drivers/bluetooth/btusb.c

   1 // SPDX-License-Identifier: GPL-2.0-or-later
   2 /*
   3  *
   4  *  Generic Bluetooth USB driver
   5  *
   6  *  Copyright (C) 2005-2008  Marcel Holtmann <marcel@holtmann.org>
   7  */
   8
   9 #include <linux/dmi.h>
  10 #include <linux/module.h>
  11 #include <linux/usb.h>
  12 #include <linux/usb/quirks.h>
  13 #include <linux/firmware.h>
  14 #include <linux/iopoll.h>
  15 #include <linux/of_device.h>
  16 #include <linux/of_irq.h>
  17 #include <linux/suspend.h>
  18 #include <linux/gpio/consumer.h>
  19 #include <linux/debugfs.h>
  20 #include <asm/unaligned.h>
  21
  22 #include <net/bluetooth/bluetooth.h>
  23 #include <net/bluetooth/hci_core.h>
  24
  25 #include "btintel.h"
  26 #include "btbcm.h"
  27 #include "btrtl.h"
  28 #include "btmtk.h"
  29
  30 #define VERSION "0.8"
  31
  32 static bool disable_scofix;
  33 static bool force_scofix;
  34 static bool enable_autosuspend = IS_ENABLED(CONFIG_BT_HCIBTUSB_AUTOSUSPEND);
  35 static bool enable_poll_sync = IS_ENABLED(CONFIG_BT_HCIBTUSB_POLL_SYNC);
  36 static bool reset = true;
  37
  38 static struct usb_driver btusb_driver;
  39
  40 #define BTUSB_IGNORE                    BIT(0)
  41 #define BTUSB_DIGIANSWER                BIT(1)
  42 #define BTUSB_CSR                       BIT(2)
  43 #define BTUSB_SNIFFER                   BIT(3)
  44 #define BTUSB_BCM92035                  BIT(4)
  45 #define BTUSB_BROKEN_ISOC               BIT(5)
  46 #define BTUSB_WRONG_SCO_MTU             BIT(6)
  47 #define BTUSB_ATH3012                   BIT(7)
  48 #define BTUSB_INTEL_COMBINED            BIT(8)
  49 #define BTUSB_INTEL_BOOT                BIT(9)
  50 #define BTUSB_BCM_PATCHRAM              BIT(10)
  51 #define BTUSB_MARVELL                   BIT(11)
  52 #define BTUSB_SWAVE                     BIT(12)
  53 #define BTUSB_AMP                       BIT(13)
  54 #define BTUSB_QCA_ROME                  BIT(14)
  55 #define BTUSB_BCM_APPLE                 BIT(15)
  56 #define BTUSB_REALTEK                   BIT(16)
  57 #define BTUSB_BCM2045                   BIT(17)
  58 #define BTUSB_IFNUM_2                   BIT(18)
  59 #define BTUSB_CW6622                    BIT(19)
  60 #define BTUSB_MEDIATEK                  BIT(20)
  61 #define BTUSB_WIDEBAND_SPEECH           BIT(21)
  62 #define BTUSB_VALID_LE_STATES           BIT(22)
  63 #define BTUSB_QCA_WCN6855               BIT(23)
  64 #define BTUSB_INTEL_BROKEN_SHUTDOWN_LED BIT(24)
  65 #define BTUSB_INTEL_BROKEN_INITIAL_NCMD BIT(25)
  66 #define BTUSB_INTEL_NO_WBS_SUPPORT      BIT(26)
  67 #define BTUSB_ACTIONS_SEMI              BIT(27)
  68
  69 static const struct usb_device_id btusb_table[] = {
  70         /* Generic Bluetooth USB device */
  71         { USB_DEVICE_INFO(0xe0, 0x01, 0x01) },
  72
  73         /* Generic Bluetooth AMP device */
  74         { USB_DEVICE_INFO(0xe0, 0x01, 0x04), .driver_info = BTUSB_AMP },
  75
  76         /* Generic Bluetooth USB interface */
  77         { USB_INTERFACE_INFO(0xe0, 0x01, 0x01) },
  78
  79         /* Apple-specific (Broadcom) devices */
  80         { USB_VENDOR_AND_INTERFACE_INFO(0x05ac, 0xff, 0x01, 0x01),
  81           .driver_info = BTUSB_BCM_APPLE | BTUSB_IFNUM_2 },
  82
  83         /* MediaTek MT76x0E */
  84         { USB_DEVICE(0x0e8d, 0x763f) },
  85
  86         /* Broadcom SoftSailing reporting vendor specific */
  87         { USB_DEVICE(0x0a5c, 0x21e1) },
  88
  89         /* Apple MacBookPro 7,1 */
  90         { USB_DEVICE(0x05ac, 0x8213) },
  91
  92         /* Apple iMac11,1 */
  93         { USB_DEVICE(0x05ac, 0x8215) },
  94
  95         /* Apple MacBookPro6,2 */
  96         { USB_DEVICE(0x05ac, 0x8218) },
  97
  98         /* Apple MacBookAir3,1, MacBookAir3,2 */
  99         { USB_DEVICE(0x05ac, 0x821b) },
 100
 101         /* Apple MacBookAir4,1 */
 102         { USB_DEVICE(0x05ac, 0x821f) },
 103
 104         /* Apple MacBookPro8,2 */
 105         { USB_DEVICE(0x05ac, 0x821a) },
 106
 107         /* Apple MacMini5,1 */
 108         { USB_DEVICE(0x05ac, 0x8281) },
 109
 110         /* AVM BlueFRITZ! USB v2.0 */
 111         { USB_DEVICE(0x057c, 0x3800), .driver_info = BTUSB_SWAVE },
 112
 113         /* Bluetooth Ultraport Module from IBM */
 114         { USB_DEVICE(0x04bf, 0x030a) },
 115
 116         /* ALPS Modules with non-standard id */
 117         { USB_DEVICE(0x044e, 0x3001) },
 118         { USB_DEVICE(0x044e, 0x3002) },
 119
 120         /* Ericsson with non-standard id */
 121         { USB_DEVICE(0x0bdb, 0x1002) },
 122
 123         /* Canyon CN-BTU1 with HID interfaces */
 124         { USB_DEVICE(0x0c10, 0x0000) },
 125
 126         /* Broadcom BCM20702B0 (Dynex/Insignia) */
 127         { USB_DEVICE(0x19ff, 0x0239), .driver_info = BTUSB_BCM_PATCHRAM },
 128
 129         /* Broadcom BCM43142A0 (Foxconn/Lenovo) */
 130         { USB_VENDOR_AND_INTERFACE_INFO(0x105b, 0xff, 0x01, 0x01),
 131           .driver_info = BTUSB_BCM_PATCHRAM },
 132
 133         /* Broadcom BCM920703 (HTC Vive) */
 134         { USB_VENDOR_AND_INTERFACE_INFO(0x0bb4, 0xff, 0x01, 0x01),
 135           .driver_info = BTUSB_BCM_PATCHRAM },
 136
 137         /* Foxconn - Hon Hai */
 138         { USB_VENDOR_AND_INTERFACE_INFO(0x0489, 0xff, 0x01, 0x01),
 139           .driver_info = BTUSB_BCM_PATCHRAM },
 140
 141         /* Lite-On Technology - Broadcom based */
 142         { USB_VENDOR_AND_INTERFACE_INFO(0x04ca, 0xff, 0x01, 0x01),
 143           .driver_info = BTUSB_BCM_PATCHRAM },
 144
 145         /* Broadcom devices with vendor specific id */
 146         { USB_VENDOR_AND_INTERFACE_INFO(0x0a5c, 0xff, 0x01, 0x01),
 147           .driver_info = BTUSB_BCM_PATCHRAM },
 148
 149         /* ASUSTek Computer - Broadcom based */
 150         { USB_VENDOR_AND_INTERFACE_INFO(0x0b05, 0xff, 0x01, 0x01),
 151           .driver_info = BTUSB_BCM_PATCHRAM },
 152
 153         /* Belkin F8065bf - Broadcom based */
 154         { USB_VENDOR_AND_INTERFACE_INFO(0x050d, 0xff, 0x01, 0x01),
 155           .driver_info = BTUSB_BCM_PATCHRAM },
 156
 157         /* IMC Networks - Broadcom based */
 158         { USB_VENDOR_AND_INTERFACE_INFO(0x13d3, 0xff, 0x01, 0x01),
 159           .driver_info = BTUSB_BCM_PATCHRAM },
 160
 161         /* Dell Computer - Broadcom based  */
 162         { USB_VENDOR_AND_INTERFACE_INFO(0x413c, 0xff, 0x01, 0x01),
 163           .driver_info = BTUSB_BCM_PATCHRAM },
 164
 165         /* Toshiba Corp - Broadcom based */
 166         { USB_VENDOR_AND_INTERFACE_INFO(0x0930, 0xff, 0x01, 0x01),
 167           .driver_info = BTUSB_BCM_PATCHRAM },
 168
 169         /* Intel Bluetooth USB Bootloader (RAM module) */
 170         { USB_DEVICE(0x8087, 0x0a5a),
 171           .driver_info = BTUSB_INTEL_BOOT | BTUSB_BROKEN_ISOC },
 172
 173         { }     /* Terminating entry */
 174 };
 175
 176 MODULE_DEVICE_TABLE(usb, btusb_table);
 177
 178 static const struct usb_device_id blacklist_table[] = {
 179         /* CSR BlueCore devices */
 180         { USB_DEVICE(0x0a12, 0x0001), .driver_info = BTUSB_CSR },
 181
 182         /* Broadcom BCM2033 without firmware */
 183         { USB_DEVICE(0x0a5c, 0x2033), .driver_info = BTUSB_IGNORE },
 184
 185         /* Broadcom BCM2045 devices */
 186         { USB_DEVICE(0x0a5c, 0x2045), .driver_info = BTUSB_BCM2045 },
 187
 188         /* Atheros 3011 with sflash firmware */
 189         { USB_DEVICE(0x0489, 0xe027), .driver_info = BTUSB_IGNORE },
 190         { USB_DEVICE(0x0489, 0xe03d), .driver_info = BTUSB_IGNORE },
 191         { USB_DEVICE(0x04f2, 0xaff1), .driver_info = BTUSB_IGNORE },
 192         { USB_DEVICE(0x0930, 0x0215), .driver_info = BTUSB_IGNORE },
 193         { USB_DEVICE(0x0cf3, 0x3002), .driver_info = BTUSB_IGNORE },
 194         { USB_DEVICE(0x0cf3, 0xe019), .driver_info = BTUSB_IGNORE },
 195         { USB_DEVICE(0x13d3, 0x3304), .driver_info = BTUSB_IGNORE },
 196
 197         /* Atheros AR9285 Malbec with sflash firmware */
 198         { USB_DEVICE(0x03f0, 0x311d), .driver_info = BTUSB_IGNORE },
 199
 200         /* Atheros 3012 with sflash firmware */
 201         { USB_DEVICE(0x0489, 0xe04d), .driver_info = BTUSB_ATH3012 },
 202         { USB_DEVICE(0x0489, 0xe04e), .driver_info = BTUSB_ATH3012 },
 203         { USB_DEVICE(0x0489, 0xe056), .driver_info = BTUSB_ATH3012 },
 204         { USB_DEVICE(0x0489, 0xe057), .driver_info = BTUSB_ATH3012 },
 205         { USB_DEVICE(0x0489, 0xe05f), .driver_info = BTUSB_ATH3012 },
 206         { USB_DEVICE(0x0489, 0xe076), .driver_info = BTUSB_ATH3012 },
 207         { USB_DEVICE(0x0489, 0xe078), .driver_info = BTUSB_ATH3012 },
 208         { USB_DEVICE(0x0489, 0xe095), .driver_info = BTUSB_ATH3012 },
 209         { USB_DEVICE(0x04c5, 0x1330), .driver_info = BTUSB_ATH3012 },
 210         { USB_DEVICE(0x04ca, 0x3004), .driver_info = BTUSB_ATH3012 },
 211         { USB_DEVICE(0x04ca, 0x3005), .driver_info = BTUSB_ATH3012 },
 212         { USB_DEVICE(0x04ca, 0x3006), .driver_info = BTUSB_ATH3012 },
 213         { USB_DEVICE(0x04ca, 0x3007), .driver_info = BTUSB_ATH3012 },
 214         { USB_DEVICE(0x04ca, 0x3008), .driver_info = BTUSB_ATH3012 },
 215         { USB_DEVICE(0x04ca, 0x300b), .driver_info = BTUSB_ATH3012 },
 216         { USB_DEVICE(0x04ca, 0x300d), .driver_info = BTUSB_ATH3012 },
 217         { USB_DEVICE(0x04ca, 0x300f), .driver_info = BTUSB_ATH3012 },
 218         { USB_DEVICE(0x04ca, 0x3010), .driver_info = BTUSB_ATH3012 },
 219         { USB_DEVICE(0x04ca, 0x3014), .driver_info = BTUSB_ATH3012 },
 220         { USB_DEVICE(0x04ca, 0x3018), .driver_info = BTUSB_ATH3012 },
 221         { USB_DEVICE(0x0930, 0x0219), .driver_info = BTUSB_ATH3012 },
 222         { USB_DEVICE(0x0930, 0x021c), .driver_info = BTUSB_ATH3012 },
 223         { USB_DEVICE(0x0930, 0x0220), .driver_info = BTUSB_ATH3012 },
 224         { USB_DEVICE(0x0930, 0x0227), .driver_info = BTUSB_ATH3012 },
 225         { USB_DEVICE(0x0b05, 0x17d0), .driver_info = BTUSB_ATH3012 },
 226         { USB_DEVICE(0x0cf3, 0x0036), .driver_info = BTUSB_ATH3012 },
 227         { USB_DEVICE(0x0cf3, 0x3004), .driver_info = BTUSB_ATH3012 },
 228         { USB_DEVICE(0x0cf3, 0x3008), .driver_info = BTUSB_ATH3012 },
 229         { USB_DEVICE(0x0cf3, 0x311d), .driver_info = BTUSB_ATH3012 },
 230         { USB_DEVICE(0x0cf3, 0x311e), .driver_info = BTUSB_ATH3012 },
 231         { USB_DEVICE(0x0cf3, 0x311f), .driver_info = BTUSB_ATH3012 },
 232         { USB_DEVICE(0x0cf3, 0x3121), .driver_info = BTUSB_ATH3012 },
 233         { USB_DEVICE(0x0cf3, 0x817a), .driver_info = BTUSB_ATH3012 },
 234         { USB_DEVICE(0x0cf3, 0x817b), .driver_info = BTUSB_ATH3012 },
 235         { USB_DEVICE(0x0cf3, 0xe003), .driver_info = BTUSB_ATH3012 },
 236         { USB_DEVICE(0x0cf3, 0xe004), .driver_info = BTUSB_ATH3012 },
 237         { USB_DEVICE(0x0cf3, 0xe005), .driver_info = BTUSB_ATH3012 },
 238         { USB_DEVICE(0x0cf3, 0xe006), .driver_info = BTUSB_ATH3012 },
 239         { USB_DEVICE(0x13d3, 0x3362), .driver_info = BTUSB_ATH3012 },
 240         { USB_DEVICE(0x13d3, 0x3375), .driver_info = BTUSB_ATH3012 },
 241         { USB_DEVICE(0x13d3, 0x3393), .driver_info = BTUSB_ATH3012 },
 242         { USB_DEVICE(0x13d3, 0x3395), .driver_info = BTUSB_ATH3012 },
 243         { USB_DEVICE(0x13d3, 0x3402), .driver_info = BTUSB_ATH3012 },
 244         { USB_DEVICE(0x13d3, 0x3408), .driver_info = BTUSB_ATH3012 },
 245         { USB_DEVICE(0x13d3, 0x3423), .driver_info = BTUSB_ATH3012 },
 246         { USB_DEVICE(0x13d3, 0x3432), .driver_info = BTUSB_ATH3012 },
 247         { USB_DEVICE(0x13d3, 0x3472), .driver_info = BTUSB_ATH3012 },
 248         { USB_DEVICE(0x13d3, 0x3474), .driver_info = BTUSB_ATH3012 },
 249         { USB_DEVICE(0x13d3, 0x3487), .driver_info = BTUSB_ATH3012 },
 250         { USB_DEVICE(0x13d3, 0x3490), .driver_info = BTUSB_ATH3012 },
 251
 252         /* Atheros AR5BBU12 with sflash firmware */
 253         { USB_DEVICE(0x0489, 0xe02c), .driver_info = BTUSB_IGNORE },
 254
 255         /* Atheros AR5BBU12 with sflash firmware */
 256         { USB_DEVICE(0x0489, 0xe036), .driver_info = BTUSB_ATH3012 },
 257         { USB_DEVICE(0x0489, 0xe03c), .driver_info = BTUSB_ATH3012 },
 258
 259         /* QCA ROME chipset */
 260         { USB_DEVICE(0x0cf3, 0x535b), .driver_info = BTUSB_QCA_ROME |
 261                                                      BTUSB_WIDEBAND_SPEECH },
 262         { USB_DEVICE(0x0cf3, 0xe007), .driver_info = BTUSB_QCA_ROME |
 263                                                      BTUSB_WIDEBAND_SPEECH },
 264         { USB_DEVICE(0x0cf3, 0xe009), .driver_info = BTUSB_QCA_ROME |
 265                                                      BTUSB_WIDEBAND_SPEECH },
 266         { USB_DEVICE(0x0cf3, 0xe010), .driver_info = BTUSB_QCA_ROME |
 267                                                      BTUSB_WIDEBAND_SPEECH },
 268         { USB_DEVICE(0x0cf3, 0xe300), .driver_info = BTUSB_QCA_ROME |
 269                                                      BTUSB_WIDEBAND_SPEECH },
 270         { USB_DEVICE(0x0cf3, 0xe301), .driver_info = BTUSB_QCA_ROME |
 271                                                      BTUSB_WIDEBAND_SPEECH },
 272         { USB_DEVICE(0x0cf3, 0xe360), .driver_info = BTUSB_QCA_ROME |
 273                                                      BTUSB_WIDEBAND_SPEECH },
 274         { USB_DEVICE(0x0cf3, 0xe500), .driver_info = BTUSB_QCA_ROME |
 275                                                      BTUSB_WIDEBAND_SPEECH },
 276         { USB_DEVICE(0x0489, 0xe092), .driver_info = BTUSB_QCA_ROME |
 277                                                      BTUSB_WIDEBAND_SPEECH },
 278         { USB_DEVICE(0x0489, 0xe09f), .driver_info = BTUSB_QCA_ROME |
 279                                                      BTUSB_WIDEBAND_SPEECH },
 280         { USB_DEVICE(0x0489, 0xe0a2), .driver_info = BTUSB_QCA_ROME |
 281                                                      BTUSB_WIDEBAND_SPEECH },
 282         { USB_DEVICE(0x04ca, 0x3011), .driver_info = BTUSB_QCA_ROME |
 283                                                      BTUSB_WIDEBAND_SPEECH },
 284         { USB_DEVICE(0x04ca, 0x3015), .driver_info = BTUSB_QCA_ROME |
 285                                                      BTUSB_WIDEBAND_SPEECH },
 286         { USB_DEVICE(0x04ca, 0x3016), .driver_info = BTUSB_QCA_ROME |
 287                                                      BTUSB_WIDEBAND_SPEECH },
 288         { USB_DEVICE(0x04ca, 0x301a), .driver_info = BTUSB_QCA_ROME |
 289                                                      BTUSB_WIDEBAND_SPEECH },
 290         { USB_DEVICE(0x04ca, 0x3021), .driver_info = BTUSB_QCA_ROME |
 291                                                      BTUSB_WIDEBAND_SPEECH },
 292         { USB_DEVICE(0x13d3, 0x3491), .driver_info = BTUSB_QCA_ROME |
 293                                                      BTUSB_WIDEBAND_SPEECH },
 294         { USB_DEVICE(0x13d3, 0x3496), .driver_info = BTUSB_QCA_ROME |
 295                                                      BTUSB_WIDEBAND_SPEECH },
 296         { USB_DEVICE(0x13d3, 0x3501), .driver_info = BTUSB_QCA_ROME |
 297                                                      BTUSB_WIDEBAND_SPEECH },
 298
 299         /* QCA WCN6855 chipset */
 300         { USB_DEVICE(0x0cf3, 0xe600), .driver_info = BTUSB_QCA_WCN6855 |
 301                                                      BTUSB_WIDEBAND_SPEECH |
 302                                                      BTUSB_VALID_LE_STATES },
 303         { USB_DEVICE(0x0489, 0xe0cc), .driver_info = BTUSB_QCA_WCN6855 |
 304                                                      BTUSB_WIDEBAND_SPEECH |
 305                                                      BTUSB_VALID_LE_STATES },
 306         { USB_DEVICE(0x0489, 0xe0d6), .driver_info = BTUSB_QCA_WCN6855 |
 307                                                      BTUSB_WIDEBAND_SPEECH |
 308                                                      BTUSB_VALID_LE_STATES },
 309         { USB_DEVICE(0x0489, 0xe0e3), .driver_info = BTUSB_QCA_WCN6855 |
 310                                                      BTUSB_WIDEBAND_SPEECH |
 311                                                      BTUSB_VALID_LE_STATES },
 312         { USB_DEVICE(0x10ab, 0x9309), .driver_info = BTUSB_QCA_WCN6855 |
 313                                                      BTUSB_WIDEBAND_SPEECH |
 314                                                      BTUSB_VALID_LE_STATES },
 315         { USB_DEVICE(0x10ab, 0x9409), .driver_info = BTUSB_QCA_WCN6855 |
 316                                                      BTUSB_WIDEBAND_SPEECH |
 317                                                      BTUSB_VALID_LE_STATES },
 318         { USB_DEVICE(0x0489, 0xe0d0), .driver_info = BTUSB_QCA_WCN6855 |
 319                                                      BTUSB_WIDEBAND_SPEECH |
 320                                                      BTUSB_VALID_LE_STATES },
 321         { USB_DEVICE(0x10ab, 0x9108), .driver_info = BTUSB_QCA_WCN6855 |
 322                                                      BTUSB_WIDEBAND_SPEECH |
 323                                                      BTUSB_VALID_LE_STATES },
 324         { USB_DEVICE(0x10ab, 0x9109), .driver_info = BTUSB_QCA_WCN6855 |
 325                                                      BTUSB_WIDEBAND_SPEECH |
 326                                                      BTUSB_VALID_LE_STATES },
 327         { USB_DEVICE(0x10ab, 0x9208), .driver_info = BTUSB_QCA_WCN6855 |
 328                                                      BTUSB_WIDEBAND_SPEECH |
 329                                                      BTUSB_VALID_LE_STATES },
 330         { USB_DEVICE(0x10ab, 0x9209), .driver_info = BTUSB_QCA_WCN6855 |
 331                                                      BTUSB_WIDEBAND_SPEECH |
 332                                                      BTUSB_VALID_LE_STATES },
 333         { USB_DEVICE(0x10ab, 0x9308), .driver_info = BTUSB_QCA_WCN6855 |
 334                                                      BTUSB_WIDEBAND_SPEECH |
 335                                                      BTUSB_VALID_LE_STATES },
 336         { USB_DEVICE(0x10ab, 0x9408), .driver_info = BTUSB_QCA_WCN6855 |
 337                                                      BTUSB_WIDEBAND_SPEECH |
 338                                                      BTUSB_VALID_LE_STATES },
 339         { USB_DEVICE(0x10ab, 0x9508), .driver_info = BTUSB_QCA_WCN6855 |
 340                                                      BTUSB_WIDEBAND_SPEECH |
 341                                                      BTUSB_VALID_LE_STATES },
 342         { USB_DEVICE(0x10ab, 0x9509), .driver_info = BTUSB_QCA_WCN6855 |
 343                                                      BTUSB_WIDEBAND_SPEECH |
 344                                                      BTUSB_VALID_LE_STATES },
 345         { USB_DEVICE(0x10ab, 0x9608), .driver_info = BTUSB_QCA_WCN6855 |
 346                                                      BTUSB_WIDEBAND_SPEECH |
 347                                                      BTUSB_VALID_LE_STATES },
 348         { USB_DEVICE(0x10ab, 0x9609), .driver_info = BTUSB_QCA_WCN6855 |
 349                                                      BTUSB_WIDEBAND_SPEECH |
 350                                                      BTUSB_VALID_LE_STATES },
 351         { USB_DEVICE(0x10ab, 0x9f09), .driver_info = BTUSB_QCA_WCN6855 |
 352                                                      BTUSB_WIDEBAND_SPEECH |
 353                                                      BTUSB_VALID_LE_STATES },
