drivers/bluetooth/btusb.c

   1 // SPDX-License-Identifier: GPL-2.0-or-later
   2 /*
   3  *
   4  *  Generic Bluetooth USB driver
   5  *
   6  *  Copyright (C) 2005-2008  Marcel Holtmann <marcel@holtmann.org>
   7  */
   8
   9 #include <linux/dmi.h>
  10 #include <linux/module.h>
  11 #include <linux/usb.h>
  12 #include <linux/usb/quirks.h>
  13 #include <linux/firmware.h>
  14 #include <linux/iopoll.h>
  15 #include <linux/of_device.h>
  16 #include <linux/of_irq.h>
  17 #include <linux/suspend.h>
  18 #include <linux/gpio/consumer.h>
  19 #include <asm/unaligned.h>
  20
  21 #include <net/bluetooth/bluetooth.h>
  22 #include <net/bluetooth/hci_core.h>
  23
  24 #include "btintel.h"
  25 #include "btbcm.h"
  26 #include "btrtl.h"
  27
  28 #define VERSION "0.8"
  29
  30 static bool disable_scofix;
  31 static bool force_scofix;
  32 static bool enable_autosuspend = IS_ENABLED(CONFIG_BT_HCIBTUSB_AUTOSUSPEND);
  33
  34 static bool reset = true;
  35
  36 static struct usb_driver btusb_driver;
  37
  38 #define BTUSB_IGNORE            0x01
  39 #define BTUSB_DIGIANSWER        0x02
  40 #define BTUSB_CSR               0x04
  41 #define BTUSB_SNIFFER           0x08
  42 #define BTUSB_BCM92035          0x10
  43 #define BTUSB_BROKEN_ISOC       0x20
  44 #define BTUSB_WRONG_SCO_MTU     0x40
  45 #define BTUSB_ATH3012           0x80
  46 #define BTUSB_INTEL             0x100
  47 #define BTUSB_INTEL_BOOT        0x200
  48 #define BTUSB_BCM_PATCHRAM      0x400
  49 #define BTUSB_MARVELL           0x800
  50 #define BTUSB_SWAVE             0x1000
  51 #define BTUSB_INTEL_NEW         0x2000
  52 #define BTUSB_AMP               0x4000
  53 #define BTUSB_QCA_ROME          0x8000
  54 #define BTUSB_BCM_APPLE         0x10000
  55 #define BTUSB_REALTEK           0x20000
  56 #define BTUSB_BCM2045           0x40000
  57 #define BTUSB_IFNUM_2           0x80000
  58 #define BTUSB_CW6622            0x100000
  59 #define BTUSB_MEDIATEK          0x200000
  60 #define BTUSB_WIDEBAND_SPEECH   0x400000
  61 #define BTUSB_VALID_LE_STATES   0x800000
  62 #define BTUSB_QCA_WCN6855       0x1000000
  63 #define BTUSB_INTEL_NEWGEN      0x2000000
  64
  65 static const struct usb_device_id btusb_table[] = {
  66         /* Generic Bluetooth USB device */
  67         { USB_DEVICE_INFO(0xe0, 0x01, 0x01) },
  68
  69         /* Generic Bluetooth AMP device */
  70         { USB_DEVICE_INFO(0xe0, 0x01, 0x04), .driver_info = BTUSB_AMP },
  71
  72         /* Generic Bluetooth USB interface */
  73         { USB_INTERFACE_INFO(0xe0, 0x01, 0x01) },
  74
  75         /* Apple-specific (Broadcom) devices */
  76         { USB_VENDOR_AND_INTERFACE_INFO(0x05ac, 0xff, 0x01, 0x01),
  77           .driver_info = BTUSB_BCM_APPLE | BTUSB_IFNUM_2 },
  78
  79         /* MediaTek MT76x0E */
  80         { USB_DEVICE(0x0e8d, 0x763f) },
  81
  82         /* Broadcom SoftSailing reporting vendor specific */
  83         { USB_DEVICE(0x0a5c, 0x21e1) },
  84
  85         /* Apple MacBookPro 7,1 */
  86         { USB_DEVICE(0x05ac, 0x8213) },
  87
  88         /* Apple iMac11,1 */
  89         { USB_DEVICE(0x05ac, 0x8215) },
  90
  91         /* Apple MacBookPro6,2 */
  92         { USB_DEVICE(0x05ac, 0x8218) },
  93
  94         /* Apple MacBookAir3,1, MacBookAir3,2 */
  95         { USB_DEVICE(0x05ac, 0x821b) },
  96
  97         /* Apple MacBookAir4,1 */
  98         { USB_DEVICE(0x05ac, 0x821f) },
  99
 100         /* Apple MacBookPro8,2 */
 101         { USB_DEVICE(0x05ac, 0x821a) },
 102
 103         /* Apple MacMini5,1 */
 104         { USB_DEVICE(0x05ac, 0x8281) },
 105
 106         /* AVM BlueFRITZ! USB v2.0 */
 107         { USB_DEVICE(0x057c, 0x3800), .driver_info = BTUSB_SWAVE },
 108
 109         /* Bluetooth Ultraport Module from IBM */
 110         { USB_DEVICE(0x04bf, 0x030a) },
 111
 112         /* ALPS Modules with non-standard id */
 113         { USB_DEVICE(0x044e, 0x3001) },
 114         { USB_DEVICE(0x044e, 0x3002) },
 115
 116         /* Ericsson with non-standard id */
 117         { USB_DEVICE(0x0bdb, 0x1002) },
 118
 119         /* Canyon CN-BTU1 with HID interfaces */
 120         { USB_DEVICE(0x0c10, 0x0000) },
 121
 122         /* Broadcom BCM20702A0 */
 123         { USB_DEVICE(0x413c, 0x8197) },
 124
 125         /* Broadcom BCM20702B0 (Dynex/Insignia) */
 126         { USB_DEVICE(0x19ff, 0x0239), .driver_info = BTUSB_BCM_PATCHRAM },
 127
 128         /* Broadcom BCM43142A0 (Foxconn/Lenovo) */
 129         { USB_VENDOR_AND_INTERFACE_INFO(0x105b, 0xff, 0x01, 0x01),
 130           .driver_info = BTUSB_BCM_PATCHRAM },
 131
 132         /* Broadcom BCM920703 (HTC Vive) */
 133         { USB_VENDOR_AND_INTERFACE_INFO(0x0bb4, 0xff, 0x01, 0x01),
 134           .driver_info = BTUSB_BCM_PATCHRAM },
 135
 136         /* Foxconn - Hon Hai */
 137         { USB_VENDOR_AND_INTERFACE_INFO(0x0489, 0xff, 0x01, 0x01),
 138           .driver_info = BTUSB_BCM_PATCHRAM },
 139
 140         /* Lite-On Technology - Broadcom based */
 141         { USB_VENDOR_AND_INTERFACE_INFO(0x04ca, 0xff, 0x01, 0x01),
 142           .driver_info = BTUSB_BCM_PATCHRAM },
 143
 144         /* Broadcom devices with vendor specific id */
 145         { USB_VENDOR_AND_INTERFACE_INFO(0x0a5c, 0xff, 0x01, 0x01),
 146           .driver_info = BTUSB_BCM_PATCHRAM },
 147
 148         /* ASUSTek Computer - Broadcom based */
 149         { USB_VENDOR_AND_INTERFACE_INFO(0x0b05, 0xff, 0x01, 0x01),
 150           .driver_info = BTUSB_BCM_PATCHRAM },
 151
 152         /* Belkin F8065bf - Broadcom based */
 153         { USB_VENDOR_AND_INTERFACE_INFO(0x050d, 0xff, 0x01, 0x01),
 154           .driver_info = BTUSB_BCM_PATCHRAM },
 155
 156         /* IMC Networks - Broadcom based */
 157         { USB_VENDOR_AND_INTERFACE_INFO(0x13d3, 0xff, 0x01, 0x01),
 158           .driver_info = BTUSB_BCM_PATCHRAM },
 159
 160         /* Dell Computer - Broadcom based  */
 161         { USB_VENDOR_AND_INTERFACE_INFO(0x413c, 0xff, 0x01, 0x01),
 162           .driver_info = BTUSB_BCM_PATCHRAM },
 163
 164         /* Toshiba Corp - Broadcom based */
 165         { USB_VENDOR_AND_INTERFACE_INFO(0x0930, 0xff, 0x01, 0x01),
 166           .driver_info = BTUSB_BCM_PATCHRAM },
 167
 168         /* Intel Bluetooth USB Bootloader (RAM module) */
 169         { USB_DEVICE(0x8087, 0x0a5a),
 170           .driver_info = BTUSB_INTEL_BOOT | BTUSB_BROKEN_ISOC },
 171
 172         { }     /* Terminating entry */
 173 };
 174
 175 MODULE_DEVICE_TABLE(usb, btusb_table);
 176
 177 static const struct usb_device_id blacklist_table[] = {
 178         /* CSR BlueCore devices */
 179         { USB_DEVICE(0x0a12, 0x0001), .driver_info = BTUSB_CSR },
 180
 181         /* Broadcom BCM2033 without firmware */
 182         { USB_DEVICE(0x0a5c, 0x2033), .driver_info = BTUSB_IGNORE },
 183
 184         /* Broadcom BCM2045 devices */
 185         { USB_DEVICE(0x0a5c, 0x2045), .driver_info = BTUSB_BCM2045 },
 186
 187         /* Atheros 3011 with sflash firmware */
 188         { USB_DEVICE(0x0489, 0xe027), .driver_info = BTUSB_IGNORE },
 189         { USB_DEVICE(0x0489, 0xe03d), .driver_info = BTUSB_IGNORE },
 190         { USB_DEVICE(0x04f2, 0xaff1), .driver_info = BTUSB_IGNORE },
 191         { USB_DEVICE(0x0930, 0x0215), .driver_info = BTUSB_IGNORE },
 192         { USB_DEVICE(0x0cf3, 0x3002), .driver_info = BTUSB_IGNORE },
 193         { USB_DEVICE(0x0cf3, 0xe019), .driver_info = BTUSB_IGNORE },
 194         { USB_DEVICE(0x13d3, 0x3304), .driver_info = BTUSB_IGNORE },
 195
 196         /* Atheros AR9285 Malbec with sflash firmware */
 197         { USB_DEVICE(0x03f0, 0x311d), .driver_info = BTUSB_IGNORE },
 198
 199         /* Atheros 3012 with sflash firmware */
 200         { USB_DEVICE(0x0489, 0xe04d), .driver_info = BTUSB_ATH3012 },
 201         { USB_DEVICE(0x0489, 0xe04e), .driver_info = BTUSB_ATH3012 },
 202         { USB_DEVICE(0x0489, 0xe056), .driver_info = BTUSB_ATH3012 },
 203         { USB_DEVICE(0x0489, 0xe057), .driver_info = BTUSB_ATH3012 },
 204         { USB_DEVICE(0x0489, 0xe05f), .driver_info = BTUSB_ATH3012 },
 205         { USB_DEVICE(0x0489, 0xe076), .driver_info = BTUSB_ATH3012 },
 206         { USB_DEVICE(0x0489, 0xe078), .driver_info = BTUSB_ATH3012 },
 207         { USB_DEVICE(0x0489, 0xe095), .driver_info = BTUSB_ATH3012 },
 208         { USB_DEVICE(0x04c5, 0x1330), .driver_info = BTUSB_ATH3012 },
 209         { USB_DEVICE(0x04ca, 0x3004), .driver_info = BTUSB_ATH3012 },
 210         { USB_DEVICE(0x04ca, 0x3005), .driver_info = BTUSB_ATH3012 },
 211         { USB_DEVICE(0x04ca, 0x3006), .driver_info = BTUSB_ATH3012 },
 212         { USB_DEVICE(0x04ca, 0x3007), .driver_info = BTUSB_ATH3012 },
 213         { USB_DEVICE(0x04ca, 0x3008), .driver_info = BTUSB_ATH3012 },
 214         { USB_DEVICE(0x04ca, 0x300b), .driver_info = BTUSB_ATH3012 },
 215         { USB_DEVICE(0x04ca, 0x300d), .driver_info = BTUSB_ATH3012 },
 216         { USB_DEVICE(0x04ca, 0x300f), .driver_info = BTUSB_ATH3012 },
 217         { USB_DEVICE(0x04ca, 0x3010), .driver_info = BTUSB_ATH3012 },
 218         { USB_DEVICE(0x04ca, 0x3014), .driver_info = BTUSB_ATH3012 },
 219         { USB_DEVICE(0x04ca, 0x3018), .driver_info = BTUSB_ATH3012 },
 220         { USB_DEVICE(0x0930, 0x0219), .driver_info = BTUSB_ATH3012 },
 221         { USB_DEVICE(0x0930, 0x021c), .driver_info = BTUSB_ATH3012 },
 222         { USB_DEVICE(0x0930, 0x0220), .driver_info = BTUSB_ATH3012 },
 223         { USB_DEVICE(0x0930, 0x0227), .driver_info = BTUSB_ATH3012 },
 224         { USB_DEVICE(0x0b05, 0x17d0), .driver_info = BTUSB_ATH3012 },
 225         { USB_DEVICE(0x0cf3, 0x0036), .driver_info = BTUSB_ATH3012 },
 226         { USB_DEVICE(0x0cf3, 0x3004), .driver_info = BTUSB_ATH3012 },
 227         { USB_DEVICE(0x0cf3, 0x3008), .driver_info = BTUSB_ATH3012 },
 228         { USB_DEVICE(0x0cf3, 0x311d), .driver_info = BTUSB_ATH3012 },
 229         { USB_DEVICE(0x0cf3, 0x311e), .driver_info = BTUSB_ATH3012 },
 230         { USB_DEVICE(0x0cf3, 0x311f), .driver_info = BTUSB_ATH3012 },
 231         { USB_DEVICE(0x0cf3, 0x3121), .driver_info = BTUSB_ATH3012 },
 232         { USB_DEVICE(0x0cf3, 0x817a), .driver_info = BTUSB_ATH3012 },
 233         { USB_DEVICE(0x0cf3, 0x817b), .driver_info = BTUSB_ATH3012 },
 234         { USB_DEVICE(0x0cf3, 0xe003), .driver_info = BTUSB_ATH3012 },
 235         { USB_DEVICE(0x0cf3, 0xe004), .driver_info = BTUSB_ATH3012 },
 236         { USB_DEVICE(0x0cf3, 0xe005), .driver_info = BTUSB_ATH3012 },
 237         { USB_DEVICE(0x0cf3, 0xe006), .driver_info = BTUSB_ATH3012 },
 238         { USB_DEVICE(0x13d3, 0x3362), .driver_info = BTUSB_ATH3012 },
 239         { USB_DEVICE(0x13d3, 0x3375), .driver_info = BTUSB_ATH3012 },
 240         { USB_DEVICE(0x13d3, 0x3393), .driver_info = BTUSB_ATH3012 },
 241         { USB_DEVICE(0x13d3, 0x3395), .driver_info = BTUSB_ATH3012 },
 242         { USB_DEVICE(0x13d3, 0x3402), .driver_info = BTUSB_ATH3012 },
 243         { USB_DEVICE(0x13d3, 0x3408), .driver_info = BTUSB_ATH3012 },
 244         { USB_DEVICE(0x13d3, 0x3423), .driver_info = BTUSB_ATH3012 },
 245         { USB_DEVICE(0x13d3, 0x3432), .driver_info = BTUSB_ATH3012 },
 246         { USB_DEVICE(0x13d3, 0x3472), .driver_info = BTUSB_ATH3012 },
 247         { USB_DEVICE(0x13d3, 0x3474), .driver_info = BTUSB_ATH3012 },
 248         { USB_DEVICE(0x13d3, 0x3487), .driver_info = BTUSB_ATH3012 },
 249         { USB_DEVICE(0x13d3, 0x3490), .driver_info = BTUSB_ATH3012 },
 250
 251         /* Atheros AR5BBU12 with sflash firmware */
 252         { USB_DEVICE(0x0489, 0xe02c), .driver_info = BTUSB_IGNORE },
 253
 254         /* Atheros AR5BBU12 with sflash firmware */
 255         { USB_DEVICE(0x0489, 0xe036), .driver_info = BTUSB_ATH3012 },
 256         { USB_DEVICE(0x0489, 0xe03c), .driver_info = BTUSB_ATH3012 },
 257
 258         /* QCA ROME chipset */
 259         { USB_DEVICE(0x0cf3, 0x535b), .driver_info = BTUSB_QCA_ROME |
 260                                                      BTUSB_WIDEBAND_SPEECH },
 261         { USB_DEVICE(0x0cf3, 0xe007), .driver_info = BTUSB_QCA_ROME |
 262                                                      BTUSB_WIDEBAND_SPEECH },
 263         { USB_DEVICE(0x0cf3, 0xe009), .driver_info = BTUSB_QCA_ROME |
 264                                                      BTUSB_WIDEBAND_SPEECH },
 265         { USB_DEVICE(0x0cf3, 0xe010), .driver_info = BTUSB_QCA_ROME |
 266                                                      BTUSB_WIDEBAND_SPEECH },
 267         { USB_DEVICE(0x0cf3, 0xe300), .driver_info = BTUSB_QCA_ROME |
 268                                                      BTUSB_WIDEBAND_SPEECH },
 269         { USB_DEVICE(0x0cf3, 0xe301), .driver_info = BTUSB_QCA_ROME |
 270                                                      BTUSB_WIDEBAND_SPEECH },
 271         { USB_DEVICE(0x0cf3, 0xe360), .driver_info = BTUSB_QCA_ROME |
 272                                                      BTUSB_WIDEBAND_SPEECH },
 273         { USB_DEVICE(0x0cf3, 0xe500), .driver_info = BTUSB_QCA_ROME |
 274                                                      BTUSB_WIDEBAND_SPEECH },
 275         { USB_DEVICE(0x0489, 0xe092), .driver_info = BTUSB_QCA_ROME |
 276                                                      BTUSB_WIDEBAND_SPEECH },
 277         { USB_DEVICE(0x0489, 0xe09f), .driver_info = BTUSB_QCA_ROME |
 278                                                      BTUSB_WIDEBAND_SPEECH },
 279         { USB_DEVICE(0x0489, 0xe0a2), .driver_info = BTUSB_QCA_ROME |
 280                                                      BTUSB_WIDEBAND_SPEECH },
 281         { USB_DEVICE(0x04ca, 0x3011), .driver_info = BTUSB_QCA_ROME |
 282                                                      BTUSB_WIDEBAND_SPEECH },
 283         { USB_DEVICE(0x04ca, 0x3015), .driver_info = BTUSB_QCA_ROME |
 284                                                      BTUSB_WIDEBAND_SPEECH },
 285         { USB_DEVICE(0x04ca, 0x3016), .driver_info = BTUSB_QCA_ROME |
 286                                                      BTUSB_WIDEBAND_SPEECH },
 287         { USB_DEVICE(0x04ca, 0x301a), .driver_info = BTUSB_QCA_ROME |
 288                                                      BTUSB_WIDEBAND_SPEECH },
 289         { USB_DEVICE(0x04ca, 0x3021), .driver_info = BTUSB_QCA_ROME |
 290                                                      BTUSB_WIDEBAND_SPEECH },
 291         { USB_DEVICE(0x13d3, 0x3491), .driver_info = BTUSB_QCA_ROME |
 292                                                      BTUSB_WIDEBAND_SPEECH },
 293         { USB_DEVICE(0x13d3, 0x3496), .driver_info = BTUSB_QCA_ROME |
 294                                                      BTUSB_WIDEBAND_SPEECH },
 295         { USB_DEVICE(0x13d3, 0x3501), .driver_info = BTUSB_QCA_ROME |
 296                                                      BTUSB_WIDEBAND_SPEECH },
 297
 298         /* QCA WCN6855 chipset */
 299         { USB_DEVICE(0x0cf3, 0xe600), .driver_info = BTUSB_QCA_WCN6855 |
 300                                                      BTUSB_WIDEBAND_SPEECH },
 301
 302         /* Broadcom BCM2035 */
 303         { USB_DEVICE(0x0a5c, 0x2009), .driver_info = BTUSB_BCM92035 },
 304         { USB_DEVICE(0x0a5c, 0x200a), .driver_info = BTUSB_WRONG_SCO_MTU },
 305         { USB_DEVICE(0x0a5c, 0x2035), .driver_info = BTUSB_WRONG_SCO_MTU },
 306
 307         /* Broadcom BCM2045 */
 308         { USB_DEVICE(0x0a5c, 0x2039), .driver_info = BTUSB_WRONG_SCO_MTU },
 309         { USB_DEVICE(0x0a5c, 0x2101), .driver_info = BTUSB_WRONG_SCO_MTU },
 310
 311         /* IBM/Lenovo ThinkPad with Broadcom chip */
 312         { USB_DEVICE(0x0a5c, 0x201e), .driver_info = BTUSB_WRONG_SCO_MTU },
 313         { USB_DEVICE(0x0a5c, 0x2110), .driver_info = BTUSB_WRONG_SCO_MTU },
 314
 315         /* HP laptop with Broadcom chip */
 316         { USB_DEVICE(0x03f0, 0x171d), .driver_info = BTUSB_WRONG_SCO_MTU },
 317
 318         /* Dell laptop with Broadcom chip */
 319         { USB_DEVICE(0x413c, 0x8126), .driver_info = BTUSB_WRONG_SCO_MTU },
 320
 321         /* Dell Wireless 370 and 410 devices */
 322         { USB_DEVICE(0x413c, 0x8152), .driver_info = BTUSB_WRONG_SCO_MTU },
 323         { USB_DEVICE(0x413c, 0x8156), .driver_info = BTUSB_WRONG_SCO_MTU },
 324
 325         /* Belkin F8T012 and F8T013 devices */
 326         { USB_DEVICE(0x050d, 0x0012), .driver_info = BTUSB_WRONG_SCO_MTU },
 327         { USB_DEVICE(0x050d, 0x0013), .driver_info = BTUSB_WRONG_SCO_MTU },
 328
 329         /* Asus WL-BTD202 device */
 330         { USB_DEVICE(0x0b05, 0x1715), .driver_info = BTUSB_WRONG_SCO_MTU },
 331
 332         /* Kensington Bluetooth USB adapter */
 333         { USB_DEVICE(0x047d, 0x105e), .driver_info = BTUSB_WRONG_SCO_MTU },
 334
 335         /* RTX Telecom based adapters with buggy SCO support */
 336         { USB_DEVICE(0x0400, 0x0807), .driver_info = BTUSB_BROKEN_ISOC },
 337         { USB_DEVICE(0x0400, 0x080a), .driver_info = BTUSB_BROKEN_ISOC },
 338
 339         /* CONWISE Technology based adapters with buggy SCO support */
 340         { USB_DEVICE(0x0e5e, 0x6622),
 341           .driver_info = BTUSB_BROKEN_ISOC | BTUSB_CW6622},
 342
 343         /* Roper Class 1 Bluetooth Dongle (Silicon Wave based) */
 344         { USB_DEVICE(0x1310, 0x0001), .driver_info = BTUSB_SWAVE },
 345
 346         /* Digianswer devices */
 347         { USB_DEVICE(0x08fd, 0x0001), .driver_info = BTUSB_DIGIANSWER },
 348         { USB_DEVICE(0x08fd, 0x0002), .driver_info = BTUSB_IGNORE },
 349
 350         /* CSR BlueCore Bluetooth Sniffer */
 351         { USB_DEVICE(0x0a12, 0x0002),
 352           .driver_info = BTUSB_SNIFFER | BTUSB_BROKEN_ISOC },
 353
 354         /* Frontline ComProbe Bluetooth Sniffer */
 355         { USB_DEVICE(0x16d3, 0x0002),
 356           .driver_info = BTUSB_SNIFFER | BTUSB_BROKEN_ISOC },
 357
 358         /* Marvell Bluetooth devices */
 359         { USB_DEVICE(0x1286, 0x2044), .driver_info = BTUSB_MARVELL },
 360         { USB_DEVICE(0x1286, 0x2046), .driver_info = BTUSB_MARVELL },
 361         { USB_DEVICE(0x1286, 0x204e), .driver_info = BTUSB_MARVELL },
 362
 363         /* Intel Bluetooth devices */
 364         { USB_DEVICE(0x8087, 0x0025), .driver_info = BTUSB_INTEL_NEW |
 365                                                      BTUSB_WIDEBAND_SPEECH |
 366                                                      BTUSB_VALID_LE_STATES },
 367         { USB_DEVICE(0x8087, 0x0026), .driver_info = BTUSB_INTEL_NEW |
 368                                                      BTUSB_WIDEBAND_SPEECH },
 369         { USB_DEVICE(0x8087, 0x0029), .driver_info = BTUSB_INTEL_NEW |
 370                                                      BTUSB_WIDEBAND_SPEECH },
 371         { USB_DEVICE(0x8087, 0x0032), .driver_info = BTUSB_INTEL_NEWGEN |
 372                                                      BTUSB_WIDEBAND_SPEECH},
 373         { USB_DEVICE(0x8087, 0x0033), .driver_info = BTUSB_INTEL_NEWGEN |
 374                                                      BTUSB_WIDEBAND_SPEECH},
 375         { USB_DEVICE(0x8087, 0x07da), .driver_info = BTUSB_CSR },
 376         { USB_DEVICE(0x8087, 0x07dc), .driver_info = BTUSB_INTEL },
 377         { USB_DEVICE(0x8087, 0x0a2a), .driver_info = BTUSB_INTEL },
 378         { USB_DEVICE(0x8087, 0x0a2b), .driver_info = BTUSB_INTEL_NEW |
 379                                                      BTUSB_WIDEBAND_SPEECH },
 380         { USB_DEVICE(0x8087, 0x0aa7), .driver_info = BTUSB_INTEL |
 381                                                      BTUSB_WIDEBAND_SPEECH },
 382         { USB_DEVICE(0x8087, 0x0aaa), .driver_info = BTUSB_INTEL_NEW |
 383                                                      BTUSB_WIDEBAND_SPEECH |
 384                                                      BTUSB_VALID_LE_STATES },
 385
 386         /* Other Intel Bluetooth devices */
 387         { USB_VENDOR_AND_INTERFACE_INFO(0x8087, 0xe0, 0x01, 0x01),
 388           .driver_info = BTUSB_IGNORE },
 389
 390         /* Realtek 8822CE Bluetooth devices */
 391         { USB_DEVICE(0x0bda, 0xb00c), .driver_info = BTUSB_REALTEK |
 392                                                      BTUSB_WIDEBAND_SPEECH },
 393         { USB_DEVICE(0x0bda, 0xc822), .driver_info = BTUSB_REALTEK |
 394                                                      BTUSB_WIDEBAND_SPEECH },
 395
 396         /* Realtek 8852AE Bluetooth devices */
 397         { USB_DEVICE(0x0bda, 0xc852), .driver_info = BTUSB_REALTEK |
 398                                                      BTUSB_WIDEBAND_SPEECH },
 399
 400         /* Realtek Bluetooth devices */
 401         { USB_VENDOR_AND_INTERFACE_INFO(0x0bda, 0xe0, 0x01, 0x01),
 402           .driver_info = BTUSB_REALTEK },
 403
 404         /* MediaTek Bluetooth devices */
 405         { USB_VENDOR_AND_INTERFACE_INFO(0x0e8d, 0xe0, 0x01, 0x01),
 406           .driver_info = BTUSB_MEDIATEK |
 407                          BTUSB_WIDEBAND_SPEECH |
 408                          BTUSB_VALID_LE_STATES },
 409
 410         /* Additional MediaTek MT7615E Bluetooth devices */
 411         { USB_DEVICE(0x13d3, 0x3560), .driver_info = BTUSB_MEDIATEK},
 412
 413         /* Additional MediaTek MT7921 Bluetooth devices */
 414         { USB_DEVICE(0x04ca, 0x3802), .driver_info = BTUSB_MEDIATEK |
 415                                                      BTUSB_WIDEBAND_SPEECH |
 416                                                      BTUSB_VALID_LE_STATES },
 417
 418         /* Additional Realtek 8723AE Bluetooth devices */
 419         { USB_DEVICE(0x0930, 0x021d), .driver_info = BTUSB_REALTEK },
 420         { USB_DEVICE(0x13d3, 0x3394), .driver_info = BTUSB_REALTEK },
 421
 422         /* Additional Realtek 8723BE Bluetooth devices */
 423         { USB_DEVICE(0x0489, 0xe085), .driver_info = BTUSB_REALTEK },
 424         { USB_DEVICE(0x0489, 0xe08b), .driver_info = BTUSB_REALTEK },
 425         { USB_DEVICE(0x13d3, 0x3410), .driver_info = BTUSB_REALTEK },
 426         { USB_DEVICE(0x13d3, 0x3416), .driver_info = BTUSB_REALTEK },
 427         { USB_DEVICE(0x13d3, 0x3459), .driver_info = BTUSB_REALTEK },
 428         { USB_DEVICE(0x13d3, 0x3494), .driver_info = BTUSB_REALTEK },
 429
 430         /* Additional Realtek 8723BU Bluetooth devices */
 431         { USB_DEVICE(0x7392, 0xa611), .driver_info = BTUSB_REALTEK },
 432
 433         /* Additional Realtek 8723DE Bluetooth devices */
 434         { USB_DEVICE(0x0bda, 0xb009), .driver_info = BTUSB_REALTEK },
 435         { USB_DEVICE(0x2ff8, 0xb011), .driver_info = BTUSB_REALTEK },
 436
 437         /* Additional Realtek 8761BU Bluetooth devices */
 438         { USB_DEVICE(0x0b05, 0x190e), .driver_info = BTUSB_REALTEK |
 439                                                      BTUSB_WIDEBAND_SPEECH },
 440
 441         /* Additional Realtek 8821AE Bluetooth devices */
 442         { USB_DEVICE(0x0b05, 0x17dc), .driver_info = BTUSB_REALTEK },
 443         { USB_DEVICE(0x13d3, 0x3414), .driver_info = BTUSB_REALTEK },
 444         { USB_DEVICE(0x13d3, 0x3458), .driver_info = BTUSB_REALTEK },
 445         { USB_DEVICE(0x13d3, 0x3461), .driver_info = BTUSB_REALTEK },
 446         { USB_DEVICE(0x13d3, 0x3462), .driver_info = BTUSB_REALTEK },
 447
 448         /* Additional Realtek 8822BE Bluetooth devices */
 449         { USB_DEVICE(0x13d3, 0x3526), .driver_info = BTUSB_REALTEK },
 450         { USB_DEVICE(0x0b05, 0x185c), .driver_info = BTUSB_REALTEK },
 451
 452         /* Additional Realtek 8822CE Bluetooth devices */
 453         { USB_DEVICE(0x04ca, 0x4005), .driver_info = BTUSB_REALTEK |
 454                                                      BTUSB_WIDEBAND_SPEECH },
 455         { USB_DEVICE(0x04c5, 0x161f), .driver_info = BTUSB_REALTEK |
 456                                                      BTUSB_WIDEBAND_SPEECH },
 457         { USB_DEVICE(0x0b05, 0x18ef), .driver_info = BTUSB_REALTEK |
 458                                                      BTUSB_WIDEBAND_SPEECH },
 459         { USB_DEVICE(0x13d3, 0x3548), .driver_info = BTUSB_REALTEK |
 460                                                      BTUSB_WIDEBAND_SPEECH },
 461         { USB_DEVICE(0x13d3, 0x3549), .driver_info = BTUSB_REALTEK |
 462                                                      BTUSB_WIDEBAND_SPEECH },
 463         { USB_DEVICE(0x13d3, 0x3553), .driver_info = BTUSB_REALTEK |
 464                                                      BTUSB_WIDEBAND_SPEECH },
 465         { USB_DEVICE(0x13d3, 0x3555), .driver_info = BTUSB_REALTEK |
 466                                                      BTUSB_WIDEBAND_SPEECH },
 467         { USB_DEVICE(0x2ff8, 0x3051), .driver_info = BTUSB_REALTEK |
 468                                                      BTUSB_WIDEBAND_SPEECH },
 469         { USB_DEVICE(0x1358, 0xc123), .driver_info = BTUSB_REALTEK |
 470                                                      BTUSB_WIDEBAND_SPEECH },
 471         { USB_DEVICE(0x0bda, 0xc123), .driver_info = BTUSB_REALTEK |
 472                                                      BTUSB_WIDEBAND_SPEECH },
 473         { USB_DEVICE(0x0cb5, 0xc547), .driver_info = BTUSB_REALTEK |
 474                                                      BTUSB_WIDEBAND_SPEECH },
 475
 476         /* Silicon Wave based devices */
 477         { USB_DEVICE(0x0c10, 0x0000), .driver_info = BTUSB_SWAVE },
 478
 479         { }     /* Terminating entry */
 480 };
 481
 482 /* The Bluetooth USB module build into some devices needs to be reset on resume,
 483  * this is a problem with the platform (likely shutting off all power) not with
 484  * the module itself. So we use a DMI list to match known broken platforms.
