drivers/bluetooth/btusb.c

   1 // SPDX-License-Identifier: GPL-2.0-or-later
   2 /*
   3  *
   4  *  Generic Bluetooth USB driver
   5  *
   6  *  Copyright (C) 2005-2008  Marcel Holtmann <marcel@holtmann.org>
   7  */
   8
   9 #include <linux/dmi.h>
  10 #include <linux/module.h>
  11 #include <linux/usb.h>
  12 #include <linux/usb/quirks.h>
  13 #include <linux/firmware.h>
  14 #include <linux/iopoll.h>
  15 #include <linux/of_device.h>
  16 #include <linux/of_irq.h>
  17 #include <linux/suspend.h>
  18 #include <linux/gpio/consumer.h>
  19 #include <asm/unaligned.h>
  20
  21 #include <net/bluetooth/bluetooth.h>
  22 #include <net/bluetooth/hci_core.h>
  23
  24 #include "btintel.h"
  25 #include "btbcm.h"
  26 #include "btrtl.h"
  27
  28 #define VERSION "0.8"
  29
  30 static bool disable_scofix;
  31 static bool force_scofix;
  32 static bool enable_autosuspend = IS_ENABLED(CONFIG_BT_HCIBTUSB_AUTOSUSPEND);
  33
  34 static bool reset = true;
  35
  36 static struct usb_driver btusb_driver;
  37
  38 #define BTUSB_IGNORE            0x01
  39 #define BTUSB_DIGIANSWER        0x02
  40 #define BTUSB_CSR               0x04
  41 #define BTUSB_SNIFFER           0x08
  42 #define BTUSB_BCM92035          0x10
  43 #define BTUSB_BROKEN_ISOC       0x20
  44 #define BTUSB_WRONG_SCO_MTU     0x40
  45 #define BTUSB_ATH3012           0x80
  46 #define BTUSB_INTEL             0x100
  47 #define BTUSB_INTEL_BOOT        0x200
  48 #define BTUSB_BCM_PATCHRAM      0x400
  49 #define BTUSB_MARVELL           0x800
  50 #define BTUSB_SWAVE             0x1000
  51 #define BTUSB_INTEL_NEW         0x2000
  52 #define BTUSB_AMP               0x4000
  53 #define BTUSB_QCA_ROME          0x8000
  54 #define BTUSB_BCM_APPLE         0x10000
  55 #define BTUSB_REALTEK           0x20000
  56 #define BTUSB_BCM2045           0x40000
  57 #define BTUSB_IFNUM_2           0x80000
  58 #define BTUSB_CW6622            0x100000
  59 #define BTUSB_MEDIATEK          0x200000
  60 #define BTUSB_WIDEBAND_SPEECH   0x400000
  61 #define BTUSB_VALID_LE_STATES   0x800000
  62 #define BTUSB_QCA_WCN6855       0x1000000
  63 #define BTUSB_INTEL_NEWGEN      0x2000000
  64
  65 static const struct usb_device_id btusb_table[] = {
  66         /* Generic Bluetooth USB device */
  67         { USB_DEVICE_INFO(0xe0, 0x01, 0x01) },
  68
  69         /* Generic Bluetooth AMP device */
  70         { USB_DEVICE_INFO(0xe0, 0x01, 0x04), .driver_info = BTUSB_AMP },
  71
  72         /* Generic Bluetooth USB interface */
  73         { USB_INTERFACE_INFO(0xe0, 0x01, 0x01) },
  74
  75         /* Apple-specific (Broadcom) devices */
  76         { USB_VENDOR_AND_INTERFACE_INFO(0x05ac, 0xff, 0x01, 0x01),
  77           .driver_info = BTUSB_BCM_APPLE | BTUSB_IFNUM_2 },
  78
  79         /* MediaTek MT76x0E */
  80         { USB_DEVICE(0x0e8d, 0x763f) },
  81
  82         /* Broadcom SoftSailing reporting vendor specific */
  83         { USB_DEVICE(0x0a5c, 0x21e1) },
  84
  85         /* Apple MacBookPro 7,1 */
  86         { USB_DEVICE(0x05ac, 0x8213) },
  87
  88         /* Apple iMac11,1 */
  89         { USB_DEVICE(0x05ac, 0x8215) },
  90
  91         /* Apple MacBookPro6,2 */
  92         { USB_DEVICE(0x05ac, 0x8218) },
  93
  94         /* Apple MacBookAir3,1, MacBookAir3,2 */
  95         { USB_DEVICE(0x05ac, 0x821b) },
  96
  97         /* Apple MacBookAir4,1 */
  98         { USB_DEVICE(0x05ac, 0x821f) },
  99
 100         /* Apple MacBookPro8,2 */
 101         { USB_DEVICE(0x05ac, 0x821a) },
 102
 103         /* Apple MacMini5,1 */
 104         { USB_DEVICE(0x05ac, 0x8281) },
 105
 106         /* AVM BlueFRITZ! USB v2.0 */
 107         { USB_DEVICE(0x057c, 0x3800), .driver_info = BTUSB_SWAVE },
 108
 109         /* Bluetooth Ultraport Module from IBM */
 110         { USB_DEVICE(0x04bf, 0x030a) },
 111
 112         /* ALPS Modules with non-standard id */
 113         { USB_DEVICE(0x044e, 0x3001) },
 114         { USB_DEVICE(0x044e, 0x3002) },
 115
 116         /* Ericsson with non-standard id */
 117         { USB_DEVICE(0x0bdb, 0x1002) },
 118
 119         /* Canyon CN-BTU1 with HID interfaces */
 120         { USB_DEVICE(0x0c10, 0x0000) },
 121
 122         /* Broadcom BCM20702A0 */
 123         { USB_DEVICE(0x413c, 0x8197) },
 124
 125         /* Broadcom BCM20702B0 (Dynex/Insignia) */
 126         { USB_DEVICE(0x19ff, 0x0239), .driver_info = BTUSB_BCM_PATCHRAM },
 127
 128         /* Broadcom BCM43142A0 (Foxconn/Lenovo) */
 129         { USB_VENDOR_AND_INTERFACE_INFO(0x105b, 0xff, 0x01, 0x01),
 130           .driver_info = BTUSB_BCM_PATCHRAM },
 131
 132         /* Broadcom BCM920703 (HTC Vive) */
 133         { USB_VENDOR_AND_INTERFACE_INFO(0x0bb4, 0xff, 0x01, 0x01),
 134           .driver_info = BTUSB_BCM_PATCHRAM },
 135
 136         /* Foxconn - Hon Hai */
 137         { USB_VENDOR_AND_INTERFACE_INFO(0x0489, 0xff, 0x01, 0x01),
 138           .driver_info = BTUSB_BCM_PATCHRAM },
 139
 140         /* Lite-On Technology - Broadcom based */
 141         { USB_VENDOR_AND_INTERFACE_INFO(0x04ca, 0xff, 0x01, 0x01),
 142           .driver_info = BTUSB_BCM_PATCHRAM },
 143
 144         /* Broadcom devices with vendor specific id */
 145         { USB_VENDOR_AND_INTERFACE_INFO(0x0a5c, 0xff, 0x01, 0x01),
 146           .driver_info = BTUSB_BCM_PATCHRAM },
 147
 148         /* ASUSTek Computer - Broadcom based */
 149         { USB_VENDOR_AND_INTERFACE_INFO(0x0b05, 0xff, 0x01, 0x01),
 150           .driver_info = BTUSB_BCM_PATCHRAM },
 151
 152         /* Belkin F8065bf - Broadcom based */
 153         { USB_VENDOR_AND_INTERFACE_INFO(0x050d, 0xff, 0x01, 0x01),
 154           .driver_info = BTUSB_BCM_PATCHRAM },
 155
 156         /* IMC Networks - Broadcom based */
 157         { USB_VENDOR_AND_INTERFACE_INFO(0x13d3, 0xff, 0x01, 0x01),
 158           .driver_info = BTUSB_BCM_PATCHRAM },
 159
 160         /* Dell Computer - Broadcom based  */
 161         { USB_VENDOR_AND_INTERFACE_INFO(0x413c, 0xff, 0x01, 0x01),
 162           .driver_info = BTUSB_BCM_PATCHRAM },
 163
 164         /* Toshiba Corp - Broadcom based */
 165         { USB_VENDOR_AND_INTERFACE_INFO(0x0930, 0xff, 0x01, 0x01),
 166           .driver_info = BTUSB_BCM_PATCHRAM },
 167
 168         /* Intel Bluetooth USB Bootloader (RAM module) */
 169         { USB_DEVICE(0x8087, 0x0a5a),
 170           .driver_info = BTUSB_INTEL_BOOT | BTUSB_BROKEN_ISOC },
 171
 172         { }     /* Terminating entry */
 173 };
 174
 175 MODULE_DEVICE_TABLE(usb, btusb_table);
 176
 177 static const struct usb_device_id blacklist_table[] = {
 178         /* CSR BlueCore devices */
 179         { USB_DEVICE(0x0a12, 0x0001), .driver_info = BTUSB_CSR },
 180
 181         /* Broadcom BCM2033 without firmware */
 182         { USB_DEVICE(0x0a5c, 0x2033), .driver_info = BTUSB_IGNORE },
 183
 184         /* Broadcom BCM2045 devices */
 185         { USB_DEVICE(0x0a5c, 0x2045), .driver_info = BTUSB_BCM2045 },
 186
 187         /* Atheros 3011 with sflash firmware */
 188         { USB_DEVICE(0x0489, 0xe027), .driver_info = BTUSB_IGNORE },
 189         { USB_DEVICE(0x0489, 0xe03d), .driver_info = BTUSB_IGNORE },
 190         { USB_DEVICE(0x04f2, 0xaff1), .driver_info = BTUSB_IGNORE },
 191         { USB_DEVICE(0x0930, 0x0215), .driver_info = BTUSB_IGNORE },
 192         { USB_DEVICE(0x0cf3, 0x3002), .driver_info = BTUSB_IGNORE },
 193         { USB_DEVICE(0x0cf3, 0xe019), .driver_info = BTUSB_IGNORE },
 194         { USB_DEVICE(0x13d3, 0x3304), .driver_info = BTUSB_IGNORE },
 195
 196         /* Atheros AR9285 Malbec with sflash firmware */
 197         { USB_DEVICE(0x03f0, 0x311d), .driver_info = BTUSB_IGNORE },
 198
 199         /* Atheros 3012 with sflash firmware */
 200         { USB_DEVICE(0x0489, 0xe04d), .driver_info = BTUSB_ATH3012 },
 201         { USB_DEVICE(0x0489, 0xe04e), .driver_info = BTUSB_ATH3012 },
 202         { USB_DEVICE(0x0489, 0xe056), .driver_info = BTUSB_ATH3012 },
 203         { USB_DEVICE(0x0489, 0xe057), .driver_info = BTUSB_ATH3012 },
 204         { USB_DEVICE(0x0489, 0xe05f), .driver_info = BTUSB_ATH3012 },
 205         { USB_DEVICE(0x0489, 0xe076), .driver_info = BTUSB_ATH3012 },
 206         { USB_DEVICE(0x0489, 0xe078), .driver_info = BTUSB_ATH3012 },
 207         { USB_DEVICE(0x0489, 0xe095), .driver_info = BTUSB_ATH3012 },
 208         { USB_DEVICE(0x04c5, 0x1330), .driver_info = BTUSB_ATH3012 },
 209         { USB_DEVICE(0x04ca, 0x3004), .driver_info = BTUSB_ATH3012 },
 210         { USB_DEVICE(0x04ca, 0x3005), .driver_info = BTUSB_ATH3012 },
 211         { USB_DEVICE(0x04ca, 0x3006), .driver_info = BTUSB_ATH3012 },
 212         { USB_DEVICE(0x04ca, 0x3007), .driver_info = BTUSB_ATH3012 },
 213         { USB_DEVICE(0x04ca, 0x3008), .driver_info = BTUSB_ATH3012 },
 214         { USB_DEVICE(0x04ca, 0x300b), .driver_info = BTUSB_ATH3012 },
 215         { USB_DEVICE(0x04ca, 0x300d), .driver_info = BTUSB_ATH3012 },
 216         { USB_DEVICE(0x04ca, 0x300f), .driver_info = BTUSB_ATH3012 },
 217         { USB_DEVICE(0x04ca, 0x3010), .driver_info = BTUSB_ATH3012 },
 218         { USB_DEVICE(0x04ca, 0x3014), .driver_info = BTUSB_ATH3012 },
 219         { USB_DEVICE(0x04ca, 0x3018), .driver_info = BTUSB_ATH3012 },
 220         { USB_DEVICE(0x0930, 0x0219), .driver_info = BTUSB_ATH3012 },
 221         { USB_DEVICE(0x0930, 0x021c), .driver_info = BTUSB_ATH3012 },
 222         { USB_DEVICE(0x0930, 0x0220), .driver_info = BTUSB_ATH3012 },
 223         { USB_DEVICE(0x0930, 0x0227), .driver_info = BTUSB_ATH3012 },
 224         { USB_DEVICE(0x0b05, 0x17d0), .driver_info = BTUSB_ATH3012 },
 225         { USB_DEVICE(0x0cf3, 0x0036), .driver_info = BTUSB_ATH3012 },
 226         { USB_DEVICE(0x0cf3, 0x3004), .driver_info = BTUSB_ATH3012 },
 227         { USB_DEVICE(0x0cf3, 0x3008), .driver_info = BTUSB_ATH3012 },
 228         { USB_DEVICE(0x0cf3, 0x311d), .driver_info = BTUSB_ATH3012 },
 229         { USB_DEVICE(0x0cf3, 0x311e), .driver_info = BTUSB_ATH3012 },
 230         { USB_DEVICE(0x0cf3, 0x311f), .driver_info = BTUSB_ATH3012 },
 231         { USB_DEVICE(0x0cf3, 0x3121), .driver_info = BTUSB_ATH3012 },
 232         { USB_DEVICE(0x0cf3, 0x817a), .driver_info = BTUSB_ATH3012 },
 233         { USB_DEVICE(0x0cf3, 0x817b), .driver_info = BTUSB_ATH3012 },
 234         { USB_DEVICE(0x0cf3, 0xe003), .driver_info = BTUSB_ATH3012 },
 235         { USB_DEVICE(0x0cf3, 0xe004), .driver_info = BTUSB_ATH3012 },
 236         { USB_DEVICE(0x0cf3, 0xe005), .driver_info = BTUSB_ATH3012 },
 237         { USB_DEVICE(0x0cf3, 0xe006), .driver_info = BTUSB_ATH3012 },
 238         { USB_DEVICE(0x13d3, 0x3362), .driver_info = BTUSB_ATH3012 },
 239         { USB_DEVICE(0x13d3, 0x3375), .driver_info = BTUSB_ATH3012 },
 240         { USB_DEVICE(0x13d3, 0x3393), .driver_info = BTUSB_ATH3012 },
 241         { USB_DEVICE(0x13d3, 0x3395), .driver_info = BTUSB_ATH3012 },
 242         { USB_DEVICE(0x13d3, 0x3402), .driver_info = BTUSB_ATH3012 },
 243         { USB_DEVICE(0x13d3, 0x3408), .driver_info = BTUSB_ATH3012 },
 244         { USB_DEVICE(0x13d3, 0x3423), .driver_info = BTUSB_ATH3012 },
 245         { USB_DEVICE(0x13d3, 0x3432), .driver_info = BTUSB_ATH3012 },
 246         { USB_DEVICE(0x13d3, 0x3472), .driver_info = BTUSB_ATH3012 },
 247         { USB_DEVICE(0x13d3, 0x3474), .driver_info = BTUSB_ATH3012 },
 248         { USB_DEVICE(0x13d3, 0x3487), .driver_info = BTUSB_ATH3012 },
 249         { USB_DEVICE(0x13d3, 0x3490), .driver_info = BTUSB_ATH3012 },
 250
 251         /* Atheros AR5BBU12 with sflash firmware */
 252         { USB_DEVICE(0x0489, 0xe02c), .driver_info = BTUSB_IGNORE },
 253
 254         /* Atheros AR5BBU12 with sflash firmware */
 255         { USB_DEVICE(0x0489, 0xe036), .driver_info = BTUSB_ATH3012 },
 256         { USB_DEVICE(0x0489, 0xe03c), .driver_info = BTUSB_ATH3012 },
 257
 258         /* QCA ROME chipset */
 259         { USB_DEVICE(0x0cf3, 0x535b), .driver_info = BTUSB_QCA_ROME |
 260                                                      BTUSB_WIDEBAND_SPEECH },
 261         { USB_DEVICE(0x0cf3, 0xe007), .driver_info = BTUSB_QCA_ROME |
 262                                                      BTUSB_WIDEBAND_SPEECH },
 263         { USB_DEVICE(0x0cf3, 0xe009), .driver_info = BTUSB_QCA_ROME |
 264                                                      BTUSB_WIDEBAND_SPEECH },
 265         { USB_DEVICE(0x0cf3, 0xe010), .driver_info = BTUSB_QCA_ROME |
 266                                                      BTUSB_WIDEBAND_SPEECH },
 267         { USB_DEVICE(0x0cf3, 0xe300), .driver_info = BTUSB_QCA_ROME |
 268                                                      BTUSB_WIDEBAND_SPEECH },
 269         { USB_DEVICE(0x0cf3, 0xe301), .driver_info = BTUSB_QCA_ROME |
 270                                                      BTUSB_WIDEBAND_SPEECH },
 271         { USB_DEVICE(0x0cf3, 0xe360), .driver_info = BTUSB_QCA_ROME |
 272                                                      BTUSB_WIDEBAND_SPEECH },
 273         { USB_DEVICE(0x0489, 0xe092), .driver_info = BTUSB_QCA_ROME |
 274                                                      BTUSB_WIDEBAND_SPEECH },
 275         { USB_DEVICE(0x0489, 0xe09f), .driver_info = BTUSB_QCA_ROME |
 276                                                      BTUSB_WIDEBAND_SPEECH },
 277         { USB_DEVICE(0x0489, 0xe0a2), .driver_info = BTUSB_QCA_ROME |
 278                                                      BTUSB_WIDEBAND_SPEECH },
 279         { USB_DEVICE(0x04ca, 0x3011), .driver_info = BTUSB_QCA_ROME |
 280                                                      BTUSB_WIDEBAND_SPEECH },
 281         { USB_DEVICE(0x04ca, 0x3015), .driver_info = BTUSB_QCA_ROME |
 282                                                      BTUSB_WIDEBAND_SPEECH },
 283         { USB_DEVICE(0x04ca, 0x3016), .driver_info = BTUSB_QCA_ROME |
 284                                                      BTUSB_WIDEBAND_SPEECH },
 285         { USB_DEVICE(0x04ca, 0x301a), .driver_info = BTUSB_QCA_ROME |
 286                                                      BTUSB_WIDEBAND_SPEECH },
 287         { USB_DEVICE(0x04ca, 0x3021), .driver_info = BTUSB_QCA_ROME |
 288                                                      BTUSB_WIDEBAND_SPEECH },
 289         { USB_DEVICE(0x13d3, 0x3491), .driver_info = BTUSB_QCA_ROME |
 290                                                      BTUSB_WIDEBAND_SPEECH },
 291         { USB_DEVICE(0x13d3, 0x3496), .driver_info = BTUSB_QCA_ROME |
 292                                                      BTUSB_WIDEBAND_SPEECH },
 293         { USB_DEVICE(0x13d3, 0x3501), .driver_info = BTUSB_QCA_ROME |
 294                                                      BTUSB_WIDEBAND_SPEECH },
 295
 296         /* QCA WCN6855 chipset */
 297         { USB_DEVICE(0x0cf3, 0xe600), .driver_info = BTUSB_QCA_WCN6855 |
 298                                                      BTUSB_WIDEBAND_SPEECH },
 299
 300         /* Broadcom BCM2035 */
 301         { USB_DEVICE(0x0a5c, 0x2009), .driver_info = BTUSB_BCM92035 },
 302         { USB_DEVICE(0x0a5c, 0x200a), .driver_info = BTUSB_WRONG_SCO_MTU },
 303         { USB_DEVICE(0x0a5c, 0x2035), .driver_info = BTUSB_WRONG_SCO_MTU },
 304
 305         /* Broadcom BCM2045 */
 306         { USB_DEVICE(0x0a5c, 0x2039), .driver_info = BTUSB_WRONG_SCO_MTU },
 307         { USB_DEVICE(0x0a5c, 0x2101), .driver_info = BTUSB_WRONG_SCO_MTU },
 308
 309         /* IBM/Lenovo ThinkPad with Broadcom chip */
 310         { USB_DEVICE(0x0a5c, 0x201e), .driver_info = BTUSB_WRONG_SCO_MTU },
 311         { USB_DEVICE(0x0a5c, 0x2110), .driver_info = BTUSB_WRONG_SCO_MTU },
 312
 313         /* HP laptop with Broadcom chip */
 314         { USB_DEVICE(0x03f0, 0x171d), .driver_info = BTUSB_WRONG_SCO_MTU },
 315
 316         /* Dell laptop with Broadcom chip */
 317         { USB_DEVICE(0x413c, 0x8126), .driver_info = BTUSB_WRONG_SCO_MTU },
 318
 319         /* Dell Wireless 370 and 410 devices */
 320         { USB_DEVICE(0x413c, 0x8152), .driver_info = BTUSB_WRONG_SCO_MTU },
 321         { USB_DEVICE(0x413c, 0x8156), .driver_info = BTUSB_WRONG_SCO_MTU },
 322
 323         /* Belkin F8T012 and F8T013 devices */
 324         { USB_DEVICE(0x050d, 0x0012), .driver_info = BTUSB_WRONG_SCO_MTU },
 325         { USB_DEVICE(0x050d, 0x0013), .driver_info = BTUSB_WRONG_SCO_MTU },
 326
 327         /* Asus WL-BTD202 device */
 328         { USB_DEVICE(0x0b05, 0x1715), .driver_info = BTUSB_WRONG_SCO_MTU },
 329
 330         /* Kensington Bluetooth USB adapter */
 331         { USB_DEVICE(0x047d, 0x105e), .driver_info = BTUSB_WRONG_SCO_MTU },
 332
 333         /* RTX Telecom based adapters with buggy SCO support */
 334         { USB_DEVICE(0x0400, 0x0807), .driver_info = BTUSB_BROKEN_ISOC },
 335         { USB_DEVICE(0x0400, 0x080a), .driver_info = BTUSB_BROKEN_ISOC },
 336
 337         /* CONWISE Technology based adapters with buggy SCO support */
 338         { USB_DEVICE(0x0e5e, 0x6622),
 339           .driver_info = BTUSB_BROKEN_ISOC | BTUSB_CW6622},
 340
 341         /* Roper Class 1 Bluetooth Dongle (Silicon Wave based) */
 342         { USB_DEVICE(0x1310, 0x0001), .driver_info = BTUSB_SWAVE },
 343
 344         /* Digianswer devices */
 345         { USB_DEVICE(0x08fd, 0x0001), .driver_info = BTUSB_DIGIANSWER },
 346         { USB_DEVICE(0x08fd, 0x0002), .driver_info = BTUSB_IGNORE },
 347
 348         /* CSR BlueCore Bluetooth Sniffer */
 349         { USB_DEVICE(0x0a12, 0x0002),
 350           .driver_info = BTUSB_SNIFFER | BTUSB_BROKEN_ISOC },
 351
 352         /* Frontline ComProbe Bluetooth Sniffer */
 353         { USB_DEVICE(0x16d3, 0x0002),
 354           .driver_info = BTUSB_SNIFFER | BTUSB_BROKEN_ISOC },
 355
 356         /* Marvell Bluetooth devices */
 357         { USB_DEVICE(0x1286, 0x2044), .driver_info = BTUSB_MARVELL },
 358         { USB_DEVICE(0x1286, 0x2046), .driver_info = BTUSB_MARVELL },
 359         { USB_DEVICE(0x1286, 0x204e), .driver_info = BTUSB_MARVELL },
 360
 361         /* Intel Bluetooth devices */
 362         { USB_DEVICE(0x8087, 0x0025), .driver_info = BTUSB_INTEL_NEW |
 363                                                      BTUSB_WIDEBAND_SPEECH |
 364                                                      BTUSB_VALID_LE_STATES },
 365         { USB_DEVICE(0x8087, 0x0026), .driver_info = BTUSB_INTEL_NEW |
 366                                                      BTUSB_WIDEBAND_SPEECH },
 367         { USB_DEVICE(0x8087, 0x0029), .driver_info = BTUSB_INTEL_NEW |
 368                                                      BTUSB_WIDEBAND_SPEECH },
 369         { USB_DEVICE(0x8087, 0x0032), .driver_info = BTUSB_INTEL_NEWGEN |
 370                                                      BTUSB_WIDEBAND_SPEECH},
 371         { USB_DEVICE(0x8087, 0x0033), .driver_info = BTUSB_INTEL_NEWGEN |
 372                                                      BTUSB_WIDEBAND_SPEECH},
 373         { USB_DEVICE(0x8087, 0x07da), .driver_info = BTUSB_CSR },
 374         { USB_DEVICE(0x8087, 0x07dc), .driver_info = BTUSB_INTEL },
 375         { USB_DEVICE(0x8087, 0x0a2a), .driver_info = BTUSB_INTEL },
 376         { USB_DEVICE(0x8087, 0x0a2b), .driver_info = BTUSB_INTEL_NEW |
 377                                                      BTUSB_WIDEBAND_SPEECH },
 378         { USB_DEVICE(0x8087, 0x0aa7), .driver_info = BTUSB_INTEL |
 379                                                      BTUSB_WIDEBAND_SPEECH },
 380         { USB_DEVICE(0x8087, 0x0aaa), .driver_info = BTUSB_INTEL_NEW |
 381                                                      BTUSB_WIDEBAND_SPEECH |
 382                                                      BTUSB_VALID_LE_STATES },
 383
 384         /* Other Intel Bluetooth devices */
 385         { USB_VENDOR_AND_INTERFACE_INFO(0x8087, 0xe0, 0x01, 0x01),
 386           .driver_info = BTUSB_IGNORE },
 387
 388         /* Realtek 8822CE Bluetooth devices */
 389         { USB_DEVICE(0x0bda, 0xb00c), .driver_info = BTUSB_REALTEK |
 390                                                      BTUSB_WIDEBAND_SPEECH },
 391
 392         /* Realtek 8852AE Bluetooth devices */
 393         { USB_DEVICE(0x0bda, 0xc852), .driver_info = BTUSB_REALTEK |
 394                                                      BTUSB_WIDEBAND_SPEECH },
 395
 396         /* Realtek Bluetooth devices */
 397         { USB_VENDOR_AND_INTERFACE_INFO(0x0bda, 0xe0, 0x01, 0x01),
 398           .driver_info = BTUSB_REALTEK },
 399
 400         /* MediaTek Bluetooth devices */
 401         { USB_VENDOR_AND_INTERFACE_INFO(0x0e8d, 0xe0, 0x01, 0x01),
 402           .driver_info = BTUSB_MEDIATEK },
 403
 404         /* Additional MediaTek MT7615E Bluetooth devices */
 405         { USB_DEVICE(0x13d3, 0x3560), .driver_info = BTUSB_MEDIATEK},
 406
 407         /* Additional Realtek 8723AE Bluetooth devices */
 408         { USB_DEVICE(0x0930, 0x021d), .driver_info = BTUSB_REALTEK },
 409         { USB_DEVICE(0x13d3, 0x3394), .driver_info = BTUSB_REALTEK },
 410
 411         /* Additional Realtek 8723BE Bluetooth devices */
 412         { USB_DEVICE(0x0489, 0xe085), .driver_info = BTUSB_REALTEK },
 413         { USB_DEVICE(0x0489, 0xe08b), .driver_info = BTUSB_REALTEK },
 414         { USB_DEVICE(0x13d3, 0x3410), .driver_info = BTUSB_REALTEK },
 415         { USB_DEVICE(0x13d3, 0x3416), .driver_info = BTUSB_REALTEK },
 416         { USB_DEVICE(0x13d3, 0x3459), .driver_info = BTUSB_REALTEK },
 417         { USB_DEVICE(0x13d3, 0x3494), .driver_info = BTUSB_REALTEK },
 418
 419         /* Additional Realtek 8723BU Bluetooth devices */
 420         { USB_DEVICE(0x7392, 0xa611), .driver_info = BTUSB_REALTEK },
 421
 422         /* Additional Realtek 8723DE Bluetooth devices */
 423         { USB_DEVICE(0x0bda, 0xb009), .driver_info = BTUSB_REALTEK },
 424         { USB_DEVICE(0x2ff8, 0xb011), .driver_info = BTUSB_REALTEK },
 425
 426         /* Additional Realtek 8821AE Bluetooth devices */
 427         { USB_DEVICE(0x0b05, 0x17dc), .driver_info = BTUSB_REALTEK },
 428         { USB_DEVICE(0x13d3, 0x3414), .driver_info = BTUSB_REALTEK },
 429         { USB_DEVICE(0x13d3, 0x3458), .driver_info = BTUSB_REALTEK },
 430         { USB_DEVICE(0x13d3, 0x3461), .driver_info = BTUSB_REALTEK },
 431         { USB_DEVICE(0x13d3, 0x3462), .driver_info = BTUSB_REALTEK },
 432
 433         /* Additional Realtek 8822BE Bluetooth devices */
 434         { USB_DEVICE(0x13d3, 0x3526), .driver_info = BTUSB_REALTEK },
 435         { USB_DEVICE(0x0b05, 0x185c), .driver_info = BTUSB_REALTEK },
 436
 437         /* Additional Realtek 8822CE Bluetooth devices */
 438         { USB_DEVICE(0x04ca, 0x4005), .driver_info = BTUSB_REALTEK |
 439                                                      BTUSB_WIDEBAND_SPEECH },
 440         { USB_DEVICE(0x04c5, 0x161f), .driver_info = BTUSB_REALTEK |
 441                                                      BTUSB_WIDEBAND_SPEECH },
 442         { USB_DEVICE(0x0b05, 0x18ef), .driver_info = BTUSB_REALTEK |
 443                                                      BTUSB_WIDEBAND_SPEECH },
 444         { USB_DEVICE(0x13d3, 0x3548), .driver_info = BTUSB_REALTEK |
 445                                                      BTUSB_WIDEBAND_SPEECH },
 446         { USB_DEVICE(0x13d3, 0x3549), .driver_info = BTUSB_REALTEK |
 447                                                      BTUSB_WIDEBAND_SPEECH },
 448         { USB_DEVICE(0x13d3, 0x3553), .driver_info = BTUSB_REALTEK |
 449                                                      BTUSB_WIDEBAND_SPEECH },
 450         { USB_DEVICE(0x13d3, 0x3555), .driver_info = BTUSB_REALTEK |
 451                                                      BTUSB_WIDEBAND_SPEECH },
 452         { USB_DEVICE(0x2ff8, 0x3051), .driver_info = BTUSB_REALTEK |
 453                                                      BTUSB_WIDEBAND_SPEECH },
 454         { USB_DEVICE(0x1358, 0xc123), .driver_info = BTUSB_REALTEK |
 455                                                      BTUSB_WIDEBAND_SPEECH },
 456         { USB_DEVICE(0x0bda, 0xc123), .driver_info = BTUSB_REALTEK |
 457                                                      BTUSB_WIDEBAND_SPEECH },
 458         { USB_DEVICE(0x0cb5, 0xc547), .driver_info = BTUSB_REALTEK |
 459                                                      BTUSB_WIDEBAND_SPEECH },
 460
 461         /* Silicon Wave based devices */
 462         { USB_DEVICE(0x0c10, 0x0000), .driver_info = BTUSB_SWAVE },
 463
 464         { }     /* Terminating entry */
 465 };
 466
 467 /* The Bluetooth USB module build into some devices needs to be reset on resume,
 468  * this is a problem with the platform (likely shutting off all power) not with
 469  * the module itself. So we use a DMI list to match known broken platforms.
