, MTK_BT_SUBSYS_RST, 1); 2882 btusb_mtk_uhw_reg_write(data, MTK_UDMA_INT_STA_BT, 0x000000FF); 2883 btusb_mtk_uhw_reg_read(data, MTK_UDMA_INT_STA_BT, &val); 2884 btusb_mtk_uhw_reg_write(data, MTK_UDMA_INT_STA_BT1, 0x000000FF); 2885 btusb_mtk_uhw_reg_read(data, MTK_UDMA_INT_STA_BT1, &val); 2886 /* MT7921 need to delay 20ms between toggle reset bit */ 2887 msleep(20); 2888 btusb_mtk_uhw_reg_write(data, MTK_BT_SUBSYS_RST, 0); 2889 btusb_mtk_uhw_reg_read(data, MTK_BT_SUBSYS_RST, &val); 2890 2891 /* Poll the register until reset is completed */ 2892 do { 2893 btusb_mtk_uhw_reg_read(data, MTK_BT_MISC, &val); 2894 if (val & MTK_BT_RST_DONE) { 2895 bt_dev_dbg(hdev, "Bluetooth Reset Successfully"); 2896 break; 2897 } 2898 2899 bt_dev_dbg(hdev, "Polling Bluetooth Reset CR"); 2900 retry++; 2901 msleep(MTK_BT_RESET_WAIT_MS); 2902 } while (retry < MTK_BT_RESET_NUM_TRIES); 2903 2904 btusb_mtk_id_get(data, 0x70010200, &val); 2905 if (!val) 2906 bt_dev_err(hdev, "Can't get device id, subsys reset fail."); 2907 2908 usb_queue_reset_device(data->intf); 2909 2910 clear_bit(BTUSB_HW_RESET_ACTIVE, &data->flags); 2911 } 2912 2913 static int btusb_recv_acl_mtk(struct hci_dev *hdev, struct sk_buff *skb) 2914 { 2915 struct btusb_data *data = hci_get_drvdata(hdev); 2916 u16 handle = le16_to_cpu(hci_acl_hdr(skb)->handle); 2917 2918 switch (handle) { 2919 case 0xfc6f: /* Firmware dump from device */ 2920 /* When the firmware hangs, the device can no longer 2921 * suspend and thus disable auto-suspend. 2922 */ 2923 usb_disable_autosuspend(data->udev); 2924 fallthrough; 2925 case 0x05ff: /* Firmware debug logging 1 */ 2926 case 0x05fe: /* Firmware debug logging 2 */ 2927 return hci_recv_diag(hdev, skb); 2928 } 2929 2930 return hci_recv_frame(hdev, skb); 2931 } 2932 2933 #ifdef CONFIG_PM 2934 /* Configure an out-of-band gpio as wake-up pin, if specified in device tree */ 2935 static int marvell_config_oob_wake(struct hci_dev *hdev) 2936 { 2937 struct sk_buff *skb; 2938 struct btusb_data *data = hci_get_drvdata(hdev); 2939 struct device *dev = &data->udev->dev; 2940 u16 pin, gap, opcode; 2941 int ret; 2942 u8 cmd[5]; 2943 2944 /* Move on if no wakeup pin specified */ 2945 if (of_property_read_u16(dev->of_node, "marvell,wakeup-pin", &pin) || 2946 of_property_read_u16(dev->of_node, "marvell,wakeup-gap-ms", &gap)) 2947 return 0; 2948 2949 /* Vendor specific command to configure a GPIO as wake-up pin */ 2950 opcode = hci_opcode_pack(0x3F, 0x59); 2951 cmd[0] = opcode & 0xFF; 2952 cmd[1] = opcode >> 8; 2953 cmd[2] = 2; /* length of parameters that follow */ 2954 cmd[3] = pin; 2955 cmd[4] = gap; /* time in ms, for which wakeup pin should be asserted */ 2956 2957 skb = bt_skb_alloc(sizeof(cmd), GFP_KERNEL); 2958 if (!skb) { 2959 bt_dev_err(hdev, "%s: No memory", __func__); 2960 return -ENOMEM; 2961 } 2962 2963 skb_put_data(skb, cmd, sizeof(cmd)); 2964 hci_skb_pkt_type(skb) = HCI_COMMAND_PKT; 2965 2966 ret = btusb_send_frame(hdev, skb); 2967 if (ret) { 2968 bt_dev_err(hdev, "%s: configuration failed", __func__); 2969 kfree_skb(skb); 2970 return ret; 2971 } 2972 2973 return 0; 2974 } 2975 #endif 2976 2977 static int btusb_set_bdaddr_marvell(struct hci_dev *hdev, 2978 const bdaddr_t *bdaddr) 2979 { 2980 struct sk_buff *skb; 2981 u8 buf[8]; 2982 long ret; 2983 2984 buf[0] = 0xfe; 2985 buf[1] = sizeof(bdaddr_t); 2986 memcpy(buf + 2, bdaddr, sizeof(bdaddr_t)); 2987 2988 skb = __hci_cmd_sync(hdev, 0xfc22, sizeof(buf), buf, HCI_INIT_TIMEOUT); 2989 if (IS_ERR(skb)) { 2990 ret = PTR_ERR(skb); 2991 bt_dev_err(hdev, "changing Marvell device address failed (%ld)", 2992 ret); 2993 return ret; 2994 } 2995 kfree_skb(skb); 2996 2997 return 0; 2998 } 2999 3000 static int btusb_set_bdaddr_ath3012(struct hci_dev *hdev, 3001 const bdaddr_t *bdaddr) 3002 { 3003 struct sk_buff *skb; 3004 u8 buf[10]; 3005 long ret; 3006 3007 buf[0] = 0x01; 3008 buf[1] = 0x01; 3009 buf[2] = 0x00; 3010 buf[3] = sizeof(bdaddr_t); 3011 memcpy(buf + 4, bdaddr, sizeof(bdaddr_t)); 3012 3013 skb = __hci_cmd_sync(hdev, 0xfc0b, sizeof(buf), buf, HCI_INIT_TIMEOUT); 3014 if (IS_ERR(skb)) { 3015 ret = PTR_ERR(skb); 3016 bt_dev_err(hdev, "Change address command failed (%ld)", ret); 3017 return ret; 3018 } 3019 kfree_skb(skb); 3020 3021 return 0; 3022 } 3023 3024 static int btusb_set_bdaddr_wcn6855(struct hci_dev *hdev, 3025 const bdaddr_t *bdaddr) 3026 { 3027 struct sk_buff *skb; 3028 u8 buf[6]; 3029 long ret; 3030 3031 memcpy(buf, bdaddr, sizeof(bdaddr_t)); 3032 3033 skb = __hci_cmd_sync_ev(hdev, 0xfc14, sizeof(buf), buf, 3034 HCI_EV_CMD_COMPLETE, HCI_INIT_TIMEOUT); 3035 if (IS_ERR(skb)) { 3036 ret = PTR_ERR(skb); 3037 bt_dev_err(hdev, "Change address command failed (%ld)", ret); 3038 return ret; 3039 } 3040 kfree_skb(skb); 3041 3042 return 0; 3043 } 3044 3045 #define QCA_DFU_PACKET_LEN 4096 3046 3047 #define QCA_GET_TARGET_VERSION 