 485  */
 486 static const struct dmi_system_id btusb_needs_reset_resume_table[] = {
 487         {
 488                 /* Dell OptiPlex 3060 (QCA ROME device 0cf3:e007) */
 489                 .matches = {
 490                         DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."),
 491                         DMI_MATCH(DMI_PRODUCT_NAME, "OptiPlex 3060"),
 492                 },
 493         },
 494         {
 495                 /* Dell XPS 9360 (QCA ROME device 0cf3:e300) */
 496                 .matches = {
 497                         DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."),
 498                         DMI_MATCH(DMI_PRODUCT_NAME, "XPS 13 9360"),
 499                 },
 500         },
 501         {
 502                 /* Dell Inspiron 5565 (QCA ROME device 0cf3:e009) */
 503                 .matches = {
 504                         DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."),
 505                         DMI_MATCH(DMI_PRODUCT_NAME, "Inspiron 5565"),
 506                 },
 507         },
 508         {}
 509 };
 510
 511 #define BTUSB_MAX_ISOC_FRAMES   10
 512
 513 #define BTUSB_INTR_RUNNING      0
 514 #define BTUSB_BULK_RUNNING      1
 515 #define BTUSB_ISOC_RUNNING      2
 516 #define BTUSB_SUSPENDING        3
 517 #define BTUSB_DID_ISO_RESUME    4
 518 #define BTUSB_BOOTLOADER        5
 519 #define BTUSB_DOWNLOADING       6
 520 #define BTUSB_FIRMWARE_LOADED   7
 521 #define BTUSB_FIRMWARE_FAILED   8
 522 #define BTUSB_BOOTING           9
 523 #define BTUSB_DIAG_RUNNING      10
 524 #define BTUSB_OOB_WAKE_ENABLED  11
 525 #define BTUSB_HW_RESET_ACTIVE   12
 526 #define BTUSB_TX_WAIT_VND_EVT   13
 527 #define BTUSB_WAKEUP_DISABLE    14
 528
 529 struct btusb_data {
 530         struct hci_dev       *hdev;
 531         struct usb_device    *udev;
 532         struct usb_interface *intf;
 533         struct usb_interface *isoc;
 534         struct usb_interface *diag;
 535         unsigned isoc_ifnum;
 536
 537         unsigned long flags;
 538
 539         struct work_struct work;
 540         struct work_struct waker;
 541
 542         struct usb_anchor deferred;
 543         struct usb_anchor tx_anchor;
 544         int tx_in_flight;
 545         spinlock_t txlock;
 546
 547         struct usb_anchor intr_anchor;
 548         struct usb_anchor bulk_anchor;
 549         struct usb_anchor isoc_anchor;
 550         struct usb_anchor diag_anchor;
 551         struct usb_anchor ctrl_anchor;
 552         spinlock_t rxlock;
 553
 554         struct sk_buff *evt_skb;
 555         struct sk_buff *acl_skb;
 556         struct sk_buff *sco_skb;
 557
 558         struct usb_endpoint_descriptor *intr_ep;
 559         struct usb_endpoint_descriptor *bulk_tx_ep;
 560         struct usb_endpoint_descriptor *bulk_rx_ep;
 561         struct usb_endpoint_descriptor *isoc_tx_ep;
 562         struct usb_endpoint_descriptor *isoc_rx_ep;
 563         struct usb_endpoint_descriptor *diag_tx_ep;
 564         struct usb_endpoint_descriptor *diag_rx_ep;
 565
 566         struct gpio_desc *reset_gpio;
 567
 568         __u8 cmdreq_type;
 569         __u8 cmdreq;
 570
 571         unsigned int sco_num;
 572         unsigned int air_mode;
 573         bool usb_alt6_packet_flow;
 574         int isoc_altsetting;
 575         int suspend_count;
 576
 577         int (*recv_event)(struct hci_dev *hdev, struct sk_buff *skb);
 578         int (*recv_bulk)(struct btusb_data *data, void *buffer, int count);
 579
 580         int (*setup_on_usb)(struct hci_dev *hdev);
 581
 582         int oob_wake_irq;   /* irq for out-of-band wake-on-bt */
 583         unsigned cmd_timeout_cnt;
 584 };
 585
 586 static void btusb_intel_cmd_timeout(struct hci_dev *hdev)
 587 {
 588         struct btusb_data *data = hci_get_drvdata(hdev);
 589         struct gpio_desc *reset_gpio = data->reset_gpio;
 590
 591         if (++data->cmd_timeout_cnt < 5)
 592                 return;
 593
 594         if (!reset_gpio) {
 595                 bt_dev_err(hdev, "No way to reset. Ignoring and continuing");
 596                 return;
 597         }
 598
 599         /*
 600          * Toggle the hard reset line if the platform provides one. The reset
 601          * is going to yank the device off the USB and then replug. So doing
 602          * once is enough. The cleanup is handled correctly on the way out
 603          * (standard USB disconnect), and the new device is detected cleanly
 604          * and bound to the driver again like it should be.
 605          */
 606         if (test_and_set_bit(BTUSB_HW_RESET_ACTIVE, &data->flags)) {
 607                 bt_dev_err(hdev, "last reset failed? Not resetting again");
 608                 return;
 609         }
 610
 611         bt_dev_err(hdev, "Initiating HW reset via gpio");
 612         gpiod_set_value_cansleep(reset_gpio, 1);
 613         msleep(100);
 614         gpiod_set_value_cansleep(reset_gpio, 0);
 615 }
 616
 617 static void btusb_rtl_cmd_timeout(struct hci_dev *hdev)
 618 {
 619         struct btusb_data *data = hci_get_drvdata(hdev);
 620         struct gpio_desc *reset_gpio = data->reset_gpio;
 621
 622         if (++data->cmd_timeout_cnt < 5)
 623                 return;
 624
 625         if (!reset_gpio) {
 626                 bt_dev_err(hdev, "No gpio to reset Realtek device, ignoring");
 627                 return;
 628         }
 629
 630         /* Toggle the hard reset line. The Realtek device is going to
 631          * yank itself off the USB and then replug. The cleanup is handled
 632          * correctly on the way out (standard USB disconnect), and the new
 633          * device is detected cleanly and bound to the driver again like
 634          * it should be.
 635          */
 636         if (test_and_set_bit(BTUSB_HW_RESET_ACTIVE, &data->flags)) {
 637                 bt_dev_err(hdev, "last reset failed? Not resetting again");
 638                 return;
 639         }
 640
 641         bt_dev_err(hdev, "Reset Realtek device via gpio");
 642         gpiod_set_value_cansleep(reset_gpio, 1);
 643         msleep(200);
 644         gpiod_set_value_cansleep(reset_gpio, 0);
 645 }
 646
 647 static void btusb_qca_cmd_timeout(struct hci_dev *hdev)
 648 {
 649         struct btusb_data *data = hci_get_drvdata(hdev);
 650         int err;
 651
 652         if (++data->cmd_timeout_cnt < 5)
 653                 return;
 654
 655         bt_dev_err(hdev, "Multiple cmd timeouts seen. Resetting usb device.");
 656         /* This is not an unbalanced PM reference since the device will reset */
 657         err = usb_autopm_get_interface(data->intf);
 658         if (!err)
 659                 usb_queue_reset_device(data->intf);
 660         else
 661                 bt_dev_err(hdev, "Failed usb_autopm_get_interface with %d", err);
 662 }
 663
 664 static inline void btusb_free_frags(struct btusb_data *data)
 665 {
 666         unsigned long flags;
 667
 668         spin_lock_irqsave(&data->rxlock, flags);
 669
 670         kfree_skb(data->evt_skb);
 671         data->evt_skb = NULL;
 672
 673         kfree_skb(data->acl_skb);
 674         data->acl_skb = NULL;
 675
 676         kfree_skb(data->sco_skb);
 677         data->sco_skb = NULL;
 678
 679         spin_unlock_irqrestore(&data->rxlock, flags);
 680 }
 681
 682 static int btusb_recv_intr(struct btusb_data *data, void *buffer, int count)
 683 {
 684         struct sk_buff *skb;
 685         unsigned long flags;
 686         int err = 0;
 687
 688         spin_lock_irqsave(&data->rxlock, flags);
 689         skb = data->evt_skb;
 690
 691         while (count) {
 692                 int len;
 693
 694                 if (!skb) {
 695                         skb = bt_skb_alloc(HCI_MAX_EVENT_SIZE, GFP_ATOMIC);
 696                         if (!skb) {
 697                                 err = -ENOMEM;
 698                                 break;
 699                         }
 700
 701                         hci_skb_pkt_type(skb) = HCI_EVENT_PKT;
 702                         hci_skb_expect(skb) = HCI_EVENT_HDR_SIZE;
 703                 }
 704
 705                 len = min_t(uint, hci_skb_expect(skb), count);
 706                 skb_put_data(skb, buffer, len);
 707
 708                 count -= len;
 709                 buffer += len;
 710                 hci_skb_expect(skb) -= len;
 711
 712                 if (skb->len == HCI_EVENT_HDR_SIZE) {
 713                         /* Complete event header */
 714                         hci_skb_expect(skb) = hci_event_hdr(skb)->plen;
 715
 716                         if (skb_tailroom(skb) < hci_skb_expect(skb)) {
 717                                 kfree_skb(skb);
 718                                 skb = NULL;
 719
 720                                 err = -EILSEQ;
 721                                 break;
 722                         }
 723                 }
 724
 725                 if (!hci_skb_expect(skb)) {
 726                         /* Complete frame */
 727                         data->recv_event(data->hdev, skb);
 728                         skb = NULL;
 729                 }
 730         }
 731
 732         data->evt_skb = skb;
 733         spin_unlock_irqrestore(&data->rxlock, flags);
 734
 735         return err;
 736 }
 737
 738 static int btusb_recv_bulk(struct btusb_data *data, void *buffer, int count)
 739 {
 740         struct sk_buff *skb;
 741         unsigned long flags;
 742         int err = 0;
 743
 744         spin_lock_irqsave(&data->rxlock, flags);
 745         skb = data->acl_skb;
 746
 747         while (count) {
 748                 int len;
 749
 750                 if (!skb) {
 751                         skb = bt_skb_alloc(HCI_MAX_FRAME_SIZE, GFP_ATOMIC);
 752                         if (!skb) {
 753                                 err = -ENOMEM;
 754                                 break;
 755                         }
 756
 757                         hci_skb_pkt_type(skb) = HCI_ACLDATA_PKT;
 758                         hci_skb_expect(skb) = HCI_ACL_HDR_SIZE;
 759                 }
 760
 761                 len = min_t(uint, hci_skb_expect(skb), count);
 762                 skb_put_data(skb, buffer, len);
 763
 764                 count -= len;
 765                 buffer += len;
 766                 hci_skb_expect(skb) -= len;
 767
 768                 if (skb->len == HCI_ACL_HDR_SIZE) {
 769                         __le16 dlen = hci_acl_hdr(skb)->dlen;
 770
 771                         /* Complete ACL header */
 772                         hci_skb_expect(skb) = __le16_to_cpu(dlen);
 773
 774                         if (skb_tailroom(skb) < hci_skb_expect(skb)) {
 775                                 kfree_skb(skb);
 776                                 skb = NULL;
 777
 778                                 err = -EILSEQ;
 779                                 break;
 780                         }
 781                 }
 782
 783                 if (!hci_skb_expect(skb)) {
 784                         /* Complete frame */
 785                         hci_recv_frame(data->hdev, skb);
 786                         skb = NULL;
 787                 }
 788         }
 789
 790         data->acl_skb = skb;
 791         spin_unlock_irqrestore(&data->rxlock, flags);
 792
 793         return err;
 794 }
 795
 796 static int btusb_recv_isoc(struct btusb_data *data, void *buffer, int count)
 797 {
 798         struct sk_buff *skb;
 799         unsigned long flags;
 800         int err = 0;
 801
 802         spin_lock_irqsave(&data->rxlock, flags);
 803         skb = data->sco_skb;
 804
 805         while (count) {
 806                 int len;
 807
 808                 if (!skb) {
 809                         skb = bt_skb_alloc(HCI_MAX_SCO_SIZE, GFP_ATOMIC);
 810                         if (!skb) {
 811                                 err = -ENOMEM;
 812                                 break;
 813                         }
 814
 815                         hci_skb_pkt_type(skb) = HCI_SCODATA_PKT;
 816                         hci_skb_expect(skb) = HCI_SCO_HDR_SIZE;
 817                 }
 818
 819                 len = min_t(uint, hci_skb_expect(skb), count);
 820                 skb_put_data(skb, buffer, len);
 821
 822                 count -= len;
 823                 buffer += len;
 824                 hci_skb_expect(skb) -= len;
 825
 826                 if (skb->len == HCI_SCO_HDR_SIZE) {
 827                         /* Complete SCO header */
 828                         hci_skb_expect(skb) = hci_sco_hdr(skb)->dlen;
 829
 830                         if (skb_tailroom(skb) < hci_skb_expect(skb)) {
 831                                 kfree_skb(skb);
 832                                 skb = NULL;
 833
 834                                 err = -EILSEQ;
 835                                 break;
 836                         }
 837                 }
 838
 839                 if (!hci_skb_expect(skb)) {
 840                         /* Complete frame */
 841                         hci_recv_frame(data->hdev, skb);
 842                         skb = NULL;
 843                 }
 844         }
 845
 846         data->sco_skb = skb;
 847         spin_unlock_irqrestore(&data->rxlock, flags);
 848
 849         return err;
 850 }
 851
 852 static void btusb_intr_complete(struct urb *urb)
 853 {
 854         struct hci_dev *hdev = urb->context;
 855         struct btusb_data *data = hci_get_drvdata(hdev);
 856         int err;
 857
 858         BT_DBG("%s urb %p status %d count %d", hdev->name, urb, urb->status,
 859                urb->actual_length);
 860
 861         if (!test_bit(HCI_RUNNING, &hdev->flags))
 862                 return;
 863
 864         if (urb->status == 0) {
 865                 hdev->stat.byte_rx += urb->actual_length;
 866
 867                 if (btusb_recv_intr(data, urb->transfer_buffer,
 868                                     urb->actual_length) < 0) {
 869                         bt_dev_err(hdev, "corrupted event packet");
 870                         hdev->stat.err_rx++;
 871                 }
 872         } else if (urb->status == -ENOENT) {
 873                 /* Avoid suspend failed when usb_kill_urb */
 874                 return;
 875         }
 876
 877         if (!test_bit(BTUSB_INTR_RUNNING, &data->flags))
 878                 return;
 879
 880         usb_mark_last_busy(data->udev);
 881         usb_anchor_urb(urb, &data->intr_anchor);
 882
 883         err = usb_submit_urb(urb, GFP_ATOMIC);
 884         if (err < 0) {
 885                 /* -EPERM: urb is being killed;
 886                  * -ENODEV: device got disconnected
 887                  */
 888                 if (err != -EPERM && err != -ENODEV)
 889                         bt_dev_err(hdev, "urb %p failed to resubmit (%d)",
 890                                    urb, -err);
 891                 usb_unanchor_urb(urb);
 892         }
 893 }
 894
 895 static int btusb_submit_intr_urb(struct hci_dev *hdev, gfp_t mem_flags)
 896 {
 897         struct btusb_data *data = hci_get_drvdata(hdev);
 898         struct urb *urb;
 899         unsigned char *buf;
 900         unsigned int pipe;
 901         int err, size;
 902
 903         BT_DBG("%s", hdev->name);
 904
 905         if (!data->intr_ep)
 906                 return -ENODEV;
 907
 908         urb = usb_alloc_urb(0, mem_flags);
 909         if (!urb)
 910                 return -ENOMEM;
 911
 912         size = le16_to_cpu(data->intr_ep->wMaxPacketSize);
 913
 914         buf = kmalloc(size, mem_flags);
 915         if (!buf) {
 916                 usb_free_urb(urb);
 917                 return -ENOMEM;
 918         }
 919
 920         pipe = usb_rcvintpipe(data->udev, data->intr_ep->bEndpointAddress);
 921
 922         usb_fill_int_urb(urb, data->udev, pipe, buf, size,
 923                          btusb_intr_complete, hdev, data->intr_ep->bInterval);
 924
 925         urb->transfer_flags |= URB_FREE_BUFFER;
 926
 927         usb_anchor_urb(urb, &data->intr_anchor);
 928
 929         err = usb_submit_urb(urb, mem_flags);
 930         if (err < 0) {
 931                 if (err != -EPERM && err != -ENODEV)
 932                         bt_dev_err(hdev, "urb %p submission failed (%d)",
 933                                    urb, -err);
 934                 usb_unanchor_urb(urb);
 935         }
 936
 937         usb_free_urb(urb);
 938
 939         return err;
 940 }
 941
 942 static void btusb_bulk_complete(struct urb *urb)
 943 {
 944         struct hci_dev *hdev = urb->context;
 945         struct btusb_data *data = hci_get_drvdata(hdev);
 946         int err;
 947
 948         BT_DBG("%s urb %p status %d count %d", hdev->name, urb, urb->status,
 949                urb->actual_length);
 950
 951         if (!test_bit(HCI_RUNNING, &hdev->flags))
 952                 return;
 953
 954         if (urb->status == 0) {
 955                 hdev->stat.byte_rx += urb->actual_length;
 956
 957                 if (data->recv_bulk(data, urb->transfer_buffer,
 958                                     urb->actual_length) < 0) {
 959                         bt_dev_err(hdev, "corrupted ACL packet");
 960                         hdev->stat.err_rx++;
 961                 }
 962         } else if (urb->status == -ENOENT) {
 963                 /* Avoid suspend failed when usb_kill_urb */
 964                 return;
 965         }
 966
 967         if (!test_bit(BTUSB_BULK_RUNNING, &data->flags))
 968                 return;
 969
 970         usb_anchor_urb(urb, &data->bulk_anchor);
 971         usb_mark_last_busy(data->udev);
 972
 973         err = usb_submit_urb(urb, GFP_ATOMIC);
 974         if (err < 0) {
 975                 /* -EPERM: urb is being killed;
 976                  * -ENODEV: device got disconnected
 977                  */
 978                 if (err != -EPERM && err != -ENODEV)
 979                         bt_dev_err(hdev, "urb %p failed to resubmit (%d)",
 980                                    urb, -err);
 981                 usb_unanchor_urb(urb);
 982         }
 983 }
 984
 985 static int btusb_submit_bulk_urb(struct hci_dev *hdev, gfp_t mem_flags)
 986 {
 987         struct btusb_data *data = hci_get_drvdata(hdev);
 988         struct urb *urb;
 989         unsigned char *buf;
 990         unsigned int pipe;
 991         int err, size = HCI_MAX_FRAME_SIZE;
 992
 993         BT_DBG("%s", hdev->name);
 994
 995         if (!data->bulk_rx_ep)
 996                 return -ENODEV;
 997
 998         urb = usb_alloc_urb(0, mem_flags);
 999         if (!urb)
1000                 return -ENOMEM;
1001
1002         buf = kmalloc(size, mem_flags);
1003         if (!buf) {
1004                 usb_free_urb(urb);
1005                 return -ENOMEM;
1006         }
1007
1008         pipe = usb_rcvbulkpipe(data->udev, data->bulk_rx_ep->bEndpointAddress);
1009
1010         usb_fill_bulk_urb(urb, data->udev, pipe, buf, size,
1011                           btusb_bulk_complete, hdev);
1012
1013         urb->transfer_flags |= URB_FREE_BUFFER;
1014
1015         usb_mark_last_busy(data->udev);
1016         usb_anchor_urb(urb, &data->bulk_anchor);
1017
1018         err = usb_submit_urb(urb, mem_flags);
1019         if (err < 0) {
1020                 if (err != -EPERM && err != -ENODEV)
1021                         bt_dev_err(hdev, "urb %p submission failed (%d)",
1022                                    urb, -err);
1023                 usb_unanchor_urb(urb);
1024         }
1025
1026         usb_free_urb(urb);
1027
1028         return err;
1029 }
1030
1031 static void btusb_isoc_complete(struct urb *urb)
1032 {
1033         struct hci_dev *hdev = urb->context;
1034         struct btusb_data *data = hci_get_drvdata(hdev);
1035         int i, err;
1036
1037         BT_DBG("%s urb %p status %d count %d", hdev->name, urb, urb->status,
1038                urb->actual_length);
1039
1040         if (!test_bit(HCI_RUNNING, &hdev->flags))
1041                 return;
1042
1043         if (urb->status == 0) {
1044                 for (i = 0; i < urb->number_of_packets; i++) {
1045                         unsigned int offset = urb->iso_frame_desc[i].offset;
1046                         unsigned int length = urb->iso_frame_desc[i].actual_length;
1047
1048                         if (urb->iso_frame_desc[i].status)
1049                                 continue;
1050
1051                         hdev->stat.byte_rx += length;
1052
1053                         if (btusb_recv_isoc(data, urb->transfer_buffer + offset,
1054                                             length) < 0) {
1055                                 bt_dev_err(hdev, "corrupted SCO packet");
1056                                 hdev->stat.err_rx++;
1057                         }
1058                 }
1059         } else if (urb->status == -ENOENT) {
1060                 /* Avoid suspend failed when usb_kill_urb */
1061                 return;
1062         }
1063
1064         if (!test_bit(BTUSB_ISOC_RUNNING, &data->flags))
1065                 return;
1066
1067         usb_anchor_urb(urb, &data->isoc_anchor);
1068
1069         err = usb_submit_urb(urb, GFP_ATOMIC);
1070         if (err < 0) {
1071                 /* -EPERM: urb is being killed;
1072                  * -ENODEV: device got disconnected
1073                  */
1074                 if (err != -EPERM && err != -ENODEV)
1075                         bt_dev_err(hdev, "urb %p failed to resubmit (%d)",
1076                                    urb, -err);
1077                 usb_unanchor_urb(urb);
1078         }
1079 }
1080
1081 static inline void __fill_isoc_descriptor_msbc(struct urb *urb, int len,
1082                                                int mtu, struct btusb_data *data)
1083 {
1084         int i, offset = 0;
1085         unsigned int interval;
1086
1087         BT_DBG("len %d mtu %d", len, mtu);
1088
1089         /* For mSBC ALT 6 setting the host will send the packet at continuous
1090          * flow. As per core spec 5, vol 4, part B, table 2.1. For ALT setting
1091          * 6 the HCI PACKET INTERVAL should be 7.5ms for every usb packets.
