drivers/bluetooth/btusb.c

   1 // SPDX-License-Identifier: GPL-2.0-or-later
   2 /*
   3  *
   4  *  Generic Bluetooth USB driver
   5  *
   6  *  Copyright (C) 2005-2008  Marcel Holtmann <marcel@holtmann.org>
   7  */
   8
   9 #include <linux/dmi.h>
  10 #include <linux/module.h>
  11 #include <linux/usb.h>
  12 #include <linux/usb/quirks.h>
  13 #include <linux/firmware.h>
  14 #include <linux/iopoll.h>
  15 #include <linux/of_device.h>
  16 #include <linux/of_irq.h>
  17 #include <linux/suspend.h>
  18 #include <linux/gpio/consumer.h>
  19 #include <asm/unaligned.h>
  20
  21 #include <net/bluetooth/bluetooth.h>
  22 #include <net/bluetooth/hci_core.h>
  23
  24 #include "btintel.h"
  25 #include "btbcm.h"
  26 #include "btrtl.h"
  27
  28 #define VERSION "0.8"
  29
  30 static bool disable_scofix;
  31 static bool force_scofix;
  32 static bool enable_autosuspend = IS_ENABLED(CONFIG_BT_HCIBTUSB_AUTOSUSPEND);
  33
  34 static bool reset = true;
  35
  36 static struct usb_driver btusb_driver;
  37
  38 #define BTUSB_IGNORE            0x01
  39 #define BTUSB_DIGIANSWER        0x02
  40 #define BTUSB_CSR               0x04
  41 #define BTUSB_SNIFFER           0x08
  42 #define BTUSB_BCM92035          0x10
  43 #define BTUSB_BROKEN_ISOC       0x20
  44 #define BTUSB_WRONG_SCO_MTU     0x40
  45 #define BTUSB_ATH3012           0x80
  46 #define BTUSB_INTEL_COMBINED    0x100
  47 #define BTUSB_INTEL_BOOT        0x200
  48 #define BTUSB_BCM_PATCHRAM      0x400
  49 #define BTUSB_MARVELL           0x800
  50 #define BTUSB_SWAVE             0x1000
  51 #define BTUSB_AMP               0x4000
  52 #define BTUSB_QCA_ROME          0x8000
  53 #define BTUSB_BCM_APPLE         0x10000
  54 #define BTUSB_REALTEK           0x20000
  55 #define BTUSB_BCM2045           0x40000
  56 #define BTUSB_IFNUM_2           0x80000
  57 #define BTUSB_CW6622            0x100000
  58 #define BTUSB_MEDIATEK          0x200000
  59 #define BTUSB_WIDEBAND_SPEECH   0x400000
  60 #define BTUSB_VALID_LE_STATES   0x800000
  61 #define BTUSB_QCA_WCN6855       0x1000000
  62 #define BTUSB_INTEL_BROKEN_INITIAL_NCMD 0x4000000
  63
  64 static const struct usb_device_id btusb_table[] = {
  65         /* Generic Bluetooth USB device */
  66         { USB_DEVICE_INFO(0xe0, 0x01, 0x01) },
  67
  68         /* Generic Bluetooth AMP device */
  69         { USB_DEVICE_INFO(0xe0, 0x01, 0x04), .driver_info = BTUSB_AMP },
  70
  71         /* Generic Bluetooth USB interface */
  72         { USB_INTERFACE_INFO(0xe0, 0x01, 0x01) },
  73
  74         /* Apple-specific (Broadcom) devices */
  75         { USB_VENDOR_AND_INTERFACE_INFO(0x05ac, 0xff, 0x01, 0x01),
  76           .driver_info = BTUSB_BCM_APPLE | BTUSB_IFNUM_2 },
  77
  78         /* MediaTek MT76x0E */
  79         { USB_DEVICE(0x0e8d, 0x763f) },
  80
  81         /* Broadcom SoftSailing reporting vendor specific */
  82         { USB_DEVICE(0x0a5c, 0x21e1) },
  83
  84         /* Apple MacBookPro 7,1 */
  85         { USB_DEVICE(0x05ac, 0x8213) },
  86
  87         /* Apple iMac11,1 */
  88         { USB_DEVICE(0x05ac, 0x8215) },
  89
  90         /* Apple MacBookPro6,2 */
  91         { USB_DEVICE(0x05ac, 0x8218) },
  92
  93         /* Apple MacBookAir3,1, MacBookAir3,2 */
  94         { USB_DEVICE(0x05ac, 0x821b) },
  95
  96         /* Apple MacBookAir4,1 */
  97         { USB_DEVICE(0x05ac, 0x821f) },
  98
  99         /* Apple MacBookPro8,2 */
 100         { USB_DEVICE(0x05ac, 0x821a) },
 101
 102         /* Apple MacMini5,1 */
 103         { USB_DEVICE(0x05ac, 0x8281) },
 104
 105         /* AVM BlueFRITZ! USB v2.0 */
 106         { USB_DEVICE(0x057c, 0x3800), .driver_info = BTUSB_SWAVE },
 107
 108         /* Bluetooth Ultraport Module from IBM */
 109         { USB_DEVICE(0x04bf, 0x030a) },
 110
 111         /* ALPS Modules with non-standard id */
 112         { USB_DEVICE(0x044e, 0x3001) },
 113         { USB_DEVICE(0x044e, 0x3002) },
 114
 115         /* Ericsson with non-standard id */
 116         { USB_DEVICE(0x0bdb, 0x1002) },
 117
 118         /* Canyon CN-BTU1 with HID interfaces */
 119         { USB_DEVICE(0x0c10, 0x0000) },
 120
 121         /* Broadcom BCM20702B0 (Dynex/Insignia) */
 122         { USB_DEVICE(0x19ff, 0x0239), .driver_info = BTUSB_BCM_PATCHRAM },
 123
 124         /* Broadcom BCM43142A0 (Foxconn/Lenovo) */
 125         { USB_VENDOR_AND_INTERFACE_INFO(0x105b, 0xff, 0x01, 0x01),
 126           .driver_info = BTUSB_BCM_PATCHRAM },
 127
 128         /* Broadcom BCM920703 (HTC Vive) */
 129         { USB_VENDOR_AND_INTERFACE_INFO(0x0bb4, 0xff, 0x01, 0x01),
 130           .driver_info = BTUSB_BCM_PATCHRAM },
 131
 132         /* Foxconn - Hon Hai */
 133         { USB_VENDOR_AND_INTERFACE_INFO(0x0489, 0xff, 0x01, 0x01),
 134           .driver_info = BTUSB_BCM_PATCHRAM },
 135
 136         /* Lite-On Technology - Broadcom based */
 137         { USB_VENDOR_AND_INTERFACE_INFO(0x04ca, 0xff, 0x01, 0x01),
 138           .driver_info = BTUSB_BCM_PATCHRAM },
 139
 140         /* Broadcom devices with vendor specific id */
 141         { USB_VENDOR_AND_INTERFACE_INFO(0x0a5c, 0xff, 0x01, 0x01),
 142           .driver_info = BTUSB_BCM_PATCHRAM },
 143
 144         /* ASUSTek Computer - Broadcom based */
 145         { USB_VENDOR_AND_INTERFACE_INFO(0x0b05, 0xff, 0x01, 0x01),
 146           .driver_info = BTUSB_BCM_PATCHRAM },
 147
 148         /* Belkin F8065bf - Broadcom based */
 149         { USB_VENDOR_AND_INTERFACE_INFO(0x050d, 0xff, 0x01, 0x01),
 150           .driver_info = BTUSB_BCM_PATCHRAM },
 151
 152         /* IMC Networks - Broadcom based */
 153         { USB_VENDOR_AND_INTERFACE_INFO(0x13d3, 0xff, 0x01, 0x01),
 154           .driver_info = BTUSB_BCM_PATCHRAM },
 155
 156         /* Dell Computer - Broadcom based  */
 157         { USB_VENDOR_AND_INTERFACE_INFO(0x413c, 0xff, 0x01, 0x01),
 158           .driver_info = BTUSB_BCM_PATCHRAM },
 159
 160         /* Toshiba Corp - Broadcom based */
 161         { USB_VENDOR_AND_INTERFACE_INFO(0x0930, 0xff, 0x01, 0x01),
 162           .driver_info = BTUSB_BCM_PATCHRAM },
 163
 164         /* Intel Bluetooth USB Bootloader (RAM module) */
 165         { USB_DEVICE(0x8087, 0x0a5a),
 166           .driver_info = BTUSB_INTEL_BOOT | BTUSB_BROKEN_ISOC },
 167
 168         { }     /* Terminating entry */
 169 };
 170
 171 MODULE_DEVICE_TABLE(usb, btusb_table);
 172
 173 static const struct usb_device_id blacklist_table[] = {
 174         /* CSR BlueCore devices */
 175         { USB_DEVICE(0x0a12, 0x0001), .driver_info = BTUSB_CSR },
 176
 177         /* Broadcom BCM2033 without firmware */
 178         { USB_DEVICE(0x0a5c, 0x2033), .driver_info = BTUSB_IGNORE },
 179
 180         /* Broadcom BCM2045 devices */
 181         { USB_DEVICE(0x0a5c, 0x2045), .driver_info = BTUSB_BCM2045 },
 182
 183         /* Atheros 3011 with sflash firmware */
 184         { USB_DEVICE(0x0489, 0xe027), .driver_info = BTUSB_IGNORE },
 185         { USB_DEVICE(0x0489, 0xe03d), .driver_info = BTUSB_IGNORE },
 186         { USB_DEVICE(0x04f2, 0xaff1), .driver_info = BTUSB_IGNORE },
 187         { USB_DEVICE(0x0930, 0x0215), .driver_info = BTUSB_IGNORE },
 188         { USB_DEVICE(0x0cf3, 0x3002), .driver_info = BTUSB_IGNORE },
 189         { USB_DEVICE(0x0cf3, 0xe019), .driver_info = BTUSB_IGNORE },
 190         { USB_DEVICE(0x13d3, 0x3304), .driver_info = BTUSB_IGNORE },
 191
 192         /* Atheros AR9285 Malbec with sflash firmware */
 193         { USB_DEVICE(0x03f0, 0x311d), .driver_info = BTUSB_IGNORE },
 194
 195         /* Atheros 3012 with sflash firmware */
 196         { USB_DEVICE(0x0489, 0xe04d), .driver_info = BTUSB_ATH3012 },
 197         { USB_DEVICE(0x0489, 0xe04e), .driver_info = BTUSB_ATH3012 },
 198         { USB_DEVICE(0x0489, 0xe056), .driver_info = BTUSB_ATH3012 },
 199         { USB_DEVICE(0x0489, 0xe057), .driver_info = BTUSB_ATH3012 },
 200         { USB_DEVICE(0x0489, 0xe05f), .driver_info = BTUSB_ATH3012 },
 201         { USB_DEVICE(0x0489, 0xe076), .driver_info = BTUSB_ATH3012 },
 202         { USB_DEVICE(0x0489, 0xe078), .driver_info = BTUSB_ATH3012 },
 203         { USB_DEVICE(0x0489, 0xe095), .driver_info = BTUSB_ATH3012 },
 204         { USB_DEVICE(0x04c5, 0x1330), .driver_info = BTUSB_ATH3012 },
 205         { USB_DEVICE(0x04ca, 0x3004), .driver_info = BTUSB_ATH3012 },
 206         { USB_DEVICE(0x04ca, 0x3005), .driver_info = BTUSB_ATH3012 },
 207         { USB_DEVICE(0x04ca, 0x3006), .driver_info = BTUSB_ATH3012 },
 208         { USB_DEVICE(0x04ca, 0x3007), .driver_info = BTUSB_ATH3012 },
 209         { USB_DEVICE(0x04ca, 0x3008), .driver_info = BTUSB_ATH3012 },
 210         { USB_DEVICE(0x04ca, 0x300b), .driver_info = BTUSB_ATH3012 },
 211         { USB_DEVICE(0x04ca, 0x300d), .driver_info = BTUSB_ATH3012 },
 212         { USB_DEVICE(0x04ca, 0x300f), .driver_info = BTUSB_ATH3012 },
 213         { USB_DEVICE(0x04ca, 0x3010), .driver_info = BTUSB_ATH3012 },
 214         { USB_DEVICE(0x04ca, 0x3014), .driver_info = BTUSB_ATH3012 },
 215         { USB_DEVICE(0x04ca, 0x3018), .driver_info = BTUSB_ATH3012 },
 216         { USB_DEVICE(0x0930, 0x0219), .driver_info = BTUSB_ATH3012 },
 217         { USB_DEVICE(0x0930, 0x021c), .driver_info = BTUSB_ATH3012 },
 218         { USB_DEVICE(0x0930, 0x0220), .driver_info = BTUSB_ATH3012 },
 219         { USB_DEVICE(0x0930, 0x0227), .driver_info = BTUSB_ATH3012 },
 220         { USB_DEVICE(0x0b05, 0x17d0), .driver_info = BTUSB_ATH3012 },
 221         { USB_DEVICE(0x0cf3, 0x0036), .driver_info = BTUSB_ATH3012 },
 222         { USB_DEVICE(0x0cf3, 0x3004), .driver_info = BTUSB_ATH3012 },
 223         { USB_DEVICE(0x0cf3, 0x3008), .driver_info = BTUSB_ATH3012 },
 224         { USB_DEVICE(0x0cf3, 0x311d), .driver_info = BTUSB_ATH3012 },
 225         { USB_DEVICE(0x0cf3, 0x311e), .driver_info = BTUSB_ATH3012 },
 226         { USB_DEVICE(0x0cf3, 0x311f), .driver_info = BTUSB_ATH3012 },
 227         { USB_DEVICE(0x0cf3, 0x3121), .driver_info = BTUSB_ATH3012 },
 228         { USB_DEVICE(0x0cf3, 0x817a), .driver_info = BTUSB_ATH3012 },
 229         { USB_DEVICE(0x0cf3, 0x817b), .driver_info = BTUSB_ATH3012 },
 230         { USB_DEVICE(0x0cf3, 0xe003), .driver_info = BTUSB_ATH3012 },
 231         { USB_DEVICE(0x0cf3, 0xe004), .driver_info = BTUSB_ATH3012 },
 232         { USB_DEVICE(0x0cf3, 0xe005), .driver_info = BTUSB_ATH3012 },
 233         { USB_DEVICE(0x0cf3, 0xe006), .driver_info = BTUSB_ATH3012 },
 234         { USB_DEVICE(0x13d3, 0x3362), .driver_info = BTUSB_ATH3012 },
 235         { USB_DEVICE(0x13d3, 0x3375), .driver_info = BTUSB_ATH3012 },
 236         { USB_DEVICE(0x13d3, 0x3393), .driver_info = BTUSB_ATH3012 },
 237         { USB_DEVICE(0x13d3, 0x3395), .driver_info = BTUSB_ATH3012 },
 238         { USB_DEVICE(0x13d3, 0x3402), .driver_info = BTUSB_ATH3012 },
 239         { USB_DEVICE(0x13d3, 0x3408), .driver_info = BTUSB_ATH3012 },
 240         { USB_DEVICE(0x13d3, 0x3423), .driver_info = BTUSB_ATH3012 },
 241         { USB_DEVICE(0x13d3, 0x3432), .driver_info = BTUSB_ATH3012 },
 242         { USB_DEVICE(0x13d3, 0x3472), .driver_info = BTUSB_ATH3012 },
 243         { USB_DEVICE(0x13d3, 0x3474), .driver_info = BTUSB_ATH3012 },
 244         { USB_DEVICE(0x13d3, 0x3487), .driver_info = BTUSB_ATH3012 },
 245         { USB_DEVICE(0x13d3, 0x3490), .driver_info = BTUSB_ATH3012 },
 246
 247         /* Atheros AR5BBU12 with sflash firmware */
 248         { USB_DEVICE(0x0489, 0xe02c), .driver_info = BTUSB_IGNORE },
 249
 250         /* Atheros AR5BBU12 with sflash firmware */
 251         { USB_DEVICE(0x0489, 0xe036), .driver_info = BTUSB_ATH3012 },
 252         { USB_DEVICE(0x0489, 0xe03c), .driver_info = BTUSB_ATH3012 },
 253
 254         /* QCA ROME chipset */
 255         { USB_DEVICE(0x0cf3, 0x535b), .driver_info = BTUSB_QCA_ROME |
 256                                                      BTUSB_WIDEBAND_SPEECH },
 257         { USB_DEVICE(0x0cf3, 0xe007), .driver_info = BTUSB_QCA_ROME |
 258                                                      BTUSB_WIDEBAND_SPEECH },
 259         { USB_DEVICE(0x0cf3, 0xe009), .driver_info = BTUSB_QCA_ROME |
 260                                                      BTUSB_WIDEBAND_SPEECH },
 261         { USB_DEVICE(0x0cf3, 0xe010), .driver_info = BTUSB_QCA_ROME |
 262                                                      BTUSB_WIDEBAND_SPEECH },
 263         { USB_DEVICE(0x0cf3, 0xe300), .driver_info = BTUSB_QCA_ROME |
 264                                                      BTUSB_WIDEBAND_SPEECH },
 265         { USB_DEVICE(0x0cf3, 0xe301), .driver_info = BTUSB_QCA_ROME |
 266                                                      BTUSB_WIDEBAND_SPEECH },
 267         { USB_DEVICE(0x0cf3, 0xe360), .driver_info = BTUSB_QCA_ROME |
 268                                                      BTUSB_WIDEBAND_SPEECH },
 269         { USB_DEVICE(0x0cf3, 0xe500), .driver_info = BTUSB_QCA_ROME |
 270                                                      BTUSB_WIDEBAND_SPEECH },
 271         { USB_DEVICE(0x0489, 0xe092), .driver_info = BTUSB_QCA_ROME |
 272                                                      BTUSB_WIDEBAND_SPEECH },
 273         { USB_DEVICE(0x0489, 0xe09f), .driver_info = BTUSB_QCA_ROME |
 274                                                      BTUSB_WIDEBAND_SPEECH },
 275         { USB_DEVICE(0x0489, 0xe0a2), .driver_info = BTUSB_QCA_ROME |
 276                                                      BTUSB_WIDEBAND_SPEECH },
 277         { USB_DEVICE(0x04ca, 0x3011), .driver_info = BTUSB_QCA_ROME |
 278                                                      BTUSB_WIDEBAND_SPEECH },
 279         { USB_DEVICE(0x04ca, 0x3015), .driver_info = BTUSB_QCA_ROME |
 280                                                      BTUSB_WIDEBAND_SPEECH },
 281         { USB_DEVICE(0x04ca, 0x3016), .driver_info = BTUSB_QCA_ROME |
 282                                                      BTUSB_WIDEBAND_SPEECH },
 283         { USB_DEVICE(0x04ca, 0x301a), .driver_info = BTUSB_QCA_ROME |
 284                                                      BTUSB_WIDEBAND_SPEECH },
 285         { USB_DEVICE(0x04ca, 0x3021), .driver_info = BTUSB_QCA_ROME |
 286                                                      BTUSB_WIDEBAND_SPEECH },
 287         { USB_DEVICE(0x13d3, 0x3491), .driver_info = BTUSB_QCA_ROME |
 288                                                      BTUSB_WIDEBAND_SPEECH },
 289         { USB_DEVICE(0x13d3, 0x3496), .driver_info = BTUSB_QCA_ROME |
 290                                                      BTUSB_WIDEBAND_SPEECH },
 291         { USB_DEVICE(0x13d3, 0x3501), .driver_info = BTUSB_QCA_ROME |
 292                                                      BTUSB_WIDEBAND_SPEECH },
 293
 294         /* QCA WCN6855 chipset */
 295         { USB_DEVICE(0x0cf3, 0xe600), .driver_info = BTUSB_QCA_WCN6855 |
 296                                                      BTUSB_WIDEBAND_SPEECH |
 297                                                      BTUSB_VALID_LE_STATES },
 298
 299         /* Broadcom BCM2035 */
 300         { USB_DEVICE(0x0a5c, 0x2009), .driver_info = BTUSB_BCM92035 },
 301         { USB_DEVICE(0x0a5c, 0x200a), .driver_info = BTUSB_WRONG_SCO_MTU },
 302         { USB_DEVICE(0x0a5c, 0x2035), .driver_info = BTUSB_WRONG_SCO_MTU },
 303
 304         /* Broadcom BCM2045 */
 305         { USB_DEVICE(0x0a5c, 0x2039), .driver_info = BTUSB_WRONG_SCO_MTU },
 306         { USB_DEVICE(0x0a5c, 0x2101), .driver_info = BTUSB_WRONG_SCO_MTU },
 307
 308         /* IBM/Lenovo ThinkPad with Broadcom chip */
 309         { USB_DEVICE(0x0a5c, 0x201e), .driver_info = BTUSB_WRONG_SCO_MTU },
 310         { USB_DEVICE(0x0a5c, 0x2110), .driver_info = BTUSB_WRONG_SCO_MTU },
 311
 312         /* HP laptop with Broadcom chip */
 313         { USB_DEVICE(0x03f0, 0x171d), .driver_info = BTUSB_WRONG_SCO_MTU },
 314
 315         /* Dell laptop with Broadcom chip */
 316         { USB_DEVICE(0x413c, 0x8126), .driver_info = BTUSB_WRONG_SCO_MTU },
 317
 318         /* Dell Wireless 370 and 410 devices */
 319         { USB_DEVICE(0x413c, 0x8152), .driver_info = BTUSB_WRONG_SCO_MTU },
 320         { USB_DEVICE(0x413c, 0x8156), .driver_info = BTUSB_WRONG_SCO_MTU },
 321
 322         /* Belkin F8T012 and F8T013 devices */
 323         { USB_DEVICE(0x050d, 0x0012), .driver_info = BTUSB_WRONG_SCO_MTU },
 324         { USB_DEVICE(0x050d, 0x0013), .driver_info = BTUSB_WRONG_SCO_MTU },
 325
 326         /* Asus WL-BTD202 device */
 327         { USB_DEVICE(0x0b05, 0x1715), .driver_info = BTUSB_WRONG_SCO_MTU },
 328
 329         /* Kensington Bluetooth USB adapter */
 330         { USB_DEVICE(0x047d, 0x105e), .driver_info = BTUSB_WRONG_SCO_MTU },
 331
 332         /* RTX Telecom based adapters with buggy SCO support */
 333         { USB_DEVICE(0x0400, 0x0807), .driver_info = BTUSB_BROKEN_ISOC },
 334         { USB_DEVICE(0x0400, 0x080a), .driver_info = BTUSB_BROKEN_ISOC },