 470  */
 471 static const struct dmi_system_id btusb_needs_reset_resume_table[] = {
 472         {
 473                 /* Dell OptiPlex 3060 (QCA ROME device 0cf3:e007) */
 474                 .matches = {
 475                         DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."),
 476                         DMI_MATCH(DMI_PRODUCT_NAME, "OptiPlex 3060"),
 477                 },
 478         },
 479         {
 480                 /* Dell XPS 9360 (QCA ROME device 0cf3:e300) */
 481                 .matches = {
 482                         DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."),
 483                         DMI_MATCH(DMI_PRODUCT_NAME, "XPS 13 9360"),
 484                 },
 485         },
 486         {
 487                 /* Dell Inspiron 5565 (QCA ROME device 0cf3:e009) */
 488                 .matches = {
 489                         DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."),
 490                         DMI_MATCH(DMI_PRODUCT_NAME, "Inspiron 5565"),
 491                 },
 492         },
 493         {}
 494 };
 495
 496 #define BTUSB_MAX_ISOC_FRAMES   10
 497
 498 #define BTUSB_INTR_RUNNING      0
 499 #define BTUSB_BULK_RUNNING      1
 500 #define BTUSB_ISOC_RUNNING      2
 501 #define BTUSB_SUSPENDING        3
 502 #define BTUSB_DID_ISO_RESUME    4
 503 #define BTUSB_BOOTLOADER        5
 504 #define BTUSB_DOWNLOADING       6
 505 #define BTUSB_FIRMWARE_LOADED   7
 506 #define BTUSB_FIRMWARE_FAILED   8
 507 #define BTUSB_BOOTING           9
 508 #define BTUSB_DIAG_RUNNING      10
 509 #define BTUSB_OOB_WAKE_ENABLED  11
 510 #define BTUSB_HW_RESET_ACTIVE   12
 511 #define BTUSB_TX_WAIT_VND_EVT   13
 512 #define BTUSB_WAKEUP_DISABLE    14
 513
 514 struct btusb_data {
 515         struct hci_dev       *hdev;
 516         struct usb_device    *udev;
 517         struct usb_interface *intf;
 518         struct usb_interface *isoc;
 519         struct usb_interface *diag;
 520         unsigned isoc_ifnum;
 521
 522         unsigned long flags;
 523
 524         struct work_struct work;
 525         struct work_struct waker;
 526
 527         struct usb_anchor deferred;
 528         struct usb_anchor tx_anchor;
 529         int tx_in_flight;
 530         spinlock_t txlock;
 531
 532         struct usb_anchor intr_anchor;
 533         struct usb_anchor bulk_anchor;
 534         struct usb_anchor isoc_anchor;
 535         struct usb_anchor diag_anchor;
 536         struct usb_anchor ctrl_anchor;
 537         spinlock_t rxlock;
 538
 539         struct sk_buff *evt_skb;
 540         struct sk_buff *acl_skb;
 541         struct sk_buff *sco_skb;
 542
 543         struct usb_endpoint_descriptor *intr_ep;
 544         struct usb_endpoint_descriptor *bulk_tx_ep;
 545         struct usb_endpoint_descriptor *bulk_rx_ep;
 546         struct usb_endpoint_descriptor *isoc_tx_ep;
 547         struct usb_endpoint_descriptor *isoc_rx_ep;
 548         struct usb_endpoint_descriptor *diag_tx_ep;
 549         struct usb_endpoint_descriptor *diag_rx_ep;
 550
 551         struct gpio_desc *reset_gpio;
 552
 553         __u8 cmdreq_type;
 554         __u8 cmdreq;
 555
 556         unsigned int sco_num;
 557         unsigned int air_mode;
 558         bool usb_alt6_packet_flow;
 559         int isoc_altsetting;
 560         int suspend_count;
 561
 562         int (*recv_event)(struct hci_dev *hdev, struct sk_buff *skb);
 563         int (*recv_bulk)(struct btusb_data *data, void *buffer, int count);
 564
 565         int (*setup_on_usb)(struct hci_dev *hdev);
 566
 567         int oob_wake_irq;   /* irq for out-of-band wake-on-bt */
 568         unsigned cmd_timeout_cnt;
 569 };
 570
 571 static void btusb_intel_cmd_timeout(struct hci_dev *hdev)
 572 {
 573         struct btusb_data *data = hci_get_drvdata(hdev);
 574         struct gpio_desc *reset_gpio = data->reset_gpio;
 575
 576         if (++data->cmd_timeout_cnt < 5)
 577                 return;
 578
 579         if (!reset_gpio) {
 580                 bt_dev_err(hdev, "No way to reset. Ignoring and continuing");
 581                 return;
 582         }
 583
 584         /*
 585          * Toggle the hard reset line if the platform provides one. The reset
 586          * is going to yank the device off the USB and then replug. So doing
 587          * once is enough. The cleanup is handled correctly on the way out
 588          * (standard USB disconnect), and the new device is detected cleanly
 589          * and bound to the driver again like it should be.
 590          */
 591         if (test_and_set_bit(BTUSB_HW_RESET_ACTIVE, &data->flags)) {
 592                 bt_dev_err(hdev, "last reset failed? Not resetting again");
 593                 return;
 594         }
 595
 596         bt_dev_err(hdev, "Initiating HW reset via gpio");
 597         gpiod_set_value_cansleep(reset_gpio, 1);
 598         msleep(100);
 599         gpiod_set_value_cansleep(reset_gpio, 0);
 600 }
 601
 602 static void btusb_rtl_cmd_timeout(struct hci_dev *hdev)
 603 {
 604         struct btusb_data *data = hci_get_drvdata(hdev);
 605         struct gpio_desc *reset_gpio = data->reset_gpio;
 606
 607         if (++data->cmd_timeout_cnt < 5)
 608                 return;
 609
 610         if (!reset_gpio) {
 611                 bt_dev_err(hdev, "No gpio to reset Realtek device, ignoring");
 612                 return;
 613         }
 614
 615         /* Toggle the hard reset line. The Realtek device is going to
 616          * yank itself off the USB and then replug. The cleanup is handled
 617          * correctly on the way out (standard USB disconnect), and the new
 618          * device is detected cleanly and bound to the driver again like
 619          * it should be.
 620          */
 621         if (test_and_set_bit(BTUSB_HW_RESET_ACTIVE, &data->flags)) {
 622                 bt_dev_err(hdev, "last reset failed? Not resetting again");
 623                 return;
 624         }
 625
 626         bt_dev_err(hdev, "Reset Realtek device via gpio");
 627         gpiod_set_value_cansleep(reset_gpio, 1);
 628         msleep(200);
 629         gpiod_set_value_cansleep(reset_gpio, 0);
 630 }
 631
 632 static void btusb_qca_cmd_timeout(struct hci_dev *hdev)
 633 {
 634         struct btusb_data *data = hci_get_drvdata(hdev);
 635         int err;
 636
 637         if (++data->cmd_timeout_cnt < 5)
 638                 return;
 639
 640         bt_dev_err(hdev, "Multiple cmd timeouts seen. Resetting usb device.");
 641         /* This is not an unbalanced PM reference since the device will reset */
 642         err = usb_autopm_get_interface(data->intf);
 643         if (!err)
 644                 usb_queue_reset_device(data->intf);
 645         else
 646                 bt_dev_err(hdev, "Failed usb_autopm_get_interface with %d", err);
 647 }
 648
 649 static inline void btusb_free_frags(struct btusb_data *data)
 650 {
 651         unsigned long flags;
 652
 653         spin_lock_irqsave(&data->rxlock, flags);
 654
 655         kfree_skb(data->evt_skb);
 656         data->evt_skb = NULL;
 657
 658         kfree_skb(data->acl_skb);
 659         data->acl_skb = NULL;
 660
 661         kfree_skb(data->sco_skb);
 662         data->sco_skb = NULL;
 663
 664         spin_unlock_irqrestore(&data->rxlock, flags);
 665 }
 666
 667 static int btusb_recv_intr(struct btusb_data *data, void *buffer, int count)
 668 {
 669         struct sk_buff *skb;
 670         unsigned long flags;
 671         int err = 0;
 672
 673         spin_lock_irqsave(&data->rxlock, flags);
 674         skb = data->evt_skb;
 675
 676         while (count) {
 677                 int len;
 678
 679                 if (!skb) {
 680                         skb = bt_skb_alloc(HCI_MAX_EVENT_SIZE, GFP_ATOMIC);
 681                         if (!skb) {
 682                                 err = -ENOMEM;
 683                                 break;
 684                         }
 685
 686                         hci_skb_pkt_type(skb) = HCI_EVENT_PKT;
 687                         hci_skb_expect(skb) = HCI_EVENT_HDR_SIZE;
 688                 }
 689
 690                 len = min_t(uint, hci_skb_expect(skb), count);
 691                 skb_put_data(skb, buffer, len);
 692
 693                 count -= len;
 694                 buffer += len;
 695                 hci_skb_expect(skb) -= len;
 696
 697                 if (skb->len == HCI_EVENT_HDR_SIZE) {
 698                         /* Complete event header */
 699                         hci_skb_expect(skb) = hci_event_hdr(skb)->plen;
 700
 701                         if (skb_tailroom(skb) < hci_skb_expect(skb)) {
 702                                 kfree_skb(skb);
 703                                 skb = NULL;
 704
 705                                 err = -EILSEQ;
 706                                 break;
 707                         }
 708                 }
 709
 710                 if (!hci_skb_expect(skb)) {
 711                         /* Complete frame */
 712                         data->recv_event(data->hdev, skb);
 713                         skb = NULL;
 714                 }
 715         }
 716
 717         data->evt_skb = skb;
 718         spin_unlock_irqrestore(&data->rxlock, flags);
 719
 720         return err;
 721 }
 722
 723 static int btusb_recv_bulk(struct btusb_data *data, void *buffer, int count)
 724 {
 725         struct sk_buff *skb;
 726         unsigned long flags;
 727         int err = 0;
 728
 729         spin_lock_irqsave(&data->rxlock, flags);
 730         skb = data->acl_skb;
 731
 732         while (count) {
 733                 int len;
 734
 735                 if (!skb) {
 736                         skb = bt_skb_alloc(HCI_MAX_FRAME_SIZE, GFP_ATOMIC);
 737                         if (!skb) {
 738                                 err = -ENOMEM;
 739                                 break;
 740                         }
 741
 742                         hci_skb_pkt_type(skb) = HCI_ACLDATA_PKT;
 743                         hci_skb_expect(skb) = HCI_ACL_HDR_SIZE;
 744                 }
 745
 746                 len = min_t(uint, hci_skb_expect(skb), count);
 747                 skb_put_data(skb, buffer, len);
 748
 749                 count -= len;
 750                 buffer += len;
 751                 hci_skb_expect(skb) -= len;
 752
 753                 if (skb->len == HCI_ACL_HDR_SIZE) {
 754                         __le16 dlen = hci_acl_hdr(skb)->dlen;
 755
 756                         /* Complete ACL header */
 757                         hci_skb_expect(skb) = __le16_to_cpu(dlen);
 758
 759                         if (skb_tailroom(skb) < hci_skb_expect(skb)) {
 760                                 kfree_skb(skb);
 761                                 skb = NULL;
 762
 763                                 err = -EILSEQ;
 764                                 break;
 765                         }
 766                 }
 767
 768                 if (!hci_skb_expect(skb)) {
 769                         /* Complete frame */
 770                         hci_recv_frame(data->hdev, skb);
 771                         skb = NULL;
 772                 }
 773         }
 774
 775         data->acl_skb = skb;
 776         spin_unlock_irqrestore(&data->rxlock, flags);
 777
 778         return err;
 779 }
 780
 781 static int btusb_recv_isoc(struct btusb_data *data, void *buffer, int count)
 782 {
 783         struct sk_buff *skb;
 784         unsigned long flags;
 785         int err = 0;
 786
 787         spin_lock_irqsave(&data->rxlock, flags);
 788         skb = data->sco_skb;
 789
 790         while (count) {
 791                 int len;
 792
 793                 if (!skb) {
 794                         skb = bt_skb_alloc(HCI_MAX_SCO_SIZE, GFP_ATOMIC);
 795                         if (!skb) {
 796                                 err = -ENOMEM;
 797                                 break;
 798                         }
 799
 800                         hci_skb_pkt_type(skb) = HCI_SCODATA_PKT;
 801                         hci_skb_expect(skb) = HCI_SCO_HDR_SIZE;
 802                 }
 803
 804                 len = min_t(uint, hci_skb_expect(skb), count);
 805                 skb_put_data(skb, buffer, len);
 806
 807                 count -= len;
 808                 buffer += len;
 809                 hci_skb_expect(skb) -= len;
 810
 811                 if (skb->len == HCI_SCO_HDR_SIZE) {
 812                         /* Complete SCO header */
 813                         hci_skb_expect(skb) = hci_sco_hdr(skb)->dlen;
 814
 815                         if (skb_tailroom(skb) < hci_skb_expect(skb)) {
 816                                 kfree_skb(skb);
 817                                 skb = NULL;
 818
 819                                 err = -EILSEQ;
 820                                 break;
 821                         }
 822                 }
 823
 824                 if (!hci_skb_expect(skb)) {
 825                         /* Complete frame */
 826                         hci_recv_frame(data->hdev, skb);
 827                         skb = NULL;
 828                 }
 829         }
 830
 831         data->sco_skb = skb;
 832         spin_unlock_irqrestore(&data->rxlock, flags);
 833
 834         return err;
 835 }
 836
 837 static void btusb_intr_complete(struct urb *urb)
 838 {
 839         struct hci_dev *hdev = urb->context;
 840         struct btusb_data *data = hci_get_drvdata(hdev);
 841         int err;
 842
 843         BT_DBG("%s urb %p status %d count %d", hdev->name, urb, urb->status,
 844                urb->actual_length);
 845
 846         if (!test_bit(HCI_RUNNING, &hdev->flags))
 847                 return;
 848
 849         if (urb->status == 0) {
 850                 hdev->stat.byte_rx += urb->actual_length;
 851
 852                 if (btusb_recv_intr(data, urb->transfer_buffer,
 853                                     urb->actual_length) < 0) {
 854                         bt_dev_err(hdev, "corrupted event packet");
 855                         hdev->stat.err_rx++;
 856                 }
 857         } else if (urb->status == -ENOENT) {
 858                 /* Avoid suspend failed when usb_kill_urb */
 859                 return;
 860         }
 861
 862         if (!test_bit(BTUSB_INTR_RUNNING, &data->flags))
 863                 return;
 864
 865         usb_mark_last_busy(data->udev);
 866         usb_anchor_urb(urb, &data->intr_anchor);
 867
 868         err = usb_submit_urb(urb, GFP_ATOMIC);
 869         if (err < 0) {
 870                 /* -EPERM: urb is being killed;
 871                  * -ENODEV: device got disconnected
 872                  */
 873                 if (err != -EPERM && err != -ENODEV)
 874                         bt_dev_err(hdev, "urb %p failed to resubmit (%d)",
 875                                    urb, -err);
 876                 usb_unanchor_urb(urb);
 877         }
 878 }
 879
 880 static int btusb_submit_intr_urb(struct hci_dev *hdev, gfp_t mem_flags)
 881 {
 882         struct btusb_data *data = hci_get_drvdata(hdev);
 883         struct urb *urb;
 884         unsigned char *buf;
 885         unsigned int pipe;
 886         int err, size;
 887
 888         BT_DBG("%s", hdev->name);
 889
 890         if (!data->intr_ep)
 891                 return -ENODEV;
 892
 893         urb = usb_alloc_urb(0, mem_flags);
 894         if (!urb)
 895                 return -ENOMEM;
 896
 897         size = le16_to_cpu(data->intr_ep->wMaxPacketSize);
 898
 899         buf = kmalloc(size, mem_flags);
 900         if (!buf) {
 901                 usb_free_urb(urb);
 902                 return -ENOMEM;
 903         }
 904
 905         pipe = usb_rcvintpipe(data->udev, data->intr_ep->bEndpointAddress);
 906
 907         usb_fill_int_urb(urb, data->udev, pipe, buf, size,
 908                          btusb_intr_complete, hdev, data->intr_ep->bInterval);
 909
 910         urb->transfer_flags |= URB_FREE_BUFFER;
 911
 912         usb_anchor_urb(urb, &data->intr_anchor);
 913
 914         err = usb_submit_urb(urb, mem_flags);
 915         if (err < 0) {
 916                 if (err != -EPERM && err != -ENODEV)
 917                         bt_dev_err(hdev, "urb %p submission failed (%d)",
 918                                    urb, -err);
 919                 usb_unanchor_urb(urb);
 920         }
 921
 922         usb_free_urb(urb);
 923
 924         return err;
 925 }
 926
 927 static void btusb_bulk_complete(struct urb *urb)
 928 {
 929         struct hci_dev *hdev = urb->context;
 930         struct btusb_data *data = hci_get_drvdata(hdev);
 931         int err;
 932
 933         BT_DBG("%s urb %p status %d count %d", hdev->name, urb, urb->status,
 934                urb->actual_length);
 935
 936         if (!test_bit(HCI_RUNNING, &hdev->flags))
 937                 return;
 938
 939         if (urb->status == 0) {
 940                 hdev->stat.byte_rx += urb->actual_length;
 941
 942                 if (data->recv_bulk(data, urb->transfer_buffer,
 943                                     urb->actual_length) < 0) {
 944                         bt_dev_err(hdev, "corrupted ACL packet");
 945                         hdev->stat.err_rx++;
 946                 }
 947         } else if (urb->status == -ENOENT) {
 948                 /* Avoid suspend failed when usb_kill_urb */
 949                 return;
 950         }
 951
 952         if (!test_bit(BTUSB_BULK_RUNNING, &data->flags))
 953                 return;
 954
 955         usb_anchor_urb(urb, &data->bulk_anchor);
 956         usb_mark_last_busy(data->udev);
 957
 958         err = usb_submit_urb(urb, GFP_ATOMIC);
 959         if (err < 0) {
 960                 /* -EPERM: urb is being killed;
 961                  * -ENODEV: device got disconnected
 962                  */
 963                 if (err != -EPERM && err != -ENODEV)
 964                         bt_dev_err(hdev, "urb %p failed to resubmit (%d)",
 965                                    urb, -err);
 966                 usb_unanchor_urb(urb);
 967         }
 968 }
 969
 970 static int btusb_submit_bulk_urb(struct hci_dev *hdev, gfp_t mem_flags)
 971 {
 972         struct btusb_data *data = hci_get_drvdata(hdev);
 973         struct urb *urb;
 974         unsigned char *buf;
 975         unsigned int pipe;
 976         int err, size = HCI_MAX_FRAME_SIZE;
 977
 978         BT_DBG("%s", hdev->name);
 979
 980         if (!data->bulk_rx_ep)
 981                 return -ENODEV;
 982
 983         urb = usb_alloc_urb(0, mem_flags);
 984         if (!urb)
 985                 return -ENOMEM;
 986
 987         buf = kmalloc(size, mem_flags);
 988         if (!buf) {
 989                 usb_free_urb(urb);
 990                 return -ENOMEM;
 991         }
 992
 993         pipe = usb_rcvbulkpipe(data->udev, data->bulk_rx_ep->bEndpointAddress);
 994
 995         usb_fill_bulk_urb(urb, data->udev, pipe, buf, size,
 996                           btusb_bulk_complete, hdev);
 997
 998         urb->transfer_flags |= URB_FREE_BUFFER;
 999
1000         usb_mark_last_busy(data->udev);
1001         usb_anchor_urb(urb, &data->bulk_anchor);
1002
1003         err = usb_submit_urb(urb, mem_flags);
1004         if (err < 0) {
1005                 if (err != -EPERM && err != -ENODEV)
1006                         bt_dev_err(hdev, "urb %p submission failed (%d)",
1007                                    urb, -err);
1008                 usb_unanchor_urb(urb);
1009         }
1010
1011         usb_free_urb(urb);
1012
1013         return err;
1014 }
1015
1016 static void btusb_isoc_complete(struct urb *urb)
1017 {
1018         struct hci_dev *hdev = urb->context;
1019         struct btusb_data *data = hci_get_drvdata(hdev);
1020         int i, err;
1021
1022         BT_DBG("%s urb %p status %d count %d", hdev->name, urb, urb->status,
1023                urb->actual_length);
1024
1025         if (!test_bit(HCI_RUNNING, &hdev->flags))
1026                 return;
1027
1028         if (urb->status == 0) {
1029                 for (i = 0; i < urb->number_of_packets; i++) {
1030                         unsigned int offset = urb->iso_frame_desc[i].offset;
1031                         unsigned int length = urb->iso_frame_desc[i].actual_length;
1032
1033                         if (urb->iso_frame_desc[i].status)
1034                                 continue;
1035
1036                         hdev->stat.byte_rx += length;
1037
1038                         if (btusb_recv_isoc(data, urb->transfer_buffer + offset,
1039                                             length) < 0) {
1040                                 bt_dev_err(hdev, "corrupted SCO packet");
1041                                 hdev->stat.err_rx++;
1042                         }
1043                 }
1044         } else if (urb->status == -ENOENT) {
1045                 /* Avoid suspend failed when usb_kill_urb */
1046                 return;
1047         }
1048
1049         if (!test_bit(BTUSB_ISOC_RUNNING, &data->flags))
1050                 return;
1051
1052         usb_anchor_urb(urb, &data->isoc_anchor);
1053
1054         err = usb_submit_urb(urb, GFP_ATOMIC);
1055         if (err < 0) {
1056                 /* -EPERM: urb is being killed;
1057                  * -ENODEV: device got disconnected
1058                  */
1059                 if (err != -EPERM && err != -ENODEV)
1060                         bt_dev_err(hdev, "urb %p failed to resubmit (%d)",
1061                                    urb, -err);
1062                 usb_unanchor_urb(urb);
1063         }
1064 }
1065
1066 static inline void __fill_isoc_descriptor_msbc(struct urb *urb, int len,
1067                                                int mtu, struct btusb_data *data)
1068 {
1069         int i, offset = 0;
1070         unsigned int interval;
1071
1072         BT_DBG("len %d mtu %d", len, mtu);
1073
1074         /* For mSBC ALT 6 setting the host will send the packet at continuous
1075          * flow. As per core spec 5, vol 4, part B, table 2.1. For ALT setting
1076          * 6 the HCI PACKET INTERVAL should be 7.5ms for every usb packets.