1092          * To maintain the rate we send 63bytes of usb packets alternatively for
1093          * 7ms and 8ms to maintain the rate as 7.5ms.
1094          */
1095         if (data->usb_alt6_packet_flow) {
1096                 interval = 7;
1097                 data->usb_alt6_packet_flow = false;
1098         } else {
1099                 interval = 6;
1100                 data->usb_alt6_packet_flow = true;
1101         }
1102
1103         for (i = 0; i < interval; i++) {
1104                 urb->iso_frame_desc[i].offset = offset;
1105                 urb->iso_frame_desc[i].length = offset;
1106         }
1107
1108         if (len && i < BTUSB_MAX_ISOC_FRAMES) {
1109                 urb->iso_frame_desc[i].offset = offset;
1110                 urb->iso_frame_desc[i].length = len;
1111                 i++;
1112         }
1113
1114         urb->number_of_packets = i;
1115 }
1116
1117 static inline void __fill_isoc_descriptor(struct urb *urb, int len, int mtu)
1118 {
1119         int i, offset = 0;
1120
1121         BT_DBG("len %d mtu %d", len, mtu);
1122
1123         for (i = 0; i < BTUSB_MAX_ISOC_FRAMES && len >= mtu;
1124                                         i++, offset += mtu, len -= mtu) {
1125                 urb->iso_frame_desc[i].offset = offset;
1126                 urb->iso_frame_desc[i].length = mtu;
1127         }
1128
1129         if (len && i < BTUSB_MAX_ISOC_FRAMES) {
1130                 urb->iso_frame_desc[i].offset = offset;
1131                 urb->iso_frame_desc[i].length = len;
1132                 i++;
1133         }
1134
1135         urb->number_of_packets = i;
1136 }
1137
1138 static int btusb_submit_isoc_urb(struct hci_dev *hdev, gfp_t mem_flags)
1139 {
1140         struct btusb_data *data = hci_get_drvdata(hdev);
1141         struct urb *urb;
1142         unsigned char *buf;
1143         unsigned int pipe;
1144         int err, size;
1145
1146         BT_DBG("%s", hdev->name);
1147
1148         if (!data->isoc_rx_ep)
1149                 return -ENODEV;
1150
1151         urb = usb_alloc_urb(BTUSB_MAX_ISOC_FRAMES, mem_flags);
1152         if (!urb)
1153                 return -ENOMEM;
1154
1155         size = le16_to_cpu(data->isoc_rx_ep->wMaxPacketSize) *
1156                                                 BTUSB_MAX_ISOC_FRAMES;
1157
1158         buf = kmalloc(size, mem_flags);
1159         if (!buf) {
1160                 usb_free_urb(urb);
1161                 return -ENOMEM;
1162         }
1163
1164         pipe = usb_rcvisocpipe(data->udev, data->isoc_rx_ep->bEndpointAddress);
1165
1166         usb_fill_int_urb(urb, data->udev, pipe, buf, size, btusb_isoc_complete,
1167                          hdev, data->isoc_rx_ep->bInterval);
1168
1169         urb->transfer_flags = URB_FREE_BUFFER | URB_ISO_ASAP;
1170
1171         __fill_isoc_descriptor(urb, size,
1172                                le16_to_cpu(data->isoc_rx_ep->wMaxPacketSize));
1173
1174         usb_anchor_urb(urb, &data->isoc_anchor);
1175
1176         err = usb_submit_urb(urb, mem_flags);
1177         if (err < 0) {
1178                 if (err != -EPERM && err != -ENODEV)
1179                         bt_dev_err(hdev, "urb %p submission failed (%d)",
1180                                    urb, -err);
1181                 usb_unanchor_urb(urb);
1182         }
1183
1184         usb_free_urb(urb);
1185
1186         return err;
1187 }
1188
1189 static void btusb_diag_complete(struct urb *urb)
1190 {
1191         struct hci_dev *hdev = urb->context;
1192         struct btusb_data *data = hci_get_drvdata(hdev);
1193         int err;
1194
1195         BT_DBG("%s urb %p status %d count %d", hdev->name, urb, urb->status,
1196                urb->actual_length);
1197
1198         if (urb->status == 0) {
1199                 struct sk_buff *skb;
1200
1201                 skb = bt_skb_alloc(urb->actual_length, GFP_ATOMIC);
1202                 if (skb) {
1203                         skb_put_data(skb, urb->transfer_buffer,
1204                                      urb->actual_length);
1205                         hci_recv_diag(hdev, skb);
1206                 }
1207         } else if (urb->status == -ENOENT) {
1208                 /* Avoid suspend failed when usb_kill_urb */
1209                 return;
1210         }
1211
1212         if (!test_bit(BTUSB_DIAG_RUNNING, &data->flags))
1213                 return;
1214
1215         usb_anchor_urb(urb, &data->diag_anchor);
1216         usb_mark_last_busy(data->udev);
1217
1218         err = usb_submit_urb(urb, GFP_ATOMIC);
1219         if (err < 0) {
1220                 /* -EPERM: urb is being killed;
1221                  * -ENODEV: device got disconnected
1222                  */
1223                 if (err != -EPERM && err != -ENODEV)
1224                         bt_dev_err(hdev, "urb %p failed to resubmit (%d)",
1225                                    urb, -err);
1226                 usb_unanchor_urb(urb);
1227         }
1228 }
1229
1230 static int btusb_submit_diag_urb(struct hci_dev *hdev, gfp_t mem_flags)
1231 {
1232         struct btusb_data *data = hci_get_drvdata(hdev);
1233         struct urb *urb;
1234         unsigned char *buf;
1235         unsigned int pipe;
1236         int err, size = HCI_MAX_FRAME_SIZE;
1237
1238         BT_DBG("%s", hdev->name);
1239
1240         if (!data->diag_rx_ep)
1241                 return -ENODEV;
1242
1243         urb = usb_alloc_urb(0, mem_flags);
1244         if (!urb)
1245                 return -ENOMEM;
1246
1247         buf = kmalloc(size, mem_flags);
1248         if (!buf) {
1249                 usb_free_urb(urb);
1250                 return -ENOMEM;
1251         }
1252
1253         pipe = usb_rcvbulkpipe(data->udev, data->diag_rx_ep->bEndpointAddress);
1254
1255         usb_fill_bulk_urb(urb, data->udev, pipe, buf, size,
1256                           btusb_diag_complete, hdev);
1257
1258         urb->transfer_flags |= URB_FREE_BUFFER;
1259
1260         usb_mark_last_busy(data->udev);
1261         usb_anchor_urb(urb, &data->diag_anchor);
1262
1263         err = usb_submit_urb(urb, mem_flags);
1264         if (err < 0) {
1265                 if (err != -EPERM && err != -ENODEV)
1266                         bt_dev_err(hdev, "urb %p submission failed (%d)",
1267                                    urb, -err);
1268                 usb_unanchor_urb(urb);
1269         }
1270
1271         usb_free_urb(urb);
1272
1273         return err;
1274 }
1275
1276 static void btusb_tx_complete(struct urb *urb)
1277 {
1278         struct sk_buff *skb = urb->context;
1279         struct hci_dev *hdev = (struct hci_dev *)skb->dev;
1280         struct btusb_data *data = hci_get_drvdata(hdev);
1281         unsigned long flags;
1282
1283         BT_DBG("%s urb %p status %d count %d", hdev->name, urb, urb->status,
1284                urb->actual_length);
1285
1286         if (!test_bit(HCI_RUNNING, &hdev->flags))
1287                 goto done;
1288
1289         if (!urb->status)
1290                 hdev->stat.byte_tx += urb->transfer_buffer_length;
1291         else
1292                 hdev->stat.err_tx++;
1293
1294 done:
1295         spin_lock_irqsave(&data->txlock, flags);
1296         data->tx_in_flight--;
1297         spin_unlock_irqrestore(&data->txlock, flags);
1298
1299         kfree(urb->setup_packet);
1300
1301         kfree_skb(skb);
1302 }
1303
1304 static void btusb_isoc_tx_complete(struct urb *urb)
1305 {
1306         struct sk_buff *skb = urb->context;
1307         struct hci_dev *hdev = (struct hci_dev *)skb->dev;
1308
1309         BT_DBG("%s urb %p status %d count %d", hdev->name, urb, urb->status,
1310                urb->actual_length);
1311
1312         if (!test_bit(HCI_RUNNING, &hdev->flags))
1313                 goto done;
1314
1315         if (!urb->status)
1316                 hdev->stat.byte_tx += urb->transfer_buffer_length;
1317         else
1318                 hdev->stat.err_tx++;
1319
1320 done:
1321         kfree(urb->setup_packet);
1322
1323         kfree_skb(skb);
1324 }
1325
1326 static int btusb_open(struct hci_dev *hdev)
1327 {
1328         struct btusb_data *data = hci_get_drvdata(hdev);
1329         int err;
1330
1331         BT_DBG("%s", hdev->name);
1332
1333         err = usb_autopm_get_interface(data->intf);
1334         if (err < 0)
1335                 return err;
1336
1337         /* Patching USB firmware files prior to starting any URBs of HCI path
1338          * It is more safe to use USB bulk channel for downloading USB patch
1339          */
1340         if (data->setup_on_usb) {
1341                 err = data->setup_on_usb(hdev);
1342                 if (err < 0)
1343                         goto setup_fail;
1344         }
1345
1346         data->intf->needs_remote_wakeup = 1;
1347
1348         /* Disable device remote wakeup when host is suspended
1349          * For Realtek chips, global suspend without
1350          * SET_FEATURE (DEVICE_REMOTE_WAKEUP) can save more power in device.
1351          */
1352         if (test_bit(BTUSB_WAKEUP_DISABLE, &data->flags))
1353                 device_wakeup_disable(&data->udev->dev);
1354
1355         if (test_and_set_bit(BTUSB_INTR_RUNNING, &data->flags))
1356                 goto done;
1357
1358         err = btusb_submit_intr_urb(hdev, GFP_KERNEL);
1359         if (err < 0)
1360                 goto failed;
1361
1362         err = btusb_submit_bulk_urb(hdev, GFP_KERNEL);
1363         if (err < 0) {
1364                 usb_kill_anchored_urbs(&data->intr_anchor);
1365                 goto failed;
1366         }
1367
1368         set_bit(BTUSB_BULK_RUNNING, &data->flags);
1369         btusb_submit_bulk_urb(hdev, GFP_KERNEL);
1370
1371         if (data->diag) {
1372                 if (!btusb_submit_diag_urb(hdev, GFP_KERNEL))
1373                         set_bit(BTUSB_DIAG_RUNNING, &data->flags);
1374         }
1375
1376 done:
1377         usb_autopm_put_interface(data->intf);
1378         return 0;
1379
1380 failed:
1381         clear_bit(BTUSB_INTR_RUNNING, &data->flags);
1382 setup_fail:
1383         usb_autopm_put_interface(data->intf);
1384         return err;
1385 }
1386
1387 static void btusb_stop_traffic(struct btusb_data *data)
1388 {
1389         usb_kill_anchored_urbs(&data->intr_anchor);
1390         usb_kill_anchored_urbs(&data->bulk_anchor);
1391         usb_kill_anchored_urbs(&data->isoc_anchor);
1392         usb_kill_anchored_urbs(&data->diag_anchor);
1393         usb_kill_anchored_urbs(&data->ctrl_anchor);
1394 }
1395
1396 static int btusb_close(struct hci_dev *hdev)
1397 {
1398         struct btusb_data *data = hci_get_drvdata(hdev);
1399         int err;
1400
1401         BT_DBG("%s", hdev->name);
1402
1403         cancel_work_sync(&data->work);
1404         cancel_work_sync(&data->waker);
1405
1406         clear_bit(BTUSB_ISOC_RUNNING, &data->flags);
1407         clear_bit(BTUSB_BULK_RUNNING, &data->flags);
1408         clear_bit(BTUSB_INTR_RUNNING, &data->flags);
1409         clear_bit(BTUSB_DIAG_RUNNING, &data->flags);
1410
1411         btusb_stop_traffic(data);
1412         btusb_free_frags(data);
1413
1414         err = usb_autopm_get_interface(data->intf);
1415         if (err < 0)
1416                 goto failed;
1417
1418         data->intf->needs_remote_wakeup = 0;
1419
1420         /* Enable remote wake up for auto-suspend */
1421         if (test_bit(BTUSB_WAKEUP_DISABLE, &data->flags))
1422                 data->intf->needs_remote_wakeup = 1;
1423
1424         usb_autopm_put_interface(data->intf);
1425
1426 failed:
1427         usb_scuttle_anchored_urbs(&data->deferred);
1428         return 0;
1429 }
1430
1431 static int btusb_flush(struct hci_dev *hdev)
1432 {
1433         struct btusb_data *data = hci_get_drvdata(hdev);
1434
1435         BT_DBG("%s", hdev->name);
1436
1437         usb_kill_anchored_urbs(&data->tx_anchor);
1438         btusb_free_frags(data);
1439
1440         return 0;
1441 }
1442
1443 static struct urb *alloc_ctrl_urb(struct hci_dev *hdev, struct sk_buff *skb)
1444 {
1445         struct btusb_data *data = hci_get_drvdata(hdev);
1446         struct usb_ctrlrequest *dr;
1447         struct urb *urb;
1448         unsigned int pipe;
1449
1450         urb = usb_alloc_urb(0, GFP_KERNEL);
1451         if (!urb)
1452                 return ERR_PTR(-ENOMEM);
1453
1454         dr = kmalloc(sizeof(*dr), GFP_KERNEL);
1455         if (!dr) {
1456                 usb_free_urb(urb);
1457                 return ERR_PTR(-ENOMEM);
1458         }
1459
1460         dr->bRequestType = data->cmdreq_type;
1461         dr->bRequest     = data->cmdreq;
1462         dr->wIndex       = 0;
1463         dr->wValue       = 0;
1464         dr->wLength      = __cpu_to_le16(skb->len);
1465
1466         pipe = usb_sndctrlpipe(data->udev, 0x00);
1467
1468         usb_fill_control_urb(urb, data->udev, pipe, (void *)dr,
1469                              skb->data, skb->len, btusb_tx_complete, skb);
1470
1471         skb->dev = (void *)hdev;
1472
1473         return urb;
1474 }
1475
1476 static struct urb *alloc_bulk_urb(struct hci_dev *hdev, struct sk_buff *skb)
1477 {
1478         struct btusb_data *data = hci_get_drvdata(hdev);
1479         struct urb *urb;
1480         unsigned int pipe;
1481
1482         if (!data->bulk_tx_ep)
1483                 return ERR_PTR(-ENODEV);
1484
1485         urb = usb_alloc_urb(0, GFP_KERNEL);
1486         if (!urb)
1487                 return ERR_PTR(-ENOMEM);
1488
1489         pipe = usb_sndbulkpipe(data->udev, data->bulk_tx_ep->bEndpointAddress);
1490
1491         usb_fill_bulk_urb(urb, data->udev, pipe,
1492                           skb->data, skb->len, btusb_tx_complete, skb);
1493
1494         skb->dev = (void *)hdev;
1495
1496         return urb;
1497 }
1498
1499 static struct urb *alloc_isoc_urb(struct hci_dev *hdev, struct sk_buff *skb)
1500 {
1501         struct btusb_data *data = hci_get_drvdata(hdev);
1502         struct urb *urb;
1503         unsigned int pipe;
1504
1505         if (!data->isoc_tx_ep)
1506                 return ERR_PTR(-ENODEV);
1507
1508         urb = usb_alloc_urb(BTUSB_MAX_ISOC_FRAMES, GFP_KERNEL);
1509         if (!urb)
1510                 return ERR_PTR(-ENOMEM);
1511
1512         pipe = usb_sndisocpipe(data->udev, data->isoc_tx_ep->bEndpointAddress);
1513
1514         usb_fill_int_urb(urb, data->udev, pipe,
1515                          skb->data, skb->len, btusb_isoc_tx_complete,
1516                          skb, data->isoc_tx_ep->bInterval);
1517
1518         urb->transfer_flags  = URB_ISO_ASAP;
1519
1520         if (data->isoc_altsetting == 6)
1521                 __fill_isoc_descriptor_msbc(urb, skb->len,
1522                                             le16_to_cpu(data->isoc_tx_ep->wMaxPacketSize),
1523                                             data);
1524         else
1525                 __fill_isoc_descriptor(urb, skb->len,
1526                                        le16_to_cpu(data->isoc_tx_ep->wMaxPacketSize));
1527         skb->dev = (void *)hdev;
1528
1529         return urb;
1530 }
1531
1532 static int submit_tx_urb(struct hci_dev *hdev, struct urb *urb)
1533 {
1534         struct btusb_data *data = hci_get_drvdata(hdev);
1535         int err;
1536
1537         usb_anchor_urb(urb, &data->tx_anchor);
1538
1539         err = usb_submit_urb(urb, GFP_KERNEL);
1540         if (err < 0) {
1541                 if (err != -EPERM && err != -ENODEV)
1542                         bt_dev_err(hdev, "urb %p submission failed (%d)",
1543                                    urb, -err);
1544                 kfree(urb->setup_packet);
1545                 usb_unanchor_urb(urb);
1546         } else {
1547                 usb_mark_last_busy(data->udev);
1548         }
1549
1550         usb_free_urb(urb);
1551         return err;
1552 }
1553
1554 static int submit_or_queue_tx_urb(struct hci_dev *hdev, struct urb *urb)
1555 {
1556         struct btusb_data *data = hci_get_drvdata(hdev);
1557         unsigned long flags;
1558         bool suspending;
1559
1560         spin_lock_irqsave(&data->txlock, flags);
1561         suspending = test_bit(BTUSB_SUSPENDING, &data->flags);
1562         if (!suspending)
1563                 data->tx_in_flight++;
1564         spin_unlock_irqrestore(&data->txlock, flags);
1565
1566         if (!suspending)
1567                 return submit_tx_urb(hdev, urb);
1568
1569         usb_anchor_urb(urb, &data->deferred);
1570         schedule_work(&data->waker);
1571
1572         usb_free_urb(urb);
1573         return 0;
1574 }
1575
1576 static int btusb_send_frame(struct hci_dev *hdev, struct sk_buff *skb)
1577 {
1578         struct urb *urb;
1579
1580         BT_DBG("%s", hdev->name);
1581
1582         switch (hci_skb_pkt_type(skb)) {
1583         case HCI_COMMAND_PKT:
1584                 urb = alloc_ctrl_urb(hdev, skb);
1585                 if (IS_ERR(urb))
1586                         return PTR_ERR(urb);
1587
1588                 hdev->stat.cmd_tx++;
1589                 return submit_or_queue_tx_urb(hdev, urb);
1590
1591         case HCI_ACLDATA_PKT:
1592                 urb = alloc_bulk_urb(hdev, skb);
1593                 if (IS_ERR(urb))
1594                         return PTR_ERR(urb);
1595
1596                 hdev->stat.acl_tx++;
1597                 return submit_or_queue_tx_urb(hdev, urb);
1598
1599         case HCI_SCODATA_PKT:
1600                 if (hci_conn_num(hdev, SCO_LINK) < 1)
1601                         return -ENODEV;
1602
1603                 urb = alloc_isoc_urb(hdev, skb);
1604                 if (IS_ERR(urb))
1605                         return PTR_ERR(urb);
1606
1607                 hdev->stat.sco_tx++;
1608                 return submit_tx_urb(hdev, urb);
1609         }
1610
1611         return -EILSEQ;
1612 }
1613
1614 static void btusb_notify(struct hci_dev *hdev, unsigned int evt)
1615 {
1616         struct btusb_data *data = hci_get_drvdata(hdev);
1617
1618         BT_DBG("%s evt %d", hdev->name, evt);
1619
1620         if (hci_conn_num(hdev, SCO_LINK) != data->sco_num) {
1621                 data->sco_num = hci_conn_num(hdev, SCO_LINK);
1622                 data->air_mode = evt;
1623                 schedule_work(&data->work);
1624         }
1625 }
1626
1627 static inline int __set_isoc_interface(struct hci_dev *hdev, int altsetting)
1628 {
1629         struct btusb_data *data = hci_get_drvdata(hdev);
1630         struct usb_interface *intf = data->isoc;
1631         struct usb_endpoint_descriptor *ep_desc;
1632         int i, err;
1633
1634         if (!data->isoc)
1635                 return -ENODEV;
1636
1637         err = usb_set_interface(data->udev, data->isoc_ifnum, altsetting);
1638         if (err < 0) {
1639                 bt_dev_err(hdev, "setting interface failed (%d)", -err);
1640                 return err;
1641         }
1642
1643         data->isoc_altsetting = altsetting;
1644
1645         data->isoc_tx_ep = NULL;
1646         data->isoc_rx_ep = NULL;
1647
1648         for (i = 0; i < intf->cur_altsetting->desc.bNumEndpoints; i++) {
1649                 ep_desc = &intf->cur_altsetting->endpoint[i].desc;
1650
1651                 if (!data->isoc_tx_ep && usb_endpoint_is_isoc_out(ep_desc)) {
1652                         data->isoc_tx_ep = ep_desc;
1653                         continue;
1654                 }
1655
1656                 if (!data->isoc_rx_ep && usb_endpoint_is_isoc_in(ep_desc)) {
1657                         data->isoc_rx_ep = ep_desc;
1658                         continue;
1659                 }
1660         }
1661
1662         if (!data->isoc_tx_ep || !data->isoc_rx_ep) {
1663                 bt_dev_err(hdev, "invalid SCO descriptors");
1664                 return -ENODEV;
1665         }
1666
1667         return 0;
1668 }
1669
1670 static int btusb_switch_alt_setting(struct hci_dev *hdev, int new_alts)
1671 {
1672         struct btusb_data *data = hci_get_drvdata(hdev);
1673         int err;
1674
1675         if (data->isoc_altsetting != new_alts) {
1676                 unsigned long flags;
1677
1678                 clear_bit(BTUSB_ISOC_RUNNING, &data->flags);
1679                 usb_kill_anchored_urbs(&data->isoc_anchor);
1680
1681                 /* When isochronous alternate setting needs to be
1682                  * changed, because SCO connection has been added
1683                  * or removed, a packet fragment may be left in the
1684                  * reassembling state. This could lead to wrongly
1685                  * assembled fragments.
1686                  *
1687                  * Clear outstanding fragment when selecting a new
1688                  * alternate setting.
1689                  */
1690                 spin_lock_irqsave(&data->rxlock, flags);
1691                 kfree_skb(data->sco_skb);
1692                 data->sco_skb = NULL;
1693                 spin_unlock_irqrestore(&data->rxlock, flags);
1694
1695                 err = __set_isoc_interface(hdev, new_alts);
1696                 if (err < 0)
1697                         return err;
1698         }
1699
1700         if (!test_and_set_bit(BTUSB_ISOC_RUNNING, &data->flags)) {
1701                 if (btusb_submit_isoc_urb(hdev, GFP_KERNEL) < 0)
1702                         clear_bit(BTUSB_ISOC_RUNNING, &data->flags);
1703                 else
1704                         btusb_submit_isoc_urb(hdev, GFP_KERNEL);
1705         }
1706
1707         return 0;
1708 }
1709
1710 static struct usb_host_interface *btusb_find_altsetting(struct btusb_data *data,
1711                                                         int alt)
1712 {
1713         struct usb_interface *intf = data->isoc;
1714         int i;
1715
1716         BT_DBG("Looking for Alt no :%d", alt);
1717
1718         if (!intf)
1719                 return NULL;
1720
1721         for (i = 0; i < intf->num_altsetting; i++) {
1722                 if (intf->altsetting[i].desc.bAlternateSetting == alt)
1723                         return &intf->altsetting[i];
1724         }
1725
1726         return NULL;
1727 }
1728
1729 static void btusb_work(struct work_struct *work)
1730 {
1731         struct btusb_data *data = container_of(work, struct btusb_data, work);
1732         struct hci_dev *hdev = data->hdev;
1733         int new_alts = 0;
1734         int err;
1735
1736         if (data->sco_num > 0) {
1737                 if (!test_bit(BTUSB_DID_ISO_RESUME, &data->flags)) {
1738                         err = usb_autopm_get_interface(data->isoc ? data->isoc : data->intf);
1739                         if (err < 0) {
1740                                 clear_bit(BTUSB_ISOC_RUNNING, &data->flags);
1741                                 usb_kill_anchored_urbs(&data->isoc_anchor);
1742                                 return;
1743                         }
1744
1745                         set_bit(BTUSB_DID_ISO_RESUME, &data->flags);
1746                 }
1747
1748                 if (data->air_mode == HCI_NOTIFY_ENABLE_SCO_CVSD) {
1749                         if (hdev->voice_setting & 0x0020) {
1750                                 static const int alts[3] = { 2, 4, 5 };
1751
1752                                 new_alts = alts[data->sco_num - 1];
1753                         } else {
1754                                 new_alts = data->sco_num;
1755                         }
1756                 } else if (data->air_mode == HCI_NOTIFY_ENABLE_SCO_TRANSP) {
1757                         /* Bluetooth USB spec recommends alt 6 (63 bytes), but
1758                          * many adapters do not support it.  Alt 1 appears to
1759                          * work for all adapters that do not have alt 6, and
1760                          * which work with WBS at all.