 335
 336         /* CONWISE Technology based adapters with buggy SCO support */
 337         { USB_DEVICE(0x0e5e, 0x6622),
 338           .driver_info = BTUSB_BROKEN_ISOC | BTUSB_CW6622},
 339
 340         /* Roper Class 1 Bluetooth Dongle (Silicon Wave based) */
 341         { USB_DEVICE(0x1310, 0x0001), .driver_info = BTUSB_SWAVE },
 342
 343         /* Digianswer devices */
 344         { USB_DEVICE(0x08fd, 0x0001), .driver_info = BTUSB_DIGIANSWER },
 345         { USB_DEVICE(0x08fd, 0x0002), .driver_info = BTUSB_IGNORE },
 346
 347         /* CSR BlueCore Bluetooth Sniffer */
 348         { USB_DEVICE(0x0a12, 0x0002),
 349           .driver_info = BTUSB_SNIFFER | BTUSB_BROKEN_ISOC },
 350
 351         /* Frontline ComProbe Bluetooth Sniffer */
 352         { USB_DEVICE(0x16d3, 0x0002),
 353           .driver_info = BTUSB_SNIFFER | BTUSB_BROKEN_ISOC },
 354
 355         /* Marvell Bluetooth devices */
 356         { USB_DEVICE(0x1286, 0x2044), .driver_info = BTUSB_MARVELL },
 357         { USB_DEVICE(0x1286, 0x2046), .driver_info = BTUSB_MARVELL },
 358         { USB_DEVICE(0x1286, 0x204e), .driver_info = BTUSB_MARVELL },
 359
 360         /* Intel Bluetooth devices */
 361         { USB_DEVICE(0x8087, 0x0025), .driver_info = BTUSB_INTEL_COMBINED },
 362         { USB_DEVICE(0x8087, 0x0026), .driver_info = BTUSB_INTEL_COMBINED },
 363         { USB_DEVICE(0x8087, 0x0029), .driver_info = BTUSB_INTEL_COMBINED },
 364         { USB_DEVICE(0x8087, 0x0032), .driver_info = BTUSB_INTEL_COMBINED },
 365         { USB_DEVICE(0x8087, 0x0033), .driver_info = BTUSB_INTEL_COMBINED },
 366         { USB_DEVICE(0x8087, 0x07da), .driver_info = BTUSB_CSR },
 367         { USB_DEVICE(0x8087, 0x07dc), .driver_info = BTUSB_INTEL_COMBINED |
 368                                                      BTUSB_INTEL_BROKEN_INITIAL_NCMD },
 369         { USB_DEVICE(0x8087, 0x0a2a), .driver_info = BTUSB_INTEL_COMBINED },
 370         { USB_DEVICE(0x8087, 0x0a2b), .driver_info = BTUSB_INTEL_COMBINED },
 371         { USB_DEVICE(0x8087, 0x0aa7), .driver_info = BTUSB_INTEL_COMBINED },
 372         { USB_DEVICE(0x8087, 0x0aaa), .driver_info = BTUSB_INTEL_COMBINED },
 373
 374         /* Other Intel Bluetooth devices */
 375         { USB_VENDOR_AND_INTERFACE_INFO(0x8087, 0xe0, 0x01, 0x01),
 376           .driver_info = BTUSB_IGNORE },
 377
 378         /* Realtek 8822CE Bluetooth devices */
 379         { USB_DEVICE(0x0bda, 0xb00c), .driver_info = BTUSB_REALTEK |
 380                                                      BTUSB_WIDEBAND_SPEECH },
 381         { USB_DEVICE(0x0bda, 0xc822), .driver_info = BTUSB_REALTEK |
 382                                                      BTUSB_WIDEBAND_SPEECH },
 383
 384         /* Realtek 8852AE Bluetooth devices */
 385         { USB_DEVICE(0x0bda, 0xc852), .driver_info = BTUSB_REALTEK |
 386                                                      BTUSB_WIDEBAND_SPEECH },
 387         { USB_DEVICE(0x0bda, 0x4852), .driver_info = BTUSB_REALTEK |
 388                                                      BTUSB_WIDEBAND_SPEECH },
 389         { USB_DEVICE(0x04c5, 0x165c), .driver_info = BTUSB_REALTEK |
 390                                                      BTUSB_WIDEBAND_SPEECH },
 391         { USB_DEVICE(0x04ca, 0x4006), .driver_info = BTUSB_REALTEK |
 392                                                      BTUSB_WIDEBAND_SPEECH },
 393
 394         /* Realtek Bluetooth devices */
 395         { USB_VENDOR_AND_INTERFACE_INFO(0x0bda, 0xe0, 0x01, 0x01),
 396           .driver_info = BTUSB_REALTEK },
 397
 398         /* MediaTek Bluetooth devices */
 399         { USB_VENDOR_AND_INTERFACE_INFO(0x0e8d, 0xe0, 0x01, 0x01),
 400           .driver_info = BTUSB_MEDIATEK |
 401                          BTUSB_WIDEBAND_SPEECH |
 402                          BTUSB_VALID_LE_STATES },
 403
 404         /* Additional MediaTek MT7615E Bluetooth devices */
 405         { USB_DEVICE(0x13d3, 0x3560), .driver_info = BTUSB_MEDIATEK},
 406
 407         /* Additional MediaTek MT7668 Bluetooth devices */
 408         { USB_DEVICE(0x043e, 0x3109), .driver_info = BTUSB_MEDIATEK |
 409                                                      BTUSB_WIDEBAND_SPEECH |
 410                                                      BTUSB_VALID_LE_STATES },
 411
 412         /* Additional MediaTek MT7921 Bluetooth devices */
 413         { USB_DEVICE(0x04ca, 0x3802), .driver_info = BTUSB_MEDIATEK |
 414                                                      BTUSB_WIDEBAND_SPEECH |
 415                                                      BTUSB_VALID_LE_STATES },
 416         { USB_DEVICE(0x13d3, 0x3563), .driver_info = BTUSB_MEDIATEK |
 417                                                      BTUSB_WIDEBAND_SPEECH |
 418                                                      BTUSB_VALID_LE_STATES },
 419         { USB_DEVICE(0x13d3, 0x3564), .driver_info = BTUSB_MEDIATEK |
 420                                                      BTUSB_WIDEBAND_SPEECH |
 421                                                      BTUSB_VALID_LE_STATES },
 422         { USB_DEVICE(0x0489, 0xe0cd), .driver_info = BTUSB_MEDIATEK |
 423                                                      BTUSB_WIDEBAND_SPEECH |
 424                                                      BTUSB_VALID_LE_STATES },
 425
 426         /* Additional Realtek 8723AE Bluetooth devices */
 427         { USB_DEVICE(0x0930, 0x021d), .driver_info = BTUSB_REALTEK },
 428         { USB_DEVICE(0x13d3, 0x3394), .driver_info = BTUSB_REALTEK },
 429
 430         /* Additional Realtek 8723BE Bluetooth devices */
 431         { USB_DEVICE(0x0489, 0xe085), .driver_info = BTUSB_REALTEK },
 432         { USB_DEVICE(0x0489, 0xe08b), .driver_info = BTUSB_REALTEK },
 433         { USB_DEVICE(0x13d3, 0x3410), .driver_info = BTUSB_REALTEK },
 434         { USB_DEVICE(0x13d3, 0x3416), .driver_info = BTUSB_REALTEK },
 435         { USB_DEVICE(0x13d3, 0x3459), .driver_info = BTUSB_REALTEK },
 436         { USB_DEVICE(0x13d3, 0x3494), .driver_info = BTUSB_REALTEK },
 437
 438         /* Additional Realtek 8723BU Bluetooth devices */
 439         { USB_DEVICE(0x7392, 0xa611), .driver_info = BTUSB_REALTEK },
 440
 441         /* Additional Realtek 8723DE Bluetooth devices */
 442         { USB_DEVICE(0x0bda, 0xb009), .driver_info = BTUSB_REALTEK },
 443         { USB_DEVICE(0x2ff8, 0xb011), .driver_info = BTUSB_REALTEK },
 444
 445         /* Additional Realtek 8761B Bluetooth devices */
 446         { USB_DEVICE(0x2357, 0x0604), .driver_info = BTUSB_REALTEK |
 447                                                      BTUSB_WIDEBAND_SPEECH },
 448
 449         /* Additional Realtek 8761BU Bluetooth devices */
 450         { USB_DEVICE(0x0b05, 0x190e), .driver_info = BTUSB_REALTEK |
 451                                                      BTUSB_WIDEBAND_SPEECH },
 452
 453         /* Additional Realtek 8821AE Bluetooth devices */
 454         { USB_DEVICE(0x0b05, 0x17dc), .driver_info = BTUSB_REALTEK },
 455         { USB_DEVICE(0x13d3, 0x3414), .driver_info = BTUSB_REALTEK },
 456         { USB_DEVICE(0x13d3, 0x3458), .driver_info = BTUSB_REALTEK },
 457         { USB_DEVICE(0x13d3, 0x3461), .driver_info = BTUSB_REALTEK },
 458         { USB_DEVICE(0x13d3, 0x3462), .driver_info = BTUSB_REALTEK },
 459
 460         /* Additional Realtek 8822BE Bluetooth devices */
 461         { USB_DEVICE(0x13d3, 0x3526), .driver_info = BTUSB_REALTEK },
 462         { USB_DEVICE(0x0b05, 0x185c), .driver_info = BTUSB_REALTEK },
 463
 464         /* Additional Realtek 8822CE Bluetooth devices */
 465         { USB_DEVICE(0x04ca, 0x4005), .driver_info = BTUSB_REALTEK |
 466                                                      BTUSB_WIDEBAND_SPEECH },
 467         { USB_DEVICE(0x04c5, 0x161f), .driver_info = BTUSB_REALTEK |
 468                                                      BTUSB_WIDEBAND_SPEECH },
 469         { USB_DEVICE(0x0b05, 0x18ef), .driver_info = BTUSB_REALTEK |
 470                                                      BTUSB_WIDEBAND_SPEECH },
 471         { USB_DEVICE(0x13d3, 0x3548), .driver_info = BTUSB_REALTEK |
 472                                                      BTUSB_WIDEBAND_SPEECH },
 473         { USB_DEVICE(0x13d3, 0x3549), .driver_info = BTUSB_REALTEK |
 474                                                      BTUSB_WIDEBAND_SPEECH },
 475         { USB_DEVICE(0x13d3, 0x3553), .driver_info = BTUSB_REALTEK |
 476                                                      BTUSB_WIDEBAND_SPEECH },
 477         { USB_DEVICE(0x13d3, 0x3555), .driver_info = BTUSB_REALTEK |
 478                                                      BTUSB_WIDEBAND_SPEECH },
 479         { USB_DEVICE(0x2ff8, 0x3051), .driver_info = BTUSB_REALTEK |
 480                                                      BTUSB_WIDEBAND_SPEECH },
 481         { USB_DEVICE(0x1358, 0xc123), .driver_info = BTUSB_REALTEK |
 482                                                      BTUSB_WIDEBAND_SPEECH },
 483         { USB_DEVICE(0x0bda, 0xc123), .driver_info = BTUSB_REALTEK |
 484                                                      BTUSB_WIDEBAND_SPEECH },
 485         { USB_DEVICE(0x0cb5, 0xc547), .driver_info = BTUSB_REALTEK |
 486                                                      BTUSB_WIDEBAND_SPEECH },
 487
 488         /* Silicon Wave based devices */
 489         { USB_DEVICE(0x0c10, 0x0000), .driver_info = BTUSB_SWAVE },
 490
 491         { }     /* Terminating entry */
 492 };
 493
 494 /* The Bluetooth USB module build into some devices needs to be reset on resume,
 495  * this is a problem with the platform (likely shutting off all power) not with
 496  * the module itself. So we use a DMI list to match known broken platforms.
 497  */
 498 static const struct dmi_system_id btusb_needs_reset_resume_table[] = {
 499         {
 500                 /* Dell OptiPlex 3060 (QCA ROME device 0cf3:e007) */
 501                 .matches = {
 502                         DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."),
 503                         DMI_MATCH(DMI_PRODUCT_NAME, "OptiPlex 3060"),
 504                 },
 505         },
 506         {
 507                 /* Dell XPS 9360 (QCA ROME device 0cf3:e300) */
 508                 .matches = {
 509                         DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."),
 510                         DMI_MATCH(DMI_PRODUCT_NAME, "XPS 13 9360"),
 511                 },
 512         },
 513         {
 514                 /* Dell Inspiron 5565 (QCA ROME device 0cf3:e009) */
 515                 .matches = {
 516                         DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."),
 517                         DMI_MATCH(DMI_PRODUCT_NAME, "Inspiron 5565"),
 518                 },
 519         },
 520         {}
 521 };
 522
 523 #define BTUSB_MAX_ISOC_FRAMES   10
 524
 525 #define BTUSB_INTR_RUNNING      0
 526 #define BTUSB_BULK_RUNNING      1
 527 #define BTUSB_ISOC_RUNNING      2
 528 #define BTUSB_SUSPENDING        3
 529 #define BTUSB_DID_ISO_RESUME    4
 530 #define BTUSB_BOOTLOADER        5
 531 #define BTUSB_DOWNLOADING       6
 532 #define BTUSB_FIRMWARE_LOADED   7
 533 #define BTUSB_FIRMWARE_FAILED   8
 534 #define BTUSB_BOOTING           9
 535 #define BTUSB_DIAG_RUNNING      10
 536 #define BTUSB_OOB_WAKE_ENABLED  11
 537 #define BTUSB_HW_RESET_ACTIVE   12
 538 #define BTUSB_TX_WAIT_VND_EVT   13
 539 #define BTUSB_WAKEUP_AUTOSUSPEND        14
 540 #define BTUSB_USE_ALT3_FOR_WBS  15
 541
 542 struct btusb_data {
 543         struct hci_dev       *hdev;
 544         struct usb_device    *udev;
 545         struct usb_interface *intf;
 546         struct usb_interface *isoc;
 547         struct usb_interface *diag;
 548         unsigned isoc_ifnum;
 549
 550         unsigned long flags;
 551
 552         struct work_struct work;
 553         struct work_struct waker;
 554
 555         struct usb_anchor deferred;
 556         struct usb_anchor tx_anchor;
 557         int tx_in_flight;
 558         spinlock_t txlock;
 559
 560         struct usb_anchor intr_anchor;
 561         struct usb_anchor bulk_anchor;
 562         struct usb_anchor isoc_anchor;
 563         struct usb_anchor diag_anchor;
 564         struct usb_anchor ctrl_anchor;
 565         spinlock_t rxlock;
 566
 567         struct sk_buff *evt_skb;
 568         struct sk_buff *acl_skb;
 569         struct sk_buff *sco_skb;
 570
 571         struct usb_endpoint_descriptor *intr_ep;
 572         struct usb_endpoint_descriptor *bulk_tx_ep;
 573         struct usb_endpoint_descriptor *bulk_rx_ep;
 574         struct usb_endpoint_descriptor *isoc_tx_ep;
 575         struct usb_endpoint_descriptor *isoc_rx_ep;
 576         struct usb_endpoint_descriptor *diag_tx_ep;
 577         struct usb_endpoint_descriptor *diag_rx_ep;
 578
 579         struct gpio_desc *reset_gpio;
 580
 581         __u8 cmdreq_type;
 582         __u8 cmdreq;
 583
 584         unsigned int sco_num;
 585         unsigned int air_mode;
 586         bool usb_alt6_packet_flow;
 587         int isoc_altsetting;
 588         int suspend_count;
 589
 590         int (*recv_event)(struct hci_dev *hdev, struct sk_buff *skb);
 591         int (*recv_acl)(struct hci_dev *hdev, struct sk_buff *skb);
 592         int (*recv_bulk)(struct btusb_data *data, void *buffer, int count);
 593
 594         int (*setup_on_usb)(struct hci_dev *hdev);
 595
 596         int oob_wake_irq;   /* irq for out-of-band wake-on-bt */
 597         unsigned cmd_timeout_cnt;
 598 };
 599
 600 static void btusb_intel_cmd_timeout(struct hci_dev *hdev)
 601 {
 602         struct btusb_data *data = hci_get_drvdata(hdev);
 603         struct gpio_desc *reset_gpio = data->reset_gpio;
 604
 605         if (++data->cmd_timeout_cnt < 5)
 606                 return;
 607
 608         if (!reset_gpio) {
 609                 bt_dev_err(hdev, "No way to reset. Ignoring and continuing");
 610                 return;
 611         }
 612
 613         /*
 614          * Toggle the hard reset line if the platform provides one. The reset
 615          * is going to yank the device off the USB and then replug. So doing
 616          * once is enough. The cleanup is handled correctly on the way out
 617          * (standard USB disconnect), and the new device is detected cleanly
 618          * and bound to the driver again like it should be.
 619          */
 620         if (test_and_set_bit(BTUSB_HW_RESET_ACTIVE, &data->flags)) {
 621                 bt_dev_err(hdev, "last reset failed? Not resetting again");
 622                 return;
 623         }
 624
 625         bt_dev_err(hdev, "Initiating HW reset via gpio");
 626         gpiod_set_value_cansleep(reset_gpio, 1);
 627         msleep(100);
 628         gpiod_set_value_cansleep(reset_gpio, 0);
 629 }
 630
 631 static void btusb_rtl_cmd_timeout(struct hci_dev *hdev)
 632 {
 633         struct btusb_data *data = hci_get_drvdata(hdev);
 634         struct gpio_desc *reset_gpio = data->reset_gpio;
 635
 636         if (++data->cmd_timeout_cnt < 5)
 637                 return;
 638
 639         if (!reset_gpio) {
 640                 bt_dev_err(hdev, "No gpio to reset Realtek device, ignoring");
 641                 return;
 642         }
 643
 644         /* Toggle the hard reset line. The Realtek device is going to
 645          * yank itself off the USB and then replug. The cleanup is handled
 646          * correctly on the way out (standard USB disconnect), and the new
 647          * device is detected cleanly and bound to the driver again like
 648          * it should be.
 649          */
 650         if (test_and_set_bit(BTUSB_HW_RESET_ACTIVE, &data->flags)) {
 651                 bt_dev_err(hdev, "last reset failed? Not resetting again");
 652                 return;
 653         }
 654
 655         bt_dev_err(hdev, "Reset Realtek device via gpio");
 656         gpiod_set_value_cansleep(reset_gpio, 1);
 657         msleep(200);
 658         gpiod_set_value_cansleep(reset_gpio, 0);
 659 }
 660
 661 static void btusb_qca_cmd_timeout(struct hci_dev *hdev)
 662 {
 663         struct btusb_data *data = hci_get_drvdata(hdev);
 664         struct gpio_desc *reset_gpio = data->reset_gpio;
 665         int err;
 666
 667         if (++data->cmd_timeout_cnt < 5)
 668                 return;
 669
 670         if (reset_gpio) {
 671                 bt_dev_err(hdev, "Reset qca device via bt_en gpio");
 672
 673                 /* Toggle the hard reset line. The qca bt device is going to
 674                  * yank itself off the USB and then replug. The cleanup is handled
 675                  * correctly on the way out (standard USB disconnect), and the new
 676                  * device is detected cleanly and bound to the driver again like
 677                  * it should be.