1077          * To maintain the rate we send 63bytes of usb packets alternatively for
1078          * 7ms and 8ms to maintain the rate as 7.5ms.
1079          */
1080         if (data->usb_alt6_packet_flow) {
1081                 interval = 7;
1082                 data->usb_alt6_packet_flow = false;
1083         } else {
1084                 interval = 6;
1085                 data->usb_alt6_packet_flow = true;
1086         }
1087
1088         for (i = 0; i < interval; i++) {
1089                 urb->iso_frame_desc[i].offset = offset;
1090                 urb->iso_frame_desc[i].length = offset;
1091         }
1092
1093         if (len && i < BTUSB_MAX_ISOC_FRAMES) {
1094                 urb->iso_frame_desc[i].offset = offset;
1095                 urb->iso_frame_desc[i].length = len;
1096                 i++;
1097         }
1098
1099         urb->number_of_packets = i;
1100 }
1101
1102 static inline void __fill_isoc_descriptor(struct urb *urb, int len, int mtu)
1103 {
1104         int i, offset = 0;
1105
1106         BT_DBG("len %d mtu %d", len, mtu);
1107
1108         for (i = 0; i < BTUSB_MAX_ISOC_FRAMES && len >= mtu;
1109                                         i++, offset += mtu, len -= mtu) {
1110                 urb->iso_frame_desc[i].offset = offset;
1111                 urb->iso_frame_desc[i].length = mtu;
1112         }
1113
1114         if (len && i < BTUSB_MAX_ISOC_FRAMES) {
1115                 urb->iso_frame_desc[i].offset = offset;
1116                 urb->iso_frame_desc[i].length = len;
1117                 i++;
1118         }
1119
1120         urb->number_of_packets = i;
1121 }
1122
1123 static int btusb_submit_isoc_urb(struct hci_dev *hdev, gfp_t mem_flags)
1124 {
1125         struct btusb_data *data = hci_get_drvdata(hdev);
1126         struct urb *urb;
1127         unsigned char *buf;
1128         unsigned int pipe;
1129         int err, size;
1130
1131         BT_DBG("%s", hdev->name);
1132
1133         if (!data->isoc_rx_ep)
1134                 return -ENODEV;
1135
1136         urb = usb_alloc_urb(BTUSB_MAX_ISOC_FRAMES, mem_flags);
1137         if (!urb)
1138                 return -ENOMEM;
1139
1140         size = le16_to_cpu(data->isoc_rx_ep->wMaxPacketSize) *
1141                                                 BTUSB_MAX_ISOC_FRAMES;
1142
1143         buf = kmalloc(size, mem_flags);
1144         if (!buf) {
1145                 usb_free_urb(urb);
1146                 return -ENOMEM;
1147         }
1148
1149         pipe = usb_rcvisocpipe(data->udev, data->isoc_rx_ep->bEndpointAddress);
1150
1151         usb_fill_int_urb(urb, data->udev, pipe, buf, size, btusb_isoc_complete,
1152                          hdev, data->isoc_rx_ep->bInterval);
1153
1154         urb->transfer_flags = URB_FREE_BUFFER | URB_ISO_ASAP;
1155
1156         __fill_isoc_descriptor(urb, size,
1157                                le16_to_cpu(data->isoc_rx_ep->wMaxPacketSize));
1158
1159         usb_anchor_urb(urb, &data->isoc_anchor);
1160
1161         err = usb_submit_urb(urb, mem_flags);
1162         if (err < 0) {
1163                 if (err != -EPERM && err != -ENODEV)
1164                         bt_dev_err(hdev, "urb %p submission failed (%d)",
1165                                    urb, -err);
1166                 usb_unanchor_urb(urb);
1167         }
1168
1169         usb_free_urb(urb);
1170
1171         return err;
1172 }
1173
1174 static void btusb_diag_complete(struct urb *urb)
1175 {
1176         struct hci_dev *hdev = urb->context;
1177         struct btusb_data *data = hci_get_drvdata(hdev);
1178         int err;
1179
1180         BT_DBG("%s urb %p status %d count %d", hdev->name, urb, urb->status,
1181                urb->actual_length);
1182
1183         if (urb->status == 0) {
1184                 struct sk_buff *skb;
1185
1186                 skb = bt_skb_alloc(urb->actual_length, GFP_ATOMIC);
1187                 if (skb) {
1188                         skb_put_data(skb, urb->transfer_buffer,
1189                                      urb->actual_length);
1190                         hci_recv_diag(hdev, skb);
1191                 }
1192         } else if (urb->status == -ENOENT) {
1193                 /* Avoid suspend failed when usb_kill_urb */
1194                 return;
1195         }
1196
1197         if (!test_bit(BTUSB_DIAG_RUNNING, &data->flags))
1198                 return;
1199
1200         usb_anchor_urb(urb, &data->diag_anchor);
1201         usb_mark_last_busy(data->udev);
1202
1203         err = usb_submit_urb(urb, GFP_ATOMIC);
1204         if (err < 0) {
1205                 /* -EPERM: urb is being killed;
1206                  * -ENODEV: device got disconnected
1207                  */
1208                 if (err != -EPERM && err != -ENODEV)
1209                         bt_dev_err(hdev, "urb %p failed to resubmit (%d)",
1210                                    urb, -err);
1211                 usb_unanchor_urb(urb);
1212         }
1213 }
1214
1215 static int btusb_submit_diag_urb(struct hci_dev *hdev, gfp_t mem_flags)
1216 {
1217         struct btusb_data *data = hci_get_drvdata(hdev);
1218         struct urb *urb;
1219         unsigned char *buf;
1220         unsigned int pipe;
1221         int err, size = HCI_MAX_FRAME_SIZE;
1222
1223         BT_DBG("%s", hdev->name);
1224
1225         if (!data->diag_rx_ep)
1226                 return -ENODEV;
1227
1228         urb = usb_alloc_urb(0, mem_flags);
1229         if (!urb)
1230                 return -ENOMEM;
1231
1232         buf = kmalloc(size, mem_flags);
1233         if (!buf) {
1234                 usb_free_urb(urb);
1235                 return -ENOMEM;
1236         }
1237
1238         pipe = usb_rcvbulkpipe(data->udev, data->diag_rx_ep->bEndpointAddress);
1239
1240         usb_fill_bulk_urb(urb, data->udev, pipe, buf, size,
1241                           btusb_diag_complete, hdev);
1242
1243         urb->transfer_flags |= URB_FREE_BUFFER;
1244
1245         usb_mark_last_busy(data->udev);
1246         usb_anchor_urb(urb, &data->diag_anchor);
1247
1248         err = usb_submit_urb(urb, mem_flags);
1249         if (err < 0) {
1250                 if (err != -EPERM && err != -ENODEV)
1251                         bt_dev_err(hdev, "urb %p submission failed (%d)",
1252                                    urb, -err);
1253                 usb_unanchor_urb(urb);
1254         }
1255
1256         usb_free_urb(urb);
1257
1258         return err;
1259 }
1260
1261 static void btusb_tx_complete(struct urb *urb)
1262 {
1263         struct sk_buff *skb = urb->context;
1264         struct hci_dev *hdev = (struct hci_dev *)skb->dev;
1265         struct btusb_data *data = hci_get_drvdata(hdev);
1266         unsigned long flags;
1267
1268         BT_DBG("%s urb %p status %d count %d", hdev->name, urb, urb->status,
1269                urb->actual_length);
1270
1271         if (!test_bit(HCI_RUNNING, &hdev->flags))
1272                 goto done;
1273
1274         if (!urb->status)
1275                 hdev->stat.byte_tx += urb->transfer_buffer_length;
1276         else
1277                 hdev->stat.err_tx++;
1278
1279 done:
1280         spin_lock_irqsave(&data->txlock, flags);
1281         data->tx_in_flight--;
1282         spin_unlock_irqrestore(&data->txlock, flags);
1283
1284         kfree(urb->setup_packet);
1285
1286         kfree_skb(skb);
1287 }
1288
1289 static void btusb_isoc_tx_complete(struct urb *urb)
1290 {
1291         struct sk_buff *skb = urb->context;
1292         struct hci_dev *hdev = (struct hci_dev *)skb->dev;
1293
1294         BT_DBG("%s urb %p status %d count %d", hdev->name, urb, urb->status,
1295                urb->actual_length);
1296
1297         if (!test_bit(HCI_RUNNING, &hdev->flags))
1298                 goto done;
1299
1300         if (!urb->status)
1301                 hdev->stat.byte_tx += urb->transfer_buffer_length;
1302         else
1303                 hdev->stat.err_tx++;
1304
1305 done:
1306         kfree(urb->setup_packet);
1307
1308         kfree_skb(skb);
1309 }
1310
1311 static int btusb_open(struct hci_dev *hdev)
1312 {
1313         struct btusb_data *data = hci_get_drvdata(hdev);
1314         int err;
1315
1316         BT_DBG("%s", hdev->name);
1317
1318         err = usb_autopm_get_interface(data->intf);
1319         if (err < 0)
1320                 return err;
1321
1322         /* Patching USB firmware files prior to starting any URBs of HCI path
1323          * It is more safe to use USB bulk channel for downloading USB patch
1324          */
1325         if (data->setup_on_usb) {
1326                 err = data->setup_on_usb(hdev);
1327                 if (err < 0)
1328                         goto setup_fail;
1329         }
1330
1331         data->intf->needs_remote_wakeup = 1;
1332
1333         /* Disable device remote wakeup when host is suspended
1334          * For Realtek chips, global suspend without
1335          * SET_FEATURE (DEVICE_REMOTE_WAKEUP) can save more power in device.
1336          */
1337         if (test_bit(BTUSB_WAKEUP_DISABLE, &data->flags))
1338                 device_wakeup_disable(&data->udev->dev);
1339
1340         if (test_and_set_bit(BTUSB_INTR_RUNNING, &data->flags))
1341                 goto done;
1342
1343         err = btusb_submit_intr_urb(hdev, GFP_KERNEL);
1344         if (err < 0)
1345                 goto failed;
1346
1347         err = btusb_submit_bulk_urb(hdev, GFP_KERNEL);
1348         if (err < 0) {
1349                 usb_kill_anchored_urbs(&data->intr_anchor);
1350                 goto failed;
1351         }
1352
1353         set_bit(BTUSB_BULK_RUNNING, &data->flags);
1354         btusb_submit_bulk_urb(hdev, GFP_KERNEL);
1355
1356         if (data->diag) {
1357                 if (!btusb_submit_diag_urb(hdev, GFP_KERNEL))
1358                         set_bit(BTUSB_DIAG_RUNNING, &data->flags);
1359         }
1360
1361 done:
1362         usb_autopm_put_interface(data->intf);
1363         return 0;
1364
1365 failed:
1366         clear_bit(BTUSB_INTR_RUNNING, &data->flags);
1367 setup_fail:
1368         usb_autopm_put_interface(data->intf);
1369         return err;
1370 }
1371
1372 static void btusb_stop_traffic(struct btusb_data *data)
1373 {
1374         usb_kill_anchored_urbs(&data->intr_anchor);
1375         usb_kill_anchored_urbs(&data->bulk_anchor);
1376         usb_kill_anchored_urbs(&data->isoc_anchor);
1377         usb_kill_anchored_urbs(&data->diag_anchor);
1378         usb_kill_anchored_urbs(&data->ctrl_anchor);
1379 }
1380
1381 static int btusb_close(struct hci_dev *hdev)
1382 {
1383         struct btusb_data *data = hci_get_drvdata(hdev);
1384         int err;
1385
1386         BT_DBG("%s", hdev->name);
1387
1388         cancel_work_sync(&data->work);
1389         cancel_work_sync(&data->waker);
1390
1391         clear_bit(BTUSB_ISOC_RUNNING, &data->flags);
1392         clear_bit(BTUSB_BULK_RUNNING, &data->flags);
1393         clear_bit(BTUSB_INTR_RUNNING, &data->flags);
1394         clear_bit(BTUSB_DIAG_RUNNING, &data->flags);
1395
1396         btusb_stop_traffic(data);
1397         btusb_free_frags(data);
1398
1399         err = usb_autopm_get_interface(data->intf);
1400         if (err < 0)
1401                 goto failed;
1402
1403         data->intf->needs_remote_wakeup = 0;
1404
1405         /* Enable remote wake up for auto-suspend */
1406         if (test_bit(BTUSB_WAKEUP_DISABLE, &data->flags))
1407                 data->intf->needs_remote_wakeup = 1;
1408
1409         usb_autopm_put_interface(data->intf);
1410
1411 failed:
1412         usb_scuttle_anchored_urbs(&data->deferred);
1413         return 0;
1414 }
1415
1416 static int btusb_flush(struct hci_dev *hdev)
1417 {
1418         struct btusb_data *data = hci_get_drvdata(hdev);
1419
1420         BT_DBG("%s", hdev->name);
1421
1422         usb_kill_anchored_urbs(&data->tx_anchor);
1423         btusb_free_frags(data);
1424
1425         return 0;
1426 }
1427
1428 static struct urb *alloc_ctrl_urb(struct hci_dev *hdev, struct sk_buff *skb)
1429 {
1430         struct btusb_data *data = hci_get_drvdata(hdev);
1431         struct usb_ctrlrequest *dr;
1432         struct urb *urb;
1433         unsigned int pipe;
1434
1435         urb = usb_alloc_urb(0, GFP_KERNEL);
1436         if (!urb)
1437                 return ERR_PTR(-ENOMEM);
1438
1439         dr = kmalloc(sizeof(*dr), GFP_KERNEL);
1440         if (!dr) {
1441                 usb_free_urb(urb);
1442                 return ERR_PTR(-ENOMEM);
1443         }
1444
1445         dr->bRequestType = data->cmdreq_type;
1446         dr->bRequest     = data->cmdreq;
1447         dr->wIndex       = 0;
1448         dr->wValue       = 0;
1449         dr->wLength      = __cpu_to_le16(skb->len);
1450
1451         pipe = usb_sndctrlpipe(data->udev, 0x00);
1452
1453         usb_fill_control_urb(urb, data->udev, pipe, (void *)dr,
1454                              skb->data, skb->len, btusb_tx_complete, skb);
1455
1456         skb->dev = (void *)hdev;
1457
1458         return urb;
1459 }
1460
1461 static struct urb *alloc_bulk_urb(struct hci_dev *hdev, struct sk_buff *skb)
1462 {
1463         struct btusb_data *data = hci_get_drvdata(hdev);
1464         struct urb *urb;
1465         unsigned int pipe;
1466
1467         if (!data->bulk_tx_ep)
1468                 return ERR_PTR(-ENODEV);
1469
1470         urb = usb_alloc_urb(0, GFP_KERNEL);
1471         if (!urb)
1472                 return ERR_PTR(-ENOMEM);
1473
1474         pipe = usb_sndbulkpipe(data->udev, data->bulk_tx_ep->bEndpointAddress);
1475
1476         usb_fill_bulk_urb(urb, data->udev, pipe,
1477                           skb->data, skb->len, btusb_tx_complete, skb);
1478
1479         skb->dev = (void *)hdev;
1480
1481         return urb;
1482 }
1483
1484 static struct urb *alloc_isoc_urb(struct hci_dev *hdev, struct sk_buff *skb)
1485 {
1486         struct btusb_data *data = hci_get_drvdata(hdev);
1487         struct urb *urb;
1488         unsigned int pipe;
1489
1490         if (!data->isoc_tx_ep)
1491                 return ERR_PTR(-ENODEV);
1492
1493         urb = usb_alloc_urb(BTUSB_MAX_ISOC_FRAMES, GFP_KERNEL);
1494         if (!urb)
1495                 return ERR_PTR(-ENOMEM);
1496
1497         pipe = usb_sndisocpipe(data->udev, data->isoc_tx_ep->bEndpointAddress);
1498
1499         usb_fill_int_urb(urb, data->udev, pipe,
1500                          skb->data, skb->len, btusb_isoc_tx_complete,
1501                          skb, data->isoc_tx_ep->bInterval);
1502
1503         urb->transfer_flags  = URB_ISO_ASAP;
1504
1505         if (data->isoc_altsetting == 6)
1506                 __fill_isoc_descriptor_msbc(urb, skb->len,
1507                                             le16_to_cpu(data->isoc_tx_ep->wMaxPacketSize),
1508                                             data);
1509         else
1510                 __fill_isoc_descriptor(urb, skb->len,
1511                                        le16_to_cpu(data->isoc_tx_ep->wMaxPacketSize));
1512         skb->dev = (void *)hdev;
1513
1514         return urb;
1515 }
1516
1517 static int submit_tx_urb(struct hci_dev *hdev, struct urb *urb)
1518 {
1519         struct btusb_data *data = hci_get_drvdata(hdev);
1520         int err;
1521
1522         usb_anchor_urb(urb, &data->tx_anchor);
1523
1524         err = usb_submit_urb(urb, GFP_KERNEL);
1525         if (err < 0) {
1526                 if (err != -EPERM && err != -ENODEV)
1527                         bt_dev_err(hdev, "urb %p submission failed (%d)",
1528                                    urb, -err);
1529                 kfree(urb->setup_packet);
1530                 usb_unanchor_urb(urb);
1531         } else {
1532                 usb_mark_last_busy(data->udev);
1533         }
1534
1535         usb_free_urb(urb);
1536         return err;
1537 }
1538
1539 static int submit_or_queue_tx_urb(struct hci_dev *hdev, struct urb *urb)
1540 {
1541         struct btusb_data *data = hci_get_drvdata(hdev);
1542         unsigned long flags;
1543         bool suspending;
1544
1545         spin_lock_irqsave(&data->txlock, flags);
1546         suspending = test_bit(BTUSB_SUSPENDING, &data->flags);
1547         if (!suspending)
1548                 data->tx_in_flight++;
1549         spin_unlock_irqrestore(&data->txlock, flags);
1550
1551         if (!suspending)
1552                 return submit_tx_urb(hdev, urb);
1553
1554         usb_anchor_urb(urb, &data->deferred);
1555         schedule_work(&data->waker);
1556
1557         usb_free_urb(urb);
1558         return 0;
1559 }
1560
1561 static int btusb_send_frame(struct hci_dev *hdev, struct sk_buff *skb)
1562 {
1563         struct urb *urb;
1564
1565         BT_DBG("%s", hdev->name);
1566
1567         switch (hci_skb_pkt_type(skb)) {
1568         case HCI_COMMAND_PKT:
1569                 urb = alloc_ctrl_urb(hdev, skb);
1570                 if (IS_ERR(urb))
1571                         return PTR_ERR(urb);
1572
1573                 hdev->stat.cmd_tx++;
1574                 return submit_or_queue_tx_urb(hdev, urb);
1575
1576         case HCI_ACLDATA_PKT:
1577                 urb = alloc_bulk_urb(hdev, skb);
1578                 if (IS_ERR(urb))
1579                         return PTR_ERR(urb);
1580
1581                 hdev->stat.acl_tx++;
1582                 return submit_or_queue_tx_urb(hdev, urb);
1583
1584         case HCI_SCODATA_PKT:
1585                 if (hci_conn_num(hdev, SCO_LINK) < 1)
1586                         return -ENODEV;
1587
1588                 urb = alloc_isoc_urb(hdev, skb);
1589                 if (IS_ERR(urb))
1590                         return PTR_ERR(urb);
1591
1592                 hdev->stat.sco_tx++;
1593                 return submit_tx_urb(hdev, urb);
1594         }
1595
1596         return -EILSEQ;
1597 }
1598
1599 static void btusb_notify(struct hci_dev *hdev, unsigned int evt)
1600 {
1601         struct btusb_data *data = hci_get_drvdata(hdev);
1602
1603         BT_DBG("%s evt %d", hdev->name, evt);
1604
1605         if (hci_conn_num(hdev, SCO_LINK) != data->sco_num) {
1606                 data->sco_num = hci_conn_num(hdev, SCO_LINK);
1607                 data->air_mode = evt;
1608                 schedule_work(&data->work);
1609         }
1610 }
1611
1612 static inline int __set_isoc_interface(struct hci_dev *hdev, int altsetting)
1613 {
1614         struct btusb_data *data = hci_get_drvdata(hdev);
1615         struct usb_interface *intf = data->isoc;
1616         struct usb_endpoint_descriptor *ep_desc;
1617         int i, err;
1618
1619         if (!data->isoc)
1620                 return -ENODEV;
1621
1622         err = usb_set_interface(data->udev, data->isoc_ifnum, altsetting);
1623         if (err < 0) {
1624                 bt_dev_err(hdev, "setting interface failed (%d)", -err);
1625                 return err;
1626         }
1627
1628         data->isoc_altsetting = altsetting;
1629
1630         data->isoc_tx_ep = NULL;
1631         data->isoc_rx_ep = NULL;
1632
1633         for (i = 0; i < intf->cur_altsetting->desc.bNumEndpoints; i++) {
1634                 ep_desc = &intf->cur_altsetting->endpoint[i].desc;
1635
1636                 if (!data->isoc_tx_ep && usb_endpoint_is_isoc_out(ep_desc)) {
1637                         data->isoc_tx_ep = ep_desc;
1638                         continue;
1639                 }
1640
1641                 if (!data->isoc_rx_ep && usb_endpoint_is_isoc_in(ep_desc)) {
1642                         data->isoc_rx_ep = ep_desc;
1643                         continue;
1644                 }
1645         }
1646
1647         if (!data->isoc_tx_ep || !data->isoc_rx_ep) {
1648                 bt_dev_err(hdev, "invalid SCO descriptors");
1649                 return -ENODEV;
1650         }
1651
1652         return 0;
1653 }
1654
1655 static int btusb_switch_alt_setting(struct hci_dev *hdev, int new_alts)
1656 {
1657         struct btusb_data *data = hci_get_drvdata(hdev);
1658         int err;
1659
1660         if (data->isoc_altsetting != new_alts) {
1661                 unsigned long flags;
1662
1663                 clear_bit(BTUSB_ISOC_RUNNING, &data->flags);
1664                 usb_kill_anchored_urbs(&data->isoc_anchor);
1665
1666                 /* When isochronous alternate setting needs to be
1667                  * changed, because SCO connection has been added
1668                  * or removed, a packet fragment may be left in the
1669                  * reassembling state. This could lead to wrongly
1670                  * assembled fragments.
1671                  *
1672                  * Clear outstanding fragment when selecting a new
1673                  * alternate setting.
1674                  */
1675                 spin_lock_irqsave(&data->rxlock, flags);
1676                 kfree_skb(data->sco_skb);
1677                 data->sco_skb = NULL;
1678                 spin_unlock_irqrestore(&data->rxlock, flags);
1679
1680                 err = __set_isoc_interface(hdev, new_alts);
1681                 if (err < 0)
1682                         return err;
1683         }
1684
1685         if (!test_and_set_bit(BTUSB_ISOC_RUNNING, &data->flags)) {
1686                 if (btusb_submit_isoc_urb(hdev, GFP_KERNEL) < 0)
1687                         clear_bit(BTUSB_ISOC_RUNNING, &data->flags);
1688                 else
1689                         btusb_submit_isoc_urb(hdev, GFP_KERNEL);
1690         }
1691
1692         return 0;
1693 }
1694
1695 static struct usb_host_interface *btusb_find_altsetting(struct btusb_data *data,
1696                                                         int alt)
1697 {
1698         struct usb_interface *intf = data->isoc;
1699         int i;
1700
1701         BT_DBG("Looking for Alt no :%d", alt);
1702
1703         if (!intf)
1704                 return NULL;
1705
1706         for (i = 0; i < intf->num_altsetting; i++) {
1707                 if (intf->altsetting[i].desc.bAlternateSetting == alt)
1708                         return &intf->altsetting[i];
1709         }
1710
1711         return NULL;
1712 }
1713
1714 static void btusb_work(struct work_struct *work)
1715 {
1716         struct btusb_data *data = container_of(work, struct btusb_data, work);
1717         struct hci_dev *hdev = data->hdev;
1718         int new_alts = 0;
1719         int err;
1720
1721         if (data->sco_num > 0) {
1722                 if (!test_bit(BTUSB_DID_ISO_RESUME, &data->flags)) {
1723                         err = usb_autopm_get_interface(data->isoc ? data->isoc : data->intf);
1724                         if (err < 0) {
1725                                 clear_bit(BTUSB_ISOC_RUNNING, &data->flags);
1726                                 usb_kill_anchored_urbs(&data->isoc_anchor);
1727                                 return;
1728                         }
1729
1730                         set_bit(BTUSB_DID_ISO_RESUME, &data->flags);
1731                 }
1732
1733                 if (data->air_mode == HCI_NOTIFY_ENABLE_SCO_CVSD) {
1734                         if (hdev->voice_setting & 0x0020) {
1735                                 static const int alts[3] = { 2, 4, 5 };
1736
1737                                 new_alts = alts[data->sco_num - 1];
1738                         } else {
1739                                 new_alts = data->sco_num;
1740                         }
1741                 } else if (data->air_mode == HCI_NOTIFY_ENABLE_SCO_TRANSP) {
1742                         /* Bluetooth USB spec recommends alt 6 (63 bytes), but
1743                          * many adapters do not support it.  Alt 1 appears to
1744                          * work for all adapters that do not have alt 6, and
1745                          * which work with WBS at all.