 354         { USB_DEVICE(0x04ca, 0x3022), .driver_info = BTUSB_QCA_WCN6855 |
 355                                                      BTUSB_WIDEBAND_SPEECH |
 356                                                      BTUSB_VALID_LE_STATES },
 357         { USB_DEVICE(0x0489, 0xe0c7), .driver_info = BTUSB_QCA_WCN6855 |
 358                                                      BTUSB_WIDEBAND_SPEECH |
 359                                                      BTUSB_VALID_LE_STATES },
 360         { USB_DEVICE(0x0489, 0xe0c9), .driver_info = BTUSB_QCA_WCN6855 |
 361                                                      BTUSB_WIDEBAND_SPEECH |
 362                                                      BTUSB_VALID_LE_STATES },
 363         { USB_DEVICE(0x0489, 0xe0ca), .driver_info = BTUSB_QCA_WCN6855 |
 364                                                      BTUSB_WIDEBAND_SPEECH |
 365                                                      BTUSB_VALID_LE_STATES },
 366         { USB_DEVICE(0x0489, 0xe0cb), .driver_info = BTUSB_QCA_WCN6855 |
 367                                                      BTUSB_WIDEBAND_SPEECH |
 368                                                      BTUSB_VALID_LE_STATES },
 369         { USB_DEVICE(0x0489, 0xe0ce), .driver_info = BTUSB_QCA_WCN6855 |
 370                                                      BTUSB_WIDEBAND_SPEECH |
 371                                                      BTUSB_VALID_LE_STATES },
 372         { USB_DEVICE(0x0489, 0xe0de), .driver_info = BTUSB_QCA_WCN6855 |
 373                                                      BTUSB_WIDEBAND_SPEECH |
 374                                                      BTUSB_VALID_LE_STATES },
 375         { USB_DEVICE(0x0489, 0xe0df), .driver_info = BTUSB_QCA_WCN6855 |
 376                                                      BTUSB_WIDEBAND_SPEECH |
 377                                                      BTUSB_VALID_LE_STATES },
 378         { USB_DEVICE(0x0489, 0xe0e1), .driver_info = BTUSB_QCA_WCN6855 |
 379                                                      BTUSB_WIDEBAND_SPEECH |
 380                                                      BTUSB_VALID_LE_STATES },
 381         { USB_DEVICE(0x0489, 0xe0ea), .driver_info = BTUSB_QCA_WCN6855 |
 382                                                      BTUSB_WIDEBAND_SPEECH |
 383                                                      BTUSB_VALID_LE_STATES },
 384         { USB_DEVICE(0x0489, 0xe0ec), .driver_info = BTUSB_QCA_WCN6855 |
 385                                                      BTUSB_WIDEBAND_SPEECH |
 386                                                      BTUSB_VALID_LE_STATES },
 387         { USB_DEVICE(0x04ca, 0x3023), .driver_info = BTUSB_QCA_WCN6855 |
 388                                                      BTUSB_WIDEBAND_SPEECH |
 389                                                      BTUSB_VALID_LE_STATES },
 390         { USB_DEVICE(0x04ca, 0x3024), .driver_info = BTUSB_QCA_WCN6855 |
 391                                                      BTUSB_WIDEBAND_SPEECH |
 392                                                      BTUSB_VALID_LE_STATES },
 393         { USB_DEVICE(0x04ca, 0x3a22), .driver_info = BTUSB_QCA_WCN6855 |
 394                                                      BTUSB_WIDEBAND_SPEECH |
 395                                                      BTUSB_VALID_LE_STATES },
 396         { USB_DEVICE(0x04ca, 0x3a24), .driver_info = BTUSB_QCA_WCN6855 |
 397                                                      BTUSB_WIDEBAND_SPEECH |
 398                                                      BTUSB_VALID_LE_STATES },
 399         { USB_DEVICE(0x04ca, 0x3a26), .driver_info = BTUSB_QCA_WCN6855 |
 400                                                      BTUSB_WIDEBAND_SPEECH |
 401                                                      BTUSB_VALID_LE_STATES },
 402         { USB_DEVICE(0x04ca, 0x3a27), .driver_info = BTUSB_QCA_WCN6855 |
 403                                                      BTUSB_WIDEBAND_SPEECH |
 404                                                      BTUSB_VALID_LE_STATES },
 405
 406         /* QCA WCN785x chipset */
 407         { USB_DEVICE(0x0cf3, 0xe700), .driver_info = BTUSB_QCA_WCN6855 |
 408                                                      BTUSB_WIDEBAND_SPEECH |
 409                                                      BTUSB_VALID_LE_STATES },
 410
 411         /* Broadcom BCM2035 */
 412         { USB_DEVICE(0x0a5c, 0x2009), .driver_info = BTUSB_BCM92035 },
 413         { USB_DEVICE(0x0a5c, 0x200a), .driver_info = BTUSB_WRONG_SCO_MTU },
 414         { USB_DEVICE(0x0a5c, 0x2035), .driver_info = BTUSB_WRONG_SCO_MTU },
 415
 416         /* Broadcom BCM2045 */
 417         { USB_DEVICE(0x0a5c, 0x2039), .driver_info = BTUSB_WRONG_SCO_MTU },
 418         { USB_DEVICE(0x0a5c, 0x2101), .driver_info = BTUSB_WRONG_SCO_MTU },
 419
 420         /* IBM/Lenovo ThinkPad with Broadcom chip */
 421         { USB_DEVICE(0x0a5c, 0x201e), .driver_info = BTUSB_WRONG_SCO_MTU },
 422         { USB_DEVICE(0x0a5c, 0x2110), .driver_info = BTUSB_WRONG_SCO_MTU },
 423
 424         /* HP laptop with Broadcom chip */
 425         { USB_DEVICE(0x03f0, 0x171d), .driver_info = BTUSB_WRONG_SCO_MTU },
 426
 427         /* Dell laptop with Broadcom chip */
 428         { USB_DEVICE(0x413c, 0x8126), .driver_info = BTUSB_WRONG_SCO_MTU },
 429
 430         /* Dell Wireless 370 and 410 devices */
 431         { USB_DEVICE(0x413c, 0x8152), .driver_info = BTUSB_WRONG_SCO_MTU },
 432         { USB_DEVICE(0x413c, 0x8156), .driver_info = BTUSB_WRONG_SCO_MTU },
 433
 434         /* Belkin F8T012 and F8T013 devices */
 435         { USB_DEVICE(0x050d, 0x0012), .driver_info = BTUSB_WRONG_SCO_MTU },
 436         { USB_DEVICE(0x050d, 0x0013), .driver_info = BTUSB_WRONG_SCO_MTU },
 437
 438         /* Asus WL-BTD202 device */
 439         { USB_DEVICE(0x0b05, 0x1715), .driver_info = BTUSB_WRONG_SCO_MTU },
 440
 441         /* Kensington Bluetooth USB adapter */
 442         { USB_DEVICE(0x047d, 0x105e), .driver_info = BTUSB_WRONG_SCO_MTU },
 443
 444         /* RTX Telecom based adapters with buggy SCO support */
 445         { USB_DEVICE(0x0400, 0x0807), .driver_info = BTUSB_BROKEN_ISOC },
 446         { USB_DEVICE(0x0400, 0x080a), .driver_info = BTUSB_BROKEN_ISOC },
 447
 448         /* CONWISE Technology based adapters with buggy SCO support */
 449         { USB_DEVICE(0x0e5e, 0x6622),
 450           .driver_info = BTUSB_BROKEN_ISOC | BTUSB_CW6622},
 451
 452         /* Roper Class 1 Bluetooth Dongle (Silicon Wave based) */
 453         { USB_DEVICE(0x1310, 0x0001), .driver_info = BTUSB_SWAVE },
 454
 455         /* Digianswer devices */
 456         { USB_DEVICE(0x08fd, 0x0001), .driver_info = BTUSB_DIGIANSWER },
 457         { USB_DEVICE(0x08fd, 0x0002), .driver_info = BTUSB_IGNORE },
 458
 459         /* CSR BlueCore Bluetooth Sniffer */
 460         { USB_DEVICE(0x0a12, 0x0002),
 461           .driver_info = BTUSB_SNIFFER | BTUSB_BROKEN_ISOC },
 462
 463         /* Frontline ComProbe Bluetooth Sniffer */
 464         { USB_DEVICE(0x16d3, 0x0002),
 465           .driver_info = BTUSB_SNIFFER | BTUSB_BROKEN_ISOC },
 466
 467         /* Marvell Bluetooth devices */
 468         { USB_DEVICE(0x1286, 0x2044), .driver_info = BTUSB_MARVELL },
 469         { USB_DEVICE(0x1286, 0x2046), .driver_info = BTUSB_MARVELL },
 470         { USB_DEVICE(0x1286, 0x204e), .driver_info = BTUSB_MARVELL },
 471
 472         /* Intel Bluetooth devices */
 473         { USB_DEVICE(0x8087, 0x0025), .driver_info = BTUSB_INTEL_COMBINED },
 474         { USB_DEVICE(0x8087, 0x0026), .driver_info = BTUSB_INTEL_COMBINED },
 475         { USB_DEVICE(0x8087, 0x0029), .driver_info = BTUSB_INTEL_COMBINED },
 476         { USB_DEVICE(0x8087, 0x0032), .driver_info = BTUSB_INTEL_COMBINED },
 477         { USB_DEVICE(0x8087, 0x0033), .driver_info = BTUSB_INTEL_COMBINED },
 478         { USB_DEVICE(0x8087, 0x0035), .driver_info = BTUSB_INTEL_COMBINED },
 479         { USB_DEVICE(0x8087, 0x0036), .driver_info = BTUSB_INTEL_COMBINED },
 480         { USB_DEVICE(0x8087, 0x07da), .driver_info = BTUSB_CSR },
 481         { USB_DEVICE(0x8087, 0x07dc), .driver_info = BTUSB_INTEL_COMBINED |
 482                                                      BTUSB_INTEL_NO_WBS_SUPPORT |
 483                                                      BTUSB_INTEL_BROKEN_INITIAL_NCMD |
 484                                                      BTUSB_INTEL_BROKEN_SHUTDOWN_LED },
 485         { USB_DEVICE(0x8087, 0x0a2a), .driver_info = BTUSB_INTEL_COMBINED |
 486                                                      BTUSB_INTEL_NO_WBS_SUPPORT |
 487                                                      BTUSB_INTEL_BROKEN_SHUTDOWN_LED },
 488         { USB_DEVICE(0x8087, 0x0a2b), .driver_info = BTUSB_INTEL_COMBINED },
 489         { USB_DEVICE(0x8087, 0x0aa7), .driver_info = BTUSB_INTEL_COMBINED |
 490                                                      BTUSB_INTEL_BROKEN_SHUTDOWN_LED },
 491         { USB_DEVICE(0x8087, 0x0aaa), .driver_info = BTUSB_INTEL_COMBINED },
 492
 493         /* Other Intel Bluetooth devices */
 494         { USB_VENDOR_AND_INTERFACE_INFO(0x8087, 0xe0, 0x01, 0x01),
 495           .driver_info = BTUSB_IGNORE },
 496
 497         /* Realtek 8821CE Bluetooth devices */
 498         { USB_DEVICE(0x13d3, 0x3529), .driver_info = BTUSB_REALTEK |
 499                                                      BTUSB_WIDEBAND_SPEECH },
 500
 501         /* Realtek 8822CE Bluetooth devices */
 502         { USB_DEVICE(0x0bda, 0xb00c), .driver_info = BTUSB_REALTEK |
 503                                                      BTUSB_WIDEBAND_SPEECH },
 504         { USB_DEVICE(0x0bda, 0xc822), .driver_info = BTUSB_REALTEK |
 505                                                      BTUSB_WIDEBAND_SPEECH },
 506
 507         /* Realtek 8822CU Bluetooth devices */
 508         { USB_DEVICE(0x13d3, 0x3549), .driver_info = BTUSB_REALTEK |
 509                                                      BTUSB_WIDEBAND_SPEECH },
 510
 511         /* Realtek 8852AE Bluetooth devices */
 512         { USB_DEVICE(0x0bda, 0x2852), .driver_info = BTUSB_REALTEK |
 513                                                      BTUSB_WIDEBAND_SPEECH },
 514         { USB_DEVICE(0x0bda, 0xc852), .driver_info = BTUSB_REALTEK |
 515                                                      BTUSB_WIDEBAND_SPEECH },
 516         { USB_DEVICE(0x0bda, 0x385a), .driver_info = BTUSB_REALTEK |
 517                                                      BTUSB_WIDEBAND_SPEECH },
 518         { USB_DEVICE(0x0bda, 0x4852), .driver_info = BTUSB_REALTEK |
 519                                                      BTUSB_WIDEBAND_SPEECH },
 520         { USB_DEVICE(0x04c5, 0x165c), .driver_info = BTUSB_REALTEK |
 521                                                      BTUSB_WIDEBAND_SPEECH },
 522         { USB_DEVICE(0x04ca, 0x4006), .driver_info = BTUSB_REALTEK |
 523                                                      BTUSB_WIDEBAND_SPEECH },
 524         { USB_DEVICE(0x0cb8, 0xc549), .driver_info = BTUSB_REALTEK |
 525                                                      BTUSB_WIDEBAND_SPEECH },
 526
 527         /* Realtek 8852CE Bluetooth devices */
 528         { USB_DEVICE(0x04ca, 0x4007), .driver_info = BTUSB_REALTEK |
 529                                                      BTUSB_WIDEBAND_SPEECH },
 530         { USB_DEVICE(0x04c5, 0x1675), .driver_info = BTUSB_REALTEK |
 531                                                      BTUSB_WIDEBAND_SPEECH },
 532         { USB_DEVICE(0x0cb8, 0xc558), .driver_info = BTUSB_REALTEK |
 533                                                      BTUSB_WIDEBAND_SPEECH },
 534         { USB_DEVICE(0x13d3, 0x3587), .driver_info = BTUSB_REALTEK |
 535                                                      BTUSB_WIDEBAND_SPEECH },
 536         { USB_DEVICE(0x13d3, 0x3586), .driver_info = BTUSB_REALTEK |
 537                                                      BTUSB_WIDEBAND_SPEECH },
 538         { USB_DEVICE(0x13d3, 0x3592), .driver_info = BTUSB_REALTEK |
 539                                                      BTUSB_WIDEBAND_SPEECH },
 540
 541         /* Realtek 8852BE Bluetooth devices */
 542         { USB_DEVICE(0x0cb8, 0xc559), .driver_info = BTUSB_REALTEK |
 543                                                      BTUSB_WIDEBAND_SPEECH },
 544         { USB_DEVICE(0x0bda, 0x887b), .driver_info = BTUSB_REALTEK |
 545                                                      BTUSB_WIDEBAND_SPEECH },
 546         { USB_DEVICE(0x13d3, 0x3571), .driver_info = BTUSB_REALTEK |
 547                                                      BTUSB_WIDEBAND_SPEECH },
 548
 549         /* Realtek Bluetooth devices */
 550         { USB_VENDOR_AND_INTERFACE_INFO(0x0bda, 0xe0, 0x01, 0x01),
 551           .driver_info = BTUSB_REALTEK },
 552
 553         /* MediaTek Bluetooth devices */
 554         { USB_VENDOR_AND_INTERFACE_INFO(0x0e8d, 0xe0, 0x01, 0x01),
 555           .driver_info = BTUSB_MEDIATEK |
 556                          BTUSB_WIDEBAND_SPEECH |
 557                          BTUSB_VALID_LE_STATES },
 558
 559         /* Additional MediaTek MT7615E Bluetooth devices */
 560         { USB_DEVICE(0x13d3, 0x3560), .driver_info = BTUSB_MEDIATEK},
 561
 562         /* Additional MediaTek MT7663 Bluetooth devices */
 563         { USB_DEVICE(0x043e, 0x310c), .driver_info = BTUSB_MEDIATEK |
 564                                                      BTUSB_WIDEBAND_SPEECH |
 565                                                      BTUSB_VALID_LE_STATES },
 566         { USB_DEVICE(0x04ca, 0x3801), .driver_info = BTUSB_MEDIATEK |
 567                                                      BTUSB_WIDEBAND_SPEECH |
 568                                                      BTUSB_VALID_LE_STATES },
 569
 570         /* Additional MediaTek MT7668 Bluetooth devices */
 571         { USB_DEVICE(0x043e, 0x3109), .driver_info = BTUSB_MEDIATEK |
 572                                                      BTUSB_WIDEBAND_SPEECH |
 573                                                      BTUSB_VALID_LE_STATES },
 574
 575         /* Additional MediaTek MT7921 Bluetooth devices */
 576         { USB_DEVICE(0x0489, 0xe0c8), .driver_info = BTUSB_MEDIATEK |
 577                                                      BTUSB_WIDEBAND_SPEECH |
 578                                                      BTUSB_VALID_LE_STATES },
 579         { USB_DEVICE(0x0489, 0xe0e0), .driver_info = BTUSB_MEDIATEK |
 580                                                      BTUSB_WIDEBAND_SPEECH |
 581                                                      BTUSB_VALID_LE_STATES },
 582         { USB_DEVICE(0x0489, 0xe0f2), .driver_info = BTUSB_MEDIATEK |
 583                                                      BTUSB_WIDEBAND_SPEECH |
 584                                                      BTUSB_VALID_LE_STATES },
 585         { USB_DEVICE(0x04ca, 0x3802), .driver_info = BTUSB_MEDIATEK |
 586                                                      BTUSB_WIDEBAND_SPEECH |
 587                                                      BTUSB_VALID_LE_STATES },
 588         { USB_DEVICE(0x13d3, 0x3563), .driver_info = BTUSB_MEDIATEK |
 589                                                      BTUSB_WIDEBAND_SPEECH |
 590                                                      BTUSB_VALID_LE_STATES },
 591         { USB_DEVICE(0x13d3, 0x3564), .driver_info = BTUSB_MEDIATEK |
 592                                                      BTUSB_WIDEBAND_SPEECH |
 593                                                      BTUSB_VALID_LE_STATES },
 594         { USB_DEVICE(0x13d3, 0x3567), .driver_info = BTUSB_MEDIATEK |
 595                                                      BTUSB_WIDEBAND_SPEECH |
 596                                                      BTUSB_VALID_LE_STATES },
 597         { USB_DEVICE(0x13d3, 0x3578), .driver_info = BTUSB_MEDIATEK |
 598                                                      BTUSB_WIDEBAND_SPEECH |
 599                                                      BTUSB_VALID_LE_STATES },
 600         { USB_DEVICE(0x13d3, 0x3583), .driver_info = BTUSB_MEDIATEK |
 601                                                      BTUSB_WIDEBAND_SPEECH |
 602                                                      BTUSB_VALID_LE_STATES },
 603         { USB_DEVICE(0x0489, 0xe0cd), .driver_info = BTUSB_MEDIATEK |
 604                                                      BTUSB_WIDEBAND_SPEECH |
 605                                                      BTUSB_VALID_LE_STATES },
 606         { USB_DEVICE(0x0e8d, 0x0608), .driver_info = BTUSB_MEDIATEK |
 607                                                      BTUSB_WIDEBAND_SPEECH |
 608                                                      BTUSB_VALID_LE_STATES },
 609
 610         /* MediaTek MT7922A Bluetooth devices */
 611         { USB_DEVICE(0x0489, 0xe0d8), .driver_info = BTUSB_MEDIATEK |
 612                                                      BTUSB_WIDEBAND_SPEECH |
 613                                                      BTUSB_VALID_LE_STATES },
 614         { USB_DEVICE(0x0489, 0xe0d9), .driver_info = BTUSB_MEDIATEK |
 615                                                      BTUSB_WIDEBAND_SPEECH |
 616                                                      BTUSB_VALID_LE_STATES },
 617         { USB_DEVICE(0x0489, 0xe0f5), .driver_info = BTUSB_MEDIATEK |
 618                                                      BTUSB_WIDEBAND_SPEECH |
 619                                                      BTUSB_VALID_LE_STATES },
 620         { USB_DEVICE(0x13d3, 0x3568), .driver_info = BTUSB_MEDIATEK |
 621                                                      BTUSB_WIDEBAND_SPEECH |
 622                                                      BTUSB_VALID_LE_STATES },
 623         { USB_DEVICE(0x0489, 0xe0e2), .driver_info = BTUSB_MEDIATEK |
 624                                                      BTUSB_WIDEBAND_SPEECH |
 625                                                      BTUSB_VALID_LE_STATES },
 626         { USB_DEVICE(0x0489, 0xe0e4), .driver_info = BTUSB_MEDIATEK |
 627                                                      BTUSB_WIDEBAND_SPEECH |
 628                                                      BTUSB_VALID_LE_STATES },
 629         { USB_DEVICE(0x0489, 0xe0f2), .driver_info = BTUSB_MEDIATEK |
 630                                                      BTUSB_WIDEBAND_SPEECH |
 631                                                      BTUSB_VALID_LE_STATES },
 632         { USB_DEVICE(0x0489, 0xe0f5), .driver_info = BTUSB_MEDIATEK |
 633                                                      BTUSB_WIDEBAND_SPEECH |
 634                                                      BTUSB_VALID_LE_STATES },
 635         { USB_DEVICE(0x0489, 0xe0f6), .driver_info = BTUSB_MEDIATEK |
 636                                                      BTUSB_WIDEBAND_SPEECH |
 637                                                      BTUSB_VALID_LE_STATES },
 638         { USB_DEVICE(0x0489, 0xe102), .driver_info = BTUSB_MEDIATEK |
 639                                                      BTUSB_WIDEBAND_SPEECH |
 640                                                      BTUSB_VALID_LE_STATES },
 641
 642         /* Additional Realtek 8723AE Bluetooth devices */
 643         { USB_DEVICE(0x0930, 0x021d), .driver_info = BTUSB_REALTEK },
 644         { USB_DEVICE(0x13d3, 0x3394), .driver_info = BTUSB_REALTEK },