 678                  */
 679                 if (test_and_set_bit(BTUSB_HW_RESET_ACTIVE, &data->flags)) {
 680                         bt_dev_err(hdev, "last reset failed? Not resetting again");
 681                         return;
 682                 }
 683
 684                 gpiod_set_value_cansleep(reset_gpio, 0);
 685                 msleep(200);
 686                 gpiod_set_value_cansleep(reset_gpio, 1);
 687
 688                 return;
 689         }
 690
 691         bt_dev_err(hdev, "Multiple cmd timeouts seen. Resetting usb device.");
 692         /* This is not an unbalanced PM reference since the device will reset */
 693         err = usb_autopm_get_interface(data->intf);
 694         if (!err)
 695                 usb_queue_reset_device(data->intf);
 696         else
 697                 bt_dev_err(hdev, "Failed usb_autopm_get_interface with %d", err);
 698 }
 699
 700 static inline void btusb_free_frags(struct btusb_data *data)
 701 {
 702         unsigned long flags;
 703
 704         spin_lock_irqsave(&data->rxlock, flags);
 705
 706         kfree_skb(data->evt_skb);
 707         data->evt_skb = NULL;
 708
 709         kfree_skb(data->acl_skb);
 710         data->acl_skb = NULL;
 711
 712         kfree_skb(data->sco_skb);
 713         data->sco_skb = NULL;
 714
 715         spin_unlock_irqrestore(&data->rxlock, flags);
 716 }
 717
 718 static int btusb_recv_intr(struct btusb_data *data, void *buffer, int count)
 719 {
 720         struct sk_buff *skb;
 721         unsigned long flags;
 722         int err = 0;
 723
 724         spin_lock_irqsave(&data->rxlock, flags);
 725         skb = data->evt_skb;
 726
 727         while (count) {
 728                 int len;
 729
 730                 if (!skb) {
 731                         skb = bt_skb_alloc(HCI_MAX_EVENT_SIZE, GFP_ATOMIC);
 732                         if (!skb) {
 733                                 err = -ENOMEM;
 734                                 break;
 735                         }
 736
 737                         hci_skb_pkt_type(skb) = HCI_EVENT_PKT;
 738                         hci_skb_expect(skb) = HCI_EVENT_HDR_SIZE;
 739                 }
 740
 741                 len = min_t(uint, hci_skb_expect(skb), count);
 742                 skb_put_data(skb, buffer, len);
 743
 744                 count -= len;
 745                 buffer += len;
 746                 hci_skb_expect(skb) -= len;
 747
 748                 if (skb->len == HCI_EVENT_HDR_SIZE) {
 749                         /* Complete event header */
 750                         hci_skb_expect(skb) = hci_event_hdr(skb)->plen;
 751
 752                         if (skb_tailroom(skb) < hci_skb_expect(skb)) {
 753                                 kfree_skb(skb);
 754                                 skb = NULL;
 755
 756                                 err = -EILSEQ;
 757                                 break;
 758                         }
 759                 }
 760
 761                 if (!hci_skb_expect(skb)) {
 762                         /* Complete frame */
 763                         data->recv_event(data->hdev, skb);
 764                         skb = NULL;
 765                 }
 766         }
 767
 768         data->evt_skb = skb;
 769         spin_unlock_irqrestore(&data->rxlock, flags);
 770
 771         return err;
 772 }
 773
 774 static int btusb_recv_bulk(struct btusb_data *data, void *buffer, int count)
 775 {
 776         struct sk_buff *skb;
 777         unsigned long flags;
 778         int err = 0;
 779
 780         spin_lock_irqsave(&data->rxlock, flags);
 781         skb = data->acl_skb;
 782
 783         while (count) {
 784                 int len;
 785
 786                 if (!skb) {
 787                         skb = bt_skb_alloc(HCI_MAX_FRAME_SIZE, GFP_ATOMIC);
 788                         if (!skb) {
 789                                 err = -ENOMEM;
 790                                 break;
 791                         }
 792
 793                         hci_skb_pkt_type(skb) = HCI_ACLDATA_PKT;
 794                         hci_skb_expect(skb) = HCI_ACL_HDR_SIZE;
 795                 }
 796
 797                 len = min_t(uint, hci_skb_expect(skb), count);
 798                 skb_put_data(skb, buffer, len);
 799
 800                 count -= len;
 801                 buffer += len;
 802                 hci_skb_expect(skb) -= len;
 803
 804                 if (skb->len == HCI_ACL_HDR_SIZE) {
 805                         __le16 dlen = hci_acl_hdr(skb)->dlen;
 806
 807                         /* Complete ACL header */
 808                         hci_skb_expect(skb) = __le16_to_cpu(dlen);
 809
 810                         if (skb_tailroom(skb) < hci_skb_expect(skb)) {
 811                                 kfree_skb(skb);
 812                                 skb = NULL;
 813
 814                                 err = -EILSEQ;
 815                                 break;
 816                         }
 817                 }
 818
 819                 if (!hci_skb_expect(skb)) {
 820                         /* Complete frame */
 821                         data->recv_acl(data->hdev, skb);
 822                         skb = NULL;
 823                 }
 824         }
 825
 826         data->acl_skb = skb;
 827         spin_unlock_irqrestore(&data->rxlock, flags);
 828
 829         return err;
 830 }
 831
 832 static int btusb_recv_isoc(struct btusb_data *data, void *buffer, int count)
 833 {
 834         struct sk_buff *skb;
 835         unsigned long flags;
 836         int err = 0;
 837
 838         spin_lock_irqsave(&data->rxlock, flags);
 839         skb = data->sco_skb;
 840
 841         while (count) {
 842                 int len;
 843
 844                 if (!skb) {
 845                         skb = bt_skb_alloc(HCI_MAX_SCO_SIZE, GFP_ATOMIC);
 846                         if (!skb) {
 847                                 err = -ENOMEM;
 848                                 break;
 849                         }
 850
 851                         hci_skb_pkt_type(skb) = HCI_SCODATA_PKT;
 852                         hci_skb_expect(skb) = HCI_SCO_HDR_SIZE;
 853                 }
 854
 855                 len = min_t(uint, hci_skb_expect(skb), count);
 856                 skb_put_data(skb, buffer, len);
 857
 858                 count -= len;
 859                 buffer += len;
 860                 hci_skb_expect(skb) -= len;
 861
 862                 if (skb->len == HCI_SCO_HDR_SIZE) {
 863                         /* Complete SCO header */
 864                         hci_skb_expect(skb) = hci_sco_hdr(skb)->dlen;
 865
 866                         if (skb_tailroom(skb) < hci_skb_expect(skb)) {
 867                                 kfree_skb(skb);
 868                                 skb = NULL;
 869
 870                                 err = -EILSEQ;
 871                                 break;
 872                         }
 873                 }
 874
 875                 if (!hci_skb_expect(skb)) {
 876                         /* Complete frame */
 877                         hci_recv_frame(data->hdev, skb);
 878                         skb = NULL;
 879                 }
 880         }
 881
 882         data->sco_skb = skb;
 883         spin_unlock_irqrestore(&data->rxlock, flags);
 884
 885         return err;
 886 }
 887
 888 static void btusb_intr_complete(struct urb *urb)
 889 {
 890         struct hci_dev *hdev = urb->context;
 891         struct btusb_data *data = hci_get_drvdata(hdev);
 892         int err;
 893
 894         BT_DBG("%s urb %p status %d count %d", hdev->name, urb, urb->status,
 895                urb->actual_length);
 896
 897         if (!test_bit(HCI_RUNNING, &hdev->flags))
 898                 return;
 899
 900         if (urb->status == 0) {
 901                 hdev->stat.byte_rx += urb->actual_length;
 902
 903                 if (btusb_recv_intr(data, urb->transfer_buffer,
 904                                     urb->actual_length) < 0) {
 905                         bt_dev_err(hdev, "corrupted event packet");
 906                         hdev->stat.err_rx++;
 907                 }
 908         } else if (urb->status == -ENOENT) {
 909                 /* Avoid suspend failed when usb_kill_urb */
 910                 return;
 911         }
 912
 913         if (!test_bit(BTUSB_INTR_RUNNING, &data->flags))
 914                 return;
 915
 916         usb_mark_last_busy(data->udev);
 917         usb_anchor_urb(urb, &data->intr_anchor);
 918
 919         err = usb_submit_urb(urb, GFP_ATOMIC);
 920         if (err < 0) {
 921                 /* -EPERM: urb is being killed;
 922                  * -ENODEV: device got disconnected
 923                  */
 924                 if (err != -EPERM && err != -ENODEV)
 925                         bt_dev_err(hdev, "urb %p failed to resubmit (%d)",
 926                                    urb, -err);
 927                 usb_unanchor_urb(urb);
 928         }
 929 }
 930
 931 static int btusb_submit_intr_urb(struct hci_dev *hdev, gfp_t mem_flags)
 932 {
 933         struct btusb_data *data = hci_get_drvdata(hdev);
 934         struct urb *urb;
 935         unsigned char *buf;
 936         unsigned int pipe;
 937         int err, size;
 938
 939         BT_DBG("%s", hdev->name);
 940
 941         if (!data->intr_ep)
 942                 return -ENODEV;
 943
 944         urb = usb_alloc_urb(0, mem_flags);
 945         if (!urb)
 946                 return -ENOMEM;
 947
 948         size = le16_to_cpu(data->intr_ep->wMaxPacketSize);
 949
 950         buf = kmalloc(size, mem_flags);
 951         if (!buf) {
 952                 usb_free_urb(urb);
 953                 return -ENOMEM;
 954         }
 955
 956         pipe = usb_rcvintpipe(data->udev, data->intr_ep->bEndpointAddress);
 957
 958         usb_fill_int_urb(urb, data->udev, pipe, buf, size,
 959                          btusb_intr_complete, hdev, data->intr_ep->bInterval);
 960
 961         urb->transfer_flags |= URB_FREE_BUFFER;
 962
 963         usb_anchor_urb(urb, &data->intr_anchor);
 964
 965         err = usb_submit_urb(urb, mem_flags);
 966         if (err < 0) {
 967                 if (err != -EPERM && err != -ENODEV)
 968                         bt_dev_err(hdev, "urb %p submission failed (%d)",
 969                                    urb, -err);
 970                 usb_unanchor_urb(urb);
 971         }
 972
 973         usb_free_urb(urb);
 974
 975         return err;
 976 }
 977
 978 static void btusb_bulk_complete(struct urb *urb)
 979 {
 980         struct hci_dev *hdev = urb->context;
 981         struct btusb_data *data = hci_get_drvdata(hdev);
 982         int err;
 983
 984         BT_DBG("%s urb %p status %d count %d", hdev->name, urb, urb->status,
 985                urb->actual_length);
 986
 987         if (!test_bit(HCI_RUNNING, &hdev->flags))
 988                 return;
 989
 990         if (urb->status == 0) {
 991                 hdev->stat.byte_rx += urb->actual_length;
 992
 993                 if (data->recv_bulk(data, urb->transfer_buffer,
 994                                     urb->actual_length) < 0) {
 995                         bt_dev_err(hdev, "corrupted ACL packet");
 996                         hdev->stat.err_rx++;
 997                 }
 998         } else if (urb->status == -ENOENT) {
 999                 /* Avoid suspend failed when usb_kill_urb */
1000                 return;
1001         }
1002
1003         if (!test_bit(BTUSB_BULK_RUNNING, &data->flags))
1004                 return;
1005
1006         usb_anchor_urb(urb, &data->bulk_anchor);
1007         usb_mark_last_busy(data->udev);
1008
1009         err = usb_submit_urb(urb, GFP_ATOMIC);
1010         if (err < 0) {
1011                 /* -EPERM: urb is being killed;
1012                  * -ENODEV: device got disconnected
1013                  */
1014                 if (err != -EPERM && err != -ENODEV)
1015                         bt_dev_err(hdev, "urb %p failed to resubmit (%d)",
1016                                    urb, -err);
1017                 usb_unanchor_urb(urb);
1018         }
1019 }
1020
1021 static int btusb_submit_bulk_urb(struct hci_dev *hdev, gfp_t mem_flags)
1022 {
1023         struct btusb_data *data = hci_get_drvdata(hdev);
1024         struct urb *urb;
1025         unsigned char *buf;
1026         unsigned int pipe;
1027         int err, size = HCI_MAX_FRAME_SIZE;
1028
1029         BT_DBG("%s", hdev->name);
1030
1031         if (!data->bulk_rx_ep)
1032                 return -ENODEV;
1033
1034         urb = usb_alloc_urb(0, mem_flags);
1035         if (!urb)
1036                 return -ENOMEM;
1037
1038         buf = kmalloc(size, mem_flags);
1039         if (!buf) {
1040                 usb_free_urb(urb);
1041                 return -ENOMEM;
1042         }
1043
1044         pipe = usb_rcvbulkpipe(data->udev, data->bulk_rx_ep->bEndpointAddress);
1045
1046         usb_fill_bulk_urb(urb, data->udev, pipe, buf, size,
1047                           btusb_bulk_complete, hdev);
1048
1049         urb->transfer_flags |= URB_FREE_BUFFER;
1050
1051         usb_mark_last_busy(data->udev);
1052         usb_anchor_urb(urb, &data->bulk_anchor);
1053
1054         err = usb_submit_urb(urb, mem_flags);
1055         if (err < 0) {
1056                 if (err != -EPERM && err != -ENODEV)
1057                         bt_dev_err(hdev, "urb %p submission failed (%d)",
1058                                    urb, -err);
1059                 usb_unanchor_urb(urb);
1060         }
1061
1062         usb_free_urb(urb);
1063
1064         return err;
1065 }
1066
1067 static void btusb_isoc_complete(struct urb *urb)
1068 {
1069         struct hci_dev *hdev = urb->context;
1070         struct btusb_data *data = hci_get_drvdata(hdev);
1071         int i, err;
1072
1073         BT_DBG("%s urb %p status %d count %d", hdev->name, urb, urb->status,
1074                urb->actual_length);
1075
1076         if (!test_bit(HCI_RUNNING, &hdev->flags))
1077                 return;
1078
1079         if (urb->status == 0) {
1080                 for (i = 0; i < urb->number_of_packets; i++) {
1081                         unsigned int offset = urb->iso_frame_desc[i].offset;
1082                         unsigned int length = urb->iso_frame_desc[i].actual_length;
1083
1084                         if (urb->iso_frame_desc[i].status)
1085                                 continue;
1086
1087                         hdev->stat.byte_rx += length;
1088
1089                         if (btusb_recv_isoc(data, urb->transfer_buffer + offset,
1090                                             length) < 0) {
1091                                 bt_dev_err(hdev, "corrupted SCO packet");
1092                                 hdev->stat.err_rx++;
1093                         }
1094                 }
1095         } else if (urb->status == -ENOENT) {
1096                 /* Avoid suspend failed when usb_kill_urb */
1097                 return;
1098         }
1099
1100         if (!test_bit(BTUSB_ISOC_RUNNING, &data->flags))
1101                 return;
1102
1103         usb_anchor_urb(urb, &data->isoc_anchor);
1104
1105         err = usb_submit_urb(urb, GFP_ATOMIC);
1106         if (err < 0) {
1107                 /* -EPERM: urb is being killed;
1108                  * -ENODEV: device got disconnected
1109                  */
1110                 if (err != -EPERM && err != -ENODEV)
1111                         bt_dev_err(hdev, "urb %p failed to resubmit (%d)",
1112                                    urb, -err);
1113                 usb_unanchor_urb(urb);
1114         }
1115 }
1116
1117 static inline void __fill_isoc_descriptor_msbc(struct urb *urb, int len,
1118                                                int mtu, struct btusb_data *data)
1119 {
1120         int i, offset = 0;
1121         unsigned int interval;
1122
1123         BT_DBG("len %d mtu %d", len, mtu);
1124
1125         /* For mSBC ALT 6 setting the host will send the packet at continuous
1126          * flow. As per core spec 5, vol 4, part B, table 2.1. For ALT setting
1127          * 6 the HCI PACKET INTERVAL should be 7.5ms for every usb packets.
1128          * To maintain the rate we send 63bytes of usb packets alternatively for
1129          * 7ms and 8ms to maintain the rate as 7.5ms.
1130          */
1131         if (data->usb_alt6_packet_flow) {
1132                 interval = 7;
1133                 data->usb_alt6_packet_flow = false;
1134         } else {
1135                 interval = 6;
1136                 data->usb_alt6_packet_flow = true;
1137         }
1138
1139         for (i = 0; i < interval; i++) {
1140                 urb->iso_frame_desc[i].offset = offset;
1141                 urb->iso_frame_desc[i].length = offset;
1142         }
1143
1144         if (len && i < BTUSB_MAX_ISOC_FRAMES) {
1145                 urb->iso_frame_desc[i].offset = offset;
1146                 urb->iso_frame_desc[i].length = len;
1147                 i++;
1148         }
1149
1150         urb->number_of_packets = i;
1151 }
1152
1153 static inline void __fill_isoc_descriptor(struct urb *urb, int len, int mtu)
1154 {
1155         int i, offset = 0;
1156
1157         BT_DBG("len %d mtu %d", len, mtu);
1158
1159         for (i = 0; i < BTUSB_MAX_ISOC_FRAMES && len >= mtu;
1160                                         i++, offset += mtu, len -= mtu) {
1161                 urb->iso_frame_desc[i].offset = offset;
1162                 urb->iso_frame_desc[i].length = mtu;
1163         }
1164
1165         if (len && i < BTUSB_MAX_ISOC_FRAMES) {
1166                 urb->iso_frame_desc[i].offset = offset;
1167                 urb->iso_frame_desc[i].length = len;
1168                 i++;
1169         }
1170
1171         urb->number_of_packets = i;
1172 }
1173
1174 static int btusb_submit_isoc_urb(struct hci_dev *hdev, gfp_t mem_flags)
1175 {
1176         struct btusb_data *data = hci_get_drvdata(hdev);
1177         struct urb *urb;
1178         unsigned char *buf;
1179         unsigned int pipe;
1180         int err, size;
1181
1182         BT_DBG("%s", hdev->name);
1183
1184         if (!data->isoc_rx_ep)
1185                 return -ENODEV;
1186
1187         urb = usb_alloc_urb(BTUSB_MAX_ISOC_FRAMES, mem_flags);
1188         if (!urb)
1189                 return -ENOMEM;
1190
1191         size = le16_to_cpu(data->isoc_rx_ep->wMaxPacketSize) *
1192                                                 BTUSB_MAX_ISOC_FRAMES;
1193
1194         buf = kmalloc(size, mem_flags);
1195         if (!buf) {
1196                 usb_free_urb(urb);
1197                 return -ENOMEM;
1198         }
1199
1200         pipe = usb_rcvisocpipe(data->udev, data->isoc_rx_ep->bEndpointAddress);
1201
1202         usb_fill_int_urb(urb, data->udev, pipe, buf, size, btusb_isoc_complete,
1203                          hdev, data->isoc_rx_ep->bInterval);
1204
1205         urb->transfer_flags = URB_FREE_BUFFER | URB_ISO_ASAP;
1206
1207         __fill_isoc_descriptor(urb, size,
1208                                le16_to_cpu(data->isoc_rx_ep->wMaxPacketSize));
1209
1210         usb_anchor_urb(urb, &data->isoc_anchor);
1211
1212         err = usb_submit_urb(urb, mem_flags);
1213         if (err < 0) {
1214                 if (err != -EPERM && err != -ENODEV)
1215                         bt_dev_err(hdev, "urb %p submission failed (%d)",
1216                                    urb, -err);
1217                 usb_unanchor_urb(urb);
1218         }
1219
1220         usb_free_urb(urb);
1221
1222         return err;
1223 }
1224
1225 static void btusb_diag_complete(struct urb *urb)
1226 {
1227         struct hci_dev *hdev = urb->context;
1228         struct btusb_data *data = hci_get_drvdata(hdev);
1229         int err;
1230
1231         BT_DBG("%s urb %p status %d count %d", hdev->name, urb, urb->status,
1232                urb->actual_length);
1233
1234         if (urb->status == 0) {
1235                 struct sk_buff *skb;
1236
1237                 skb = bt_skb_alloc(urb->actual_length, GFP_ATOMIC);
1238                 if (skb) {
1239                         skb_put_data(skb, urb->transfer_buffer,
1240                                      urb->actual_length);
1241                         hci_recv_diag(hdev, skb);
1242                 }
1243         } else if (urb->status == -ENOENT) {
1244                 /* Avoid suspend failed when usb_kill_urb */
1245                 return;
1246         }
1247
1248         if (!test_bit(BTUSB_DIAG_RUNNING, &data->flags))
1249                 return;
1250
1251         usb_anchor_urb(urb, &data->diag_anchor);
1252         usb_mark_last_busy(data->udev);
1253
1254         err = usb_submit_urb(urb, GFP_ATOMIC);
1255         if (err < 0) {
1256                 /* -EPERM: urb is being killed;
1257                  * -ENODEV: device got disconnected
1258                  */
1259                 if (err != -EPERM && err != -ENODEV)
1260                         bt_dev_err(hdev, "urb %p failed to resubmit (%d)",
1261                                    urb, -err);
1262                 usb_unanchor_urb(urb);
1263         }
1264 }
1265
1266 static int btusb_submit_diag_urb(struct hci_dev *hdev, gfp_t mem_flags)
1267 {
1268         struct btusb_data *data = hci_get_drvdata(hdev);
1269         struct urb *urb;
1270         unsigned char *buf;
1271         unsigned int pipe;
1272         int err, size = HCI_MAX_FRAME_SIZE;
1273
1274         BT_DBG("%s", hdev->name);
1275
1276         if (!data->diag_rx_ep)
1277                 return -ENODEV;
1278
1279         urb = usb_alloc_urb(0, mem_flags);
1280         if (!urb)
1281                 return -ENOMEM;
1282
1283         buf = kmalloc(size, mem_flags);
1284         if (!buf) {
1285                 usb_free_urb(urb);
1286                 return -ENOMEM;
1287         }
1288
1289         pipe = usb_rcvbulkpipe(data->udev, data->diag_rx_ep->bEndpointAddress);
1290
1291         usb_fill_bulk_urb(urb, data->udev, pipe, buf, size,
1292                           btusb_diag_complete, hdev);
1293
1294         urb->transfer_flags |= URB_FREE_BUFFER;
1295
1296         usb_mark_last_busy(data->udev);
1297         usb_anchor_urb(urb, &data->diag_anchor);
1298
1299         err = usb_submit_urb(urb, mem_flags);
1300         if (err < 0) {
1301                 if (err != -EPERM && err != -ENODEV)
1302                         bt_dev_err(hdev, "urb %p submission failed (%d)",
1303                                    urb, -err);
1304                 usb_unanchor_urb(urb);
1305         }
1306
1307         usb_free_urb(urb);
1308
1309         return err;
1310 }
1311
1312 static void btusb_tx_complete(struct urb *urb)
1313 {
1314         struct sk_buff *skb = urb->context;
1315         struct hci_dev *hdev = (struct hci_dev *)skb->dev;
1316         struct btusb_data *data = hci_get_drvdata(hdev);
1317         unsigned long flags;
1318
1319         BT_DBG("%s urb %p status %d count %d", hdev->name, urb, urb->status,
1320                urb->actual_length);
1321
1322         if (!test_bit(HCI_RUNNING, &hdev->flags))
1323                 goto done;
1324
1325         if (!urb->status)
1326                 hdev->stat.byte_tx += urb->transfer_buffer_length;
1327         else
1328                 hdev->stat.err_tx++;
1329
1330 done:
1331         spin_lock_irqsave(&data->txlock, flags);
1332         data->tx_in_flight--;
1333         spin_unlock_irqrestore(&data->txlock, flags);
1334
1335         kfree(urb->setup_packet);
1336
1337         kfree_skb(skb);
1338 }
1339
1340 static void btusb_isoc_tx_complete(struct urb *urb)
1341 {
1342         struct sk_buff *skb = urb->context;
1343         struct hci_dev *hdev = (struct hci_dev *)skb->dev;
1344
1345         BT_DBG("%s urb %p status %d count %d", hdev->name, urb, urb->status,
1346                urb->actual_length);
1347
1348         if (!test_bit(HCI_RUNNING, &hdev->flags))
1349                 goto done;
1350
1351         if (!urb->status)
1352                 hdev->stat.byte_tx += urb->transfer_buffer_length;