0x09 3048 #define QCA_CHECK_STATUS 0x05 3049 #define QCA_DFU_DOWNLOAD 0x01 3050 3051 #define QCA_SYSCFG_UPDATED 0x40 3052 #define QCA_PATCH_UPDATED 0x80 3053 #define QCA_DFU_TIMEOUT 3000 3054 #define QCA_FLAG_MULTI_NVM 0x80 3055 #define QCA_BT_RESET_WAIT_MS 100 3056 3057 #define WCN6855_2_0_RAM_VERSION_GF 0x400c1200 3058 #define WCN6855_2_1_RAM_VERSION_GF 0x400c1211 3059 3060 struct qca_version { 3061 __le32 rom_version; 3062 __le32 patch_version; 3063 __le32 ram_version; 3064 __u8 chip_id; 3065 __u8 platform_id; 3066 __le16 flag; 3067 __u8 reserved[4]; 3068 } __packed; 3069 3070 struct qca_rampatch_version { 3071 __le16 rom_version_high; 3072 __le16 rom_version_low; 3073 __le16 patch_version; 3074 } __packed; 3075 3076 struct qca_device_info { 3077 u32 rom_version; 3078 u8 rampatch_hdr; /* length of header in rampatch */ 3079 u8 nvm_hdr; /* length of header in NVM */ 3080 u8 ver_offset; /* offset of version structure in rampatch */ 3081 }; 3082 3083 static const struct qca_device_info qca_devices_table[] = { 3084 { 0x00000100, 20, 4, 8 }, /* Rome 1.0 */ 3085 { 0x00000101, 20, 4, 8 }, /* Rome 1.1 */ 3086 { 0x00000200, 28, 4, 16 }, /* Rome 2.0 */ 3087 { 0x00000201, 28, 4, 16 }, /* Rome 2.1 */ 3088 { 0x00000300, 28, 4, 16 }, /* Rome 3.0 */ 3089 { 0x00000302, 28, 4, 16 }, /* Rome 3.2 */ 3090 { 0x00130100, 40, 4, 16 }, /* WCN6855 1.0 */ 3091 { 0x00130200, 40, 4, 16 }, /* WCN6855 2.0 */ 3092 { 0x00130201, 40, 4, 16 }, /* WCN6855 2.1 */ 3093 { 0x00190200, 40, 4, 16 }, /* WCN785x 2.0 */ 3094 }; 3095 3096 static int btusb_qca_send_vendor_req(struct usb_device *udev, u8 request, 3097 void *data, u16 size) 3098 { 3099 int pipe, err; 3100 u8 *buf; 3101 3102 buf = kmalloc(size, GFP_KERNEL); 3103 if (!buf) 3104 return -ENOMEM; 3105 3106 /* Found some of USB hosts have IOT issues with ours so that we should 3107 * not wait until HCI layer is ready. 3108 */ 3109 pipe = usb_rcvctrlpipe(udev, 0); 3110 err = usb_control_msg(udev, pipe, request, USB_TYPE_VENDOR | USB_DIR_IN, 3111 0, 0, buf, size, USB_CTRL_SET_TIMEOUT); 3112 if (err < 0) { 3113 dev_err(&udev->dev, "Failed to access otp area (%d)", err); 3114 goto done; 3115 } 3116 3117 memcpy(data, buf, size); 3118 3119 done: 3120 kfree(buf); 3121 3122 return err; 3123 } 3124 3125 static int btusb_setup_qca_download_fw(struct hci_dev *hdev, 3126 const struct firmware *firmware, 3127 size_t hdr_size) 3128 { 3129 struct btusb_data *btdata = hci_get_drvdata(hdev); 3130 struct usb_device *udev = btdata->udev; 3131 size_t count, size, sent = 0; 3132 int pipe, len, err; 3133 u8 *buf; 3134 3135 buf = kmalloc(QCA_DFU_PACKET_LEN, GFP_KERNEL); 3136 if (!buf) 3137 return -ENOMEM; 3138 3139 count = firmware->size; 3140 3141 size = min_t(size_t, count, hdr_size); 3142 memcpy(buf, firmware->data, size); 3143 3144 /* USB patches should go down to controller through USB path 3145 * because binary format fits to go down through USB channel. 3146 * USB control path is for patching headers and USB bulk is for 3147 * patch body. 3148 */ 3149 pipe = usb_sndctrlpipe(udev, 0); 3150 err = usb_control_msg(udev, pipe, QCA_DFU_DOWNLOAD, USB_TYPE_VENDOR, 3151 0, 0, buf, size, USB_CTRL_SET_TIMEOUT); 3152 if (err < 0) { 3153 bt_dev_err(hdev, "Failed to send headers (%d)", err); 3154 goto done; 3155 } 3156 3157 sent += size; 3158 count -= size; 3159 3160 /* ep2 need time to switch from function acl to function dfu, 3161 * so we add 20ms delay here. 3162 */ 3163 msleep(20); 3164 3165 while (count) { 3166 size = min_t(size_t, count, QCA_DFU_PACKET_LEN); 3167 3168 memcpy(buf, firmware->data + sent, size); 3169 3170 pipe = usb_sndbulkpipe(udev, 0x02); 3171 err = usb_bulk_msg(udev, pipe, buf, size, &len, 3172 QCA_DFU_TIMEOUT); 3173 if (err < 0) { 3174 bt_dev_err(hdev, "Failed to send body at %zd of %zd (%d)", 3175 sent, firmware->size, err); 3176 break; 3177 } 3178 3179 if (size != len) { 3180 bt_dev_err(hdev, "Failed to get bulk buffer"); 3181 err = -EILSEQ; 3182 break; 3183 } 3184 3185 sent += size; 3186 count -= size; 3187 } 3188 3189 done: 3190 kfree(buf); 3191 return err; 3192 } 3193 3194 static int btusb_setup_qca_load_rampatch(struct hci_dev *hdev, 3195 struct qca_version *ver, 3196 const struct qca_device_info *info) 3197 { 3198 struct qca_rampatch_version *rver; 3199 const struct firmware *fw; 3200 u32 ver_rom, ver_patch, rver_rom; 3201 u16 rver_rom_low, rver_rom_high, rver_patch; 3202 char fwname[64]; 3203 int err; 3204 3205 ver_rom = le32_to_cpu(ver->rom_version); 3206 ver_patch = le32_to_cpu(ver->patch_version); 3207 3208 snprintf(fwname, sizeof(fwname), "qca/rampatch_usb_%08x.bin", ver_rom); 3209 3210 err = request_firmware(&fw, fwname, &hdev->dev); 3211 if (err) { 3212 bt_dev_err(hdev, "failed to request rampatch file: %s (%d)", 3213 fwname, err); 3214 return err; 3215 } 3216 3217 bt_dev_info(hdev, "using rampatch file: %s", fwname); 3218 3219 rver = (struct qca_rampatch_version *)(fw->data + info->ver_offset); 3220 rver_rom_low = le16_to_cpu(rver->rom_version_low); 3221 rver_patch = le16_to_cpu(rver->patch_version); 3222 3223 if (ver_rom & ~0xffffU) { 3224 rver_rom_high = le16_to_cpu(rver->rom_version_high); 3225 rver_rom = le32_to_cpu(rver_rom_high << 16 | rver_rom_low); 3226 } else { 3227 rver_rom = rver_rom_low; 3228 } 3229 3230 bt_dev_info(hdev, "QCA: patch rome 0x%x build 0x%x, " 3231 "firmware rome 0x%x build 0x%x", 3232 rver_rom, rver_patch, ver_rom, ver_patch); 3233 3234 if (rver_rom != ver_rom || rver_patch <= ver_patch) { 3235 bt_dev_err(hdev, "rampatch file version did not match with firmware"); 3236 err = -EINVAL; 3237 goto done; 3238 } 3239 3240 err = btusb_setup_qca_download_fw(hdev, fw, info->rampatch_hdr); 3241 3242 done: 3243 release_firmware(fw); 3244 3245 return err; 3246 } 3247 3248 static void btusb_generate_qca_nvm_name(char *fwname, size_t max_size, 3249 const struct qca_version *ver) 3250 { 3251 u32 rom_version = le32_to_cpu(ver->rom_version); 3252 u16 flag = le16_to_cpu(ver->flag); 3253 3254 if (((flag >> 8) & 0xff) == QCA_FLAG_MULTI_NVM) { 3255 /* The board_id should be split into two bytes 3256 * The 1st byte is chip ID, and the 2nd byte is platform ID 3257 * For example, board ID 0x010A, 0x01 is platform ID. 0x0A is chip ID 3258 * we have several platforms, and platform IDs are continuously added 3259 * Platform ID: 3260 * 0x00 is for Mobile 3261 * 0x01 is for X86 3262 * 0x02 is for Automotive 3263 * 0x03 is for Consumer electronic 3264 */ 3265 u16 board_id = (ver->chip_id << 8) + ver->platform_id; 3266 const char *variant; 3267 3268 switch (le32_to_cpu(ver->ram_version)) { 3269 case WCN6855_2_0_RAM_VERSION_GF: 3270 case WCN6855_2_1_RAM_VERSION_GF: 3271 variant = "_gf"; 3272 break; 3273 default: 3274 variant = ""; 3275 break; 3276 } 3277 3278 if (board_id == 0) { 3279 snprintf(fwname, max_size, "qca/nvm_usb_%08x%s.bin", 3280 rom_version, variant); 3281 } else { 3282 snprintf(fwname, max_size, "qca/nvm_usb_%08x%s_%04x.bin", 3283 rom_version, variant, board_id); 3284 } 3285 } else { 3286 snprintf(fwname, max_size, "qca/nvm_usb_%08x.bin", 3287 rom_version); 3288 } 3289 3290 } 3291 3292 static int btusb_setup_qca_load_nvm(struct hci_dev *hdev, 3293 struct qca_version *ver, 3294 const struct qca_device_info *info) 3295 { 3296 const struct firmware *fw; 3297 char fwname[64]; 3298 int err; 3299 3300 btusb_generate_qca_nvm_name(fwname, sizeof(fwname), ver); 3301 3302 err = request_firmware(&fw, fwname, &hdev->dev); 3303 if (err) { 3304 bt_dev_err(hdev, "failed to request NVM file: %s (%d)", 3305 fwname, err); 3306 return err; 3307 } 3308 3309 bt_dev_info(hdev, "using NVM file: %s", fwname); 3310 3311 err = btusb_setup_qca_download_fw(hdev, fw, info->nvm_hdr); 3312 3313 release_firmware(fw); 3314 3315 return err; 3316 } 3317 3318 /* identify the ROM version and check whether patches are needed */ 3319 static bool btusb_qca_need_patch(struct usb_device *udev) 3320 { 3321 struct qca_version ver; 3322 3323 if (btusb_qca_send_vendor_req(udev, QCA_GET_TARGET_VERSION, &ver, 3324 sizeof(ver)) < 0) 3325 return false; 3326 /* only low ROM versions need patches */ 3327 return !(le32_to_cpu(ver.rom_version) & ~0xffffU); 3328 } 3329 3330 static int btusb_setup_qca(struct hci_dev *hdev) 3331 { 3332 struct btusb_data *btdata = hci_get_drvdata(hdev); 3333 struct usb_device *udev = btdata->udev; 3334 const struct qca_device_info *info = NULL; 3335 struct qca_version ver; 3336 u32 ver_rom; 3337 u8 status; 3338 int i, err; 3339 3340 err = btusb_qca_send_vendor_req(udev, QCA_GET_TARGET_VERSION, &ver, 3341 sizeof(ver)); 3342 if (err < 0) 3343 return err; 3344 3345 ver_rom = le32_to_cpu(ver.rom_version); 3346 3347 for (i = 0; i < ARRAY_SIZE(qca_devices_table); i++) { 3348 if (ver_rom == qca_devices_table[i].rom_version) 3349 info = &qca_devices_table[i]; 3350 } 3351 if (!info) { 3352 /* If the rom_version is not matched in the qca_devices_table 3353 * and the high ROM version is not zero, we assume this chip no 3354 * need to load the rampatch and nvm. 3355 */ 3356 if (ver_rom & ~0xffffU) 3357 return 0; 3358 3359 bt_dev_err(hdev, "don't support firmware rome 0x%x", ver_rom); 3360 return -ENODEV; 3361 } 3362 3363 err = btusb_qca_send_vendor_req(udev, QCA_CHECK_STATUS, &status, 3364 sizeof(status)); 3365 if (err < 0) 3366 return err; 3367 3368 if (!(status & QCA_PATCH_UPDATED)) { 3369 err = btusb_setup_qca_load_rampatch(hdev, &ver, info); 3370 if (err < 0) 3371 return err; 3372 } 3373 3374 err = btusb_qca_send_vendor_req(udev, QCA_GET_TARGET_VERSION, &ver, 3375 sizeof(ver)); 3376 if (err < 0) 3377 return err; 3378 3379 if (!