 645
 646         /* Additional Realtek 8723BE Bluetooth devices */
 647         { USB_DEVICE(0x0489, 0xe085), .driver_info = BTUSB_REALTEK },
 648         { USB_DEVICE(0x0489, 0xe08b), .driver_info = BTUSB_REALTEK },
 649         { USB_DEVICE(0x04f2, 0xb49f), .driver_info = BTUSB_REALTEK },
 650         { USB_DEVICE(0x13d3, 0x3410), .driver_info = BTUSB_REALTEK },
 651         { USB_DEVICE(0x13d3, 0x3416), .driver_info = BTUSB_REALTEK },
 652         { USB_DEVICE(0x13d3, 0x3459), .driver_info = BTUSB_REALTEK },
 653         { USB_DEVICE(0x13d3, 0x3494), .driver_info = BTUSB_REALTEK },
 654
 655         /* Additional Realtek 8723BU Bluetooth devices */
 656         { USB_DEVICE(0x7392, 0xa611), .driver_info = BTUSB_REALTEK },
 657
 658         /* Additional Realtek 8723DE Bluetooth devices */
 659         { USB_DEVICE(0x0bda, 0xb009), .driver_info = BTUSB_REALTEK },
 660         { USB_DEVICE(0x2ff8, 0xb011), .driver_info = BTUSB_REALTEK },
 661
 662         /* Additional Realtek 8761BUV Bluetooth devices */
 663         { USB_DEVICE(0x2357, 0x0604), .driver_info = BTUSB_REALTEK |
 664                                                      BTUSB_WIDEBAND_SPEECH },
 665         { USB_DEVICE(0x0b05, 0x190e), .driver_info = BTUSB_REALTEK |
 666                                                      BTUSB_WIDEBAND_SPEECH },
 667         { USB_DEVICE(0x2550, 0x8761), .driver_info = BTUSB_REALTEK |
 668                                                      BTUSB_WIDEBAND_SPEECH },
 669         { USB_DEVICE(0x0bda, 0x8771), .driver_info = BTUSB_REALTEK |
 670                                                      BTUSB_WIDEBAND_SPEECH },
 671         { USB_DEVICE(0x6655, 0x8771), .driver_info = BTUSB_REALTEK |
 672                                                      BTUSB_WIDEBAND_SPEECH },
 673         { USB_DEVICE(0x7392, 0xc611), .driver_info = BTUSB_REALTEK |
 674                                                      BTUSB_WIDEBAND_SPEECH },
 675         { USB_DEVICE(0x2b89, 0x8761), .driver_info = BTUSB_REALTEK |
 676                                                      BTUSB_WIDEBAND_SPEECH },
 677
 678         /* Additional Realtek 8821AE Bluetooth devices */
 679         { USB_DEVICE(0x0b05, 0x17dc), .driver_info = BTUSB_REALTEK },
 680         { USB_DEVICE(0x13d3, 0x3414), .driver_info = BTUSB_REALTEK },
 681         { USB_DEVICE(0x13d3, 0x3458), .driver_info = BTUSB_REALTEK },
 682         { USB_DEVICE(0x13d3, 0x3461), .driver_info = BTUSB_REALTEK },
 683         { USB_DEVICE(0x13d3, 0x3462), .driver_info = BTUSB_REALTEK },
 684
 685         /* Additional Realtek 8822BE Bluetooth devices */
 686         { USB_DEVICE(0x13d3, 0x3526), .driver_info = BTUSB_REALTEK },
 687         { USB_DEVICE(0x0b05, 0x185c), .driver_info = BTUSB_REALTEK },
 688
 689         /* Additional Realtek 8822CE Bluetooth devices */
 690         { USB_DEVICE(0x04ca, 0x4005), .driver_info = BTUSB_REALTEK |
 691                                                      BTUSB_WIDEBAND_SPEECH },
 692         { USB_DEVICE(0x04c5, 0x161f), .driver_info = BTUSB_REALTEK |
 693                                                      BTUSB_WIDEBAND_SPEECH },
 694         { USB_DEVICE(0x0b05, 0x18ef), .driver_info = BTUSB_REALTEK |
 695                                                      BTUSB_WIDEBAND_SPEECH },
 696         { USB_DEVICE(0x13d3, 0x3548), .driver_info = BTUSB_REALTEK |
 697                                                      BTUSB_WIDEBAND_SPEECH },
 698         { USB_DEVICE(0x13d3, 0x3549), .driver_info = BTUSB_REALTEK |
 699                                                      BTUSB_WIDEBAND_SPEECH },
 700         { USB_DEVICE(0x13d3, 0x3553), .driver_info = BTUSB_REALTEK |
 701                                                      BTUSB_WIDEBAND_SPEECH },
 702         { USB_DEVICE(0x13d3, 0x3555), .driver_info = BTUSB_REALTEK |
 703                                                      BTUSB_WIDEBAND_SPEECH },
 704         { USB_DEVICE(0x2ff8, 0x3051), .driver_info = BTUSB_REALTEK |
 705                                                      BTUSB_WIDEBAND_SPEECH },
 706         { USB_DEVICE(0x1358, 0xc123), .driver_info = BTUSB_REALTEK |
 707                                                      BTUSB_WIDEBAND_SPEECH },
 708         { USB_DEVICE(0x0bda, 0xc123), .driver_info = BTUSB_REALTEK |
 709                                                      BTUSB_WIDEBAND_SPEECH },
 710         { USB_DEVICE(0x0cb5, 0xc547), .driver_info = BTUSB_REALTEK |
 711                                                      BTUSB_WIDEBAND_SPEECH },
 712
 713         /* Actions Semiconductor ATS2851 based devices */
 714         { USB_DEVICE(0x10d7, 0xb012), .driver_info = BTUSB_ACTIONS_SEMI },
 715
 716         /* Silicon Wave based devices */
 717         { USB_DEVICE(0x0c10, 0x0000), .driver_info = BTUSB_SWAVE },
 718
 719         { }     /* Terminating entry */
 720 };
 721
 722 /* The Bluetooth USB module build into some devices needs to be reset on resume,
 723  * this is a problem with the platform (likely shutting off all power) not with
 724  * the module itself. So we use a DMI list to match known broken platforms.
 725  */
 726 static const struct dmi_system_id btusb_needs_reset_resume_table[] = {
 727         {
 728                 /* Dell OptiPlex 3060 (QCA ROME device 0cf3:e007) */
 729                 .matches = {
 730                         DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."),
 731                         DMI_MATCH(DMI_PRODUCT_NAME, "OptiPlex 3060"),
 732                 },
 733         },
 734         {
 735                 /* Dell XPS 9360 (QCA ROME device 0cf3:e300) */
 736                 .matches = {
 737                         DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."),
 738                         DMI_MATCH(DMI_PRODUCT_NAME, "XPS 13 9360"),
 739                 },
 740         },
 741         {
 742                 /* Dell Inspiron 5565 (QCA ROME device 0cf3:e009) */
 743                 .matches = {
 744                         DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."),
 745                         DMI_MATCH(DMI_PRODUCT_NAME, "Inspiron 5565"),
 746                 },
 747         },
 748         {}
 749 };
 750
 751 struct qca_dump_info {
 752         /* fields for dump collection */
 753         u16 id_vendor;
 754         u16 id_product;
 755         u32 fw_version;
 756         u32 controller_id;
 757         u32 ram_dump_size;
 758         u16 ram_dump_seqno;
 759 };
 760
 761 #define BTUSB_MAX_ISOC_FRAMES   10
 762
 763 #define BTUSB_INTR_RUNNING      0
 764 #define BTUSB_BULK_RUNNING      1
 765 #define BTUSB_ISOC_RUNNING      2
 766 #define BTUSB_SUSPENDING        3
 767 #define BTUSB_DID_ISO_RESUME    4
 768 #define BTUSB_BOOTLOADER        5
 769 #define BTUSB_DOWNLOADING       6
 770 #define BTUSB_FIRMWARE_LOADED   7
 771 #define BTUSB_FIRMWARE_FAILED   8
 772 #define BTUSB_BOOTING           9
 773 #define BTUSB_DIAG_RUNNING      10
 774 #define BTUSB_OOB_WAKE_ENABLED  11
 775 #define BTUSB_HW_RESET_ACTIVE   12
 776 #define BTUSB_TX_WAIT_VND_EVT   13
 777 #define BTUSB_WAKEUP_AUTOSUSPEND        14
 778 #define BTUSB_USE_ALT3_FOR_WBS  15
 779 #define BTUSB_ALT6_CONTINUOUS_TX        16
 780 #define BTUSB_HW_SSR_ACTIVE     17
 781
 782 struct btusb_data {
 783         struct hci_dev       *hdev;
 784         struct usb_device    *udev;
 785         struct usb_interface *intf;
 786         struct usb_interface *isoc;
 787         struct usb_interface *diag;
 788         unsigned isoc_ifnum;
 789
 790         unsigned long flags;
 791
 792         bool poll_sync;
 793         int intr_interval;
 794         struct work_struct  work;
 795         struct work_struct  waker;
 796         struct delayed_work rx_work;
 797
 798         struct sk_buff_head acl_q;
 799
 800         struct usb_anchor deferred;
 801         struct usb_anchor tx_anchor;
 802         int tx_in_flight;
 803         spinlock_t txlock;
 804
 805         struct usb_anchor intr_anchor;
 806         struct usb_anchor bulk_anchor;
 807         struct usb_anchor isoc_anchor;
 808         struct usb_anchor diag_anchor;
 809         struct usb_anchor ctrl_anchor;
 810         spinlock_t rxlock;
 811
 812         struct sk_buff *evt_skb;
 813         struct sk_buff *acl_skb;
 814         struct sk_buff *sco_skb;
 815
 816         struct usb_endpoint_descriptor *intr_ep;
 817         struct usb_endpoint_descriptor *bulk_tx_ep;
 818         struct usb_endpoint_descriptor *bulk_rx_ep;
 819         struct usb_endpoint_descriptor *isoc_tx_ep;
 820         struct usb_endpoint_descriptor *isoc_rx_ep;
 821         struct usb_endpoint_descriptor *diag_tx_ep;
 822         struct usb_endpoint_descriptor *diag_rx_ep;
 823
 824         struct gpio_desc *reset_gpio;
 825
 826         __u8 cmdreq_type;
 827         __u8 cmdreq;
 828
 829         unsigned int sco_num;
 830         unsigned int air_mode;
 831         bool usb_alt6_packet_flow;
 832         int isoc_altsetting;
 833         int suspend_count;
 834
 835         int (*recv_event)(struct hci_dev *hdev, struct sk_buff *skb);
 836         int (*recv_acl)(struct hci_dev *hdev, struct sk_buff *skb);
 837         int (*recv_bulk)(struct btusb_data *data, void *buffer, int count);
 838
 839         int (*setup_on_usb)(struct hci_dev *hdev);
 840
 841         int oob_wake_irq;   /* irq for out-of-band wake-on-bt */
 842         unsigned cmd_timeout_cnt;
 843
 844         struct qca_dump_info qca_dump;
 845 };
 846
 847 static void btusb_reset(struct hci_dev *hdev)
 848 {
 849         struct btusb_data *data;
 850         int err;
 851
 852         if (hdev->reset) {
 853                 hdev->reset(hdev);
 854                 return;
 855         }
 856
 857         data = hci_get_drvdata(hdev);
 858         /* This is not an unbalanced PM reference since the device will reset */
 859         err = usb_autopm_get_interface(data->intf);
 860         if (err) {
 861                 bt_dev_err(hdev, "Failed usb_autopm_get_interface: %d", err);
 862                 return;
 863         }
 864
 865         bt_dev_err(hdev, "Resetting usb device.");
 866         usb_queue_reset_device(data->intf);
 867 }
 868
 869 static void btusb_intel_cmd_timeout(struct hci_dev *hdev)
 870 {
 871         struct btusb_data *data = hci_get_drvdata(hdev);
 872         struct gpio_desc *reset_gpio = data->reset_gpio;
 873         struct btintel_data *intel_data = hci_get_priv(hdev);
 874
 875         if (++data->cmd_timeout_cnt < 5)
 876                 return;
 877
 878         if (intel_data->acpi_reset_method) {
 879                 if (test_and_set_bit(INTEL_ACPI_RESET_ACTIVE, intel_data->flags)) {
 880                         bt_dev_err(hdev, "acpi: last reset failed ? Not resetting again");
 881                         return;
 882                 }
 883
 884                 bt_dev_err(hdev, "Initiating acpi reset method");
 885                 /* If ACPI reset method fails, lets try with legacy GPIO
 886                  * toggling
 887                  */
 888                 if (!intel_data->acpi_reset_method(hdev)) {
 889                         return;
 890                 }
 891         }
 892
 893         if (!reset_gpio) {
 894                 btusb_reset(hdev);
 895                 return;
 896         }
 897
 898         /*
 899          * Toggle the hard reset line if the platform provides one. The reset
 900          * is going to yank the device off the USB and then replug. So doing
 901          * once is enough. The cleanup is handled correctly on the way out
 902          * (standard USB disconnect), and the new device is detected cleanly
 903          * and bound to the driver again like it should be.
 904          */
 905         if (test_and_set_bit(BTUSB_HW_RESET_ACTIVE, &data->flags)) {
 906                 bt_dev_err(hdev, "last reset failed? Not resetting again");
 907                 return;
 908         }
 909
 910         bt_dev_err(hdev, "Initiating HW reset via gpio");
 911         gpiod_set_value_cansleep(reset_gpio, 1);
 912         msleep(100);
 913         gpiod_set_value_cansleep(reset_gpio, 0);
 914 }
 915
 916 #define RTK_DEVCOREDUMP_CODE_MEMDUMP            0x01
 917 #define RTK_DEVCOREDUMP_CODE_HW_ERR             0x02
 918 #define RTK_DEVCOREDUMP_CODE_CMD_TIMEOUT        0x03
 919
 920 #define RTK_SUB_EVENT_CODE_COREDUMP             0x34
 921
 922 struct rtk_dev_coredump_hdr {
 923         u8 type;
 924         u8 code;
 925         u8 reserved[2];
 926 } __packed;
 927
 928 static inline void btusb_rtl_alloc_devcoredump(struct hci_dev *hdev,
 929                 struct rtk_dev_coredump_hdr *hdr, u8 *buf, u32 len)
 930 {
 931         struct sk_buff *skb;
 932
 933         skb = alloc_skb(len + sizeof(*hdr), GFP_ATOMIC);
 934         if (!skb)
 935                 return;
 936
 937         skb_put_data(skb, hdr, sizeof(*hdr));
 938         if (len)
 939                 skb_put_data(skb, buf, len);
 940
 941         if (!hci_devcd_init(hdev, skb->len)) {
 942                 hci_devcd_append(hdev, skb);
 943                 hci_devcd_complete(hdev);
 944         } else {
 945                 bt_dev_err(hdev, "RTL: Failed to generate devcoredump");
 946                 kfree_skb(skb);
 947         }
 948 }
 949
 950 static void btusb_rtl_cmd_timeout(struct hci_dev *hdev)
 951 {
 952         struct btusb_data *data = hci_get_drvdata(hdev);
 953         struct gpio_desc *reset_gpio = data->reset_gpio;
 954         struct rtk_dev_coredump_hdr hdr = {
 955                 .type = RTK_DEVCOREDUMP_CODE_CMD_TIMEOUT,
 956         };
 957
 958         btusb_rtl_alloc_devcoredump(hdev, &hdr, NULL, 0);
 959
 960         if (++data->cmd_timeout_cnt < 5)
 961                 return;
 962
 963         if (!reset_gpio) {
 964                 btusb_reset(hdev);
 965                 return;
 966         }
 967
 968         /* Toggle the hard reset line. The Realtek device is going to
 969          * yank itself off the USB and then replug. The cleanup is handled
 970          * correctly on the way out (standard USB disconnect), and the new
 971          * device is detected cleanly and bound to the driver again like
 972          * it should be.
 973          */
 974         if (test_and_set_bit(BTUSB_HW_RESET_ACTIVE, &data->flags)) {
 975                 bt_dev_err(hdev, "last reset failed? Not resetting again");
 976                 return;
 977         }
 978
 979         bt_dev_err(hdev, "Reset Realtek device via gpio");
 980         gpiod_set_value_cansleep(reset_gpio, 1);
 981         msleep(200);
 982         gpiod_set_value_cansleep(reset_gpio, 0);
 983 }
 984
 985 static void btusb_rtl_hw_error(struct hci_dev *hdev, u8 code)
 986 {
 987         struct rtk_dev_coredump_hdr hdr = {
 988                 .type = RTK_DEVCOREDUMP_CODE_HW_ERR,
 989                 .code = code,
 990         };
 991
 992         bt_dev_err(hdev, "RTL: hw err, trigger devcoredump (%d)", code);
 993
 994         btusb_rtl_alloc_devcoredump(hdev, &hdr, NULL, 0);
 995 }
 996
 997 static void btusb_qca_cmd_timeout(struct hci_dev *hdev)
 998 {
 999         struct btusb_data *data = hci_get_drvdata(hdev);
1000         struct gpio_desc *reset_gpio = data->reset_gpio;
1001
1002         if (test_bit(BTUSB_HW_SSR_ACTIVE, &data->flags)) {
1003                 bt_dev_info(hdev, "Ramdump in progress, defer cmd_timeout");
1004                 return;
1005         }
1006
1007         if (++data->cmd_timeout_cnt < 5)
1008                 return;
1009
1010         if (reset_gpio) {
1011                 bt_dev_err(hdev, "Reset qca device via bt_en gpio");
1012
1013                 /* Toggle the hard reset line. The qca bt device is going to
1014                  * yank itself off the USB and then replug. The cleanup is handled
1015                  * correctly on the way out (standard USB disconnect), and the new
1016                  * device is detected cleanly and bound to the driver again like
1017                  * it should be.
1018                  */
1019                 if (test_and_set_bit(BTUSB_HW_RESET_ACTIVE, &data->flags)) {
1020                         bt_dev_err(hdev, "last reset failed? Not resetting again");
1021                         return;
1022                 }
1023
1024                 gpiod_set_value_cansleep(reset_gpio, 0);
1025                 msleep(200);
1026                 gpiod_set_value_cansleep(reset_gpio, 1);
1027
1028                 return;
1029         }
1030
1031         btusb_reset(hdev);
1032 }
1033
1034 static inline void btusb_free_frags(struct btusb_data *data)
1035 {
1036         unsigned long flags;
1037
1038         spin_lock_irqsave(&data->rxlock, flags);
1039
1040         dev_kfree_skb_irq(data->evt_skb);
1041         data->evt_skb = NULL;
1042
1043         dev_kfree_skb_irq(data->acl_skb);
1044         data->acl_skb = NULL;
1045
1046         dev_kfree_skb_irq(data->sco_skb);
1047         data->sco_skb = NULL;
1048
1049         spin_unlock_irqrestore(&data->rxlock, flags);
1050 }
1051
1052 static int btusb_recv_event(struct btusb_data *data, struct sk_buff *skb)
1053 {
1054         if (data->intr_interval) {
1055                 /* Trigger dequeue immediatelly if an event is received */
1056                 schedule_delayed_work(&data->rx_work, 0);
1057         }
1058
1059         return data->recv_event(data->hdev, skb);
1060 }
1061
1062 static int btusb_recv_intr(struct btusb_data *data, void *buffer, int count)
1063 {
1064         struct sk_buff *skb;
1065         unsigned long flags;
1066         int err = 0;
1067
1068         spin_lock_irqsave(&data->rxlock, flags);
1069         skb = data->evt_skb;
1070
1071         while (count) {
1072                 int len;
1073
1074                 if (!skb) {
1075                         skb = bt_skb_alloc(HCI_MAX_EVENT_SIZE, GFP_ATOMIC);
1076                         if (!skb) {
1077                                 err = -ENOMEM;
1078                                 break;
1079                         }
1080
1081                         hci_skb_pkt_type(skb) = HCI_EVENT_PKT;
1082                         hci_skb_expect(skb) = HCI_EVENT_HDR_SIZE;
1083                 }
1084
1085                 len = min_t(uint, hci_skb_expect(skb), count);
1086                 skb_put_data(skb, buffer, len);
1087
1088                 count -= len;
1089                 buffer += len;
1090                 hci_skb_expect(skb) -= len;
1091
1092                 if (skb->len == HCI_EVENT_HDR_SIZE) {
1093                         /* Complete event header */
1094                         hci_skb_expect(skb) = hci_event_hdr(skb)->plen;
1095
1096                         if (skb_tailroom(skb) < hci_skb_expect(skb)) {
1097                                 kfree_skb(skb);
1098                                 skb = NULL;
1099
1100                                 err = -EILSEQ;
1101                                 break;
1102                         }
1103                 }
1104
1105                 if (!hci_skb_expect(skb)) {
1106                         /* Complete frame */
1107                         btusb_recv_event(data, skb);
1108                         skb = NULL;
1109                 }
1110         }
1111
1112         data->evt_skb = skb;
1113         spin_unlock_irqrestore(&data->rxlock, flags);
1114
1115         return err;
1116 }
1117
1118 static int btusb_recv_acl(struct btusb_data *data, struct sk_buff *skb)
1119 {
1120         /* Only queue ACL packet if intr_interval is set as it means
1121          * force_poll_sync has been enabled.