1353         else
1354                 hdev->stat.err_tx++;
1355
1356 done:
1357         kfree(urb->setup_packet);
1358
1359         kfree_skb(skb);
1360 }
1361
1362 static int btusb_open(struct hci_dev *hdev)
1363 {
1364         struct btusb_data *data = hci_get_drvdata(hdev);
1365         int err;
1366
1367         BT_DBG("%s", hdev->name);
1368
1369         err = usb_autopm_get_interface(data->intf);
1370         if (err < 0)
1371                 return err;
1372
1373         /* Patching USB firmware files prior to starting any URBs of HCI path
1374          * It is more safe to use USB bulk channel for downloading USB patch
1375          */
1376         if (data->setup_on_usb) {
1377                 err = data->setup_on_usb(hdev);
1378                 if (err < 0)
1379                         goto setup_fail;
1380         }
1381
1382         data->intf->needs_remote_wakeup = 1;
1383
1384         if (test_and_set_bit(BTUSB_INTR_RUNNING, &data->flags))
1385                 goto done;
1386
1387         err = btusb_submit_intr_urb(hdev, GFP_KERNEL);
1388         if (err < 0)
1389                 goto failed;
1390
1391         err = btusb_submit_bulk_urb(hdev, GFP_KERNEL);
1392         if (err < 0) {
1393                 usb_kill_anchored_urbs(&data->intr_anchor);
1394                 goto failed;
1395         }
1396
1397         set_bit(BTUSB_BULK_RUNNING, &data->flags);
1398         btusb_submit_bulk_urb(hdev, GFP_KERNEL);
1399
1400         if (data->diag) {
1401                 if (!btusb_submit_diag_urb(hdev, GFP_KERNEL))
1402                         set_bit(BTUSB_DIAG_RUNNING, &data->flags);
1403         }
1404
1405 done:
1406         usb_autopm_put_interface(data->intf);
1407         return 0;
1408
1409 failed:
1410         clear_bit(BTUSB_INTR_RUNNING, &data->flags);
1411 setup_fail:
1412         usb_autopm_put_interface(data->intf);
1413         return err;
1414 }
1415
1416 static void btusb_stop_traffic(struct btusb_data *data)
1417 {
1418         usb_kill_anchored_urbs(&data->intr_anchor);
1419         usb_kill_anchored_urbs(&data->bulk_anchor);
1420         usb_kill_anchored_urbs(&data->isoc_anchor);
1421         usb_kill_anchored_urbs(&data->diag_anchor);
1422         usb_kill_anchored_urbs(&data->ctrl_anchor);
1423 }
1424
1425 static int btusb_close(struct hci_dev *hdev)
1426 {
1427         struct btusb_data *data = hci_get_drvdata(hdev);
1428         int err;
1429
1430         BT_DBG("%s", hdev->name);
1431
1432         cancel_work_sync(&data->work);
1433         cancel_work_sync(&data->waker);
1434
1435         clear_bit(BTUSB_ISOC_RUNNING, &data->flags);
1436         clear_bit(BTUSB_BULK_RUNNING, &data->flags);
1437         clear_bit(BTUSB_INTR_RUNNING, &data->flags);
1438         clear_bit(BTUSB_DIAG_RUNNING, &data->flags);
1439
1440         btusb_stop_traffic(data);
1441         btusb_free_frags(data);
1442
1443         err = usb_autopm_get_interface(data->intf);
1444         if (err < 0)
1445                 goto failed;
1446
1447         data->intf->needs_remote_wakeup = 0;
1448
1449         /* Enable remote wake up for auto-suspend */
1450         if (test_bit(BTUSB_WAKEUP_AUTOSUSPEND, &data->flags))
1451                 data->intf->needs_remote_wakeup = 1;
1452
1453         usb_autopm_put_interface(data->intf);
1454
1455 failed:
1456         usb_scuttle_anchored_urbs(&data->deferred);
1457         return 0;
1458 }
1459
1460 static int btusb_flush(struct hci_dev *hdev)
1461 {
1462         struct btusb_data *data = hci_get_drvdata(hdev);
1463
1464         BT_DBG("%s", hdev->name);
1465
1466         usb_kill_anchored_urbs(&data->tx_anchor);
1467         btusb_free_frags(data);
1468
1469         return 0;
1470 }
1471
1472 static struct urb *alloc_ctrl_urb(struct hci_dev *hdev, struct sk_buff *skb)
1473 {
1474         struct btusb_data *data = hci_get_drvdata(hdev);
1475         struct usb_ctrlrequest *dr;
1476         struct urb *urb;
1477         unsigned int pipe;
1478
1479         urb = usb_alloc_urb(0, GFP_KERNEL);
1480         if (!urb)
1481                 return ERR_PTR(-ENOMEM);
1482
1483         dr = kmalloc(sizeof(*dr), GFP_KERNEL);
1484         if (!dr) {
1485                 usb_free_urb(urb);
1486                 return ERR_PTR(-ENOMEM);
1487         }
1488
1489         dr->bRequestType = data->cmdreq_type;
1490         dr->bRequest     = data->cmdreq;
1491         dr->wIndex       = 0;
1492         dr->wValue       = 0;
1493         dr->wLength      = __cpu_to_le16(skb->len);
1494
1495         pipe = usb_sndctrlpipe(data->udev, 0x00);
1496
1497         usb_fill_control_urb(urb, data->udev, pipe, (void *)dr,
1498                              skb->data, skb->len, btusb_tx_complete, skb);
1499
1500         skb->dev = (void *)hdev;
1501
1502         return urb;
1503 }
1504
1505 static struct urb *alloc_bulk_urb(struct hci_dev *hdev, struct sk_buff *skb)
1506 {
1507         struct btusb_data *data = hci_get_drvdata(hdev);
1508         struct urb *urb;
1509         unsigned int pipe;
1510
1511         if (!data->bulk_tx_ep)
1512                 return ERR_PTR(-ENODEV);
1513
1514         urb = usb_alloc_urb(0, GFP_KERNEL);
1515         if (!urb)
1516                 return ERR_PTR(-ENOMEM);
1517
1518         pipe = usb_sndbulkpipe(data->udev, data->bulk_tx_ep->bEndpointAddress);
1519
1520         usb_fill_bulk_urb(urb, data->udev, pipe,
1521                           skb->data, skb->len, btusb_tx_complete, skb);
1522
1523         skb->dev = (void *)hdev;
1524
1525         return urb;
1526 }
1527
1528 static struct urb *alloc_isoc_urb(struct hci_dev *hdev, struct sk_buff *skb)
1529 {
1530         struct btusb_data *data = hci_get_drvdata(hdev);
1531         struct urb *urb;
1532         unsigned int pipe;
1533
1534         if (!data->isoc_tx_ep)
1535                 return ERR_PTR(-ENODEV);
1536
1537         urb = usb_alloc_urb(BTUSB_MAX_ISOC_FRAMES, GFP_KERNEL);
1538         if (!urb)
1539                 return ERR_PTR(-ENOMEM);
1540
1541         pipe = usb_sndisocpipe(data->udev, data->isoc_tx_ep->bEndpointAddress);
1542
1543         usb_fill_int_urb(urb, data->udev, pipe,
1544                          skb->data, skb->len, btusb_isoc_tx_complete,
1545                          skb, data->isoc_tx_ep->bInterval);
1546
1547         urb->transfer_flags  = URB_ISO_ASAP;
1548
1549         if (data->isoc_altsetting == 6)
1550                 __fill_isoc_descriptor_msbc(urb, skb->len,
1551                                             le16_to_cpu(data->isoc_tx_ep->wMaxPacketSize),
1552                                             data);
1553         else
1554                 __fill_isoc_descriptor(urb, skb->len,
1555                                        le16_to_cpu(data->isoc_tx_ep->wMaxPacketSize));
1556         skb->dev = (void *)hdev;
1557
1558         return urb;
1559 }
1560
1561 static int submit_tx_urb(struct hci_dev *hdev, struct urb *urb)
1562 {
1563         struct btusb_data *data = hci_get_drvdata(hdev);
1564         int err;
1565
1566         usb_anchor_urb(urb, &data->tx_anchor);
1567
1568         err = usb_submit_urb(urb, GFP_KERNEL);
1569         if (err < 0) {
1570                 if (err != -EPERM && err != -ENODEV)
1571                         bt_dev_err(hdev, "urb %p submission failed (%d)",
1572                                    urb, -err);
1573                 kfree(urb->setup_packet);
1574                 usb_unanchor_urb(urb);
1575         } else {
1576                 usb_mark_last_busy(data->udev);
1577         }
1578
1579         usb_free_urb(urb);
1580         return err;
1581 }
1582
1583 static int submit_or_queue_tx_urb(struct hci_dev *hdev, struct urb *urb)
1584 {
1585         struct btusb_data *data = hci_get_drvdata(hdev);
1586         unsigned long flags;
1587         bool suspending;
1588
1589         spin_lock_irqsave(&data->txlock, flags);
1590         suspending = test_bit(BTUSB_SUSPENDING, &data->flags);
1591         if (!suspending)
1592                 data->tx_in_flight++;
1593         spin_unlock_irqrestore(&data->txlock, flags);
1594
1595         if (!suspending)
1596                 return submit_tx_urb(hdev, urb);
1597
1598         usb_anchor_urb(urb, &data->deferred);
1599         schedule_work(&data->waker);
1600
1601         usb_free_urb(urb);
1602         return 0;
1603 }
1604
1605 static int btusb_send_frame(struct hci_dev *hdev, struct sk_buff *skb)
1606 {
1607         struct urb *urb;
1608
1609         BT_DBG("%s", hdev->name);
1610
1611         switch (hci_skb_pkt_type(skb)) {
1612         case HCI_COMMAND_PKT:
1613                 urb = alloc_ctrl_urb(hdev, skb);
1614                 if (IS_ERR(urb))
1615                         return PTR_ERR(urb);
1616
1617                 hdev->stat.cmd_tx++;
1618                 return submit_or_queue_tx_urb(hdev, urb);
1619
1620         case HCI_ACLDATA_PKT:
1621                 urb = alloc_bulk_urb(hdev, skb);
1622                 if (IS_ERR(urb))
1623                         return PTR_ERR(urb);
1624
1625                 hdev->stat.acl_tx++;
1626                 return submit_or_queue_tx_urb(hdev, urb);
1627
1628         case HCI_SCODATA_PKT:
1629                 if (hci_conn_num(hdev, SCO_LINK) < 1)
1630                         return -ENODEV;
1631
1632                 urb = alloc_isoc_urb(hdev, skb);
1633                 if (IS_ERR(urb))
1634                         return PTR_ERR(urb);
1635
1636                 hdev->stat.sco_tx++;
1637                 return submit_tx_urb(hdev, urb);
1638         }
1639
1640         return -EILSEQ;
1641 }
1642
1643 static void btusb_notify(struct hci_dev *hdev, unsigned int evt)
1644 {
1645         struct btusb_data *data = hci_get_drvdata(hdev);
1646
1647         BT_DBG("%s evt %d", hdev->name, evt);
1648
1649         if (hci_conn_num(hdev, SCO_LINK) != data->sco_num) {
1650                 data->sco_num = hci_conn_num(hdev, SCO_LINK);
1651                 data->air_mode = evt;
1652                 schedule_work(&data->work);
1653         }
1654 }
1655
1656 static inline int __set_isoc_interface(struct hci_dev *hdev, int altsetting)
1657 {
1658         struct btusb_data *data = hci_get_drvdata(hdev);
1659         struct usb_interface *intf = data->isoc;
1660         struct usb_endpoint_descriptor *ep_desc;
1661         int i, err;
1662
1663         if (!data->isoc)
1664                 return -ENODEV;
1665
1666         err = usb_set_interface(data->udev, data->isoc_ifnum, altsetting);
1667         if (err < 0) {
1668                 bt_dev_err(hdev, "setting interface failed (%d)", -err);
1669                 return err;
1670         }
1671
1672         data->isoc_altsetting = altsetting;
1673
1674         data->isoc_tx_ep = NULL;
1675         data->isoc_rx_ep = NULL;
1676
1677         for (i = 0; i < intf->cur_altsetting->desc.bNumEndpoints; i++) {
1678                 ep_desc = &intf->cur_altsetting->endpoint[i].desc;
1679
1680                 if (!data->isoc_tx_ep && usb_endpoint_is_isoc_out(ep_desc)) {
1681                         data->isoc_tx_ep = ep_desc;
1682                         continue;
1683                 }
1684
1685                 if (!data->isoc_rx_ep && usb_endpoint_is_isoc_in(ep_desc)) {
1686                         data->isoc_rx_ep = ep_desc;
1687                         continue;
1688                 }
1689         }
1690
1691         if (!data->isoc_tx_ep || !data->isoc_rx_ep) {
1692                 bt_dev_err(hdev, "invalid SCO descriptors");
1693                 return -ENODEV;
1694         }
1695
1696         return 0;
1697 }
1698
1699 static int btusb_switch_alt_setting(struct hci_dev *hdev, int new_alts)
1700 {
1701         struct btusb_data *data = hci_get_drvdata(hdev);
1702         int err;
1703
1704         if (data->isoc_altsetting != new_alts) {
1705                 unsigned long flags;
1706
1707                 clear_bit(BTUSB_ISOC_RUNNING, &data->flags);
1708                 usb_kill_anchored_urbs(&data->isoc_anchor);
1709
1710                 /* When isochronous alternate setting needs to be
1711                  * changed, because SCO connection has been added
1712                  * or removed, a packet fragment may be left in the
1713                  * reassembling state. This could lead to wrongly
1714                  * assembled fragments.
1715                  *
1716                  * Clear outstanding fragment when selecting a new
1717                  * alternate setting.
1718                  */
1719                 spin_lock_irqsave(&data->rxlock, flags);
1720                 kfree_skb(data->sco_skb);
1721                 data->sco_skb = NULL;
1722                 spin_unlock_irqrestore(&data->rxlock, flags);
1723
1724                 err = __set_isoc_interface(hdev, new_alts);
1725                 if (err < 0)
1726                         return err;
1727         }
1728
1729         if (!test_and_set_bit(BTUSB_ISOC_RUNNING, &data->flags)) {
1730                 if (btusb_submit_isoc_urb(hdev, GFP_KERNEL) < 0)
1731                         clear_bit(BTUSB_ISOC_RUNNING, &data->flags);
1732                 else
1733                         btusb_submit_isoc_urb(hdev, GFP_KERNEL);
1734         }
1735
1736         return 0;
1737 }
1738
1739 static struct usb_host_interface *btusb_find_altsetting(struct btusb_data *data,
1740                                                         int alt)
1741 {
1742         struct usb_interface *intf = data->isoc;
1743         int i;
1744
1745         BT_DBG("Looking for Alt no :%d", alt);
1746
1747         if (!intf)
1748                 return NULL;
1749
1750         for (i = 0; i < intf->num_altsetting; i++) {
1751                 if (intf->altsetting[i].desc.bAlternateSetting == alt)
1752                         return &intf->altsetting[i];
1753         }
1754
1755         return NULL;
1756 }
1757
1758 static void btusb_work(struct work_struct *work)
1759 {
1760         struct btusb_data *data = container_of(work, struct btusb_data, work);
1761         struct hci_dev *hdev = data->hdev;
1762         int new_alts = 0;
1763         int err;
1764
1765         if (data->sco_num > 0) {
1766                 if (!test_bit(BTUSB_DID_ISO_RESUME, &data->flags)) {
1767                         err = usb_autopm_get_interface(data->isoc ? data->isoc : data->intf);
1768                         if (err < 0) {
1769                                 clear_bit(BTUSB_ISOC_RUNNING, &data->flags);
1770                                 usb_kill_anchored_urbs(&data->isoc_anchor);
1771                                 return;
1772                         }
1773
1774                         set_bit(BTUSB_DID_ISO_RESUME, &data->flags);
1775                 }
1776
1777                 if (data->air_mode == HCI_NOTIFY_ENABLE_SCO_CVSD) {
1778                         if (hdev->voice_setting & 0x0020) {
1779                                 static const int alts[3] = { 2, 4, 5 };
1780
1781                                 new_alts = alts[data->sco_num - 1];
1782                         } else {
1783                                 new_alts = data->sco_num;
1784                         }
1785                 } else if (data->air_mode == HCI_NOTIFY_ENABLE_SCO_TRANSP) {
1786                         /* Bluetooth USB spec recommends alt 6 (63 bytes), but
1787                          * many adapters do not support it.  Alt 1 appears to
1788                          * work for all adapters that do not have alt 6, and
1789                          * which work with WBS at all.  Some devices prefer
1790                          * alt 3 (HCI payload >= 60 Bytes let air packet
1791                          * data satisfy 60 bytes), requiring
1792                          * MTU >= 3 (packets) * 25 (size) - 3 (headers) = 72
1793                          * see also Core spec 5, vol 4, B 2.1.1 & Table 2.1.
1794                          */
1795                         if (btusb_find_altsetting(data, 6))
1796                                 new_alts = 6;
1797                         else if (btusb_find_altsetting(data, 3) &&
1798                                  hdev->sco_mtu >= 72 &&
1799                                  test_bit(BTUSB_USE_ALT3_FOR_WBS, &data->flags))
1800                                 new_alts = 3;
1801                         else
1802                                 new_alts = 1;
1803                 }
1804
1805                 if (btusb_switch_alt_setting(hdev, new_alts) < 0)
1806                         bt_dev_err(hdev, "set USB alt:(%d) failed!", new_alts);
1807         } else {
1808                 clear_bit(BTUSB_ISOC_RUNNING, &data->flags);
1809                 usb_kill_anchored_urbs(&data->isoc_anchor);
1810
1811                 __set_isoc_interface(hdev, 0);
1812                 if (test_and_clear_bit(BTUSB_DID_ISO_RESUME, &data->flags))
1813                         usb_autopm_put_interface(data->isoc ? data->isoc : data->intf);
1814         }
1815 }
1816
1817 static void btusb_waker(struct work_struct *work)
1818 {
1819         struct btusb_data *data = container_of(work, struct btusb_data, waker);
1820         int err;
1821
1822         err = usb_autopm_get_interface(data->intf);
1823         if (err < 0)
1824                 return;
1825
1826         usb_autopm_put_interface(data->intf);
1827 }
1828
1829 static int btusb_setup_bcm92035(struct hci_dev *hdev)
1830 {
1831         struct sk_buff *skb;
1832         u8 val = 0x00;
1833
1834         BT_DBG("%s", hdev->name);
1835
1836         skb = __hci_cmd_sync(hdev, 0xfc3b, 1, &val, HCI_INIT_TIMEOUT);
1837         if (IS_ERR(skb))
1838                 bt_dev_err(hdev, "BCM92035 command failed (%ld)", PTR_ERR(skb));
1839         else
1840                 kfree_skb(skb);
1841
1842         return 0;
1843 }
1844
1845 static int btusb_setup_csr(struct hci_dev *hdev)
1846 {
1847         struct btusb_data *data = hci_get_drvdata(hdev);
1848         u16 bcdDevice = le16_to_cpu(data->udev->descriptor.bcdDevice);
1849         struct hci_rp_read_local_version *rp;
1850         struct sk_buff *skb;
1851         bool is_fake = false;
1852         int ret;
1853
1854         BT_DBG("%s", hdev->name);
1855
1856         skb = __hci_cmd_sync(hdev, HCI_OP_READ_LOCAL_VERSION, 0, NULL,
1857                              HCI_INIT_TIMEOUT);
1858         if (IS_ERR(skb)) {
1859                 int err = PTR_ERR(skb);
1860                 bt_dev_err(hdev, "CSR: Local version failed (%d)", err);
1861                 return err;
1862         }
1863
1864         if (skb->len != sizeof(struct hci_rp_read_local_version)) {
1865                 bt_dev_err(hdev, "CSR: Local version length mismatch");
1866                 kfree_skb(skb);
1867                 return -EIO;
1868         }
1869
1870         rp = (struct hci_rp_read_local_version *)skb->data;
1871
1872         /* Detect a wide host of Chinese controllers that aren't CSR.
1873          *
1874          * Known fake bcdDevices: 0x0100, 0x0134, 0x1915, 0x2520, 0x7558, 0x8891
1875          *
1876          * The main thing they have in common is that these are really popular low-cost
1877          * options that support newer Bluetooth versions but rely on heavy VID/PID
1878          * squatting of this poor old Bluetooth 1.1 device. Even sold as such.
1879          *
1880          * We detect actual CSR devices by checking that the HCI manufacturer code
1881          * is Cambridge Silicon Radio (10) and ensuring that LMP sub-version and
1882          * HCI rev values always match. As they both store the firmware number.
1883          */
1884         if (le16_to_cpu(rp->manufacturer) != 10 ||
1885             le16_to_cpu(rp->hci_rev) != le16_to_cpu(rp->lmp_subver))
1886                 is_fake = true;
1887
1888         /* Known legit CSR firmware build numbers and their supported BT versions:
1889          * - 1.1 (0x1) -> 0x0073, 0x020d, 0x033c, 0x034e
1890          * - 1.2 (0x2) ->                 0x04d9, 0x0529
1891          * - 2.0 (0x3) ->         0x07a6, 0x07ad, 0x0c5c
1892          * - 2.1 (0x4) ->         0x149c, 0x1735, 0x1899 (0x1899 is a BlueCore4-External)
1893          * - 4.0 (0x6) ->         0x1d86, 0x2031, 0x22bb
1894          *
1895          * e.g. Real CSR dongles with LMP subversion 0x73 are old enough that
1896          *      support BT 1.1 only; so it's a dead giveaway when some
1897          *      third-party BT 4.0 dongle reuses it.
1898          */
1899         else if (le16_to_cpu(rp->lmp_subver) <= 0x034e &&
1900                  le16_to_cpu(rp->hci_ver) > BLUETOOTH_VER_1_1)
1901                 is_fake = true;
1902
1903         else if (le16_to_cpu(rp->lmp_subver) <= 0x0529 &&
1904                  le16_to_cpu(rp->hci_ver) > BLUETOOTH_VER_1_2)
1905                 is_fake = true;
1906
1907         else if (le16_to_cpu(rp->lmp_subver) <= 0x0c5c &&
1908                  le16_to_cpu(rp->hci_ver) > BLUETOOTH_VER_2_0)
1909                 is_fake = true;
1910
1911         else if (le16_to_cpu(rp->lmp_subver) <= 0x1899 &&
1912                  le16_to_cpu(rp->hci_ver) > BLUETOOTH_VER_2_1)
1913                 is_fake = true;
1914
1915         else if (le16_to_cpu(rp->lmp_subver) <= 0x22bb &&
1916                  le16_to_cpu(rp->hci_ver) > BLUETOOTH_VER_4_0)
1917                 is_fake = true;
1918
1919         /* Other clones which beat all the above checks */
1920         else if (bcdDevice == 0x0134 &&
1921                  le16_to_cpu(rp->lmp_subver) == 0x0c5c &&
1922                  le16_to_cpu(rp->hci_ver) == BLUETOOTH_VER_2_0)
1923                 is_fake = true;
1924
1925         if (is_fake) {
1926                 bt_dev_warn(hdev, "CSR: Unbranded CSR clone detected; adding workarounds and force-suspending once...");
1927
1928                 /* Generally these clones have big discrepancies between
1929                  * advertised features and what's actually supported.
1930                  * Probably will need to be expanded in the future;
1931                  * without these the controller will lock up.
1932                  */
1933                 set_bit(HCI_QUIRK_BROKEN_STORED_LINK_KEY, &hdev->quirks);
1934                 set_bit(HCI_QUIRK_BROKEN_ERR_DATA_REPORTING, &hdev->quirks);
1935
1936                 /* Clear the reset quirk since this is not an actual
1937                  * early Bluetooth 1.1 device from CSR.
1938                  */
1939                 clear_bit(HCI_QUIRK_RESET_ON_CLOSE, &hdev->quirks);
1940                 clear_bit(HCI_QUIRK_SIMULTANEOUS_DISCOVERY, &hdev->quirks);
1941
1942                 /*
1943                  * Special workaround for these BT 4.0 chip clones, and potentially more:
1944                  *
1945                  * - 0x0134: a Barrot 8041a02                 (HCI rev: 0x1012 sub: 0x0810)
1946                  * - 0x7558: IC markings FR3191AHAL 749H15143 (HCI rev/sub-version: 0x0709)
1947                  *
1948                  * These controllers are really messed-up.
1949                  *
1950                  * 1. Their bulk RX endpoint will never report any data unless
1951                  * the device was suspended at least once (yes, really).
1952                  * 2. They will not wakeup when autosuspended and receiving data
1953                  * on their bulk RX endpoint from e.g. a keyboard or mouse
1954                  * (IOW remote-wakeup support is broken for the bulk endpoint).
1955                  *
1956                  * To fix 1. enable runtime-suspend, force-suspend the
1957                  * HCI and then wake-it up by disabling runtime-suspend.
1958                  *
1959                  * To fix 2. clear the HCI's can_wake flag, this way the HCI
1960                  * will still be autosuspended when it is not open.
1961                  *
1962                  * --
1963                  *
1964                  * Because these are widespread problems we prefer generic solutions; so
1965                  * apply this initialization quirk to every controller that gets here,
1966                  * it should be harmless. The alternative is to not work at all.