1761                          */
1762                         new_alts = btusb_find_altsetting(data, 6) ? 6 : 1;
1763                         /* Because mSBC frames do not need to be aligned to the
1764                          * SCO packet boundary. If support the Alt 3, use the
1765                          * Alt 3 for HCI payload >= 60 Bytes let air packet
1766                          * data satisfy 60 bytes.
1767                          */
1768                         if (new_alts == 1 && btusb_find_altsetting(data, 3))
1769                                 new_alts = 3;
1770                 }
1771
1772                 if (btusb_switch_alt_setting(hdev, new_alts) < 0)
1773                         bt_dev_err(hdev, "set USB alt:(%d) failed!", new_alts);
1774         } else {
1775                 clear_bit(BTUSB_ISOC_RUNNING, &data->flags);
1776                 usb_kill_anchored_urbs(&data->isoc_anchor);
1777
1778                 __set_isoc_interface(hdev, 0);
1779                 if (test_and_clear_bit(BTUSB_DID_ISO_RESUME, &data->flags))
1780                         usb_autopm_put_interface(data->isoc ? data->isoc : data->intf);
1781         }
1782 }
1783
1784 static void btusb_waker(struct work_struct *work)
1785 {
1786         struct btusb_data *data = container_of(work, struct btusb_data, waker);
1787         int err;
1788
1789         err = usb_autopm_get_interface(data->intf);
1790         if (err < 0)
1791                 return;
1792
1793         usb_autopm_put_interface(data->intf);
1794 }
1795
1796 static int btusb_setup_bcm92035(struct hci_dev *hdev)
1797 {
1798         struct sk_buff *skb;
1799         u8 val = 0x00;
1800
1801         BT_DBG("%s", hdev->name);
1802
1803         skb = __hci_cmd_sync(hdev, 0xfc3b, 1, &val, HCI_INIT_TIMEOUT);
1804         if (IS_ERR(skb))
1805                 bt_dev_err(hdev, "BCM92035 command failed (%ld)", PTR_ERR(skb));
1806         else
1807                 kfree_skb(skb);
1808
1809         return 0;
1810 }
1811
1812 static int btusb_setup_csr(struct hci_dev *hdev)
1813 {
1814         struct btusb_data *data = hci_get_drvdata(hdev);
1815         u16 bcdDevice = le16_to_cpu(data->udev->descriptor.bcdDevice);
1816         struct hci_rp_read_local_version *rp;
1817         struct sk_buff *skb;
1818         bool is_fake = false;
1819         int ret;
1820
1821         BT_DBG("%s", hdev->name);
1822
1823         skb = __hci_cmd_sync(hdev, HCI_OP_READ_LOCAL_VERSION, 0, NULL,
1824                              HCI_INIT_TIMEOUT);
1825         if (IS_ERR(skb)) {
1826                 int err = PTR_ERR(skb);
1827                 bt_dev_err(hdev, "CSR: Local version failed (%d)", err);
1828                 return err;
1829         }
1830
1831         if (skb->len != sizeof(struct hci_rp_read_local_version)) {
1832                 bt_dev_err(hdev, "CSR: Local version length mismatch");
1833                 kfree_skb(skb);
1834                 return -EIO;
1835         }
1836
1837         rp = (struct hci_rp_read_local_version *)skb->data;
1838
1839         /* Detect a wide host of Chinese controllers that aren't CSR.
1840          *
1841          * Known fake bcdDevices: 0x0100, 0x0134, 0x1915, 0x2520, 0x7558, 0x8891
1842          *
1843          * The main thing they have in common is that these are really popular low-cost
1844          * options that support newer Bluetooth versions but rely on heavy VID/PID
1845          * squatting of this poor old Bluetooth 1.1 device. Even sold as such.
1846          *
1847          * We detect actual CSR devices by checking that the HCI manufacturer code
1848          * is Cambridge Silicon Radio (10) and ensuring that LMP sub-version and
1849          * HCI rev values always match. As they both store the firmware number.
1850          */
1851         if (le16_to_cpu(rp->manufacturer) != 10 ||
1852             le16_to_cpu(rp->hci_rev) != le16_to_cpu(rp->lmp_subver))
1853                 is_fake = true;
1854
1855         /* Known legit CSR firmware build numbers and their supported BT versions:
1856          * - 1.1 (0x1) -> 0x0073, 0x020d, 0x033c, 0x034e
1857          * - 1.2 (0x2) ->                 0x04d9, 0x0529
1858          * - 2.0 (0x3) ->         0x07a6, 0x07ad, 0x0c5c
1859          * - 2.1 (0x4) ->         0x149c, 0x1735, 0x1899 (0x1899 is a BlueCore4-External)
1860          * - 4.0 (0x6) ->         0x1d86, 0x2031, 0x22bb
1861          *
1862          * e.g. Real CSR dongles with LMP subversion 0x73 are old enough that
1863          *      support BT 1.1 only; so it's a dead giveaway when some
1864          *      third-party BT 4.0 dongle reuses it.
1865          */
1866         else if (le16_to_cpu(rp->lmp_subver) <= 0x034e &&
1867                  le16_to_cpu(rp->hci_ver) > BLUETOOTH_VER_1_1)
1868                 is_fake = true;
1869
1870         else if (le16_to_cpu(rp->lmp_subver) <= 0x0529 &&
1871                  le16_to_cpu(rp->hci_ver) > BLUETOOTH_VER_1_2)
1872                 is_fake = true;
1873
1874         else if (le16_to_cpu(rp->lmp_subver) <= 0x0c5c &&
1875                  le16_to_cpu(rp->hci_ver) > BLUETOOTH_VER_2_0)
1876                 is_fake = true;
1877
1878         else if (le16_to_cpu(rp->lmp_subver) <= 0x1899 &&
1879                  le16_to_cpu(rp->hci_ver) > BLUETOOTH_VER_2_1)
1880                 is_fake = true;
1881
1882         else if (le16_to_cpu(rp->lmp_subver) <= 0x22bb &&
1883                  le16_to_cpu(rp->hci_ver) > BLUETOOTH_VER_4_0)
1884                 is_fake = true;
1885
1886         /* Other clones which beat all the above checks */
1887         else if (bcdDevice == 0x0134 &&
1888                  le16_to_cpu(rp->lmp_subver) == 0x0c5c &&
1889                  le16_to_cpu(rp->hci_ver) == BLUETOOTH_VER_2_0)
1890                 is_fake = true;
1891
1892         if (is_fake) {
1893                 bt_dev_warn(hdev, "CSR: Unbranded CSR clone detected; adding workarounds...");
1894
1895                 /* Generally these clones have big discrepancies between
1896                  * advertised features and what's actually supported.
1897                  * Probably will need to be expanded in the future;
1898                  * without these the controller will lock up.
1899                  */
1900                 set_bit(HCI_QUIRK_BROKEN_STORED_LINK_KEY, &hdev->quirks);
1901                 set_bit(HCI_QUIRK_BROKEN_ERR_DATA_REPORTING, &hdev->quirks);
1902
1903                 /* Clear the reset quirk since this is not an actual
1904                  * early Bluetooth 1.1 device from CSR.
1905                  */
1906                 clear_bit(HCI_QUIRK_RESET_ON_CLOSE, &hdev->quirks);
1907                 clear_bit(HCI_QUIRK_SIMULTANEOUS_DISCOVERY, &hdev->quirks);
1908
1909                 /*
1910                  * Special workaround for clones with a Barrot 8041a02 chip,
1911                  * these clones are really messed-up:
1912                  * 1. Their bulk rx endpoint will never report any data unless
1913                  * the device was suspended at least once (yes really).
1914                  * 2. They will not wakeup when autosuspended and receiving data
1915                  * on their bulk rx endpoint from e.g. a keyboard or mouse
1916                  * (IOW remote-wakeup support is broken for the bulk endpoint).
1917                  *
1918                  * To fix 1. enable runtime-suspend, force-suspend the
1919                  * hci and then wake-it up by disabling runtime-suspend.
1920                  *
1921                  * To fix 2. clear the hci's can_wake flag, this way the hci
1922                  * will still be autosuspended when it is not open.
1923                  */
1924                 if (bcdDevice == 0x8891 &&
1925                     le16_to_cpu(rp->lmp_subver) == 0x1012 &&
1926                     le16_to_cpu(rp->hci_rev) == 0x0810 &&
1927                     le16_to_cpu(rp->hci_ver) == BLUETOOTH_VER_4_0) {
1928                         bt_dev_warn(hdev, "CSR: detected a fake CSR dongle using a Barrot 8041a02 chip, this chip is very buggy and may have issues");
1929
1930                         pm_runtime_allow(&data->udev->dev);
1931
1932                         ret = pm_runtime_suspend(&data->udev->dev);
1933                         if (ret >= 0)
1934                                 msleep(200);
1935                         else
1936                                 bt_dev_err(hdev, "Failed to suspend the device for Barrot 8041a02 receive-issue workaround");
1937
1938                         pm_runtime_forbid(&data->udev->dev);
1939
1940                         device_set_wakeup_capable(&data->udev->dev, false);
1941                         /* Re-enable autosuspend if this was requested */
1942                         if (enable_autosuspend)
1943                                 usb_enable_autosuspend(data->udev);
1944                 }
1945         }
1946
1947         kfree_skb(skb);
1948
1949         return 0;
1950 }
1951
1952 static const struct firmware *btusb_setup_intel_get_fw(struct hci_dev *hdev,
1953                                                        struct intel_version *ver)
1954 {
1955         const struct firmware *fw;
1956         char fwname[64];
1957         int ret;
1958
1959         snprintf(fwname, sizeof(fwname),
1960                  "intel/ibt-hw-%x.%x.%x-fw-%x.%x.%x.%x.%x.bseq",
1961                  ver->hw_platform, ver->hw_variant, ver->hw_revision,
1962                  ver->fw_variant,  ver->fw_revision, ver->fw_build_num,
1963                  ver->fw_build_ww, ver->fw_build_yy);
1964
1965         ret = request_firmware(&fw, fwname, &hdev->dev);
1966         if (ret < 0) {
1967                 if (ret == -EINVAL) {
1968                         bt_dev_err(hdev, "Intel firmware file request failed (%d)",
1969                                    ret);
1970                         return NULL;
1971                 }
1972
1973                 bt_dev_err(hdev, "failed to open Intel firmware file: %s (%d)",
1974                            fwname, ret);
1975
1976                 /* If the correct firmware patch file is not found, use the
1977                  * default firmware patch file instead
1978                  */
1979                 snprintf(fwname, sizeof(fwname), "intel/ibt-hw-%x.%x.bseq",
1980                          ver->hw_platform, ver->hw_variant);
1981                 if (request_firmware(&fw, fwname, &hdev->dev) < 0) {
1982                         bt_dev_err(hdev, "failed to open default fw file: %s",
1983                                    fwname);
1984                         return NULL;
1985                 }
1986         }
1987
1988         bt_dev_info(hdev, "Intel Bluetooth firmware file: %s", fwname);
1989
1990         return fw;
1991 }
1992
1993 static int btusb_setup_intel_patching(struct hci_dev *hdev,
1994                                       const struct firmware *fw,
1995                                       const u8 **fw_ptr, int *disable_patch)
1996 {
1997         struct sk_buff *skb;
1998         struct hci_command_hdr *cmd;
1999         const u8 *cmd_param;
2000         struct hci_event_hdr *evt = NULL;
2001         const u8 *evt_param = NULL;
2002         int remain = fw->size - (*fw_ptr - fw->data);
2003
2004         /* The first byte indicates the types of the patch command or event.
2005          * 0x01 means HCI command and 0x02 is HCI event. If the first bytes
2006          * in the current firmware buffer doesn't start with 0x01 or
2007          * the size of remain buffer is smaller than HCI command header,
2008          * the firmware file is corrupted and it should stop the patching
2009          * process.
2010          */
2011         if (remain > HCI_COMMAND_HDR_SIZE && *fw_ptr[0] != 0x01) {
2012                 bt_dev_err(hdev, "Intel fw corrupted: invalid cmd read");
2013                 return -EINVAL;
2014         }
2015         (*fw_ptr)++;
2016         remain--;
2017
2018         cmd = (struct hci_command_hdr *)(*fw_ptr);
2019         *fw_ptr += sizeof(*cmd);
2020         remain -= sizeof(*cmd);
2021
2022         /* Ensure that the remain firmware data is long enough than the length
2023          * of command parameter. If not, the firmware file is corrupted.
2024          */
2025         if (remain < cmd->plen) {
2026                 bt_dev_err(hdev, "Intel fw corrupted: invalid cmd len");
2027                 return -EFAULT;
2028         }
2029
2030         /* If there is a command that loads a patch in the firmware
2031          * file, then enable the patch upon success, otherwise just
2032          * disable the manufacturer mode, for example patch activation
2033          * is not required when the default firmware patch file is used
2034          * because there are no patch data to load.
2035          */
2036         if (*disable_patch && le16_to_cpu(cmd->opcode) == 0xfc8e)
2037                 *disable_patch = 0;
2038
2039         cmd_param = *fw_ptr;
2040         *fw_ptr += cmd->plen;
2041         remain -= cmd->plen;
2042
2043         /* This reads the expected events when the above command is sent to the
2044          * device. Some vendor commands expects more than one events, for
2045          * example command status event followed by vendor specific event.
2046          * For this case, it only keeps the last expected event. so the command
2047          * can be sent with __hci_cmd_sync_ev() which returns the sk_buff of
2048          * last expected event.
2049          */
2050         while (remain > HCI_EVENT_HDR_SIZE && *fw_ptr[0] == 0x02) {
2051                 (*fw_ptr)++;
2052                 remain--;
2053
2054                 evt = (struct hci_event_hdr *)(*fw_ptr);
2055                 *fw_ptr += sizeof(*evt);
2056                 remain -= sizeof(*evt);
2057
2058                 if (remain < evt->plen) {
2059                         bt_dev_err(hdev, "Intel fw corrupted: invalid evt len");
2060                         return -EFAULT;
2061                 }
2062
2063                 evt_param = *fw_ptr;
2064                 *fw_ptr += evt->plen;
2065                 remain -= evt->plen;
2066         }
2067
2068         /* Every HCI commands in the firmware file has its correspond event.
2069          * If event is not found or remain is smaller than zero, the firmware
2070          * file is corrupted.
2071          */
2072         if (!evt || !evt_param || remain < 0) {
2073                 bt_dev_err(hdev, "Intel fw corrupted: invalid evt read");
2074                 return -EFAULT;
2075         }
2076
2077         skb = __hci_cmd_sync_ev(hdev, le16_to_cpu(cmd->opcode), cmd->plen,
2078                                 cmd_param, evt->evt, HCI_INIT_TIMEOUT);
2079         if (IS_ERR(skb)) {
2080                 bt_dev_err(hdev, "sending Intel patch command (0x%4.4x) failed (%ld)",
2081                            cmd->opcode, PTR_ERR(skb));
2082                 return PTR_ERR(skb);
2083         }
2084
2085         /* It ensures that the returned event matches the event data read from
2086          * the firmware file. At fist, it checks the length and then
2087          * the contents of the event.
2088          */
2089         if (skb->len != evt->plen) {
2090                 bt_dev_err(hdev, "mismatch event length (opcode 0x%4.4x)",
2091                            le16_to_cpu(cmd->opcode));
2092                 kfree_skb(skb);
2093                 return -EFAULT;
2094         }
2095
2096         if (memcmp(skb->data, evt_param, evt->plen)) {
2097                 bt_dev_err(hdev, "mismatch event parameter (opcode 0x%4.4x)",
2098                            le16_to_cpu(cmd->opcode));
2099                 kfree_skb(skb);
2100                 return -EFAULT;
2101         }
2102         kfree_skb(skb);
2103
2104         return 0;
2105 }
2106
2107 static int btusb_setup_intel(struct hci_dev *hdev)
2108 {
2109         struct sk_buff *skb;
2110         const struct firmware *fw;
2111         const u8 *fw_ptr;
2112         int disable_patch, err;
2113         struct intel_version ver;
2114
2115         BT_DBG("%s", hdev->name);
2116
2117         /* The controller has a bug with the first HCI command sent to it
2118          * returning number of completed commands as zero. This would stall the
2119          * command processing in the Bluetooth core.
2120          *
2121          * As a workaround, send HCI Reset command first which will reset the
2122          * number of completed commands and allow normal command processing
2123          * from now on.
2124          */
2125         skb = __hci_cmd_sync(hdev, HCI_OP_RESET, 0, NULL, HCI_INIT_TIMEOUT);
2126         if (IS_ERR(skb)) {
2127                 bt_dev_err(hdev, "sending initial HCI reset command failed (%ld)",
2128                            PTR_ERR(skb));
2129                 return PTR_ERR(skb);
2130         }
2131         kfree_skb(skb);
2132
2133         /* Read Intel specific controller version first to allow selection of
2134          * which firmware file to load.
2135          *
2136          * The returned information are hardware variant and revision plus
2137          * firmware variant, revision and build number.
2138          */
2139         err = btintel_read_version(hdev, &ver);
2140         if (err)
2141                 return err;
2142
2143         bt_dev_info(hdev, "read Intel version: %02x%02x%02x%02x%02x%02x%02x%02x%02x",
2144                     ver.hw_platform, ver.hw_variant, ver.hw_revision,
2145                     ver.fw_variant,  ver.fw_revision, ver.fw_build_num,
2146                     ver.fw_build_ww, ver.fw_build_yy, ver.fw_patch_num);
2147
2148         /* fw_patch_num indicates the version of patch the device currently
2149          * have. If there is no patch data in the device, it is always 0x00.
2150          * So, if it is other than 0x00, no need to patch the device again.
2151          */
2152         if (ver.fw_patch_num) {
2153                 bt_dev_info(hdev, "Intel device is already patched. "
2154                             "patch num: %02x", ver.fw_patch_num);
2155                 goto complete;
2156         }
2157
2158         /* Opens the firmware patch file based on the firmware version read
2159          * from the controller. If it fails to open the matching firmware
2160          * patch file, it tries to open the default firmware patch file.
2161          * If no patch file is found, allow the device to operate without
2162          * a patch.
2163          */
2164         fw = btusb_setup_intel_get_fw(hdev, &ver);
2165         if (!fw)
2166                 goto complete;
2167         fw_ptr = fw->data;
2168
2169         /* Enable the manufacturer mode of the controller.
2170          * Only while this mode is enabled, the driver can download the
2171          * firmware patch data and configuration parameters.
2172          */
2173         err = btintel_enter_mfg(hdev);
2174         if (err) {
2175                 release_firmware(fw);
2176                 return err;
2177         }
2178
2179         disable_patch = 1;
2180
2181         /* The firmware data file consists of list of Intel specific HCI
2182          * commands and its expected events. The first byte indicates the
2183          * type of the message, either HCI command or HCI event.
2184          *
2185          * It reads the command and its expected event from the firmware file,
2186          * and send to the controller. Once __hci_cmd_sync_ev() returns,
2187          * the returned event is compared with the event read from the firmware
2188          * file and it will continue until all the messages are downloaded to
2189          * the controller.
2190          *
2191          * Once the firmware patching is completed successfully,
2192          * the manufacturer mode is disabled with reset and activating the
2193          * downloaded patch.
2194          *
2195          * If the firmware patching fails, the manufacturer mode is
2196          * disabled with reset and deactivating the patch.
2197          *
2198          * If the default patch file is used, no reset is done when disabling
2199          * the manufacturer.
2200          */
2201         while (fw->size > fw_ptr - fw->data) {
2202                 int ret;
2203
2204                 ret = btusb_setup_intel_patching(hdev, fw, &fw_ptr,
2205                                                  &disable_patch);
2206                 if (ret < 0)
2207                         goto exit_mfg_deactivate;
2208         }
2209
2210         release_firmware(fw);
2211
2212         if (disable_patch)
2213                 goto exit_mfg_disable;
2214
2215         /* Patching completed successfully and disable the manufacturer mode
2216          * with reset and activate the downloaded firmware patches.
2217          */
2218         err = btintel_exit_mfg(hdev, true, true);
2219         if (err)
2220                 return err;
2221
2222         /* Need build number for downloaded fw patches in
2223          * every power-on boot
2224          */
2225        err = btintel_read_version(hdev, &ver);
2226        if (err)
2227                return err;
2228        bt_dev_info(hdev, "Intel BT fw patch 0x%02x completed & activated",
2229                    ver.fw_patch_num);
2230
2231         goto complete;
2232
2233 exit_mfg_disable:
2234         /* Disable the manufacturer mode without reset */
2235         err = btintel_exit_mfg(hdev, false, false);
2236         if (err)
2237                 return err;
2238
2239         bt_dev_info(hdev, "Intel firmware patch completed");
2240
2241         goto complete;
2242
2243 exit_mfg_deactivate:
2244         release_firmware(fw);
2245
2246         /* Patching failed. Disable the manufacturer mode with reset and
2247          * deactivate the downloaded firmware patches.
2248          */
2249         err = btintel_exit_mfg(hdev, true, false);
2250         if (err)
2251                 return err;
2252
2253         bt_dev_info(hdev, "Intel firmware patch completed and deactivated");
2254
2255 complete:
2256         /* Set the event mask for Intel specific vendor events. This enables
2257          * a few extra events that are useful during general operation.
2258          */
2259         btintel_set_event_mask_mfg(hdev, false);
2260
2261         btintel_check_bdaddr(hdev);
2262         return 0;
2263 }
2264
2265 static int inject_cmd_complete(struct hci_dev *hdev, __u16 opcode)
2266 {
2267         struct sk_buff *skb;
2268         struct hci_event_hdr *hdr;
2269         struct hci_ev_cmd_complete *evt;
2270
2271         skb = bt_skb_alloc(sizeof(*hdr) + sizeof(*evt) + 1, GFP_KERNEL);
2272         if (!skb)
2273                 return -ENOMEM;
2274
2275         hdr = skb_put(skb, sizeof(*hdr));
2276         hdr->evt = HCI_EV_CMD_COMPLETE;
2277         hdr->plen = sizeof(*evt) + 1;
2278
2279         evt = skb_put(skb, sizeof(*evt));
2280         evt->ncmd = 0x01;
2281         evt->opcode = cpu_to_le16(opcode);
2282
2283         skb_put_u8(skb, 0x00);
2284
2285         hci_skb_pkt_type(skb) = HCI_EVENT_PKT;
2286
2287         return hci_recv_frame(hdev, skb);
2288 }
2289
2290 static int btusb_recv_bulk_intel(struct btusb_data *data, void *buffer,
2291                                  int count)
2292 {
2293         /* When the device is in bootloader mode, then it can send
2294          * events via the bulk endpoint. These events are treated the
2295          * same way as the ones received from the interrupt endpoint.
2296          */
2297         if (test_bit(BTUSB_BOOTLOADER, &data->flags))
2298                 return btusb_recv_intr(data, buffer, count);
2299
2300         return btusb_recv_bulk(data, buffer, count);
2301 }
2302
2303 static void btusb_intel_bootup(struct btusb_data *data, const void *ptr,
2304                                unsigned int len)
2305 {
2306         const struct intel_bootup *evt = ptr;
2307
2308         if (len != sizeof(*evt))
2309                 return;
2310
2311         if (test_and_clear_bit(BTUSB_BOOTING, &data->flags))
2312                 wake_up_bit(&data->flags, BTUSB_BOOTING);
2313 }
2314
2315 static void btusb_intel_secure_send_result(struct btusb_data *data,
2316                                            const void *ptr, unsigned int len)
2317 {
2318         const struct intel_secure_send_result *evt = ptr;
2319
2320         if (len != sizeof(*evt))
2321                 return;
2322
2323         if (evt->result)
2324                 set_bit(BTUSB_FIRMWARE_FAILED, &data->flags);
2325
2326         if (test_and_clear_bit(BTUSB_DOWNLOADING, &data->flags) &&
2327             test_bit(BTUSB_FIRMWARE_LOADED, &data->flags))
2328                 wake_up_bit(&data->flags, BTUSB_DOWNLOADING);
2329 }
2330
2331 static int btusb_recv_event_intel(struct hci_dev *hdev, struct sk_buff *skb)
2332 {
2333         struct btusb_data *data = hci_get_drvdata(hdev);
2334
2335         if (test_bit(BTUSB_BOOTLOADER, &data->flags)) {
2336                 struct hci_event_hdr *hdr = (void *)skb->data;
2337
2338                 if (skb->len > HCI_EVENT_HDR_SIZE && hdr->evt == 0xff &&
2339                     hdr->plen > 0) {
2340                         const void *ptr = skb->data + HCI_EVENT_HDR_SIZE + 1;
2341                         unsigned int len = skb->len - HCI_EVENT_HDR_SIZE - 1;
2342
2343                         switch (skb->data[2]) {
2344                         case 0x02:
2345                                 /* When switching to the operational firmware
2346                                  * the device sends a vendor specific event
2347                                  * indicating that the bootup completed.
2348                                  */
2349                                 btusb_intel_bootup(data, ptr, len);
2350                                 break;
2351                         case 0x06:
2352                                 /* When the firmware loading completes the
2353                                  * device sends out a vendor specific event
2354                                  * indicating the result of the firmware
2355                                  * loading.
2356                                  */
2357                                 btusb_intel_secure_send_result(data, ptr, len);
2358                                 break;
2359                         }
2360                 }
2361         }
2362
2363         return hci_recv_frame(hdev, skb);
2364 }
2365
2366 static int btusb_send_frame_intel(struct hci_dev *hdev, struct sk_buff *skb)
2367 {
2368         struct btusb_data *data = hci_get_drvdata(hdev);
2369         struct urb *urb;
2370
2371         BT_DBG("%s", hdev->name);
2372
2373         switch (hci_skb_pkt_type(skb)) {
2374         case HCI_COMMAND_PKT:
2375                 if (test_bit(BTUSB_BOOTLOADER, &data->flags)) {
2376                         struct hci_command_hdr *cmd = (void *)skb->data;
2377                         __u16 opcode = le16_to_cpu(cmd->opcode);
2378
2379                         /* When in bootloader mode and the command 0xfc09
2380                          * is received, it needs to be send down the
2381                          * bulk endpoint. So allocate a bulk URB instead.