1122          */
1123         if (!data->intr_interval)
1124                 return data->recv_acl(data->hdev, skb);
1125
1126         skb_queue_tail(&data->acl_q, skb);
1127         schedule_delayed_work(&data->rx_work, data->intr_interval);
1128
1129         return 0;
1130 }
1131
1132 static int btusb_recv_bulk(struct btusb_data *data, void *buffer, int count)
1133 {
1134         struct sk_buff *skb;
1135         unsigned long flags;
1136         int err = 0;
1137
1138         spin_lock_irqsave(&data->rxlock, flags);
1139         skb = data->acl_skb;
1140
1141         while (count) {
1142                 int len;
1143
1144                 if (!skb) {
1145                         skb = bt_skb_alloc(HCI_MAX_FRAME_SIZE, GFP_ATOMIC);
1146                         if (!skb) {
1147                                 err = -ENOMEM;
1148                                 break;
1149                         }
1150
1151                         hci_skb_pkt_type(skb) = HCI_ACLDATA_PKT;
1152                         hci_skb_expect(skb) = HCI_ACL_HDR_SIZE;
1153                 }
1154
1155                 len = min_t(uint, hci_skb_expect(skb), count);
1156                 skb_put_data(skb, buffer, len);
1157
1158                 count -= len;
1159                 buffer += len;
1160                 hci_skb_expect(skb) -= len;
1161
1162                 if (skb->len == HCI_ACL_HDR_SIZE) {
1163                         __le16 dlen = hci_acl_hdr(skb)->dlen;
1164
1165                         /* Complete ACL header */
1166                         hci_skb_expect(skb) = __le16_to_cpu(dlen);
1167
1168                         if (skb_tailroom(skb) < hci_skb_expect(skb)) {
1169                                 kfree_skb(skb);
1170                                 skb = NULL;
1171
1172                                 err = -EILSEQ;
1173                                 break;
1174                         }
1175                 }
1176
1177                 if (!hci_skb_expect(skb)) {
1178                         /* Complete frame */
1179                         btusb_recv_acl(data, skb);
1180                         skb = NULL;
1181                 }
1182         }
1183
1184         data->acl_skb = skb;
1185         spin_unlock_irqrestore(&data->rxlock, flags);
1186
1187         return err;
1188 }
1189
1190 static bool btusb_validate_sco_handle(struct hci_dev *hdev,
1191                                       struct hci_sco_hdr *hdr)
1192 {
1193         __u16 handle;
1194
1195         if (hci_dev_test_flag(hdev, HCI_USER_CHANNEL))
1196                 // Can't validate, userspace controls everything.
1197                 return true;
1198
1199         /*
1200          * USB isochronous transfers are not designed to be reliable and may
1201          * lose fragments.  When this happens, the next first fragment
1202          * encountered might actually be a continuation fragment.
1203          * Validate the handle to detect it and drop it, or else the upper
1204          * layer will get garbage for a while.
1205          */
1206
1207         handle = hci_handle(__le16_to_cpu(hdr->handle));
1208
1209         switch (hci_conn_lookup_type(hdev, handle)) {
1210         case SCO_LINK:
1211         case ESCO_LINK:
1212                 return true;
1213         default:
1214                 return false;
1215         }
1216 }
1217
1218 static int btusb_recv_isoc(struct btusb_data *data, void *buffer, int count)
1219 {
1220         struct sk_buff *skb;
1221         unsigned long flags;
1222         int err = 0;
1223
1224         spin_lock_irqsave(&data->rxlock, flags);
1225         skb = data->sco_skb;
1226
1227         while (count) {
1228                 int len;
1229
1230                 if (!skb) {
1231                         skb = bt_skb_alloc(HCI_MAX_SCO_SIZE, GFP_ATOMIC);
1232                         if (!skb) {
1233                                 err = -ENOMEM;
1234                                 break;
1235                         }
1236
1237                         hci_skb_pkt_type(skb) = HCI_SCODATA_PKT;
1238                         hci_skb_expect(skb) = HCI_SCO_HDR_SIZE;
1239                 }
1240
1241                 len = min_t(uint, hci_skb_expect(skb), count);
1242                 skb_put_data(skb, buffer, len);
1243
1244                 count -= len;
1245                 buffer += len;
1246                 hci_skb_expect(skb) -= len;
1247
1248                 if (skb->len == HCI_SCO_HDR_SIZE) {
1249                         /* Complete SCO header */
1250                         struct hci_sco_hdr *hdr = hci_sco_hdr(skb);
1251
1252                         hci_skb_expect(skb) = hdr->dlen;
1253
1254                         if (skb_tailroom(skb) < hci_skb_expect(skb) ||
1255                             !btusb_validate_sco_handle(data->hdev, hdr)) {
1256                                 kfree_skb(skb);
1257                                 skb = NULL;
1258
1259                                 err = -EILSEQ;
1260                                 break;
1261                         }
1262                 }
1263
1264                 if (!hci_skb_expect(skb)) {
1265                         /* Complete frame */
1266                         hci_recv_frame(data->hdev, skb);
1267                         skb = NULL;
1268                 }
1269         }
1270
1271         data->sco_skb = skb;
1272         spin_unlock_irqrestore(&data->rxlock, flags);
1273
1274         return err;
1275 }
1276
1277 static void btusb_intr_complete(struct urb *urb)
1278 {
1279         struct hci_dev *hdev = urb->context;
1280         struct btusb_data *data = hci_get_drvdata(hdev);
1281         int err;
1282
1283         BT_DBG("%s urb %p status %d count %d", hdev->name, urb, urb->status,
1284                urb->actual_length);
1285
1286         if (!test_bit(HCI_RUNNING, &hdev->flags))
1287                 return;
1288
1289         if (urb->status == 0) {
1290                 hdev->stat.byte_rx += urb->actual_length;
1291
1292                 if (btusb_recv_intr(data, urb->transfer_buffer,
1293                                     urb->actual_length) < 0) {
1294                         bt_dev_err(hdev, "corrupted event packet");
1295                         hdev->stat.err_rx++;
1296                 }
1297         } else if (urb->status == -ENOENT) {
1298                 /* Avoid suspend failed when usb_kill_urb */
1299                 return;
1300         }
1301
1302         if (!test_bit(BTUSB_INTR_RUNNING, &data->flags))
1303                 return;
1304
1305         usb_mark_last_busy(data->udev);
1306         usb_anchor_urb(urb, &data->intr_anchor);
1307
1308         err = usb_submit_urb(urb, GFP_ATOMIC);
1309         if (err < 0) {
1310                 /* -EPERM: urb is being killed;
1311                  * -ENODEV: device got disconnected
1312                  */
1313                 if (err != -EPERM && err != -ENODEV)
1314                         bt_dev_err(hdev, "urb %p failed to resubmit (%d)",
1315                                    urb, -err);
1316                 if (err != -EPERM)
1317                         hci_cmd_sync_cancel(hdev, -err);
1318                 usb_unanchor_urb(urb);
1319         }
1320 }
1321
1322 static int btusb_submit_intr_urb(struct hci_dev *hdev, gfp_t mem_flags)
1323 {
1324         struct btusb_data *data = hci_get_drvdata(hdev);
1325         struct urb *urb;
1326         unsigned char *buf;
1327         unsigned int pipe;
1328         int err, size;
1329
1330         BT_DBG("%s", hdev->name);
1331
1332         if (!data->intr_ep)
1333                 return -ENODEV;
1334
1335         urb = usb_alloc_urb(0, mem_flags);
1336         if (!urb)
1337                 return -ENOMEM;
1338
1339         size = le16_to_cpu(data->intr_ep->wMaxPacketSize);
1340
1341         buf = kmalloc(size, mem_flags);
1342         if (!buf) {
1343                 usb_free_urb(urb);
1344                 return -ENOMEM;
1345         }
1346
1347         pipe = usb_rcvintpipe(data->udev, data->intr_ep->bEndpointAddress);
1348
1349         usb_fill_int_urb(urb, data->udev, pipe, buf, size,
1350                          btusb_intr_complete, hdev, data->intr_ep->bInterval);
1351
1352         urb->transfer_flags |= URB_FREE_BUFFER;
1353
1354         usb_anchor_urb(urb, &data->intr_anchor);
1355
1356         err = usb_submit_urb(urb, mem_flags);
1357         if (err < 0) {
1358                 if (err != -EPERM && err != -ENODEV)
1359                         bt_dev_err(hdev, "urb %p submission failed (%d)",
1360                                    urb, -err);
1361                 if (err != -EPERM)
1362                         hci_cmd_sync_cancel(hdev, -err);
1363                 usb_unanchor_urb(urb);
1364         }
1365
1366         /* Only initialize intr_interval if URB poll sync is enabled */
1367         if (!data->poll_sync)
1368                 goto done;
1369
1370         /* The units are frames (milliseconds) for full and low speed devices,
1371          * and microframes (1/8 millisecond) for highspeed and SuperSpeed
1372          * devices.
1373          *
1374          * This is done once on open/resume so it shouldn't change even if
1375          * force_poll_sync changes.
1376          */
1377         switch (urb->dev->speed) {
1378         case USB_SPEED_SUPER_PLUS:
1379         case USB_SPEED_SUPER:   /* units are 125us */
1380                 data->intr_interval = usecs_to_jiffies(urb->interval * 125);
1381                 break;
1382         default:
1383                 data->intr_interval = msecs_to_jiffies(urb->interval);
1384                 break;
1385         }
1386
1387 done:
1388         usb_free_urb(urb);
1389
1390         return err;
1391 }
1392
1393 static void btusb_bulk_complete(struct urb *urb)
1394 {
1395         struct hci_dev *hdev = urb->context;
1396         struct btusb_data *data = hci_get_drvdata(hdev);
1397         int err;
1398
1399         BT_DBG("%s urb %p status %d count %d", hdev->name, urb, urb->status,
1400                urb->actual_length);
1401
1402         if (!test_bit(HCI_RUNNING, &hdev->flags))
1403                 return;
1404
1405         if (urb->status == 0) {
1406                 hdev->stat.byte_rx += urb->actual_length;
1407
1408                 if (data->recv_bulk(data, urb->transfer_buffer,
1409                                     urb->actual_length) < 0) {
1410                         bt_dev_err(hdev, "corrupted ACL packet");
1411                         hdev->stat.err_rx++;
1412                 }
1413         } else if (urb->status == -ENOENT) {
1414                 /* Avoid suspend failed when usb_kill_urb */
1415                 return;
1416         }
1417
1418         if (!test_bit(BTUSB_BULK_RUNNING, &data->flags))
1419                 return;
1420
1421         usb_anchor_urb(urb, &data->bulk_anchor);
1422         usb_mark_last_busy(data->udev);
1423
1424         err = usb_submit_urb(urb, GFP_ATOMIC);
1425         if (err < 0) {
1426                 /* -EPERM: urb is being killed;
1427                  * -ENODEV: device got disconnected
1428                  */
1429                 if (err != -EPERM && err != -ENODEV)
1430                         bt_dev_err(hdev, "urb %p failed to resubmit (%d)",
1431                                    urb, -err);
1432                 usb_unanchor_urb(urb);
1433         }
1434 }
1435
1436 static int btusb_submit_bulk_urb(struct hci_dev *hdev, gfp_t mem_flags)
1437 {
1438         struct btusb_data *data = hci_get_drvdata(hdev);
1439         struct urb *urb;
1440         unsigned char *buf;
1441         unsigned int pipe;
1442         int err, size = HCI_MAX_FRAME_SIZE;
1443
1444         BT_DBG("%s", hdev->name);
1445
1446         if (!data->bulk_rx_ep)
1447                 return -ENODEV;
1448
1449         urb = usb_alloc_urb(0, mem_flags);
1450         if (!urb)
1451                 return -ENOMEM;
1452
1453         buf = kmalloc(size, mem_flags);
1454         if (!buf) {
1455                 usb_free_urb(urb);
1456                 return -ENOMEM;
1457         }
1458
1459         pipe = usb_rcvbulkpipe(data->udev, data->bulk_rx_ep->bEndpointAddress);
1460
1461         usb_fill_bulk_urb(urb, data->udev, pipe, buf, size,
1462                           btusb_bulk_complete, hdev);
1463
1464         urb->transfer_flags |= URB_FREE_BUFFER;
1465
1466         usb_mark_last_busy(data->udev);
1467         usb_anchor_urb(urb, &data->bulk_anchor);
1468
1469         err = usb_submit_urb(urb, mem_flags);
1470         if (err < 0) {
1471                 if (err != -EPERM && err != -ENODEV)
1472                         bt_dev_err(hdev, "urb %p submission failed (%d)",
1473                                    urb, -err);
1474                 usb_unanchor_urb(urb);
1475         }
1476
1477         usb_free_urb(urb);
1478
1479         return err;
1480 }
1481
1482 static void btusb_isoc_complete(struct urb *urb)
1483 {
1484         struct hci_dev *hdev = urb->context;
1485         struct btusb_data *data = hci_get_drvdata(hdev);
1486         int i, err;
1487
1488         BT_DBG("%s urb %p status %d count %d", hdev->name, urb, urb->status,
1489                urb->actual_length);
1490
1491         if (!test_bit(HCI_RUNNING, &hdev->flags))
1492                 return;
1493
1494         if (urb->status == 0) {
1495                 for (i = 0; i < urb->number_of_packets; i++) {
1496                         unsigned int offset = urb->iso_frame_desc[i].offset;
1497                         unsigned int length = urb->iso_frame_desc[i].actual_length;
1498
1499                         if (urb->iso_frame_desc[i].status)
1500                                 continue;
1501
1502                         hdev->stat.byte_rx += length;
1503
1504                         if (btusb_recv_isoc(data, urb->transfer_buffer + offset,
1505                                             length) < 0) {
1506                                 bt_dev_err(hdev, "corrupted SCO packet");
1507                                 hdev->stat.err_rx++;
1508                         }
1509                 }
1510         } else if (urb->status == -ENOENT) {
1511                 /* Avoid suspend failed when usb_kill_urb */
1512                 return;
1513         }
1514
1515         if (!test_bit(BTUSB_ISOC_RUNNING, &data->flags))
1516                 return;
1517
1518         usb_anchor_urb(urb, &data->isoc_anchor);
1519
1520         err = usb_submit_urb(urb, GFP_ATOMIC);
1521         if (err < 0) {
1522                 /* -EPERM: urb is being killed;
1523                  * -ENODEV: device got disconnected
1524                  */
1525                 if (err != -EPERM && err != -ENODEV)
1526                         bt_dev_err(hdev, "urb %p failed to resubmit (%d)",
1527                                    urb, -err);
1528                 usb_unanchor_urb(urb);
1529         }
1530 }
1531
1532 static inline void __fill_isoc_descriptor_msbc(struct urb *urb, int len,
1533                                                int mtu, struct btusb_data *data)
1534 {
1535         int i = 0, offset = 0;
1536         unsigned int interval;
1537
1538         BT_DBG("len %d mtu %d", len, mtu);
1539
1540         /* For mSBC ALT 6 settings some chips need to transmit the data
1541          * continuously without the zero length of USB packets.
1542          */
1543         if (test_bit(BTUSB_ALT6_CONTINUOUS_TX, &data->flags))
1544                 goto ignore_usb_alt6_packet_flow;
1545
1546         /* For mSBC ALT 6 setting the host will send the packet at continuous
1547          * flow. As per core spec 5, vol 4, part B, table 2.1. For ALT setting
1548          * 6 the HCI PACKET INTERVAL should be 7.5ms for every usb packets.
1549          * To maintain the rate we send 63bytes of usb packets alternatively for
1550          * 7ms and 8ms to maintain the rate as 7.5ms.
1551          */
1552         if (data->usb_alt6_packet_flow) {
1553                 interval = 7;
1554                 data->usb_alt6_packet_flow = false;
1555         } else {
1556                 interval = 6;
1557                 data->usb_alt6_packet_flow = true;
1558         }
1559
1560         for (i = 0; i < interval; i++) {
1561                 urb->iso_frame_desc[i].offset = offset;
1562                 urb->iso_frame_desc[i].length = offset;
1563         }
1564
1565 ignore_usb_alt6_packet_flow:
1566         if (len && i < BTUSB_MAX_ISOC_FRAMES) {
1567                 urb->iso_frame_desc[i].offset = offset;
1568                 urb->iso_frame_desc[i].length = len;
1569                 i++;
1570         }
1571
1572         urb->number_of_packets = i;
1573 }
1574
1575 static inline void __fill_isoc_descriptor(struct urb *urb, int len, int mtu)
1576 {
1577         int i, offset = 0;
1578
1579         BT_DBG("len %d mtu %d", len, mtu);
1580
1581         for (i = 0; i < BTUSB_MAX_ISOC_FRAMES && len >= mtu;
1582                                         i++, offset += mtu, len -= mtu) {
1583                 urb->iso_frame_desc[i].offset = offset;
1584                 urb->iso_frame_desc[i].length = mtu;
1585         }
1586
1587         if (len && i < BTUSB_MAX_ISOC_FRAMES) {
1588                 urb->iso_frame_desc[i].offset = offset;
1589                 urb->iso_frame_desc[i].length = len;
1590                 i++;
1591         }
1592
1593         urb->number_of_packets = i;
1594 }
1595
1596 static int btusb_submit_isoc_urb(struct hci_dev *hdev, gfp_t mem_flags)
1597 {
1598         struct btusb_data *data = hci_get_drvdata(hdev);
1599         struct urb *urb;
1600         unsigned char *buf;
1601         unsigned int pipe;
1602         int err, size;
1603
1604         BT_DBG("%s", hdev->name);
1605
1606         if (!data->isoc_rx_ep)
1607                 return -ENODEV;
1608
1609         urb = usb_alloc_urb(BTUSB_MAX_ISOC_FRAMES, mem_flags);
1610         if (!urb)
1611                 return -ENOMEM;
1612
1613         size = le16_to_cpu(data->isoc_rx_ep->wMaxPacketSize) *
1614                                                 BTUSB_MAX_ISOC_FRAMES;
1615
1616         buf = kmalloc(size, mem_flags);
1617         if (!buf) {
1618                 usb_free_urb(urb);
1619                 return -ENOMEM;
1620         }
1621
1622         pipe = usb_rcvisocpipe(data->udev, data->isoc_rx_ep->bEndpointAddress);
1623
1624         usb_fill_int_urb(urb, data->udev, pipe, buf, size, btusb_isoc_complete,
1625                          hdev, data->isoc_rx_ep->bInterval);
1626
1627         urb->transfer_flags = URB_FREE_BUFFER | URB_ISO_ASAP;
1628
1629         __fill_isoc_descriptor(urb, size,
1630                                le16_to_cpu(data->isoc_rx_ep->wMaxPacketSize));
1631
1632         usb_anchor_urb(urb, &data->isoc_anchor);
1633
1634         err = usb_submit_urb(urb, mem_flags);
1635         if (err < 0) {
1636                 if (err != -EPERM && err != -ENODEV)
1637                         bt_dev_err(hdev, "urb %p submission failed (%d)",
1638                                    urb, -err);
1639                 usb_unanchor_urb(urb);
1640         }
1641
1642         usb_free_urb(urb);
1643
1644         return err;
1645 }
1646
1647 static void btusb_diag_complete(struct urb *urb)
1648 {
1649         struct hci_dev *hdev = urb->context;
1650         struct btusb_data *data = hci_get_drvdata(hdev);
1651         int err;
1652
1653         BT_DBG("%s urb %p status %d count %d", hdev->name, urb, urb->status,
1654                urb->actual_length);
1655
1656         if (urb->status == 0) {
1657                 struct sk_buff *skb;
1658
1659                 skb = bt_skb_alloc(urb->actual_length, GFP_ATOMIC);
1660                 if (skb) {
1661                         skb_put_data(skb, urb->transfer_buffer,
1662                                      urb->actual_length);
1663                         hci_recv_diag(hdev, skb);
1664                 }
1665         } else if (urb->status == -ENOENT) {
1666                 /* Avoid suspend failed when usb_kill_urb */
1667                 return;
1668         }
1669
1670         if (!test_bit(BTUSB_DIAG_RUNNING, &data->flags))
1671                 return;
1672
1673         usb_anchor_urb(urb, &data->diag_anchor);
1674         usb_mark_last_busy(data->udev);
1675
1676         err = usb_submit_urb(urb, GFP_ATOMIC);
1677         if (err < 0) {
1678                 /* -EPERM: urb is being killed;
1679                  * -ENODEV: device got disconnected
1680                  */
1681                 if (err != -EPERM && err != -ENODEV)
1682                         bt_dev_err(hdev, "urb %p failed to resubmit (%d)",
1683                                    urb, -err);
1684                 usb_unanchor_urb(urb);
1685         }
1686 }
1687
1688 static int btusb_submit_diag_urb(struct hci_dev *hdev, gfp_t mem_flags)
1689 {
1690         struct btusb_data *data = hci_get_drvdata(hdev);
1691         struct urb *urb;
1692         unsigned char *buf;
1693         unsigned int pipe;
1694         int err, size = HCI_MAX_FRAME_SIZE;
1695
1696         BT_DBG("%s", hdev->name);
1697
1698         if (!data->diag_rx_ep)
1699                 return -ENODEV;
1700
1701         urb = usb_alloc_urb(0, mem_flags);
1702         if (!urb)
1703                 return -ENOMEM;
1704
1705         buf = kmalloc(size, mem_flags);
1706         if (!buf) {
1707                 usb_free_urb(urb);
1708                 return -ENOMEM;
1709         }
1710
1711         pipe = usb_rcvbulkpipe(data->udev, data->diag_rx_ep->bEndpointAddress);
1712
1713         usb_fill_bulk_urb(urb, data->udev, pipe, buf, size,
1714                           btusb_diag_complete, hdev);
1715
1716         urb->transfer_flags |= URB_FREE_BUFFER;
1717
1718         usb_mark_last_busy(data->udev);
1719         usb_anchor_urb(urb, &data->diag_anchor);
1720
1721         err = usb_submit_urb(urb, mem_flags);
1722         if (err < 0) {
1723                 if (err != -EPERM && err != -ENODEV)