1967                  */
1968                 pm_runtime_allow(&data->udev->dev);
1969
1970                 ret = pm_runtime_suspend(&data->udev->dev);
1971                 if (ret >= 0)
1972                         msleep(200);
1973                 else
1974                         bt_dev_err(hdev, "CSR: Failed to suspend the device for our Barrot 8041a02 receive-issue workaround");
1975
1976                 pm_runtime_forbid(&data->udev->dev);
1977
1978                 device_set_wakeup_capable(&data->udev->dev, false);
1979
1980                 /* Re-enable autosuspend if this was requested */
1981                 if (enable_autosuspend)
1982                         usb_enable_autosuspend(data->udev);
1983         }
1984
1985         kfree_skb(skb);
1986
1987         return 0;
1988 }
1989
1990 static int inject_cmd_complete(struct hci_dev *hdev, __u16 opcode)
1991 {
1992         struct sk_buff *skb;
1993         struct hci_event_hdr *hdr;
1994         struct hci_ev_cmd_complete *evt;
1995
1996         skb = bt_skb_alloc(sizeof(*hdr) + sizeof(*evt) + 1, GFP_KERNEL);
1997         if (!skb)
1998                 return -ENOMEM;
1999
2000         hdr = skb_put(skb, sizeof(*hdr));
2001         hdr->evt = HCI_EV_CMD_COMPLETE;
2002         hdr->plen = sizeof(*evt) + 1;
2003
2004         evt = skb_put(skb, sizeof(*evt));
2005         evt->ncmd = 0x01;
2006         evt->opcode = cpu_to_le16(opcode);
2007
2008         skb_put_u8(skb, 0x00);
2009
2010         hci_skb_pkt_type(skb) = HCI_EVENT_PKT;
2011
2012         return hci_recv_frame(hdev, skb);
2013 }
2014
2015 static int btusb_recv_bulk_intel(struct btusb_data *data, void *buffer,
2016                                  int count)
2017 {
2018         struct hci_dev *hdev = data->hdev;
2019
2020         /* When the device is in bootloader mode, then it can send
2021          * events via the bulk endpoint. These events are treated the
2022          * same way as the ones received from the interrupt endpoint.
2023          */
2024         if (btintel_test_flag(hdev, INTEL_BOOTLOADER))
2025                 return btusb_recv_intr(data, buffer, count);
2026
2027         return btusb_recv_bulk(data, buffer, count);
2028 }
2029
2030 static int btusb_recv_event_intel(struct hci_dev *hdev, struct sk_buff *skb)
2031 {
2032         if (btintel_test_flag(hdev, INTEL_BOOTLOADER)) {
2033                 struct hci_event_hdr *hdr = (void *)skb->data;
2034
2035                 if (skb->len > HCI_EVENT_HDR_SIZE && hdr->evt == 0xff &&
2036                     hdr->plen > 0) {
2037                         const void *ptr = skb->data + HCI_EVENT_HDR_SIZE + 1;
2038                         unsigned int len = skb->len - HCI_EVENT_HDR_SIZE - 1;
2039
2040                         switch (skb->data[2]) {
2041                         case 0x02:
2042                                 /* When switching to the operational firmware
2043                                  * the device sends a vendor specific event
2044                                  * indicating that the bootup completed.
2045                                  */
2046                                 btintel_bootup(hdev, ptr, len);
2047                                 break;
2048                         case 0x06:
2049                                 /* When the firmware loading completes the
2050                                  * device sends out a vendor specific event
2051                                  * indicating the result of the firmware
2052                                  * loading.
2053                                  */
2054                                 btintel_secure_send_result(hdev, ptr, len);
2055                                 break;
2056                         }
2057                 }
2058         }
2059
2060         return hci_recv_frame(hdev, skb);
2061 }
2062
2063 static int btusb_send_frame_intel(struct hci_dev *hdev, struct sk_buff *skb)
2064 {
2065         struct urb *urb;
2066
2067         BT_DBG("%s", hdev->name);
2068
2069         switch (hci_skb_pkt_type(skb)) {
2070         case HCI_COMMAND_PKT:
2071                 if (btintel_test_flag(hdev, INTEL_BOOTLOADER)) {
2072                         struct hci_command_hdr *cmd = (void *)skb->data;
2073                         __u16 opcode = le16_to_cpu(cmd->opcode);
2074
2075                         /* When in bootloader mode and the command 0xfc09
2076                          * is received, it needs to be send down the
2077                          * bulk endpoint. So allocate a bulk URB instead.
2078                          */
2079                         if (opcode == 0xfc09)
2080                                 urb = alloc_bulk_urb(hdev, skb);
2081                         else
2082                                 urb = alloc_ctrl_urb(hdev, skb);
2083
2084                         /* When the 0xfc01 command is issued to boot into
2085                          * the operational firmware, it will actually not
2086                          * send a command complete event. To keep the flow
2087                          * control working inject that event here.
2088                          */
2089                         if (opcode == 0xfc01)
2090                                 inject_cmd_complete(hdev, opcode);
2091                 } else {
2092                         urb = alloc_ctrl_urb(hdev, skb);
2093                 }
2094                 if (IS_ERR(urb))
2095                         return PTR_ERR(urb);
2096
2097                 hdev->stat.cmd_tx++;
2098                 return submit_or_queue_tx_urb(hdev, urb);
2099
2100         case HCI_ACLDATA_PKT:
2101                 urb = alloc_bulk_urb(hdev, skb);
2102                 if (IS_ERR(urb))
2103                         return PTR_ERR(urb);
2104
2105                 hdev->stat.acl_tx++;
2106                 return submit_or_queue_tx_urb(hdev, urb);
2107
2108         case HCI_SCODATA_PKT:
2109                 if (hci_conn_num(hdev, SCO_LINK) < 1)
2110                         return -ENODEV;
2111
2112                 urb = alloc_isoc_urb(hdev, skb);
2113                 if (IS_ERR(urb))
2114                         return PTR_ERR(urb);
2115
2116                 hdev->stat.sco_tx++;
2117                 return submit_tx_urb(hdev, urb);
2118         }
2119
2120         return -EILSEQ;
2121 }
2122
2123 /* UHW CR mapping */
2124 #define MTK_BT_MISC             0x70002510
2125 #define MTK_BT_SUBSYS_RST       0x70002610
2126 #define MTK_UDMA_INT_STA_BT     0x74000024
2127 #define MTK_UDMA_INT_STA_BT1    0x74000308
2128 #define MTK_BT_WDT_STATUS       0x740003A0
2129 #define MTK_EP_RST_OPT          0x74011890
2130 #define MTK_EP_RST_IN_OUT_OPT   0x00010001
2131 #define MTK_BT_RST_DONE         0x00000100
2132 #define MTK_BT_RESET_WAIT_MS    100
2133 #define MTK_BT_RESET_NUM_TRIES  10
2134 #define FIRMWARE_MT7663         "mediatek/mt7663pr2h.bin"
2135 #define FIRMWARE_MT7668         "mediatek/mt7668pr2h.bin"
2136
2137 #define HCI_WMT_MAX_EVENT_SIZE          64
2138 /* It is for mt79xx download rom patch*/
2139 #define MTK_FW_ROM_PATCH_HEADER_SIZE    32
2140 #define MTK_FW_ROM_PATCH_GD_SIZE        64
2141 #define MTK_FW_ROM_PATCH_SEC_MAP_SIZE   64
2142 #define MTK_SEC_MAP_COMMON_SIZE 12
2143 #define MTK_SEC_MAP_NEED_SEND_SIZE      52
2144
2145 enum {
2146         BTMTK_WMT_PATCH_DWNLD = 0x1,
2147         BTMTK_WMT_FUNC_CTRL = 0x6,
2148         BTMTK_WMT_RST = 0x7,
2149         BTMTK_WMT_SEMAPHORE = 0x17,
2150 };
2151
2152 enum {
2153         BTMTK_WMT_INVALID,
2154         BTMTK_WMT_PATCH_UNDONE,
2155         BTMTK_WMT_PATCH_PROGRESS,
2156         BTMTK_WMT_PATCH_DONE,
2157         BTMTK_WMT_ON_UNDONE,
2158         BTMTK_WMT_ON_DONE,
2159         BTMTK_WMT_ON_PROGRESS,
2160 };
2161
2162 struct btmtk_wmt_hdr {
2163         u8      dir;
2164         u8      op;
2165         __le16  dlen;
2166         u8      flag;
2167 } __packed;
2168
2169 struct btmtk_hci_wmt_cmd {
2170         struct btmtk_wmt_hdr hdr;
2171         u8 data[];
2172 } __packed;
2173
2174 struct btmtk_hci_wmt_evt {
2175         struct hci_event_hdr hhdr;
2176         struct btmtk_wmt_hdr whdr;
2177 } __packed;
2178
2179 struct btmtk_hci_wmt_evt_funcc {
2180         struct btmtk_hci_wmt_evt hwhdr;
2181         __be16 status;
2182 } __packed;
2183
2184 struct btmtk_tci_sleep {
2185         u8 mode;
2186         __le16 duration;
2187         __le16 host_duration;
2188         u8 host_wakeup_pin;
2189         u8 time_compensation;
2190 } __packed;
2191
2192 struct btmtk_hci_wmt_params {
2193         u8 op;
2194         u8 flag;
2195         u16 dlen;
2196         const void *data;
2197         u32 *status;
2198 };
2199
2200 struct btmtk_patch_header {
2201         u8 datetime[16];
2202         u8 platform[4];
2203         __le16 hwver;
2204         __le16 swver;
2205         __le32 magicnum;
2206 } __packed;
2207
2208 struct btmtk_global_desc {
2209         __le32 patch_ver;
2210         __le32 sub_sys;
2211         __le32 feature_opt;
2212         __le32 section_num;
2213 } __packed;
2214
2215 struct btmtk_section_map {
2216         __le32 sectype;
2217         __le32 secoffset;
2218         __le32 secsize;
2219         union {
2220                 __le32 u4SecSpec[13];
2221                 struct {
2222                         __le32 dlAddr;
2223                         __le32 dlsize;
2224                         __le32 seckeyidx;
2225                         __le32 alignlen;
2226                         __le32 sectype;
2227                         __le32 dlmodecrctype;
2228                         __le32 crc;
2229                         __le32 reserved[6];
2230                 } bin_info_spec;
2231         };
2232 } __packed;
2233
2234 static int btusb_set_bdaddr_mtk(struct hci_dev *hdev, const bdaddr_t *bdaddr)
2235 {
2236         struct sk_buff *skb;
2237         long ret;
2238
2239         skb = __hci_cmd_sync(hdev, 0xfc1a, sizeof(bdaddr), bdaddr, HCI_INIT_TIMEOUT);
2240         if (IS_ERR(skb)) {
2241                 ret = PTR_ERR(skb);
2242                 bt_dev_err(hdev, "changing Mediatek device address failed (%ld)",
2243                            ret);
2244                 return ret;
2245         }
2246         kfree_skb(skb);
2247
2248         return 0;
2249 }
2250
2251 static void btusb_mtk_wmt_recv(struct urb *urb)
2252 {
2253         struct hci_dev *hdev = urb->context;
2254         struct btusb_data *data = hci_get_drvdata(hdev);
2255         struct hci_event_hdr *hdr;
2256         struct sk_buff *skb;
2257         int err;
2258
2259         if (urb->status == 0 && urb->actual_length > 0) {
2260                 hdev->stat.byte_rx += urb->actual_length;
2261
2262                 /* WMT event shouldn't be fragmented and the size should be
2263                  * less than HCI_WMT_MAX_EVENT_SIZE.
2264                  */
2265                 skb = bt_skb_alloc(HCI_WMT_MAX_EVENT_SIZE, GFP_ATOMIC);
2266                 if (!skb) {
2267                         hdev->stat.err_rx++;
2268                         return;
2269                 }
2270
2271                 hci_skb_pkt_type(skb) = HCI_EVENT_PKT;
2272                 skb_put_data(skb, urb->transfer_buffer, urb->actual_length);
2273
2274                 hdr = (void *)skb->data;
2275                 /* Fix up the vendor event id with 0xff for vendor specific
2276                  * instead of 0xe4 so that event send via monitoring socket can
2277                  * be parsed properly.
2278                  */
2279                 hdr->evt = 0xff;
2280
2281                 /* When someone waits for the WMT event, the skb is being cloned
2282                  * and being processed the events from there then.
2283                  */
2284                 if (test_bit(BTUSB_TX_WAIT_VND_EVT, &data->flags)) {
2285                         data->evt_skb = skb_clone(skb, GFP_ATOMIC);
2286                         if (!data->evt_skb) {
2287                                 kfree_skb(skb);
2288                                 return;
2289                         }
2290                 }
2291
2292                 err = hci_recv_frame(hdev, skb);
2293                 if (err < 0) {
2294                         kfree_skb(data->evt_skb);
2295                         data->evt_skb = NULL;
2296                         return;
2297                 }
2298
2299                 if (test_and_clear_bit(BTUSB_TX_WAIT_VND_EVT,
2300                                        &data->flags)) {
2301                         /* Barrier to sync with other CPUs */
2302                         smp_mb__after_atomic();
2303                         wake_up_bit(&data->flags,
2304                                     BTUSB_TX_WAIT_VND_EVT);
2305                 }
2306                 return;
2307         } else if (urb->status == -ENOENT) {
2308                 /* Avoid suspend failed when usb_kill_urb */
2309                 return;
2310         }
2311
2312         usb_mark_last_busy(data->udev);
2313
2314         /* The URB complete handler is still called with urb->actual_length = 0
2315          * when the event is not available, so we should keep re-submitting
2316          * URB until WMT event returns, Also, It's necessary to wait some time
2317          * between the two consecutive control URBs to relax the target device
2318          * to generate the event. Otherwise, the WMT event cannot return from
2319          * the device successfully.
2320          */
2321         udelay(500);
2322
2323         usb_anchor_urb(urb, &data->ctrl_anchor);
2324         err = usb_submit_urb(urb, GFP_ATOMIC);
2325         if (err < 0) {
2326                 /* -EPERM: urb is being killed;
2327                  * -ENODEV: device got disconnected
2328                  */
2329                 if (err != -EPERM && err != -ENODEV)
2330                         bt_dev_err(hdev, "urb %p failed to resubmit (%d)",
2331                                    urb, -err);
2332                 usb_unanchor_urb(urb);
2333         }
2334 }
2335
2336 static int btusb_mtk_submit_wmt_recv_urb(struct hci_dev *hdev)
2337 {
2338         struct btusb_data *data = hci_get_drvdata(hdev);
2339         struct usb_ctrlrequest *dr;
2340         unsigned char *buf;
2341         int err, size = 64;
2342         unsigned int pipe;
2343         struct urb *urb;
2344
2345         urb = usb_alloc_urb(0, GFP_KERNEL);
2346         if (!urb)
2347                 return -ENOMEM;
2348
2349         dr = kmalloc(sizeof(*dr), GFP_KERNEL);
2350         if (!dr) {
2351                 usb_free_urb(urb);
2352                 return -ENOMEM;
2353         }
2354
2355         dr->bRequestType = USB_TYPE_VENDOR | USB_DIR_IN;
2356         dr->bRequest     = 1;
2357         dr->wIndex       = cpu_to_le16(0);
2358         dr->wValue       = cpu_to_le16(48);
2359         dr->wLength      = cpu_to_le16(size);
2360
2361         buf = kmalloc(size, GFP_KERNEL);
2362         if (!buf) {
2363                 kfree(dr);
2364                 usb_free_urb(urb);
2365                 return -ENOMEM;
2366         }
2367
2368         pipe = usb_rcvctrlpipe(data->udev, 0);
2369
2370         usb_fill_control_urb(urb, data->udev, pipe, (void *)dr,
2371                              buf, size, btusb_mtk_wmt_recv, hdev);
2372
2373         urb->transfer_flags |= URB_FREE_BUFFER;
2374
2375         usb_anchor_urb(urb, &data->ctrl_anchor);
2376         err = usb_submit_urb(urb, GFP_KERNEL);
2377         if (err < 0) {
2378                 if (err != -EPERM && err != -ENODEV)
2379                         bt_dev_err(hdev, "urb %p submission failed (%d)",
2380                                    urb, -err);
2381                 usb_unanchor_urb(urb);
2382         }
2383
2384         usb_free_urb(urb);
2385
2386         return err;
2387 }
2388
2389 static int btusb_mtk_hci_wmt_sync(struct hci_dev *hdev,
2390                                   struct btmtk_hci_wmt_params *wmt_params)
2391 {
2392         struct btusb_data *data = hci_get_drvdata(hdev);
2393         struct btmtk_hci_wmt_evt_funcc *wmt_evt_funcc;
2394         u32 hlen, status = BTMTK_WMT_INVALID;
2395         struct btmtk_hci_wmt_evt *wmt_evt;
2396         struct btmtk_hci_wmt_cmd *wc;
2397         struct btmtk_wmt_hdr *hdr;
2398         int err;
2399
2400         /* Send the WMT command and wait until the WMT event returns */
2401         hlen = sizeof(*hdr) + wmt_params->dlen;
2402         if (hlen > 255)
2403                 return -EINVAL;
2404
2405         wc = kzalloc(hlen, GFP_KERNEL);
2406         if (!wc)
2407                 return -ENOMEM;
2408
2409         hdr = &wc->hdr;
2410         hdr->dir = 1;
2411         hdr->op = wmt_params->op;
2412         hdr->dlen = cpu_to_le16(wmt_params->dlen + 1);
2413         hdr->flag = wmt_params->flag;
2414         memcpy(wc->data, wmt_params->data, wmt_params->dlen);
2415
2416         set_bit(BTUSB_TX_WAIT_VND_EVT, &data->flags);
2417
2418         err = __hci_cmd_send(hdev, 0xfc6f, hlen, wc);
2419
2420         if (err < 0) {
2421                 clear_bit(BTUSB_TX_WAIT_VND_EVT, &data->flags);
2422                 goto err_free_wc;
2423         }
2424
2425         /* Submit control IN URB on demand to process the WMT event */
2426         err = btusb_mtk_submit_wmt_recv_urb(hdev);
2427         if (err < 0)
2428                 goto err_free_wc;
2429
2430         /* The vendor specific WMT commands are all answered by a vendor
2431          * specific event and will have the Command Status or Command
2432          * Complete as with usual HCI command flow control.
2433          *
2434          * After sending the command, wait for BTUSB_TX_WAIT_VND_EVT
2435          * state to be cleared. The driver specific event receive routine
2436          * will clear that state and with that indicate completion of the
2437          * WMT command.