2382                          */
2383                         if (opcode == 0xfc09)
2384                                 urb = alloc_bulk_urb(hdev, skb);
2385                         else
2386                                 urb = alloc_ctrl_urb(hdev, skb);
2387
2388                         /* When the 0xfc01 command is issued to boot into
2389                          * the operational firmware, it will actually not
2390                          * send a command complete event. To keep the flow
2391                          * control working inject that event here.
2392                          */
2393                         if (opcode == 0xfc01)
2394                                 inject_cmd_complete(hdev, opcode);
2395                 } else {
2396                         urb = alloc_ctrl_urb(hdev, skb);
2397                 }
2398                 if (IS_ERR(urb))
2399                         return PTR_ERR(urb);
2400
2401                 hdev->stat.cmd_tx++;
2402                 return submit_or_queue_tx_urb(hdev, urb);
2403
2404         case HCI_ACLDATA_PKT:
2405                 urb = alloc_bulk_urb(hdev, skb);
2406                 if (IS_ERR(urb))
2407                         return PTR_ERR(urb);
2408
2409                 hdev->stat.acl_tx++;
2410                 return submit_or_queue_tx_urb(hdev, urb);
2411
2412         case HCI_SCODATA_PKT:
2413                 if (hci_conn_num(hdev, SCO_LINK) < 1)
2414                         return -ENODEV;
2415
2416                 urb = alloc_isoc_urb(hdev, skb);
2417                 if (IS_ERR(urb))
2418                         return PTR_ERR(urb);
2419
2420                 hdev->stat.sco_tx++;
2421                 return submit_tx_urb(hdev, urb);
2422         }
2423
2424         return -EILSEQ;
2425 }
2426
2427 static int btusb_setup_intel_new_get_fw_name(struct intel_version *ver,
2428                                              struct intel_boot_params *params,
2429                                              char *fw_name, size_t len,
2430                                              const char *suffix)
2431 {
2432         switch (ver->hw_variant) {
2433         case 0x0b:      /* SfP */
2434         case 0x0c:      /* WsP */
2435                 snprintf(fw_name, len, "intel/ibt-%u-%u.%s",
2436                         le16_to_cpu(ver->hw_variant),
2437                         le16_to_cpu(params->dev_revid),
2438                         suffix);
2439                 break;
2440         case 0x11:      /* JfP */
2441         case 0x12:      /* ThP */
2442         case 0x13:      /* HrP */
2443         case 0x14:      /* CcP */
2444                 snprintf(fw_name, len, "intel/ibt-%u-%u-%u.%s",
2445                         le16_to_cpu(ver->hw_variant),
2446                         le16_to_cpu(ver->hw_revision),
2447                         le16_to_cpu(ver->fw_revision),
2448                         suffix);
2449                 break;
2450         default:
2451                 return -EINVAL;
2452         }
2453
2454         return 0;
2455 }
2456
2457 static void btusb_setup_intel_newgen_get_fw_name(const struct intel_version_tlv *ver_tlv,
2458                                                  char *fw_name, size_t len,
2459                                                  const char *suffix)
2460 {
2461         /* The firmware file name for new generation controllers will be
2462          * ibt-<cnvi_top type+cnvi_top step>-<cnvr_top type+cnvr_top step>
2463          */
2464         snprintf(fw_name, len, "intel/ibt-%04x-%04x.%s",
2465                  INTEL_CNVX_TOP_PACK_SWAB(INTEL_CNVX_TOP_TYPE(ver_tlv->cnvi_top),
2466                                           INTEL_CNVX_TOP_STEP(ver_tlv->cnvi_top)),
2467                  INTEL_CNVX_TOP_PACK_SWAB(INTEL_CNVX_TOP_TYPE(ver_tlv->cnvr_top),
2468                                           INTEL_CNVX_TOP_STEP(ver_tlv->cnvr_top)),
2469                  suffix);
2470 }
2471
2472 static int btusb_download_wait(struct hci_dev *hdev, ktime_t calltime, int msec)
2473 {
2474         struct btusb_data *data = hci_get_drvdata(hdev);
2475         ktime_t delta, rettime;
2476         unsigned long long duration;
2477         int err;
2478
2479         set_bit(BTUSB_FIRMWARE_LOADED, &data->flags);
2480
2481         bt_dev_info(hdev, "Waiting for firmware download to complete");
2482
2483         err = wait_on_bit_timeout(&data->flags, BTUSB_DOWNLOADING,
2484                                   TASK_INTERRUPTIBLE,
2485                                   msecs_to_jiffies(msec));
2486         if (err == -EINTR) {
2487                 bt_dev_err(hdev, "Firmware loading interrupted");
2488                 return err;
2489         }
2490
2491         if (err) {
2492                 bt_dev_err(hdev, "Firmware loading timeout");
2493                 return -ETIMEDOUT;
2494         }
2495
2496         if (test_bit(BTUSB_FIRMWARE_FAILED, &data->flags)) {
2497                 bt_dev_err(hdev, "Firmware loading failed");
2498                 return -ENOEXEC;
2499         }
2500
2501         rettime = ktime_get();
2502         delta = ktime_sub(rettime, calltime);
2503         duration = (unsigned long long)ktime_to_ns(delta) >> 10;
2504
2505         bt_dev_info(hdev, "Firmware loaded in %llu usecs", duration);
2506
2507         return 0;
2508 }
2509
2510 static int btusb_intel_download_firmware_newgen(struct hci_dev *hdev,
2511                                                 struct intel_version_tlv *ver,
2512                                                 u32 *boot_param)
2513 {
2514         const struct firmware *fw;
2515         char fwname[64];
2516         int err;
2517         struct btusb_data *data = hci_get_drvdata(hdev);
2518         ktime_t calltime;
2519
2520         if (!ver || !boot_param)
2521                 return -EINVAL;
2522
2523         /* The firmware variant determines if the device is in bootloader
2524          * mode or is running operational firmware. The value 0x03 identifies
2525          * the bootloader and the value 0x23 identifies the operational
2526          * firmware.
2527          *
2528          * When the operational firmware is already present, then only
2529          * the check for valid Bluetooth device address is needed. This
2530          * determines if the device will be added as configured or
2531          * unconfigured controller.
2532          *
2533          * It is not possible to use the Secure Boot Parameters in this
2534          * case since that command is only available in bootloader mode.
2535          */
2536         if (ver->img_type == 0x03) {
2537                 clear_bit(BTUSB_BOOTLOADER, &data->flags);
2538                 btintel_check_bdaddr(hdev);
2539         }
2540
2541         /* If the OTP has no valid Bluetooth device address, then there will
2542          * also be no valid address for the operational firmware.
2543          */
2544         if (!bacmp(&ver->otp_bd_addr, BDADDR_ANY)) {
2545                 bt_dev_info(hdev, "No device address configured");
2546                 set_bit(HCI_QUIRK_INVALID_BDADDR, &hdev->quirks);
2547         }
2548
2549         btusb_setup_intel_newgen_get_fw_name(ver, fwname, sizeof(fwname), "sfi");
2550         err = firmware_request_nowarn(&fw, fwname, &hdev->dev);
2551         if (err < 0) {
2552                 if (!test_bit(BTUSB_BOOTLOADER, &data->flags)) {
2553                         /* Firmware has already been loaded */
2554                         set_bit(BTUSB_FIRMWARE_LOADED, &data->flags);
2555                         return 0;
2556                 }
2557
2558                 bt_dev_err(hdev, "Failed to load Intel firmware file %s (%d)",
2559                            fwname, err);
2560
2561                 return err;
2562         }
2563
2564         bt_dev_info(hdev, "Found device firmware: %s", fwname);
2565
2566         if (fw->size < 644) {
2567                 bt_dev_err(hdev, "Invalid size of firmware file (%zu)",
2568                            fw->size);
2569                 err = -EBADF;
2570                 goto done;
2571         }
2572
2573         calltime = ktime_get();
2574
2575         set_bit(BTUSB_DOWNLOADING, &data->flags);
2576
2577         /* Start firmware downloading and get boot parameter */
2578         err = btintel_download_firmware_newgen(hdev, ver, fw, boot_param,
2579                                                INTEL_HW_VARIANT(ver->cnvi_bt),
2580                                                ver->sbe_type);
2581         if (err < 0) {
2582                 if (err == -EALREADY) {
2583                         /* Firmware has already been loaded */
2584                         set_bit(BTUSB_FIRMWARE_LOADED, &data->flags);
2585                         err = 0;
2586                         goto done;
2587                 }
2588
2589                 /* When FW download fails, send Intel Reset to retry
2590                  * FW download.
2591                  */
2592                 btintel_reset_to_bootloader(hdev);
2593                 goto done;
2594         }
2595
2596         /* Before switching the device into operational mode and with that
2597          * booting the loaded firmware, wait for the bootloader notification
2598          * that all fragments have been successfully received.
2599          *
2600          * When the event processing receives the notification, then the
2601          * BTUSB_DOWNLOADING flag will be cleared.
2602          *
2603          * The firmware loading should not take longer than 5 seconds
2604          * and thus just timeout if that happens and fail the setup
2605          * of this device.
2606          */
2607         err = btusb_download_wait(hdev, calltime, 5000);
2608         if (err == -ETIMEDOUT)
2609                 btintel_reset_to_bootloader(hdev);
2610
2611 done:
2612         release_firmware(fw);
2613         return err;
2614 }
2615
2616 static int btusb_intel_download_firmware(struct hci_dev *hdev,
2617                                          struct intel_version *ver,
2618                                          struct intel_boot_params *params,
2619                                          u32 *boot_param)
2620 {
2621         const struct firmware *fw;
2622         char fwname[64];
2623         int err;
2624         struct btusb_data *data = hci_get_drvdata(hdev);
2625         ktime_t calltime;
2626
2627         if (!ver || !params)
2628                 return -EINVAL;
2629
2630         /* The firmware variant determines if the device is in bootloader
2631          * mode or is running operational firmware. The value 0x06 identifies
2632          * the bootloader and the value 0x23 identifies the operational
2633          * firmware.
2634          *
2635          * When the operational firmware is already present, then only
2636          * the check for valid Bluetooth device address is needed. This
2637          * determines if the device will be added as configured or
2638          * unconfigured controller.
2639          *
2640          * It is not possible to use the Secure Boot Parameters in this
2641          * case since that command is only available in bootloader mode.
2642          */
2643         if (ver->fw_variant == 0x23) {
2644                 clear_bit(BTUSB_BOOTLOADER, &data->flags);
2645                 btintel_check_bdaddr(hdev);
2646
2647                 /* SfP and WsP don't seem to update the firmware version on file
2648                  * so version checking is currently possible.
2649                  */
2650                 switch (ver->hw_variant) {
2651                 case 0x0b:      /* SfP */
2652                 case 0x0c:      /* WsP */
2653                         return 0;
2654                 }
2655
2656                 /* Proceed to download to check if the version matches */
2657                 goto download;
2658         }
2659
2660         /* Read the secure boot parameters to identify the operating
2661          * details of the bootloader.
2662          */
2663         err = btintel_read_boot_params(hdev, params);
2664         if (err)
2665                 return err;
2666
2667         /* It is required that every single firmware fragment is acknowledged
2668          * with a command complete event. If the boot parameters indicate
2669          * that this bootloader does not send them, then abort the setup.
2670          */
2671         if (params->limited_cce != 0x00) {
2672                 bt_dev_err(hdev, "Unsupported Intel firmware loading method (%u)",
2673                            params->limited_cce);
2674                 return -EINVAL;
2675         }
2676
2677         /* If the OTP has no valid Bluetooth device address, then there will
2678          * also be no valid address for the operational firmware.
2679          */
2680         if (!bacmp(&params->otp_bdaddr, BDADDR_ANY)) {
2681                 bt_dev_info(hdev, "No device address configured");
2682                 set_bit(HCI_QUIRK_INVALID_BDADDR, &hdev->quirks);
2683         }
2684
2685 download:
2686         /* With this Intel bootloader only the hardware variant and device
2687          * revision information are used to select the right firmware for SfP
2688          * and WsP.
2689          *
2690          * The firmware filename is ibt-<hw_variant>-<dev_revid>.sfi.
2691          *
2692          * Currently the supported hardware variants are:
2693          *   11 (0x0b) for iBT3.0 (LnP/SfP)
2694          *   12 (0x0c) for iBT3.5 (WsP)
2695          *
2696          * For ThP/JfP and for future SKU's, the FW name varies based on HW
2697          * variant, HW revision and FW revision, as these are dependent on CNVi
2698          * and RF Combination.
2699          *
2700          *   17 (0x11) for iBT3.5 (JfP)
2701          *   18 (0x12) for iBT3.5 (ThP)
2702          *
2703          * The firmware file name for these will be
2704          * ibt-<hw_variant>-<hw_revision>-<fw_revision>.sfi.
2705          *
2706          */
2707         err = btusb_setup_intel_new_get_fw_name(ver, params, fwname,
2708                                                 sizeof(fwname), "sfi");
2709         if (err < 0) {
2710                 if (!test_bit(BTUSB_BOOTLOADER, &data->flags)) {
2711                         /* Firmware has already been loaded */
2712                         set_bit(BTUSB_FIRMWARE_LOADED, &data->flags);
2713                         return 0;
2714                 }
2715
2716                 bt_dev_err(hdev, "Unsupported Intel firmware naming");
2717                 return -EINVAL;
2718         }
2719
2720         err = firmware_request_nowarn(&fw, fwname, &hdev->dev);
2721         if (err < 0) {
2722                 if (!test_bit(BTUSB_BOOTLOADER, &data->flags)) {
2723                         /* Firmware has already been loaded */
2724                         set_bit(BTUSB_FIRMWARE_LOADED, &data->flags);
2725                         return 0;
2726                 }
2727
2728                 bt_dev_err(hdev, "Failed to load Intel firmware file %s (%d)",
2729                            fwname, err);
2730                 return err;
2731         }
2732
2733         bt_dev_info(hdev, "Found device firmware: %s", fwname);
2734
2735         if (fw->size < 644) {
2736                 bt_dev_err(hdev, "Invalid size of firmware file (%zu)",
2737                            fw->size);
2738                 err = -EBADF;
2739                 goto done;
2740         }
2741
2742         calltime = ktime_get();
2743
2744         set_bit(BTUSB_DOWNLOADING, &data->flags);
2745
2746         /* Start firmware downloading and get boot parameter */
2747         err = btintel_download_firmware(hdev, ver, fw, boot_param);
2748         if (err < 0) {
2749                 if (err == -EALREADY) {
2750                         /* Firmware has already been loaded */
2751                         set_bit(BTUSB_FIRMWARE_LOADED, &data->flags);
2752                         err = 0;
2753                         goto done;
2754                 }
2755
2756                 /* When FW download fails, send Intel Reset to retry
2757                  * FW download.
2758                  */
2759                 btintel_reset_to_bootloader(hdev);
2760                 goto done;
2761         }
2762
2763         /* Before switching the device into operational mode and with that
2764          * booting the loaded firmware, wait for the bootloader notification
2765          * that all fragments have been successfully received.
2766          *
2767          * When the event processing receives the notification, then the
2768          * BTUSB_DOWNLOADING flag will be cleared.
2769          *
2770          * The firmware loading should not take longer than 5 seconds
2771          * and thus just timeout if that happens and fail the setup
2772          * of this device.
2773          */
2774         err = btusb_download_wait(hdev, calltime, 5000);
2775         if (err == -ETIMEDOUT)
2776                 btintel_reset_to_bootloader(hdev);
2777
2778 done:
2779         release_firmware(fw);
2780         return err;
2781 }
2782
2783 static int btusb_boot_wait(struct hci_dev *hdev, ktime_t calltime, int msec)
2784 {
2785         struct btusb_data *data = hci_get_drvdata(hdev);
2786         ktime_t delta, rettime;
2787         unsigned long long duration;
2788         int err;
2789
2790         bt_dev_info(hdev, "Waiting for device to boot");
2791
2792         err = wait_on_bit_timeout(&data->flags, BTUSB_BOOTING,
2793                                   TASK_INTERRUPTIBLE,
2794                                   msecs_to_jiffies(msec));
2795         if (err == -EINTR) {
2796                 bt_dev_err(hdev, "Device boot interrupted");
2797                 return -EINTR;
2798         }
2799
2800         if (err) {
2801                 bt_dev_err(hdev, "Device boot timeout");
2802                 return -ETIMEDOUT;
2803         }
2804
2805         rettime = ktime_get();
2806         delta = ktime_sub(rettime, calltime);
2807         duration = (unsigned long long) ktime_to_ns(delta) >> 10;
2808
2809         bt_dev_info(hdev, "Device booted in %llu usecs", duration);
2810
2811         return 0;
2812 }
2813
2814 static int btusb_intel_boot(struct hci_dev *hdev, u32 boot_addr)
2815 {
2816         struct btusb_data *data = hci_get_drvdata(hdev);
2817         ktime_t calltime;
2818         int err;
2819
2820         calltime = ktime_get();
2821
2822         set_bit(BTUSB_BOOTING, &data->flags);
2823
2824         err = btintel_send_intel_reset(hdev, boot_addr);
2825         if (err) {
2826                 bt_dev_err(hdev, "Intel Soft Reset failed (%d)", err);
2827                 btintel_reset_to_bootloader(hdev);
2828                 return err;
2829         }
2830
2831         /* The bootloader will not indicate when the device is ready. This
2832          * is done by the operational firmware sending bootup notification.
2833          *
2834          * Booting into operational firmware should not take longer than
2835          * 1 second. However if that happens, then just fail the setup
2836          * since something went wrong.
2837          */
2838         err = btusb_boot_wait(hdev, calltime, 1000);
2839         if (err == -ETIMEDOUT)
2840                 btintel_reset_to_bootloader(hdev);
2841
2842         return err;
2843 }
2844
2845 static int btusb_setup_intel_new(struct hci_dev *hdev)
2846 {
2847         struct btusb_data *data = hci_get_drvdata(hdev);
2848         struct intel_version ver;
2849         struct intel_boot_params params;
2850         u32 boot_param;
2851         char ddcname[64];
2852         int err;
2853         struct intel_debug_features features;
2854
2855         BT_DBG("%s", hdev->name);
2856
2857         /* Set the default boot parameter to 0x0 and it is updated to
2858          * SKU specific boot parameter after reading Intel_Write_Boot_Params
2859          * command while downloading the firmware.
2860          */
2861         boot_param = 0x00000000;
2862
2863         /* Read the Intel version information to determine if the device
2864          * is in bootloader mode or if it already has operational firmware
2865          * loaded.
2866          */
2867         err = btintel_read_version(hdev, &ver);
2868         if (err) {
2869                 bt_dev_err(hdev, "Intel Read version failed (%d)", err);
2870                 btintel_reset_to_bootloader(hdev);
2871                 return err;
2872         }
2873
2874         err = btintel_version_info(hdev, &ver);
2875         if (err)
2876                 return err;
2877
2878         err = btusb_intel_download_firmware(hdev, &ver, &params, &boot_param);
2879         if (err)
2880                 return err;
2881
2882         /* controller is already having an operational firmware */
2883         if (ver.fw_variant == 0x23)
2884                 goto finish;
2885
2886         err = btusb_intel_boot(hdev, boot_param);
2887         if (err)
2888                 return err;
2889
2890         clear_bit(BTUSB_BOOTLOADER, &data->flags);
2891
2892         err = btusb_setup_intel_new_get_fw_name(&ver, &params, ddcname,
2893                                                 sizeof(ddcname), "ddc");
2894
2895         if (err < 0) {
2896                 bt_dev_err(hdev, "Unsupported Intel firmware naming");
2897         } else {
2898                 /* Once the device is running in operational mode, it needs to
2899                  * apply the device configuration (DDC) parameters.
2900                  *
2901                  * The device can work without DDC parameters, so even if it
2902                  * fails to load the file, no need to fail the setup.
2903                  */
2904                 btintel_load_ddc_config(hdev, ddcname);
2905         }
2906
2907         /* Read the Intel supported features and if new exception formats
2908          * supported, need to load the additional DDC config to enable.
2909          */
2910         btintel_read_debug_features(hdev, &features);
2911
2912         /* Set DDC mask for available debug features */
2913         btintel_set_debug_features(hdev, &features);
2914
2915         /* Read the Intel version information after loading the FW  */
2916         err = btintel_read_version(hdev, &ver);
2917         if (err)
2918                 return err;
2919
2920         btintel_version_info(hdev, &ver);
2921
2922 finish:
2923         /* All Intel controllers that support the Microsoft vendor
2924          * extension are using 0xFC1E for VsMsftOpCode.
2925          */
2926         switch (ver.hw_variant) {
2927         case 0x11:      /* JfP */
2928         case 0x12:      /* ThP */
2929         case 0x13:      /* HrP */
2930         case 0x14:      /* CcP */
2931                 hci_set_msft_opcode(hdev, 0xFC1E);
2932                 break;
2933         }
2934
2935         /* Set the event mask for Intel specific vendor events. This enables
2936          * a few extra events that are useful during general operation. It
2937          * does not enable any debugging related events.
2938          *
2939          * The device will function correctly without these events enabled
2940          * and thus no need to fail the setup.
2941          */
2942         btintel_set_event_mask(hdev, false);
2943
2944         return 0;
2945 }
2946
2947 static int btusb_setup_intel_newgen(struct hci_dev *hdev)
2948 {
2949         struct btusb_data *data = hci_get_drvdata(hdev);
2950         u32 boot_param;
2951         char ddcname[64];
2952         int err;
2953         struct intel_debug_features features;
2954         struct intel_version_tlv version;
2955
2956         bt_dev_dbg(hdev, "");
2957
2958         /* Set the default boot parameter to 0x0 and it is updated to
2959          * SKU specific boot parameter after reading Intel_Write_Boot_Params
2960          * command while downloading the firmware.
2961          */
2962         boot_param = 0x00000000;
2963
2964         /* Read the Intel version information to determine if the device
2965          * is in bootloader mode or if it already has operational firmware
2966          * loaded.
2967          */
2968         err = btintel_read_version_tlv(hdev, &version);
2969         if (err) {
2970                 bt_dev_err(hdev, "Intel Read version failed (%d)", err);
2971                 btintel_reset_to_bootloader(hdev);
2972                 return err;
2973         }
2974
2975         err = btintel_version_info_tlv(hdev, &version);
2976         if (err)
2977                 return err;
2978
2979         err = btusb_intel_download_firmware_newgen(hdev, &version, &boot_param);
2980         if (err)
2981                 return err;
2982
2983         /* check if controller is already having an operational firmware */
2984         if (version.img_type == 0x03)
2985                 goto finish;
2986
2987         err = btusb_intel_boot(hdev, boot_param);
2988         if (err)
2989                 return err;
2990
2991         clear_bit(BTUSB_BOOTLOADER, &data->flags);
2992
2993         btusb_setup_intel_newgen_get_fw_name(&version, ddcname, sizeof(ddcname),
2994                                              "ddc");
2995         /* Once the device is running in operational mode, it needs to
2996          * apply the device configuration (DDC) parameters.
2997          *
2998          * The device can work without DDC parameters, so even if it
2999          * fails to load the file, no need to fail the setup.
3000          */
3001         btintel_load_ddc_config(hdev, ddcname);
3002
3003         /* Read the Intel supported features and if new exception formats
3004          * supported, need to load the additional DDC config to enable.
3005          */
3006         btintel_read_debug_features(hdev, &features);
3007
3008         /* Set DDC mask for available debug features */
3009         btintel_set_debug_features(hdev, &features);
3010
3011         /* Read the Intel version information after loading the FW  */
3012         err = btintel_read_version_tlv(hdev, &version);
3013         if (err)
3014                 return err;
3015
3016         btintel_version_info_tlv(hdev, &version);
3017
3018 finish:
3019         /* Set the event mask for Intel specific vendor events. This enables
3020          * a few extra events that are useful during general operation. It
3021          * does not enable any debugging related events.
3022          *
3023          * The device will function correctly without these events enabled
3024          * and thus no need to fail the setup.
3025          */
3026         btintel_set_event_mask(hdev, false);
3027
3028         return 0;
3029 }
3030 static int btusb_shutdown_intel(struct hci_dev *hdev)
3031 {
3032         struct sk_buff *skb;
3033         long ret;
3034
3035         /* In the shutdown sequence where Bluetooth is turned off followed
3036          * by WiFi being turned off, turning WiFi back on causes issue with
3037          * the RF calibration.
3038          *
3039          * To ensure that any RF activity has been stopped, issue HCI Reset
3040          * command to clear all ongoing activity including advertising,
3041          * scanning etc.
3042          */
3043         skb = __hci_cmd_sync(hdev, HCI_OP_RESET, 0, NULL, HCI_INIT_TIMEOUT);
3044         if (IS_ERR(skb)) {
3045                 ret = PTR_ERR(skb);
3046                 bt_dev_err(hdev, "HCI reset during shutdown failed");
3047                 return ret;
3048         }
3049         kfree_skb(skb);
3050
3051         /* Some platforms have an issue with BT LED when the interface is
3052          * down or BT radio is turned off, which takes 5 seconds to BT LED
3053          * goes off. This command turns off the BT LED immediately.