1746                          */
1747                         new_alts = btusb_find_altsetting(data, 6) ? 6 : 1;
1748                 }
1749
1750                 if (btusb_switch_alt_setting(hdev, new_alts) < 0)
1751                         bt_dev_err(hdev, "set USB alt:(%d) failed!", new_alts);
1752         } else {
1753                 clear_bit(BTUSB_ISOC_RUNNING, &data->flags);
1754                 usb_kill_anchored_urbs(&data->isoc_anchor);
1755
1756                 __set_isoc_interface(hdev, 0);
1757                 if (test_and_clear_bit(BTUSB_DID_ISO_RESUME, &data->flags))
1758                         usb_autopm_put_interface(data->isoc ? data->isoc : data->intf);
1759         }
1760 }
1761
1762 static void btusb_waker(struct work_struct *work)
1763 {
1764         struct btusb_data *data = container_of(work, struct btusb_data, waker);
1765         int err;
1766
1767         err = usb_autopm_get_interface(data->intf);
1768         if (err < 0)
1769                 return;
1770
1771         usb_autopm_put_interface(data->intf);
1772 }
1773
1774 static int btusb_setup_bcm92035(struct hci_dev *hdev)
1775 {
1776         struct sk_buff *skb;
1777         u8 val = 0x00;
1778
1779         BT_DBG("%s", hdev->name);
1780
1781         skb = __hci_cmd_sync(hdev, 0xfc3b, 1, &val, HCI_INIT_TIMEOUT);
1782         if (IS_ERR(skb))
1783                 bt_dev_err(hdev, "BCM92035 command failed (%ld)", PTR_ERR(skb));
1784         else
1785                 kfree_skb(skb);
1786
1787         return 0;
1788 }
1789
1790 static int btusb_setup_csr(struct hci_dev *hdev)
1791 {
1792         struct btusb_data *data = hci_get_drvdata(hdev);
1793         u16 bcdDevice = le16_to_cpu(data->udev->descriptor.bcdDevice);
1794         struct hci_rp_read_local_version *rp;
1795         struct sk_buff *skb;
1796         bool is_fake = false;
1797         int ret;
1798
1799         BT_DBG("%s", hdev->name);
1800
1801         skb = __hci_cmd_sync(hdev, HCI_OP_READ_LOCAL_VERSION, 0, NULL,
1802                              HCI_INIT_TIMEOUT);
1803         if (IS_ERR(skb)) {
1804                 int err = PTR_ERR(skb);
1805                 bt_dev_err(hdev, "CSR: Local version failed (%d)", err);
1806                 return err;
1807         }
1808
1809         if (skb->len != sizeof(struct hci_rp_read_local_version)) {
1810                 bt_dev_err(hdev, "CSR: Local version length mismatch");
1811                 kfree_skb(skb);
1812                 return -EIO;
1813         }
1814
1815         rp = (struct hci_rp_read_local_version *)skb->data;
1816
1817         /* Detect a wide host of Chinese controllers that aren't CSR.
1818          *
1819          * Known fake bcdDevices: 0x0100, 0x0134, 0x1915, 0x2520, 0x7558, 0x8891
1820          *
1821          * The main thing they have in common is that these are really popular low-cost
1822          * options that support newer Bluetooth versions but rely on heavy VID/PID
1823          * squatting of this poor old Bluetooth 1.1 device. Even sold as such.
1824          *
1825          * We detect actual CSR devices by checking that the HCI manufacturer code
1826          * is Cambridge Silicon Radio (10) and ensuring that LMP sub-version and
1827          * HCI rev values always match. As they both store the firmware number.
1828          */
1829         if (le16_to_cpu(rp->manufacturer) != 10 ||
1830             le16_to_cpu(rp->hci_rev) != le16_to_cpu(rp->lmp_subver))
1831                 is_fake = true;
1832
1833         /* Known legit CSR firmware build numbers and their supported BT versions:
1834          * - 1.1 (0x1) -> 0x0073, 0x020d, 0x033c, 0x034e
1835          * - 1.2 (0x2) ->                 0x04d9, 0x0529
1836          * - 2.0 (0x3) ->         0x07a6, 0x07ad, 0x0c5c
1837          * - 2.1 (0x4) ->         0x149c, 0x1735, 0x1899 (0x1899 is a BlueCore4-External)
1838          * - 4.0 (0x6) ->         0x1d86, 0x2031, 0x22bb
1839          *
1840          * e.g. Real CSR dongles with LMP subversion 0x73 are old enough that
1841          *      support BT 1.1 only; so it's a dead giveaway when some
1842          *      third-party BT 4.0 dongle reuses it.
1843          */
1844         else if (le16_to_cpu(rp->lmp_subver) <= 0x034e &&
1845                  le16_to_cpu(rp->hci_ver) > BLUETOOTH_VER_1_1)
1846                 is_fake = true;
1847
1848         else if (le16_to_cpu(rp->lmp_subver) <= 0x0529 &&
1849                  le16_to_cpu(rp->hci_ver) > BLUETOOTH_VER_1_2)
1850                 is_fake = true;
1851
1852         else if (le16_to_cpu(rp->lmp_subver) <= 0x0c5c &&
1853                  le16_to_cpu(rp->hci_ver) > BLUETOOTH_VER_2_0)
1854                 is_fake = true;
1855
1856         else if (le16_to_cpu(rp->lmp_subver) <= 0x1899 &&
1857                  le16_to_cpu(rp->hci_ver) > BLUETOOTH_VER_2_1)
1858                 is_fake = true;
1859
1860         else if (le16_to_cpu(rp->lmp_subver) <= 0x22bb &&
1861                  le16_to_cpu(rp->hci_ver) > BLUETOOTH_VER_4_0)
1862                 is_fake = true;
1863
1864         /* Other clones which beat all the above checks */
1865         else if (bcdDevice == 0x0134 &&
1866                  le16_to_cpu(rp->lmp_subver) == 0x0c5c &&
1867                  le16_to_cpu(rp->hci_ver) == BLUETOOTH_VER_2_0)
1868                 is_fake = true;
1869
1870         if (is_fake) {
1871                 bt_dev_warn(hdev, "CSR: Unbranded CSR clone detected; adding workarounds...");
1872
1873                 /* Generally these clones have big discrepancies between
1874                  * advertised features and what's actually supported.
1875                  * Probably will need to be expanded in the future;
1876                  * without these the controller will lock up.
1877                  */
1878                 set_bit(HCI_QUIRK_BROKEN_STORED_LINK_KEY, &hdev->quirks);
1879                 set_bit(HCI_QUIRK_BROKEN_ERR_DATA_REPORTING, &hdev->quirks);
1880
1881                 /* Clear the reset quirk since this is not an actual
1882                  * early Bluetooth 1.1 device from CSR.
1883                  */
1884                 clear_bit(HCI_QUIRK_RESET_ON_CLOSE, &hdev->quirks);
1885                 clear_bit(HCI_QUIRK_SIMULTANEOUS_DISCOVERY, &hdev->quirks);
1886
1887                 /*
1888                  * Special workaround for clones with a Barrot 8041a02 chip,
1889                  * these clones are really messed-up:
1890                  * 1. Their bulk rx endpoint will never report any data unless
1891                  * the device was suspended at least once (yes really).
1892                  * 2. They will not wakeup when autosuspended and receiving data
1893                  * on their bulk rx endpoint from e.g. a keyboard or mouse
1894                  * (IOW remote-wakeup support is broken for the bulk endpoint).
1895                  *
1896                  * To fix 1. enable runtime-suspend, force-suspend the
1897                  * hci and then wake-it up by disabling runtime-suspend.
1898                  *
1899                  * To fix 2. clear the hci's can_wake flag, this way the hci
1900                  * will still be autosuspended when it is not open.
1901                  */
1902                 if (bcdDevice == 0x8891 &&
1903                     le16_to_cpu(rp->lmp_subver) == 0x1012 &&
1904                     le16_to_cpu(rp->hci_rev) == 0x0810 &&
1905                     le16_to_cpu(rp->hci_ver) == BLUETOOTH_VER_4_0) {
1906                         bt_dev_warn(hdev, "CSR: detected a fake CSR dongle using a Barrot 8041a02 chip, this chip is very buggy and may have issues");
1907
1908                         pm_runtime_allow(&data->udev->dev);
1909
1910                         ret = pm_runtime_suspend(&data->udev->dev);
1911                         if (ret >= 0)
1912                                 msleep(200);
1913                         else
1914                                 bt_dev_err(hdev, "Failed to suspend the device for Barrot 8041a02 receive-issue workaround");
1915
1916                         pm_runtime_forbid(&data->udev->dev);
1917
1918                         device_set_wakeup_capable(&data->udev->dev, false);
1919                         /* Re-enable autosuspend if this was requested */
1920                         if (enable_autosuspend)
1921                                 usb_enable_autosuspend(data->udev);
1922                 }
1923         }
1924
1925         kfree_skb(skb);
1926
1927         return 0;
1928 }
1929
1930 static const struct firmware *btusb_setup_intel_get_fw(struct hci_dev *hdev,
1931                                                        struct intel_version *ver)
1932 {
1933         const struct firmware *fw;
1934         char fwname[64];
1935         int ret;
1936
1937         snprintf(fwname, sizeof(fwname),
1938                  "intel/ibt-hw-%x.%x.%x-fw-%x.%x.%x.%x.%x.bseq",
1939                  ver->hw_platform, ver->hw_variant, ver->hw_revision,
1940                  ver->fw_variant,  ver->fw_revision, ver->fw_build_num,
1941                  ver->fw_build_ww, ver->fw_build_yy);
1942
1943         ret = request_firmware(&fw, fwname, &hdev->dev);
1944         if (ret < 0) {
1945                 if (ret == -EINVAL) {
1946                         bt_dev_err(hdev, "Intel firmware file request failed (%d)",
1947                                    ret);
1948                         return NULL;
1949                 }
1950
1951                 bt_dev_err(hdev, "failed to open Intel firmware file: %s (%d)",
1952                            fwname, ret);
1953
1954                 /* If the correct firmware patch file is not found, use the
1955                  * default firmware patch file instead
1956                  */
1957                 snprintf(fwname, sizeof(fwname), "intel/ibt-hw-%x.%x.bseq",
1958                          ver->hw_platform, ver->hw_variant);
1959                 if (request_firmware(&fw, fwname, &hdev->dev) < 0) {
1960                         bt_dev_err(hdev, "failed to open default fw file: %s",
1961                                    fwname);
1962                         return NULL;
1963                 }
1964         }
1965
1966         bt_dev_info(hdev, "Intel Bluetooth firmware file: %s", fwname);
1967
1968         return fw;
1969 }
1970
1971 static int btusb_setup_intel_patching(struct hci_dev *hdev,
1972                                       const struct firmware *fw,
1973                                       const u8 **fw_ptr, int *disable_patch)
1974 {
1975         struct sk_buff *skb;
1976         struct hci_command_hdr *cmd;
1977         const u8 *cmd_param;
1978         struct hci_event_hdr *evt = NULL;
1979         const u8 *evt_param = NULL;
1980         int remain = fw->size - (*fw_ptr - fw->data);
1981
1982         /* The first byte indicates the types of the patch command or event.
1983          * 0x01 means HCI command and 0x02 is HCI event. If the first bytes
1984          * in the current firmware buffer doesn't start with 0x01 or
1985          * the size of remain buffer is smaller than HCI command header,
1986          * the firmware file is corrupted and it should stop the patching
1987          * process.
1988          */
1989         if (remain > HCI_COMMAND_HDR_SIZE && *fw_ptr[0] != 0x01) {
1990                 bt_dev_err(hdev, "Intel fw corrupted: invalid cmd read");
1991                 return -EINVAL;
1992         }
1993         (*fw_ptr)++;
1994         remain--;
1995
1996         cmd = (struct hci_command_hdr *)(*fw_ptr);
1997         *fw_ptr += sizeof(*cmd);
1998         remain -= sizeof(*cmd);
1999
2000         /* Ensure that the remain firmware data is long enough than the length
2001          * of command parameter. If not, the firmware file is corrupted.
2002          */
2003         if (remain < cmd->plen) {
2004                 bt_dev_err(hdev, "Intel fw corrupted: invalid cmd len");
2005                 return -EFAULT;
2006         }
2007
2008         /* If there is a command that loads a patch in the firmware
2009          * file, then enable the patch upon success, otherwise just
2010          * disable the manufacturer mode, for example patch activation
2011          * is not required when the default firmware patch file is used
2012          * because there are no patch data to load.
2013          */
2014         if (*disable_patch && le16_to_cpu(cmd->opcode) == 0xfc8e)
2015                 *disable_patch = 0;
2016
2017         cmd_param = *fw_ptr;
2018         *fw_ptr += cmd->plen;
2019         remain -= cmd->plen;
2020
2021         /* This reads the expected events when the above command is sent to the
2022          * device. Some vendor commands expects more than one events, for
2023          * example command status event followed by vendor specific event.
2024          * For this case, it only keeps the last expected event. so the command
2025          * can be sent with __hci_cmd_sync_ev() which returns the sk_buff of
2026          * last expected event.
2027          */
2028         while (remain > HCI_EVENT_HDR_SIZE && *fw_ptr[0] == 0x02) {
2029                 (*fw_ptr)++;
2030                 remain--;
2031
2032                 evt = (struct hci_event_hdr *)(*fw_ptr);
2033                 *fw_ptr += sizeof(*evt);
2034                 remain -= sizeof(*evt);
2035
2036                 if (remain < evt->plen) {
2037                         bt_dev_err(hdev, "Intel fw corrupted: invalid evt len");
2038                         return -EFAULT;
2039                 }
2040
2041                 evt_param = *fw_ptr;
2042                 *fw_ptr += evt->plen;
2043                 remain -= evt->plen;
2044         }
2045
2046         /* Every HCI commands in the firmware file has its correspond event.
2047          * If event is not found or remain is smaller than zero, the firmware
2048          * file is corrupted.
2049          */
2050         if (!evt || !evt_param || remain < 0) {
2051                 bt_dev_err(hdev, "Intel fw corrupted: invalid evt read");
2052                 return -EFAULT;
2053         }
2054
2055         skb = __hci_cmd_sync_ev(hdev, le16_to_cpu(cmd->opcode), cmd->plen,
2056                                 cmd_param, evt->evt, HCI_INIT_TIMEOUT);
2057         if (IS_ERR(skb)) {
2058                 bt_dev_err(hdev, "sending Intel patch command (0x%4.4x) failed (%ld)",
2059                            cmd->opcode, PTR_ERR(skb));
2060                 return PTR_ERR(skb);
2061         }
2062
2063         /* It ensures that the returned event matches the event data read from
2064          * the firmware file. At fist, it checks the length and then
2065          * the contents of the event.
2066          */
2067         if (skb->len != evt->plen) {
2068                 bt_dev_err(hdev, "mismatch event length (opcode 0x%4.4x)",
2069                            le16_to_cpu(cmd->opcode));
2070                 kfree_skb(skb);
2071                 return -EFAULT;
2072         }
2073
2074         if (memcmp(skb->data, evt_param, evt->plen)) {
2075                 bt_dev_err(hdev, "mismatch event parameter (opcode 0x%4.4x)",
2076                            le16_to_cpu(cmd->opcode));
2077                 kfree_skb(skb);
2078                 return -EFAULT;
2079         }
2080         kfree_skb(skb);
2081
2082         return 0;
2083 }
2084
2085 static int btusb_setup_intel(struct hci_dev *hdev)
2086 {
2087         struct sk_buff *skb;
2088         const struct firmware *fw;
2089         const u8 *fw_ptr;
2090         int disable_patch, err;
2091         struct intel_version ver;
2092
2093         BT_DBG("%s", hdev->name);
2094
2095         /* The controller has a bug with the first HCI command sent to it
2096          * returning number of completed commands as zero. This would stall the
2097          * command processing in the Bluetooth core.
2098          *
2099          * As a workaround, send HCI Reset command first which will reset the
2100          * number of completed commands and allow normal command processing
2101          * from now on.
2102          */
2103         skb = __hci_cmd_sync(hdev, HCI_OP_RESET, 0, NULL, HCI_INIT_TIMEOUT);
2104         if (IS_ERR(skb)) {
2105                 bt_dev_err(hdev, "sending initial HCI reset command failed (%ld)",
2106                            PTR_ERR(skb));
2107                 return PTR_ERR(skb);
2108         }
2109         kfree_skb(skb);
2110
2111         /* Read Intel specific controller version first to allow selection of
2112          * which firmware file to load.
2113          *
2114          * The returned information are hardware variant and revision plus
2115          * firmware variant, revision and build number.
2116          */
2117         err = btintel_read_version(hdev, &ver);
2118         if (err)
2119                 return err;
2120
2121         bt_dev_info(hdev, "read Intel version: %02x%02x%02x%02x%02x%02x%02x%02x%02x",
2122                     ver.hw_platform, ver.hw_variant, ver.hw_revision,
2123                     ver.fw_variant,  ver.fw_revision, ver.fw_build_num,
2124                     ver.fw_build_ww, ver.fw_build_yy, ver.fw_patch_num);
2125
2126         /* fw_patch_num indicates the version of patch the device currently
2127          * have. If there is no patch data in the device, it is always 0x00.
2128          * So, if it is other than 0x00, no need to patch the device again.
2129          */
2130         if (ver.fw_patch_num) {
2131                 bt_dev_info(hdev, "Intel device is already patched. "
2132                             "patch num: %02x", ver.fw_patch_num);
2133                 goto complete;
2134         }
2135
2136         /* Opens the firmware patch file based on the firmware version read
2137          * from the controller. If it fails to open the matching firmware
2138          * patch file, it tries to open the default firmware patch file.
2139          * If no patch file is found, allow the device to operate without
2140          * a patch.
2141          */
2142         fw = btusb_setup_intel_get_fw(hdev, &ver);
2143         if (!fw)
2144                 goto complete;
2145         fw_ptr = fw->data;
2146
2147         /* Enable the manufacturer mode of the controller.
2148          * Only while this mode is enabled, the driver can download the
2149          * firmware patch data and configuration parameters.
2150          */
2151         err = btintel_enter_mfg(hdev);
2152         if (err) {
2153                 release_firmware(fw);
2154                 return err;
2155         }
2156
2157         disable_patch = 1;
2158
2159         /* The firmware data file consists of list of Intel specific HCI
2160          * commands and its expected events. The first byte indicates the
2161          * type of the message, either HCI command or HCI event.
2162          *
2163          * It reads the command and its expected event from the firmware file,
2164          * and send to the controller. Once __hci_cmd_sync_ev() returns,
2165          * the returned event is compared with the event read from the firmware
2166          * file and it will continue until all the messages are downloaded to
2167          * the controller.
2168          *
2169          * Once the firmware patching is completed successfully,
2170          * the manufacturer mode is disabled with reset and activating the
2171          * downloaded patch.
2172          *
2173          * If the firmware patching fails, the manufacturer mode is
2174          * disabled with reset and deactivating the patch.
2175          *
2176          * If the default patch file is used, no reset is done when disabling
2177          * the manufacturer.
2178          */
2179         while (fw->size > fw_ptr - fw->data) {
2180                 int ret;
2181
2182                 ret = btusb_setup_intel_patching(hdev, fw, &fw_ptr,
2183                                                  &disable_patch);
2184                 if (ret < 0)
2185                         goto exit_mfg_deactivate;
2186         }
2187
2188         release_firmware(fw);
2189
2190         if (disable_patch)
2191                 goto exit_mfg_disable;
2192
2193         /* Patching completed successfully and disable the manufacturer mode
2194          * with reset and activate the downloaded firmware patches.
2195          */
2196         err = btintel_exit_mfg(hdev, true, true);
2197         if (err)
2198                 return err;
2199
2200         /* Need build number for downloaded fw patches in
2201          * every power-on boot
2202          */
2203        err = btintel_read_version(hdev, &ver);
2204        if (err)
2205                return err;
2206        bt_dev_info(hdev, "Intel BT fw patch 0x%02x completed & activated",
2207                    ver.fw_patch_num);
2208
2209         goto complete;
2210
2211 exit_mfg_disable:
2212         /* Disable the manufacturer mode without reset */
2213         err = btintel_exit_mfg(hdev, false, false);
2214         if (err)
2215                 return err;
2216
2217         bt_dev_info(hdev, "Intel firmware patch completed");
2218
2219         goto complete;
2220
2221 exit_mfg_deactivate:
2222         release_firmware(fw);
2223
2224         /* Patching failed. Disable the manufacturer mode with reset and
2225          * deactivate the downloaded firmware patches.
2226          */
2227         err = btintel_exit_mfg(hdev, true, false);
2228         if (err)
2229                 return err;
2230
2231         bt_dev_info(hdev, "Intel firmware patch completed and deactivated");
2232
2233 complete:
2234         /* Set the event mask for Intel specific vendor events. This enables
2235          * a few extra events that are useful during general operation.
2236          */
2237         btintel_set_event_mask_mfg(hdev, false);
2238
2239         btintel_check_bdaddr(hdev);
2240         return 0;
2241 }
2242
2243 static int inject_cmd_complete(struct hci_dev *hdev, __u16 opcode)
2244 {
2245         struct sk_buff *skb;
2246         struct hci_event_hdr *hdr;
2247         struct hci_ev_cmd_complete *evt;
2248
2249         skb = bt_skb_alloc(sizeof(*hdr) + sizeof(*evt) + 1, GFP_KERNEL);
2250         if (!skb)
2251                 return -ENOMEM;
2252
2253         hdr = skb_put(skb, sizeof(*hdr));
2254         hdr->evt = HCI_EV_CMD_COMPLETE;
2255         hdr->plen = sizeof(*evt) + 1;
2256
2257         evt = skb_put(skb, sizeof(*evt));
2258         evt->ncmd = 0x01;
2259         evt->opcode = cpu_to_le16(opcode);
2260
2261         skb_put_u8(skb, 0x00);
2262
2263         hci_skb_pkt_type(skb) = HCI_EVENT_PKT;
2264
2265         return hci_recv_frame(hdev, skb);
2266 }
2267
2268 static int btusb_recv_bulk_intel(struct btusb_data *data, void *buffer,
2269                                  int count)
2270 {
2271         /* When the device is in bootloader mode, then it can send
2272          * events via the bulk endpoint. These events are treated the
2273          * same way as the ones received from the interrupt endpoint.
2274          */
2275         if (test_bit(BTUSB_BOOTLOADER, &data->flags))
2276                 return btusb_recv_intr(data, buffer, count);
2277
2278         return btusb_recv_bulk(data, buffer, count);
2279 }
2280
2281 static void btusb_intel_bootup(struct btusb_data *data, const void *ptr,
2282                                unsigned int len)
2283 {
2284         const struct intel_bootup *evt = ptr;
2285
2286         if (len != sizeof(*evt))
2287                 return;
2288
2289         if (test_and_clear_bit(BTUSB_BOOTING, &data->flags))
2290                 wake_up_bit(&data->flags, BTUSB_BOOTING);
2291 }
2292
2293 static void btusb_intel_secure_send_result(struct btusb_data *data,
2294                                            const void *ptr, unsigned int len)
2295 {
2296         const struct intel_secure_send_result *evt = ptr;
2297
2298         if (len != sizeof(*evt))
2299                 return;
2300
2301         if (evt->result)
2302                 set_bit(BTUSB_FIRMWARE_FAILED, &data->flags);
2303
2304         if (test_and_clear_bit(BTUSB_DOWNLOADING, &data->flags) &&
2305             test_bit(BTUSB_FIRMWARE_LOADED, &data->flags))
2306                 wake_up_bit(&data->flags, BTUSB_DOWNLOADING);
2307 }
2308
2309 static int btusb_recv_event_intel(struct hci_dev *hdev, struct sk_buff *skb)
2310 {
2311         struct btusb_data *data = hci_get_drvdata(hdev);
2312
2313         if (test_bit(BTUSB_BOOTLOADER, &data->flags)) {
2314                 struct hci_event_hdr *hdr = (void *)skb->data;
2315
2316                 if (skb->len > HCI_EVENT_HDR_SIZE && hdr->evt == 0xff &&
2317                     hdr->plen > 0) {
2318                         const void *ptr = skb->data + HCI_EVENT_HDR_SIZE + 1;
2319                         unsigned int len = skb->len - HCI_EVENT_HDR_SIZE - 1;
2320
2321                         switch (skb->data[2]) {
2322                         case 0x02:
2323                                 /* When switching to the operational firmware
2324                                  * the device sends a vendor specific event
2325                                  * indicating that the bootup completed.
2326                                  */
2327                                 btusb_intel_bootup(data, ptr, len);
2328                                 break;
2329                         case 0x06:
2330                                 /* When the firmware loading completes the
2331                                  * device sends out a vendor specific event
2332                                  * indicating the result of the firmware
2333                                  * loading.
2334                                  */
2335                                 btusb_intel_secure_send_result(data, ptr, len);
2336                                 break;
2337                         }
2338                 }
2339         }
2340
2341         return hci_recv_frame(hdev, skb);
2342 }
2343
2344 static int btusb_send_frame_intel(struct hci_dev *hdev, struct sk_buff *skb)
2345 {
2346         struct btusb_data *data = hci_get_drvdata(hdev);
2347         struct urb *urb;
2348
2349         BT_DBG("%s", hdev->name);
2350
2351         switch (hci_skb_pkt_type(skb)) {
2352         case HCI_COMMAND_PKT:
2353                 if (test_bit(BTUSB_BOOTLOADER, &data->flags)) {
2354                         struct hci_command_hdr *cmd = (void *)skb->data;
2355                         __u16 opcode = le16_to_cpu(cmd->opcode);
2356
2357                         /* When in bootloader mode and the command 0xfc09
2358                          * is received, it needs to be send down the
2359                          * bulk endpoint. So allocate a bulk URB instead.
2360                          */
2361                         if (opcode == 0xfc09)
2362                                 urb = alloc_bulk_urb(hdev, skb);
2363                         else
2364                                 urb = alloc_ctrl_urb(hdev, skb);
2365
2366                         /* When the 0xfc01 command is issued to boot into
2367                          * the operational firmware, it will actually not
2368                          * send a command complete event. To keep the flow
2369                          * control working inject that event here.