2438          */
2439         err = wait_on_bit_timeout(&data->flags, BTUSB_TX_WAIT_VND_EVT,
2440                                   TASK_INTERRUPTIBLE, HCI_INIT_TIMEOUT);
2441         if (err == -EINTR) {
2442                 bt_dev_err(hdev, "Execution of wmt command interrupted");
2443                 clear_bit(BTUSB_TX_WAIT_VND_EVT, &data->flags);
2444                 goto err_free_wc;
2445         }
2446
2447         if (err) {
2448                 bt_dev_err(hdev, "Execution of wmt command timed out");
2449                 clear_bit(BTUSB_TX_WAIT_VND_EVT, &data->flags);
2450                 err = -ETIMEDOUT;
2451                 goto err_free_wc;
2452         }
2453
2454         /* Parse and handle the return WMT event */
2455         wmt_evt = (struct btmtk_hci_wmt_evt *)data->evt_skb->data;
2456         if (wmt_evt->whdr.op != hdr->op) {
2457                 bt_dev_err(hdev, "Wrong op received %d expected %d",
2458                            wmt_evt->whdr.op, hdr->op);
2459                 err = -EIO;
2460                 goto err_free_skb;
2461         }
2462
2463         switch (wmt_evt->whdr.op) {
2464         case BTMTK_WMT_SEMAPHORE:
2465                 if (wmt_evt->whdr.flag == 2)
2466                         status = BTMTK_WMT_PATCH_UNDONE;
2467                 else
2468                         status = BTMTK_WMT_PATCH_DONE;
2469                 break;
2470         case BTMTK_WMT_FUNC_CTRL:
2471                 wmt_evt_funcc = (struct btmtk_hci_wmt_evt_funcc *)wmt_evt;
2472                 if (be16_to_cpu(wmt_evt_funcc->status) == 0x404)
2473                         status = BTMTK_WMT_ON_DONE;
2474                 else if (be16_to_cpu(wmt_evt_funcc->status) == 0x420)
2475                         status = BTMTK_WMT_ON_PROGRESS;
2476                 else
2477                         status = BTMTK_WMT_ON_UNDONE;
2478                 break;
2479         case BTMTK_WMT_PATCH_DWNLD:
2480                 if (wmt_evt->whdr.flag == 2)
2481                         status = BTMTK_WMT_PATCH_DONE;
2482                 else if (wmt_evt->whdr.flag == 1)
2483                         status = BTMTK_WMT_PATCH_PROGRESS;
2484                 else
2485                         status = BTMTK_WMT_PATCH_UNDONE;
2486                 break;
2487         }
2488
2489         if (wmt_params->status)
2490                 *wmt_params->status = status;
2491
2492 err_free_skb:
2493         kfree_skb(data->evt_skb);
2494         data->evt_skb = NULL;
2495 err_free_wc:
2496         kfree(wc);
2497         return err;
2498 }
2499
2500 static int btusb_mtk_setup_firmware_79xx(struct hci_dev *hdev, const char *fwname)
2501 {
2502         struct btmtk_hci_wmt_params wmt_params;
2503         struct btmtk_global_desc *globaldesc = NULL;
2504         struct btmtk_section_map *sectionmap;
2505         const struct firmware *fw;
2506         const u8 *fw_ptr;
2507         const u8 *fw_bin_ptr;
2508         int err, dlen, i, status;
2509         u8 flag, first_block, retry;
2510         u32 section_num, dl_size, section_offset;
2511         u8 cmd[64];
2512
2513         err = request_firmware(&fw, fwname, &hdev->dev);
2514         if (err < 0) {
2515                 bt_dev_err(hdev, "Failed to load firmware file (%d)", err);
2516                 return err;
2517         }
2518
2519         fw_ptr = fw->data;
2520         fw_bin_ptr = fw_ptr;
2521         globaldesc = (struct btmtk_global_desc *)(fw_ptr + MTK_FW_ROM_PATCH_HEADER_SIZE);
2522         section_num = le32_to_cpu(globaldesc->section_num);
2523
2524         for (i = 0; i < section_num; i++) {
2525                 first_block = 1;
2526                 fw_ptr = fw_bin_ptr;
2527                 sectionmap = (struct btmtk_section_map *)(fw_ptr + MTK_FW_ROM_PATCH_HEADER_SIZE +
2528                               MTK_FW_ROM_PATCH_GD_SIZE + MTK_FW_ROM_PATCH_SEC_MAP_SIZE * i);
2529
2530                 section_offset = le32_to_cpu(sectionmap->secoffset);
2531                 dl_size = le32_to_cpu(sectionmap->bin_info_spec.dlsize);
2532
2533                 if (dl_size > 0) {
2534                         retry = 20;
2535                         while (retry > 0) {
2536                                 cmd[0] = 0; /* 0 means legacy dl mode. */
2537                                 memcpy(cmd + 1,
2538                                        fw_ptr + MTK_FW_ROM_PATCH_HEADER_SIZE +
2539                                        MTK_FW_ROM_PATCH_GD_SIZE + MTK_FW_ROM_PATCH_SEC_MAP_SIZE * i +
2540                                        MTK_SEC_MAP_COMMON_SIZE,
2541                                        MTK_SEC_MAP_NEED_SEND_SIZE + 1);
2542
2543                                 wmt_params.op = BTMTK_WMT_PATCH_DWNLD;
2544                                 wmt_params.status = &status;
2545                                 wmt_params.flag = 0;
2546                                 wmt_params.dlen = MTK_SEC_MAP_NEED_SEND_SIZE + 1;
2547                                 wmt_params.data = &cmd;
2548
2549                                 err = btusb_mtk_hci_wmt_sync(hdev, &wmt_params);
2550                                 if (err < 0) {
2551                                         bt_dev_err(hdev, "Failed to send wmt patch dwnld (%d)",
2552                                                    err);
2553                                         goto err_release_fw;
2554                                 }
2555
2556                                 if (status == BTMTK_WMT_PATCH_UNDONE) {
2557                                         break;
2558                                 } else if (status == BTMTK_WMT_PATCH_PROGRESS) {
2559                                         msleep(100);
2560                                         retry--;
2561                                 } else if (status == BTMTK_WMT_PATCH_DONE) {
2562                                         goto next_section;
2563                                 } else {
2564                                         bt_dev_err(hdev, "Failed wmt patch dwnld status (%d)",
2565                                                    status);
2566                                         goto err_release_fw;
2567                                 }
2568                         }
2569
2570                         fw_ptr += section_offset;
2571                         wmt_params.op = BTMTK_WMT_PATCH_DWNLD;
2572                         wmt_params.status = NULL;
2573
2574                         while (dl_size > 0) {
2575                                 dlen = min_t(int, 250, dl_size);
2576                                 if (first_block == 1) {
2577                                         flag = 1;
2578                                         first_block = 0;
2579                                 } else if (dl_size - dlen <= 0) {
2580                                         flag = 3;
2581                                 } else {
2582                                         flag = 2;
2583                                 }
2584
2585                                 wmt_params.flag = flag;
2586                                 wmt_params.dlen = dlen;
2587                                 wmt_params.data = fw_ptr;
2588
2589                                 err = btusb_mtk_hci_wmt_sync(hdev, &wmt_params);
2590                                 if (err < 0) {
2591                                         bt_dev_err(hdev, "Failed to send wmt patch dwnld (%d)",
2592                                                    err);
2593                                         goto err_release_fw;
2594                                 }
2595
2596                                 dl_size -= dlen;
2597                                 fw_ptr += dlen;
2598                         }
2599                 }
2600 next_section:
2601                 continue;
2602         }
2603         /* Wait a few moments for firmware activation done */
2604         usleep_range(100000, 120000);
2605
2606 err_release_fw:
2607         release_firmware(fw);
2608
2609         return err;
2610 }
2611
2612 static int btusb_mtk_setup_firmware(struct hci_dev *hdev, const char *fwname)
2613 {
2614         struct btmtk_hci_wmt_params wmt_params;
2615         const struct firmware *fw;
2616         const u8 *fw_ptr;
2617         size_t fw_size;
2618         int err, dlen;
2619         u8 flag, param;
2620
2621         err = request_firmware(&fw, fwname, &hdev->dev);
2622         if (err < 0) {
2623                 bt_dev_err(hdev, "Failed to load firmware file (%d)", err);
2624                 return err;
2625         }
2626
2627         /* Power on data RAM the firmware relies on. */
2628         param = 1;
2629         wmt_params.op = BTMTK_WMT_FUNC_CTRL;
2630         wmt_params.flag = 3;
2631         wmt_params.dlen = sizeof(param);
2632         wmt_params.data = &param;
2633         wmt_params.status = NULL;
2634
2635         err = btusb_mtk_hci_wmt_sync(hdev, &wmt_params);
2636         if (err < 0) {
2637                 bt_dev_err(hdev, "Failed to power on data RAM (%d)", err);
2638                 goto err_release_fw;
2639         }
2640
2641         fw_ptr = fw->data;
2642         fw_size = fw->size;
2643
2644         /* The size of patch header is 30 bytes, should be skip */
2645         if (fw_size < 30) {
2646                 err = -EINVAL;
2647                 goto err_release_fw;
2648         }
2649
2650         fw_size -= 30;
2651         fw_ptr += 30;
2652         flag = 1;
2653
2654         wmt_params.op = BTMTK_WMT_PATCH_DWNLD;
2655         wmt_params.status = NULL;
2656
2657         while (fw_size > 0) {
2658                 dlen = min_t(int, 250, fw_size);
2659
2660                 /* Tell device the position in sequence */
2661                 if (fw_size - dlen <= 0)
2662                         flag = 3;
2663                 else if (fw_size < fw->size - 30)
2664                         flag = 2;
2665
2666                 wmt_params.flag = flag;
2667                 wmt_params.dlen = dlen;
2668                 wmt_params.data = fw_ptr;
2669
2670                 err = btusb_mtk_hci_wmt_sync(hdev, &wmt_params);
2671                 if (err < 0) {
2672                         bt_dev_err(hdev, "Failed to send wmt patch dwnld (%d)",
2673                                    err);
2674                         goto err_release_fw;
2675                 }
2676
2677                 fw_size -= dlen;
2678                 fw_ptr += dlen;
2679         }
2680
2681         wmt_params.op = BTMTK_WMT_RST;
2682         wmt_params.flag = 4;
2683         wmt_params.dlen = 0;
2684         wmt_params.data = NULL;
2685         wmt_params.status = NULL;
2686
2687         /* Activate funciton the firmware providing to */
2688         err = btusb_mtk_hci_wmt_sync(hdev, &wmt_params);
2689         if (err < 0) {
2690                 bt_dev_err(hdev, "Failed to send wmt rst (%d)", err);
2691                 goto err_release_fw;
2692         }
2693
2694         /* Wait a few moments for firmware activation done */
2695         usleep_range(10000, 12000);
2696
2697 err_release_fw:
2698         release_firmware(fw);
2699
2700         return err;
2701 }
2702
2703 static int btusb_mtk_func_query(struct hci_dev *hdev)
2704 {
2705         struct btmtk_hci_wmt_params wmt_params;
2706         int status, err;
2707         u8 param = 0;
2708
2709         /* Query whether the function is enabled */
2710         wmt_params.op = BTMTK_WMT_FUNC_CTRL;
2711         wmt_params.flag = 4;
2712         wmt_params.dlen = sizeof(param);
2713         wmt_params.data = &param;
2714         wmt_params.status = &status;
2715
2716         err = btusb_mtk_hci_wmt_sync(hdev, &wmt_params);
2717         if (err < 0) {
2718                 bt_dev_err(hdev, "Failed to query function status (%d)", err);
2719                 return err;
2720         }
2721
2722         return status;
2723 }
2724
2725 static int btusb_mtk_uhw_reg_write(struct btusb_data *data, u32 reg, u32 val)
2726 {
2727         struct hci_dev *hdev = data->hdev;
2728         int pipe, err;
2729         void *buf;
2730
2731         buf = kzalloc(4, GFP_KERNEL);
2732         if (!buf)
2733                 return -ENOMEM;
2734
2735         put_unaligned_le32(val, buf);
2736
2737         pipe = usb_sndctrlpipe(data->udev, 0);
2738         err = usb_control_msg(data->udev, pipe, 0x02,
2739                               0x5E,
2740                               reg >> 16, reg & 0xffff,
2741                               buf, 4, USB_CTRL_SET_TIMEOUT);
2742         if (err < 0) {
2743                 bt_dev_err(hdev, "Failed to write uhw reg(%d)", err);
2744                 goto err_free_buf;
2745         }
2746
2747 err_free_buf:
2748         kfree(buf);
2749
2750         return err;
2751 }
2752
2753 static int btusb_mtk_uhw_reg_read(struct btusb_data *data, u32 reg, u32 *val)
2754 {
2755         struct hci_dev *hdev = data->hdev;
2756         int pipe, err;
2757         void *buf;
2758
2759         buf = kzalloc(4, GFP_KERNEL);
2760         if (!buf)
2761                 return -ENOMEM;
2762
2763         pipe = usb_rcvctrlpipe(data->udev, 0);
2764         err = usb_control_msg(data->udev, pipe, 0x01,
2765                               0xDE,
2766                               reg >> 16, reg & 0xffff,
2767                               buf, 4, USB_CTRL_SET_TIMEOUT);
2768         if (err < 0) {
2769                 bt_dev_err(hdev, "Failed to read uhw reg(%d)", err);
2770                 goto err_free_buf;
2771         }
2772
2773         *val = get_unaligned_le32(buf);
2774         bt_dev_dbg(hdev, "reg=%x, value=0x%08x", reg, *val);
2775
2776 err_free_buf:
2777         kfree(buf);
2778
2779         return err;
2780 }
2781
2782 static int btusb_mtk_reg_read(struct btusb_data *data, u32 reg, u32 *val)
2783 {
2784         int pipe, err, size = sizeof(u32);
2785         void *buf;
2786
2787         buf = kzalloc(size, GFP_KERNEL);
2788         if (!buf)
2789                 return -ENOMEM;
2790
2791         pipe = usb_rcvctrlpipe(data->udev, 0);
2792         err = usb_control_msg(data->udev, pipe, 0x63,
2793                               USB_TYPE_VENDOR | USB_DIR_IN,
2794                               reg >> 16, reg & 0xffff,
2795                               buf, size, USB_CTRL_SET_TIMEOUT);
2796         if (err < 0)
2797                 goto err_free_buf;
2798
2799         *val = get_unaligned_le32(buf);
2800
2801 err_free_buf:
2802         kfree(buf);
2803
2804         return err;
2805 }
2806
2807 static int btusb_mtk_id_get(struct btusb_data *data, u32 reg, u32 *id)
2808 {
2809         return btusb_mtk_reg_read(data, reg, id);
2810 }
2811
2812 static int btusb_mtk_setup(struct hci_dev *hdev)
2813 {
2814         struct btusb_data *data = hci_get_drvdata(hdev);
2815         struct btmtk_hci_wmt_params wmt_params;
2816         ktime_t calltime, delta, rettime;
2817         struct btmtk_tci_sleep tci_sleep;
2818         unsigned long long duration;
2819         struct sk_buff *skb;
2820         const char *fwname;
2821         int err, status;
2822         u32 dev_id;
2823         char fw_bin_name[64];
2824         u32 fw_version = 0;
2825         u8 param;
2826
2827         calltime = ktime_get();
2828
2829         err = btusb_mtk_id_get(data, 0x80000008, &dev_id);
2830         if (err < 0) {
2831                 bt_dev_err(hdev, "Failed to get device id (%d)", err);
2832                 return err;
2833         }
2834
2835         if (!dev_id) {
2836                 err = btusb_mtk_id_get(data, 0x70010200, &dev_id);
2837                 if (err < 0) {
2838                         bt_dev_err(hdev, "Failed to get device id (%d)", err);
2839                         return err;
2840                 }
2841                 err = btusb_mtk_id_get(data, 0x80021004, &fw_version);
2842                 if (err < 0) {
2843                         bt_dev_err(hdev, "Failed to get fw version (%d)", err);
2844                         return err;
2845                 }
2846         }
2847
2848         switch (dev_id) {
2849         case 0x7663:
2850                 fwname = FIRMWARE_MT7663;
2851                 break;
2852         case 0x7668:
2853                 fwname = FIRMWARE_MT7668;
2854                 break;
2855         case 0x7922:
2856         case 0x7961:
2857                 snprintf(fw_bin_name, sizeof(fw_bin_name),
2858                         "mediatek/BT_RAM_CODE_MT%04x_1_%x_hdr.bin",
2859                          dev_id & 0xffff, (fw_version & 0xff) + 1);
2860                 err = btusb_mtk_setup_firmware_79xx(hdev, fw_bin_name);
2861
2862                 /* It's Device EndPoint Reset Option Register */
2863                 btusb_mtk_uhw_reg_write(data, MTK_EP_RST_OPT, MTK_EP_RST_IN_OUT_OPT);
2864
2865                 /* Enable Bluetooth protocol */
2866                 param = 1;
2867                 wmt_params.op = BTMTK_WMT_FUNC_CTRL;
2868                 wmt_params.flag = 0;
2869                 wmt_params.dlen = sizeof(param);
2870                 wmt_params.data = &param;
2871                 wmt_params.status = NULL;
2872
2873                 err = btusb_mtk_hci_wmt_sync(hdev, &wmt_params);
2874                 if (err < 0) {
2875                         bt_dev_err(hdev, "Failed to send wmt func ctrl (%d)", err);
2876                         return err;
2877                 }
2878
2879                 hci_set_msft_opcode(hdev, 0xFD30);
2880                 goto done;
2881         default:
2882                 bt_dev_err(hdev, "Unsupported hardware variant (%08x)",
2883                            dev_id);
2884                 return -ENODEV;
2885         }
2886
2887         /* Query whether the firmware is already download */
2888         wmt_params.op = BTMTK_WMT_SEMAPHORE;
2889         wmt_params.flag = 1;
2890         wmt_params.dlen = 0;
2891         wmt_params.data = NULL;
2892         wmt_params.status = &status;
2893
2894         err = btusb_mtk_hci_wmt_sync(hdev, &wmt_params);
2895         if (err < 0) {
2896                 bt_dev_err(hdev, "Failed to query firmware status (%d)", err);
2897                 return err;
2898         }
2899
2900         if (status == BTMTK_WMT_PATCH_DONE) {
2901                 bt_dev_info(hdev, "firmware already downloaded");
2902                 goto ignore_setup_fw;
2903         }
2904
2905         /* Setup a firmware which the device definitely requires */
2906         err = btusb_mtk_setup_firmware(hdev, fwname);
2907         if (err < 0)
2908                 return err;
2909
2910 ignore_setup_fw:
2911         err = readx_poll_timeout(btusb_mtk_func_query, hdev, status,
2912                                  status < 0 || status != BTMTK_WMT_ON_PROGRESS,
2913                                  2000, 5000000);
2914         /* -ETIMEDOUT happens */
2915         if (err < 0)
2916                 return err;
2917
2918         /* The other errors happen in btusb_mtk_func_query */
2919         if (status < 0)
2920                 return status;
2921
2922         if (status == BTMTK_WMT_ON_DONE) {
2923                 bt_dev_info(hdev, "function already on");
2924                 goto ignore_func_on;
2925         }
2926
2927         /* Enable Bluetooth protocol */
2928         param = 1;
2929         wmt_params.op = BTMTK_WMT_FUNC_CTRL;
2930         wmt_params.flag = 0;
2931         wmt_params.dlen = sizeof(param);
2932         wmt_params.data = &param;
2933         wmt_params.status = NULL;
2934
2935         err = btusb_mtk_hci_wmt_sync(hdev, &wmt_params);
2936         if (err < 0) {
2937                 bt_dev_err(hdev, "Failed to send wmt func ctrl (%d)", err);
2938                 return err;
2939         }
2940
2941 ignore_func_on:
2942         /* Apply the low power environment setup */
2943         tci_sleep.mode = 0x5;
2944         tci_sleep.duration = cpu_to_le16(0x640);
2945         tci_sleep.host_duration = cpu_to_le16(0x640);
2946         tci_sleep.host_wakeup_pin = 0;
2947         tci_sleep.time_compensation = 0;
2948
2949         skb = __hci_cmd_sync(hdev, 0xfc7a, sizeof(tci_sleep), &tci_sleep,
2950                              HCI_INIT_TIMEOUT);
2951         if (IS_ERR(skb)) {
2952                 err = PTR_ERR(skb);
2953                 bt_dev_err(hdev, "Failed to apply low power setting (%d)", err);
2954                 return err;
2955         }
2956         kfree_skb(skb);
2957
2958 done:
2959         rettime = ktime_get();
2960         delta = ktime_sub(rettime, calltime);
2961         duration = (unsigned long long)ktime_to_ns(delta) >> 10;
2962
2963         bt_dev_info(hdev, "Device setup in %llu usecs", duration);
2964
2965         return 0;
2966 }
2967
2968 static int btusb_mtk_shutdown(struct hci_dev *hdev)
2969 {
2970         struct btmtk_hci_wmt_params wmt_params;
2971         u8 param = 0;
2972         int err;
2973
2974         /* Disable the device */
2975         wmt_params.op = BTMTK_WMT_FUNC_CTRL;
2976         wmt_params.flag = 0;
2977         wmt_params.dlen = sizeof(param);
2978         wmt_params.data = &param;
2979         wmt_params.status = NULL;
2980
2981         err = btusb_mtk_hci_wmt_sync(hdev, &wmt_params);
2982         if (err < 0) {
2983                 bt_dev_err(hdev, "Failed to send wmt func ctrl (%d)", err);
2984                 return err;
2985         }
2986
2987         return 0;
2988 }
2989
2990 static void btusb_mtk_cmd_timeout(struct hci_dev *hdev)
2991 {
2992         struct btusb_data *data = hci_get_drvdata(hdev);
2993         u32 val;
2994         int err, retry = 0;
2995
2996         /* It's MediaTek specific bluetooth reset mechanism via USB */
2997         if (test_and_set_bit(BTUSB_HW_RESET_ACTIVE, &data->flags)) {
2998                 bt_dev_err(hdev, "last reset failed? Not resetting again");
2999                 return;
3000         }
3001
3002         err = usb_autopm_get_interface(data->intf);
3003         if (err < 0)
3004                 return;
3005
3006         btusb_stop_traffic(data);
3007         usb_kill_anchored_urbs(&data->tx_anchor);
3008
3009         /* It's Device EndPoint Reset Option Register */
3010         bt_dev_dbg(hdev, "Initiating reset mechanism via uhw");
3011         btusb_mtk_uhw_reg_write(data, MTK_EP_RST_OPT, MTK_EP_RST_IN_OUT_OPT);
3012         btusb_mtk_uhw_reg_read(data, MTK_BT_WDT_STATUS, &val);
3013
3014         /* Reset the bluetooth chip via USB interface. */
3015         btusb_mtk_uhw_reg_write(data, MTK_BT_SUBSYS_RST, 1);
3016         btusb_mtk_uhw_reg_write(data, MTK_UDMA_INT_STA_BT, 0x000000FF);
3017         btusb_mtk_uhw_reg_read(data, MTK_UDMA_INT_STA_BT, &val);
3018         btusb_mtk_uhw_reg_write(data, MTK_UDMA_INT_STA_BT1, 0x000000FF);
3019         btusb_mtk_uhw_reg_read(data, MTK_UDMA_INT_STA_BT1, &val);
3020         /* MT7921 need to delay 20ms between toggle reset bit */
3021         msleep(20);
3022         btusb_mtk_uhw_reg_write(data, MTK_BT_SUBSYS_RST, 0);
3023         btusb_mtk_uhw_reg_read(data, MTK_BT_SUBSYS_RST, &val);
3024
3025         /* Poll the register until reset is completed */
3026         do {
3027                 btusb_mtk_uhw_reg_read(data, MTK_BT_MISC, &val);
3028                 if (val & MTK_BT_RST_DONE) {
3029                         bt_dev_dbg(hdev, "Bluetooth Reset Successfully");
3030                         break;
3031                 }
3032
3033                 bt_dev_dbg(hdev, "Polling Bluetooth Reset CR");
3034                 retry++;
3035                 msleep(MTK_BT_RESET_WAIT_MS);
3036         } while (retry < MTK_BT_RESET_NUM_TRIES);
3037
3038         btusb_mtk_id_get(data, 0x70010200, &val);
3039         if (!val)
3040                 bt_dev_err(hdev, "Can't get device id, subsys reset fail.");
3041
3042         usb_queue_reset_device(data->intf);
3043
3044         clear_bit(BTUSB_HW_RESET_ACTIVE, &data->flags);
3045 }
3046
3047 static int btusb_recv_acl_mtk(struct hci_dev *hdev, struct sk_buff *skb)
3048 {
3049         struct btusb_data *data = hci_get_drvdata(hdev);
3050         u16 handle = le16_to_cpu(hci_acl_hdr(skb)->handle);
3051
3052         switch (handle) {
3053         case 0xfc6f:            /* Firmware dump from device */
3054                 /* When the firmware hangs, the device can no longer
3055                  * suspend and thus disable auto-suspend.