(status & QCA_SYSCFG_UPDATED)) { 3380 err = btusb_setup_qca_load_nvm(hdev, &ver, info); 3381 if (err < 0) 3382 return err; 3383 3384 /* WCN6855 2.1 and later will reset to apply firmware downloaded here, so 3385 * wait ~100ms for reset Done then go ahead, otherwise, it maybe 3386 * cause potential enable failure. 3387 */ 3388 if (info->rom_version >= 0x00130201) 3389 msleep(QCA_BT_RESET_WAIT_MS); 3390 } 3391 3392 /* Mark HCI_OP_ENHANCED_SETUP_SYNC_CONN as broken as it doesn't seem to 3393 * work with the likes of HSP/HFP mSBC. 3394 */ 3395 set_bit(HCI_QUIRK_BROKEN_ENHANCED_SETUP_SYNC_CONN, &hdev->quirks); 3396 3397 return 0; 3398 } 3399 3400 static inline int __set_diag_interface(struct hci_dev *hdev) 3401 { 3402 struct btusb_data *data = hci_get_drvdata(hdev); 3403 struct usb_interface *intf = data->diag; 3404 int i; 3405 3406 if (!data->diag) 3407 return -ENODEV; 3408 3409 data->diag_tx_ep = NULL; 3410 data->diag_rx_ep = NULL; 3411 3412 for (i = 0; i < intf->cur_altsetting->desc.bNumEndpoints; i++) { 3413 struct usb_endpoint_descriptor *ep_desc; 3414 3415 ep_desc = &intf->cur_altsetting->endpoint[i].desc; 3416 3417 if (!data->diag_tx_ep && usb_endpoint_is_bulk_out(ep_desc)) { 3418 data->diag_tx_ep = ep_desc; 3419 continue; 3420 } 3421 3422 if (!data->diag_rx_ep && usb_endpoint_is_bulk_in(ep_desc)) { 3423 data->diag_rx_ep = ep_desc; 3424 continue; 3425 } 3426 } 3427 3428 if (!data->diag_tx_ep || !data->diag_rx_ep) { 3429 bt_dev_err(hdev, "invalid diagnostic descriptors"); 3430 return -ENODEV; 3431 } 3432 3433 return 0; 3434 } 3435 3436 static struct urb *alloc_diag_urb(struct hci_dev *hdev, bool enable) 3437 { 3438 struct btusb_data *data = hci_get_drvdata(hdev); 3439 struct sk_buff *skb; 3440 struct urb *urb; 3441 unsigned int pipe; 3442 3443 if (!data->diag_tx_ep) 3444 return ERR_PTR(-ENODEV); 3445 3446 urb = usb_alloc_urb(0, GFP_KERNEL); 3447 if (!urb) 3448 return ERR_PTR(-ENOMEM); 3449 3450 skb = bt_skb_alloc(2, GFP_KERNEL); 3451 if (!skb) { 3452 usb_free_urb(urb); 3453 return ERR_PTR(-ENOMEM); 3454 } 3455 3456 skb_put_u8(skb, 0xf0); 3457 skb_put_u8(skb, enable); 3458 3459 pipe = usb_sndbulkpipe(data->udev, data->diag_tx_ep->bEndpointAddress); 3460 3461 usb_fill_bulk_urb(urb, data->udev, pipe, 3462 skb->data, skb->len, btusb_tx_complete, skb); 3463 3464 skb->dev = (void *)hdev; 3465 3466 return urb; 3467 } 3468 3469 static int btusb_bcm_set_diag(struct hci_dev *hdev, bool enable) 3470 { 3471 struct btusb_data *data = hci_get_drvdata(hdev); 3472 struct urb *urb; 3473 3474 if (!data->diag) 3475 return -ENODEV; 3476 3477 if (!test_bit(HCI_RUNNING, &hdev->flags)) 3478 return -ENETDOWN; 3479 3480 urb = alloc_diag_urb(hdev, enable); 3481 if (IS_ERR(urb)) 3482 return PTR_ERR(urb); 3483 3484 return submit_or_queue_tx_urb(hdev, urb); 3485 } 3486 3487 #ifdef CONFIG_PM 3488 static irqreturn_t btusb_oob_wake_handler(int irq, void *priv) 3489 { 3490 struct btusb_data *data = priv; 3491 3492 pm_wakeup_event(&data->udev->dev, 0); 3493 pm_system_wakeup(); 3494 3495 /* Disable only if not already disabled (keep it balanced) */ 3496 if (test_and_clear_bit(BTUSB_OOB_WAKE_ENABLED, &data->flags)) { 3497 disable_irq_nosync(irq); 3498 disable_irq_wake(irq); 3499 } 3500 return IRQ_HANDLED; 3501 } 3502 3503 static const struct of_device_id btusb_match_table[] = { 3504 { .compatible = "usb1286,204e" }, 3505 { .compatible = "usbcf3,e300" }, /* QCA6174A */ 3506 { .compatible = "usb4ca,301a" }, /* QCA6174A (Lite-On) */ 3507 { } 3508 }; 3509 MODULE_DEVICE_TABLE(of, btusb_match_table); 3510 3511 /* Use an oob wakeup pin? */ 3512 static int btusb_config_oob_wake(struct hci_dev *hdev) 3513 { 3514 struct btusb_data *data = hci_get_drvdata(hdev); 3515 struct device *dev = &data->udev->dev; 3516 int irq, ret; 3517 3518 clear_bit(BTUSB_OOB_WAKE_ENABLED, &data->flags); 3519 3520 if (!of_match_device(btusb_match_table, dev)) 3521 return 0; 3522 3523 /* Move on if no IRQ specified */ 3524 irq = of_irq_get_byname(dev->of_node, "wakeup"); 3525 if (irq <= 0) { 3526 bt_dev_dbg(hdev, "%s: no OOB Wakeup IRQ in DT", __func__); 3527 return 0; 3528 } 3529 3530 irq_set_status_flags(irq, IRQ_NOAUTOEN); 3531 ret = devm_request_irq(&hdev->dev, irq, btusb_oob_wake_handler, 3532 0, "OOB Wake-on-BT", data); 3533 if (ret) { 3534 bt_dev_err(hdev, "%s: IRQ request failed", __func__); 3535 return ret; 3536 } 3537 3538 ret = device_init_wakeup(dev, true); 3539 if (ret) { 3540 bt_dev_err(hdev, "%s: failed to init_wakeup", __func__); 3541 return ret; 3542 } 3543 3544 data->oob_wake_irq = irq; 3545 bt_dev_info(hdev, "OOB Wake-on-BT configured at IRQ %u", irq); 3546 return 0; 3547 } 3548 #endif 3549 3550 static void btusb_check_needs_reset_resume(struct usb_interface *intf) 3551 { 3552 if (dmi_check_system(btusb_needs_reset_resume_table)) 3553 interface_to_usbdev(intf)->quirks |= USB_QUIRK_RESET_RESUME; 3554 } 3555 3556 static bool btusb_wakeup(struct hci_dev *hdev) 3557 { 3558 struct btusb_data *data = hci_get_drvdata(hdev); 3559 3560 return device_may_wakeup(&data->udev->dev); 3561 } 3562 3563 static int btusb_shutdown_qca(struct hci_dev *hdev) 3564 { 3565 struct sk_buff *skb; 3566 3567 skb = __hci_cmd_sync(hdev, HCI_OP_RESET, 0, NULL, HCI_INIT_TIMEOUT); 3568 if (IS_ERR(skb)) { 3569 bt_dev_err(hdev, "HCI reset during shutdown failed"); 3570 return PTR_ERR(skb); 3571 } 3572 kfree_skb(skb); 3573 3574 return 0; 3575 } 3576 3577 static ssize_t force_poll_sync_read(struct file *file, char __user *user_buf, 3578 size_t count, loff_t *ppos) 3579 { 3580 struct btusb_data *data = file->private_data; 3581 char buf[3]; 3582 3583 buf[0] = data->poll_sync ? 