2370                          */
2371                         if (opcode == 0xfc01)
2372                                 inject_cmd_complete(hdev, opcode);
2373                 } else {
2374                         urb = alloc_ctrl_urb(hdev, skb);
2375                 }
2376                 if (IS_ERR(urb))
2377                         return PTR_ERR(urb);
2378
2379                 hdev->stat.cmd_tx++;
2380                 return submit_or_queue_tx_urb(hdev, urb);
2381
2382         case HCI_ACLDATA_PKT:
2383                 urb = alloc_bulk_urb(hdev, skb);
2384                 if (IS_ERR(urb))
2385                         return PTR_ERR(urb);
2386
2387                 hdev->stat.acl_tx++;
2388                 return submit_or_queue_tx_urb(hdev, urb);
2389
2390         case HCI_SCODATA_PKT:
2391                 if (hci_conn_num(hdev, SCO_LINK) < 1)
2392                         return -ENODEV;
2393
2394                 urb = alloc_isoc_urb(hdev, skb);
2395                 if (IS_ERR(urb))
2396                         return PTR_ERR(urb);
2397
2398                 hdev->stat.sco_tx++;
2399                 return submit_tx_urb(hdev, urb);
2400         }
2401
2402         return -EILSEQ;
2403 }
2404
2405 static bool btusb_setup_intel_new_get_fw_name(struct intel_version *ver,
2406                                              struct intel_boot_params *params,
2407                                              char *fw_name, size_t len,
2408                                              const char *suffix)
2409 {
2410         switch (ver->hw_variant) {
2411         case 0x0b:      /* SfP */
2412         case 0x0c:      /* WsP */
2413                 snprintf(fw_name, len, "intel/ibt-%u-%u.%s",
2414                         le16_to_cpu(ver->hw_variant),
2415                         le16_to_cpu(params->dev_revid),
2416                         suffix);
2417                 break;
2418         case 0x11:      /* JfP */
2419         case 0x12:      /* ThP */
2420         case 0x13:      /* HrP */
2421         case 0x14:      /* CcP */
2422                 snprintf(fw_name, len, "intel/ibt-%u-%u-%u.%s",
2423                         le16_to_cpu(ver->hw_variant),
2424                         le16_to_cpu(ver->hw_revision),
2425                         le16_to_cpu(ver->fw_revision),
2426                         suffix);
2427                 break;
2428         default:
2429                 return false;
2430         }
2431         return true;
2432 }
2433
2434 static void btusb_setup_intel_newgen_get_fw_name(const struct intel_version_tlv *ver_tlv,
2435                                                  char *fw_name, size_t len,
2436                                                  const char *suffix)
2437 {
2438         /* The firmware file name for new generation controllers will be
2439          * ibt-<cnvi_top type+cnvi_top step>-<cnvr_top type+cnvr_top step>
2440          */
2441         snprintf(fw_name, len, "intel/ibt-%04x-%04x.%s",
2442                  INTEL_CNVX_TOP_PACK_SWAB(INTEL_CNVX_TOP_TYPE(ver_tlv->cnvi_top),
2443                                           INTEL_CNVX_TOP_STEP(ver_tlv->cnvi_top)),
2444                  INTEL_CNVX_TOP_PACK_SWAB(INTEL_CNVX_TOP_TYPE(ver_tlv->cnvr_top),
2445                                           INTEL_CNVX_TOP_STEP(ver_tlv->cnvr_top)),
2446                  suffix);
2447 }
2448
2449 static int btusb_intel_download_firmware_newgen(struct hci_dev *hdev,
2450                                                 struct intel_version_tlv *ver,
2451                                                 u32 *boot_param)
2452 {
2453         const struct firmware *fw;
2454         char fwname[64];
2455         int err;
2456         struct btusb_data *data = hci_get_drvdata(hdev);
2457
2458         if (!ver || !boot_param)
2459                 return -EINVAL;
2460
2461         /* The hardware platform number has a fixed value of 0x37 and
2462          * for now only accept this single value.
2463          */
2464         if (INTEL_HW_PLATFORM(ver->cnvi_bt) != 0x37) {
2465                 bt_dev_err(hdev, "Unsupported Intel hardware platform (0x%2x)",
2466                            INTEL_HW_PLATFORM(ver->cnvi_bt));
2467                 return -EINVAL;
2468         }
2469
2470         /* The firmware variant determines if the device is in bootloader
2471          * mode or is running operational firmware. The value 0x03 identifies
2472          * the bootloader and the value 0x23 identifies the operational
2473          * firmware.
2474          *
2475          * When the operational firmware is already present, then only
2476          * the check for valid Bluetooth device address is needed. This
2477          * determines if the device will be added as configured or
2478          * unconfigured controller.
2479          *
2480          * It is not possible to use the Secure Boot Parameters in this
2481          * case since that command is only available in bootloader mode.
2482          */
2483         if (ver->img_type == 0x03) {
2484                 clear_bit(BTUSB_BOOTLOADER, &data->flags);
2485                 btintel_check_bdaddr(hdev);
2486                 return 0;
2487         }
2488
2489         /* Check for supported iBT hardware variants of this firmware
2490          * loading method.
2491          *
2492          * This check has been put in place to ensure correct forward
2493          * compatibility options when newer hardware variants come along.
2494          */
2495         switch (INTEL_HW_VARIANT(ver->cnvi_bt)) {
2496         case 0x17:      /* TyP */
2497         case 0x18:      /* Slr */
2498         case 0x19:      /* Slr-F */
2499                 break;
2500         default:
2501                 bt_dev_err(hdev, "Unsupported Intel hardware variant (0x%x)",
2502                            INTEL_HW_VARIANT(ver->cnvi_bt));
2503                 return -EINVAL;
2504         }
2505
2506         /* If the device is not in bootloader mode, then the only possible
2507          * choice is to return an error and abort the device initialization.
2508          */
2509         if (ver->img_type != 0x01) {
2510                 bt_dev_err(hdev, "Unsupported Intel firmware variant (0x%x)",
2511                            ver->img_type);
2512                 return -ENODEV;
2513         }
2514
2515         /* It is required that every single firmware fragment is acknowledged
2516          * with a command complete event. If the boot parameters indicate
2517          * that this bootloader does not send them, then abort the setup.
2518          */
2519         if (ver->limited_cce != 0x00) {
2520                 bt_dev_err(hdev, "Unsupported Intel firmware loading method (0x%x)",
2521                            ver->limited_cce);
2522                 return -EINVAL;
2523         }
2524
2525         /* Secure boot engine type should be either 1 (ECDSA) or 0 (RSA) */
2526         if (ver->sbe_type > 0x01) {
2527                 bt_dev_err(hdev, "Unsupported Intel secure boot engine type (0x%x)",
2528                            ver->sbe_type);
2529                 return -EINVAL;
2530         }
2531
2532         /* If the OTP has no valid Bluetooth device address, then there will
2533          * also be no valid address for the operational firmware.
2534          */
2535         if (!bacmp(&ver->otp_bd_addr, BDADDR_ANY)) {
2536                 bt_dev_info(hdev, "No device address configured");
2537                 set_bit(HCI_QUIRK_INVALID_BDADDR, &hdev->quirks);
2538         }
2539
2540         btusb_setup_intel_newgen_get_fw_name(ver, fwname, sizeof(fwname), "sfi");
2541         err = request_firmware(&fw, fwname, &hdev->dev);
2542         if (err < 0) {
2543                 bt_dev_err(hdev, "Failed to load Intel firmware file %s (%d)",
2544                            fwname, err);
2545                 return err;
2546         }
2547
2548         bt_dev_info(hdev, "Found device firmware: %s", fwname);
2549
2550         if (fw->size < 644) {
2551                 bt_dev_err(hdev, "Invalid size of firmware file (%zu)",
2552                            fw->size);
2553                 err = -EBADF;
2554                 goto done;
2555         }
2556
2557         set_bit(BTUSB_DOWNLOADING, &data->flags);
2558
2559         /* Start firmware downloading and get boot parameter */
2560         err = btintel_download_firmware_newgen(hdev, fw, boot_param,
2561                                                INTEL_HW_VARIANT(ver->cnvi_bt),
2562                                                ver->sbe_type);
2563         if (err < 0) {
2564                 /* When FW download fails, send Intel Reset to retry
2565                  * FW download.
2566                  */
2567                 btintel_reset_to_bootloader(hdev);
2568                 goto done;
2569         }
2570         set_bit(BTUSB_FIRMWARE_LOADED, &data->flags);
2571
2572         bt_dev_info(hdev, "Waiting for firmware download to complete");
2573
2574         /* Before switching the device into operational mode and with that
2575          * booting the loaded firmware, wait for the bootloader notification
2576          * that all fragments have been successfully received.
2577          *
2578          * When the event processing receives the notification, then the
2579          * BTUSB_DOWNLOADING flag will be cleared.
2580          *
2581          * The firmware loading should not take longer than 5 seconds
2582          * and thus just timeout if that happens and fail the setup
2583          * of this device.
2584          */
2585         err = wait_on_bit_timeout(&data->flags, BTUSB_DOWNLOADING,
2586                                   TASK_INTERRUPTIBLE,
2587                                   msecs_to_jiffies(5000));
2588         if (err == -EINTR) {
2589                 bt_dev_err(hdev, "Firmware loading interrupted");
2590                 goto done;
2591         }
2592
2593         if (err) {
2594                 bt_dev_err(hdev, "Firmware loading timeout");
2595                 err = -ETIMEDOUT;
2596                 btintel_reset_to_bootloader(hdev);
2597                 goto done;
2598         }
2599
2600         if (test_bit(BTUSB_FIRMWARE_FAILED, &data->flags)) {
2601                 bt_dev_err(hdev, "Firmware loading failed");
2602                 err = -ENOEXEC;
2603                 goto done;
2604         }
2605
2606 done:
2607         release_firmware(fw);
2608         return err;
2609 }
2610
2611 static int btusb_intel_download_firmware(struct hci_dev *hdev,
2612                                          struct intel_version *ver,
2613                                          struct intel_boot_params *params,
2614                                          u32 *boot_param)
2615 {
2616         const struct firmware *fw;
2617         char fwname[64];
2618         int err;
2619         struct btusb_data *data = hci_get_drvdata(hdev);
2620
2621         if (!ver || !params)
2622                 return -EINVAL;
2623
2624         /* The hardware platform number has a fixed value of 0x37 and
2625          * for now only accept this single value.
2626          */
2627         if (ver->hw_platform != 0x37) {
2628                 bt_dev_err(hdev, "Unsupported Intel hardware platform (%u)",
2629                            ver->hw_platform);
2630                 return -EINVAL;
2631         }
2632
2633         /* Check for supported iBT hardware variants of this firmware
2634          * loading method.
2635          *
2636          * This check has been put in place to ensure correct forward
2637          * compatibility options when newer hardware variants come along.
2638          */
2639         switch (ver->hw_variant) {
2640         case 0x0b:      /* SfP */
2641         case 0x0c:      /* WsP */
2642         case 0x11:      /* JfP */
2643         case 0x12:      /* ThP */
2644         case 0x13:      /* HrP */
2645         case 0x14:      /* CcP */
2646                 break;
2647         default:
2648                 bt_dev_err(hdev, "Unsupported Intel hardware variant (%u)",
2649                            ver->hw_variant);
2650                 return -EINVAL;
2651         }
2652
2653         btintel_version_info(hdev, ver);
2654
2655         /* The firmware variant determines if the device is in bootloader
2656          * mode or is running operational firmware. The value 0x06 identifies
2657          * the bootloader and the value 0x23 identifies the operational
2658          * firmware.
2659          *
2660          * When the operational firmware is already present, then only
2661          * the check for valid Bluetooth device address is needed. This
2662          * determines if the device will be added as configured or
2663          * unconfigured controller.
2664          *
2665          * It is not possible to use the Secure Boot Parameters in this
2666          * case since that command is only available in bootloader mode.
2667          */
2668         if (ver->fw_variant == 0x23) {
2669                 clear_bit(BTUSB_BOOTLOADER, &data->flags);
2670                 btintel_check_bdaddr(hdev);
2671                 return 0;
2672         }
2673
2674         /* If the device is not in bootloader mode, then the only possible
2675          * choice is to return an error and abort the device initialization.
2676          */
2677         if (ver->fw_variant != 0x06) {
2678                 bt_dev_err(hdev, "Unsupported Intel firmware variant (%u)",
2679                            ver->fw_variant);
2680                 return -ENODEV;
2681         }
2682
2683         /* Read the secure boot parameters to identify the operating
2684          * details of the bootloader.
2685          */
2686         err = btintel_read_boot_params(hdev, params);
2687         if (err)
2688                 return err;
2689
2690         /* It is required that every single firmware fragment is acknowledged
2691          * with a command complete event. If the boot parameters indicate
2692          * that this bootloader does not send them, then abort the setup.
2693          */
2694         if (params->limited_cce != 0x00) {
2695                 bt_dev_err(hdev, "Unsupported Intel firmware loading method (%u)",
2696                            params->limited_cce);
2697                 return -EINVAL;
2698         }
2699
2700         /* If the OTP has no valid Bluetooth device address, then there will
2701          * also be no valid address for the operational firmware.
2702          */
2703         if (!bacmp(&params->otp_bdaddr, BDADDR_ANY)) {
2704                 bt_dev_info(hdev, "No device address configured");
2705                 set_bit(HCI_QUIRK_INVALID_BDADDR, &hdev->quirks);
2706         }
2707
2708         /* With this Intel bootloader only the hardware variant and device
2709          * revision information are used to select the right firmware for SfP
2710          * and WsP.
2711          *
2712          * The firmware filename is ibt-<hw_variant>-<dev_revid>.sfi.
2713          *
2714          * Currently the supported hardware variants are:
2715          *   11 (0x0b) for iBT3.0 (LnP/SfP)
2716          *   12 (0x0c) for iBT3.5 (WsP)
2717          *
2718          * For ThP/JfP and for future SKU's, the FW name varies based on HW
2719          * variant, HW revision and FW revision, as these are dependent on CNVi
2720          * and RF Combination.
2721          *
2722          *   17 (0x11) for iBT3.5 (JfP)
2723          *   18 (0x12) for iBT3.5 (ThP)
2724          *
2725          * The firmware file name for these will be
2726          * ibt-<hw_variant>-<hw_revision>-<fw_revision>.sfi.
2727          *
2728          */
2729         err = btusb_setup_intel_new_get_fw_name(ver, params, fwname,
2730                                                 sizeof(fwname), "sfi");
2731         if (!err) {
2732                 bt_dev_err(hdev, "Unsupported Intel firmware naming");
2733                 return -EINVAL;
2734         }
2735
2736         err = request_firmware(&fw, fwname, &hdev->dev);
2737         if (err < 0) {
2738                 bt_dev_err(hdev, "Failed to load Intel firmware file %s (%d)",
2739                            fwname, err);
2740                 return err;
2741         }
2742
2743         bt_dev_info(hdev, "Found device firmware: %s", fwname);
2744
2745         if (fw->size < 644) {
2746                 bt_dev_err(hdev, "Invalid size of firmware file (%zu)",
2747                            fw->size);
2748                 err = -EBADF;
2749                 goto done;
2750         }
2751
2752         set_bit(BTUSB_DOWNLOADING, &data->flags);
2753
2754         /* Start firmware downloading and get boot parameter */
2755         err = btintel_download_firmware(hdev, fw, boot_param);
2756         if (err < 0) {
2757                 /* When FW download fails, send Intel Reset to retry
2758                  * FW download.
2759                  */
2760                 btintel_reset_to_bootloader(hdev);
2761                 goto done;
2762         }
2763         set_bit(BTUSB_FIRMWARE_LOADED, &data->flags);
2764
2765         bt_dev_info(hdev, "Waiting for firmware download to complete");
2766
2767         /* Before switching the device into operational mode and with that
2768          * booting the loaded firmware, wait for the bootloader notification
2769          * that all fragments have been successfully received.
2770          *
2771          * When the event processing receives the notification, then the
2772          * BTUSB_DOWNLOADING flag will be cleared.
2773          *
2774          * The firmware loading should not take longer than 5 seconds
2775          * and thus just timeout if that happens and fail the setup
2776          * of this device.
2777          */
2778         err = wait_on_bit_timeout(&data->flags, BTUSB_DOWNLOADING,
2779                                   TASK_INTERRUPTIBLE,
2780                                   msecs_to_jiffies(5000));
2781         if (err == -EINTR) {
2782                 bt_dev_err(hdev, "Firmware loading interrupted");
2783                 goto done;
2784         }
2785
2786         if (err) {
2787                 bt_dev_err(hdev, "Firmware loading timeout");
2788                 err = -ETIMEDOUT;
2789                 btintel_reset_to_bootloader(hdev);
2790                 goto done;
2791         }
2792
2793         if (test_bit(BTUSB_FIRMWARE_FAILED, &data->flags)) {
2794                 bt_dev_err(hdev, "Firmware loading failed");
2795                 err = -ENOEXEC;
2796                 goto done;
2797         }
2798
2799 done:
2800         release_firmware(fw);
2801         return err;
2802 }
2803
2804 static int btusb_setup_intel_new(struct hci_dev *hdev)
2805 {
2806         struct btusb_data *data = hci_get_drvdata(hdev);
2807         struct intel_version ver;
2808         struct intel_boot_params params;
2809         u32 boot_param;
2810         char ddcname[64];
2811         ktime_t calltime, delta, rettime;
2812         unsigned long long duration;
2813         int err;
2814         struct intel_debug_features features;
2815
2816         BT_DBG("%s", hdev->name);
2817
2818         /* Set the default boot parameter to 0x0 and it is updated to
2819          * SKU specific boot parameter after reading Intel_Write_Boot_Params
2820          * command while downloading the firmware.
2821          */
2822         boot_param = 0x00000000;
2823
2824         calltime = ktime_get();
2825
2826         /* Read the Intel version information to determine if the device
2827          * is in bootloader mode or if it already has operational firmware
2828          * loaded.
2829          */
2830         err = btintel_read_version(hdev, &ver);
2831         if (err) {
2832                 bt_dev_err(hdev, "Intel Read version failed (%d)", err);
2833                 btintel_reset_to_bootloader(hdev);
2834                 return err;
2835         }
2836
2837         err = btusb_intel_download_firmware(hdev, &ver, &params, &boot_param);
2838         if (err)
2839                 return err;
2840
2841         /* controller is already having an operational firmware */
2842         if (ver.fw_variant == 0x23)
2843                 goto finish;
2844
2845         rettime = ktime_get();
2846         delta = ktime_sub(rettime, calltime);
2847         duration = (unsigned long long) ktime_to_ns(delta) >> 10;
2848
2849         bt_dev_info(hdev, "Firmware loaded in %llu usecs", duration);
2850
2851         calltime = ktime_get();
2852
2853         set_bit(BTUSB_BOOTING, &data->flags);
2854
2855         err = btintel_send_intel_reset(hdev, boot_param);
2856         if (err) {
2857                 bt_dev_err(hdev, "Intel Soft Reset failed (%d)", err);
2858                 btintel_reset_to_bootloader(hdev);
2859                 return err;
2860         }
2861
2862         /* The bootloader will not indicate when the device is ready. This
2863          * is done by the operational firmware sending bootup notification.
2864          *
2865          * Booting into operational firmware should not take longer than
2866          * 1 second. However if that happens, then just fail the setup
2867          * since something went wrong.
2868          */
2869         bt_dev_info(hdev, "Waiting for device to boot");
2870
2871         err = wait_on_bit_timeout(&data->flags, BTUSB_BOOTING,
2872                                   TASK_INTERRUPTIBLE,
2873                                   msecs_to_jiffies(1000));
2874
2875         if (err == -EINTR) {
2876                 bt_dev_err(hdev, "Device boot interrupted");
2877                 return -EINTR;
2878         }
2879
2880         if (err) {
2881                 bt_dev_err(hdev, "Device boot timeout");
2882                 btintel_reset_to_bootloader(hdev);
2883                 return -ETIMEDOUT;
2884         }
2885
2886         rettime = ktime_get();
2887         delta = ktime_sub(rettime, calltime);
2888         duration = (unsigned long long) ktime_to_ns(delta) >> 10;
2889
2890         bt_dev_info(hdev, "Device booted in %llu usecs", duration);
2891
2892         clear_bit(BTUSB_BOOTLOADER, &data->flags);
2893
2894         err = btusb_setup_intel_new_get_fw_name(&ver, &params, ddcname,
2895                                                 sizeof(ddcname), "ddc");
2896
2897         if (!err) {
2898                 bt_dev_err(hdev, "Unsupported Intel firmware naming");
2899         } else {
2900                 /* Once the device is running in operational mode, it needs to
2901                  * apply the device configuration (DDC) parameters.
2902                  *
2903                  * The device can work without DDC parameters, so even if it
2904                  * fails to load the file, no need to fail the setup.
2905                  */
2906                 btintel_load_ddc_config(hdev, ddcname);
2907         }
2908
2909         /* Read the Intel supported features and if new exception formats
2910          * supported, need to load the additional DDC config to enable.
2911          */
2912         btintel_read_debug_features(hdev, &features);
2913
2914         /* Set DDC mask for available debug features */
2915         btintel_set_debug_features(hdev, &features);
2916
2917         /* Read the Intel version information after loading the FW  */
2918         err = btintel_read_version(hdev, &ver);
2919         if (err)
2920                 return err;
2921
2922         btintel_version_info(hdev, &ver);
2923
2924 finish:
2925         /* All Intel controllers that support the Microsoft vendor
2926          * extension are using 0xFC1E for VsMsftOpCode.
2927          */
2928         switch (ver.hw_variant) {
2929         case 0x11:      /* JfP */
2930         case 0x12:      /* ThP */
2931         case 0x13:      /* HrP */
2932         case 0x14:      /* CcP */
2933                 hci_set_msft_opcode(hdev, 0xFC1E);
2934                 break;
2935         }
2936
2937         /* Set the event mask for Intel specific vendor events. This enables
2938          * a few extra events that are useful during general operation. It
2939          * does not enable any debugging related events.
2940          *
2941          * The device will function correctly without these events enabled
2942          * and thus no need to fail the setup.
2943          */
2944         btintel_set_event_mask(hdev, false);
2945
2946         return 0;
2947 }
2948
2949 static int btusb_setup_intel_newgen(struct hci_dev *hdev)
2950 {
2951         struct btusb_data *data = hci_get_drvdata(hdev);
2952         u32 boot_param;
2953         char ddcname[64];
2954         ktime_t calltime, delta, rettime;
2955         unsigned long long duration;
2956         int err;
2957         struct intel_debug_features features;
2958         struct intel_version_tlv version;
2959
2960         bt_dev_dbg(hdev, "");
2961
2962         /* Set the default boot parameter to 0x0 and it is updated to
2963          * SKU specific boot parameter after reading Intel_Write_Boot_Params
2964          * command while downloading the firmware.
2965          */
2966         boot_param = 0x00000000;
2967
2968         calltime = ktime_get();
2969
2970         /* Read the Intel version information to determine if the device
2971          * is in bootloader mode or if it already has operational firmware
2972          * loaded.
2973          */
2974         err = btintel_read_version_tlv(hdev, &version);
2975         if (err) {
2976                 bt_dev_err(hdev, "Intel Read version failed (%d)", err);
2977                 btintel_reset_to_bootloader(hdev);
2978                 return err;
2979         }
2980
2981         btintel_version_info_tlv(hdev, &version);
2982
2983         err = btusb_intel_download_firmware_newgen(hdev, &version, &boot_param);
2984         if (err)
2985                 return err;
2986
2987         /* check if controller is already having an operational firmware */
2988         if (version.img_type == 0x03)
2989                 goto finish;
2990
2991         rettime = ktime_get();
2992         delta = ktime_sub(rettime, calltime);
2993         duration = (unsigned long long)ktime_to_ns(delta) >> 10;
2994
2995         bt_dev_info(hdev, "Firmware loaded in %llu usecs", duration);
2996
2997         calltime = ktime_get();
2998
2999         set_bit(BTUSB_BOOTING, &data->flags);
3000
3001         err = btintel_send_intel_reset(hdev, boot_param);
3002         if (err) {
3003                 bt_dev_err(hdev, "Intel Soft Reset failed (%d)", err);
3004                 btintel_reset_to_bootloader(hdev);
3005                 return err;
3006         }
3007
3008         /* The bootloader will not indicate when the device is ready. This
3009          * is done by the operational firmware sending bootup notification.
3010          *
3011          * Booting into operational firmware should not take longer than
3012          * 1 second. However if that happens, then just fail the setup
3013          * since something went wrong.
3014          */
3015         bt_dev_info(hdev, "Waiting for device to boot");
3016
3017         err = wait_on_bit_timeout(&data->flags, BTUSB_BOOTING,
3018                                   TASK_INTERRUPTIBLE,
3019                                   msecs_to_jiffies(1000));
3020
3021         if (err == -EINTR) {
3022                 bt_dev_err(hdev, "Device boot interrupted");
3023                 return -EINTR;
3024         }
3025
3026         if (err) {
3027                 bt_dev_err(hdev, "Device boot timeout");
3028                 btintel_reset_to_bootloader(hdev);
3029                 return -ETIMEDOUT;
3030         }
3031
3032         rettime = ktime_get();
3033         delta = ktime_sub(rettime, calltime);
3034         duration = (unsigned long long)ktime_to_ns(delta) >> 10;
3035
3036         bt_dev_info(hdev, "Device booted in %llu usecs", duration);
3037
3038         clear_bit(BTUSB_BOOTLOADER, &data->flags);
3039
3040         btusb_setup_intel_newgen_get_fw_name(&version, ddcname, sizeof(ddcname),
3041                                              "ddc");
3042         /* Once the device is running in operational mode, it needs to
3043          * apply the device configuration (DDC) parameters.
3044          *
3045          * The device can work without DDC parameters, so even if it
3046          * fails to load the file, no need to fail the setup.
3047          */
3048         btintel_load_ddc_config(hdev, ddcname);
3049
3050         /* Read the Intel supported features and if new exception formats
3051          * supported, need to load the additional DDC config to enable.
3052          */
3053         btintel_read_debug_features(hdev, &features);
3054
3055         /* Set DDC mask for available debug features */
3056         btintel_set_debug_features(hdev, &features);
3057
3058         /* Read the Intel version information after loading the FW  */
3059         err = btintel_read_version_tlv(hdev, &version);
3060         if (err)
3061                 return err;
3062
3063         btintel_version_info_tlv(hdev, &version);
3064
3065 finish:
3066         /* Set the event mask for Intel specific vendor events. This enables
3067          * a few extra events that are useful during general operation. It
3068          * does not enable any debugging related events.
3069          *
3070          * The device will function correctly without these events enabled
3071          * and thus no need to fail the setup.
3072          */
3073         btintel_set_event_mask(hdev, false);
3074
3075         return 0;
3076 }
3077 static int btusb_shutdown_intel(struct hci_dev *hdev)
3078 {
3079         struct sk_buff *skb;
3080         long ret;
3081
3082         /* In the shutdown sequence where Bluetooth is turned off followed
3083          * by WiFi being turned off, turning WiFi back on causes issue with
3084          * the RF calibration.
3085          *
3086          * To ensure that any RF activity has been stopped, issue HCI Reset
3087          * command to clear all ongoing activity including advertising,
3088          * scanning etc.
3089          */
3090         skb = __hci_cmd_sync(hdev, HCI_OP_RESET, 0, NULL, HCI_INIT_TIMEOUT);
3091         if (IS_ERR(skb)) {
3092                 ret = PTR_ERR(skb);
3093                 bt_dev_err(hdev, "HCI reset during shutdown failed");
3094                 return ret;
3095         }
3096         kfree_skb(skb);
3097
3098         /* Some platforms have an issue with BT LED when the interface is
3099          * down or BT radio is turned off, which takes 5 seconds to BT LED
3100          * goes off. This command turns off the BT LED immediately.