3056                  */
3057                 usb_disable_autosuspend(data->udev);
3058                 fallthrough;
3059         case 0x05ff:            /* Firmware debug logging 1 */
3060         case 0x05fe:            /* Firmware debug logging 2 */
3061                 return hci_recv_diag(hdev, skb);
3062         }
3063
3064         return hci_recv_frame(hdev, skb);
3065 }
3066
3067 MODULE_FIRMWARE(FIRMWARE_MT7663);
3068 MODULE_FIRMWARE(FIRMWARE_MT7668);
3069
3070 #ifdef CONFIG_PM
3071 /* Configure an out-of-band gpio as wake-up pin, if specified in device tree */
3072 static int marvell_config_oob_wake(struct hci_dev *hdev)
3073 {
3074         struct sk_buff *skb;
3075         struct btusb_data *data = hci_get_drvdata(hdev);
3076         struct device *dev = &data->udev->dev;
3077         u16 pin, gap, opcode;
3078         int ret;
3079         u8 cmd[5];
3080
3081         /* Move on if no wakeup pin specified */
3082         if (of_property_read_u16(dev->of_node, "marvell,wakeup-pin", &pin) ||
3083             of_property_read_u16(dev->of_node, "marvell,wakeup-gap-ms", &gap))
3084                 return 0;
3085
3086         /* Vendor specific command to configure a GPIO as wake-up pin */
3087         opcode = hci_opcode_pack(0x3F, 0x59);
3088         cmd[0] = opcode & 0xFF;
3089         cmd[1] = opcode >> 8;
3090         cmd[2] = 2; /* length of parameters that follow */
3091         cmd[3] = pin;
3092         cmd[4] = gap; /* time in ms, for which wakeup pin should be asserted */
3093
3094         skb = bt_skb_alloc(sizeof(cmd), GFP_KERNEL);
3095         if (!skb) {
3096                 bt_dev_err(hdev, "%s: No memory", __func__);
3097                 return -ENOMEM;
3098         }
3099
3100         skb_put_data(skb, cmd, sizeof(cmd));
3101         hci_skb_pkt_type(skb) = HCI_COMMAND_PKT;
3102
3103         ret = btusb_send_frame(hdev, skb);
3104         if (ret) {
3105                 bt_dev_err(hdev, "%s: configuration failed", __func__);
3106                 kfree_skb(skb);
3107                 return ret;
3108         }
3109
3110         return 0;
3111 }
3112 #endif
3113
3114 static int btusb_set_bdaddr_marvell(struct hci_dev *hdev,
3115                                     const bdaddr_t *bdaddr)
3116 {
3117         struct sk_buff *skb;
3118         u8 buf[8];
3119         long ret;
3120
3121         buf[0] = 0xfe;
3122         buf[1] = sizeof(bdaddr_t);
3123         memcpy(buf + 2, bdaddr, sizeof(bdaddr_t));
3124
3125         skb = __hci_cmd_sync(hdev, 0xfc22, sizeof(buf), buf, HCI_INIT_TIMEOUT);
3126         if (IS_ERR(skb)) {
3127                 ret = PTR_ERR(skb);
3128                 bt_dev_err(hdev, "changing Marvell device address failed (%ld)",
3129                            ret);
3130                 return ret;
3131         }
3132         kfree_skb(skb);
3133
3134         return 0;
3135 }
3136
3137 static int btusb_set_bdaddr_ath3012(struct hci_dev *hdev,
3138                                     const bdaddr_t *bdaddr)
3139 {
3140         struct sk_buff *skb;
3141         u8 buf[10];
3142         long ret;
3143
3144         buf[0] = 0x01;
3145         buf[1] = 0x01;
3146         buf[2] = 0x00;
3147         buf[3] = sizeof(bdaddr_t);
3148         memcpy(buf + 4, bdaddr, sizeof(bdaddr_t));
3149
3150         skb = __hci_cmd_sync(hdev, 0xfc0b, sizeof(buf), buf, HCI_INIT_TIMEOUT);
3151         if (IS_ERR(skb)) {
3152                 ret = PTR_ERR(skb);
3153                 bt_dev_err(hdev, "Change address command failed (%ld)", ret);
3154                 return ret;
3155         }
3156         kfree_skb(skb);
3157
3158         return 0;
3159 }
3160
3161 static int btusb_set_bdaddr_wcn6855(struct hci_dev *hdev,
3162                                 const bdaddr_t *bdaddr)
3163 {
3164         struct sk_buff *skb;
3165         u8 buf[6];
3166         long ret;
3167
3168         memcpy(buf, bdaddr, sizeof(bdaddr_t));
3169
3170         skb = __hci_cmd_sync_ev(hdev, 0xfc14, sizeof(buf), buf,
3171                                 HCI_EV_CMD_COMPLETE, HCI_INIT_TIMEOUT);
3172         if (IS_ERR(skb)) {
3173                 ret = PTR_ERR(skb);
3174                 bt_dev_err(hdev, "Change address command failed (%ld)", ret);
3175                 return ret;
3176         }
3177         kfree_skb(skb);
3178
3179         return 0;
3180 }
3181
3182 #define QCA_DFU_PACKET_LEN      4096
3183
3184 #define QCA_GET_TARGET_VERSION  0x09
3185 #define QCA_CHECK_STATUS        0x05
3186 #define QCA_DFU_DOWNLOAD        0x01
3187
3188 #define QCA_SYSCFG_UPDATED      0x40
3189 #define QCA_PATCH_UPDATED       0x80
3190 #define QCA_DFU_TIMEOUT         3000
3191 #define QCA_FLAG_MULTI_NVM      0x80
3192
3193 struct qca_version {
3194         __le32  rom_version;
3195         __le32  patch_version;
3196         __le32  ram_version;
3197         __le16  board_id;
3198         __le16  flag;
3199         __u8    reserved[4];
3200 } __packed;
3201
3202 struct qca_rampatch_version {
3203         __le16  rom_version_high;
3204         __le16  rom_version_low;
3205         __le16  patch_version;
3206 } __packed;
3207
3208 struct qca_device_info {
3209         u32     rom_version;
3210         u8      rampatch_hdr;   /* length of header in rampatch */
3211         u8      nvm_hdr;        /* length of header in NVM */
3212         u8      ver_offset;     /* offset of version structure in rampatch */
3213 };
3214
3215 static const struct qca_device_info qca_devices_table[] = {
3216         { 0x00000100, 20, 4,  8 }, /* Rome 1.0 */
3217         { 0x00000101, 20, 4,  8 }, /* Rome 1.1 */
3218         { 0x00000200, 28, 4, 16 }, /* Rome 2.0 */
3219         { 0x00000201, 28, 4, 16 }, /* Rome 2.1 */
3220         { 0x00000300, 28, 4, 16 }, /* Rome 3.0 */
3221         { 0x00000302, 28, 4, 16 }, /* Rome 3.2 */
3222         { 0x00130100, 40, 4, 16 }, /* WCN6855 1.0 */
3223         { 0x00130200, 40, 4, 16 }, /* WCN6855 2.0 */
3224 };
3225
3226 static int btusb_qca_send_vendor_req(struct usb_device *udev, u8 request,
3227                                      void *data, u16 size)
3228 {
3229         int pipe, err;
3230         u8 *buf;
3231
3232         buf = kmalloc(size, GFP_KERNEL);
3233         if (!buf)
3234                 return -ENOMEM;
3235
3236         /* Found some of USB hosts have IOT issues with ours so that we should
3237          * not wait until HCI layer is ready.
3238          */
3239         pipe = usb_rcvctrlpipe(udev, 0);
3240         err = usb_control_msg(udev, pipe, request, USB_TYPE_VENDOR | USB_DIR_IN,
3241                               0, 0, buf, size, USB_CTRL_SET_TIMEOUT);
3242         if (err < 0) {
3243                 dev_err(&udev->dev, "Failed to access otp area (%d)", err);
3244                 goto done;
3245         }
3246
3247         memcpy(data, buf, size);
3248
3249 done:
3250         kfree(buf);
3251
3252         return err;
3253 }
3254
3255 static int btusb_setup_qca_download_fw(struct hci_dev *hdev,
3256                                        const struct firmware *firmware,
3257                                        size_t hdr_size)
3258 {
3259         struct btusb_data *btdata = hci_get_drvdata(hdev);
3260         struct usb_device *udev = btdata->udev;
3261         size_t count, size, sent = 0;
3262         int pipe, len, err;
3263         u8 *buf;
3264
3265         buf = kmalloc(QCA_DFU_PACKET_LEN, GFP_KERNEL);
3266         if (!buf)
3267                 return -ENOMEM;
3268
3269         count = firmware->size;
3270
3271         size = min_t(size_t, count, hdr_size);
3272         memcpy(buf, firmware->data, size);
3273
3274         /* USB patches should go down to controller through USB path
3275          * because binary format fits to go down through USB channel.
3276          * USB control path is for patching headers and USB bulk is for
3277          * patch body.
3278          */
3279         pipe = usb_sndctrlpipe(udev, 0);
3280         err = usb_control_msg(udev, pipe, QCA_DFU_DOWNLOAD, USB_TYPE_VENDOR,
3281                               0, 0, buf, size, USB_CTRL_SET_TIMEOUT);
3282         if (err < 0) {
3283                 bt_dev_err(hdev, "Failed to send headers (%d)", err);
3284                 goto done;
3285         }
3286
3287         sent += size;
3288         count -= size;
3289
3290         /* ep2 need time to switch from function acl to function dfu,
3291          * so we add 20ms delay here.
3292          */
3293         msleep(20);
3294
3295         while (count) {
3296                 size = min_t(size_t, count, QCA_DFU_PACKET_LEN);
3297
3298                 memcpy(buf, firmware->data + sent, size);
3299
3300                 pipe = usb_sndbulkpipe(udev, 0x02);
3301                 err = usb_bulk_msg(udev, pipe, buf, size, &len,
3302                                    QCA_DFU_TIMEOUT);
3303                 if (err < 0) {
3304                         bt_dev_err(hdev, "Failed to send body at %zd of %zd (%d)",
3305                                    sent, firmware->size, err);
3306                         break;
3307                 }
3308
3309                 if (size != len) {
3310                         bt_dev_err(hdev, "Failed to get bulk buffer");
3311                         err = -EILSEQ;
3312                         break;
3313                 }
3314
3315                 sent  += size;
3316                 count -= size;
3317         }
3318
3319 done:
3320         kfree(buf);
3321         return err;
3322 }
3323
3324 static int btusb_setup_qca_load_rampatch(struct hci_dev *hdev,
3325                                          struct qca_version *ver,
3326                                          const struct qca_device_info *info)
3327 {
3328         struct qca_rampatch_version *rver;
3329         const struct firmware *fw;
3330         u32 ver_rom, ver_patch, rver_rom;
3331         u16 rver_rom_low, rver_rom_high, rver_patch;
3332         char fwname[64];
3333         int err;
3334
3335         ver_rom = le32_to_cpu(ver->rom_version);
3336         ver_patch = le32_to_cpu(ver->patch_version);
3337
3338         snprintf(fwname, sizeof(fwname), "qca/rampatch_usb_%08x.bin", ver_rom);
3339
3340         err = request_firmware(&fw, fwname, &hdev->dev);
3341         if (err) {
3342                 bt_dev_err(hdev, "failed to request rampatch file: %s (%d)",
3343                            fwname, err);
3344                 return err;
3345         }
3346
3347         bt_dev_info(hdev, "using rampatch file: %s", fwname);
3348
3349         rver = (struct qca_rampatch_version *)(fw->data + info->ver_offset);
3350         rver_rom_low = le16_to_cpu(rver->rom_version_low);
3351         rver_patch = le16_to_cpu(rver->patch_version);
3352
3353         if (ver_rom & ~0xffffU) {
3354                 rver_rom_high = le16_to_cpu(rver->rom_version_high);
3355                 rver_rom = le32_to_cpu(rver_rom_high << 16 | rver_rom_low);
3356         } else {
3357                 rver_rom = rver_rom_low;
3358         }
3359
3360         bt_dev_info(hdev, "QCA: patch rome 0x%x build 0x%x, "
3361                     "firmware rome 0x%x build 0x%x",
3362                     rver_rom, rver_patch, ver_rom, ver_patch);
3363
3364         if (rver_rom != ver_rom || rver_patch <= ver_patch) {
3365                 bt_dev_err(hdev, "rampatch file version did not match with firmware");
3366                 err = -EINVAL;
3367                 goto done;
3368         }
3369
3370         err = btusb_setup_qca_download_fw(hdev, fw, info->rampatch_hdr);
3371
3372 done:
3373         release_firmware(fw);
3374
3375         return err;
3376 }
3377
3378 static int btusb_setup_qca_load_nvm(struct hci_dev *hdev,
3379                                     struct qca_version *ver,
3380                                     const struct qca_device_info *info)
3381 {
3382         const struct firmware *fw;
3383         char fwname[64];
3384         int err;
3385
3386         if (((ver->flag >> 8) & 0xff) == QCA_FLAG_MULTI_NVM) {
3387                 /* if boardid equal 0, use default nvm without surfix */
3388                 if (le16_to_cpu(ver->board_id) == 0x0) {
3389                         snprintf(fwname, sizeof(fwname), "qca/nvm_usb_%08x.bin",
3390                                  le32_to_cpu(ver->rom_version));
3391                 } else {
3392                         snprintf(fwname, sizeof(fwname), "qca/nvm_usb_%08x_%04x.bin",
3393                                 le32_to_cpu(ver->rom_version),
3394                                 le16_to_cpu(ver->board_id));
3395                 }
3396         } else {
3397                 snprintf(fwname, sizeof(fwname), "qca/nvm_usb_%08x.bin",
3398                          le32_to_cpu(ver->rom_version));
3399         }
3400
3401         err = request_firmware(&fw, fwname, &hdev->dev);
3402         if (err) {
3403                 bt_dev_err(hdev, "failed to request NVM file: %s (%d)",
3404                            fwname, err);
3405                 return err;
3406         }
3407
3408         bt_dev_info(hdev, "using NVM file: %s", fwname);
3409
3410         err = btusb_setup_qca_download_fw(hdev, fw, info->nvm_hdr);
3411
3412         release_firmware(fw);
3413
3414         return err;
3415 }
3416
3417 /* identify the ROM version and check whether patches are needed */
3418 static bool btusb_qca_need_patch(struct usb_device *udev)
3419 {
3420         struct qca_version ver;
3421
3422         if (btusb_qca_send_vendor_req(udev, QCA_GET_TARGET_VERSION, &ver,
3423                                       sizeof(ver)) < 0)
3424                 return false;
3425         /* only low ROM versions need patches */
3426         return !(le32_to_cpu(ver.rom_version) & ~0xffffU);
3427 }
3428
3429 static int btusb_setup_qca(struct hci_dev *hdev)
3430 {
3431         struct btusb_data *btdata = hci_get_drvdata(hdev);
3432         struct usb_device *udev = btdata->udev;
3433         const struct qca_device_info *info = NULL;
3434         struct qca_version ver;
3435         u32 ver_rom;
3436         u8 status;
3437         int i, err;
3438
3439         err = btusb_qca_send_vendor_req(udev, QCA_GET_TARGET_VERSION, &ver,
3440                                         sizeof(ver));
3441         if (err < 0)
3442                 return err;
3443
3444         ver_rom = le32_to_cpu(ver.rom_version);
3445
3446         for (i = 0; i < ARRAY_SIZE(qca_devices_table); i++) {
3447                 if (ver_rom == qca_devices_table[i].rom_version)
3448                         info = &qca_devices_table[i];
3449         }
3450         if (!info) {
3451                 /* If the rom_version is not matched in the qca_devices_table
3452                  * and the high ROM version is not zero, we assume this chip no
3453                  * need to load the rampatch and nvm.
3454                  */
3455                 if (ver_rom & ~0xffffU)
3456                         return 0;
3457
3458                 bt_dev_err(hdev, "don't support firmware rome 0x%x", ver_rom);
3459                 return -ENODEV;
3460         }
3461
3462         err = btusb_qca_send_vendor_req(udev, QCA_CHECK_STATUS, &status,
3463                                         sizeof(status));
3464         if (err < 0)
3465                 return err;
3466
3467         if (!(status & QCA_PATCH_UPDATED)) {
3468                 err = btusb_setup_qca_load_rampatch(hdev, &ver, info);
3469                 if (err < 0)
3470                         return err;
3471         }
3472
3473         err = btusb_qca_send_vendor_req(udev, QCA_GET_TARGET_VERSION, &ver,
3474                                         sizeof(ver));
3475         if (err < 0)
3476                 return err;
3477
3478         if (!(status & QCA_SYSCFG_UPDATED)) {
3479                 err = btusb_setup_qca_load_nvm(hdev, &ver, info);
3480                 if (err < 0)
3481                         return err;
3482         }
3483
3484         return 0;
3485 }
3486
3487 static inline int __set_diag_interface(struct hci_dev *hdev)
3488 {
3489         struct btusb_data *data = hci_get_drvdata(hdev);
3490         struct usb_interface *intf = data->diag;
3491         int i;
3492
3493         if (!data->diag)
3494                 return -ENODEV;
3495
3496         data->diag_tx_ep = NULL;
3497         data->diag_rx_ep = NULL;
3498
3499         for (i = 0; i < intf->cur_altsetting->desc.bNumEndpoints; i++) {
3500                 struct usb_endpoint_descriptor *ep_desc;
3501
3502                 ep_desc = &intf->cur_altsetting->endpoint[i].desc;
3503
3504                 if (!data->diag_tx_ep && usb_endpoint_is_bulk_out(ep_desc)) {
3505                         data->diag_tx_ep = ep_desc;
3506                         continue;
3507                 }
3508
3509                 if (!data->diag_rx_ep && usb_endpoint_is_bulk_in(ep_desc)) {
3510                         data->diag_rx_ep = ep_desc;
3511                         continue;
3512                 }
3513         }
3514
3515         if (!data->diag_tx_ep || !data->diag_rx_ep) {
3516                 bt_dev_err(hdev, "invalid diagnostic descriptors");
3517                 return -ENODEV;
3518         }
3519
3520         return 0;
3521 }
3522
3523 static struct urb *alloc_diag_urb(struct hci_dev *hdev, bool enable)
3524 {
3525         struct btusb_data *data = hci_get_drvdata(hdev);
3526         struct sk_buff *skb;
3527         struct urb *urb;
3528         unsigned int pipe;
3529
3530         if (!data->diag_tx_ep)
3531                 return ERR_PTR(-ENODEV);
3532
3533         urb = usb_alloc_urb(0, GFP_KERNEL);
3534         if (!urb)
3535                 return ERR_PTR(-ENOMEM);
3536
3537         skb = bt_skb_alloc(2, GFP_KERNEL);
3538         if (!skb) {
3539                 usb_free_urb(urb);
3540                 return ERR_PTR(-ENOMEM);
3541         }
3542
3543         skb_put_u8(skb, 0xf0);
3544         skb_put_u8(skb, enable);
3545
3546         pipe = usb_sndbulkpipe(data->udev, data->diag_tx_ep->bEndpointAddress);
3547
3548         usb_fill_bulk_urb(urb, data->udev, pipe,
3549                           skb->data, skb->len, btusb_tx_complete, skb);
3550
3551         skb->dev = (void *)hdev;
3552
3553         return urb;
3554 }
3555
3556 static int btusb_bcm_set_diag(struct hci_dev *hdev, bool enable)
3557 {
3558         struct btusb_data *data = hci_get_drvdata(hdev);
3559         struct urb *urb;
3560
3561         if (!data->diag)
3562                 return -ENODEV;
3563
3564         if (!test_bit(HCI_RUNNING, &hdev->flags))
3565                 return -ENETDOWN;
3566
3567         urb = alloc_diag_urb(hdev, enable);
3568         if (IS_ERR(urb))
3569                 return PTR_ERR(urb);
3570
3571         return submit_or_queue_tx_urb(hdev, urb);
3572 }
3573
3574 #ifdef CONFIG_PM
3575 static irqreturn_t btusb_oob_wake_handler(int irq, void *priv)
3576 {
3577         struct btusb_data *data = priv;
3578
3579         pm_wakeup_event(&data->udev->dev, 0);
3580         pm_system_wakeup();
3581
3582         /* Disable only if not already disabled (keep it balanced) */
3583         if (test_and_clear_bit(BTUSB_OOB_WAKE_ENABLED, &data->flags)) {
3584                 disable_irq_nosync(irq);
3585                 disable_irq_wake(irq);
3586         }
3587         return IRQ_HANDLED;
3588 }
3589
3590 static const struct of_device_id btusb_match_table[] = {
3591         { .compatible = "usb1286,204e" },
3592         { .compatible = "usbcf3,e300" }, /* QCA6174A */
3593         { .compatible = "usb4ca,301a" }, /* QCA6174A (Lite-On) */
3594         { }
3595 };
3596 MODULE_DEVICE_TABLE(of, btusb_match_table);
3597
3598 /* Use an oob wakeup pin? */
3599 static int btusb_config_oob_wake(struct hci_dev *hdev)
3600 {
3601         struct btusb_data *data = hci_get_drvdata(hdev);
3602         struct device *dev = &data->udev->dev;
3603         int irq, ret;
3604
3605         clear_bit(BTUSB_OOB_WAKE_ENABLED, &data->flags);
3606
3607         if (!of_match_device(btusb_match_table, dev))
3608                 return 0;
3609
3610         /* Move on if no IRQ specified */
3611         irq = of_irq_get_byname(dev->of_node, "wakeup");
3612         if (irq <= 0) {
3613                 bt_dev_dbg(hdev, "%s: no OOB Wakeup IRQ in DT", __func__);
3614                 return 0;
3615         }
3616
3617         irq_set_status_flags(irq, IRQ_NOAUTOEN);
3618         ret = devm_request_irq(&hdev->dev, irq, btusb_oob_wake_handler,
3619                                0, "OOB Wake-on-BT", data);
3620         if (ret) {
3621                 bt_dev_err(hdev, "%s: IRQ request failed", __func__);
3622                 return ret;
3623         }
3624
3625         ret = device_init_wakeup(dev, true);
3626         if (ret) {
3627                 bt_dev_err(hdev, "%s: failed to init_wakeup", __func__);
3628                 return ret;
3629         }
3630
3631         data->oob_wake_irq = irq;
3632         bt_dev_info(hdev, "OOB Wake-on-BT configured at IRQ %u", irq);
3633         return 0;
3634 }
3635 #endif
3636
3637 static void btusb_check_needs_reset_resume(struct usb_interface *intf)
3638 {
3639         if (dmi_check_system(btusb_needs_reset_resume_table))
3640                 interface_to_usbdev(intf)->quirks |= USB_QUIRK_RESET_RESUME;
3641 }
3642
3643 static bool btusb_wakeup(struct hci_dev *hdev)
3644 {
3645         struct btusb_data *data = hci_get_drvdata(hdev);
3646
3647         return device_may_wakeup(&data->udev->dev);
3648 }
3649
3650 static int btusb_shutdown_qca(struct hci_dev *hdev)
3651 {
3652         struct sk_buff *skb;
3653
3654         skb = __hci_cmd_sync(hdev, HCI_OP_RESET, 0, NULL, HCI_INIT_TIMEOUT);
3655         if (IS_ERR(skb)) {
3656                 bt_dev_err(hdev, "HCI reset during shutdown failed");
3657                 return PTR_ERR(skb);
3658         }
3659         kfree_skb(skb);
3660
3661         return 0;
3662 }
3663
3664 static int btusb_probe(struct usb_interface *intf,
3665                        const struct usb_device_id *id)
3666 {
3667         struct usb_endpoint_descriptor *ep_desc;
3668         struct gpio_desc *reset_gpio;
3669         struct btusb_data *data;
3670         struct hci_dev *hdev;
3671         unsigned ifnum_base;
3672         int i, err, priv_size;
3673
3674         BT_DBG("intf %p id %p", intf, id);
3675
3676         /* interface numbers are hardcoded in the spec */
3677         if (intf->cur_altsetting->desc.bInterfaceNumber != 0) {