1724                         bt_dev_err(hdev, "urb %p submission failed (%d)",
1725                                    urb, -err);
1726                 usb_unanchor_urb(urb);
1727         }
1728
1729         usb_free_urb(urb);
1730
1731         return err;
1732 }
1733
1734 static void btusb_tx_complete(struct urb *urb)
1735 {
1736         struct sk_buff *skb = urb->context;
1737         struct hci_dev *hdev = (struct hci_dev *)skb->dev;
1738         struct btusb_data *data = hci_get_drvdata(hdev);
1739         unsigned long flags;
1740
1741         BT_DBG("%s urb %p status %d count %d", hdev->name, urb, urb->status,
1742                urb->actual_length);
1743
1744         if (!test_bit(HCI_RUNNING, &hdev->flags))
1745                 goto done;
1746
1747         if (!urb->status) {
1748                 hdev->stat.byte_tx += urb->transfer_buffer_length;
1749         } else {
1750                 if (hci_skb_pkt_type(skb) == HCI_COMMAND_PKT)
1751                         hci_cmd_sync_cancel(hdev, -urb->status);
1752                 hdev->stat.err_tx++;
1753         }
1754
1755 done:
1756         spin_lock_irqsave(&data->txlock, flags);
1757         data->tx_in_flight--;
1758         spin_unlock_irqrestore(&data->txlock, flags);
1759
1760         kfree(urb->setup_packet);
1761
1762         kfree_skb(skb);
1763 }
1764
1765 static void btusb_isoc_tx_complete(struct urb *urb)
1766 {
1767         struct sk_buff *skb = urb->context;
1768         struct hci_dev *hdev = (struct hci_dev *)skb->dev;
1769
1770         BT_DBG("%s urb %p status %d count %d", hdev->name, urb, urb->status,
1771                urb->actual_length);
1772
1773         if (!test_bit(HCI_RUNNING, &hdev->flags))
1774                 goto done;
1775
1776         if (!urb->status)
1777                 hdev->stat.byte_tx += urb->transfer_buffer_length;
1778         else
1779                 hdev->stat.err_tx++;
1780
1781 done:
1782         kfree(urb->setup_packet);
1783
1784         kfree_skb(skb);
1785 }
1786
1787 static int btusb_open(struct hci_dev *hdev)
1788 {
1789         struct btusb_data *data = hci_get_drvdata(hdev);
1790         int err;
1791
1792         BT_DBG("%s", hdev->name);
1793
1794         err = usb_autopm_get_interface(data->intf);
1795         if (err < 0)
1796                 return err;
1797
1798         /* Patching USB firmware files prior to starting any URBs of HCI path
1799          * It is more safe to use USB bulk channel for downloading USB patch
1800          */
1801         if (data->setup_on_usb) {
1802                 err = data->setup_on_usb(hdev);
1803                 if (err < 0)
1804                         goto setup_fail;
1805         }
1806
1807         data->intf->needs_remote_wakeup = 1;
1808
1809         if (test_and_set_bit(BTUSB_INTR_RUNNING, &data->flags))
1810                 goto done;
1811
1812         err = btusb_submit_intr_urb(hdev, GFP_KERNEL);
1813         if (err < 0)
1814                 goto failed;
1815
1816         err = btusb_submit_bulk_urb(hdev, GFP_KERNEL);
1817         if (err < 0) {
1818                 usb_kill_anchored_urbs(&data->intr_anchor);
1819                 goto failed;
1820         }
1821
1822         set_bit(BTUSB_BULK_RUNNING, &data->flags);
1823         btusb_submit_bulk_urb(hdev, GFP_KERNEL);
1824
1825         if (data->diag) {
1826                 if (!btusb_submit_diag_urb(hdev, GFP_KERNEL))
1827                         set_bit(BTUSB_DIAG_RUNNING, &data->flags);
1828         }
1829
1830 done:
1831         usb_autopm_put_interface(data->intf);
1832         return 0;
1833
1834 failed:
1835         clear_bit(BTUSB_INTR_RUNNING, &data->flags);
1836 setup_fail:
1837         usb_autopm_put_interface(data->intf);
1838         return err;
1839 }
1840
1841 static void btusb_stop_traffic(struct btusb_data *data)
1842 {
1843         usb_kill_anchored_urbs(&data->intr_anchor);
1844         usb_kill_anchored_urbs(&data->bulk_anchor);
1845         usb_kill_anchored_urbs(&data->isoc_anchor);
1846         usb_kill_anchored_urbs(&data->diag_anchor);
1847         usb_kill_anchored_urbs(&data->ctrl_anchor);
1848 }
1849
1850 static int btusb_close(struct hci_dev *hdev)
1851 {
1852         struct btusb_data *data = hci_get_drvdata(hdev);
1853         int err;
1854
1855         BT_DBG("%s", hdev->name);
1856
1857         cancel_delayed_work(&data->rx_work);
1858         cancel_work_sync(&data->work);
1859         cancel_work_sync(&data->waker);
1860
1861         skb_queue_purge(&data->acl_q);
1862
1863         clear_bit(BTUSB_ISOC_RUNNING, &data->flags);
1864         clear_bit(BTUSB_BULK_RUNNING, &data->flags);
1865         clear_bit(BTUSB_INTR_RUNNING, &data->flags);
1866         clear_bit(BTUSB_DIAG_RUNNING, &data->flags);
1867
1868         btusb_stop_traffic(data);
1869         btusb_free_frags(data);
1870
1871         err = usb_autopm_get_interface(data->intf);
1872         if (err < 0)
1873                 goto failed;
1874
1875         data->intf->needs_remote_wakeup = 0;
1876
1877         /* Enable remote wake up for auto-suspend */
1878         if (test_bit(BTUSB_WAKEUP_AUTOSUSPEND, &data->flags))
1879                 data->intf->needs_remote_wakeup = 1;
1880
1881         usb_autopm_put_interface(data->intf);
1882
1883 failed:
1884         usb_scuttle_anchored_urbs(&data->deferred);
1885         return 0;
1886 }
1887
1888 static int btusb_flush(struct hci_dev *hdev)
1889 {
1890         struct btusb_data *data = hci_get_drvdata(hdev);
1891
1892         BT_DBG("%s", hdev->name);
1893
1894         cancel_delayed_work(&data->rx_work);
1895
1896         skb_queue_purge(&data->acl_q);
1897
1898         usb_kill_anchored_urbs(&data->tx_anchor);
1899         btusb_free_frags(data);
1900
1901         return 0;
1902 }
1903
1904 static struct urb *alloc_ctrl_urb(struct hci_dev *hdev, struct sk_buff *skb)
1905 {
1906         struct btusb_data *data = hci_get_drvdata(hdev);
1907         struct usb_ctrlrequest *dr;
1908         struct urb *urb;
1909         unsigned int pipe;
1910
1911         urb = usb_alloc_urb(0, GFP_KERNEL);
1912         if (!urb)
1913                 return ERR_PTR(-ENOMEM);
1914
1915         dr = kmalloc(sizeof(*dr), GFP_KERNEL);
1916         if (!dr) {
1917                 usb_free_urb(urb);
1918                 return ERR_PTR(-ENOMEM);
1919         }
1920
1921         dr->bRequestType = data->cmdreq_type;
1922         dr->bRequest     = data->cmdreq;
1923         dr->wIndex       = 0;
1924         dr->wValue       = 0;
1925         dr->wLength      = __cpu_to_le16(skb->len);
1926
1927         pipe = usb_sndctrlpipe(data->udev, 0x00);
1928
1929         usb_fill_control_urb(urb, data->udev, pipe, (void *)dr,
1930                              skb->data, skb->len, btusb_tx_complete, skb);
1931
1932         skb->dev = (void *)hdev;
1933
1934         return urb;
1935 }
1936
1937 static struct urb *alloc_bulk_urb(struct hci_dev *hdev, struct sk_buff *skb)
1938 {
1939         struct btusb_data *data = hci_get_drvdata(hdev);
1940         struct urb *urb;
1941         unsigned int pipe;
1942
1943         if (!data->bulk_tx_ep)
1944                 return ERR_PTR(-ENODEV);
1945
1946         urb = usb_alloc_urb(0, GFP_KERNEL);
1947         if (!urb)
1948                 return ERR_PTR(-ENOMEM);
1949
1950         pipe = usb_sndbulkpipe(data->udev, data->bulk_tx_ep->bEndpointAddress);
1951
1952         usb_fill_bulk_urb(urb, data->udev, pipe,
1953                           skb->data, skb->len, btusb_tx_complete, skb);
1954
1955         skb->dev = (void *)hdev;
1956
1957         return urb;
1958 }
1959
1960 static struct urb *alloc_isoc_urb(struct hci_dev *hdev, struct sk_buff *skb)
1961 {
1962         struct btusb_data *data = hci_get_drvdata(hdev);
1963         struct urb *urb;
1964         unsigned int pipe;
1965
1966         if (!data->isoc_tx_ep)
1967                 return ERR_PTR(-ENODEV);
1968
1969         urb = usb_alloc_urb(BTUSB_MAX_ISOC_FRAMES, GFP_KERNEL);
1970         if (!urb)
1971                 return ERR_PTR(-ENOMEM);
1972
1973         pipe = usb_sndisocpipe(data->udev, data->isoc_tx_ep->bEndpointAddress);
1974
1975         usb_fill_int_urb(urb, data->udev, pipe,
1976                          skb->data, skb->len, btusb_isoc_tx_complete,
1977                          skb, data->isoc_tx_ep->bInterval);
1978
1979         urb->transfer_flags  = URB_ISO_ASAP;
1980
1981         if (data->isoc_altsetting == 6)
1982                 __fill_isoc_descriptor_msbc(urb, skb->len,
1983                                             le16_to_cpu(data->isoc_tx_ep->wMaxPacketSize),
1984                                             data);
1985         else
1986                 __fill_isoc_descriptor(urb, skb->len,
1987                                        le16_to_cpu(data->isoc_tx_ep->wMaxPacketSize));
1988         skb->dev = (void *)hdev;
1989
1990         return urb;
1991 }
1992
1993 static int submit_tx_urb(struct hci_dev *hdev, struct urb *urb)
1994 {
1995         struct btusb_data *data = hci_get_drvdata(hdev);
1996         int err;
1997
1998         usb_anchor_urb(urb, &data->tx_anchor);
1999
2000         err = usb_submit_urb(urb, GFP_KERNEL);
2001         if (err < 0) {
2002                 if (err != -EPERM && err != -ENODEV)
2003                         bt_dev_err(hdev, "urb %p submission failed (%d)",
2004                                    urb, -err);
2005                 kfree(urb->setup_packet);
2006                 usb_unanchor_urb(urb);
2007         } else {
2008                 usb_mark_last_busy(data->udev);
2009         }
2010
2011         usb_free_urb(urb);
2012         return err;
2013 }
2014
2015 static int submit_or_queue_tx_urb(struct hci_dev *hdev, struct urb *urb)
2016 {
2017         struct btusb_data *data = hci_get_drvdata(hdev);
2018         unsigned long flags;
2019         bool suspending;
2020
2021         spin_lock_irqsave(&data->txlock, flags);
2022         suspending = test_bit(BTUSB_SUSPENDING, &data->flags);
2023         if (!suspending)
2024                 data->tx_in_flight++;
2025         spin_unlock_irqrestore(&data->txlock, flags);
2026
2027         if (!suspending)
2028                 return submit_tx_urb(hdev, urb);
2029
2030         usb_anchor_urb(urb, &data->deferred);
2031         schedule_work(&data->waker);
2032
2033         usb_free_urb(urb);
2034         return 0;
2035 }
2036
2037 static int btusb_send_frame(struct hci_dev *hdev, struct sk_buff *skb)
2038 {
2039         struct urb *urb;
2040
2041         BT_DBG("%s", hdev->name);
2042
2043         switch (hci_skb_pkt_type(skb)) {
2044         case HCI_COMMAND_PKT:
2045                 urb = alloc_ctrl_urb(hdev, skb);
2046                 if (IS_ERR(urb))
2047                         return PTR_ERR(urb);
2048
2049                 hdev->stat.cmd_tx++;
2050                 return submit_or_queue_tx_urb(hdev, urb);
2051
2052         case HCI_ACLDATA_PKT:
2053                 urb = alloc_bulk_urb(hdev, skb);
2054                 if (IS_ERR(urb))
2055                         return PTR_ERR(urb);
2056
2057                 hdev->stat.acl_tx++;
2058                 return submit_or_queue_tx_urb(hdev, urb);
2059
2060         case HCI_SCODATA_PKT:
2061                 if (hci_conn_num(hdev, SCO_LINK) < 1)
2062                         return -ENODEV;
2063
2064                 urb = alloc_isoc_urb(hdev, skb);
2065                 if (IS_ERR(urb))
2066                         return PTR_ERR(urb);
2067
2068                 hdev->stat.sco_tx++;
2069                 return submit_tx_urb(hdev, urb);
2070
2071         case HCI_ISODATA_PKT:
2072                 urb = alloc_bulk_urb(hdev, skb);
2073                 if (IS_ERR(urb))
2074                         return PTR_ERR(urb);
2075
2076                 return submit_or_queue_tx_urb(hdev, urb);
2077         }
2078
2079         return -EILSEQ;
2080 }
2081
2082 static void btusb_notify(struct hci_dev *hdev, unsigned int evt)
2083 {
2084         struct btusb_data *data = hci_get_drvdata(hdev);
2085
2086         BT_DBG("%s evt %d", hdev->name, evt);
2087
2088         if (hci_conn_num(hdev, SCO_LINK) != data->sco_num) {
2089                 data->sco_num = hci_conn_num(hdev, SCO_LINK);
2090                 data->air_mode = evt;
2091                 schedule_work(&data->work);
2092         }
2093 }
2094
2095 static inline int __set_isoc_interface(struct hci_dev *hdev, int altsetting)
2096 {
2097         struct btusb_data *data = hci_get_drvdata(hdev);
2098         struct usb_interface *intf = data->isoc;
2099         struct usb_endpoint_descriptor *ep_desc;
2100         int i, err;
2101
2102         if (!data->isoc)
2103                 return -ENODEV;
2104
2105         err = usb_set_interface(data->udev, data->isoc_ifnum, altsetting);
2106         if (err < 0) {
2107                 bt_dev_err(hdev, "setting interface failed (%d)", -err);
2108                 return err;
2109         }
2110
2111         data->isoc_altsetting = altsetting;
2112
2113         data->isoc_tx_ep = NULL;
2114         data->isoc_rx_ep = NULL;
2115
2116         for (i = 0; i < intf->cur_altsetting->desc.bNumEndpoints; i++) {
2117                 ep_desc = &intf->cur_altsetting->endpoint[i].desc;
2118
2119                 if (!data->isoc_tx_ep && usb_endpoint_is_isoc_out(ep_desc)) {
2120                         data->isoc_tx_ep = ep_desc;
2121                         continue;
2122                 }
2123
2124                 if (!data->isoc_rx_ep && usb_endpoint_is_isoc_in(ep_desc)) {
2125                         data->isoc_rx_ep = ep_desc;
2126                         continue;
2127                 }
2128         }
2129
2130         if (!data->isoc_tx_ep || !data->isoc_rx_ep) {
2131                 bt_dev_err(hdev, "invalid SCO descriptors");
2132                 return -ENODEV;
2133         }
2134
2135         return 0;
2136 }
2137
2138 static int btusb_switch_alt_setting(struct hci_dev *hdev, int new_alts)
2139 {
2140         struct btusb_data *data = hci_get_drvdata(hdev);
2141         int err;
2142
2143         if (data->isoc_altsetting != new_alts) {
2144                 unsigned long flags;
2145
2146                 clear_bit(BTUSB_ISOC_RUNNING, &data->flags);
2147                 usb_kill_anchored_urbs(&data->isoc_anchor);
2148
2149                 /* When isochronous alternate setting needs to be
2150                  * changed, because SCO connection has been added
2151                  * or removed, a packet fragment may be left in the
2152                  * reassembling state. This could lead to wrongly
2153                  * assembled fragments.
2154                  *
2155                  * Clear outstanding fragment when selecting a new
2156                  * alternate setting.
2157                  */
2158                 spin_lock_irqsave(&data->rxlock, flags);
2159                 kfree_skb(data->sco_skb);
2160                 data->sco_skb = NULL;
2161                 spin_unlock_irqrestore(&data->rxlock, flags);
2162
2163                 err = __set_isoc_interface(hdev, new_alts);
2164                 if (err < 0)
2165                         return err;
2166         }
2167
2168         if (!test_and_set_bit(BTUSB_ISOC_RUNNING, &data->flags)) {
2169                 if (btusb_submit_isoc_urb(hdev, GFP_KERNEL) < 0)
2170                         clear_bit(BTUSB_ISOC_RUNNING, &data->flags);
2171                 else
2172                         btusb_submit_isoc_urb(hdev, GFP_KERNEL);
2173         }
2174
2175         return 0;
2176 }
2177
2178 static struct usb_host_interface *btusb_find_altsetting(struct btusb_data *data,
2179                                                         int alt)
2180 {
2181         struct usb_interface *intf = data->isoc;
2182         int i;
2183
2184         BT_DBG("Looking for Alt no :%d", alt);
2185
2186         if (!intf)
2187                 return NULL;
2188
2189         for (i = 0; i < intf->num_altsetting; i++) {
2190                 if (intf->altsetting[i].desc.bAlternateSetting == alt)
2191                         return &intf->altsetting[i];
2192         }
2193
2194         return NULL;
2195 }
2196
2197 static void btusb_work(struct work_struct *work)
2198 {
2199         struct btusb_data *data = container_of(work, struct btusb_data, work);
2200         struct hci_dev *hdev = data->hdev;
2201         int new_alts = 0;
2202         int err;
2203
2204         if (data->sco_num > 0) {
2205                 if (!test_bit(BTUSB_DID_ISO_RESUME, &data->flags)) {
2206                         err = usb_autopm_get_interface(data->isoc ? data->isoc : data->intf);
2207                         if (err < 0) {
2208                                 clear_bit(BTUSB_ISOC_RUNNING, &data->flags);
2209                                 usb_kill_anchored_urbs(&data->isoc_anchor);
2210                                 return;
2211                         }
2212
2213                         set_bit(BTUSB_DID_ISO_RESUME, &data->flags);
2214                 }
2215
2216                 if (data->air_mode == HCI_NOTIFY_ENABLE_SCO_CVSD) {
2217                         if (hdev->voice_setting & 0x0020) {
2218                                 static const int alts[3] = { 2, 4, 5 };
2219
2220                                 new_alts = alts[data->sco_num - 1];
2221                         } else {
2222                                 new_alts = data->sco_num;
2223                         }
2224                 } else if (data->air_mode == HCI_NOTIFY_ENABLE_SCO_TRANSP) {
2225                         /* Bluetooth USB spec recommends alt 6 (63 bytes), but
2226                          * many adapters do not support it.  Alt 1 appears to
2227                          * work for all adapters that do not have alt 6, and
2228                          * which work with WBS at all.  Some devices prefer
2229                          * alt 3 (HCI payload >= 60 Bytes let air packet
2230                          * data satisfy 60 bytes), requiring
2231                          * MTU >= 3 (packets) * 25 (size) - 3 (headers) = 72
2232                          * see also Core spec 5, vol 4, B 2.1.1 & Table 2.1.
2233                          */
2234                         if (btusb_find_altsetting(data, 6))
2235                                 new_alts = 6;
2236                         else if (btusb_find_altsetting(data, 3) &&
2237                                  hdev->sco_mtu >= 72 &&
2238                                  test_bit(BTUSB_USE_ALT3_FOR_WBS, &data->flags))
2239                                 new_alts = 3;
2240                         else
2241                                 new_alts = 1;
2242                 }
2243
2244                 if (btusb_switch_alt_setting(hdev, new_alts) < 0)
2245                         bt_dev_err(hdev, "set USB alt:(%d) failed!", new_alts);
2246         } else {
2247                 usb_kill_anchored_urbs(&data->isoc_anchor);
2248
2249                 if (test_and_clear_bit(BTUSB_ISOC_RUNNING, &data->flags))
2250                         __set_isoc_interface(hdev, 0);
2251
2252                 if (test_and_clear_bit(BTUSB_DID_ISO_RESUME, &data->flags))
2253                         usb_autopm_put_interface(data->isoc ? data->isoc : data->intf);
2254         }
2255 }
2256
2257 static void btusb_waker(struct work_struct *work)
2258 {
2259         struct btusb_data *data = container_of(work, struct btusb_data, waker);
2260         int err;
2261
2262         err = usb_autopm_get_interface(data->intf);
2263         if (err < 0)
2264                 return;
2265
2266         usb_autopm_put_interface(data->intf);
2267 }
2268
2269 static void btusb_rx_work(struct work_struct *work)
2270 {
2271         struct btusb_data *data = container_of(work, struct btusb_data,
2272                                                rx_work.work);
2273         struct sk_buff *skb;
2274
2275         /* Dequeue ACL data received during the interval */
2276         while ((skb = skb_dequeue(&data->acl_q)))
2277                 data->recv_acl(data->hdev, skb);
2278 }
2279
2280 static int btusb_setup_bcm92035(struct hci_dev *hdev)
2281 {
2282         struct sk_buff *skb;
2283         u8 val = 0x00;
2284
2285         BT_DBG("%s", hdev->name);
2286
2287         skb = __hci_cmd_sync(hdev, 0xfc3b, 1, &val, HCI_INIT_TIMEOUT);
2288         if (IS_ERR(skb))
2289                 bt_dev_err(hdev, "BCM92035 command failed (%ld)", PTR_ERR(skb));
2290         else
2291                 kfree_skb(skb);
2292
2293         return 0;
2294 }
2295
2296 static int btusb_setup_csr(struct hci_dev *hdev)
2297 {
2298         struct btusb_data *data = hci_get_drvdata(hdev);
2299         u16 bcdDevice = le16_to_cpu(data->udev->descriptor.bcdDevice);
2300         struct hci_rp_read_local_version *rp;
2301         struct sk_buff *skb;
2302         bool is_fake = false;
2303         int ret;
2304
2305         BT_DBG("%s", hdev->name);
2306
2307         skb = __hci_cmd_sync(hdev, HCI_OP_READ_LOCAL_VERSION, 0, NULL,
2308                              HCI_INIT_TIMEOUT);
2309         if (IS_ERR(skb)) {
2310                 int err = PTR_ERR(skb);
2311                 bt_dev_err(hdev, "CSR: Local version failed (%d)", err);
2312                 return err;
2313         }
2314
2315         rp = skb_pull_data(skb, sizeof(*rp));
2316         if (!rp) {
2317                 bt_dev_err(hdev, "CSR: Local version length mismatch");
2318                 kfree_skb(skb);
2319                 return -EIO;
2320         }
2321
2322         bt_dev_info(hdev, "CSR: Setting up dongle with HCI ver=%u rev=%04x",
2323                     rp->hci_ver, le16_to_cpu(rp->hci_rev));
2324
2325         bt_dev_info(hdev, "LMP ver=%u subver=%04x; manufacturer=%u",
2326                     rp->lmp_ver, le16_to_cpu(rp->lmp_subver),
2327                     le16_to_cpu(rp->manufacturer));
2328
2329         /* Detect a wide host of Chinese controllers that aren't CSR.