'Y' : 'N'; 3584 buf[1] = '\n'; 3585 buf[2] = '\0'; 3586 return simple_read_from_buffer(user_buf, count, ppos, buf, 2); 3587 } 3588 3589 static ssize_t force_poll_sync_write(struct file *file, 3590 const char __user *user_buf, 3591 size_t count, loff_t *ppos) 3592 { 3593 struct btusb_data *data = file->private_data; 3594 bool enable; 3595 int err; 3596 3597 err = kstrtobool_from_user(user_buf, count, &enable); 3598 if (err) 3599 return err; 3600 3601 /* Only allow changes while the adapter is down */ 3602 if (test_bit(HCI_UP, &data->hdev->flags)) 3603 return -EPERM; 3604 3605 if (data->poll_sync == enable) 3606 return -EALREADY; 3607 3608 data->poll_sync = enable; 3609 3610 return count; 3611 } 3612 3613 static const struct file_operations force_poll_sync_fops = { 3614 .open = simple_open, 3615 .read = force_poll_sync_read, 3616 .write = force_poll_sync_write, 3617 .llseek = default_llseek, 3618 }; 3619 3620 static int btusb_probe(struct usb_interface *intf, 3621 const struct usb_device_id *id) 3622 { 3623 struct usb_endpoint_descriptor *ep_desc; 3624 struct gpio_desc *reset_gpio; 3625 struct btusb_data *data; 3626 struct hci_dev *hdev; 3627 unsigned ifnum_base; 3628 int i, err, priv_size; 3629 3630 BT_DBG("intf %p id %p", intf, id); 3631 3632 /* interface numbers are hardcoded in the spec */ 3633 if (intf->cur_altsetting->desc.bInterfaceNumber != 0) { 3634 if (!(id->driver_info & BTUSB_IFNUM_2)) 3635 return -ENODEV; 3636 if (intf->cur_altsetting->desc.bInterfaceNumber != 2) 3637 return -ENODEV; 3638 } 3639 3640 ifnum_base = intf->cur_altsetting->desc.bInterfaceNumber; 3641 3642 if (!id->driver_info) { 3643 const struct usb_device_id *match; 3644 3645 match = usb_match_id(intf, blacklist_table); 3646 if (match) 3647 id = match; 3648 } 3649 3650 if (id->driver_info == BTUSB_IGNORE) 3651 return -ENODEV; 3652 3653 if (id->driver_info & BTUSB_ATH3012) { 3654 struct usb_device *udev = interface_to_usbdev(intf); 3655 3656 /* Old firmware would otherwise let ath3k driver load 3657 * patch and sysconfig files 3658 */ 3659 if (le16_to_cpu(udev->descriptor.bcdDevice) <= 0x0001 && 3660 !btusb_qca_need_patch(udev)) 3661 return -ENODEV; 3662 } 3663 3664 data = devm_kzalloc(&intf->dev, sizeof(*data), GFP_KERNEL); 3665 if (!data) 3666 return -ENOMEM; 3667 3668 for (i = 0; i < intf->cur_altsetting->desc.bNumEndpoints; i++) { 3669 ep_desc = &intf->cur_altsetting->endpoint[i].desc; 3670 3671 if (!data->intr_ep && usb_endpoint_is_int_in(ep_desc)) { 3672 data->intr_ep = ep_desc; 3673 continue; 3674 } 3675 3676 if (!data->bulk_tx_ep && usb_endpoint_is_bulk_out(ep_desc)) { 3677 data->bulk_tx_ep = ep_desc; 3678 continue; 3679 } 3680 3681 if (!data->bulk_rx_ep && usb_endpoint_is_bulk_in(ep_desc)) { 3682 data->bulk_rx_ep = ep_desc; 3683 continue; 3684 } 3685 } 3686 3687 if (!data->intr_ep || !data->bulk_tx_ep || !data->bulk_rx_ep) 3688 return -ENODEV; 3689 3690 if (id->driver_info & BTUSB_AMP) { 3691 data->cmdreq_type = USB_TYPE_CLASS | 0x01; 3692 data->cmdreq = 0x2b; 3693 } else { 3694 data->cmdreq_type = USB_TYPE_CLASS; 3695 data->cmdreq = 0x00; 3696 } 3697 3698 data->udev = interface_to_usbdev(intf); 3699 data->intf = intf; 3700 3701 INIT_WORK(&data->work, btusb_work); 3702 INIT_WORK(&data->waker, btusb_waker); 3703 INIT_DELAYED_WORK(&data->rx_work, btusb_rx_work); 3704 3705 skb_queue_head_init(&data->acl_q); 3706 3707 init_usb_anchor(&data->deferred); 3708 init_usb_anchor(&data->tx_anchor); 3709 spin_lock_init(&data->txlock); 3710 3711 init_usb_anchor(&data->intr_anchor); 3712 init_usb_anchor(&data->bulk_anchor); 3713 init_usb_anchor(&data->isoc_anchor); 3714 init_usb_anchor(&data->diag_anchor); 3715 init_usb_anchor(&data->ctrl_anchor); 3716 spin_lock_init(&data->rxlock); 3717 3718 priv_size = 0; 3719 3720 data->recv_event = hci_recv_frame; 3721 data->recv_bulk = btusb_recv_bulk; 3722 3723 if (id->driver_info & BTUSB_INTEL_COMBINED) { 3724 /* Allocate extra space for Intel device */ 3725 priv_size += sizeof(struct btintel_data); 3726 3727 /* Override the rx handlers */ 3728 data->recv_event = btusb_recv_event_intel; 3729 data->recv_bulk = btusb_recv_bulk_intel; 3730 } 3731 3732 data->recv_acl = hci_recv_frame; 3733 3734 hdev = hci_alloc_dev_priv(priv_size); 3735 if (!hdev) 3736 return -ENOMEM; 3737 3738 hdev->bus = HCI_USB; 3739 hci_set_drvdata(hdev, data); 3740 3741 if (id->driver_info & BTUSB_AMP) 3742 hdev->dev_type = HCI_AMP; 3743 else 3744 hdev->dev_type = HCI_PRIMARY; 3745 3746 data->hdev = hdev; 3747 3748 SET_HCIDEV_DEV(hdev, &intf->dev); 3749 3750 reset_gpio = gpiod_get_optional(&data->udev->dev, "reset", 3751 GPIOD_OUT_LOW); 3752 if (IS_ERR(reset_gpio)) { 3753 err = PTR_ERR(reset_gpio); 3754 goto out_free_dev; 3755 } else if (reset_gpio) { 3756 data->reset_gpio = reset_gpio; 3757 } 3758 3759 hdev->open = btusb_open; 3760 hdev->close = btusb_close; 3761 hdev->flush = btusb_flush; 3762 hdev->send = btusb_send_frame; 3763 hdev->notify = btusb_notify; 3764 hdev->wakeup = btusb_wakeup; 3765 3766 #ifdef CONFIG_PM 3767 err = btusb_config_oob_wake(hdev); 3768 if (err) 3769 goto out_free_dev; 3770 3771 /* Marvell devices may need a specific chip configuration */ 3772 if (id->driver_info & BTUSB_MARVELL && data->oob_wake_irq) { 3773 err = marvell_config_oob_wake(hdev); 3774 if (err) 3775 goto out_free_dev; 3776 } 3777 #endif 3778 if (id->driver_info & BTUSB_CW6622) 3779 set_bit(HCI_QUIRK_BROKEN_STORED_LINK_KEY, &hdev->quirks); 3780 3781 if (id->driver_info & BTUSB_BCM2045) 3782 set_bit(HCI_QUIRK_BROKEN_STORED_LINK_KEY, &hdev->quirks); 3783 3784 if (id->driver_info & BTUSB_BCM92035) 3785 hdev->setup = btusb_setup_bcm92035; 3786 3787 if (IS_ENABLED(CONFIG_BT_HCIBTUSB_BCM) && 3788 (id->driver_info & BTUSB_BCM_PATCHRAM)) { 3789 hdev->manufacturer = 15; 3790 hdev->setup = btbcm_setup_patchram; 3791 hdev->set_diag = btusb_bcm_set_diag; 3792 hdev->set_bdaddr = btbcm_set_bdaddr; 3793 3794 /* Broadcom LM_DIAG Interface numbers are hardcoded */ 3795 data->diag = usb_ifnum_to_if(data->udev, ifnum_base + 2); 3796 } 3797 3798 if (IS_ENABLED(CONFIG_BT_HCIBTUSB_BCM) && 3799 (id->driver_info & BTUSB_BCM_APPLE)) { 3800 hdev->manufacturer = 15; 3801 hdev->setup = btbcm_setup_apple; 3802 hdev->set_diag = btusb_bcm_set_diag; 3803 3804 /* Broadcom LM_DIAG Interface numbers are hardcoded */ 3805 data->diag = usb_ifnum_to_if(data->udev, ifnum_base + 2); 3806 } 3807 3808 /* Combined Intel Device setup to support multiple setup routine */ 3809 if (id->driver_info & BTUSB_INTEL_COMBINED) { 3810 err = btintel_configure_setup(hdev); 3811 if (err) 3812 goto out_free_dev; 3813 3814 /* Transport specific configuration */ 3815 hdev->send = btusb_send_frame_intel; 3816 hdev->cmd_timeout = btusb_intel_cmd_timeout; 3817 3818 if (id->driver_info & BTUSB_INTEL_NO_WBS_SUPPORT) 3819 btintel_set_flag(hdev, INTEL_ROM_LEGACY_NO_WBS_SUPPORT); 3820 3821 if (id->driver_info & BTUSB_INTEL_BROKEN_INITIAL_NCMD) 3822 btintel_set_flag(hdev, INTEL_BROKEN_INITIAL_NCMD); 3823 3824 if (id->driver_info & BTUSB_INTEL_BROKEN_SHUTDOWN_LED) 3825 btintel_set_flag(hdev, INTEL_BROKEN_SHUTDOWN_LED); 3826 } 3827 3828 if (id->driver_info & BTUSB_MARVELL) 3829 hdev->set_bdaddr = btusb_set_bdaddr_marvell; 3830 3831 if (IS_ENABLED(CONFIG_BT_HCIBTUSB_MTK) && 3832 (id->driver_info & BTUSB_MEDIATEK)) { 3833 hdev->setup = btusb_mtk_setup; 3834 hdev->shutdown = btusb_mtk_shutdown; 3835 hdev->manufacturer = 70; 3836 hdev->cmd_timeout = btusb_mtk_cmd_timeout; 3837 hdev->set_bdaddr = btmtk_set_bdaddr; 3838 set_bit(HCI_QUIRK_BROKEN_ENHANCED_SETUP_SYNC_CONN, &hdev->quirks); 3839 set_bit(HCI_QUIRK_NON_PERSISTENT_SETUP, &hdev->quirks); 3840 data->recv_acl = btusb_recv_acl_mtk; 3841 } 3842 3843 if (id->driver_info & BTUSB_SWAVE) { 3844 set_bit(HCI_QUIRK_FIXUP_INQUIRY_MODE, &hdev->quirks); 3845 set_bit(HCI_QUIRK_BROKEN_LOCAL_COMMANDS, &hdev->quirks); 3846 } 3847 3848 if (id->driver_info & BTUSB_INTEL_BOOT) { 3849 hdev->manufacturer = 2; 3850 set_bit(HCI_QUIRK_RAW_DEVICE, &hdev->quirks); 3851 } 3852 3853 if (id->driver_info & BTUSB_ATH3012) { 3854 data->setup_on_usb = btusb_setup_qca; 3855 hdev->set_bdaddr = btusb_set_bdaddr_ath3012; 3856 set_bit(HCI_QUIRK_SIMULTANEOUS_DISCOVERY, &hdev->quirks); 3857 set_bit(HCI_QUIRK_STRICT_DUPLICATE_FILTER, &hdev->quirks); 3858 } 3859 3860 if (id->driver_info & BTUSB_QCA_ROME) { 3861 data->setup_on_usb = btusb_setup_qca; 3862 hdev->set_bdaddr = btusb_set_bdaddr_ath3012; 3863 hdev->cmd_timeout = btusb_qca_cmd_timeout; 3864 set_bit(HCI_QUIRK_SIMULTANEOUS_DISCOVERY, &hdev->quirks); 3865 btusb_check_needs_reset_resume(intf); 3866 } 3867 3868 if (id->driver_info & BTUSB_QCA_WCN6855) { 3869 data->setup_on_usb = btusb_setup_qca; 3870 hdev->shutdown = btusb_shutdown_qca; 3871 hdev->set_bdaddr = btusb_set_bdaddr_wcn6855; 3872 hdev->cmd_timeout = btusb_qca_cmd_timeout; 3873 set_bit(HCI_QUIRK_SIMULTANEOUS_DISCOVERY, &hdev->quirks); 3874 hci_set_msft_opcode(hdev, 0xFD70); 3875 } 3876 3877 if (id->driver_info & BTUSB_AMP) { 3878 /* AMP controllers do not support SCO packets */ 3879 data->isoc = NULL; 3880 } else { 3881 /* Interface orders are hardcoded in the specification */ 3882 data->isoc = usb_ifnum_to_if(data->udev, ifnum_base + 1); 3883 data->isoc_ifnum = ifnum_base + 1; 3884 } 3885 3886 if (IS_ENABLED(CONFIG_BT_HCIBTUSB_RTL) && 3887 (id->driver_info & BTUSB_REALTEK)) { 3888 hdev->setup = btrtl_setup_realtek; 3889 hdev->shutdown = btrtl_shutdown_realtek; 3890 hdev->cmd_timeout = btusb_rtl_cmd_timeout; 3891 3892 /* Realtek devices need to set remote wakeup on auto-suspend */ 3893 set_bit(BTUSB_WAKEUP_AUTOSUSPEND, &data->flags); 3894 set_bit(BTUSB_USE_ALT3_FOR_WBS, &data->flags); 3895 } 3896 3897 if (!reset) 3898 set_bit(HCI_QUIRK_RESET_ON_CLOSE, &hdev->quirks); 3899 3900 if (force_scofix || id->driver_info & BTUSB_WRONG_SCO_MTU) { 3901 if (!disable_scofix) 3902 set_bit(HCI_QUIRK_FIXUP_BUFFER_SIZE, &hdev->quirks); 3903 } 3904 3905 if (id->driver_info & BTUSB_BROKEN_ISOC) 3906 data->isoc = NULL; 3907 3908 if (id->driver_info & BTUSB_WIDEBAND_SPEECH) 3909 set_bit(HCI_QUIRK_WIDEBAND_SPEECH_SUPPORTED, &hdev->quirks); 3910 3911 if (id->driver_info & BTUSB_VALID_LE_STATES) 3912 set_bit(HCI_QUIRK_VALID_LE_STATES, &hdev->quirks); 3913 3914 if (id->driver_info & BTUSB_DIGIANSWER) { 3915 data->cmdreq_type = USB_TYPE_VENDOR; 3916 set_bit(HCI_QUIRK_RESET_ON_CLOSE, &hdev->quirks); 3917 } 3918 3919 if (id->driver_info & BTUSB_CSR) { 3920 struct usb_device *udev = data->udev; 3921 u16 bcdDevice = le16_to_cpu(udev->descriptor.bcdDevice); 3922 3923 /* Old firmware would otherwise execute USB reset */ 3924 if (bcdDevice < 0x117) 3925 set_bit(HCI_QUIRK_RESET_ON_CLOSE, &hdev->quirks); 3926 3927 /* This must be set first in case we disable it for fakes */ 3928 set_bit(HCI_QUIRK_SIMULTANEOUS_DISCOVERY, &hdev->quirks); 3929 3930 /* Fake CSR devices with broken commands */ 3931 if (le16_to_cpu(udev->descriptor.idVendor) == 0x0a12 && 3932 le16_to_cpu(udev->descriptor.idProduct) == 0x0001) 3933 hdev->setup = btusb_setup_csr; 3934 } 3935 3936 if (id->driver_info & BTUSB_SNIFFER) { 3937 struct usb_device *udev = data->udev; 3938 3939 /* New sniffer firmware has crippled HCI interface */ 3940 if (le16_to_cpu(udev->descriptor.bcdDevice) > 0x997) 3941 set_bit(HCI_QUIRK_RAW_DEVICE, &hdev->quirks); 3942 } 3943 3944 if (id->driver_info & BTUSB_INTEL_BOOT) { 3945 /* A bug in the bootloader causes that interrupt interface is 3946 * only enabled after receiving SetInterface(0, AltSetting=0). 3947 */ 3948 err = usb_set_interface(data->udev, 0, 0); 3949 if (err < 0) { 3950 BT_ERR("failed to set interface 0, alt 0 %d", err); 3951 goto out_free_dev; 3952 } 3953 } 3954 3955 if (data->isoc) { 3956 err = usb_driver_claim_interface(&btusb_driver, 3957 data->isoc, data); 3958 if (err < 0) 3959 goto out_free_dev; 3960 } 3961 3962 if (IS_ENABLED(CONFIG_BT_HCIBTUSB_BCM) && data->diag) { 3963 if (!usb_driver_claim_interface(&btusb_driver, 3964 data->diag, data)) 3965 __set_diag_interface(hdev); 3966 else 3967 data->diag = NULL; 3968 } 3969 3970 if (enable_autosuspend) 3971 usb_enable_autosuspend(data->udev); 3972 3973 err = hci_register_dev(hdev); 3974 if (err < 0) 3975 goto out_free_dev; 3976 3977 usb_set_intfdata(intf, data); 3978 3979 debugfs_create_file("force_poll_sync", 0644, hdev->debugfs, data, 3980 &force_poll_sync_fops); 3981 3982 return 0; 3983 3984 out_free_dev: 3985 if (data->reset_gpio) 3986 gpiod_put(data->reset_gpio); 3987 hci_free_dev(hdev); 3988 return err; 3989 } 3990 3991 static void btusb_disconnect(struct usb_interface *intf) 3992 { 3993 struct btusb_data *data = usb_get_intfdata(intf); 3994 struct hci_dev *hdev; 3995 3996 BT_DBG("intf %p", intf); 3997 3998 if (!data) 3999 return; 4000 4001 hdev = data->hdev; 4002 usb_set_intfdata(data->intf, NULL); 4003 4004 if (data->isoc) 4005 usb_set_intfdata(data->isoc, NULL); 4006 4007 if (data->diag) 4008 usb_set_intfdata(data->diag, NULL); 4009 4010 hci_unregister_dev(hdev); 4011 4012 if (intf == data->intf) { 4013 if (data->isoc) 4014 usb_driver_release_interface(&btusb_driver, data->isoc); 4015 if (data->diag) 4016 usb_driver_release_interface(&btusb_driver, data->diag); 4017 } else if (intf == data->isoc) { 4018 if (data->diag) 4019 usb_driver_release_interface(&btusb_driver, data->diag); 4020 usb_driver_release_interface(&btusb_driver, data->intf); 4021 } else if (intf == data->diag) { 4022 usb_driver_release_interface(&btusb_driver, data->intf); 4023 if (data->isoc) 4024 usb_driver_release_interface(&btusb_driver, data->isoc); 4025 } 4026 4027 if (data->oob_wake_irq) 4028 device_init_wakeup(&data->udev->dev, false); 4029 4030 if (data->reset_gpio) 4031 gpiod_put(data->reset_gpio); 4032 4033 hci_free_dev(hdev); 4034 } 4035 4036 #ifdef CONFIG_PM 4037 static int btusb_suspend(struct usb_interface *intf, pm_message_t message) 4038 { 4039 struct btusb_data *data = usb_get_intfdata(intf); 4040 4041 BT_DBG("intf %p", intf); 4042 4043 if (data->suspend_count++) 4044 return 0; 4045 4046 spin_lock_irq(&data->txlock); 4047 if (!