3101          */
3102         skb = __hci_cmd_sync(hdev, 0xfc3f, 0, NULL, HCI_INIT_TIMEOUT);
3103         if (IS_ERR(skb)) {
3104                 ret = PTR_ERR(skb);
3105                 bt_dev_err(hdev, "turning off Intel device LED failed");
3106                 return ret;
3107         }
3108         kfree_skb(skb);
3109
3110         return 0;
3111 }
3112
3113 static int btusb_shutdown_intel_new(struct hci_dev *hdev)
3114 {
3115         struct sk_buff *skb;
3116
3117         /* Send HCI Reset to the controller to stop any BT activity which
3118          * were triggered. This will help to save power and maintain the
3119          * sync b/w Host and controller
3120          */
3121         skb = __hci_cmd_sync(hdev, HCI_OP_RESET, 0, NULL, HCI_INIT_TIMEOUT);
3122         if (IS_ERR(skb)) {
3123                 bt_dev_err(hdev, "HCI reset during shutdown failed");
3124                 return PTR_ERR(skb);
3125         }
3126         kfree_skb(skb);
3127
3128         return 0;
3129 }
3130
3131 #define FIRMWARE_MT7663         "mediatek/mt7663pr2h.bin"
3132 #define FIRMWARE_MT7668         "mediatek/mt7668pr2h.bin"
3133
3134 #define HCI_WMT_MAX_EVENT_SIZE          64
3135 /* It is for mt79xx download rom patch*/
3136 #define MTK_FW_ROM_PATCH_HEADER_SIZE    32
3137 #define MTK_FW_ROM_PATCH_GD_SIZE        64
3138 #define MTK_FW_ROM_PATCH_SEC_MAP_SIZE   64
3139 #define MTK_SEC_MAP_COMMON_SIZE 12
3140 #define MTK_SEC_MAP_NEED_SEND_SIZE      52
3141
3142 enum {
3143         BTMTK_WMT_PATCH_DWNLD = 0x1,
3144         BTMTK_WMT_FUNC_CTRL = 0x6,
3145         BTMTK_WMT_RST = 0x7,
3146         BTMTK_WMT_SEMAPHORE = 0x17,
3147 };
3148
3149 enum {
3150         BTMTK_WMT_INVALID,
3151         BTMTK_WMT_PATCH_UNDONE,
3152         BTMTK_WMT_PATCH_PROGRESS,
3153         BTMTK_WMT_PATCH_DONE,
3154         BTMTK_WMT_ON_UNDONE,
3155         BTMTK_WMT_ON_DONE,
3156         BTMTK_WMT_ON_PROGRESS,
3157 };
3158
3159 struct btmtk_wmt_hdr {
3160         u8      dir;
3161         u8      op;
3162         __le16  dlen;
3163         u8      flag;
3164 } __packed;
3165
3166 struct btmtk_hci_wmt_cmd {
3167         struct btmtk_wmt_hdr hdr;
3168         u8 data[];
3169 } __packed;
3170
3171 struct btmtk_hci_wmt_evt {
3172         struct hci_event_hdr hhdr;
3173         struct btmtk_wmt_hdr whdr;
3174 } __packed;
3175
3176 struct btmtk_hci_wmt_evt_funcc {
3177         struct btmtk_hci_wmt_evt hwhdr;
3178         __be16 status;
3179 } __packed;
3180
3181 struct btmtk_tci_sleep {
3182         u8 mode;
3183         __le16 duration;
3184         __le16 host_duration;
3185         u8 host_wakeup_pin;
3186         u8 time_compensation;
3187 } __packed;
3188
3189 struct btmtk_hci_wmt_params {
3190         u8 op;
3191         u8 flag;
3192         u16 dlen;
3193         const void *data;
3194         u32 *status;
3195 };
3196
3197 struct btmtk_patch_header {
3198         u8 datetime[16];
3199         u8 platform[4];
3200         __le16 hwver;
3201         __le16 swver;
3202         __le32 magicnum;
3203 } __packed;
3204
3205 struct btmtk_global_desc {
3206         __le32 patch_ver;
3207         __le32 sub_sys;
3208         __le32 feature_opt;
3209         __le32 section_num;
3210 } __packed;
3211
3212 struct btmtk_section_map {
3213         __le32 sectype;
3214         __le32 secoffset;
3215         __le32 secsize;
3216         union {
3217                 __le32 u4SecSpec[13];
3218                 struct {
3219                         __le32 dlAddr;
3220                         __le32 dlsize;
3221                         __le32 seckeyidx;
3222                         __le32 alignlen;
3223                         __le32 sectype;
3224                         __le32 dlmodecrctype;
3225                         __le32 crc;
3226                         __le32 reserved[6];
3227                 } bin_info_spec;
3228         };
3229 } __packed;
3230
3231 static void btusb_mtk_wmt_recv(struct urb *urb)
3232 {
3233         struct hci_dev *hdev = urb->context;
3234         struct btusb_data *data = hci_get_drvdata(hdev);
3235         struct hci_event_hdr *hdr;
3236         struct sk_buff *skb;
3237         int err;
3238
3239         if (urb->status == 0 && urb->actual_length > 0) {
3240                 hdev->stat.byte_rx += urb->actual_length;
3241
3242                 /* WMT event shouldn't be fragmented and the size should be
3243                  * less than HCI_WMT_MAX_EVENT_SIZE.
3244                  */
3245                 skb = bt_skb_alloc(HCI_WMT_MAX_EVENT_SIZE, GFP_ATOMIC);
3246                 if (!skb) {
3247                         hdev->stat.err_rx++;
3248                         return;
3249                 }
3250
3251                 hci_skb_pkt_type(skb) = HCI_EVENT_PKT;
3252                 skb_put_data(skb, urb->transfer_buffer, urb->actual_length);
3253
3254                 hdr = (void *)skb->data;
3255                 /* Fix up the vendor event id with 0xff for vendor specific
3256                  * instead of 0xe4 so that event send via monitoring socket can
3257                  * be parsed properly.
3258                  */
3259                 hdr->evt = 0xff;
3260
3261                 /* When someone waits for the WMT event, the skb is being cloned
3262                  * and being processed the events from there then.
3263                  */
3264                 if (test_bit(BTUSB_TX_WAIT_VND_EVT, &data->flags)) {
3265                         data->evt_skb = skb_clone(skb, GFP_ATOMIC);
3266                         if (!data->evt_skb) {
3267                                 kfree_skb(skb);
3268                                 return;
3269                         }
3270                 }
3271
3272                 err = hci_recv_frame(hdev, skb);
3273                 if (err < 0) {
3274                         kfree_skb(data->evt_skb);
3275                         data->evt_skb = NULL;
3276                         return;
3277                 }
3278
3279                 if (test_and_clear_bit(BTUSB_TX_WAIT_VND_EVT,
3280                                        &data->flags)) {
3281                         /* Barrier to sync with other CPUs */
3282                         smp_mb__after_atomic();
3283                         wake_up_bit(&data->flags,
3284                                     BTUSB_TX_WAIT_VND_EVT);
3285                 }
3286                 return;
3287         } else if (urb->status == -ENOENT) {
3288                 /* Avoid suspend failed when usb_kill_urb */
3289                 return;
3290         }
3291
3292         usb_mark_last_busy(data->udev);
3293
3294         /* The URB complete handler is still called with urb->actual_length = 0
3295          * when the event is not available, so we should keep re-submitting
3296          * URB until WMT event returns, Also, It's necessary to wait some time
3297          * between the two consecutive control URBs to relax the target device
3298          * to generate the event. Otherwise, the WMT event cannot return from
3299          * the device successfully.
3300          */
3301         udelay(500);
3302
3303         usb_anchor_urb(urb, &data->ctrl_anchor);
3304         err = usb_submit_urb(urb, GFP_ATOMIC);
3305         if (err < 0) {
3306                 /* -EPERM: urb is being killed;
3307                  * -ENODEV: device got disconnected
3308                  */
3309                 if (err != -EPERM && err != -ENODEV)
3310                         bt_dev_err(hdev, "urb %p failed to resubmit (%d)",
3311                                    urb, -err);
3312                 usb_unanchor_urb(urb);
3313         }
3314 }
3315
3316 static int btusb_mtk_submit_wmt_recv_urb(struct hci_dev *hdev)
3317 {
3318         struct btusb_data *data = hci_get_drvdata(hdev);
3319         struct usb_ctrlrequest *dr;
3320         unsigned char *buf;
3321         int err, size = 64;
3322         unsigned int pipe;
3323         struct urb *urb;
3324
3325         urb = usb_alloc_urb(0, GFP_KERNEL);
3326         if (!urb)
3327                 return -ENOMEM;
3328
3329         dr = kmalloc(sizeof(*dr), GFP_KERNEL);
3330         if (!dr) {
3331                 usb_free_urb(urb);
3332                 return -ENOMEM;
3333         }
3334
3335         dr->bRequestType = USB_TYPE_VENDOR | USB_DIR_IN;
3336         dr->bRequest     = 1;
3337         dr->wIndex       = cpu_to_le16(0);
3338         dr->wValue       = cpu_to_le16(48);
3339         dr->wLength      = cpu_to_le16(size);
3340
3341         buf = kmalloc(size, GFP_KERNEL);
3342         if (!buf) {
3343                 kfree(dr);
3344                 usb_free_urb(urb);
3345                 return -ENOMEM;
3346         }
3347
3348         pipe = usb_rcvctrlpipe(data->udev, 0);
3349
3350         usb_fill_control_urb(urb, data->udev, pipe, (void *)dr,
3351                              buf, size, btusb_mtk_wmt_recv, hdev);
3352
3353         urb->transfer_flags |= URB_FREE_BUFFER;
3354
3355         usb_anchor_urb(urb, &data->ctrl_anchor);
3356         err = usb_submit_urb(urb, GFP_KERNEL);
3357         if (err < 0) {
3358                 if (err != -EPERM && err != -ENODEV)
3359                         bt_dev_err(hdev, "urb %p submission failed (%d)",
3360                                    urb, -err);
3361                 usb_unanchor_urb(urb);
3362         }
3363
3364         usb_free_urb(urb);
3365
3366         return err;
3367 }
3368
3369 static int btusb_mtk_hci_wmt_sync(struct hci_dev *hdev,
3370                                   struct btmtk_hci_wmt_params *wmt_params)
3371 {
3372         struct btusb_data *data = hci_get_drvdata(hdev);
3373         struct btmtk_hci_wmt_evt_funcc *wmt_evt_funcc;
3374         u32 hlen, status = BTMTK_WMT_INVALID;
3375         struct btmtk_hci_wmt_evt *wmt_evt;
3376         struct btmtk_hci_wmt_cmd *wc;
3377         struct btmtk_wmt_hdr *hdr;
3378         int err;
3379
3380         /* Submit control IN URB on demand to process the WMT event */
3381         err = btusb_mtk_submit_wmt_recv_urb(hdev);
3382         if (err < 0)
3383                 return err;
3384
3385         /* Send the WMT command and wait until the WMT event returns */
3386         hlen = sizeof(*hdr) + wmt_params->dlen;
3387         if (hlen > 255)
3388                 return -EINVAL;
3389
3390         wc = kzalloc(hlen, GFP_KERNEL);
3391         if (!wc)
3392                 return -ENOMEM;
3393
3394         hdr = &wc->hdr;
3395         hdr->dir = 1;
3396         hdr->op = wmt_params->op;
3397         hdr->dlen = cpu_to_le16(wmt_params->dlen + 1);
3398         hdr->flag = wmt_params->flag;
3399         memcpy(wc->data, wmt_params->data, wmt_params->dlen);
3400
3401         set_bit(BTUSB_TX_WAIT_VND_EVT, &data->flags);
3402
3403         err = __hci_cmd_send(hdev, 0xfc6f, hlen, wc);
3404
3405         if (err < 0) {
3406                 clear_bit(BTUSB_TX_WAIT_VND_EVT, &data->flags);
3407                 goto err_free_wc;
3408         }
3409
3410         /* The vendor specific WMT commands are all answered by a vendor
3411          * specific event and will have the Command Status or Command
3412          * Complete as with usual HCI command flow control.
3413          *
3414          * After sending the command, wait for BTUSB_TX_WAIT_VND_EVT
3415          * state to be cleared. The driver specific event receive routine
3416          * will clear that state and with that indicate completion of the
3417          * WMT command.
3418          */
3419         err = wait_on_bit_timeout(&data->flags, BTUSB_TX_WAIT_VND_EVT,
3420                                   TASK_INTERRUPTIBLE, HCI_INIT_TIMEOUT);
3421         if (err == -EINTR) {
3422                 bt_dev_err(hdev, "Execution of wmt command interrupted");
3423                 clear_bit(BTUSB_TX_WAIT_VND_EVT, &data->flags);
3424                 goto err_free_wc;
3425         }
3426
3427         if (err) {
3428                 bt_dev_err(hdev, "Execution of wmt command timed out");
3429                 clear_bit(BTUSB_TX_WAIT_VND_EVT, &data->flags);
3430                 err = -ETIMEDOUT;
3431                 goto err_free_wc;
3432         }
3433
3434         /* Parse and handle the return WMT event */
3435         wmt_evt = (struct btmtk_hci_wmt_evt *)data->evt_skb->data;
3436         if (wmt_evt->whdr.op != hdr->op) {
3437                 bt_dev_err(hdev, "Wrong op received %d expected %d",
3438                            wmt_evt->whdr.op, hdr->op);
3439                 err = -EIO;
3440                 goto err_free_skb;
3441         }
3442
3443         switch (wmt_evt->whdr.op) {
3444         case BTMTK_WMT_SEMAPHORE:
3445                 if (wmt_evt->whdr.flag == 2)
3446                         status = BTMTK_WMT_PATCH_UNDONE;
3447                 else
3448                         status = BTMTK_WMT_PATCH_DONE;
3449                 break;
3450         case BTMTK_WMT_FUNC_CTRL:
3451                 wmt_evt_funcc = (struct btmtk_hci_wmt_evt_funcc *)wmt_evt;
3452                 if (be16_to_cpu(wmt_evt_funcc->status) == 0x404)
3453                         status = BTMTK_WMT_ON_DONE;
3454                 else if (be16_to_cpu(wmt_evt_funcc->status) == 0x420)
3455                         status = BTMTK_WMT_ON_PROGRESS;
3456                 else
3457                         status = BTMTK_WMT_ON_UNDONE;
3458                 break;
3459         case BTMTK_WMT_PATCH_DWNLD:
3460                 if (wmt_evt->whdr.flag == 2)
3461                         status = BTMTK_WMT_PATCH_DONE;
3462                 else if (wmt_evt->whdr.flag == 1)
3463                         status = BTMTK_WMT_PATCH_PROGRESS;
3464                 else
3465                         status = BTMTK_WMT_PATCH_UNDONE;
3466                 break;
3467         }
3468
3469         if (wmt_params->status)
3470                 *wmt_params->status = status;
3471
3472 err_free_skb:
3473         kfree_skb(data->evt_skb);
3474         data->evt_skb = NULL;
3475 err_free_wc:
3476         kfree(wc);
3477         return err;
3478 }
3479
3480 static int btusb_mtk_setup_firmware_79xx(struct hci_dev *hdev, const char *fwname)
3481 {
3482         struct btmtk_hci_wmt_params wmt_params;
3483         struct btmtk_global_desc *globaldesc = NULL;
3484         struct btmtk_section_map *sectionmap;
3485         const struct firmware *fw;
3486         const u8 *fw_ptr;
3487         const u8 *fw_bin_ptr;
3488         int err, dlen, i, status;
3489         u8 flag, first_block, retry;
3490         u32 section_num, dl_size, section_offset;
3491         u8 cmd[64];
3492
3493         err = request_firmware(&fw, fwname, &hdev->dev);
3494         if (err < 0) {
3495                 bt_dev_err(hdev, "Failed to load firmware file (%d)", err);
3496                 return err;
3497         }
3498
3499         fw_ptr = fw->data;
3500         fw_bin_ptr = fw_ptr;
3501         globaldesc = (struct btmtk_global_desc *)(fw_ptr + MTK_FW_ROM_PATCH_HEADER_SIZE);
3502         section_num = le32_to_cpu(globaldesc->section_num);
3503
3504         for (i = 0; i < section_num; i++) {
3505                 first_block = 1;
3506                 fw_ptr = fw_bin_ptr;
3507                 sectionmap = (struct btmtk_section_map *)(fw_ptr + MTK_FW_ROM_PATCH_HEADER_SIZE +
3508                               MTK_FW_ROM_PATCH_GD_SIZE + MTK_FW_ROM_PATCH_SEC_MAP_SIZE * i);
3509
3510                 section_offset = le32_to_cpu(sectionmap->secoffset);
3511                 dl_size = le32_to_cpu(sectionmap->bin_info_spec.dlsize);
3512
3513                 if (dl_size > 0) {
3514                         retry = 20;
3515                         while (retry > 0) {
3516                                 cmd[0] = 0; /* 0 means legacy dl mode. */
3517                                 memcpy(cmd + 1,
3518                                        fw_ptr + MTK_FW_ROM_PATCH_HEADER_SIZE +
3519                                        MTK_FW_ROM_PATCH_GD_SIZE + MTK_FW_ROM_PATCH_SEC_MAP_SIZE * i +
3520                                        MTK_SEC_MAP_COMMON_SIZE,
3521                                        MTK_SEC_MAP_NEED_SEND_SIZE + 1);
3522
3523                                 wmt_params.op = BTMTK_WMT_PATCH_DWNLD;
3524                                 wmt_params.status = &status;
3525                                 wmt_params.flag = 0;
3526                                 wmt_params.dlen = MTK_SEC_MAP_NEED_SEND_SIZE + 1;
3527                                 wmt_params.data = &cmd;
3528
3529                                 err = btusb_mtk_hci_wmt_sync(hdev, &wmt_params);
3530                                 if (err < 0) {
3531                                         bt_dev_err(hdev, "Failed to send wmt patch dwnld (%d)",
3532                                                    err);
3533                                         goto err_release_fw;
3534                                 }
3535
3536                                 if (status == BTMTK_WMT_PATCH_UNDONE) {
3537                                         break;
3538                                 } else if (status == BTMTK_WMT_PATCH_PROGRESS) {
3539                                         msleep(100);
3540                                         retry--;
3541                                 } else if (status == BTMTK_WMT_PATCH_DONE) {
3542                                         goto next_section;
3543                                 } else {
3544                                         bt_dev_err(hdev, "Failed wmt patch dwnld status (%d)",
3545                                                    status);
3546                                         goto err_release_fw;
3547                                 }
3548                         }
3549
3550                         fw_ptr += section_offset;
3551                         wmt_params.op = BTMTK_WMT_PATCH_DWNLD;
3552                         wmt_params.status = NULL;
3553
3554                         while (dl_size > 0) {
3555                                 dlen = min_t(int, 250, dl_size);
3556                                 if (first_block == 1) {
3557                                         flag = 1;
3558                                         first_block = 0;
3559                                 } else if (dl_size - dlen <= 0) {
3560                                         flag = 3;
3561                                 } else {
3562                                         flag = 2;
3563                                 }
3564
3565                                 wmt_params.flag = flag;
3566                                 wmt_params.dlen = dlen;
3567                                 wmt_params.data = fw_ptr;
3568
3569                                 err = btusb_mtk_hci_wmt_sync(hdev, &wmt_params);
3570                                 if (err < 0) {
3571                                         bt_dev_err(hdev, "Failed to send wmt patch dwnld (%d)",
3572                                                    err);
3573                                         goto err_release_fw;
3574                                 }
3575
3576                                 dl_size -= dlen;
3577                                 fw_ptr += dlen;
3578                         }
3579                 }
3580 next_section:
3581                 continue;
3582         }
3583         /* Wait a few moments for firmware activation done */
3584         usleep_range(100000, 120000);
3585
3586 err_release_fw:
3587         release_firmware(fw);
3588
3589         return err;
3590 }
3591
3592 static int btusb_mtk_setup_firmware(struct hci_dev *hdev, const char *fwname)
3593 {
3594         struct btmtk_hci_wmt_params wmt_params;
3595         const struct firmware *fw;
3596         const u8 *fw_ptr;
3597         size_t fw_size;
3598         int err, dlen;
3599         u8 flag, param;
3600
3601         err = request_firmware(&fw, fwname, &hdev->dev);
3602         if (err < 0) {
3603                 bt_dev_err(hdev, "Failed to load firmware file (%d)", err);
3604                 return err;
3605         }
3606
3607         /* Power on data RAM the firmware relies on. */
3608         param = 1;
3609         wmt_params.op = BTMTK_WMT_FUNC_CTRL;
3610         wmt_params.flag = 3;
3611         wmt_params.dlen = sizeof(param);
3612         wmt_params.data = &param;
3613         wmt_params.status = NULL;
3614
3615         err = btusb_mtk_hci_wmt_sync(hdev, &wmt_params);
3616         if (err < 0) {
3617                 bt_dev_err(hdev, "Failed to power on data RAM (%d)", err);
3618                 goto err_release_fw;
3619         }
3620
3621         fw_ptr = fw->data;
3622         fw_size = fw->size;
3623
3624         /* The size of patch header is 30 bytes, should be skip */
3625         if (fw_size < 30) {
3626                 err = -EINVAL;
3627                 goto err_release_fw;
3628         }
3629
3630         fw_size -= 30;
3631         fw_ptr += 30;
3632         flag = 1;
3633
3634         wmt_params.op = BTMTK_WMT_PATCH_DWNLD;
3635         wmt_params.status = NULL;
3636
3637         while (fw_size > 0) {
3638                 dlen = min_t(int, 250, fw_size);
3639
3640                 /* Tell device the position in sequence */
3641                 if (fw_size - dlen <= 0)
3642                         flag = 3;
3643                 else if (fw_size < fw->size - 30)
3644                         flag = 2;
3645
3646                 wmt_params.flag = flag;
3647                 wmt_params.dlen = dlen;
3648                 wmt_params.data = fw_ptr;
3649
3650                 err = btusb_mtk_hci_wmt_sync(hdev, &wmt_params);
3651                 if (err < 0) {
3652                         bt_dev_err(hdev, "Failed to send wmt patch dwnld (%d)",
3653                                    err);
3654                         goto err_release_fw;
3655                 }
3656
3657                 fw_size -= dlen;
3658                 fw_ptr += dlen;
3659         }
3660
3661         wmt_params.op = BTMTK_WMT_RST;
3662         wmt_params.flag = 4;
3663         wmt_params.dlen = 0;
3664         wmt_params.data = NULL;
3665         wmt_params.status = NULL;
3666
3667         /* Activate funciton the firmware providing to */
3668         err = btusb_mtk_hci_wmt_sync(hdev, &wmt_params);
3669         if (err < 0) {
3670                 bt_dev_err(hdev, "Failed to send wmt rst (%d)", err);