2330          *
2331          * Known fake bcdDevices: 0x0100, 0x0134, 0x1915, 0x2520, 0x7558, 0x8891
2332          *
2333          * The main thing they have in common is that these are really popular low-cost
2334          * options that support newer Bluetooth versions but rely on heavy VID/PID
2335          * squatting of this poor old Bluetooth 1.1 device. Even sold as such.
2336          *
2337          * We detect actual CSR devices by checking that the HCI manufacturer code
2338          * is Cambridge Silicon Radio (10) and ensuring that LMP sub-version and
2339          * HCI rev values always match. As they both store the firmware number.
2340          */
2341         if (le16_to_cpu(rp->manufacturer) != 10 ||
2342             le16_to_cpu(rp->hci_rev) != le16_to_cpu(rp->lmp_subver))
2343                 is_fake = true;
2344
2345         /* Known legit CSR firmware build numbers and their supported BT versions:
2346          * - 1.1 (0x1) -> 0x0073, 0x020d, 0x033c, 0x034e
2347          * - 1.2 (0x2) ->                 0x04d9, 0x0529
2348          * - 2.0 (0x3) ->         0x07a6, 0x07ad, 0x0c5c
2349          * - 2.1 (0x4) ->         0x149c, 0x1735, 0x1899 (0x1899 is a BlueCore4-External)
2350          * - 4.0 (0x6) ->         0x1d86, 0x2031, 0x22bb
2351          *
2352          * e.g. Real CSR dongles with LMP subversion 0x73 are old enough that
2353          *      support BT 1.1 only; so it's a dead giveaway when some
2354          *      third-party BT 4.0 dongle reuses it.
2355          */
2356         else if (le16_to_cpu(rp->lmp_subver) <= 0x034e &&
2357                  rp->hci_ver > BLUETOOTH_VER_1_1)
2358                 is_fake = true;
2359
2360         else if (le16_to_cpu(rp->lmp_subver) <= 0x0529 &&
2361                  rp->hci_ver > BLUETOOTH_VER_1_2)
2362                 is_fake = true;
2363
2364         else if (le16_to_cpu(rp->lmp_subver) <= 0x0c5c &&
2365                  rp->hci_ver > BLUETOOTH_VER_2_0)
2366                 is_fake = true;
2367
2368         else if (le16_to_cpu(rp->lmp_subver) <= 0x1899 &&
2369                  rp->hci_ver > BLUETOOTH_VER_2_1)
2370                 is_fake = true;
2371
2372         else if (le16_to_cpu(rp->lmp_subver) <= 0x22bb &&
2373                  rp->hci_ver > BLUETOOTH_VER_4_0)
2374                 is_fake = true;
2375
2376         /* Other clones which beat all the above checks */
2377         else if (bcdDevice == 0x0134 &&
2378                  le16_to_cpu(rp->lmp_subver) == 0x0c5c &&
2379                  rp->hci_ver == BLUETOOTH_VER_2_0)
2380                 is_fake = true;
2381
2382         if (is_fake) {
2383                 bt_dev_warn(hdev, "CSR: Unbranded CSR clone detected; adding workarounds and force-suspending once...");
2384
2385                 /* Generally these clones have big discrepancies between
2386                  * advertised features and what's actually supported.
2387                  * Probably will need to be expanded in the future;
2388                  * without these the controller will lock up.
2389                  */
2390                 set_bit(HCI_QUIRK_BROKEN_STORED_LINK_KEY, &hdev->quirks);
2391                 set_bit(HCI_QUIRK_BROKEN_ERR_DATA_REPORTING, &hdev->quirks);
2392                 set_bit(HCI_QUIRK_BROKEN_FILTER_CLEAR_ALL, &hdev->quirks);
2393                 set_bit(HCI_QUIRK_NO_SUSPEND_NOTIFIER, &hdev->quirks);
2394
2395                 /* Clear the reset quirk since this is not an actual
2396                  * early Bluetooth 1.1 device from CSR.
2397                  */
2398                 clear_bit(HCI_QUIRK_RESET_ON_CLOSE, &hdev->quirks);
2399                 clear_bit(HCI_QUIRK_SIMULTANEOUS_DISCOVERY, &hdev->quirks);
2400
2401                 /*
2402                  * Special workaround for these BT 4.0 chip clones, and potentially more:
2403                  *
2404                  * - 0x0134: a Barrot 8041a02                 (HCI rev: 0x0810 sub: 0x1012)
2405                  * - 0x7558: IC markings FR3191AHAL 749H15143 (HCI rev/sub-version: 0x0709)
2406                  *
2407                  * These controllers are really messed-up.
2408                  *
2409                  * 1. Their bulk RX endpoint will never report any data unless
2410                  *    the device was suspended at least once (yes, really).
2411                  * 2. They will not wakeup when autosuspended and receiving data
2412                  *    on their bulk RX endpoint from e.g. a keyboard or mouse
2413                  *    (IOW remote-wakeup support is broken for the bulk endpoint).
2414                  *
2415                  * To fix 1. enable runtime-suspend, force-suspend the
2416                  * HCI and then wake-it up by disabling runtime-suspend.
2417                  *
2418                  * To fix 2. clear the HCI's can_wake flag, this way the HCI
2419                  * will still be autosuspended when it is not open.
2420                  *
2421                  * --
2422                  *
2423                  * Because these are widespread problems we prefer generic solutions; so
2424                  * apply this initialization quirk to every controller that gets here,
2425                  * it should be harmless. The alternative is to not work at all.
2426                  */
2427                 pm_runtime_allow(&data->udev->dev);
2428
2429                 ret = pm_runtime_suspend(&data->udev->dev);
2430                 if (ret >= 0)
2431                         msleep(200);
2432                 else
2433                         bt_dev_warn(hdev, "CSR: Couldn't suspend the device for our Barrot 8041a02 receive-issue workaround");
2434
2435                 pm_runtime_forbid(&data->udev->dev);
2436
2437                 device_set_wakeup_capable(&data->udev->dev, false);
2438
2439                 /* Re-enable autosuspend if this was requested */
2440                 if (enable_autosuspend)
2441                         usb_enable_autosuspend(data->udev);
2442         }
2443
2444         kfree_skb(skb);
2445
2446         return 0;
2447 }
2448
2449 static int inject_cmd_complete(struct hci_dev *hdev, __u16 opcode)
2450 {
2451         struct sk_buff *skb;
2452         struct hci_event_hdr *hdr;
2453         struct hci_ev_cmd_complete *evt;
2454
2455         skb = bt_skb_alloc(sizeof(*hdr) + sizeof(*evt) + 1, GFP_KERNEL);
2456         if (!skb)
2457                 return -ENOMEM;
2458
2459         hdr = skb_put(skb, sizeof(*hdr));
2460         hdr->evt = HCI_EV_CMD_COMPLETE;
2461         hdr->plen = sizeof(*evt) + 1;
2462
2463         evt = skb_put(skb, sizeof(*evt));
2464         evt->ncmd = 0x01;
2465         evt->opcode = cpu_to_le16(opcode);
2466
2467         skb_put_u8(skb, 0x00);
2468
2469         hci_skb_pkt_type(skb) = HCI_EVENT_PKT;
2470
2471         return hci_recv_frame(hdev, skb);
2472 }
2473
2474 static int btusb_recv_bulk_intel(struct btusb_data *data, void *buffer,
2475                                  int count)
2476 {
2477         struct hci_dev *hdev = data->hdev;
2478
2479         /* When the device is in bootloader mode, then it can send
2480          * events via the bulk endpoint. These events are treated the
2481          * same way as the ones received from the interrupt endpoint.
2482          */
2483         if (btintel_test_flag(hdev, INTEL_BOOTLOADER))
2484                 return btusb_recv_intr(data, buffer, count);
2485
2486         return btusb_recv_bulk(data, buffer, count);
2487 }
2488
2489 static int btusb_intel_diagnostics(struct hci_dev *hdev, struct sk_buff *skb)
2490 {
2491         struct intel_tlv *tlv = (void *)&skb->data[5];
2492
2493         /* The first event is always an event type TLV */
2494         if (tlv->type != INTEL_TLV_TYPE_ID)
2495                 goto recv_frame;
2496
2497         switch (tlv->val[0]) {
2498         case INTEL_TLV_SYSTEM_EXCEPTION:
2499         case INTEL_TLV_FATAL_EXCEPTION:
2500         case INTEL_TLV_DEBUG_EXCEPTION:
2501         case INTEL_TLV_TEST_EXCEPTION:
2502                 /* Generate devcoredump from exception */
2503                 if (!hci_devcd_init(hdev, skb->len)) {
2504                         hci_devcd_append(hdev, skb);
2505                         hci_devcd_complete(hdev);
2506                 } else {
2507                         bt_dev_err(hdev, "Failed to generate devcoredump");
2508                         kfree_skb(skb);
2509                 }
2510                 return 0;
2511         default:
2512                 bt_dev_err(hdev, "Invalid exception type %02X", tlv->val[0]);
2513         }
2514
2515 recv_frame:
2516         return hci_recv_frame(hdev, skb);
2517 }
2518
2519 static int btusb_recv_event_intel(struct hci_dev *hdev, struct sk_buff *skb)
2520 {
2521         struct hci_event_hdr *hdr = (void *)skb->data;
2522         const char diagnostics_hdr[] = { 0x87, 0x80, 0x03 };
2523
2524         if (skb->len > HCI_EVENT_HDR_SIZE && hdr->evt == 0xff &&
2525             hdr->plen > 0) {
2526                 const void *ptr = skb->data + HCI_EVENT_HDR_SIZE + 1;
2527                 unsigned int len = skb->len - HCI_EVENT_HDR_SIZE - 1;
2528
2529                 if (btintel_test_flag(hdev, INTEL_BOOTLOADER)) {
2530                         switch (skb->data[2]) {
2531                         case 0x02:
2532                                 /* When switching to the operational firmware
2533                                  * the device sends a vendor specific event
2534                                  * indicating that the bootup completed.
2535                                  */
2536                                 btintel_bootup(hdev, ptr, len);
2537                                 break;
2538                         case 0x06:
2539                                 /* When the firmware loading completes the
2540                                  * device sends out a vendor specific event
2541                                  * indicating the result of the firmware
2542                                  * loading.
2543                                  */
2544                                 btintel_secure_send_result(hdev, ptr, len);
2545                                 break;
2546                         }
2547                 }
2548
2549                 /* Handle all diagnostics events separately. May still call
2550                  * hci_recv_frame.
2551                  */
2552                 if (len >= sizeof(diagnostics_hdr) &&
2553                     memcmp(&skb->data[2], diagnostics_hdr,
2554                            sizeof(diagnostics_hdr)) == 0) {
2555                         return btusb_intel_diagnostics(hdev, skb);
2556                 }
2557         }
2558
2559         return hci_recv_frame(hdev, skb);
2560 }
2561
2562 static int btusb_send_frame_intel(struct hci_dev *hdev, struct sk_buff *skb)
2563 {
2564         struct urb *urb;
2565
2566         BT_DBG("%s", hdev->name);
2567
2568         switch (hci_skb_pkt_type(skb)) {
2569         case HCI_COMMAND_PKT:
2570                 if (btintel_test_flag(hdev, INTEL_BOOTLOADER)) {
2571                         struct hci_command_hdr *cmd = (void *)skb->data;
2572                         __u16 opcode = le16_to_cpu(cmd->opcode);
2573
2574                         /* When in bootloader mode and the command 0xfc09
2575                          * is received, it needs to be send down the
2576                          * bulk endpoint. So allocate a bulk URB instead.
2577                          */
2578                         if (opcode == 0xfc09)
2579                                 urb = alloc_bulk_urb(hdev, skb);
2580                         else
2581                                 urb = alloc_ctrl_urb(hdev, skb);
2582
2583                         /* When the 0xfc01 command is issued to boot into
2584                          * the operational firmware, it will actually not
2585                          * send a command complete event. To keep the flow
2586                          * control working inject that event here.
2587                          */
2588                         if (opcode == 0xfc01)
2589                                 inject_cmd_complete(hdev, opcode);
2590                 } else {
2591                         urb = alloc_ctrl_urb(hdev, skb);
2592                 }
2593                 if (IS_ERR(urb))
2594                         return PTR_ERR(urb);
2595
2596                 hdev->stat.cmd_tx++;
2597                 return submit_or_queue_tx_urb(hdev, urb);
2598
2599         case HCI_ACLDATA_PKT:
2600                 urb = alloc_bulk_urb(hdev, skb);
2601                 if (IS_ERR(urb))
2602                         return PTR_ERR(urb);
2603
2604                 hdev->stat.acl_tx++;
2605                 return submit_or_queue_tx_urb(hdev, urb);
2606
2607         case HCI_SCODATA_PKT:
2608                 if (hci_conn_num(hdev, SCO_LINK) < 1)
2609                         return -ENODEV;
2610
2611                 urb = alloc_isoc_urb(hdev, skb);
2612                 if (IS_ERR(urb))
2613                         return PTR_ERR(urb);
2614
2615                 hdev->stat.sco_tx++;
2616                 return submit_tx_urb(hdev, urb);
2617
2618         case HCI_ISODATA_PKT:
2619                 urb = alloc_bulk_urb(hdev, skb);
2620                 if (IS_ERR(urb))
2621                         return PTR_ERR(urb);
2622
2623                 return submit_or_queue_tx_urb(hdev, urb);
2624         }
2625
2626         return -EILSEQ;
2627 }
2628
2629 static int btusb_setup_realtek(struct hci_dev *hdev)
2630 {
2631         struct btusb_data *data = hci_get_drvdata(hdev);
2632         int ret;
2633
2634         ret = btrtl_setup_realtek(hdev);
2635
2636         if (btrealtek_test_flag(data->hdev, REALTEK_ALT6_CONTINUOUS_TX_CHIP))
2637                 set_bit(BTUSB_ALT6_CONTINUOUS_TX, &data->flags);
2638
2639         return ret;
2640 }
2641
2642 static int btusb_recv_event_realtek(struct hci_dev *hdev, struct sk_buff *skb)
2643 {
2644         if (skb->data[0] == HCI_VENDOR_PKT && skb->data[2] == RTK_SUB_EVENT_CODE_COREDUMP) {
2645                 struct rtk_dev_coredump_hdr hdr = {
2646                         .code = RTK_DEVCOREDUMP_CODE_MEMDUMP,
2647                 };
2648
2649                 bt_dev_dbg(hdev, "RTL: received coredump vendor evt, len %u",
2650                         skb->len);
2651
2652                 btusb_rtl_alloc_devcoredump(hdev, &hdr, skb->data, skb->len);
2653                 kfree_skb(skb);
2654
2655                 return 0;
2656         }
2657
2658         return hci_recv_frame(hdev, skb);
2659 }
2660
2661 /* UHW CR mapping */
2662 #define MTK_BT_MISC             0x70002510
2663 #define MTK_BT_SUBSYS_RST       0x70002610
2664 #define MTK_UDMA_INT_STA_BT     0x74000024
2665 #define MTK_UDMA_INT_STA_BT1    0x74000308
2666 #define MTK_BT_WDT_STATUS       0x740003A0
2667 #define MTK_EP_RST_OPT          0x74011890
2668 #define MTK_EP_RST_IN_OUT_OPT   0x00010001
2669 #define MTK_BT_RST_DONE         0x00000100
2670 #define MTK_BT_RESET_REG_CONNV3 0x70028610
2671 #define MTK_BT_READ_DEV_ID      0x70010200
2672
2673
2674 static void btusb_mtk_wmt_recv(struct urb *urb)
2675 {
2676         struct hci_dev *hdev = urb->context;
2677         struct btusb_data *data = hci_get_drvdata(hdev);
2678         struct sk_buff *skb;
2679         int err;
2680
2681         if (urb->status == 0 && urb->actual_length > 0) {
2682                 hdev->stat.byte_rx += urb->actual_length;
2683
2684                 /* WMT event shouldn't be fragmented and the size should be
2685                  * less than HCI_WMT_MAX_EVENT_SIZE.
2686                  */
2687                 skb = bt_skb_alloc(HCI_WMT_MAX_EVENT_SIZE, GFP_ATOMIC);
2688                 if (!skb) {
2689                         hdev->stat.err_rx++;
2690                         kfree(urb->setup_packet);
2691                         return;
2692                 }
2693
2694                 hci_skb_pkt_type(skb) = HCI_EVENT_PKT;
2695                 skb_put_data(skb, urb->transfer_buffer, urb->actual_length);
2696
2697                 /* When someone waits for the WMT event, the skb is being cloned
2698                  * and being processed the events from there then.
2699                  */
2700                 if (test_bit(BTUSB_TX_WAIT_VND_EVT, &data->flags)) {
2701                         data->evt_skb = skb_clone(skb, GFP_ATOMIC);
2702                         if (!data->evt_skb) {
2703                                 kfree_skb(skb);
2704                                 kfree(urb->setup_packet);
2705                                 return;
2706                         }
2707                 }
2708
2709                 err = hci_recv_frame(hdev, skb);
2710                 if (err < 0) {
2711                         kfree_skb(data->evt_skb);
2712                         data->evt_skb = NULL;
2713                         kfree(urb->setup_packet);
2714                         return;
2715                 }
2716
2717                 if (test_and_clear_bit(BTUSB_TX_WAIT_VND_EVT,
2718                                        &data->flags)) {
2719                         /* Barrier to sync with other CPUs */
2720                         smp_mb__after_atomic();
2721                         wake_up_bit(&data->flags,
2722                                     BTUSB_TX_WAIT_VND_EVT);
2723                 }
2724                 kfree(urb->setup_packet);
2725                 return;
2726         } else if (urb->status == -ENOENT) {
2727                 /* Avoid suspend failed when usb_kill_urb */
2728                 return;
2729         }
2730
2731         usb_mark_last_busy(data->udev);
2732
2733         /* The URB complete handler is still called with urb->actual_length = 0
2734          * when the event is not available, so we should keep re-submitting
2735          * URB until WMT event returns, Also, It's necessary to wait some time
2736          * between the two consecutive control URBs to relax the target device
2737          * to generate the event. Otherwise, the WMT event cannot return from
2738          * the device successfully.
2739          */
2740         udelay(500);
2741
2742         usb_anchor_urb(urb, &data->ctrl_anchor);
2743         err = usb_submit_urb(urb, GFP_ATOMIC);
2744         if (err < 0) {
2745                 kfree(urb->setup_packet);
2746                 /* -EPERM: urb is being killed;
2747                  * -ENODEV: device got disconnected
2748                  */
2749                 if (err != -EPERM && err != -ENODEV)
2750                         bt_dev_err(hdev, "urb %p failed to resubmit (%d)",
2751                                    urb, -err);
2752                 usb_unanchor_urb(urb);
2753         }
2754 }
2755
2756 static int btusb_mtk_submit_wmt_recv_urb(struct hci_dev *hdev)
2757 {
2758         struct btusb_data *data = hci_get_drvdata(hdev);
2759         struct usb_ctrlrequest *dr;
2760         unsigned char *buf;
2761         int err, size = 64;
2762         unsigned int pipe;
2763         struct urb *urb;
2764
2765         urb = usb_alloc_urb(0, GFP_KERNEL);
2766         if (!urb)
2767                 return -ENOMEM;
2768
2769         dr = kmalloc(sizeof(*dr), GFP_KERNEL);
2770         if (!dr) {
2771                 usb_free_urb(urb);
2772                 return -ENOMEM;
2773         }
2774
2775         dr->bRequestType = USB_TYPE_VENDOR | USB_DIR_IN;
2776         dr->bRequest     = 1;
2777         dr->wIndex       = cpu_to_le16(0);
2778         dr->wValue       = cpu_to_le16(48);
2779         dr->wLength      = cpu_to_le16(size);
2780
2781         buf = kmalloc(size, GFP_KERNEL);
2782         if (!buf) {
2783                 kfree(dr);
2784                 usb_free_urb(urb);
2785                 return -ENOMEM;
2786         }
2787
2788         pipe = usb_rcvctrlpipe(data->udev, 0);
2789
2790         usb_fill_control_urb(urb, data->udev, pipe, (void *)dr,
2791                              buf, size, btusb_mtk_wmt_recv, hdev);
2792
2793         urb->transfer_flags |= URB_FREE_BUFFER;
2794
2795         usb_anchor_urb(urb, &data->ctrl_anchor);
2796         err = usb_submit_urb(urb, GFP_KERNEL);
2797         if (err < 0) {
2798                 if (err != -EPERM && err != -ENODEV)
2799                         bt_dev_err(hdev, "urb %p submission failed (%d)",
2800                                    urb, -err);
2801                 usb_unanchor_urb(urb);
2802         }
2803
2804         usb_free_urb(urb);
2805
2806         return err;
2807 }
2808
2809 static int btusb_mtk_hci_wmt_sync(struct hci_dev *hdev,
2810                                   struct btmtk_hci_wmt_params *wmt_params)
2811 {
2812         struct btusb_data *data = hci_get_drvdata(hdev);
2813         struct btmtk_hci_wmt_evt_funcc *wmt_evt_funcc;
2814         u32 hlen, status = BTMTK_WMT_INVALID;
2815         struct btmtk_hci_wmt_evt *wmt_evt;
2816         struct btmtk_hci_wmt_cmd *wc;
2817         struct btmtk_wmt_hdr *hdr;
2818         int err;
2819
2820         /* Send the WMT command and wait until the WMT event returns */
2821         hlen = sizeof(*hdr) + wmt_params->dlen;
2822         if (hlen > 255)
2823                 return -EINVAL;
2824
2825         wc = kzalloc(hlen, GFP_KERNEL);
2826         if (!wc)
2827                 return -ENOMEM;
2828
2829         hdr = &wc->hdr;
2830         hdr->dir = 1;
2831         hdr->op = wmt_params->op;
2832         hdr->dlen = cpu_to_le16(wmt_params->dlen + 1);
2833         hdr->flag = wmt_params->flag;
2834         memcpy(wc->data, wmt_params->data, wmt_params->dlen);
2835
2836         set_bit(BTUSB_TX_WAIT_VND_EVT, &data->flags);
2837
2838         /* WMT cmd/event doesn't follow up the generic HCI cmd/event handling,
2839          * it needs constantly polling control pipe until the host received the
2840          * WMT event, thus, we should require to specifically acquire PM counter
2841          * on the USB to prevent the interface from entering auto suspended
2842          * while WMT cmd/event in progress.