3054          */
3055         skb = __hci_cmd_sync(hdev, 0xfc3f, 0, NULL, HCI_INIT_TIMEOUT);
3056         if (IS_ERR(skb)) {
3057                 ret = PTR_ERR(skb);
3058                 bt_dev_err(hdev, "turning off Intel device LED failed");
3059                 return ret;
3060         }
3061         kfree_skb(skb);
3062
3063         return 0;
3064 }
3065
3066 static int btusb_shutdown_intel_new(struct hci_dev *hdev)
3067 {
3068         struct sk_buff *skb;
3069
3070         /* Send HCI Reset to the controller to stop any BT activity which
3071          * were triggered. This will help to save power and maintain the
3072          * sync b/w Host and controller
3073          */
3074         skb = __hci_cmd_sync(hdev, HCI_OP_RESET, 0, NULL, HCI_INIT_TIMEOUT);
3075         if (IS_ERR(skb)) {
3076                 bt_dev_err(hdev, "HCI reset during shutdown failed");
3077                 return PTR_ERR(skb);
3078         }
3079         kfree_skb(skb);
3080
3081         return 0;
3082 }
3083
3084 #define FIRMWARE_MT7663         "mediatek/mt7663pr2h.bin"
3085 #define FIRMWARE_MT7668         "mediatek/mt7668pr2h.bin"
3086
3087 #define HCI_WMT_MAX_EVENT_SIZE          64
3088 /* It is for mt79xx download rom patch*/
3089 #define MTK_FW_ROM_PATCH_HEADER_SIZE    32
3090 #define MTK_FW_ROM_PATCH_GD_SIZE        64
3091 #define MTK_FW_ROM_PATCH_SEC_MAP_SIZE   64
3092 #define MTK_SEC_MAP_COMMON_SIZE 12
3093 #define MTK_SEC_MAP_NEED_SEND_SIZE      52
3094
3095 enum {
3096         BTMTK_WMT_PATCH_DWNLD = 0x1,
3097         BTMTK_WMT_FUNC_CTRL = 0x6,
3098         BTMTK_WMT_RST = 0x7,
3099         BTMTK_WMT_SEMAPHORE = 0x17,
3100 };
3101
3102 enum {
3103         BTMTK_WMT_INVALID,
3104         BTMTK_WMT_PATCH_UNDONE,
3105         BTMTK_WMT_PATCH_PROGRESS,
3106         BTMTK_WMT_PATCH_DONE,
3107         BTMTK_WMT_ON_UNDONE,
3108         BTMTK_WMT_ON_DONE,
3109         BTMTK_WMT_ON_PROGRESS,
3110 };
3111
3112 struct btmtk_wmt_hdr {
3113         u8      dir;
3114         u8      op;
3115         __le16  dlen;
3116         u8      flag;
3117 } __packed;
3118
3119 struct btmtk_hci_wmt_cmd {
3120         struct btmtk_wmt_hdr hdr;
3121         u8 data[];
3122 } __packed;
3123
3124 struct btmtk_hci_wmt_evt {
3125         struct hci_event_hdr hhdr;
3126         struct btmtk_wmt_hdr whdr;
3127 } __packed;
3128
3129 struct btmtk_hci_wmt_evt_funcc {
3130         struct btmtk_hci_wmt_evt hwhdr;
3131         __be16 status;
3132 } __packed;
3133
3134 struct btmtk_tci_sleep {
3135         u8 mode;
3136         __le16 duration;
3137         __le16 host_duration;
3138         u8 host_wakeup_pin;
3139         u8 time_compensation;
3140 } __packed;
3141
3142 struct btmtk_hci_wmt_params {
3143         u8 op;
3144         u8 flag;
3145         u16 dlen;
3146         const void *data;
3147         u32 *status;
3148 };
3149
3150 struct btmtk_patch_header {
3151         u8 datetime[16];
3152         u8 platform[4];
3153         __le16 hwver;
3154         __le16 swver;
3155         __le32 magicnum;
3156 } __packed;
3157
3158 struct btmtk_global_desc {
3159         __le32 patch_ver;
3160         __le32 sub_sys;
3161         __le32 feature_opt;
3162         __le32 section_num;
3163 } __packed;
3164
3165 struct btmtk_section_map {
3166         __le32 sectype;
3167         __le32 secoffset;
3168         __le32 secsize;
3169         union {
3170                 __le32 u4SecSpec[13];
3171                 struct {
3172                         __le32 dlAddr;
3173                         __le32 dlsize;
3174                         __le32 seckeyidx;
3175                         __le32 alignlen;
3176                         __le32 sectype;
3177                         __le32 dlmodecrctype;
3178                         __le32 crc;
3179                         __le32 reserved[6];
3180                 } bin_info_spec;
3181         };
3182 } __packed;
3183
3184 static void btusb_mtk_wmt_recv(struct urb *urb)
3185 {
3186         struct hci_dev *hdev = urb->context;
3187         struct btusb_data *data = hci_get_drvdata(hdev);
3188         struct hci_event_hdr *hdr;
3189         struct sk_buff *skb;
3190         int err;
3191
3192         if (urb->status == 0 && urb->actual_length > 0) {
3193                 hdev->stat.byte_rx += urb->actual_length;
3194
3195                 /* WMT event shouldn't be fragmented and the size should be
3196                  * less than HCI_WMT_MAX_EVENT_SIZE.
3197                  */
3198                 skb = bt_skb_alloc(HCI_WMT_MAX_EVENT_SIZE, GFP_ATOMIC);
3199                 if (!skb) {
3200                         hdev->stat.err_rx++;
3201                         return;
3202                 }
3203
3204                 hci_skb_pkt_type(skb) = HCI_EVENT_PKT;
3205                 skb_put_data(skb, urb->transfer_buffer, urb->actual_length);
3206
3207                 hdr = (void *)skb->data;
3208                 /* Fix up the vendor event id with 0xff for vendor specific
3209                  * instead of 0xe4 so that event send via monitoring socket can
3210                  * be parsed properly.
3211                  */
3212                 hdr->evt = 0xff;
3213
3214                 /* When someone waits for the WMT event, the skb is being cloned
3215                  * and being processed the events from there then.
3216                  */
3217                 if (test_bit(BTUSB_TX_WAIT_VND_EVT, &data->flags)) {
3218                         data->evt_skb = skb_clone(skb, GFP_ATOMIC);
3219                         if (!data->evt_skb) {
3220                                 kfree_skb(skb);
3221                                 return;
3222                         }
3223                 }
3224
3225                 err = hci_recv_frame(hdev, skb);
3226                 if (err < 0) {
3227                         kfree_skb(data->evt_skb);
3228                         data->evt_skb = NULL;
3229                         return;
3230                 }
3231
3232                 if (test_and_clear_bit(BTUSB_TX_WAIT_VND_EVT,
3233                                        &data->flags)) {
3234                         /* Barrier to sync with other CPUs */
3235                         smp_mb__after_atomic();
3236                         wake_up_bit(&data->flags,
3237                                     BTUSB_TX_WAIT_VND_EVT);
3238                 }
3239                 return;
3240         } else if (urb->status == -ENOENT) {
3241                 /* Avoid suspend failed when usb_kill_urb */
3242                 return;
3243         }
3244
3245         usb_mark_last_busy(data->udev);
3246
3247         /* The URB complete handler is still called with urb->actual_length = 0
3248          * when the event is not available, so we should keep re-submitting
3249          * URB until WMT event returns, Also, It's necessary to wait some time
3250          * between the two consecutive control URBs to relax the target device
3251          * to generate the event. Otherwise, the WMT event cannot return from
3252          * the device successfully.
3253          */
3254         udelay(500);
3255
3256         usb_anchor_urb(urb, &data->ctrl_anchor);
3257         err = usb_submit_urb(urb, GFP_ATOMIC);
3258         if (err < 0) {
3259                 /* -EPERM: urb is being killed;
3260                  * -ENODEV: device got disconnected
3261                  */
3262                 if (err != -EPERM && err != -ENODEV)
3263                         bt_dev_err(hdev, "urb %p failed to resubmit (%d)",
3264                                    urb, -err);
3265                 usb_unanchor_urb(urb);
3266         }
3267 }
3268
3269 static int btusb_mtk_submit_wmt_recv_urb(struct hci_dev *hdev)
3270 {
3271         struct btusb_data *data = hci_get_drvdata(hdev);
3272         struct usb_ctrlrequest *dr;
3273         unsigned char *buf;
3274         int err, size = 64;
3275         unsigned int pipe;
3276         struct urb *urb;
3277
3278         urb = usb_alloc_urb(0, GFP_KERNEL);
3279         if (!urb)
3280                 return -ENOMEM;
3281
3282         dr = kmalloc(sizeof(*dr), GFP_KERNEL);
3283         if (!dr) {
3284                 usb_free_urb(urb);
3285                 return -ENOMEM;
3286         }
3287
3288         dr->bRequestType = USB_TYPE_VENDOR | USB_DIR_IN;
3289         dr->bRequest     = 1;
3290         dr->wIndex       = cpu_to_le16(0);
3291         dr->wValue       = cpu_to_le16(48);
3292         dr->wLength      = cpu_to_le16(size);
3293
3294         buf = kmalloc(size, GFP_KERNEL);
3295         if (!buf) {
3296                 kfree(dr);
3297                 usb_free_urb(urb);
3298                 return -ENOMEM;
3299         }
3300
3301         pipe = usb_rcvctrlpipe(data->udev, 0);
3302
3303         usb_fill_control_urb(urb, data->udev, pipe, (void *)dr,
3304                              buf, size, btusb_mtk_wmt_recv, hdev);
3305
3306         urb->transfer_flags |= URB_FREE_BUFFER;
3307
3308         usb_anchor_urb(urb, &data->ctrl_anchor);
3309         err = usb_submit_urb(urb, GFP_KERNEL);
3310         if (err < 0) {
3311                 if (err != -EPERM && err != -ENODEV)
3312                         bt_dev_err(hdev, "urb %p submission failed (%d)",
3313                                    urb, -err);
3314                 usb_unanchor_urb(urb);
3315         }
3316
3317         usb_free_urb(urb);
3318
3319         return err;
3320 }
3321
3322 static int btusb_mtk_hci_wmt_sync(struct hci_dev *hdev,
3323                                   struct btmtk_hci_wmt_params *wmt_params)
3324 {
3325         struct btusb_data *data = hci_get_drvdata(hdev);
3326         struct btmtk_hci_wmt_evt_funcc *wmt_evt_funcc;
3327         u32 hlen, status = BTMTK_WMT_INVALID;
3328         struct btmtk_hci_wmt_evt *wmt_evt;
3329         struct btmtk_hci_wmt_cmd *wc;
3330         struct btmtk_wmt_hdr *hdr;
3331         int err;
3332
3333         /* Send the WMT command and wait until the WMT event returns */
3334         hlen = sizeof(*hdr) + wmt_params->dlen;
3335         if (hlen > 255)
3336                 return -EINVAL;
3337
3338         wc = kzalloc(hlen, GFP_KERNEL);
3339         if (!wc)
3340                 return -ENOMEM;
3341
3342         hdr = &wc->hdr;
3343         hdr->dir = 1;
3344         hdr->op = wmt_params->op;
3345         hdr->dlen = cpu_to_le16(wmt_params->dlen + 1);
3346         hdr->flag = wmt_params->flag;
3347         memcpy(wc->data, wmt_params->data, wmt_params->dlen);
3348
3349         set_bit(BTUSB_TX_WAIT_VND_EVT, &data->flags);
3350
3351         err = __hci_cmd_send(hdev, 0xfc6f, hlen, wc);
3352
3353         if (err < 0) {
3354                 clear_bit(BTUSB_TX_WAIT_VND_EVT, &data->flags);
3355                 goto err_free_wc;
3356         }
3357
3358         /* Submit control IN URB on demand to process the WMT event */
3359         err = btusb_mtk_submit_wmt_recv_urb(hdev);
3360         if (err < 0)
3361                 goto err_free_wc;
3362
3363         /* The vendor specific WMT commands are all answered by a vendor
3364          * specific event and will have the Command Status or Command
3365          * Complete as with usual HCI command flow control.
3366          *
3367          * After sending the command, wait for BTUSB_TX_WAIT_VND_EVT
3368          * state to be cleared. The driver specific event receive routine
3369          * will clear that state and with that indicate completion of the
3370          * WMT command.
3371          */
3372         err = wait_on_bit_timeout(&data->flags, BTUSB_TX_WAIT_VND_EVT,
3373                                   TASK_INTERRUPTIBLE, HCI_INIT_TIMEOUT);
3374         if (err == -EINTR) {
3375                 bt_dev_err(hdev, "Execution of wmt command interrupted");
3376                 clear_bit(BTUSB_TX_WAIT_VND_EVT, &data->flags);
3377                 goto err_free_wc;
3378         }
3379
3380         if (err) {
3381                 bt_dev_err(hdev, "Execution of wmt command timed out");
3382                 clear_bit(BTUSB_TX_WAIT_VND_EVT, &data->flags);
3383                 err = -ETIMEDOUT;
3384                 goto err_free_wc;
3385         }
3386
3387         /* Parse and handle the return WMT event */
3388         wmt_evt = (struct btmtk_hci_wmt_evt *)data->evt_skb->data;
3389         if (wmt_evt->whdr.op != hdr->op) {
3390                 bt_dev_err(hdev, "Wrong op received %d expected %d",
3391                            wmt_evt->whdr.op, hdr->op);
3392                 err = -EIO;
3393                 goto err_free_skb;
3394         }
3395
3396         switch (wmt_evt->whdr.op) {
3397         case BTMTK_WMT_SEMAPHORE:
3398                 if (wmt_evt->whdr.flag == 2)
3399                         status = BTMTK_WMT_PATCH_UNDONE;
3400                 else
3401                         status = BTMTK_WMT_PATCH_DONE;
3402                 break;
3403         case BTMTK_WMT_FUNC_CTRL:
3404                 wmt_evt_funcc = (struct btmtk_hci_wmt_evt_funcc *)wmt_evt;
3405                 if (be16_to_cpu(wmt_evt_funcc->status) == 0x404)
3406                         status = BTMTK_WMT_ON_DONE;
3407                 else if (be16_to_cpu(wmt_evt_funcc->status) == 0x420)
3408                         status = BTMTK_WMT_ON_PROGRESS;
3409                 else
3410                         status = BTMTK_WMT_ON_UNDONE;
3411                 break;
3412         case BTMTK_WMT_PATCH_DWNLD:
3413                 if (wmt_evt->whdr.flag == 2)
3414                         status = BTMTK_WMT_PATCH_DONE;
3415                 else if (wmt_evt->whdr.flag == 1)
3416                         status = BTMTK_WMT_PATCH_PROGRESS;
3417                 else
3418                         status = BTMTK_WMT_PATCH_UNDONE;
3419                 break;
3420         }
3421
3422         if (wmt_params->status)
3423                 *wmt_params->status = status;
3424
3425 err_free_skb:
3426         kfree_skb(data->evt_skb);
3427         data->evt_skb = NULL;
3428 err_free_wc:
3429         kfree(wc);
3430         return err;
3431 }
3432
3433 static int btusb_mtk_setup_firmware_79xx(struct hci_dev *hdev, const char *fwname)
3434 {
3435         struct btmtk_hci_wmt_params wmt_params;
3436         struct btmtk_global_desc *globaldesc = NULL;
3437         struct btmtk_section_map *sectionmap;
3438         const struct firmware *fw;
3439         const u8 *fw_ptr;
3440         const u8 *fw_bin_ptr;
3441         int err, dlen, i, status;
3442         u8 flag, first_block, retry;
3443         u32 section_num, dl_size, section_offset;
3444         u8 cmd[64];
3445
3446         err = request_firmware(&fw, fwname, &hdev->dev);
3447         if (err < 0) {
3448                 bt_dev_err(hdev, "Failed to load firmware file (%d)", err);
3449                 return err;
3450         }
3451
3452         fw_ptr = fw->data;
3453         fw_bin_ptr = fw_ptr;
3454         globaldesc = (struct btmtk_global_desc *)(fw_ptr + MTK_FW_ROM_PATCH_HEADER_SIZE);
3455         section_num = le32_to_cpu(globaldesc->section_num);
3456
3457         for (i = 0; i < section_num; i++) {
3458                 first_block = 1;
3459                 fw_ptr = fw_bin_ptr;
3460                 sectionmap = (struct btmtk_section_map *)(fw_ptr + MTK_FW_ROM_PATCH_HEADER_SIZE +
3461                               MTK_FW_ROM_PATCH_GD_SIZE + MTK_FW_ROM_PATCH_SEC_MAP_SIZE * i);
3462
3463                 section_offset = le32_to_cpu(sectionmap->secoffset);
3464                 dl_size = le32_to_cpu(sectionmap->bin_info_spec.dlsize);
3465
3466                 if (dl_size > 0) {
3467                         retry = 20;
3468                         while (retry > 0) {
3469                                 cmd[0] = 0; /* 0 means legacy dl mode. */
3470                                 memcpy(cmd + 1,
3471                                        fw_ptr + MTK_FW_ROM_PATCH_HEADER_SIZE +
3472                                        MTK_FW_ROM_PATCH_GD_SIZE + MTK_FW_ROM_PATCH_SEC_MAP_SIZE * i +
3473                                        MTK_SEC_MAP_COMMON_SIZE,
3474                                        MTK_SEC_MAP_NEED_SEND_SIZE + 1);
3475
3476                                 wmt_params.op = BTMTK_WMT_PATCH_DWNLD;
3477                                 wmt_params.status = &status;
3478                                 wmt_params.flag = 0;
3479                                 wmt_params.dlen = MTK_SEC_MAP_NEED_SEND_SIZE + 1;
3480                                 wmt_params.data = &cmd;
3481
3482                                 err = btusb_mtk_hci_wmt_sync(hdev, &wmt_params);
3483                                 if (err < 0) {
3484                                         bt_dev_err(hdev, "Failed to send wmt patch dwnld (%d)",
3485                                                    err);
3486                                         goto err_release_fw;
3487                                 }
3488
3489                                 if (status == BTMTK_WMT_PATCH_UNDONE) {
3490                                         break;
3491                                 } else if (status == BTMTK_WMT_PATCH_PROGRESS) {
3492                                         msleep(100);
3493                                         retry--;
3494                                 } else if (status == BTMTK_WMT_PATCH_DONE) {
3495                                         goto next_section;
3496                                 } else {
3497                                         bt_dev_err(hdev, "Failed wmt patch dwnld status (%d)",
3498                                                    status);
3499                                         goto err_release_fw;
3500                                 }
3501                         }
3502
3503                         fw_ptr += section_offset;
3504                         wmt_params.op = BTMTK_WMT_PATCH_DWNLD;
3505                         wmt_params.status = NULL;
3506
3507                         while (dl_size > 0) {
3508                                 dlen = min_t(int, 250, dl_size);
3509                                 if (first_block == 1) {
3510                                         flag = 1;
3511                                         first_block = 0;
3512                                 } else if (dl_size - dlen <= 0) {
3513                                         flag = 3;
3514                                 } else {
3515                                         flag = 2;
3516                                 }
3517
3518                                 wmt_params.flag = flag;
3519                                 wmt_params.dlen = dlen;
3520                                 wmt_params.data = fw_ptr;
3521
3522                                 err = btusb_mtk_hci_wmt_sync(hdev, &wmt_params);
3523                                 if (err < 0) {
3524                                         bt_dev_err(hdev, "Failed to send wmt patch dwnld (%d)",
3525                                                    err);
3526                                         goto err_release_fw;
3527                                 }
3528
3529                                 dl_size -= dlen;
3530                                 fw_ptr += dlen;
3531                         }
3532                 }
3533 next_section:
3534                 continue;
3535         }
3536         /* Wait a few moments for firmware activation done */
3537         usleep_range(100000, 120000);
3538
3539 err_release_fw:
3540         release_firmware(fw);
3541
3542         return err;
3543 }
3544
3545 static int btusb_mtk_setup_firmware(struct hci_dev *hdev, const char *fwname)
3546 {
3547         struct btmtk_hci_wmt_params wmt_params;
3548         const struct firmware *fw;
3549         const u8 *fw_ptr;
3550         size_t fw_size;
3551         int err, dlen;
3552         u8 flag, param;
3553
3554         err = request_firmware(&fw, fwname, &hdev->dev);
3555         if (err < 0) {
3556                 bt_dev_err(hdev, "Failed to load firmware file (%d)", err);
3557                 return err;
3558         }
3559
3560         /* Power on data RAM the firmware relies on. */
3561         param = 1;
3562         wmt_params.op = BTMTK_WMT_FUNC_CTRL;
3563         wmt_params.flag = 3;
3564         wmt_params.dlen = sizeof(param);
3565         wmt_params.data = &param;
3566         wmt_params.status = NULL;
3567
3568         err = btusb_mtk_hci_wmt_sync(hdev, &wmt_params);
3569         if (err < 0) {
3570                 bt_dev_err(hdev, "Failed to power on data RAM (%d)", err);
3571                 goto err_release_fw;
3572         }
3573
3574         fw_ptr = fw->data;
3575         fw_size = fw->size;
3576
3577         /* The size of patch header is 30 bytes, should be skip */
3578         if (fw_size < 30) {
3579                 err = -EINVAL;
3580                 goto err_release_fw;
3581         }
3582
3583         fw_size -= 30;
3584         fw_ptr += 30;
3585         flag = 1;
3586
3587         wmt_params.op = BTMTK_WMT_PATCH_DWNLD;
3588         wmt_params.status = NULL;
3589
3590         while (fw_size > 0) {
3591                 dlen = min_t(int, 250, fw_size);
3592
3593                 /* Tell device the position in sequence */
3594                 if (fw_size - dlen <= 0)
3595                         flag = 3;
3596                 else if (fw_size < fw->size - 30)
3597                         flag = 2;
3598
3599                 wmt_params.flag = flag;
3600                 wmt_params.dlen = dlen;
3601                 wmt_params.data = fw_ptr;
3602
3603                 err = btusb_mtk_hci_wmt_sync(hdev, &wmt_params);
3604                 if (err < 0) {
3605                         bt_dev_err(hdev, "Failed to send wmt patch dwnld (%d)",
3606                                    err);
3607                         goto err_release_fw;
3608                 }
3609
3610                 fw_size -= dlen;
3611                 fw_ptr += dlen;
3612         }
3613
3614         wmt_params.op = BTMTK_WMT_RST;
3615         wmt_params.flag = 4;
3616         wmt_params.dlen = 0;
3617         wmt_params.data = NULL;
3618         wmt_params.status = NULL;
3619
3620         /* Activate funciton the firmware providing to */
3621         err = btusb_mtk_hci_wmt_sync(hdev, &wmt_params);
3622         if (err < 0) {
3623                 bt_dev_err(hdev, "Failed to send wmt rst (%d)", err);
3624                 goto err_release_fw;
3625         }
3626
3627         /* Wait a few moments for firmware activation done */
3628         usleep_range(10000, 12000);
3629
3630 err_release_fw:
3631         release_firmware(fw);