3671                 goto err_release_fw;
3672         }
3673
3674         /* Wait a few moments for firmware activation done */
3675         usleep_range(10000, 12000);
3676
3677 err_release_fw:
3678         release_firmware(fw);
3679
3680         return err;
3681 }
3682
3683 static int btusb_mtk_func_query(struct hci_dev *hdev)
3684 {
3685         struct btmtk_hci_wmt_params wmt_params;
3686         int status, err;
3687         u8 param = 0;
3688
3689         /* Query whether the function is enabled */
3690         wmt_params.op = BTMTK_WMT_FUNC_CTRL;
3691         wmt_params.flag = 4;
3692         wmt_params.dlen = sizeof(param);
3693         wmt_params.data = &param;
3694         wmt_params.status = &status;
3695
3696         err = btusb_mtk_hci_wmt_sync(hdev, &wmt_params);
3697         if (err < 0) {
3698                 bt_dev_err(hdev, "Failed to query function status (%d)", err);
3699                 return err;
3700         }
3701
3702         return status;
3703 }
3704
3705 static int btusb_mtk_reg_read(struct btusb_data *data, u32 reg, u32 *val)
3706 {
3707         int pipe, err, size = sizeof(u32);
3708         void *buf;
3709
3710         buf = kzalloc(size, GFP_KERNEL);
3711         if (!buf)
3712                 return -ENOMEM;
3713
3714         pipe = usb_rcvctrlpipe(data->udev, 0);
3715         err = usb_control_msg(data->udev, pipe, 0x63,
3716                               USB_TYPE_VENDOR | USB_DIR_IN,
3717                               reg >> 16, reg & 0xffff,
3718                               buf, size, USB_CTRL_SET_TIMEOUT);
3719         if (err < 0)
3720                 goto err_free_buf;
3721
3722         *val = get_unaligned_le32(buf);
3723
3724 err_free_buf:
3725         kfree(buf);
3726
3727         return err;
3728 }
3729
3730 static int btusb_mtk_id_get(struct btusb_data *data, u32 reg, u32 *id)
3731 {
3732         return btusb_mtk_reg_read(data, reg, id);
3733 }
3734
3735 static int btusb_mtk_setup(struct hci_dev *hdev)
3736 {
3737         struct btusb_data *data = hci_get_drvdata(hdev);
3738         struct btmtk_hci_wmt_params wmt_params;
3739         ktime_t calltime, delta, rettime;
3740         struct btmtk_tci_sleep tci_sleep;
3741         unsigned long long duration;
3742         struct sk_buff *skb;
3743         const char *fwname;
3744         int err, status;
3745         u32 dev_id;
3746         char fw_bin_name[64];
3747         u32 fw_version = 0;
3748         u8 param;
3749
3750         calltime = ktime_get();
3751
3752         err = btusb_mtk_id_get(data, 0x80000008, &dev_id);
3753         if (err < 0) {
3754                 bt_dev_err(hdev, "Failed to get device id (%d)", err);
3755                 return err;
3756         }
3757
3758         if (!dev_id) {
3759                 err = btusb_mtk_id_get(data, 0x70010200, &dev_id);
3760                 if (err < 0) {
3761                         bt_dev_err(hdev, "Failed to get device id (%d)", err);
3762                         return err;
3763                 }
3764                 err = btusb_mtk_id_get(data, 0x80021004, &fw_version);
3765                 if (err < 0) {
3766                         bt_dev_err(hdev, "Failed to get fw version (%d)", err);
3767                         return err;
3768                 }
3769         }
3770
3771         switch (dev_id) {
3772         case 0x7663:
3773                 fwname = FIRMWARE_MT7663;
3774                 break;
3775         case 0x7668:
3776                 fwname = FIRMWARE_MT7668;
3777                 break;
3778         case 0x7961:
3779                 snprintf(fw_bin_name, sizeof(fw_bin_name),
3780                         "mediatek/BT_RAM_CODE_MT%04x_1_%x_hdr.bin",
3781                          dev_id & 0xffff, (fw_version & 0xff) + 1);
3782                 err = btusb_mtk_setup_firmware_79xx(hdev, fw_bin_name);
3783
3784                 /* Enable Bluetooth protocol */
3785                 param = 1;
3786                 wmt_params.op = BTMTK_WMT_FUNC_CTRL;
3787                 wmt_params.flag = 0;
3788                 wmt_params.dlen = sizeof(param);
3789                 wmt_params.data = &param;
3790                 wmt_params.status = NULL;
3791
3792                 err = btusb_mtk_hci_wmt_sync(hdev, &wmt_params);
3793                 if (err < 0) {
3794                         bt_dev_err(hdev, "Failed to send wmt func ctrl (%d)", err);
3795                         return err;
3796                 }
3797                 goto done;
3798         default:
3799                 bt_dev_err(hdev, "Unsupported hardware variant (%08x)",
3800                            dev_id);
3801                 return -ENODEV;
3802         }
3803
3804         /* Query whether the firmware is already download */
3805         wmt_params.op = BTMTK_WMT_SEMAPHORE;
3806         wmt_params.flag = 1;
3807         wmt_params.dlen = 0;
3808         wmt_params.data = NULL;
3809         wmt_params.status = &status;
3810
3811         err = btusb_mtk_hci_wmt_sync(hdev, &wmt_params);
3812         if (err < 0) {
3813                 bt_dev_err(hdev, "Failed to query firmware status (%d)", err);
3814                 return err;
3815         }
3816
3817         if (status == BTMTK_WMT_PATCH_DONE) {
3818                 bt_dev_info(hdev, "firmware already downloaded");
3819                 goto ignore_setup_fw;
3820         }
3821
3822         /* Setup a firmware which the device definitely requires */
3823         err = btusb_mtk_setup_firmware(hdev, fwname);
3824         if (err < 0)
3825                 return err;
3826
3827 ignore_setup_fw:
3828         err = readx_poll_timeout(btusb_mtk_func_query, hdev, status,
3829                                  status < 0 || status != BTMTK_WMT_ON_PROGRESS,
3830                                  2000, 5000000);
3831         /* -ETIMEDOUT happens */
3832         if (err < 0)
3833                 return err;
3834
3835         /* The other errors happen in btusb_mtk_func_query */
3836         if (status < 0)
3837                 return status;
3838
3839         if (status == BTMTK_WMT_ON_DONE) {
3840                 bt_dev_info(hdev, "function already on");
3841                 goto ignore_func_on;
3842         }
3843
3844         /* Enable Bluetooth protocol */
3845         param = 1;
3846         wmt_params.op = BTMTK_WMT_FUNC_CTRL;
3847         wmt_params.flag = 0;
3848         wmt_params.dlen = sizeof(param);
3849         wmt_params.data = &param;
3850         wmt_params.status = NULL;
3851
3852         err = btusb_mtk_hci_wmt_sync(hdev, &wmt_params);
3853         if (err < 0) {
3854                 bt_dev_err(hdev, "Failed to send wmt func ctrl (%d)", err);
3855                 return err;
3856         }
3857
3858 ignore_func_on:
3859         /* Apply the low power environment setup */
3860         tci_sleep.mode = 0x5;
3861         tci_sleep.duration = cpu_to_le16(0x640);
3862         tci_sleep.host_duration = cpu_to_le16(0x640);
3863         tci_sleep.host_wakeup_pin = 0;
3864         tci_sleep.time_compensation = 0;
3865
3866         skb = __hci_cmd_sync(hdev, 0xfc7a, sizeof(tci_sleep), &tci_sleep,
3867                              HCI_INIT_TIMEOUT);
3868         if (IS_ERR(skb)) {
3869                 err = PTR_ERR(skb);
3870                 bt_dev_err(hdev, "Failed to apply low power setting (%d)", err);
3871                 return err;
3872         }
3873         kfree_skb(skb);
3874
3875 done:
3876         rettime = ktime_get();
3877         delta = ktime_sub(rettime, calltime);
3878         duration = (unsigned long long)ktime_to_ns(delta) >> 10;
3879
3880         bt_dev_info(hdev, "Device setup in %llu usecs", duration);
3881
3882         return 0;
3883 }
3884
3885 static int btusb_mtk_shutdown(struct hci_dev *hdev)
3886 {
3887         struct btmtk_hci_wmt_params wmt_params;
3888         u8 param = 0;
3889         int err;
3890
3891         /* Disable the device */
3892         wmt_params.op = BTMTK_WMT_FUNC_CTRL;
3893         wmt_params.flag = 0;
3894         wmt_params.dlen = sizeof(param);
3895         wmt_params.data = &param;
3896         wmt_params.status = NULL;
3897
3898         err = btusb_mtk_hci_wmt_sync(hdev, &wmt_params);
3899         if (err < 0) {
3900                 bt_dev_err(hdev, "Failed to send wmt func ctrl (%d)", err);
3901                 return err;
3902         }
3903
3904         return 0;
3905 }
3906
3907 MODULE_FIRMWARE(FIRMWARE_MT7663);
3908 MODULE_FIRMWARE(FIRMWARE_MT7668);
3909
3910 #ifdef CONFIG_PM
3911 /* Configure an out-of-band gpio as wake-up pin, if specified in device tree */
3912 static int marvell_config_oob_wake(struct hci_dev *hdev)
3913 {
3914         struct sk_buff *skb;
3915         struct btusb_data *data = hci_get_drvdata(hdev);
3916         struct device *dev = &data->udev->dev;
3917         u16 pin, gap, opcode;
3918         int ret;
3919         u8 cmd[5];
3920
3921         /* Move on if no wakeup pin specified */
3922         if (of_property_read_u16(dev->of_node, "marvell,wakeup-pin", &pin) ||
3923             of_property_read_u16(dev->of_node, "marvell,wakeup-gap-ms", &gap))
3924                 return 0;
3925
3926         /* Vendor specific command to configure a GPIO as wake-up pin */
3927         opcode = hci_opcode_pack(0x3F, 0x59);
3928         cmd[0] = opcode & 0xFF;
3929         cmd[1] = opcode >> 8;
3930         cmd[2] = 2; /* length of parameters that follow */
3931         cmd[3] = pin;
3932         cmd[4] = gap; /* time in ms, for which wakeup pin should be asserted */
3933
3934         skb = bt_skb_alloc(sizeof(cmd), GFP_KERNEL);
3935         if (!skb) {
3936                 bt_dev_err(hdev, "%s: No memory", __func__);
3937                 return -ENOMEM;
3938         }
3939
3940         skb_put_data(skb, cmd, sizeof(cmd));
3941         hci_skb_pkt_type(skb) = HCI_COMMAND_PKT;
3942
3943         ret = btusb_send_frame(hdev, skb);
3944         if (ret) {
3945                 bt_dev_err(hdev, "%s: configuration failed", __func__);
3946                 kfree_skb(skb);
3947                 return ret;
3948         }
3949
3950         return 0;
3951 }
3952 #endif
3953
3954 static int btusb_set_bdaddr_marvell(struct hci_dev *hdev,
3955                                     const bdaddr_t *bdaddr)
3956 {
3957         struct sk_buff *skb;
3958         u8 buf[8];
3959         long ret;
3960
3961         buf[0] = 0xfe;
3962         buf[1] = sizeof(bdaddr_t);
3963         memcpy(buf + 2, bdaddr, sizeof(bdaddr_t));
3964
3965         skb = __hci_cmd_sync(hdev, 0xfc22, sizeof(buf), buf, HCI_INIT_TIMEOUT);
3966         if (IS_ERR(skb)) {
3967                 ret = PTR_ERR(skb);
3968                 bt_dev_err(hdev, "changing Marvell device address failed (%ld)",
3969                            ret);
3970                 return ret;
3971         }
3972         kfree_skb(skb);
3973
3974         return 0;
3975 }
3976
3977 static int btusb_set_bdaddr_ath3012(struct hci_dev *hdev,
3978                                     const bdaddr_t *bdaddr)
3979 {
3980         struct sk_buff *skb;
3981         u8 buf[10];
3982         long ret;
3983
3984         buf[0] = 0x01;
3985         buf[1] = 0x01;
3986         buf[2] = 0x00;
3987         buf[3] = sizeof(bdaddr_t);
3988         memcpy(buf + 4, bdaddr, sizeof(bdaddr_t));
3989
3990         skb = __hci_cmd_sync(hdev, 0xfc0b, sizeof(buf), buf, HCI_INIT_TIMEOUT);
3991         if (IS_ERR(skb)) {
3992                 ret = PTR_ERR(skb);
3993                 bt_dev_err(hdev, "Change address command failed (%ld)", ret);
3994                 return ret;
3995         }
3996         kfree_skb(skb);
3997
3998         return 0;
3999 }
4000
4001 static int btusb_set_bdaddr_wcn6855(struct hci_dev *hdev,
4002                                 const bdaddr_t *bdaddr)
4003 {
4004         struct sk_buff *skb;
4005         u8 buf[6];
4006         long ret;
4007
4008         memcpy(buf, bdaddr, sizeof(bdaddr_t));
4009
4010         skb = __hci_cmd_sync_ev(hdev, 0xfc14, sizeof(buf), buf,
4011                                 HCI_EV_CMD_COMPLETE, HCI_INIT_TIMEOUT);
4012         if (IS_ERR(skb)) {
4013                 ret = PTR_ERR(skb);
4014                 bt_dev_err(hdev, "Change address command failed (%ld)", ret);
4015                 return ret;
4016         }
4017         kfree_skb(skb);
4018
4019         return 0;
4020 }
4021
4022 #define QCA_DFU_PACKET_LEN      4096
4023
4024 #define QCA_GET_TARGET_VERSION  0x09
4025 #define QCA_CHECK_STATUS        0x05
4026 #define QCA_DFU_DOWNLOAD        0x01
4027
4028 #define QCA_SYSCFG_UPDATED      0x40
4029 #define QCA_PATCH_UPDATED       0x80
4030 #define QCA_DFU_TIMEOUT         3000
4031 #define QCA_FLAG_MULTI_NVM      0x80
4032
4033 struct qca_version {
4034         __le32  rom_version;
4035         __le32  patch_version;
4036         __le32  ram_version;
4037         __le16  board_id;
4038         __le16  flag;
4039         __u8    reserved[4];
4040 } __packed;
4041
4042 struct qca_rampatch_version {
4043         __le16  rom_version_high;
4044         __le16  rom_version_low;
4045         __le16  patch_version;
4046 } __packed;
4047
4048 struct qca_device_info {
4049         u32     rom_version;
4050         u8      rampatch_hdr;   /* length of header in rampatch */
4051         u8      nvm_hdr;        /* length of header in NVM */
4052         u8      ver_offset;     /* offset of version structure in rampatch */
4053 };
4054
4055 static const struct qca_device_info qca_devices_table[] = {
4056         { 0x00000100, 20, 4,  8 }, /* Rome 1.0 */
4057         { 0x00000101, 20, 4,  8 }, /* Rome 1.1 */
4058         { 0x00000200, 28, 4, 16 }, /* Rome 2.0 */
4059         { 0x00000201, 28, 4, 16 }, /* Rome 2.1 */
4060         { 0x00000300, 28, 4, 16 }, /* Rome 3.0 */
4061         { 0x00000302, 28, 4, 16 }, /* Rome 3.2 */
4062         { 0x00130100, 40, 4, 16 }, /* WCN6855 1.0 */
4063         { 0x00130200, 40, 4, 16 }, /* WCN6855 2.0 */
4064 };
4065
4066 static int btusb_qca_send_vendor_req(struct usb_device *udev, u8 request,
4067                                      void *data, u16 size)
4068 {
4069         int pipe, err;
4070         u8 *buf;
4071
4072         buf = kmalloc(size, GFP_KERNEL);
4073         if (!buf)
4074                 return -ENOMEM;
4075
4076         /* Found some of USB hosts have IOT issues with ours so that we should
4077          * not wait until HCI layer is ready.
4078          */
4079         pipe = usb_rcvctrlpipe(udev, 0);
4080         err = usb_control_msg(udev, pipe, request, USB_TYPE_VENDOR | USB_DIR_IN,
4081                               0, 0, buf, size, USB_CTRL_SET_TIMEOUT);
4082         if (err < 0) {
4083                 dev_err(&udev->dev, "Failed to access otp area (%d)", err);
4084                 goto done;
4085         }
4086
4087         memcpy(data, buf, size);
4088
4089 done:
4090         kfree(buf);
4091
4092         return err;
4093 }
4094
4095 static int btusb_setup_qca_download_fw(struct hci_dev *hdev,
4096                                        const struct firmware *firmware,
4097                                        size_t hdr_size)
4098 {
4099         struct btusb_data *btdata = hci_get_drvdata(hdev);
4100         struct usb_device *udev = btdata->udev;
4101         size_t count, size, sent = 0;
4102         int pipe, len, err;
4103         u8 *buf;
4104
4105         buf = kmalloc(QCA_DFU_PACKET_LEN, GFP_KERNEL);
4106         if (!buf)
4107                 return -ENOMEM;
4108
4109         count = firmware->size;
4110
4111         size = min_t(size_t, count, hdr_size);
4112         memcpy(buf, firmware->data, size);
4113
4114         /* USB patches should go down to controller through USB path
4115          * because binary format fits to go down through USB channel.
4116          * USB control path is for patching headers and USB bulk is for
4117          * patch body.
4118          */
4119         pipe = usb_sndctrlpipe(udev, 0);
4120         err = usb_control_msg(udev, pipe, QCA_DFU_DOWNLOAD, USB_TYPE_VENDOR,
4121                               0, 0, buf, size, USB_CTRL_SET_TIMEOUT);
4122         if (err < 0) {
4123                 bt_dev_err(hdev, "Failed to send headers (%d)", err);
4124                 goto done;
4125         }
4126
4127         sent += size;
4128         count -= size;
4129
4130         while (count) {
4131                 size = min_t(size_t, count, QCA_DFU_PACKET_LEN);
4132
4133                 memcpy(buf, firmware->data + sent, size);
4134
4135                 pipe = usb_sndbulkpipe(udev, 0x02);
4136                 err = usb_bulk_msg(udev, pipe, buf, size, &len,
4137                                    QCA_DFU_TIMEOUT);
4138                 if (err < 0) {
4139                         bt_dev_err(hdev, "Failed to send body at %zd of %zd (%d)",
4140                                    sent, firmware->size, err);
4141                         break;
4142                 }
4143
4144                 if (size != len) {
4145                         bt_dev_err(hdev, "Failed to get bulk buffer");
4146                         err = -EILSEQ;
4147                         break;
4148                 }
4149
4150                 sent  += size;
4151                 count -= size;
4152         }
4153
4154 done:
4155         kfree(buf);
4156         return err;
4157 }
4158
4159 static int btusb_setup_qca_load_rampatch(struct hci_dev *hdev,
4160                                          struct qca_version *ver,
4161                                          const struct qca_device_info *info)
4162 {
4163         struct qca_rampatch_version *rver;
4164         const struct firmware *fw;
4165         u32 ver_rom, ver_patch, rver_rom;
4166         u16 rver_rom_low, rver_rom_high, rver_patch;
4167         char fwname[64];
4168         int err;
4169
4170         ver_rom = le32_to_cpu(ver->rom_version);
4171         ver_patch = le32_to_cpu(ver->patch_version);
4172
4173         snprintf(fwname, sizeof(fwname), "qca/rampatch_usb_%08x.bin", ver_rom);
4174
4175         err = request_firmware(&fw, fwname, &hdev->dev);
4176         if (err) {
4177                 bt_dev_err(hdev, "failed to request rampatch file: %s (%d)",
4178                            fwname, err);
4179                 return err;
4180         }
4181
4182         bt_dev_info(hdev, "using rampatch file: %s", fwname);
4183
4184         rver = (struct qca_rampatch_version *)(fw->data + info->ver_offset);
4185         rver_rom_low = le16_to_cpu(rver->rom_version_low);
4186         rver_patch = le16_to_cpu(rver->patch_version);
4187
4188         if (ver_rom & ~0xffffU) {
4189                 rver_rom_high = le16_to_cpu(rver->rom_version_high);
4190                 rver_rom = le32_to_cpu(rver_rom_high << 16 | rver_rom_low);
4191         } else {
4192                 rver_rom = rver_rom_low;
4193         }
4194
4195         bt_dev_info(hdev, "QCA: patch rome 0x%x build 0x%x, "
4196                     "firmware rome 0x%x build 0x%x",
4197                     rver_rom, rver_patch, ver_rom, ver_patch);
4198
4199         if (rver_rom != ver_rom || rver_patch <= ver_patch) {
4200                 bt_dev_err(hdev, "rampatch file version did not match with firmware");
4201                 err = -EINVAL;
4202                 goto done;
4203         }
4204
4205         err = btusb_setup_qca_download_fw(hdev, fw, info->rampatch_hdr);
4206
4207 done:
4208         release_firmware(fw);
4209
4210         return err;
4211 }
4212
4213 static int btusb_setup_qca_load_nvm(struct hci_dev *hdev,
4214                                     struct qca_version *ver,
4215                                     const struct qca_device_info *info)
4216 {
4217         const struct firmware *fw;
4218         char fwname[64];
4219         int err;
4220
4221         if (((ver->flag >> 8) & 0xff) == QCA_FLAG_MULTI_NVM) {
4222                 snprintf(fwname, sizeof(fwname), "qca/nvm_usb_%08x_%04x.bin",
4223                          le32_to_cpu(ver->rom_version),
4224                          le16_to_cpu(ver->board_id));
4225         } else {
4226                 snprintf(fwname, sizeof(fwname), "qca/nvm_usb_%08x.bin",
4227                          le32_to_cpu(ver->rom_version));
4228         }
4229
4230         err = request_firmware(&fw, fwname, &hdev->dev);
4231         if (err) {
4232                 bt_dev_err(hdev, "failed to request NVM file: %s (%d)",
4233                            fwname, err);
4234                 return err;
4235         }
4236
4237         bt_dev_info(hdev, "using NVM file: %s", fwname);
4238
4239         err = btusb_setup_qca_download_fw(hdev, fw, info->nvm_hdr);
4240
4241         release_firmware(fw);
4242
4243         return err;
4244 }
4245
4246 /* identify the ROM version and check whether patches are needed */
4247 static bool btusb_qca_need_patch(struct usb_device *udev)
4248 {
4249         struct qca_version ver;
4250
4251         if (btusb_qca_send_vendor_req(udev, QCA_GET_TARGET_VERSION, &ver,
4252                                       sizeof(ver)) < 0)
4253                 return false;
4254         /* only low ROM versions need patches */
4255         return !(le32_to_cpu(ver.rom_version) & ~0xffffU);
4256 }
4257
4258 static int btusb_setup_qca(struct hci_dev *hdev)
4259 {
4260         struct btusb_data *btdata = hci_get_drvdata(hdev);
4261         struct usb_device *udev = btdata->udev;
4262         const struct qca_device_info *info = NULL;
4263         struct qca_version ver;
4264         u32 ver_rom;
4265         u8 status;
4266         int i, err;
4267
4268         err = btusb_qca_send_vendor_req(udev, QCA_GET_TARGET_VERSION, &ver,
4269                                         sizeof(ver));
4270         if (err < 0)
4271                 return err;
4272
4273         ver_rom = le32_to_cpu(ver.rom_version);
4274
4275         for (i = 0; i < ARRAY_SIZE(qca_devices_table); i++) {
4276                 if (ver_rom == qca_devices_table[i].rom_version)
4277                         info = &qca_devices_table[i];
4278         }
4279         if (!info) {
4280                 /* If the rom_version is not matched in the qca_devices_table
4281                  * and the high ROM version is not zero, we assume this chip no
4282                  * need to load the rampatch and nvm.