(PMSG_IS_AUTO(message) && data->tx_in_flight)) { 4048 set_bit(BTUSB_SUSPENDING, &data->flags); 4049 spin_unlock_irq(&data->txlock); 4050 } else { 4051 spin_unlock_irq(&data->txlock); 4052 data->suspend_count--; 4053 return -EBUSY; 4054 } 4055 4056 cancel_work_sync(&data->work); 4057 4058 btusb_stop_traffic(data); 4059 usb_kill_anchored_urbs(&data->tx_anchor); 4060 4061 if (data->oob_wake_irq && device_may_wakeup(&data->udev->dev)) { 4062 set_bit(BTUSB_OOB_WAKE_ENABLED, &data->flags); 4063 enable_irq_wake(data->oob_wake_irq); 4064 enable_irq(data->oob_wake_irq); 4065 } 4066 4067 /* For global suspend, Realtek devices lose the loaded fw 4068 * in them. But for autosuspend, firmware should remain. 4069 * Actually, it depends on whether the usb host sends 4070 * set feature (enable wakeup) or not. 4071 */ 4072 if (test_bit(BTUSB_WAKEUP_AUTOSUSPEND, &data->flags)) { 4073 if (PMSG_IS_AUTO(message) && 4074 device_can_wakeup(&data->udev->dev)) 4075 data->udev->do_remote_wakeup = 1; 4076 else if (!PMSG_IS_AUTO(message) && 4077 !device_may_wakeup(&data->udev->dev)) { 4078 data->udev->do_remote_wakeup = 0; 4079 data->udev->reset_resume = 1; 4080 } 4081 } 4082 4083 return 0; 4084 } 4085 4086 static void play_deferred(struct btusb_data *data) 4087 { 4088 struct urb *urb; 4089 int err; 4090 4091 while ((urb = usb_get_from_anchor(&data->deferred))) { 4092 usb_anchor_urb(urb, &data->tx_anchor); 4093 4094 err = usb_submit_urb(urb, GFP_ATOMIC); 4095 if (err < 0) { 4096 if (err != -EPERM && err != -ENODEV) 4097 BT_ERR("%s urb %p submission failed (%d)", 4098 data->hdev->name, urb, -err); 4099 kfree(urb->setup_packet); 4100 usb_unanchor_urb(urb); 4101 usb_free_urb(urb); 4102 break; 4103 } 4104 4105 data->tx_in_flight++; 4106 usb_free_urb(urb); 4107 } 4108 4109 /* Cleanup the rest deferred urbs. */ 4110 while ((urb = usb_get_from_anchor(&data->deferred))) { 4111 kfree(urb->setup_packet); 4112 usb_free_urb(urb); 4113 } 4114 } 4115 4116 static int btusb_resume(struct usb_interface *intf) 4117 { 4118 struct btusb_data *data = usb_get_intfdata(intf); 4119 struct hci_dev *hdev = data->hdev; 4120 int err = 0; 4121 4122 BT_DBG("intf %p", intf); 4123 4124 if (--data->suspend_count) 4125 return 0; 4126 4127 /* Disable only if not already disabled (keep it balanced) */ 4128 if (test_and_clear_bit(BTUSB_OOB_WAKE_ENABLED, &data->flags)) { 4129 disable_irq(data->oob_wake_irq); 4130 disable_irq_wake(data->oob_wake_irq); 4131 } 4132 4133 if (!test_bit(HCI_RUNNING, &hdev->flags)) 4134 goto done; 4135 4136 if (test_bit(BTUSB_INTR_RUNNING, &data->flags)) { 4137 err = btusb_submit_intr_urb(hdev, GFP_NOIO); 4138 if (err < 0) { 4139 clear_bit(BTUSB_INTR_RUNNING, &data->flags); 4140 goto failed; 4141 } 4142 } 4143 4144 if (test_bit(BTUSB_BULK_RUNNING, &data->flags)) { 4145 err = btusb_submit_bulk_urb(hdev, GFP_NOIO); 4146 if (err < 0) { 4147 clear_bit(BTUSB_BULK_RUNNING, &data->flags); 4148 goto failed; 4149 } 4150 4151 btusb_submit_bulk_urb(hdev, GFP_NOIO); 4152 } 4153 4154 if (test_bit(BTUSB_ISOC_RUNNING, &data->flags)) { 4155 if (btusb_submit_isoc_urb(hdev, GFP_NOIO) < 0) 4156 clear_bit(BTUSB_ISOC_RUNNING, &data->flags); 4157 else 4158 btusb_submit_isoc_urb(hdev, GFP_NOIO); 4159 } 4160 4161 spin_lock_irq(&data->txlock); 4162 play_deferred(data); 4163 clear_bit(BTUSB_SUSPENDING, &data->flags); 4164 spin_unlock_irq(&data->txlock); 4165 schedule_work(&data->work); 4166 4167 return 0; 4168 4169 failed: 4170 usb_scuttle_anchored_urbs(&data->deferred); 4171 done: 4172 spin_lock_irq(&data->txlock); 4173 clear_bit(BTUSB_SUSPENDING, &data->flags); 4174 spin_unlock_irq(&data->txlock); 4175 4176 return err; 4177 } 4178 #endif 4179 4180 static struct usb_driver btusb_driver = { 4181 .name = "btusb", 4182 .probe = btusb_probe, 4183 .disconnect = btusb_disconnect, 4184 #ifdef CONFIG_PM 4185 .suspend = btusb_suspend, 4186 .resume = btusb_resume, 4187 #endif 4188 .id_table = btusb_table, 4189 .supports_autosuspend = 1, 4190 .disable_hub_initiated_lpm = 1, 4191 }; 4192 4193 module_usb_driver(btusb_driver); 4194 4195 module_param(disable_scofix, bool, 0644); 4196 MODULE_PARM_DESC(disable_scofix, "Disable fixup of wrong SCO buffer size"); 4197 4198 module_param(force_scofix, bool, 0644); 4199 MODULE_PARM_DESC(force_scofix, "Force fixup of wrong SCO buffers size"); 4200 4201 module_param(enable_autosuspend, bool, 0644); 4202 MODULE_PARM_DESC(enable_autosuspend, "Enable USB autosuspend by default"); 4203 4204 module_param(reset, bool, 0644); 4205 MODULE_PARM_DESC(reset, "Send HCI reset command on initialization"); 4206 4207 MODULE_AUTHOR("Marcel Holtmann <marcel@holtmann.org>"); 4208 MODULE_DESCRIPTION("Generic Bluetooth USB driver ver " VERSION); 4209 MODULE_VERSION(VERSION); 4210 MODULE_LICENSE("GPL"); 4211