3632
3633         return err;
3634 }
3635
3636 static int btusb_mtk_func_query(struct hci_dev *hdev)
3637 {
3638         struct btmtk_hci_wmt_params wmt_params;
3639         int status, err;
3640         u8 param = 0;
3641
3642         /* Query whether the function is enabled */
3643         wmt_params.op = BTMTK_WMT_FUNC_CTRL;
3644         wmt_params.flag = 4;
3645         wmt_params.dlen = sizeof(param);
3646         wmt_params.data = &param;
3647         wmt_params.status = &status;
3648
3649         err = btusb_mtk_hci_wmt_sync(hdev, &wmt_params);
3650         if (err < 0) {
3651                 bt_dev_err(hdev, "Failed to query function status (%d)", err);
3652                 return err;
3653         }
3654
3655         return status;
3656 }
3657
3658 static int btusb_mtk_reg_read(struct btusb_data *data, u32 reg, u32 *val)
3659 {
3660         int pipe, err, size = sizeof(u32);
3661         void *buf;
3662
3663         buf = kzalloc(size, GFP_KERNEL);
3664         if (!buf)
3665                 return -ENOMEM;
3666
3667         pipe = usb_rcvctrlpipe(data->udev, 0);
3668         err = usb_control_msg(data->udev, pipe, 0x63,
3669                               USB_TYPE_VENDOR | USB_DIR_IN,
3670                               reg >> 16, reg & 0xffff,
3671                               buf, size, USB_CTRL_SET_TIMEOUT);
3672         if (err < 0)
3673                 goto err_free_buf;
3674
3675         *val = get_unaligned_le32(buf);
3676
3677 err_free_buf:
3678         kfree(buf);
3679
3680         return err;
3681 }
3682
3683 static int btusb_mtk_id_get(struct btusb_data *data, u32 reg, u32 *id)
3684 {
3685         return btusb_mtk_reg_read(data, reg, id);
3686 }
3687
3688 static int btusb_mtk_setup(struct hci_dev *hdev)
3689 {
3690         struct btusb_data *data = hci_get_drvdata(hdev);
3691         struct btmtk_hci_wmt_params wmt_params;
3692         ktime_t calltime, delta, rettime;
3693         struct btmtk_tci_sleep tci_sleep;
3694         unsigned long long duration;
3695         struct sk_buff *skb;
3696         const char *fwname;
3697         int err, status;
3698         u32 dev_id;
3699         char fw_bin_name[64];
3700         u32 fw_version = 0;
3701         u8 param;
3702
3703         calltime = ktime_get();
3704
3705         err = btusb_mtk_id_get(data, 0x80000008, &dev_id);
3706         if (err < 0) {
3707                 bt_dev_err(hdev, "Failed to get device id (%d)", err);
3708                 return err;
3709         }
3710
3711         if (!dev_id) {
3712                 err = btusb_mtk_id_get(data, 0x70010200, &dev_id);
3713                 if (err < 0) {
3714                         bt_dev_err(hdev, "Failed to get device id (%d)", err);
3715                         return err;
3716                 }
3717                 err = btusb_mtk_id_get(data, 0x80021004, &fw_version);
3718                 if (err < 0) {
3719                         bt_dev_err(hdev, "Failed to get fw version (%d)", err);
3720                         return err;
3721                 }
3722         }
3723
3724         switch (dev_id) {
3725         case 0x7663:
3726                 fwname = FIRMWARE_MT7663;
3727                 break;
3728         case 0x7668:
3729                 fwname = FIRMWARE_MT7668;
3730                 break;
3731         case 0x7961:
3732                 snprintf(fw_bin_name, sizeof(fw_bin_name),
3733                         "mediatek/BT_RAM_CODE_MT%04x_1_%x_hdr.bin",
3734                          dev_id & 0xffff, (fw_version & 0xff) + 1);
3735                 err = btusb_mtk_setup_firmware_79xx(hdev, fw_bin_name);
3736
3737                 /* Enable Bluetooth protocol */
3738                 param = 1;
3739                 wmt_params.op = BTMTK_WMT_FUNC_CTRL;
3740                 wmt_params.flag = 0;
3741                 wmt_params.dlen = sizeof(param);
3742                 wmt_params.data = &param;
3743                 wmt_params.status = NULL;
3744
3745                 err = btusb_mtk_hci_wmt_sync(hdev, &wmt_params);
3746                 if (err < 0) {
3747                         bt_dev_err(hdev, "Failed to send wmt func ctrl (%d)", err);
3748                         return err;
3749                 }
3750                 goto done;
3751         default:
3752                 bt_dev_err(hdev, "Unsupported hardware variant (%08x)",
3753                            dev_id);
3754                 return -ENODEV;
3755         }
3756
3757         /* Query whether the firmware is already download */
3758         wmt_params.op = BTMTK_WMT_SEMAPHORE;
3759         wmt_params.flag = 1;
3760         wmt_params.dlen = 0;
3761         wmt_params.data = NULL;
3762         wmt_params.status = &status;
3763
3764         err = btusb_mtk_hci_wmt_sync(hdev, &wmt_params);
3765         if (err < 0) {
3766                 bt_dev_err(hdev, "Failed to query firmware status (%d)", err);
3767                 return err;
3768         }
3769
3770         if (status == BTMTK_WMT_PATCH_DONE) {
3771                 bt_dev_info(hdev, "firmware already downloaded");
3772                 goto ignore_setup_fw;
3773         }
3774
3775         /* Setup a firmware which the device definitely requires */
3776         err = btusb_mtk_setup_firmware(hdev, fwname);
3777         if (err < 0)
3778                 return err;
3779
3780 ignore_setup_fw:
3781         err = readx_poll_timeout(btusb_mtk_func_query, hdev, status,
3782                                  status < 0 || status != BTMTK_WMT_ON_PROGRESS,
3783                                  2000, 5000000);
3784         /* -ETIMEDOUT happens */
3785         if (err < 0)
3786                 return err;
3787
3788         /* The other errors happen in btusb_mtk_func_query */
3789         if (status < 0)
3790                 return status;
3791
3792         if (status == BTMTK_WMT_ON_DONE) {
3793                 bt_dev_info(hdev, "function already on");
3794                 goto ignore_func_on;
3795         }
3796
3797         /* Enable Bluetooth protocol */
3798         param = 1;
3799         wmt_params.op = BTMTK_WMT_FUNC_CTRL;
3800         wmt_params.flag = 0;
3801         wmt_params.dlen = sizeof(param);
3802         wmt_params.data = &param;
3803         wmt_params.status = NULL;
3804
3805         err = btusb_mtk_hci_wmt_sync(hdev, &wmt_params);
3806         if (err < 0) {
3807                 bt_dev_err(hdev, "Failed to send wmt func ctrl (%d)", err);
3808                 return err;
3809         }
3810
3811 ignore_func_on:
3812         /* Apply the low power environment setup */
3813         tci_sleep.mode = 0x5;
3814         tci_sleep.duration = cpu_to_le16(0x640);
3815         tci_sleep.host_duration = cpu_to_le16(0x640);
3816         tci_sleep.host_wakeup_pin = 0;
3817         tci_sleep.time_compensation = 0;
3818
3819         skb = __hci_cmd_sync(hdev, 0xfc7a, sizeof(tci_sleep), &tci_sleep,
3820                              HCI_INIT_TIMEOUT);
3821         if (IS_ERR(skb)) {
3822                 err = PTR_ERR(skb);
3823                 bt_dev_err(hdev, "Failed to apply low power setting (%d)", err);
3824                 return err;
3825         }
3826         kfree_skb(skb);
3827
3828 done:
3829         rettime = ktime_get();
3830         delta = ktime_sub(rettime, calltime);
3831         duration = (unsigned long long)ktime_to_ns(delta) >> 10;
3832
3833         bt_dev_info(hdev, "Device setup in %llu usecs", duration);
3834
3835         return 0;
3836 }
3837
3838 static int btusb_mtk_shutdown(struct hci_dev *hdev)
3839 {
3840         struct btmtk_hci_wmt_params wmt_params;
3841         u8 param = 0;
3842         int err;
3843
3844         /* Disable the device */
3845         wmt_params.op = BTMTK_WMT_FUNC_CTRL;
3846         wmt_params.flag = 0;
3847         wmt_params.dlen = sizeof(param);
3848         wmt_params.data = &param;
3849         wmt_params.status = NULL;
3850
3851         err = btusb_mtk_hci_wmt_sync(hdev, &wmt_params);
3852         if (err < 0) {
3853                 bt_dev_err(hdev, "Failed to send wmt func ctrl (%d)", err);
3854                 return err;
3855         }
3856
3857         return 0;
3858 }
3859
3860 MODULE_FIRMWARE(FIRMWARE_MT7663);
3861 MODULE_FIRMWARE(FIRMWARE_MT7668);
3862
3863 #ifdef CONFIG_PM
3864 /* Configure an out-of-band gpio as wake-up pin, if specified in device tree */
3865 static int marvell_config_oob_wake(struct hci_dev *hdev)
3866 {
3867         struct sk_buff *skb;
3868         struct btusb_data *data = hci_get_drvdata(hdev);
3869         struct device *dev = &data->udev->dev;
3870         u16 pin, gap, opcode;
3871         int ret;
3872         u8 cmd[5];
3873
3874         /* Move on if no wakeup pin specified */
3875         if (of_property_read_u16(dev->of_node, "marvell,wakeup-pin", &pin) ||
3876             of_property_read_u16(dev->of_node, "marvell,wakeup-gap-ms", &gap))
3877                 return 0;
3878
3879         /* Vendor specific command to configure a GPIO as wake-up pin */
3880         opcode = hci_opcode_pack(0x3F, 0x59);
3881         cmd[0] = opcode & 0xFF;
3882         cmd[1] = opcode >> 8;
3883         cmd[2] = 2; /* length of parameters that follow */
3884         cmd[3] = pin;
3885         cmd[4] = gap; /* time in ms, for which wakeup pin should be asserted */
3886
3887         skb = bt_skb_alloc(sizeof(cmd), GFP_KERNEL);
3888         if (!skb) {
3889                 bt_dev_err(hdev, "%s: No memory", __func__);
3890                 return -ENOMEM;
3891         }
3892
3893         skb_put_data(skb, cmd, sizeof(cmd));
3894         hci_skb_pkt_type(skb) = HCI_COMMAND_PKT;
3895
3896         ret = btusb_send_frame(hdev, skb);
3897         if (ret) {
3898                 bt_dev_err(hdev, "%s: configuration failed", __func__);
3899                 kfree_skb(skb);
3900                 return ret;
3901         }
3902
3903         return 0;
3904 }
3905 #endif
3906
3907 static int btusb_set_bdaddr_marvell(struct hci_dev *hdev,
3908                                     const bdaddr_t *bdaddr)
3909 {
3910         struct sk_buff *skb;
3911         u8 buf[8];
3912         long ret;
3913
3914         buf[0] = 0xfe;
3915         buf[1] = sizeof(bdaddr_t);
3916         memcpy(buf + 2, bdaddr, sizeof(bdaddr_t));
3917
3918         skb = __hci_cmd_sync(hdev, 0xfc22, sizeof(buf), buf, HCI_INIT_TIMEOUT);
3919         if (IS_ERR(skb)) {
3920                 ret = PTR_ERR(skb);
3921                 bt_dev_err(hdev, "changing Marvell device address failed (%ld)",
3922                            ret);
3923                 return ret;
3924         }
3925         kfree_skb(skb);
3926
3927         return 0;
3928 }
3929
3930 static int btusb_set_bdaddr_ath3012(struct hci_dev *hdev,
3931                                     const bdaddr_t *bdaddr)
3932 {
3933         struct sk_buff *skb;
3934         u8 buf[10];
3935         long ret;
3936
3937         buf[0] = 0x01;
3938         buf[1] = 0x01;
3939         buf[2] = 0x00;
3940         buf[3] = sizeof(bdaddr_t);
3941         memcpy(buf + 4, bdaddr, sizeof(bdaddr_t));
3942
3943         skb = __hci_cmd_sync(hdev, 0xfc0b, sizeof(buf), buf, HCI_INIT_TIMEOUT);
3944         if (IS_ERR(skb)) {
3945                 ret = PTR_ERR(skb);
3946                 bt_dev_err(hdev, "Change address command failed (%ld)", ret);
3947                 return ret;
3948         }
3949         kfree_skb(skb);
3950
3951         return 0;
3952 }
3953
3954 static int btusb_set_bdaddr_wcn6855(struct hci_dev *hdev,
3955                                 const bdaddr_t *bdaddr)
3956 {
3957         struct sk_buff *skb;
3958         u8 buf[6];
3959         long ret;
3960
3961         memcpy(buf, bdaddr, sizeof(bdaddr_t));
3962
3963         skb = __hci_cmd_sync_ev(hdev, 0xfc14, sizeof(buf), buf,
3964                                 HCI_EV_CMD_COMPLETE, HCI_INIT_TIMEOUT);
3965         if (IS_ERR(skb)) {
3966                 ret = PTR_ERR(skb);
3967                 bt_dev_err(hdev, "Change address command failed (%ld)", ret);
3968                 return ret;
3969         }
3970         kfree_skb(skb);
3971
3972         return 0;
3973 }
3974
3975 #define QCA_DFU_PACKET_LEN      4096
3976
3977 #define QCA_GET_TARGET_VERSION  0x09
3978 #define QCA_CHECK_STATUS        0x05
3979 #define QCA_DFU_DOWNLOAD        0x01
3980
3981 #define QCA_SYSCFG_UPDATED      0x40
3982 #define QCA_PATCH_UPDATED       0x80
3983 #define QCA_DFU_TIMEOUT         3000
3984 #define QCA_FLAG_MULTI_NVM      0x80
3985
3986 struct qca_version {
3987         __le32  rom_version;
3988         __le32  patch_version;
3989         __le32  ram_version;
3990         __le16  board_id;
3991         __le16  flag;
3992         __u8    reserved[4];
3993 } __packed;
3994
3995 struct qca_rampatch_version {
3996         __le16  rom_version_high;
3997         __le16  rom_version_low;
3998         __le16  patch_version;
3999 } __packed;
4000
4001 struct qca_device_info {
4002         u32     rom_version;
4003         u8      rampatch_hdr;   /* length of header in rampatch */
4004         u8      nvm_hdr;        /* length of header in NVM */
4005         u8      ver_offset;     /* offset of version structure in rampatch */
4006 };
4007
4008 static const struct qca_device_info qca_devices_table[] = {
4009         { 0x00000100, 20, 4,  8 }, /* Rome 1.0 */
4010         { 0x00000101, 20, 4,  8 }, /* Rome 1.1 */
4011         { 0x00000200, 28, 4, 16 }, /* Rome 2.0 */
4012         { 0x00000201, 28, 4, 16 }, /* Rome 2.1 */
4013         { 0x00000300, 28, 4, 16 }, /* Rome 3.0 */
4014         { 0x00000302, 28, 4, 16 }, /* Rome 3.2 */
4015         { 0x00130100, 40, 4, 16 }, /* WCN6855 1.0 */
4016         { 0x00130200, 40, 4, 16 }, /* WCN6855 2.0 */
4017 };
4018
4019 static int btusb_qca_send_vendor_req(struct usb_device *udev, u8 request,
4020                                      void *data, u16 size)
4021 {
4022         int pipe, err;
4023         u8 *buf;
4024
4025         buf = kmalloc(size, GFP_KERNEL);
4026         if (!buf)
4027                 return -ENOMEM;
4028
4029         /* Found some of USB hosts have IOT issues with ours so that we should
4030          * not wait until HCI layer is ready.
4031          */
4032         pipe = usb_rcvctrlpipe(udev, 0);
4033         err = usb_control_msg(udev, pipe, request, USB_TYPE_VENDOR | USB_DIR_IN,
4034                               0, 0, buf, size, USB_CTRL_SET_TIMEOUT);
4035         if (err < 0) {
4036                 dev_err(&udev->dev, "Failed to access otp area (%d)", err);
4037                 goto done;
4038         }
4039
4040         memcpy(data, buf, size);
4041
4042 done:
4043         kfree(buf);
4044
4045         return err;
4046 }
4047
4048 static int btusb_setup_qca_download_fw(struct hci_dev *hdev,
4049                                        const struct firmware *firmware,
4050                                        size_t hdr_size)
4051 {
4052         struct btusb_data *btdata = hci_get_drvdata(hdev);
4053         struct usb_device *udev = btdata->udev;
4054         size_t count, size, sent = 0;
4055         int pipe, len, err;
4056         u8 *buf;
4057
4058         buf = kmalloc(QCA_DFU_PACKET_LEN, GFP_KERNEL);
4059         if (!buf)
4060                 return -ENOMEM;
4061
4062         count = firmware->size;
4063
4064         size = min_t(size_t, count, hdr_size);
4065         memcpy(buf, firmware->data, size);
4066
4067         /* USB patches should go down to controller through USB path
4068          * because binary format fits to go down through USB channel.
4069          * USB control path is for patching headers and USB bulk is for
4070          * patch body.
4071          */
4072         pipe = usb_sndctrlpipe(udev, 0);
4073         err = usb_control_msg(udev, pipe, QCA_DFU_DOWNLOAD, USB_TYPE_VENDOR,
4074                               0, 0, buf, size, USB_CTRL_SET_TIMEOUT);
4075         if (err < 0) {
4076                 bt_dev_err(hdev, "Failed to send headers (%d)", err);
4077                 goto done;
4078         }
4079
4080         sent += size;
4081         count -= size;
4082
4083         /* ep2 need time to switch from function acl to function dfu,
4084          * so we add 20ms delay here.
4085          */
4086         msleep(20);
4087
4088         while (count) {
4089                 size = min_t(size_t, count, QCA_DFU_PACKET_LEN);
4090
4091                 memcpy(buf, firmware->data + sent, size);
4092
4093                 pipe = usb_sndbulkpipe(udev, 0x02);
4094                 err = usb_bulk_msg(udev, pipe, buf, size, &len,
4095                                    QCA_DFU_TIMEOUT);
4096                 if (err < 0) {
4097                         bt_dev_err(hdev, "Failed to send body at %zd of %zd (%d)",
4098                                    sent, firmware->size, err);
4099                         break;
4100                 }
4101
4102                 if (size != len) {
4103                         bt_dev_err(hdev, "Failed to get bulk buffer");
4104                         err = -EILSEQ;
4105                         break;
4106                 }
4107
4108                 sent  += size;
4109                 count -= size;
4110         }
4111
4112 done:
4113         kfree(buf);
4114         return err;
4115 }
4116
4117 static int btusb_setup_qca_load_rampatch(struct hci_dev *hdev,
4118                                          struct qca_version *ver,
4119                                          const struct qca_device_info *info)
4120 {
4121         struct qca_rampatch_version *rver;
4122         const struct firmware *fw;
4123         u32 ver_rom, ver_patch, rver_rom;
4124         u16 rver_rom_low, rver_rom_high, rver_patch;
4125         char fwname[64];
4126         int err;
4127
4128         ver_rom = le32_to_cpu(ver->rom_version);
4129         ver_patch = le32_to_cpu(ver->patch_version);
4130
4131         snprintf(fwname, sizeof(fwname), "qca/rampatch_usb_%08x.bin", ver_rom);
4132
4133         err = request_firmware(&fw, fwname, &hdev->dev);
4134         if (err) {
4135                 bt_dev_err(hdev, "failed to request rampatch file: %s (%d)",
4136                            fwname, err);
4137                 return err;
4138         }
4139
4140         bt_dev_info(hdev, "using rampatch file: %s", fwname);
4141
4142         rver = (struct qca_rampatch_version *)(fw->data + info->ver_offset);
4143         rver_rom_low = le16_to_cpu(rver->rom_version_low);
4144         rver_patch = le16_to_cpu(rver->patch_version);
4145
4146         if (ver_rom & ~0xffffU) {
4147                 rver_rom_high = le16_to_cpu(rver->rom_version_high);
4148                 rver_rom = le32_to_cpu(rver_rom_high << 16 | rver_rom_low);
4149         } else {
4150                 rver_rom = rver_rom_low;
4151         }
4152
4153         bt_dev_info(hdev, "QCA: patch rome 0x%x build 0x%x, "
4154                     "firmware rome 0x%x build 0x%x",
4155                     rver_rom, rver_patch, ver_rom, ver_patch);
4156
4157         if (rver_rom != ver_rom || rver_patch <= ver_patch) {
4158                 bt_dev_err(hdev, "rampatch file version did not match with firmware");
4159                 err = -EINVAL;
4160                 goto done;
4161         }
4162
4163         err = btusb_setup_qca_download_fw(hdev, fw, info->rampatch_hdr);
4164
4165 done:
4166         release_firmware(fw);
4167
4168         return err;
4169 }
4170
4171 static int btusb_setup_qca_load_nvm(struct hci_dev *hdev,
4172                                     struct qca_version *ver,
4173                                     const struct qca_device_info *info)
4174 {
4175         const struct firmware *fw;
4176         char fwname[64];
4177         int err;
4178
4179         if (((ver->flag >> 8) & 0xff) == QCA_FLAG_MULTI_NVM) {
4180                 /* if boardid equal 0, use default nvm without surfix */
4181                 if (le16_to_cpu(ver->board_id) == 0x0) {
4182                         snprintf(fwname, sizeof(fwname), "qca/nvm_usb_%08x.bin",
4183                                  le32_to_cpu(ver->rom_version));
4184                 } else {
4185                         snprintf(fwname, sizeof(fwname), "qca/nvm_usb_%08x_%04x.bin",
4186                                 le32_to_cpu(ver->rom_version),
4187                                 le16_to_cpu(ver->board_id));
4188                 }
4189         } else {
4190                 snprintf(fwname, sizeof(fwname), "qca/nvm_usb_%08x.bin",
4191                          le32_to_cpu(ver->rom_version));
4192         }
4193
4194         err = request_firmware(&fw, fwname, &hdev->dev);
4195         if (err) {
4196                 bt_dev_err(hdev, "failed to request NVM file: %s (%d)",
4197                            fwname, err);
4198                 return err;
4199         }
4200
4201         bt_dev_info(hdev, "using NVM file: %s", fwname);
4202
4203         err = btusb_setup_qca_download_fw(hdev, fw, info->nvm_hdr);
4204
4205         release_firmware(fw);
4206
4207         return err;
4208 }
4209
4210 /* identify the ROM version and check whether patches are needed */
4211 static bool btusb_qca_need_patch(struct usb_device *udev)
4212 {
4213         struct qca_version ver;
4214
4215         if (btusb_qca_send_vendor_req(udev, QCA_GET_TARGET_VERSION, &ver,
4216                                       sizeof(ver)) < 0)
4217                 return false;
4218         /* only low ROM versions need patches */
4219         return !(le32_to_cpu(ver.rom_version) & ~0xffffU);
4220 }
4221
4222 static int btusb_setup_qca(struct hci_dev *hdev)
4223 {
4224         struct btusb_data *btdata = hci_get_drvdata(hdev);
4225         struct usb_device *udev = btdata->udev;
4226         const struct qca_device_info *info = NULL;
4227         struct qca_version ver;
4228         u32 ver_rom;
4229         u8 status;
4230         int i, err;
4231
4232         err = btusb_qca_send_vendor_req(udev, QCA_GET_TARGET_VERSION, &ver,
4233                                         sizeof(ver));
4234         if (err < 0)
4235                 return err;
4236
4237         ver_rom = le32_to_cpu(ver.rom_version);
4238
4239         for (i = 0; i < ARRAY_SIZE(qca_devices_table); i++) {
4240                 if (ver_rom == qca_devices_table[i].rom_version)
4241                         info = &qca_devices_table[i];
4242         }
4243         if (!info) {
4244                 /* If the rom_version is not matched in the qca_devices_table
4245                  * and the high ROM version is not zero, we assume this chip no
4246                  * need to load the rampatch and nvm.