4283                  */
4284                 if (ver_rom & ~0xffffU)
4285                         return 0;
4286
4287                 bt_dev_err(hdev, "don't support firmware rome 0x%x", ver_rom);
4288                 return -ENODEV;
4289         }
4290
4291         err = btusb_qca_send_vendor_req(udev, QCA_CHECK_STATUS, &status,
4292                                         sizeof(status));
4293         if (err < 0)
4294                 return err;
4295
4296         if (!(status & QCA_PATCH_UPDATED)) {
4297                 err = btusb_setup_qca_load_rampatch(hdev, &ver, info);
4298                 if (err < 0)
4299                         return err;
4300         }
4301
4302         err = btusb_qca_send_vendor_req(udev, QCA_GET_TARGET_VERSION, &ver,
4303                                         sizeof(ver));
4304         if (err < 0)
4305                 return err;
4306
4307         if (!(status & QCA_SYSCFG_UPDATED)) {
4308                 err = btusb_setup_qca_load_nvm(hdev, &ver, info);
4309                 if (err < 0)
4310                         return err;
4311         }
4312
4313         return 0;
4314 }
4315
4316 static inline int __set_diag_interface(struct hci_dev *hdev)
4317 {
4318         struct btusb_data *data = hci_get_drvdata(hdev);
4319         struct usb_interface *intf = data->diag;
4320         int i;
4321
4322         if (!data->diag)
4323                 return -ENODEV;
4324
4325         data->diag_tx_ep = NULL;
4326         data->diag_rx_ep = NULL;
4327
4328         for (i = 0; i < intf->cur_altsetting->desc.bNumEndpoints; i++) {
4329                 struct usb_endpoint_descriptor *ep_desc;
4330
4331                 ep_desc = &intf->cur_altsetting->endpoint[i].desc;
4332
4333                 if (!data->diag_tx_ep && usb_endpoint_is_bulk_out(ep_desc)) {
4334                         data->diag_tx_ep = ep_desc;
4335                         continue;
4336                 }
4337
4338                 if (!data->diag_rx_ep && usb_endpoint_is_bulk_in(ep_desc)) {
4339                         data->diag_rx_ep = ep_desc;
4340                         continue;
4341                 }
4342         }
4343
4344         if (!data->diag_tx_ep || !data->diag_rx_ep) {
4345                 bt_dev_err(hdev, "invalid diagnostic descriptors");
4346                 return -ENODEV;
4347         }
4348
4349         return 0;
4350 }
4351
4352 static struct urb *alloc_diag_urb(struct hci_dev *hdev, bool enable)
4353 {
4354         struct btusb_data *data = hci_get_drvdata(hdev);
4355         struct sk_buff *skb;
4356         struct urb *urb;
4357         unsigned int pipe;
4358
4359         if (!data->diag_tx_ep)
4360                 return ERR_PTR(-ENODEV);
4361
4362         urb = usb_alloc_urb(0, GFP_KERNEL);
4363         if (!urb)
4364                 return ERR_PTR(-ENOMEM);
4365
4366         skb = bt_skb_alloc(2, GFP_KERNEL);
4367         if (!skb) {
4368                 usb_free_urb(urb);
4369                 return ERR_PTR(-ENOMEM);
4370         }
4371
4372         skb_put_u8(skb, 0xf0);
4373         skb_put_u8(skb, enable);
4374
4375         pipe = usb_sndbulkpipe(data->udev, data->diag_tx_ep->bEndpointAddress);
4376
4377         usb_fill_bulk_urb(urb, data->udev, pipe,
4378                           skb->data, skb->len, btusb_tx_complete, skb);
4379
4380         skb->dev = (void *)hdev;
4381
4382         return urb;
4383 }
4384
4385 static int btusb_bcm_set_diag(struct hci_dev *hdev, bool enable)
4386 {
4387         struct btusb_data *data = hci_get_drvdata(hdev);
4388         struct urb *urb;
4389
4390         if (!data->diag)
4391                 return -ENODEV;
4392
4393         if (!test_bit(HCI_RUNNING, &hdev->flags))
4394                 return -ENETDOWN;
4395
4396         urb = alloc_diag_urb(hdev, enable);
4397         if (IS_ERR(urb))
4398                 return PTR_ERR(urb);
4399
4400         return submit_or_queue_tx_urb(hdev, urb);
4401 }
4402
4403 #ifdef CONFIG_PM
4404 static irqreturn_t btusb_oob_wake_handler(int irq, void *priv)
4405 {
4406         struct btusb_data *data = priv;
4407
4408         pm_wakeup_event(&data->udev->dev, 0);
4409         pm_system_wakeup();
4410
4411         /* Disable only if not already disabled (keep it balanced) */
4412         if (test_and_clear_bit(BTUSB_OOB_WAKE_ENABLED, &data->flags)) {
4413                 disable_irq_nosync(irq);
4414                 disable_irq_wake(irq);
4415         }
4416         return IRQ_HANDLED;
4417 }
4418
4419 static const struct of_device_id btusb_match_table[] = {
4420         { .compatible = "usb1286,204e" },
4421         { .compatible = "usbcf3,e300" }, /* QCA6174A */
4422         { .compatible = "usb4ca,301a" }, /* QCA6174A (Lite-On) */
4423         { }
4424 };
4425 MODULE_DEVICE_TABLE(of, btusb_match_table);
4426
4427 /* Use an oob wakeup pin? */
4428 static int btusb_config_oob_wake(struct hci_dev *hdev)
4429 {
4430         struct btusb_data *data = hci_get_drvdata(hdev);
4431         struct device *dev = &data->udev->dev;
4432         int irq, ret;
4433
4434         clear_bit(BTUSB_OOB_WAKE_ENABLED, &data->flags);
4435
4436         if (!of_match_device(btusb_match_table, dev))
4437                 return 0;
4438
4439         /* Move on if no IRQ specified */
4440         irq = of_irq_get_byname(dev->of_node, "wakeup");
4441         if (irq <= 0) {
4442                 bt_dev_dbg(hdev, "%s: no OOB Wakeup IRQ in DT", __func__);
4443                 return 0;
4444         }
4445
4446         irq_set_status_flags(irq, IRQ_NOAUTOEN);
4447         ret = devm_request_irq(&hdev->dev, irq, btusb_oob_wake_handler,
4448                                0, "OOB Wake-on-BT", data);
4449         if (ret) {
4450                 bt_dev_err(hdev, "%s: IRQ request failed", __func__);
4451                 return ret;
4452         }
4453
4454         ret = device_init_wakeup(dev, true);
4455         if (ret) {
4456                 bt_dev_err(hdev, "%s: failed to init_wakeup", __func__);
4457                 return ret;
4458         }
4459
4460         data->oob_wake_irq = irq;
4461         bt_dev_info(hdev, "OOB Wake-on-BT configured at IRQ %u", irq);
4462         return 0;
4463 }
4464 #endif
4465
4466 static void btusb_check_needs_reset_resume(struct usb_interface *intf)
4467 {
4468         if (dmi_check_system(btusb_needs_reset_resume_table))
4469                 interface_to_usbdev(intf)->quirks |= USB_QUIRK_RESET_RESUME;
4470 }
4471
4472 static bool btusb_prevent_wake(struct hci_dev *hdev)
4473 {
4474         struct btusb_data *data = hci_get_drvdata(hdev);
4475
4476         if (test_bit(BTUSB_WAKEUP_DISABLE, &data->flags))
4477                 return true;
4478
4479         return !device_may_wakeup(&data->udev->dev);
4480 }
4481
4482 static int btusb_shutdown_qca(struct hci_dev *hdev)
4483 {
4484         struct sk_buff *skb;
4485
4486         skb = __hci_cmd_sync(hdev, HCI_OP_RESET, 0, NULL, HCI_INIT_TIMEOUT);
4487         if (IS_ERR(skb)) {
4488                 bt_dev_err(hdev, "HCI reset during shutdown failed");
4489                 return PTR_ERR(skb);
4490         }
4491         kfree_skb(skb);
4492
4493         return 0;
4494 }
4495
4496 static int btusb_probe(struct usb_interface *intf,
4497                        const struct usb_device_id *id)
4498 {
4499         struct usb_endpoint_descriptor *ep_desc;
4500         struct gpio_desc *reset_gpio;
4501         struct btusb_data *data;
4502         struct hci_dev *hdev;
4503         unsigned ifnum_base;
4504         int i, err;
4505
4506         BT_DBG("intf %p id %p", intf, id);
4507
4508         /* interface numbers are hardcoded in the spec */
4509         if (intf->cur_altsetting->desc.bInterfaceNumber != 0) {
4510                 if (!(id->driver_info & BTUSB_IFNUM_2))
4511                         return -ENODEV;
4512                 if (intf->cur_altsetting->desc.bInterfaceNumber != 2)
4513                         return -ENODEV;
4514         }
4515
4516         ifnum_base = intf->cur_altsetting->desc.bInterfaceNumber;
4517
4518         if (!id->driver_info) {
4519                 const struct usb_device_id *match;
4520
4521                 match = usb_match_id(intf, blacklist_table);
4522                 if (match)
4523                         id = match;
4524         }
4525
4526         if (id->driver_info == BTUSB_IGNORE)
4527                 return -ENODEV;
4528
4529         if (id->driver_info & BTUSB_ATH3012) {
4530                 struct usb_device *udev = interface_to_usbdev(intf);
4531
4532                 /* Old firmware would otherwise let ath3k driver load
4533                  * patch and sysconfig files
4534                  */
4535                 if (le16_to_cpu(udev->descriptor.bcdDevice) <= 0x0001 &&
4536                     !btusb_qca_need_patch(udev))
4537                         return -ENODEV;
4538         }
4539
4540         data = devm_kzalloc(&intf->dev, sizeof(*data), GFP_KERNEL);
4541         if (!data)
4542                 return -ENOMEM;
4543
4544         for (i = 0; i < intf->cur_altsetting->desc.bNumEndpoints; i++) {
4545                 ep_desc = &intf->cur_altsetting->endpoint[i].desc;
4546
4547                 if (!data->intr_ep && usb_endpoint_is_int_in(ep_desc)) {
4548                         data->intr_ep = ep_desc;
4549                         continue;
4550                 }
4551
4552                 if (!data->bulk_tx_ep && usb_endpoint_is_bulk_out(ep_desc)) {
4553                         data->bulk_tx_ep = ep_desc;
4554                         continue;
4555                 }
4556
4557                 if (!data->bulk_rx_ep && usb_endpoint_is_bulk_in(ep_desc)) {
4558                         data->bulk_rx_ep = ep_desc;
4559                         continue;
4560                 }
4561         }
4562
4563         if (!data->intr_ep || !data->bulk_tx_ep || !data->bulk_rx_ep)
4564                 return -ENODEV;
4565
4566         if (id->driver_info & BTUSB_AMP) {
4567                 data->cmdreq_type = USB_TYPE_CLASS | 0x01;
4568                 data->cmdreq = 0x2b;
4569         } else {
4570                 data->cmdreq_type = USB_TYPE_CLASS;
4571                 data->cmdreq = 0x00;
4572         }
4573
4574         data->udev = interface_to_usbdev(intf);
4575         data->intf = intf;
4576
4577         INIT_WORK(&data->work, btusb_work);
4578         INIT_WORK(&data->waker, btusb_waker);
4579         init_usb_anchor(&data->deferred);
4580         init_usb_anchor(&data->tx_anchor);
4581         spin_lock_init(&data->txlock);
4582
4583         init_usb_anchor(&data->intr_anchor);
4584         init_usb_anchor(&data->bulk_anchor);
4585         init_usb_anchor(&data->isoc_anchor);
4586         init_usb_anchor(&data->diag_anchor);
4587         init_usb_anchor(&data->ctrl_anchor);
4588         spin_lock_init(&data->rxlock);
4589
4590         if (id->driver_info & BTUSB_INTEL_NEW) {
4591                 data->recv_event = btusb_recv_event_intel;
4592                 data->recv_bulk = btusb_recv_bulk_intel;
4593                 set_bit(BTUSB_BOOTLOADER, &data->flags);
4594         } else {
4595                 data->recv_event = hci_recv_frame;
4596                 data->recv_bulk = btusb_recv_bulk;
4597         }
4598
4599         hdev = hci_alloc_dev();
4600         if (!hdev)
4601                 return -ENOMEM;
4602
4603         hdev->bus = HCI_USB;
4604         hci_set_drvdata(hdev, data);
4605
4606         if (id->driver_info & BTUSB_AMP)
4607                 hdev->dev_type = HCI_AMP;
4608         else
4609                 hdev->dev_type = HCI_PRIMARY;
4610
4611         data->hdev = hdev;
4612
4613         SET_HCIDEV_DEV(hdev, &intf->dev);
4614
4615         reset_gpio = gpiod_get_optional(&data->udev->dev, "reset",
4616                                         GPIOD_OUT_LOW);
4617         if (IS_ERR(reset_gpio)) {
4618                 err = PTR_ERR(reset_gpio);
4619                 goto out_free_dev;
4620         } else if (reset_gpio) {
4621                 data->reset_gpio = reset_gpio;
4622         }
4623
4624         hdev->open   = btusb_open;
4625         hdev->close  = btusb_close;
4626         hdev->flush  = btusb_flush;
4627         hdev->send   = btusb_send_frame;
4628         hdev->notify = btusb_notify;
4629         hdev->prevent_wake = btusb_prevent_wake;
4630
4631 #ifdef CONFIG_PM
4632         err = btusb_config_oob_wake(hdev);
4633         if (err)
4634                 goto out_free_dev;
4635
4636         /* Marvell devices may need a specific chip configuration */
4637         if (id->driver_info & BTUSB_MARVELL && data->oob_wake_irq) {
4638                 err = marvell_config_oob_wake(hdev);
4639                 if (err)
4640                         goto out_free_dev;
4641         }
4642 #endif
4643         if (id->driver_info & BTUSB_CW6622)
4644                 set_bit(HCI_QUIRK_BROKEN_STORED_LINK_KEY, &hdev->quirks);
4645
4646         if (id->driver_info & BTUSB_BCM2045)
4647                 set_bit(HCI_QUIRK_BROKEN_STORED_LINK_KEY, &hdev->quirks);
4648
4649         if (id->driver_info & BTUSB_BCM92035)
4650                 hdev->setup = btusb_setup_bcm92035;
4651
4652         if (IS_ENABLED(CONFIG_BT_HCIBTUSB_BCM) &&
4653             (id->driver_info & BTUSB_BCM_PATCHRAM)) {
4654                 hdev->manufacturer = 15;
4655                 hdev->setup = btbcm_setup_patchram;
4656                 hdev->set_diag = btusb_bcm_set_diag;
4657                 hdev->set_bdaddr = btbcm_set_bdaddr;
4658
4659                 /* Broadcom LM_DIAG Interface numbers are hardcoded */
4660                 data->diag = usb_ifnum_to_if(data->udev, ifnum_base + 2);
4661         }
4662
4663         if (IS_ENABLED(CONFIG_BT_HCIBTUSB_BCM) &&
4664             (id->driver_info & BTUSB_BCM_APPLE)) {
4665                 hdev->manufacturer = 15;
4666                 hdev->setup = btbcm_setup_apple;
4667                 hdev->set_diag = btusb_bcm_set_diag;
4668
4669                 /* Broadcom LM_DIAG Interface numbers are hardcoded */
4670                 data->diag = usb_ifnum_to_if(data->udev, ifnum_base + 2);
4671         }
4672
4673         if (id->driver_info & BTUSB_INTEL) {
4674                 hdev->manufacturer = 2;
4675                 hdev->setup = btusb_setup_intel;
4676                 hdev->shutdown = btusb_shutdown_intel;
4677                 hdev->set_diag = btintel_set_diag_mfg;
4678                 hdev->set_bdaddr = btintel_set_bdaddr;
4679                 hdev->cmd_timeout = btusb_intel_cmd_timeout;
4680                 set_bit(HCI_QUIRK_STRICT_DUPLICATE_FILTER, &hdev->quirks);
4681                 set_bit(HCI_QUIRK_SIMULTANEOUS_DISCOVERY, &hdev->quirks);
4682                 set_bit(HCI_QUIRK_NON_PERSISTENT_DIAG, &hdev->quirks);
4683         }
4684
4685         if (id->driver_info & BTUSB_INTEL_NEW) {
4686                 hdev->manufacturer = 2;
4687                 hdev->send = btusb_send_frame_intel;
4688                 hdev->setup = btusb_setup_intel_new;
4689                 hdev->shutdown = btusb_shutdown_intel_new;
4690                 hdev->hw_error = btintel_hw_error;
4691                 hdev->set_diag = btintel_set_diag;
4692                 hdev->set_bdaddr = btintel_set_bdaddr;
4693                 hdev->cmd_timeout = btusb_intel_cmd_timeout;
4694                 set_bit(HCI_QUIRK_STRICT_DUPLICATE_FILTER, &hdev->quirks);
4695                 set_bit(HCI_QUIRK_SIMULTANEOUS_DISCOVERY, &hdev->quirks);
4696                 set_bit(HCI_QUIRK_NON_PERSISTENT_DIAG, &hdev->quirks);
4697         }
4698
4699         if (id->driver_info & BTUSB_INTEL_NEWGEN) {
4700                 hdev->manufacturer = 2;
4701                 hdev->send = btusb_send_frame_intel;
4702                 hdev->setup = btusb_setup_intel_newgen;
4703                 hdev->shutdown = btusb_shutdown_intel_new;
4704                 hdev->hw_error = btintel_hw_error;
4705                 hdev->set_diag = btintel_set_diag;
4706                 hdev->set_bdaddr = btintel_set_bdaddr;
4707                 hdev->cmd_timeout = btusb_intel_cmd_timeout;
4708                 set_bit(HCI_QUIRK_STRICT_DUPLICATE_FILTER, &hdev->quirks);
4709                 set_bit(HCI_QUIRK_SIMULTANEOUS_DISCOVERY, &hdev->quirks);
4710                 set_bit(HCI_QUIRK_NON_PERSISTENT_DIAG, &hdev->quirks);
4711
4712                 data->recv_event = btusb_recv_event_intel;
4713                 data->recv_bulk = btusb_recv_bulk_intel;
4714                 set_bit(BTUSB_BOOTLOADER, &data->flags);
4715         }
4716
4717         if (id->driver_info & BTUSB_MARVELL)
4718                 hdev->set_bdaddr = btusb_set_bdaddr_marvell;
4719
4720         if (IS_ENABLED(CONFIG_BT_HCIBTUSB_MTK) &&
4721             (id->driver_info & BTUSB_MEDIATEK)) {
4722                 hdev->setup = btusb_mtk_setup;
4723                 hdev->shutdown = btusb_mtk_shutdown;
4724                 hdev->manufacturer = 70;
4725                 set_bit(HCI_QUIRK_NON_PERSISTENT_SETUP, &hdev->quirks);
4726         }
4727
4728         if (id->driver_info & BTUSB_SWAVE) {
4729                 set_bit(HCI_QUIRK_FIXUP_INQUIRY_MODE, &hdev->quirks);
4730                 set_bit(HCI_QUIRK_BROKEN_LOCAL_COMMANDS, &hdev->quirks);
4731         }
4732
4733         if (id->driver_info & BTUSB_INTEL_BOOT) {
4734                 hdev->manufacturer = 2;
4735                 set_bit(HCI_QUIRK_RAW_DEVICE, &hdev->quirks);
4736         }
4737
4738         if (id->driver_info & BTUSB_ATH3012) {
4739                 data->setup_on_usb = btusb_setup_qca;
4740                 hdev->set_bdaddr = btusb_set_bdaddr_ath3012;
4741                 set_bit(HCI_QUIRK_SIMULTANEOUS_DISCOVERY, &hdev->quirks);
4742                 set_bit(HCI_QUIRK_STRICT_DUPLICATE_FILTER, &hdev->quirks);
4743         }
4744
4745         if (id->driver_info & BTUSB_QCA_ROME) {
4746                 data->setup_on_usb = btusb_setup_qca;
4747                 hdev->set_bdaddr = btusb_set_bdaddr_ath3012;
4748                 hdev->cmd_timeout = btusb_qca_cmd_timeout;
4749                 set_bit(HCI_QUIRK_SIMULTANEOUS_DISCOVERY, &hdev->quirks);
4750                 btusb_check_needs_reset_resume(intf);
4751         }
4752
4753         if (id->driver_info & BTUSB_QCA_WCN6855) {
4754                 data->setup_on_usb = btusb_setup_qca;
4755                 hdev->shutdown = btusb_shutdown_qca;
4756                 hdev->set_bdaddr = btusb_set_bdaddr_wcn6855;
4757                 hdev->cmd_timeout = btusb_qca_cmd_timeout;
4758                 set_bit(HCI_QUIRK_SIMULTANEOUS_DISCOVERY, &hdev->quirks);
4759         }
4760
4761         if (id->driver_info & BTUSB_AMP) {
4762                 /* AMP controllers do not support SCO packets */
4763                 data->isoc = NULL;
4764         } else {
4765                 /* Interface orders are hardcoded in the specification */
4766                 data->isoc = usb_ifnum_to_if(data->udev, ifnum_base + 1);
4767                 data->isoc_ifnum = ifnum_base + 1;
4768         }
4769
4770         if (IS_ENABLED(CONFIG_BT_HCIBTUSB_RTL) &&
4771             (id->driver_info & BTUSB_REALTEK)) {
4772                 hdev->setup = btrtl_setup_realtek;
4773                 hdev->shutdown = btrtl_shutdown_realtek;
4774                 hdev->cmd_timeout = btusb_rtl_cmd_timeout;
4775
4776                 /* Realtek devices lose their updated firmware over global
4777                  * suspend that means host doesn't send SET_FEATURE
4778                  * (DEVICE_REMOTE_WAKEUP)
4779                  */
4780                 set_bit(BTUSB_WAKEUP_DISABLE, &data->flags);
4781         }
4782
4783         if (!reset)
4784                 set_bit(HCI_QUIRK_RESET_ON_CLOSE, &hdev->quirks);
4785
4786         if (force_scofix || id->driver_info & BTUSB_WRONG_SCO_MTU) {
4787                 if (!disable_scofix)
4788                         set_bit(HCI_QUIRK_FIXUP_BUFFER_SIZE, &hdev->quirks);
4789         }
4790
4791         if (id->driver_info & BTUSB_BROKEN_ISOC)
4792                 data->isoc = NULL;
4793
4794         if (id->driver_info & BTUSB_WIDEBAND_SPEECH)
4795                 set_bit(HCI_QUIRK_WIDEBAND_SPEECH_SUPPORTED, &hdev->quirks);
4796
4797         if (id->driver_info & BTUSB_VALID_LE_STATES)
4798                 set_bit(HCI_QUIRK_VALID_LE_STATES, &hdev->quirks);
4799
4800         if (id->driver_info & BTUSB_DIGIANSWER) {
4801                 data->cmdreq_type = USB_TYPE_VENDOR;
4802                 set_bit(HCI_QUIRK_RESET_ON_CLOSE, &hdev->quirks);
4803         }
4804
4805         if (id->driver_info & BTUSB_CSR) {
4806                 struct usb_device *udev = data->udev;
4807                 u16 bcdDevice = le16_to_cpu(udev->descriptor.bcdDevice);
4808
4809                 /* Old firmware would otherwise execute USB reset */
4810                 if (bcdDevice < 0x117)
4811                         set_bit(HCI_QUIRK_RESET_ON_CLOSE, &hdev->quirks);
4812
4813                 /* This must be set first in case we disable it for fakes */
4814                 set_bit(HCI_QUIRK_SIMULTANEOUS_DISCOVERY, &hdev->quirks);
4815
4816                 /* Fake CSR devices with broken commands */
4817                 if (le16_to_cpu(udev->descriptor.idVendor)  == 0x0a12 &&
4818                     le16_to_cpu(udev->descriptor.idProduct) == 0x0001)
4819                         hdev->setup = btusb_setup_csr;
4820         }
4821
4822         if (id->driver_info & BTUSB_SNIFFER) {
4823                 struct usb_device *udev = data->udev;
4824
4825                 /* New sniffer firmware has crippled HCI interface */
4826                 if (le16_to_cpu(udev->descriptor.bcdDevice) > 0x997)
4827                         set_bit(HCI_QUIRK_RAW_DEVICE, &hdev->quirks);
4828         }
4829
4830         if (id->driver_info & BTUSB_INTEL_BOOT) {
4831                 /* A bug in the bootloader causes that interrupt interface is
4832                  * only enabled after receiving SetInterface(0, AltSetting=0).
4833                  */
4834                 err = usb_set_interface(data->udev, 0, 0);
4835                 if (err < 0) {
4836                         BT_ERR("failed to set interface 0, alt 0 %d", err);
4837                         goto out_free_dev;
4838                 }
4839         }
4840
4841         if (data->isoc) {
4842                 err = usb_driver_claim_interface(&btusb_driver,
4843                                                  data->isoc, data);
4844                 if (err < 0)
4845                         goto out_free_dev;
4846         }
4847
4848         if (IS_ENABLED(CONFIG_BT_HCIBTUSB_BCM) && data->diag) {
4849                 if (!usb_driver_claim_interface(&btusb_driver,
4850                                                 data->diag, data))
4851                         __set_diag_interface(hdev);
4852                 else
4853                         data->diag = NULL;
4854         }
4855
4856         if (!enable_autosuspend)
4857                 usb_disable_autosuspend(data->udev);
4858
4859         err = hci_register_dev(hdev);
4860         if (err < 0)
4861                 goto out_free_dev;
4862
4863         usb_set_intfdata(intf, data);
4864
4865         return 0;
4866
4867 out_free_dev:
4868         if (data->reset_gpio)
4869                 gpiod_put(data->reset_gpio);
4870         hci_free_dev(hdev);
4871         return err;
4872 }
4873
4874 static void btusb_disconnect(struct usb_interface *intf)
4875 {
4876         struct btusb_data *data = usb_get_intfdata(intf);
4877         struct hci_dev *hdev;
4878
4879         BT_DBG("intf %p", intf);
4880
4881         if (!data)
4882                 return;
4883
4884         hdev = data->hdev;
4885         usb_set_intfdata(data->intf, NULL);
4886
4887         if (data->isoc)
4888                 usb_set_intfdata(data->isoc, NULL);
4889
4890         if (data->diag)
4891                 usb_set_intfdata(data->diag, NULL);
4892
4893         hci_unregister_dev(hdev);
4894
4895         if (intf == data->intf) {
4896                 if (data->isoc)
4897                         usb_driver_release_interface(&btusb_driver, data->isoc);
4898                 if (data->diag)
4899                         usb_driver_release_interface(&btusb_driver, data->diag);
4900         } else if (intf == data->isoc) {
4901                 if (data->diag)
4902                         usb_driver_release_interface(&btusb_driver, data->diag);
4903                 usb_driver_release_interface(&btusb_driver, data->intf);
4904         } else if (intf == data->diag) {
4905                 usb_driver_release_interface(&btusb_driver, data->intf);
4906                 if (data->isoc)
4907                         usb_driver_release_interface(&btusb_driver, data->isoc);
4908         }
4909
4910         if (data->oob_wake_irq)
4911                 device_init_wakeup(&data->udev->dev, false);
4912
4913         if (data->reset_gpio)
4914                 gpiod_put(data->reset_gpio);
4915
4916         hci_free_dev(hdev);
4917
4918         if (!enable_autosuspend)
4919                 usb_enable_autosuspend(data->udev);
4920 }
4921
4922 #ifdef CONFIG_PM
4923 static int btusb_suspend(struct usb_interface *intf, pm_message_t message)
4924 {
4925         struct btusb_data *data = usb_get_intfdata(intf);
4926
4927         BT_DBG("intf %p", intf);
4928
4929         if (data->suspend_count++)
4930                 return 0;
4931
4932         spin_lock_irq(&data->txlock);
4933         if (!(PMSG_IS_AUTO(message) && data->tx_in_flight)) {
4934                 set_bit(BTUSB_SUSPENDING, &data->flags);
4935                 spin_unlock_irq(&data->txlock);
4936         } else {
4937                 spin_unlock_irq(&data->txlock);
4938                 data->suspend_count--;
4939                 return -EBUSY;
4940         }
4941
4942         cancel_work_sync(&data->work);
4943
4944         btusb_stop_traffic(data);
4945         usb_kill_anchored_urbs(&data->tx_anchor);
4946
4947         if (data->oob_wake_irq && device_may_wakeup(&data->udev->dev)) {
4948                 set_bit(BTUSB_OOB_WAKE_ENABLED, &data->flags);
4949                 enable_irq_wake(data->oob_wake_irq);
4950                 enable_irq(data->oob_wake_irq);
4951         }
4952
4953         /* For global suspend, Realtek devices lose the loaded fw
4954          * in them. But for autosuspend, firmware should remain.
4955          * Actually, it depends on whether the usb host sends
4956          * set feature (enable wakeup) or not.
4957          */
4958         if (test_bit(BTUSB_WAKEUP_DISABLE, &data->flags)) {
4959                 if (PMSG_IS_AUTO(message) &&
4960                     device_can_wakeup(&data->udev->dev))
4961                         data->udev->do_remote_wakeup = 1;
4962                 else if (!PMSG_IS_AUTO(message))
4963                         data->udev->reset_resume = 1;
4964         }
4965
4966         return 0;
4967 }
4968
4969 static void play_deferred(struct btusb_data *data)
4970 {
4971         struct urb *urb;
4972         int err;
4973
4974         while ((urb = usb_get_from_anchor(&data->deferred))) {
4975                 usb_anchor_urb(urb, &data->tx_anchor);
4976
4977                 err = usb_submit_urb(urb, GFP_ATOMIC);
4978                 if (err < 0) {
4979                         if (err != -EPERM && err != -ENODEV)
4980                                 BT_ERR("%s urb %p submission failed (%d)",
4981                                        data->hdev->name, urb, -err);
4982                         kfree(urb->setup_packet);
4983                         usb_unanchor_urb(urb);
4984                         usb_free_urb(urb);
4985                         break;
4986                 }
4987
4988                 data->tx_in_flight++;
4989                 usb_free_urb(urb);
4990         }
4991
4992         /* Cleanup the rest deferred urbs. */
4993         while ((urb = usb_get_from_anchor(&data->deferred))) {
4994                 kfree(urb->setup_packet);
4995                 usb_free_urb(urb);
4996         }
4997 }
4998
4999 static int btusb_resume(struct usb_interface *intf)
5000 {
5001         struct btusb_data *data = usb_get_intfdata(intf);
5002         struct hci_dev *hdev = data->hdev;
5003         int err = 0;
5004
5005         BT_DBG("intf %p", intf);
5006
5007         if (--data->suspend_count)
5008                 return 0;
5009
5010         /* Disable only if not already disabled (keep it balanced) */
5011         if (test_and_clear_bit(BTUSB_OOB_WAKE_ENABLED, &data->flags)) {
5012                 disable_irq(data->oob_wake_irq);
5013                 disable_irq_wake(data->oob_wake_irq);
5014         }
5015
5016         if (!test_bit(HCI_RUNNING, &hdev->flags))
5017                 goto done;
5018
5019         if (test_bit(BTUSB_INTR_RUNNING, &data->flags)) {
5020                 err = btusb_submit_intr_urb(hdev, GFP_NOIO);
5021                 if (err < 0) {
5022                         clear_bit(BTUSB_INTR_RUNNING, &data->flags);
5023                         goto failed;
5024                 }
5025         }
5026
5027         if (test_bit(BTUSB_BULK_RUNNING, &data->flags)) {
5028                 err = btusb_submit_bulk_urb(hdev, GFP_NOIO);
5029                 if (err < 0) {
5030                         clear_bit(BTUSB_BULK_RUNNING, &data->flags);
5031                         goto failed;
5032                 }
5033
5034                 btusb_submit_bulk_urb(hdev, GFP_NOIO);
5035         }
5036
5037         if (test_bit(BTUSB_ISOC_RUNNING, &data->flags)) {
5038                 if (btusb_submit_isoc_urb(hdev, GFP_NOIO) < 0)
5039                         clear_bit(BTUSB_ISOC_RUNNING, &data->flags);
5040                 else
5041                         btusb_submit_isoc_urb(hdev, GFP_NOIO);
5042         }
5043
5044         spin_lock_irq(&data->txlock);
5045         play_deferred(data);
5046         clear_bit(BTUSB_SUSPENDING, &data->flags);
5047         spin_unlock_irq(&data->txlock);
5048         schedule_work(&data->work);
5049
5050         return 0;
5051
5052 failed:
5053         usb_scuttle_anchored_urbs(&data->deferred);
5054 done:
5055         spin_lock_irq(&data->txlock);
5056         clear_bit(BTUSB_SUSPENDING, &data->flags);
5057         spin_unlock_irq(&data->txlock);
5058
5059         return err;
5060 }
5061 #endif
5062
5063 static struct usb_driver btusb_driver = {
5064         .name           = "btusb",
5065         .probe          = btusb_probe,
5066         .disconnect     = btusb_disconnect,
5067 #ifdef CONFIG_PM
5068         .suspend        = btusb_suspend,
5069         .resume         = btusb_resume,
5070 #endif
5071         .id_table       = btusb_table,
5072         .supports_autosuspend = 1,
5073         .disable_hub_initiated_lpm = 1,
5074 };
5075
5076 module_usb_driver(btusb_driver);
5077
5078 module_param(disable_scofix, bool, 0644);
5079 MODULE_PARM_DESC(disable_scofix, "Disable fixup of wrong SCO buffer size");
5080
5081 module_param(force_scofix, bool, 0644);
5082 MODULE_PARM_DESC(force_scofix, "Force fixup of wrong SCO buffers size");
5083
5084 module_param(enable_autosuspend, bool, 0644);
5085 MODULE_PARM_DESC(enable_autosuspend, "Enable USB autosuspend by default");
5086
5087 module_param(reset, bool, 0644);
5088 MODULE_PARM_DESC(reset, "Send HCI reset command on initialization");
5089
5090 MODULE_AUTHOR("Marcel Holtmann <marcel@holtmann.org>");
5091 MODULE_DESCRIPTION("Generic Bluetooth USB driver ver " VERSION);
5092 MODULE_VERSION(VERSION);
5093 MODULE_LICENSE("GPL");