3678                 if (!(id->driver_info & BTUSB_IFNUM_2))
3679                         return -ENODEV;
3680                 if (intf->cur_altsetting->desc.bInterfaceNumber != 2)
3681                         return -ENODEV;
3682         }
3683
3684         ifnum_base = intf->cur_altsetting->desc.bInterfaceNumber;
3685
3686         if (!id->driver_info) {
3687                 const struct usb_device_id *match;
3688
3689                 match = usb_match_id(intf, blacklist_table);
3690                 if (match)
3691                         id = match;
3692         }
3693
3694         if (id->driver_info == BTUSB_IGNORE)
3695                 return -ENODEV;
3696
3697         if (id->driver_info & BTUSB_ATH3012) {
3698                 struct usb_device *udev = interface_to_usbdev(intf);
3699
3700                 /* Old firmware would otherwise let ath3k driver load
3701                  * patch and sysconfig files
3702                  */
3703                 if (le16_to_cpu(udev->descriptor.bcdDevice) <= 0x0001 &&
3704                     !btusb_qca_need_patch(udev))
3705                         return -ENODEV;
3706         }
3707
3708         data = devm_kzalloc(&intf->dev, sizeof(*data), GFP_KERNEL);
3709         if (!data)
3710                 return -ENOMEM;
3711
3712         for (i = 0; i < intf->cur_altsetting->desc.bNumEndpoints; i++) {
3713                 ep_desc = &intf->cur_altsetting->endpoint[i].desc;
3714
3715                 if (!data->intr_ep && usb_endpoint_is_int_in(ep_desc)) {
3716                         data->intr_ep = ep_desc;
3717                         continue;
3718                 }
3719
3720                 if (!data->bulk_tx_ep && usb_endpoint_is_bulk_out(ep_desc)) {
3721                         data->bulk_tx_ep = ep_desc;
3722                         continue;
3723                 }
3724
3725                 if (!data->bulk_rx_ep && usb_endpoint_is_bulk_in(ep_desc)) {
3726                         data->bulk_rx_ep = ep_desc;
3727                         continue;
3728                 }
3729         }
3730
3731         if (!data->intr_ep || !data->bulk_tx_ep || !data->bulk_rx_ep)
3732                 return -ENODEV;
3733
3734         if (id->driver_info & BTUSB_AMP) {
3735                 data->cmdreq_type = USB_TYPE_CLASS | 0x01;
3736                 data->cmdreq = 0x2b;
3737         } else {
3738                 data->cmdreq_type = USB_TYPE_CLASS;
3739                 data->cmdreq = 0x00;
3740         }
3741
3742         data->udev = interface_to_usbdev(intf);
3743         data->intf = intf;
3744
3745         INIT_WORK(&data->work, btusb_work);
3746         INIT_WORK(&data->waker, btusb_waker);
3747         init_usb_anchor(&data->deferred);
3748         init_usb_anchor(&data->tx_anchor);
3749         spin_lock_init(&data->txlock);
3750
3751         init_usb_anchor(&data->intr_anchor);
3752         init_usb_anchor(&data->bulk_anchor);
3753         init_usb_anchor(&data->isoc_anchor);
3754         init_usb_anchor(&data->diag_anchor);
3755         init_usb_anchor(&data->ctrl_anchor);
3756         spin_lock_init(&data->rxlock);
3757
3758         priv_size = 0;
3759
3760         data->recv_event = hci_recv_frame;
3761         data->recv_bulk = btusb_recv_bulk;
3762
3763         if (id->driver_info & BTUSB_INTEL_COMBINED) {
3764                 /* Allocate extra space for Intel device */
3765                 priv_size += sizeof(struct btintel_data);
3766
3767                 /* Override the rx handlers */
3768                 data->recv_event = btusb_recv_event_intel;
3769                 data->recv_bulk = btusb_recv_bulk_intel;
3770         }
3771
3772         data->recv_acl = hci_recv_frame;
3773
3774         hdev = hci_alloc_dev_priv(priv_size);
3775         if (!hdev)
3776                 return -ENOMEM;
3777
3778         hdev->bus = HCI_USB;
3779         hci_set_drvdata(hdev, data);
3780
3781         if (id->driver_info & BTUSB_AMP)
3782                 hdev->dev_type = HCI_AMP;
3783         else
3784                 hdev->dev_type = HCI_PRIMARY;
3785
3786         data->hdev = hdev;
3787
3788         SET_HCIDEV_DEV(hdev, &intf->dev);
3789
3790         reset_gpio = gpiod_get_optional(&data->udev->dev, "reset",
3791                                         GPIOD_OUT_LOW);
3792         if (IS_ERR(reset_gpio)) {
3793                 err = PTR_ERR(reset_gpio);
3794                 goto out_free_dev;
3795         } else if (reset_gpio) {
3796                 data->reset_gpio = reset_gpio;
3797         }
3798
3799         hdev->open   = btusb_open;
3800         hdev->close  = btusb_close;
3801         hdev->flush  = btusb_flush;
3802         hdev->send   = btusb_send_frame;
3803         hdev->notify = btusb_notify;
3804         hdev->wakeup = btusb_wakeup;
3805
3806 #ifdef CONFIG_PM
3807         err = btusb_config_oob_wake(hdev);
3808         if (err)
3809                 goto out_free_dev;
3810
3811         /* Marvell devices may need a specific chip configuration */
3812         if (id->driver_info & BTUSB_MARVELL && data->oob_wake_irq) {
3813                 err = marvell_config_oob_wake(hdev);
3814                 if (err)
3815                         goto out_free_dev;
3816         }
3817 #endif
3818         if (id->driver_info & BTUSB_CW6622)
3819                 set_bit(HCI_QUIRK_BROKEN_STORED_LINK_KEY, &hdev->quirks);
3820
3821         if (id->driver_info & BTUSB_BCM2045)
3822                 set_bit(HCI_QUIRK_BROKEN_STORED_LINK_KEY, &hdev->quirks);
3823
3824         if (id->driver_info & BTUSB_BCM92035)
3825                 hdev->setup = btusb_setup_bcm92035;
3826
3827         if (IS_ENABLED(CONFIG_BT_HCIBTUSB_BCM) &&
3828             (id->driver_info & BTUSB_BCM_PATCHRAM)) {
3829                 hdev->manufacturer = 15;
3830                 hdev->setup = btbcm_setup_patchram;
3831                 hdev->set_diag = btusb_bcm_set_diag;
3832                 hdev->set_bdaddr = btbcm_set_bdaddr;
3833
3834                 /* Broadcom LM_DIAG Interface numbers are hardcoded */
3835                 data->diag = usb_ifnum_to_if(data->udev, ifnum_base + 2);
3836         }
3837
3838         if (IS_ENABLED(CONFIG_BT_HCIBTUSB_BCM) &&
3839             (id->driver_info & BTUSB_BCM_APPLE)) {
3840                 hdev->manufacturer = 15;
3841                 hdev->setup = btbcm_setup_apple;
3842                 hdev->set_diag = btusb_bcm_set_diag;
3843
3844                 /* Broadcom LM_DIAG Interface numbers are hardcoded */
3845                 data->diag = usb_ifnum_to_if(data->udev, ifnum_base + 2);
3846         }
3847
3848         /* Combined Intel Device setup to support multiple setup routine */
3849         if (id->driver_info & BTUSB_INTEL_COMBINED) {
3850                 err = btintel_configure_setup(hdev);
3851                 if (err)
3852                         goto out_free_dev;
3853
3854                 /* Transport specific configuration */
3855                 hdev->send = btusb_send_frame_intel;
3856                 hdev->cmd_timeout = btusb_intel_cmd_timeout;
3857
3858                 if (id->driver_info & BTUSB_INTEL_BROKEN_INITIAL_NCMD)
3859                         btintel_set_flag(hdev, INTEL_BROKEN_INITIAL_NCMD);
3860         }
3861
3862         if (id->driver_info & BTUSB_MARVELL)
3863                 hdev->set_bdaddr = btusb_set_bdaddr_marvell;
3864
3865         if (IS_ENABLED(CONFIG_BT_HCIBTUSB_MTK) &&
3866             (id->driver_info & BTUSB_MEDIATEK)) {
3867                 hdev->setup = btusb_mtk_setup;
3868                 hdev->shutdown = btusb_mtk_shutdown;
3869                 hdev->manufacturer = 70;
3870                 hdev->cmd_timeout = btusb_mtk_cmd_timeout;
3871                 hdev->set_bdaddr = btusb_set_bdaddr_mtk;
3872                 set_bit(HCI_QUIRK_NON_PERSISTENT_SETUP, &hdev->quirks);
3873                 data->recv_acl = btusb_recv_acl_mtk;
3874         }
3875
3876         if (id->driver_info & BTUSB_SWAVE) {
3877                 set_bit(HCI_QUIRK_FIXUP_INQUIRY_MODE, &hdev->quirks);
3878                 set_bit(HCI_QUIRK_BROKEN_LOCAL_COMMANDS, &hdev->quirks);
3879         }
3880
3881         if (id->driver_info & BTUSB_INTEL_BOOT) {
3882                 hdev->manufacturer = 2;
3883                 set_bit(HCI_QUIRK_RAW_DEVICE, &hdev->quirks);
3884         }
3885
3886         if (id->driver_info & BTUSB_ATH3012) {
3887                 data->setup_on_usb = btusb_setup_qca;
3888                 hdev->set_bdaddr = btusb_set_bdaddr_ath3012;
3889                 set_bit(HCI_QUIRK_SIMULTANEOUS_DISCOVERY, &hdev->quirks);
3890                 set_bit(HCI_QUIRK_STRICT_DUPLICATE_FILTER, &hdev->quirks);
3891         }
3892
3893         if (id->driver_info & BTUSB_QCA_ROME) {
3894                 data->setup_on_usb = btusb_setup_qca;
3895                 hdev->set_bdaddr = btusb_set_bdaddr_ath3012;
3896                 hdev->cmd_timeout = btusb_qca_cmd_timeout;
3897                 set_bit(HCI_QUIRK_SIMULTANEOUS_DISCOVERY, &hdev->quirks);
3898                 btusb_check_needs_reset_resume(intf);
3899         }
3900
3901         if (id->driver_info & BTUSB_QCA_WCN6855) {
3902                 data->setup_on_usb = btusb_setup_qca;
3903                 hdev->shutdown = btusb_shutdown_qca;
3904                 hdev->set_bdaddr = btusb_set_bdaddr_wcn6855;
3905                 hdev->cmd_timeout = btusb_qca_cmd_timeout;
3906                 set_bit(HCI_QUIRK_SIMULTANEOUS_DISCOVERY, &hdev->quirks);
3907                 hci_set_msft_opcode(hdev, 0xFD70);
3908         }
3909
3910         if (id->driver_info & BTUSB_AMP) {
3911                 /* AMP controllers do not support SCO packets */
3912                 data->isoc = NULL;
3913         } else {
3914                 /* Interface orders are hardcoded in the specification */
3915                 data->isoc = usb_ifnum_to_if(data->udev, ifnum_base + 1);
3916                 data->isoc_ifnum = ifnum_base + 1;
3917         }
3918
3919         if (IS_ENABLED(CONFIG_BT_HCIBTUSB_RTL) &&
3920             (id->driver_info & BTUSB_REALTEK)) {
3921                 hdev->setup = btrtl_setup_realtek;
3922                 hdev->shutdown = btrtl_shutdown_realtek;
3923                 hdev->cmd_timeout = btusb_rtl_cmd_timeout;
3924
3925                 /* Realtek devices need to set remote wakeup on auto-suspend */
3926                 set_bit(BTUSB_WAKEUP_AUTOSUSPEND, &data->flags);
3927                 set_bit(BTUSB_USE_ALT3_FOR_WBS, &data->flags);
3928         }
3929
3930         if (!reset)
3931                 set_bit(HCI_QUIRK_RESET_ON_CLOSE, &hdev->quirks);
3932
3933         if (force_scofix || id->driver_info & BTUSB_WRONG_SCO_MTU) {
3934                 if (!disable_scofix)
3935                         set_bit(HCI_QUIRK_FIXUP_BUFFER_SIZE, &hdev->quirks);
3936         }
3937
3938         if (id->driver_info & BTUSB_BROKEN_ISOC)
3939                 data->isoc = NULL;
3940
3941         if (id->driver_info & BTUSB_WIDEBAND_SPEECH)
3942                 set_bit(HCI_QUIRK_WIDEBAND_SPEECH_SUPPORTED, &hdev->quirks);
3943
3944         if (id->driver_info & BTUSB_VALID_LE_STATES)
3945                 set_bit(HCI_QUIRK_VALID_LE_STATES, &hdev->quirks);
3946
3947         if (id->driver_info & BTUSB_DIGIANSWER) {
3948                 data->cmdreq_type = USB_TYPE_VENDOR;
3949                 set_bit(HCI_QUIRK_RESET_ON_CLOSE, &hdev->quirks);
3950         }
3951
3952         if (id->driver_info & BTUSB_CSR) {
3953                 struct usb_device *udev = data->udev;
3954                 u16 bcdDevice = le16_to_cpu(udev->descriptor.bcdDevice);
3955
3956                 /* Old firmware would otherwise execute USB reset */
3957                 if (bcdDevice < 0x117)
3958                         set_bit(HCI_QUIRK_RESET_ON_CLOSE, &hdev->quirks);
3959
3960                 /* This must be set first in case we disable it for fakes */
3961                 set_bit(HCI_QUIRK_SIMULTANEOUS_DISCOVERY, &hdev->quirks);
3962
3963                 /* Fake CSR devices with broken commands */
3964                 if (le16_to_cpu(udev->descriptor.idVendor)  == 0x0a12 &&
3965                     le16_to_cpu(udev->descriptor.idProduct) == 0x0001)
3966                         hdev->setup = btusb_setup_csr;
3967         }
3968
3969         if (id->driver_info & BTUSB_SNIFFER) {
3970                 struct usb_device *udev = data->udev;
3971
3972                 /* New sniffer firmware has crippled HCI interface */
3973                 if (le16_to_cpu(udev->descriptor.bcdDevice) > 0x997)
3974                         set_bit(HCI_QUIRK_RAW_DEVICE, &hdev->quirks);
3975         }
3976
3977         if (id->driver_info & BTUSB_INTEL_BOOT) {
3978                 /* A bug in the bootloader causes that interrupt interface is
3979                  * only enabled after receiving SetInterface(0, AltSetting=0).
3980                  */
3981                 err = usb_set_interface(data->udev, 0, 0);
3982                 if (err < 0) {
3983                         BT_ERR("failed to set interface 0, alt 0 %d", err);
3984                         goto out_free_dev;
3985                 }
3986         }
3987
3988         if (data->isoc) {
3989                 err = usb_driver_claim_interface(&btusb_driver,
3990                                                  data->isoc, data);
3991                 if (err < 0)
3992                         goto out_free_dev;
3993         }
3994
3995         if (IS_ENABLED(CONFIG_BT_HCIBTUSB_BCM) && data->diag) {
3996                 if (!usb_driver_claim_interface(&btusb_driver,
3997                                                 data->diag, data))
3998                         __set_diag_interface(hdev);
3999                 else
4000                         data->diag = NULL;
4001         }
4002
4003         if (enable_autosuspend)
4004                 usb_enable_autosuspend(data->udev);
4005
4006         err = hci_register_dev(hdev);
4007         if (err < 0)
4008                 goto out_free_dev;
4009
4010         usb_set_intfdata(intf, data);
4011
4012         return 0;
4013
4014 out_free_dev:
4015         if (data->reset_gpio)
4016                 gpiod_put(data->reset_gpio);
4017         hci_free_dev(hdev);
4018         return err;
4019 }
4020
4021 static void btusb_disconnect(struct usb_interface *intf)
4022 {
4023         struct btusb_data *data = usb_get_intfdata(intf);
4024         struct hci_dev *hdev;
4025
4026         BT_DBG("intf %p", intf);
4027
4028         if (!data)
4029                 return;
4030
4031         hdev = data->hdev;
4032         usb_set_intfdata(data->intf, NULL);
4033
4034         if (data->isoc)
4035                 usb_set_intfdata(data->isoc, NULL);
4036
4037         if (data->diag)
4038                 usb_set_intfdata(data->diag, NULL);
4039
4040         hci_unregister_dev(hdev);
4041
4042         if (intf == data->intf) {
4043                 if (data->isoc)
4044                         usb_driver_release_interface(&btusb_driver, data->isoc);
4045                 if (data->diag)
4046                         usb_driver_release_interface(&btusb_driver, data->diag);
4047         } else if (intf == data->isoc) {
4048                 if (data->diag)
4049                         usb_driver_release_interface(&btusb_driver, data->diag);
4050                 usb_driver_release_interface(&btusb_driver, data->intf);
4051         } else if (intf == data->diag) {
4052                 usb_driver_release_interface(&btusb_driver, data->intf);
4053                 if (data->isoc)
4054                         usb_driver_release_interface(&btusb_driver, data->isoc);
4055         }
4056
4057         if (data->oob_wake_irq)
4058                 device_init_wakeup(&data->udev->dev, false);
4059
4060         if (data->reset_gpio)
4061                 gpiod_put(data->reset_gpio);
4062
4063         hci_free_dev(hdev);
4064 }
4065
4066 #ifdef CONFIG_PM
4067 static int btusb_suspend(struct usb_interface *intf, pm_message_t message)
4068 {
4069         struct btusb_data *data = usb_get_intfdata(intf);
4070
4071         BT_DBG("intf %p", intf);
4072
4073         if (data->suspend_count++)
4074                 return 0;
4075
4076         spin_lock_irq(&data->txlock);
4077         if (!(PMSG_IS_AUTO(message) && data->tx_in_flight)) {
4078                 set_bit(BTUSB_SUSPENDING, &data->flags);
4079                 spin_unlock_irq(&data->txlock);
4080         } else {
4081                 spin_unlock_irq(&data->txlock);
4082                 data->suspend_count--;
4083                 return -EBUSY;
4084         }
4085
4086         cancel_work_sync(&data->work);
4087
4088         btusb_stop_traffic(data);
4089         usb_kill_anchored_urbs(&data->tx_anchor);
4090
4091         if (data->oob_wake_irq && device_may_wakeup(&data->udev->dev)) {
4092                 set_bit(BTUSB_OOB_WAKE_ENABLED, &data->flags);
4093                 enable_irq_wake(data->oob_wake_irq);
4094                 enable_irq(data->oob_wake_irq);
4095         }
4096
4097         /* For global suspend, Realtek devices lose the loaded fw
4098          * in them. But for autosuspend, firmware should remain.
4099          * Actually, it depends on whether the usb host sends
4100          * set feature (enable wakeup) or not.
4101          */
4102         if (test_bit(BTUSB_WAKEUP_AUTOSUSPEND, &data->flags)) {
4103                 if (PMSG_IS_AUTO(message) &&
4104                     device_can_wakeup(&data->udev->dev))
4105                         data->udev->do_remote_wakeup = 1;
4106                 else if (!PMSG_IS_AUTO(message) &&
4107                          !device_may_wakeup(&data->udev->dev)) {
4108                         data->udev->do_remote_wakeup = 0;
4109                         data->udev->reset_resume = 1;
4110                 }
4111         }
4112
4113         return 0;
4114 }
4115
4116 static void play_deferred(struct btusb_data *data)
4117 {
4118         struct urb *urb;
4119         int err;
4120
4121         while ((urb = usb_get_from_anchor(&data->deferred))) {
4122                 usb_anchor_urb(urb, &data->tx_anchor);
4123
4124                 err = usb_submit_urb(urb, GFP_ATOMIC);
4125                 if (err < 0) {
4126                         if (err != -EPERM && err != -ENODEV)
4127                                 BT_ERR("%s urb %p submission failed (%d)",
4128                                        data->hdev->name, urb, -err);
4129                         kfree(urb->setup_packet);
4130                         usb_unanchor_urb(urb);
4131                         usb_free_urb(urb);
4132                         break;
4133                 }
4134
4135                 data->tx_in_flight++;
4136                 usb_free_urb(urb);
4137         }
4138
4139         /* Cleanup the rest deferred urbs. */
4140         while ((urb = usb_get_from_anchor(&data->deferred))) {
4141                 kfree(urb->setup_packet);
4142                 usb_free_urb(urb);
4143         }
4144 }
4145
4146 static int btusb_resume(struct usb_interface *intf)
4147 {
4148         struct btusb_data *data = usb_get_intfdata(intf);
4149         struct hci_dev *hdev = data->hdev;
4150         int err = 0;
4151
4152         BT_DBG("intf %p", intf);
4153
4154         if (--data->suspend_count)
4155                 return 0;
4156
4157         /* Disable only if not already disabled (keep it balanced) */
4158         if (test_and_clear_bit(BTUSB_OOB_WAKE_ENABLED, &data->flags)) {
4159                 disable_irq(data->oob_wake_irq);
4160                 disable_irq_wake(data->oob_wake_irq);
4161         }
4162
4163         if (!test_bit(HCI_RUNNING, &hdev->flags))
4164                 goto done;
4165
4166         if (test_bit(BTUSB_INTR_RUNNING, &data->flags)) {
4167                 err = btusb_submit_intr_urb(hdev, GFP_NOIO);
4168                 if (err < 0) {
4169                         clear_bit(BTUSB_INTR_RUNNING, &data->flags);
4170                         goto failed;
4171                 }
4172         }
4173
4174         if (test_bit(BTUSB_BULK_RUNNING, &data->flags)) {
4175                 err = btusb_submit_bulk_urb(hdev, GFP_NOIO);
4176                 if (err < 0) {
4177                         clear_bit(BTUSB_BULK_RUNNING, &data->flags);
4178                         goto failed;
4179                 }
4180
4181                 btusb_submit_bulk_urb(hdev, GFP_NOIO);
4182         }
4183
4184         if (test_bit(BTUSB_ISOC_RUNNING, &data->flags)) {
4185                 if (btusb_submit_isoc_urb(hdev, GFP_NOIO) < 0)
4186                         clear_bit(BTUSB_ISOC_RUNNING, &data->flags);
4187                 else
4188                         btusb_submit_isoc_urb(hdev, GFP_NOIO);
4189         }
4190
4191         spin_lock_irq(&data->txlock);
4192         play_deferred(data);
4193         clear_bit(BTUSB_SUSPENDING, &data->flags);
4194         spin_unlock_irq(&data->txlock);
4195         schedule_work(&data->work);
4196
4197         return 0;
4198
4199 failed:
4200         usb_scuttle_anchored_urbs(&data->deferred);
4201 done:
4202         spin_lock_irq(&data->txlock);
4203         clear_bit(BTUSB_SUSPENDING, &data->flags);
4204         spin_unlock_irq(&data->txlock);
4205
4206         return err;
4207 }
4208 #endif
4209
4210 static struct usb_driver btusb_driver = {
4211         .name           = "btusb",
4212         .probe          = btusb_probe,
4213         .disconnect     = btusb_disconnect,
4214 #ifdef CONFIG_PM
4215         .suspend        = btusb_suspend,
4216         .resume         = btusb_resume,
4217 #endif
4218         .id_table       = btusb_table,
4219         .supports_autosuspend = 1,
4220         .disable_hub_initiated_lpm = 1,
4221 };
4222
4223 module_usb_driver(btusb_driver);
4224
4225 module_param(disable_scofix, bool, 0644);
4226 MODULE_PARM_DESC(disable_scofix, "Disable fixup of wrong SCO buffer size");
4227
4228 module_param(force_scofix, bool, 0644);
4229 MODULE_PARM_DESC(force_scofix, "Force fixup of wrong SCO buffers size");
4230
4231 module_param(enable_autosuspend, bool, 0644);
4232 MODULE_PARM_DESC(enable_autosuspend, "Enable USB autosuspend by default");
4233
4234 module_param(reset, bool, 0644);
4235 MODULE_PARM_DESC(reset, "Send HCI reset command on initialization");
4236
4237 MODULE_AUTHOR("Marcel Holtmann <marcel@holtmann.org>");
4238 MODULE_DESCRIPTION("Generic Bluetooth USB driver ver " VERSION);
4239 MODULE_VERSION(VERSION);
4240 MODULE_LICENSE("GPL");