4247                  */
4248                 if (ver_rom & ~0xffffU)
4249                         return 0;
4250
4251                 bt_dev_err(hdev, "don't support firmware rome 0x%x", ver_rom);
4252                 return -ENODEV;
4253         }
4254
4255         err = btusb_qca_send_vendor_req(udev, QCA_CHECK_STATUS, &status,
4256                                         sizeof(status));
4257         if (err < 0)
4258                 return err;
4259
4260         if (!(status & QCA_PATCH_UPDATED)) {
4261                 err = btusb_setup_qca_load_rampatch(hdev, &ver, info);
4262                 if (err < 0)
4263                         return err;
4264         }
4265
4266         err = btusb_qca_send_vendor_req(udev, QCA_GET_TARGET_VERSION, &ver,
4267                                         sizeof(ver));
4268         if (err < 0)
4269                 return err;
4270
4271         if (!(status & QCA_SYSCFG_UPDATED)) {
4272                 err = btusb_setup_qca_load_nvm(hdev, &ver, info);
4273                 if (err < 0)
4274                         return err;
4275         }
4276
4277         return 0;
4278 }
4279
4280 static inline int __set_diag_interface(struct hci_dev *hdev)
4281 {
4282         struct btusb_data *data = hci_get_drvdata(hdev);
4283         struct usb_interface *intf = data->diag;
4284         int i;
4285
4286         if (!data->diag)
4287                 return -ENODEV;
4288
4289         data->diag_tx_ep = NULL;
4290         data->diag_rx_ep = NULL;
4291
4292         for (i = 0; i < intf->cur_altsetting->desc.bNumEndpoints; i++) {
4293                 struct usb_endpoint_descriptor *ep_desc;
4294
4295                 ep_desc = &intf->cur_altsetting->endpoint[i].desc;
4296
4297                 if (!data->diag_tx_ep && usb_endpoint_is_bulk_out(ep_desc)) {
4298                         data->diag_tx_ep = ep_desc;
4299                         continue;
4300                 }
4301
4302                 if (!data->diag_rx_ep && usb_endpoint_is_bulk_in(ep_desc)) {
4303                         data->diag_rx_ep = ep_desc;
4304                         continue;
4305                 }
4306         }
4307
4308         if (!data->diag_tx_ep || !data->diag_rx_ep) {
4309                 bt_dev_err(hdev, "invalid diagnostic descriptors");
4310                 return -ENODEV;
4311         }
4312
4313         return 0;
4314 }
4315
4316 static struct urb *alloc_diag_urb(struct hci_dev *hdev, bool enable)
4317 {
4318         struct btusb_data *data = hci_get_drvdata(hdev);
4319         struct sk_buff *skb;
4320         struct urb *urb;
4321         unsigned int pipe;
4322
4323         if (!data->diag_tx_ep)
4324                 return ERR_PTR(-ENODEV);
4325
4326         urb = usb_alloc_urb(0, GFP_KERNEL);
4327         if (!urb)
4328                 return ERR_PTR(-ENOMEM);
4329
4330         skb = bt_skb_alloc(2, GFP_KERNEL);
4331         if (!skb) {
4332                 usb_free_urb(urb);
4333                 return ERR_PTR(-ENOMEM);
4334         }
4335
4336         skb_put_u8(skb, 0xf0);
4337         skb_put_u8(skb, enable);
4338
4339         pipe = usb_sndbulkpipe(data->udev, data->diag_tx_ep->bEndpointAddress);
4340
4341         usb_fill_bulk_urb(urb, data->udev, pipe,
4342                           skb->data, skb->len, btusb_tx_complete, skb);
4343
4344         skb->dev = (void *)hdev;
4345
4346         return urb;
4347 }
4348
4349 static int btusb_bcm_set_diag(struct hci_dev *hdev, bool enable)
4350 {
4351         struct btusb_data *data = hci_get_drvdata(hdev);
4352         struct urb *urb;
4353
4354         if (!data->diag)
4355                 return -ENODEV;
4356
4357         if (!test_bit(HCI_RUNNING, &hdev->flags))
4358                 return -ENETDOWN;
4359
4360         urb = alloc_diag_urb(hdev, enable);
4361         if (IS_ERR(urb))
4362                 return PTR_ERR(urb);
4363
4364         return submit_or_queue_tx_urb(hdev, urb);
4365 }
4366
4367 #ifdef CONFIG_PM
4368 static irqreturn_t btusb_oob_wake_handler(int irq, void *priv)
4369 {
4370         struct btusb_data *data = priv;
4371
4372         pm_wakeup_event(&data->udev->dev, 0);
4373         pm_system_wakeup();
4374
4375         /* Disable only if not already disabled (keep it balanced) */
4376         if (test_and_clear_bit(BTUSB_OOB_WAKE_ENABLED, &data->flags)) {
4377                 disable_irq_nosync(irq);
4378                 disable_irq_wake(irq);
4379         }
4380         return IRQ_HANDLED;
4381 }
4382
4383 static const struct of_device_id btusb_match_table[] = {
4384         { .compatible = "usb1286,204e" },
4385         { .compatible = "usbcf3,e300" }, /* QCA6174A */
4386         { .compatible = "usb4ca,301a" }, /* QCA6174A (Lite-On) */
4387         { }
4388 };
4389 MODULE_DEVICE_TABLE(of, btusb_match_table);
4390
4391 /* Use an oob wakeup pin? */
4392 static int btusb_config_oob_wake(struct hci_dev *hdev)
4393 {
4394         struct btusb_data *data = hci_get_drvdata(hdev);
4395         struct device *dev = &data->udev->dev;
4396         int irq, ret;
4397
4398         clear_bit(BTUSB_OOB_WAKE_ENABLED, &data->flags);
4399
4400         if (!of_match_device(btusb_match_table, dev))
4401                 return 0;
4402
4403         /* Move on if no IRQ specified */
4404         irq = of_irq_get_byname(dev->of_node, "wakeup");
4405         if (irq <= 0) {
4406                 bt_dev_dbg(hdev, "%s: no OOB Wakeup IRQ in DT", __func__);
4407                 return 0;
4408         }
4409
4410         irq_set_status_flags(irq, IRQ_NOAUTOEN);
4411         ret = devm_request_irq(&hdev->dev, irq, btusb_oob_wake_handler,
4412                                0, "OOB Wake-on-BT", data);
4413         if (ret) {
4414                 bt_dev_err(hdev, "%s: IRQ request failed", __func__);
4415                 return ret;
4416         }
4417
4418         ret = device_init_wakeup(dev, true);
4419         if (ret) {
4420                 bt_dev_err(hdev, "%s: failed to init_wakeup", __func__);
4421                 return ret;
4422         }
4423
4424         data->oob_wake_irq = irq;
4425         bt_dev_info(hdev, "OOB Wake-on-BT configured at IRQ %u", irq);
4426         return 0;
4427 }
4428 #endif
4429
4430 static void btusb_check_needs_reset_resume(struct usb_interface *intf)
4431 {
4432         if (dmi_check_system(btusb_needs_reset_resume_table))
4433                 interface_to_usbdev(intf)->quirks |= USB_QUIRK_RESET_RESUME;
4434 }
4435
4436 static bool btusb_prevent_wake(struct hci_dev *hdev)
4437 {
4438         struct btusb_data *data = hci_get_drvdata(hdev);
4439
4440         if (test_bit(BTUSB_WAKEUP_DISABLE, &data->flags))
4441                 return true;
4442
4443         return !device_may_wakeup(&data->udev->dev);
4444 }
4445
4446 static int btusb_shutdown_qca(struct hci_dev *hdev)
4447 {
4448         struct sk_buff *skb;
4449
4450         skb = __hci_cmd_sync(hdev, HCI_OP_RESET, 0, NULL, HCI_INIT_TIMEOUT);
4451         if (IS_ERR(skb)) {
4452                 bt_dev_err(hdev, "HCI reset during shutdown failed");
4453                 return PTR_ERR(skb);
4454         }
4455         kfree_skb(skb);
4456
4457         return 0;
4458 }
4459
4460 static int btusb_probe(struct usb_interface *intf,
4461                        const struct usb_device_id *id)
4462 {
4463         struct usb_endpoint_descriptor *ep_desc;
4464         struct gpio_desc *reset_gpio;
4465         struct btusb_data *data;
4466         struct hci_dev *hdev;
4467         unsigned ifnum_base;
4468         int i, err;
4469
4470         BT_DBG("intf %p id %p", intf, id);
4471
4472         /* interface numbers are hardcoded in the spec */
4473         if (intf->cur_altsetting->desc.bInterfaceNumber != 0) {
4474                 if (!(id->driver_info & BTUSB_IFNUM_2))
4475                         return -ENODEV;
4476                 if (intf->cur_altsetting->desc.bInterfaceNumber != 2)
4477                         return -ENODEV;
4478         }
4479
4480         ifnum_base = intf->cur_altsetting->desc.bInterfaceNumber;
4481
4482         if (!id->driver_info) {
4483                 const struct usb_device_id *match;
4484
4485                 match = usb_match_id(intf, blacklist_table);
4486                 if (match)
4487                         id = match;
4488         }
4489
4490         if (id->driver_info == BTUSB_IGNORE)
4491                 return -ENODEV;
4492
4493         if (id->driver_info & BTUSB_ATH3012) {
4494                 struct usb_device *udev = interface_to_usbdev(intf);
4495
4496                 /* Old firmware would otherwise let ath3k driver load
4497                  * patch and sysconfig files
4498                  */
4499                 if (le16_to_cpu(udev->descriptor.bcdDevice) <= 0x0001 &&
4500                     !btusb_qca_need_patch(udev))
4501                         return -ENODEV;
4502         }
4503
4504         data = devm_kzalloc(&intf->dev, sizeof(*data), GFP_KERNEL);
4505         if (!data)
4506                 return -ENOMEM;
4507
4508         for (i = 0; i < intf->cur_altsetting->desc.bNumEndpoints; i++) {
4509                 ep_desc = &intf->cur_altsetting->endpoint[i].desc;
4510
4511                 if (!data->intr_ep && usb_endpoint_is_int_in(ep_desc)) {
4512                         data->intr_ep = ep_desc;
4513                         continue;
4514                 }
4515
4516                 if (!data->bulk_tx_ep && usb_endpoint_is_bulk_out(ep_desc)) {
4517                         data->bulk_tx_ep = ep_desc;
4518                         continue;
4519                 }
4520
4521                 if (!data->bulk_rx_ep && usb_endpoint_is_bulk_in(ep_desc)) {
4522                         data->bulk_rx_ep = ep_desc;
4523                         continue;
4524                 }
4525         }
4526
4527         if (!data->intr_ep || !data->bulk_tx_ep || !data->bulk_rx_ep)
4528                 return -ENODEV;
4529
4530         if (id->driver_info & BTUSB_AMP) {
4531                 data->cmdreq_type = USB_TYPE_CLASS | 0x01;
4532                 data->cmdreq = 0x2b;
4533         } else {
4534                 data->cmdreq_type = USB_TYPE_CLASS;
4535                 data->cmdreq = 0x00;
4536         }
4537
4538         data->udev = interface_to_usbdev(intf);
4539         data->intf = intf;
4540
4541         INIT_WORK(&data->work, btusb_work);
4542         INIT_WORK(&data->waker, btusb_waker);
4543         init_usb_anchor(&data->deferred);
4544         init_usb_anchor(&data->tx_anchor);
4545         spin_lock_init(&data->txlock);
4546
4547         init_usb_anchor(&data->intr_anchor);
4548         init_usb_anchor(&data->bulk_anchor);
4549         init_usb_anchor(&data->isoc_anchor);
4550         init_usb_anchor(&data->diag_anchor);
4551         init_usb_anchor(&data->ctrl_anchor);
4552         spin_lock_init(&data->rxlock);
4553
4554         if (id->driver_info & BTUSB_INTEL_NEW) {
4555                 data->recv_event = btusb_recv_event_intel;
4556                 data->recv_bulk = btusb_recv_bulk_intel;
4557                 set_bit(BTUSB_BOOTLOADER, &data->flags);
4558         } else {
4559                 data->recv_event = hci_recv_frame;
4560                 data->recv_bulk = btusb_recv_bulk;
4561         }
4562
4563         hdev = hci_alloc_dev();
4564         if (!hdev)
4565                 return -ENOMEM;
4566
4567         hdev->bus = HCI_USB;
4568         hci_set_drvdata(hdev, data);
4569
4570         if (id->driver_info & BTUSB_AMP)
4571                 hdev->dev_type = HCI_AMP;
4572         else
4573                 hdev->dev_type = HCI_PRIMARY;
4574
4575         data->hdev = hdev;
4576
4577         SET_HCIDEV_DEV(hdev, &intf->dev);
4578
4579         reset_gpio = gpiod_get_optional(&data->udev->dev, "reset",
4580                                         GPIOD_OUT_LOW);
4581         if (IS_ERR(reset_gpio)) {
4582                 err = PTR_ERR(reset_gpio);
4583                 goto out_free_dev;
4584         } else if (reset_gpio) {
4585                 data->reset_gpio = reset_gpio;
4586         }
4587
4588         hdev->open   = btusb_open;
4589         hdev->close  = btusb_close;
4590         hdev->flush  = btusb_flush;
4591         hdev->send   = btusb_send_frame;
4592         hdev->notify = btusb_notify;
4593         hdev->prevent_wake = btusb_prevent_wake;
4594
4595 #ifdef CONFIG_PM
4596         err = btusb_config_oob_wake(hdev);
4597         if (err)
4598                 goto out_free_dev;
4599
4600         /* Marvell devices may need a specific chip configuration */
4601         if (id->driver_info & BTUSB_MARVELL && data->oob_wake_irq) {
4602                 err = marvell_config_oob_wake(hdev);
4603                 if (err)
4604                         goto out_free_dev;
4605         }
4606 #endif
4607         if (id->driver_info & BTUSB_CW6622)
4608                 set_bit(HCI_QUIRK_BROKEN_STORED_LINK_KEY, &hdev->quirks);
4609
4610         if (id->driver_info & BTUSB_BCM2045)
4611                 set_bit(HCI_QUIRK_BROKEN_STORED_LINK_KEY, &hdev->quirks);
4612
4613         if (id->driver_info & BTUSB_BCM92035)
4614                 hdev->setup = btusb_setup_bcm92035;
4615
4616         if (IS_ENABLED(CONFIG_BT_HCIBTUSB_BCM) &&
4617             (id->driver_info & BTUSB_BCM_PATCHRAM)) {
4618                 hdev->manufacturer = 15;
4619                 hdev->setup = btbcm_setup_patchram;
4620                 hdev->set_diag = btusb_bcm_set_diag;
4621                 hdev->set_bdaddr = btbcm_set_bdaddr;
4622
4623                 /* Broadcom LM_DIAG Interface numbers are hardcoded */
4624                 data->diag = usb_ifnum_to_if(data->udev, ifnum_base + 2);
4625         }
4626
4627         if (IS_ENABLED(CONFIG_BT_HCIBTUSB_BCM) &&
4628             (id->driver_info & BTUSB_BCM_APPLE)) {
4629                 hdev->manufacturer = 15;
4630                 hdev->setup = btbcm_setup_apple;
4631                 hdev->set_diag = btusb_bcm_set_diag;
4632
4633                 /* Broadcom LM_DIAG Interface numbers are hardcoded */
4634                 data->diag = usb_ifnum_to_if(data->udev, ifnum_base + 2);
4635         }
4636
4637         if (id->driver_info & BTUSB_INTEL) {
4638                 hdev->manufacturer = 2;
4639                 hdev->setup = btusb_setup_intel;
4640                 hdev->shutdown = btusb_shutdown_intel;
4641                 hdev->set_diag = btintel_set_diag_mfg;
4642                 hdev->set_bdaddr = btintel_set_bdaddr;
4643                 hdev->cmd_timeout = btusb_intel_cmd_timeout;
4644                 set_bit(HCI_QUIRK_STRICT_DUPLICATE_FILTER, &hdev->quirks);
4645                 set_bit(HCI_QUIRK_SIMULTANEOUS_DISCOVERY, &hdev->quirks);
4646                 set_bit(HCI_QUIRK_NON_PERSISTENT_DIAG, &hdev->quirks);
4647         }
4648
4649         if (id->driver_info & BTUSB_INTEL_NEW) {
4650                 hdev->manufacturer = 2;
4651                 hdev->send = btusb_send_frame_intel;
4652                 hdev->setup = btusb_setup_intel_new;
4653                 hdev->shutdown = btusb_shutdown_intel_new;
4654                 hdev->hw_error = btintel_hw_error;
4655                 hdev->set_diag = btintel_set_diag;
4656                 hdev->set_bdaddr = btintel_set_bdaddr;
4657                 hdev->cmd_timeout = btusb_intel_cmd_timeout;
4658                 set_bit(HCI_QUIRK_STRICT_DUPLICATE_FILTER, &hdev->quirks);
4659                 set_bit(HCI_QUIRK_SIMULTANEOUS_DISCOVERY, &hdev->quirks);
4660                 set_bit(HCI_QUIRK_NON_PERSISTENT_DIAG, &hdev->quirks);
4661         }
4662
4663         if (id->driver_info & BTUSB_INTEL_NEWGEN) {
4664                 hdev->manufacturer = 2;
4665                 hdev->send = btusb_send_frame_intel;
4666                 hdev->setup = btusb_setup_intel_newgen;
4667                 hdev->shutdown = btusb_shutdown_intel_new;
4668                 hdev->hw_error = btintel_hw_error;
4669                 hdev->set_diag = btintel_set_diag;
4670                 hdev->set_bdaddr = btintel_set_bdaddr;
4671                 hdev->cmd_timeout = btusb_intel_cmd_timeout;
4672                 set_bit(HCI_QUIRK_STRICT_DUPLICATE_FILTER, &hdev->quirks);
4673                 set_bit(HCI_QUIRK_SIMULTANEOUS_DISCOVERY, &hdev->quirks);
4674                 set_bit(HCI_QUIRK_NON_PERSISTENT_DIAG, &hdev->quirks);
4675
4676                 data->recv_event = btusb_recv_event_intel;
4677                 data->recv_bulk = btusb_recv_bulk_intel;
4678                 set_bit(BTUSB_BOOTLOADER, &data->flags);
4679         }
4680
4681         if (id->driver_info & BTUSB_MARVELL)
4682                 hdev->set_bdaddr = btusb_set_bdaddr_marvell;
4683
4684         if (IS_ENABLED(CONFIG_BT_HCIBTUSB_MTK) &&
4685             (id->driver_info & BTUSB_MEDIATEK)) {
4686                 hdev->setup = btusb_mtk_setup;
4687                 hdev->shutdown = btusb_mtk_shutdown;
4688                 hdev->manufacturer = 70;
4689                 set_bit(HCI_QUIRK_NON_PERSISTENT_SETUP, &hdev->quirks);
4690         }
4691
4692         if (id->driver_info & BTUSB_SWAVE) {
4693                 set_bit(HCI_QUIRK_FIXUP_INQUIRY_MODE, &hdev->quirks);
4694                 set_bit(HCI_QUIRK_BROKEN_LOCAL_COMMANDS, &hdev->quirks);
4695         }
4696
4697         if (id->driver_info & BTUSB_INTEL_BOOT) {
4698                 hdev->manufacturer = 2;
4699                 set_bit(HCI_QUIRK_RAW_DEVICE, &hdev->quirks);
4700         }
4701
4702         if (id->driver_info & BTUSB_ATH3012) {
4703                 data->setup_on_usb = btusb_setup_qca;
4704                 hdev->set_bdaddr = btusb_set_bdaddr_ath3012;
4705                 set_bit(HCI_QUIRK_SIMULTANEOUS_DISCOVERY, &hdev->quirks);
4706                 set_bit(HCI_QUIRK_STRICT_DUPLICATE_FILTER, &hdev->quirks);
4707         }
4708
4709         if (id->driver_info & BTUSB_QCA_ROME) {
4710                 data->setup_on_usb = btusb_setup_qca;
4711                 hdev->set_bdaddr = btusb_set_bdaddr_ath3012;
4712                 hdev->cmd_timeout = btusb_qca_cmd_timeout;
4713                 set_bit(HCI_QUIRK_SIMULTANEOUS_DISCOVERY, &hdev->quirks);
4714                 btusb_check_needs_reset_resume(intf);
4715         }
4716
4717         if (id->driver_info & BTUSB_QCA_WCN6855) {
4718                 data->setup_on_usb = btusb_setup_qca;
4719                 hdev->shutdown = btusb_shutdown_qca;
4720                 hdev->set_bdaddr = btusb_set_bdaddr_wcn6855;
4721                 hdev->cmd_timeout = btusb_qca_cmd_timeout;
4722                 set_bit(HCI_QUIRK_SIMULTANEOUS_DISCOVERY, &hdev->quirks);
4723         }
4724
4725         if (id->driver_info & BTUSB_AMP) {
4726                 /* AMP controllers do not support SCO packets */
4727                 data->isoc = NULL;
4728         } else {
4729                 /* Interface orders are hardcoded in the specification */
4730                 data->isoc = usb_ifnum_to_if(data->udev, ifnum_base + 1);
4731                 data->isoc_ifnum = ifnum_base + 1;
4732         }
4733
4734         if (IS_ENABLED(CONFIG_BT_HCIBTUSB_RTL) &&
4735             (id->driver_info & BTUSB_REALTEK)) {
4736                 hdev->setup = btrtl_setup_realtek;
4737                 hdev->shutdown = btrtl_shutdown_realtek;
4738                 hdev->cmd_timeout = btusb_rtl_cmd_timeout;
4739
4740                 /* Realtek devices lose their updated firmware over global
4741                  * suspend that means host doesn't send SET_FEATURE
4742                  * (DEVICE_REMOTE_WAKEUP)
4743                  */
4744                 set_bit(BTUSB_WAKEUP_DISABLE, &data->flags);
4745         }
4746
4747         if (!reset)
4748                 set_bit(HCI_QUIRK_RESET_ON_CLOSE, &hdev->quirks);
4749
4750         if (force_scofix || id->driver_info & BTUSB_WRONG_SCO_MTU) {
4751                 if (!disable_scofix)
4752                         set_bit(HCI_QUIRK_FIXUP_BUFFER_SIZE, &hdev->quirks);
4753         }
4754
4755         if (id->driver_info & BTUSB_BROKEN_ISOC)
4756                 data->isoc = NULL;
4757
4758         if (id->driver_info & BTUSB_WIDEBAND_SPEECH)
4759                 set_bit(HCI_QUIRK_WIDEBAND_SPEECH_SUPPORTED, &hdev->quirks);
4760
4761         if (id->driver_info & BTUSB_VALID_LE_STATES)
4762                 set_bit(HCI_QUIRK_VALID_LE_STATES, &hdev->quirks);
4763
4764         if (id->driver_info & BTUSB_DIGIANSWER) {
4765                 data->cmdreq_type = USB_TYPE_VENDOR;
4766                 set_bit(HCI_QUIRK_RESET_ON_CLOSE, &hdev->quirks);
4767         }
4768
4769         if (id->driver_info & BTUSB_CSR) {
4770                 struct usb_device *udev = data->udev;
4771                 u16 bcdDevice = le16_to_cpu(udev->descriptor.bcdDevice);
4772
4773                 /* Old firmware would otherwise execute USB reset */
4774                 if (bcdDevice < 0x117)
4775                         set_bit(HCI_QUIRK_RESET_ON_CLOSE, &hdev->quirks);
4776
4777                 /* This must be set first in case we disable it for fakes */
4778                 set_bit(HCI_QUIRK_SIMULTANEOUS_DISCOVERY, &hdev->quirks);
4779
4780                 /* Fake CSR devices with broken commands */
4781                 if (le16_to_cpu(udev->descriptor.idVendor)  == 0x0a12 &&
4782                     le16_to_cpu(udev->descriptor.idProduct) == 0x0001)
4783                         hdev->setup = btusb_setup_csr;
4784         }
4785
4786         if (id->driver_info & BTUSB_SNIFFER) {
4787                 struct usb_device *udev = data->udev;
4788
4789                 /* New sniffer firmware has crippled HCI interface */
4790                 if (le16_to_cpu(udev->descriptor.bcdDevice) > 0x997)
4791                         set_bit(HCI_QUIRK_RAW_DEVICE, &hdev->quirks);
4792         }
4793
4794         if (id->driver_info & BTUSB_INTEL_BOOT) {
4795                 /* A bug in the bootloader causes that interrupt interface is
4796                  * only enabled after receiving SetInterface(0, AltSetting=0).
4797                  */
4798                 err = usb_set_interface(data->udev, 0, 0);
4799                 if (err < 0) {
4800                         BT_ERR("failed to set interface 0, alt 0 %d", err);
4801                         goto out_free_dev;
4802                 }
4803         }
4804
4805         if (data->isoc) {
4806                 err = usb_driver_claim_interface(&btusb_driver,
4807                                                  data->isoc, data);
4808                 if (err < 0)
4809                         goto out_free_dev;
4810         }
4811
4812         if (IS_ENABLED(CONFIG_BT_HCIBTUSB_BCM) && data->diag) {
4813                 if (!usb_driver_claim_interface(&btusb_driver,
4814                                                 data->diag, data))
4815                         __set_diag_interface(hdev);
4816                 else
4817                         data->diag = NULL;
4818         }
4819
4820         if (enable_autosuspend)
4821                 usb_enable_autosuspend(data->udev);
4822
4823         err = hci_register_dev(hdev);
4824         if (err < 0)
4825                 goto out_free_dev;
4826
4827         usb_set_intfdata(intf, data);
4828
4829         return 0;
4830
4831 out_free_dev:
4832         if (data->reset_gpio)
4833                 gpiod_put(data->reset_gpio);
4834         hci_free_dev(hdev);
4835         return err;
4836 }
4837
4838 static void btusb_disconnect(struct usb_interface *intf)
4839 {
4840         struct btusb_data *data = usb_get_intfdata(intf);
4841         struct hci_dev *hdev;
4842
4843         BT_DBG("intf %p", intf);
4844
4845         if (!data)
4846                 return;
4847
4848         hdev = data->hdev;
4849         usb_set_intfdata(data->intf, NULL);
4850
4851         if (data->isoc)
4852                 usb_set_intfdata(data->isoc, NULL);
4853
4854         if (data->diag)
4855                 usb_set_intfdata(data->diag, NULL);
4856
4857         hci_unregister_dev(hdev);
4858
4859         if (intf == data->intf) {
4860                 if (data->isoc)
4861                         usb_driver_release_interface(&btusb_driver, data->isoc);
4862                 if (data->diag)
4863                         usb_driver_release_interface(&btusb_driver, data->diag);
4864         } else if (intf == data->isoc) {
4865                 if (data->diag)
4866                         usb_driver_release_interface(&btusb_driver, data->diag);
4867                 usb_driver_release_interface(&btusb_driver, data->intf);
4868         } else if (intf == data->diag) {
4869                 usb_driver_release_interface(&btusb_driver, data->intf);
4870                 if (data->isoc)
4871                         usb_driver_release_interface(&btusb_driver, data->isoc);
4872         }
4873
4874         if (data->oob_wake_irq)
4875                 device_init_wakeup(&data->udev->dev, false);
4876
4877         if (data->reset_gpio)
4878                 gpiod_put(data->reset_gpio);
4879
4880         hci_free_dev(hdev);
4881 }
4882
4883 #ifdef CONFIG_PM
4884 static int btusb_suspend(struct usb_interface *intf, pm_message_t message)
4885 {
4886         struct btusb_data *data = usb_get_intfdata(intf);
4887
4888         BT_DBG("intf %p", intf);
4889
4890         if (data->suspend_count++)
4891                 return 0;
4892
4893         spin_lock_irq(&data->txlock);
4894         if (!(PMSG_IS_AUTO(message) && data->tx_in_flight)) {
4895                 set_bit(BTUSB_SUSPENDING, &data->flags);
4896                 spin_unlock_irq(&data->txlock);
4897         } else {
4898                 spin_unlock_irq(&data->txlock);
4899                 data->suspend_count--;
4900                 return -EBUSY;
4901         }
4902
4903         cancel_work_sync(&data->work);
4904
4905         btusb_stop_traffic(data);
4906         usb_kill_anchored_urbs(&data->tx_anchor);
4907
4908         if (data->oob_wake_irq && device_may_wakeup(&data->udev->dev)) {
4909                 set_bit(BTUSB_OOB_WAKE_ENABLED, &data->flags);
4910                 enable_irq_wake(data->oob_wake_irq);
4911                 enable_irq(data->oob_wake_irq);
4912         }
4913
4914         /* For global suspend, Realtek devices lose the loaded fw
4915          * in them. But for autosuspend, firmware should remain.
4916          * Actually, it depends on whether the usb host sends
4917          * set feature (enable wakeup) or not.
4918          */
4919         if (test_bit(BTUSB_WAKEUP_DISABLE, &data->flags)) {
4920                 if (PMSG_IS_AUTO(message) &&
4921                     device_can_wakeup(&data->udev->dev))
4922                         data->udev->do_remote_wakeup = 1;
4923                 else if (!PMSG_IS_AUTO(message))
4924                         data->udev->reset_resume = 1;
4925         }
4926
4927         return 0;
4928 }
4929
4930 static void play_deferred(struct btusb_data *data)
4931 {
4932         struct urb *urb;
4933         int err;
4934
4935         while ((urb = usb_get_from_anchor(&data->deferred))) {
4936                 usb_anchor_urb(urb, &data->tx_anchor);
4937
4938                 err = usb_submit_urb(urb, GFP_ATOMIC);
4939                 if (err < 0) {
4940                         if (err != -EPERM && err != -ENODEV)
4941                                 BT_ERR("%s urb %p submission failed (%d)",
4942                                        data->hdev->name, urb, -err);
4943                         kfree(urb->setup_packet);
4944                         usb_unanchor_urb(urb);
4945                         usb_free_urb(urb);
4946                         break;
4947                 }
4948
4949                 data->tx_in_flight++;
4950                 usb_free_urb(urb);
4951         }
4952
4953         /* Cleanup the rest deferred urbs. */
4954         while ((urb = usb_get_from_anchor(&data->deferred))) {
4955                 kfree(urb->setup_packet);
4956                 usb_free_urb(urb);
4957         }
4958 }
4959
4960 static int btusb_resume(struct usb_interface *intf)
4961 {
4962         struct btusb_data *data = usb_get_intfdata(intf);
4963         struct hci_dev *hdev = data->hdev;
4964         int err = 0;
4965
4966         BT_DBG("intf %p", intf);
4967
4968         if (--data->suspend_count)
4969                 return 0;
4970
4971         /* Disable only if not already disabled (keep it balanced) */
4972         if (test_and_clear_bit(BTUSB_OOB_WAKE_ENABLED, &data->flags)) {
4973                 disable_irq(data->oob_wake_irq);
4974                 disable_irq_wake(data->oob_wake_irq);
4975         }
4976
4977         if (!test_bit(HCI_RUNNING, &hdev->flags))
4978                 goto done;
4979
4980         if (test_bit(BTUSB_INTR_RUNNING, &data->flags)) {
4981                 err = btusb_submit_intr_urb(hdev, GFP_NOIO);
4982                 if (err < 0) {
4983                         clear_bit(BTUSB_INTR_RUNNING, &data->flags);
4984                         goto failed;
4985                 }
4986         }
4987
4988         if (test_bit(BTUSB_BULK_RUNNING, &data->flags)) {
4989                 err = btusb_submit_bulk_urb(hdev, GFP_NOIO);
4990                 if (err < 0) {
4991                         clear_bit(BTUSB_BULK_RUNNING, &data->flags);
4992                         goto failed;
4993                 }
4994
4995                 btusb_submit_bulk_urb(hdev, GFP_NOIO);
4996         }
4997
4998         if (test_bit(BTUSB_ISOC_RUNNING, &data->flags)) {
4999                 if (btusb_submit_isoc_urb(hdev, GFP_NOIO) < 0)
5000                         clear_bit(BTUSB_ISOC_RUNNING, &data->flags);
5001                 else
5002                         btusb_submit_isoc_urb(hdev, GFP_NOIO);
5003         }
5004
5005         spin_lock_irq(&data->txlock);
5006         play_deferred(data);
5007         clear_bit(BTUSB_SUSPENDING, &data->flags);
5008         spin_unlock_irq(&data->txlock);
5009         schedule_work(&data->work);
5010
5011         return 0;
5012
5013 failed:
5014         usb_scuttle_anchored_urbs(&data->deferred);
5015 done:
5016         spin_lock_irq(&data->txlock);
5017         clear_bit(BTUSB_SUSPENDING, &data->flags);
5018         spin_unlock_irq(&data->txlock);
5019
5020         return err;
5021 }
5022 #endif
5023
5024 static struct usb_driver btusb_driver = {
5025         .name           = "btusb",
5026         .probe          = btusb_probe,
5027         .disconnect     = btusb_disconnect,
5028 #ifdef CONFIG_PM
5029         .suspend        = btusb_suspend,
5030         .resume         = btusb_resume,
5031 #endif
5032         .id_table       = btusb_table,
5033         .supports_autosuspend = 1,
5034         .disable_hub_initiated_lpm = 1,
5035 };
5036
5037 module_usb_driver(btusb_driver);
5038
5039 module_param(disable_scofix, bool, 0644);
5040 MODULE_PARM_DESC(disable_scofix, "Disable fixup of wrong SCO buffer size");
5041
5042 module_param(force_scofix, bool, 0644);
5043 MODULE_PARM_DESC(force_scofix, "Force fixup of wrong SCO buffers size");
5044
5045 module_param(enable_autosuspend, bool, 0644);
5046 MODULE_PARM_DESC(enable_autosuspend, "Enable USB autosuspend by default");
5047
5048 module_param(reset, bool, 0644);
5049 MODULE_PARM_DESC(reset, "Send HCI reset command on initialization");
5050
5051 MODULE_AUTHOR("Marcel Holtmann <marcel@holtmann.org>");
5052 MODULE_DESCRIPTION("Generic Bluetooth USB driver ver " VERSION);
5053 MODULE_VERSION(VERSION);
5054 MODULE_LICENSE("GPL");