2843          */
2844         err = usb_autopm_get_interface(data->intf);
2845         if (err < 0)
2846                 goto err_free_wc;
2847
2848         err = __hci_cmd_send(hdev, 0xfc6f, hlen, wc);
2849
2850         if (err < 0) {
2851                 clear_bit(BTUSB_TX_WAIT_VND_EVT, &data->flags);
2852                 usb_autopm_put_interface(data->intf);
2853                 goto err_free_wc;
2854         }
2855
2856         /* Submit control IN URB on demand to process the WMT event */
2857         err = btusb_mtk_submit_wmt_recv_urb(hdev);
2858
2859         usb_autopm_put_interface(data->intf);
2860
2861         if (err < 0)
2862                 goto err_free_wc;
2863
2864         /* The vendor specific WMT commands are all answered by a vendor
2865          * specific event and will have the Command Status or Command
2866          * Complete as with usual HCI command flow control.
2867          *
2868          * After sending the command, wait for BTUSB_TX_WAIT_VND_EVT
2869          * state to be cleared. The driver specific event receive routine
2870          * will clear that state and with that indicate completion of the
2871          * WMT command.
2872          */
2873         err = wait_on_bit_timeout(&data->flags, BTUSB_TX_WAIT_VND_EVT,
2874                                   TASK_INTERRUPTIBLE, HCI_INIT_TIMEOUT);
2875         if (err == -EINTR) {
2876                 bt_dev_err(hdev, "Execution of wmt command interrupted");
2877                 clear_bit(BTUSB_TX_WAIT_VND_EVT, &data->flags);
2878                 goto err_free_wc;
2879         }
2880
2881         if (err) {
2882                 bt_dev_err(hdev, "Execution of wmt command timed out");
2883                 clear_bit(BTUSB_TX_WAIT_VND_EVT, &data->flags);
2884                 err = -ETIMEDOUT;
2885                 goto err_free_wc;
2886         }
2887
2888         /* Parse and handle the return WMT event */
2889         wmt_evt = (struct btmtk_hci_wmt_evt *)data->evt_skb->data;
2890         if (wmt_evt->whdr.op != hdr->op) {
2891                 bt_dev_err(hdev, "Wrong op received %d expected %d",
2892                            wmt_evt->whdr.op, hdr->op);
2893                 err = -EIO;
2894                 goto err_free_skb;
2895         }
2896
2897         switch (wmt_evt->whdr.op) {
2898         case BTMTK_WMT_SEMAPHORE:
2899                 if (wmt_evt->whdr.flag == 2)
2900                         status = BTMTK_WMT_PATCH_UNDONE;
2901                 else
2902                         status = BTMTK_WMT_PATCH_DONE;
2903                 break;
2904         case BTMTK_WMT_FUNC_CTRL:
2905                 wmt_evt_funcc = (struct btmtk_hci_wmt_evt_funcc *)wmt_evt;
2906                 if (be16_to_cpu(wmt_evt_funcc->status) == 0x404)
2907                         status = BTMTK_WMT_ON_DONE;
2908                 else if (be16_to_cpu(wmt_evt_funcc->status) == 0x420)
2909                         status = BTMTK_WMT_ON_PROGRESS;
2910                 else
2911                         status = BTMTK_WMT_ON_UNDONE;
2912                 break;
2913         case BTMTK_WMT_PATCH_DWNLD:
2914                 if (wmt_evt->whdr.flag == 2)
2915                         status = BTMTK_WMT_PATCH_DONE;
2916                 else if (wmt_evt->whdr.flag == 1)
2917                         status = BTMTK_WMT_PATCH_PROGRESS;
2918                 else
2919                         status = BTMTK_WMT_PATCH_UNDONE;
2920                 break;
2921         }
2922
2923         if (wmt_params->status)
2924                 *wmt_params->status = status;
2925
2926 err_free_skb:
2927         kfree_skb(data->evt_skb);
2928         data->evt_skb = NULL;
2929 err_free_wc:
2930         kfree(wc);
2931         return err;
2932 }
2933
2934 static int btusb_mtk_func_query(struct hci_dev *hdev)
2935 {
2936         struct btmtk_hci_wmt_params wmt_params;
2937         int status, err;
2938         u8 param = 0;
2939
2940         /* Query whether the function is enabled */
2941         wmt_params.op = BTMTK_WMT_FUNC_CTRL;
2942         wmt_params.flag = 4;
2943         wmt_params.dlen = sizeof(param);
2944         wmt_params.data = &param;
2945         wmt_params.status = &status;
2946
2947         err = btusb_mtk_hci_wmt_sync(hdev, &wmt_params);
2948         if (err < 0) {
2949                 bt_dev_err(hdev, "Failed to query function status (%d)", err);
2950                 return err;
2951         }
2952
2953         return status;
2954 }
2955
2956 static int btusb_mtk_uhw_reg_write(struct btusb_data *data, u32 reg, u32 val)
2957 {
2958         struct hci_dev *hdev = data->hdev;
2959         int pipe, err;
2960         void *buf;
2961
2962         buf = kzalloc(4, GFP_KERNEL);
2963         if (!buf)
2964                 return -ENOMEM;
2965
2966         put_unaligned_le32(val, buf);
2967
2968         pipe = usb_sndctrlpipe(data->udev, 0);
2969         err = usb_control_msg(data->udev, pipe, 0x02,
2970                               0x5E,
2971                               reg >> 16, reg & 0xffff,
2972                               buf, 4, USB_CTRL_SET_TIMEOUT);
2973         if (err < 0) {
2974                 bt_dev_err(hdev, "Failed to write uhw reg(%d)", err);
2975                 goto err_free_buf;
2976         }
2977
2978 err_free_buf:
2979         kfree(buf);
2980
2981         return err;
2982 }
2983
2984 static int btusb_mtk_uhw_reg_read(struct btusb_data *data, u32 reg, u32 *val)
2985 {
2986         struct hci_dev *hdev = data->hdev;
2987         int pipe, err;
2988         void *buf;
2989
2990         buf = kzalloc(4, GFP_KERNEL);
2991         if (!buf)
2992                 return -ENOMEM;
2993
2994         pipe = usb_rcvctrlpipe(data->udev, 0);
2995         err = usb_control_msg(data->udev, pipe, 0x01,
2996                               0xDE,
2997                               reg >> 16, reg & 0xffff,
2998                               buf, 4, USB_CTRL_SET_TIMEOUT);
2999         if (err < 0) {
3000                 bt_dev_err(hdev, "Failed to read uhw reg(%d)", err);
3001                 goto err_free_buf;
3002         }
3003
3004         *val = get_unaligned_le32(buf);
3005         bt_dev_dbg(hdev, "reg=%x, value=0x%08x", reg, *val);
3006
3007 err_free_buf:
3008         kfree(buf);
3009
3010         return err;
3011 }
3012
3013 static int btusb_mtk_reg_read(struct btusb_data *data, u32 reg, u32 *val)
3014 {
3015         int pipe, err, size = sizeof(u32);
3016         void *buf;
3017
3018         buf = kzalloc(size, GFP_KERNEL);
3019         if (!buf)
3020                 return -ENOMEM;
3021
3022         pipe = usb_rcvctrlpipe(data->udev, 0);
3023         err = usb_control_msg(data->udev, pipe, 0x63,
3024                               USB_TYPE_VENDOR | USB_DIR_IN,
3025                               reg >> 16, reg & 0xffff,
3026                               buf, size, USB_CTRL_SET_TIMEOUT);
3027         if (err < 0)
3028                 goto err_free_buf;
3029
3030         *val = get_unaligned_le32(buf);
3031
3032 err_free_buf:
3033         kfree(buf);
3034
3035         return err;
3036 }
3037
3038 static int btusb_mtk_id_get(struct btusb_data *data, u32 reg, u32 *id)
3039 {
3040         return btusb_mtk_reg_read(data, reg, id);
3041 }
3042
3043 static u32 btusb_mtk_reset_done(struct hci_dev *hdev)
3044 {
3045         struct btusb_data *data = hci_get_drvdata(hdev);
3046         u32 val = 0;
3047
3048         btusb_mtk_uhw_reg_read(data, MTK_BT_MISC, &val);
3049
3050         return val & MTK_BT_RST_DONE;
3051 }
3052
3053 static int btusb_mtk_reset(struct hci_dev *hdev, void *rst_data)
3054 {
3055         struct btusb_data *data = hci_get_drvdata(hdev);
3056         struct btmediatek_data *mediatek;
3057         u32 val;
3058         int err;
3059
3060         /* It's MediaTek specific bluetooth reset mechanism via USB */
3061         if (test_and_set_bit(BTUSB_HW_RESET_ACTIVE, &data->flags)) {
3062                 bt_dev_err(hdev, "last reset failed? Not resetting again");
3063                 return -EBUSY;
3064         }
3065
3066         err = usb_autopm_get_interface(data->intf);
3067         if (err < 0)
3068                 return err;
3069
3070         btusb_stop_traffic(data);
3071         usb_kill_anchored_urbs(&data->tx_anchor);
3072         mediatek = hci_get_priv(hdev);
3073
3074         if (mediatek->dev_id == 0x7925) {
3075                 btusb_mtk_uhw_reg_read(data, MTK_BT_RESET_REG_CONNV3, &val);
3076                 val |= (1 << 5);
3077                 btusb_mtk_uhw_reg_write(data, MTK_BT_RESET_REG_CONNV3, val);
3078                 btusb_mtk_uhw_reg_read(data, MTK_BT_RESET_REG_CONNV3, &val);
3079                 val &= 0xFFFF00FF;
3080                 val |= (1 << 13);
3081                 btusb_mtk_uhw_reg_write(data, MTK_BT_RESET_REG_CONNV3, val);
3082                 btusb_mtk_uhw_reg_write(data, MTK_EP_RST_OPT, 0x00010001);
3083                 btusb_mtk_uhw_reg_read(data, MTK_BT_RESET_REG_CONNV3, &val);
3084                 val |= (1 << 0);
3085                 btusb_mtk_uhw_reg_write(data, MTK_BT_RESET_REG_CONNV3, val);
3086                 btusb_mtk_uhw_reg_write(data, MTK_UDMA_INT_STA_BT, 0x000000FF);
3087                 btusb_mtk_uhw_reg_read(data, MTK_UDMA_INT_STA_BT, &val);
3088                 btusb_mtk_uhw_reg_write(data, MTK_UDMA_INT_STA_BT1, 0x000000FF);
3089                 btusb_mtk_uhw_reg_read(data, MTK_UDMA_INT_STA_BT1, &val);
3090                 msleep(100);
3091         } else {
3092                 /* It's Device EndPoint Reset Option Register */
3093                 bt_dev_dbg(hdev, "Initiating reset mechanism via uhw");
3094                 btusb_mtk_uhw_reg_write(data, MTK_EP_RST_OPT, MTK_EP_RST_IN_OUT_OPT);
3095                 btusb_mtk_uhw_reg_read(data, MTK_BT_WDT_STATUS, &val);
3096
3097                 /* Reset the bluetooth chip via USB interface. */
3098                 btusb_mtk_uhw_reg_write(data, MTK_BT_SUBSYS_RST, 1);
3099                 btusb_mtk_uhw_reg_write(data, MTK_UDMA_INT_STA_BT, 0x000000FF);
3100                 btusb_mtk_uhw_reg_read(data, MTK_UDMA_INT_STA_BT, &val);
3101                 btusb_mtk_uhw_reg_write(data, MTK_UDMA_INT_STA_BT1, 0x000000FF);
3102                 btusb_mtk_uhw_reg_read(data, MTK_UDMA_INT_STA_BT1, &val);
3103                 /* MT7921 need to delay 20ms between toggle reset bit */
3104                 msleep(20);
3105                 btusb_mtk_uhw_reg_write(data, MTK_BT_SUBSYS_RST, 0);
3106                 btusb_mtk_uhw_reg_read(data, MTK_BT_SUBSYS_RST, &val);
3107         }
3108
3109         err = readx_poll_timeout(btusb_mtk_reset_done, hdev, val,
3110                                  val & MTK_BT_RST_DONE, 20000, 1000000);
3111         if (err < 0)
3112                 bt_dev_err(hdev, "Reset timeout");
3113
3114         btusb_mtk_id_get(data, 0x70010200, &val);
3115         if (!val)
3116                 bt_dev_err(hdev, "Can't get device id, subsys reset fail.");
3117
3118         usb_queue_reset_device(data->intf);
3119
3120         clear_bit(BTUSB_HW_RESET_ACTIVE, &data->flags);
3121
3122         return err;
3123 }
3124
3125 static int btusb_mtk_setup(struct hci_dev *hdev)
3126 {
3127         struct btusb_data *data = hci_get_drvdata(hdev);
3128         struct btmtk_hci_wmt_params wmt_params;
3129         ktime_t calltime, delta, rettime;
3130         struct btmtk_tci_sleep tci_sleep;
3131         unsigned long long duration;
3132         struct sk_buff *skb;
3133         const char *fwname;
3134         int err, status;
3135         u32 dev_id = 0;
3136         char fw_bin_name[64];
3137         u32 fw_version = 0;
3138         u8 param;
3139         struct btmediatek_data *mediatek;
3140
3141         calltime = ktime_get();
3142
3143         err = btusb_mtk_id_get(data, 0x80000008, &dev_id);
3144         if (err < 0) {
3145                 bt_dev_err(hdev, "Failed to get device id (%d)", err);
3146                 return err;
3147         }
3148
3149         if (!dev_id || dev_id != 0x7663) {
3150                 err = btusb_mtk_id_get(data, 0x70010200, &dev_id);
3151                 if (err < 0) {
3152                         bt_dev_err(hdev, "Failed to get device id (%d)", err);
3153                         return err;
3154                 }
3155                 err = btusb_mtk_id_get(data, 0x80021004, &fw_version);
3156                 if (err < 0) {
3157                         bt_dev_err(hdev, "Failed to get fw version (%d)", err);
3158                         return err;
3159                 }
3160         }
3161
3162         mediatek = hci_get_priv(hdev);
3163         mediatek->dev_id = dev_id;
3164         mediatek->reset_sync = btusb_mtk_reset;
3165
3166         err = btmtk_register_coredump(hdev, btusb_driver.name, fw_version);
3167         if (err < 0)
3168                 bt_dev_err(hdev, "Failed to register coredump (%d)", err);
3169
3170         switch (dev_id) {
3171         case 0x7663:
3172                 fwname = FIRMWARE_MT7663;
3173                 break;
3174         case 0x7668:
3175                 fwname = FIRMWARE_MT7668;
3176                 break;
3177         case 0x7922:
3178         case 0x7961:
3179         case 0x7925:
3180                 if (dev_id == 0x7925)
3181                         snprintf(fw_bin_name, sizeof(fw_bin_name),
3182                                  "mediatek/mt%04x/BT_RAM_CODE_MT%04x_1_%x_hdr.bin",
3183                                  dev_id & 0xffff, dev_id & 0xffff, (fw_version & 0xff) + 1);
3184                 else
3185                         snprintf(fw_bin_name, sizeof(fw_bin_name),
3186                                  "mediatek/BT_RAM_CODE_MT%04x_1_%x_hdr.bin",
3187                                  dev_id & 0xffff, (fw_version & 0xff) + 1);
3188
3189                 err = btmtk_setup_firmware_79xx(hdev, fw_bin_name,
3190                                                 btusb_mtk_hci_wmt_sync);
3191                 if (err < 0) {
3192                         bt_dev_err(hdev, "Failed to set up firmware (%d)", err);
3193                         return err;
3194                 }
3195
3196                 /* It's Device EndPoint Reset Option Register */
3197                 btusb_mtk_uhw_reg_write(data, MTK_EP_RST_OPT, MTK_EP_RST_IN_OUT_OPT);
3198
3199                 /* Enable Bluetooth protocol */
3200                 param = 1;
3201                 wmt_params.op = BTMTK_WMT_FUNC_CTRL;
3202                 wmt_params.flag = 0;
3203                 wmt_params.dlen = sizeof(param);
3204                 wmt_params.data = &param;
3205                 wmt_params.status = NULL;
3206
3207                 err = btusb_mtk_hci_wmt_sync(hdev, &wmt_params);
3208                 if (err < 0) {
3209                         bt_dev_err(hdev, "Failed to send wmt func ctrl (%d)", err);
3210                         return err;
3211                 }
3212
3213                 hci_set_msft_opcode(hdev, 0xFD30);
3214                 hci_set_aosp_capable(hdev);
3215                 goto done;
3216         default:
3217                 bt_dev_err(hdev, "Unsupported hardware variant (%08x)",
3218                            dev_id);
3219                 return -ENODEV;
3220         }
3221
3222         /* Query whether the firmware is already download */
3223         wmt_params.op = BTMTK_WMT_SEMAPHORE;
3224         wmt_params.flag = 1;
3225         wmt_params.dlen = 0;
3226         wmt_params.data = NULL;
3227         wmt_params.status = &status;
3228
3229         err = btusb_mtk_hci_wmt_sync(hdev, &wmt_params);
3230         if (err < 0) {
3231                 bt_dev_err(hdev, "Failed to query firmware status (%d)", err);
3232                 return err;
3233         }
3234
3235         if (status == BTMTK_WMT_PATCH_DONE) {
3236                 bt_dev_info(hdev, "firmware already downloaded");
3237                 goto ignore_setup_fw;
3238         }
3239
3240         /* Setup a firmware which the device definitely requires */
3241         err = btmtk_setup_firmware(hdev, fwname,
3242                                    btusb_mtk_hci_wmt_sync);
3243         if (err < 0)
3244                 return err;
3245
3246 ignore_setup_fw:
3247         err = readx_poll_timeout(btusb_mtk_func_query, hdev, status,
3248                                  status < 0 || status != BTMTK_WMT_ON_PROGRESS,
3249                                  2000, 5000000);
3250         /* -ETIMEDOUT happens */
3251         if (err < 0)
3252                 return err;
3253
3254         /* The other errors happen in btusb_mtk_func_query */
3255         if (status < 0)
3256                 return status;
3257
3258         if (status == BTMTK_WMT_ON_DONE) {
3259                 bt_dev_info(hdev, "function already on");
3260                 goto ignore_func_on;
3261         }
3262
3263         /* Enable Bluetooth protocol */
3264         param = 1;
3265         wmt_params.op = BTMTK_WMT_FUNC_CTRL;
3266         wmt_params.flag = 0;
3267         wmt_params.dlen = sizeof(param);
3268         wmt_params.data = &param;
3269         wmt_params.status = NULL;
3270
3271         err = btusb_mtk_hci_wmt_sync(hdev, &wmt_params);
3272         if (err < 0) {
3273                 bt_dev_err(hdev, "Failed to send wmt func ctrl (%d)", err);
3274                 return err;
3275         }
3276
3277 ignore_func_on:
3278         /* Apply the low power environment setup */
3279         tci_sleep.mode = 0x5;
3280         tci_sleep.duration = cpu_to_le16(0x640);
3281         tci_sleep.host_duration = cpu_to_le16(0x640);
3282         tci_sleep.host_wakeup_pin = 0;
3283         tci_sleep.time_compensation = 0;
3284
3285         skb = __hci_cmd_sync(hdev, 0xfc7a, sizeof(tci_sleep), &tci_sleep,
3286                              HCI_INIT_TIMEOUT);
3287         if (IS_ERR(skb)) {
3288                 err = PTR_ERR(skb);
3289                 bt_dev_err(hdev, "Failed to apply low power setting (%d)", err);
3290                 return err;
3291         }
3292         kfree_skb(skb);
3293
3294 done:
3295         rettime = ktime_get();
3296         delta = ktime_sub(rettime, calltime);
3297         duration = (unsigned long long)ktime_to_ns(delta) >> 10;
3298
3299         bt_dev_info(hdev, "Device setup in %llu usecs", duration);
3300
3301         return 0;
3302 }
3303
3304 static int btusb_mtk_shutdown(struct hci_dev *hdev)
3305 {
3306         struct btmtk_hci_wmt_params wmt_params;
3307         u8 param = 0;
3308         int err;
3309
3310         /* Disable the device */
3311         wmt_params.op = BTMTK_WMT_FUNC_CTRL;
3312         wmt_params.flag = 0;
3313         wmt_params.dlen = sizeof(param);
3314         wmt_params.data = &param;
3315         wmt_params.status = NULL;
3316
3317         err = btusb_mtk_hci_wmt_sync(hdev, &wmt_params);
3318         if (err < 0) {
3319                 bt_dev_err(hdev, "Failed to send wmt func ctrl (%d)", err);
3320                 return err;
3321         }
3322
3323         return 0;
3324 }
3325
3326 static int btusb_recv_acl_mtk(struct hci_dev *hdev, struct sk_buff *skb)
3327 {
3328         struct btusb_data *data = hci_get_drvdata(hdev);
3329         u16 handle = le16_to_cpu(hci_acl_hdr(skb)->handle);
3330         struct sk_buff *skb_cd;
3331
3332         switch (handle) {
3333         case 0xfc6f:            /* Firmware dump from device */
3334                 /* When the firmware hangs, the device can no longer
3335                  * suspend and thus disable auto-suspend.
3336                  */
3337                 usb_disable_autosuspend(data->udev);
3338
3339                 /* We need to forward the diagnostic packet to userspace daemon
3340                  * for backward compatibility, so we have to clone the packet
3341                  * extraly for the in-kernel coredump support.
3342                  */
3343                 skb_cd = skb_clone(skb, GFP_ATOMIC);
3344                 if (skb_cd)
3345                         btmtk_process_coredump(hdev, skb_cd);
3346
3347                 fallthrough;
3348         case 0x05ff:            /* Firmware debug logging 1 */
3349         case 0x05fe:            /* Firmware debug logging 2 */
3350                 return hci_recv_diag(hdev, skb);
3351         }
3352
3353         return hci_recv_frame(hdev, skb);
3354 }
3355
3356 #ifdef CONFIG_PM
3357 /* Configure an out-of-band gpio as wake-up pin, if specified in device tree */
3358 static int marvell_config_oob_wake(struct hci_dev *hdev)
3359 {
3360         struct sk_buff *skb;
3361         struct btusb_data *data = hci_get_drvdata(hdev);
3362         struct device *dev = &data->udev->dev;
3363         u16 pin, gap, opcode;
3364         int ret;
3365         u8 cmd[5];
3366
3367         /* Move on if no wakeup pin specified */
3368         if (of_property_read_u16(dev->of_node, "marvell,wakeup-pin", &pin) ||
3369             of_property_read_u16(dev->of_node, "marvell,wakeup-gap-ms", &gap))
3370                 return 0;
3371
3372         /* Vendor specific command to configure a GPIO as wake-up pin */
3373         opcode = hci_opcode_pack(0x3F, 0x59);
3374         cmd[0] = opcode & 0xFF;
3375         cmd[1] = opcode >> 8;
3376         cmd[2] = 2; /* length of parameters that follow */
3377         cmd[3] = pin;
3378         cmd[4] = gap; /* time in ms, for which wakeup pin should be asserted */
3379
3380         skb = bt_skb_alloc(sizeof(cmd), GFP_KERNEL);
3381         if (!skb) {
3382                 bt_dev_err(hdev, "%s: No memory", __func__);
3383                 return -ENOMEM;
3384         }
3385
3386         skb_put_data(skb, cmd, sizeof(cmd));
3387         hci_skb_pkt_type(skb) = HCI_COMMAND_PKT;
3388
3389         ret = btusb_send_frame(hdev, skb);
3390         if (ret) {
3391                 bt_dev_err(hdev, "%s: configuration failed", __func__);
3392                 kfree_skb(skb);
3393                 return ret;
3394         }
3395
3396         return 0;
3397 }
3398 #endif
3399
3400 static int btusb_set_bdaddr_marvell(struct hci_dev *hdev,
3401                                     const bdaddr_t *bdaddr)
3402 {
3403         struct sk_buff *skb;
3404         u8 buf[8];
3405         long ret;
3406
3407         buf[0] = 0xfe;
3408         buf[1] = sizeof(bdaddr_t);
3409         memcpy(buf + 2, bdaddr, sizeof(bdaddr_t));
3410
3411         skb = __hci_cmd_sync(hdev, 0xfc22, sizeof(buf), buf, HCI_INIT_TIMEOUT);
3412         if (IS_ERR(skb)) {
3413                 ret = PTR_ERR(skb);
3414                 bt_dev_err(hdev, "changing Marvell device address failed (%ld)",
3415                            ret);
3416                 return ret;
3417         }
3418         kfree_skb(skb);
3419
3420         return 0;
3421 }
3422
3423 static int btusb_set_bdaddr_ath3012(struct hci_dev *hdev,
3424                                     const bdaddr_t *bdaddr)
3425 {
3426         struct sk_buff *skb;
3427         u8 buf[10];
3428         long ret;
3429
3430         buf[0] = 0x01;
3431         buf[1] = 0x01;
3432         buf[2] = 0x00;
3433         buf[3] = sizeof(bdaddr_t);
3434         memcpy(buf + 4, bdaddr, sizeof(bdaddr_t));
3435
3436         skb = __hci_cmd_sync(hdev, 0xfc0b, sizeof(buf), buf, HCI_INIT_TIMEOUT);
3437         if (IS_ERR(skb)) {
3438                 ret = PTR_ERR(skb);
3439                 bt_dev_err(hdev, "Change address command failed (%ld)", ret);
3440                 return ret;
3441         }
3442         kfree_skb(skb);
3443
3444         return 0;
3445 }
3446
3447 static int btusb_set_bdaddr_wcn6855(struct hci_dev *hdev,
3448                                 const bdaddr_t *bdaddr)
3449 {
3450         struct sk_buff *skb;
3451         u8 buf[6];
3452         long ret;
3453
3454         memcpy(buf, bdaddr, sizeof(bdaddr_t));
3455
3456         skb = __hci_cmd_sync_ev(hdev, 0xfc14, sizeof(buf), buf,
3457                                 HCI_EV_CMD_COMPLETE, HCI_INIT_TIMEOUT);
3458         if (IS_ERR(skb)) {
3459                 ret = PTR_ERR(skb);
3460                 bt_dev_err(hdev, "Change address command failed (%ld)", ret);
3461                 return ret;
3462         }
3463         kfree_skb(skb);
3464
3465         return 0;
3466 }
3467
3468 #define QCA_MEMDUMP_ACL_HANDLE 0x2EDD
3469 #define QCA_MEMDUMP_SIZE_MAX  0x100000
3470 #define QCA_MEMDUMP_VSE_CLASS 0x01
3471 #define QCA_MEMDUMP_MSG_TYPE 0x08
3472 #define QCA_MEMDUMP_PKT_SIZE 248
3473 #define QCA_LAST_SEQUENCE_NUM 0xffff
3474
3475 struct qca_dump_hdr {
3476         u8 vse_class;
3477         u8 msg_type;
3478         __le16 seqno;
3479         u8 reserved;
3480         union {
3481                 u8 data[0];
3482                 struct {
3483                         __le32 ram_dump_size;
3484                         u8 data0[0];
3485                 } __packed;
3486         };
3487 } __packed;
3488
3489
3490 static void btusb_dump_hdr_qca(struct hci_dev *hdev, struct sk_buff *skb)
3491 {
3492         char buf[128];
3493         struct btusb_data *btdata = hci_get_drvdata(hdev);
3494
3495         snprintf(buf, sizeof(buf), "Controller Name: 0x%x\n",
3496                         btdata->qca_dump.controller_id);
3497         skb_put_data(skb, buf, strlen(buf));
3498
3499         snprintf(buf, sizeof(buf), "Firmware Version: 0x%x\n",
3500                         btdata->qca_dump.fw_version);
3501         skb_put_data(skb, buf, strlen(buf));
3502
3503         snprintf(buf, sizeof(buf), "Driver: %s\nVendor: qca\n",
3504                         btusb_driver.name);
3505         skb_put_data(skb, buf, strlen(buf));
3506
3507         snprintf(buf, sizeof(buf), "VID: 0x%x\nPID:0x%x\n",
3508                         btdata->qca_dump.id_vendor, btdata->qca_dump.id_product);
3509         skb_put_data(skb, buf, strlen(buf));
3510
3511         snprintf(buf, sizeof(buf), "Lmp Subversion: 0x%x\n",
3512                         hdev->lmp_subver);
3513         skb_put_data(skb, buf, strlen(buf));
3514 }
3515
3516 static void btusb_coredump_qca(struct hci_dev *hdev)
3517 {
3518         static const u8 param[] = { 0x26 };
3519         struct sk_buff *skb;
3520
3521         skb = __hci_cmd_sync(hdev, 0xfc0c, 1, param, HCI_CMD_TIMEOUT);
3522         if (IS_ERR(skb))
3523                 bt_dev_err(hdev, "%s: triggle crash failed (%ld)", __func__, PTR_ERR(skb));
3524         kfree_skb(skb);
3525 }
3526
3527 /*
3528  * ==0: not a dump pkt.
3529  * < 0: fails to handle a dump pkt
3530  * > 0: otherwise.
3531  */
3532 static int handle_dump_pkt_qca(struct hci_dev *hdev, struct sk_buff *skb)
3533 {
3534         int ret = 1;
3535         u8 pkt_type;
3536         u8 *sk_ptr;
3537         unsigned int sk_len;
3538         u16 seqno;
3539         u32 dump_size;
3540
3541         struct hci_event_hdr *event_hdr;
3542         struct hci_acl_hdr *acl_hdr;
3543         struct qca_dump_hdr *dump_hdr;
3544         struct btusb_data *btdata = hci_get_drvdata(hdev);
3545         struct usb_device *udev = btdata->udev;
3546
3547         pkt_type = hci_skb_pkt_type(skb);
3548         sk_ptr = skb->data;
3549         sk_len = skb->len;
3550
3551         if (pkt_type == HCI_ACLDATA_PKT) {
3552                 acl_hdr = hci_acl_hdr(skb);
3553                 if (le16_to_cpu(acl_hdr->handle) != QCA_MEMDUMP_ACL_HANDLE)
3554                         return 0;
3555                 sk_ptr += HCI_ACL_HDR_SIZE;
3556                 sk_len -= HCI_ACL_HDR_SIZE;
3557                 event_hdr = (struct hci_event_hdr *)sk_ptr;
3558         } else {
3559                 event_hdr = hci_event_hdr(skb);
3560         }
3561
3562         if ((event_hdr->evt != HCI_VENDOR_PKT)
3563                 || (event_hdr->plen != (sk_len - HCI_EVENT_HDR_SIZE)))
3564                 return 0;
3565
3566         sk_ptr += HCI_EVENT_HDR_SIZE;
3567         sk_len -= HCI_EVENT_HDR_SIZE;
3568
3569         dump_hdr = (struct qca_dump_hdr *)sk_ptr;
3570         if ((sk_len < offsetof(struct qca_dump_hdr, data))
3571                 || (dump_hdr->vse_class != QCA_MEMDUMP_VSE_CLASS)
3572             || (dump_hdr->msg_type != QCA_MEMDUMP_MSG_TYPE))
3573                 return 0;
3574
3575         /*it is dump pkt now*/
3576         seqno = le16_to_cpu(dump_hdr->seqno);
3577         if (seqno == 0) {
3578                 set_bit(BTUSB_HW_SSR_ACTIVE, &btdata->flags);
3579                 dump_size = le32_to_cpu(dump_hdr->ram_dump_size);
3580                 if (!dump_size || (dump_size > QCA_MEMDUMP_SIZE_MAX)) {
3581                         ret = -EILSEQ;
3582                         bt_dev_err(hdev, "Invalid memdump size(%u)",
3583                                    dump_size);
3584                         goto out;
3585                 }
3586
3587                 ret = hci_devcd_init(hdev, dump_size);
3588                 if (ret < 0) {
3589                         bt_dev_err(hdev, "memdump init error(%d)", ret);
3590                         goto out;
3591                 }
3592
3593                 btdata->qca_dump.ram_dump_size = dump_size;
3594                 btdata->qca_dump.ram_dump_seqno = 0;
3595                 sk_ptr += offsetof(struct qca_dump_hdr, data0);
3596                 sk_len -= offsetof(struct qca_dump_hdr, data0);
3597
3598                 usb_disable_autosuspend(udev);
3599                 bt_dev_info(hdev, "%s memdump size(%u)\n",
3600                             (pkt_type == HCI_ACLDATA_PKT) ? "ACL" : "event",
3601                             dump_size);
3602         } else {
3603                 sk_ptr += offsetof(struct qca_dump_hdr, data);
3604                 sk_len -= offsetof(struct qca_dump_hdr, data);
3605         }
3606
3607         if (!btdata->qca_dump.ram_dump_size) {
3608                 ret = -EINVAL;
3609                 bt_dev_err(hdev, "memdump is not active");
3610                 goto out;
3611         }
3612
3613         if ((seqno > btdata->qca_dump.ram_dump_seqno + 1) && (seqno != QCA_LAST_SEQUENCE_NUM)) {
3614                 dump_size = QCA_MEMDUMP_PKT_SIZE * (seqno - btdata->qca_dump.ram_dump_seqno - 1);
3615                 hci_devcd_append_pattern(hdev, 0x0, dump_size);
3616                 bt_dev_err(hdev,
3617                            "expected memdump seqno(%u) is not received(%u)\n",
3618                            btdata->qca_dump.ram_dump_seqno, seqno);
3619                 btdata->qca_dump.ram_dump_seqno = seqno;
3620                 kfree_skb(skb);
3621                 return ret;
3622         }
3623
3624         skb_pull(skb, skb->len - sk_len);
3625         hci_devcd_append(hdev, skb);
3626         btdata->qca_dump.ram_dump_seqno++;
3627         if (seqno == QCA_LAST_SEQUENCE_NUM) {
3628                 bt_dev_info(hdev,
3629                                 "memdump done: pkts(%u), total(%u)\n",
3630                                 btdata->qca_dump.ram_dump_seqno, btdata->qca_dump.ram_dump_size);
3631
3632                 hci_devcd_complete(hdev);
3633                 goto out;
3634         }
3635         return ret;
3636
3637 out:
3638         if (btdata->qca_dump.ram_dump_size)
3639                 usb_enable_autosuspend(udev);
3640         btdata->qca_dump.ram_dump_size = 0;
3641         btdata->qca_dump.ram_dump_seqno = 0;
3642         clear_bit(BTUSB_HW_SSR_ACTIVE, &btdata->flags);
3643
3644         if (ret < 0)
3645                 kfree_skb(skb);
3646         return ret;
3647 }
3648
3649 static int btusb_recv_acl_qca(struct hci_dev *hdev, struct sk_buff *skb)
3650 {
3651         if (handle_dump_pkt_qca(hdev, skb))
3652                 return 0;
3653         return hci_recv_frame(hdev, skb);
3654 }
3655
3656 static int btusb_recv_evt_qca(struct hci_dev *hdev, struct sk_buff *skb)
3657 {
3658         if (handle_dump_pkt_qca(hdev, skb))
3659                 return 0;
3660         return hci_recv_frame(hdev, skb);
3661 }
3662
3663
3664 #define QCA_DFU_PACKET_LEN      4096
3665
3666 #define QCA_GET_TARGET_VERSION  0x09
3667 #define QCA_CHECK_STATUS        0x05
3668 #define QCA_DFU_DOWNLOAD        0x01
3669
3670 #define QCA_SYSCFG_UPDATED      0x40
3671 #define QCA_PATCH_UPDATED       0x80
3672 #define QCA_DFU_TIMEOUT         3000
3673 #define QCA_FLAG_MULTI_NVM      0x80
3674 #define QCA_BT_RESET_WAIT_MS    100
3675
3676 #define WCN6855_2_0_RAM_VERSION_GF 0x400c1200
3677 #define WCN6855_2_1_RAM_VERSION_GF 0x400c1211
3678
3679 struct qca_version {
3680         __le32  rom_version;
3681         __le32  patch_version;
3682         __le32  ram_version;
3683         __u8    chip_id;
3684         __u8    platform_id;
3685         __le16  flag;
3686         __u8    reserved[4];
3687 } __packed;
3688
3689 struct qca_rampatch_version {
3690         __le16  rom_version_high;
3691         __le16  rom_version_low;
3692         __le16  patch_version;
3693 } __packed;
3694
3695 struct qca_device_info {
3696         u32     rom_version;
3697         u8      rampatch_hdr;   /* length of header in rampatch */
3698         u8      nvm_hdr;        /* length of header in NVM */
3699         u8      ver_offset;     /* offset of version structure in rampatch */
3700 };
3701
3702 static const struct qca_device_info qca_devices_table[] = {
3703         { 0x00000100, 20, 4,  8 }, /* Rome 1.0 */
3704         { 0x00000101, 20, 4,  8 }, /* Rome 1.1 */
3705         { 0x00000200, 28, 4, 16 }, /* Rome 2.0 */
3706         { 0x00000201, 28, 4, 16 }, /* Rome 2.1 */
3707         { 0x00000300, 28, 4, 16 }, /* Rome 3.0 */
3708         { 0x00000302, 28, 4, 16 }, /* Rome 3.2 */
3709         { 0x00130100, 40, 4, 16 }, /* WCN6855 1.0 */
3710         { 0x00130200, 40, 4, 16 }, /* WCN6855 2.0 */
3711         { 0x00130201, 40, 4, 16 }, /* WCN6855 2.1 */
3712         { 0x00190200, 40, 4, 16 }, /* WCN785x 2.0 */
3713 };
3714
3715 static int btusb_qca_send_vendor_req(struct usb_device *udev, u8 request,
3716                                      void *data, u16 size)
3717 {
3718         int pipe, err;
3719         u8 *buf;
3720
3721         buf = kmalloc(size, GFP_KERNEL);
3722         if (!buf)
3723                 return -ENOMEM;
3724
3725         /* Found some of USB hosts have IOT issues with ours so that we should
3726          * not wait until HCI layer is ready.
3727          */
3728         pipe = usb_rcvctrlpipe(udev, 0);
3729         err = usb_control_msg(udev, pipe, request, USB_TYPE_VENDOR | USB_DIR_IN,
3730                               0, 0, buf, size, USB_CTRL_SET_TIMEOUT);
3731         if (err < 0) {
3732                 dev_err(&udev->dev, "Failed to access otp area (%d)", err);
3733                 goto done;
3734         }
3735
3736         memcpy(data, buf, size);
3737
3738 done:
3739         kfree(buf);
3740
3741         return err;
3742 }
3743
3744 static int btusb_setup_qca_download_fw(struct hci_dev *hdev,
3745                                        const struct firmware *firmware,
3746                                        size_t hdr_size)
3747 {
3748         struct btusb_data *btdata = hci_get_drvdata(hdev);
3749         struct usb_device *udev = btdata->udev;
3750         size_t count, size, sent = 0;
3751         int pipe, len, err;
3752         u8 *buf;
3753
3754         buf = kmalloc(QCA_DFU_PACKET_LEN, GFP_KERNEL);
3755         if (!buf)
3756                 return -ENOMEM;
3757
3758         count = firmware->size;
3759
3760         size = min_t(size_t, count, hdr_size);
3761         memcpy(buf, firmware->data, size);
3762
3763         /* USB patches should go down to controller through USB path
3764          * because binary format fits to go down through USB channel.
3765          * USB control path is for patching headers and USB bulk is for
3766          * patch body.
3767          */
3768         pipe = usb_sndctrlpipe(udev, 0);
3769         err = usb_control_msg(udev, pipe, QCA_DFU_DOWNLOAD, USB_TYPE_VENDOR,
3770                               0, 0, buf, size, USB_CTRL_SET_TIMEOUT);
3771         if (err < 0) {
3772                 bt_dev_err(hdev, "Failed to send headers (%d)", err);
3773                 goto done;
3774         }
3775
3776         sent += size;
3777         count -= size;
3778
3779         /* ep2 need time to switch from function acl to function dfu,
3780          * so we add 20ms delay here.
3781          */
3782         msleep(20);
3783
3784         while (count) {
3785                 size = min_t(size_t, count, QCA_DFU_PACKET_LEN);
3786
3787                 memcpy(buf, firmware->data + sent, size);
3788
3789                 pipe = usb_sndbulkpipe(udev, 0x02);
3790                 err = usb_bulk_msg(udev, pipe, buf, size, &len,
3791                                    QCA_DFU_TIMEOUT);
3792                 if (err < 0) {
3793                         bt_dev_err(hdev, "Failed to send body at %zd of %zd (%d)",
3794                                    sent, firmware->size, err);
3795                         break;
3796                 }
3797
3798                 if (size != len) {
3799                         bt_dev_err(hdev, "Failed to get bulk buffer");
3800                         err = -EILSEQ;
3801                         break;
3802                 }
3803
3804                 sent  += size;
3805                 count -= size;
3806         }
3807
3808 done:
3809         kfree(buf);
3810         return err;
3811 }
3812
3813 static int btusb_setup_qca_load_rampatch(struct hci_dev *hdev,
3814                                          struct qca_version *ver,
3815                                          const struct qca_device_info *info)
3816 {
3817         struct qca_rampatch_version *rver;
3818         const struct firmware *fw;
3819         u32 ver_rom, ver_patch, rver_rom;
3820         u16 rver_rom_low, rver_rom_high, rver_patch;
3821         char fwname[64];
3822         int err;
3823
3824         ver_rom = le32_to_cpu(ver->rom_version);
3825         ver_patch = le32_to_cpu(ver->patch_version);
3826
3827         snprintf(fwname, sizeof(fwname), "qca/rampatch_usb_%08x.bin", ver_rom);
3828
3829         err = request_firmware(&fw, fwname, &hdev->dev);
3830         if (err) {
3831                 bt_dev_err(hdev, "failed to request rampatch file: %s (%d)",
3832                            fwname, err);
3833                 return err;
3834         }
3835
3836         bt_dev_info(hdev, "using rampatch file: %s", fwname);
3837
3838         rver = (struct qca_rampatch_version *)(fw->data + info->ver_offset);
3839         rver_rom_low = le16_to_cpu(rver->rom_version_low);
3840         rver_patch = le16_to_cpu(rver->patch_version);
3841
3842         if (ver_rom & ~0xffffU) {
3843                 rver_rom_high = le16_to_cpu(rver->rom_version_high);
3844                 rver_rom = rver_rom_high << 16 | rver_rom_low;
3845         } else {
3846                 rver_rom = rver_rom_low;
3847         }
3848
3849         bt_dev_info(hdev, "QCA: patch rome 0x%x build 0x%x, "
3850                     "firmware rome 0x%x build 0x%x",
3851                     rver_rom, rver_patch, ver_rom, ver_patch);
3852
3853         if (rver_rom != ver_rom || rver_patch <= ver_patch) {
3854                 bt_dev_err(hdev, "rampatch file version did not match with firmware");
3855                 err = -EINVAL;
3856                 goto done;
3857         }
3858
3859         err = btusb_setup_qca_download_fw(hdev, fw, info->rampatch_hdr);
3860
3861 done:
3862         release_firmware(fw);
3863
3864         return err;
3865 }
3866
3867 static void btusb_generate_qca_nvm_name(char *fwname, size_t max_size,
3868                                         const struct qca_version *ver)
3869 {
3870         u32 rom_version = le32_to_cpu(ver->rom_version);
3871         u16 flag = le16_to_cpu(ver->flag);
3872
3873         if (((flag >> 8) & 0xff) == QCA_FLAG_MULTI_NVM) {
3874                 /* The board_id should be split into two bytes
3875                  * The 1st byte is chip ID, and the 2nd byte is platform ID
3876                  * For example, board ID 0x010A, 0x01 is platform ID. 0x0A is chip ID
3877                  * we have several platforms, and platform IDs are continuously added
3878                  * Platform ID:
3879                  * 0x00 is for Mobile
3880                  * 0x01 is for X86
3881                  * 0x02 is for Automotive
3882                  * 0x03 is for Consumer electronic
3883                  */
3884                 u16 board_id = (ver->chip_id << 8) + ver->platform_id;
3885                 const char *variant;
3886
3887                 switch (le32_to_cpu(ver->ram_version)) {
3888                 case WCN6855_2_0_RAM_VERSION_GF:
3889                 case WCN6855_2_1_RAM_VERSION_GF:
3890                         variant = "_gf";
3891                         break;
3892                 default:
3893                         variant = "";
3894                         break;
3895                 }
3896
3897                 if (board_id == 0) {
3898                         snprintf(fwname, max_size, "qca/nvm_usb_%08x%s.bin",
3899                                 rom_version, variant);
3900                 } else {
3901                         snprintf(fwname, max_size, "qca/nvm_usb_%08x%s_%04x.bin",
3902                                 rom_version, variant, board_id);
3903                 }
3904         } else {
3905                 snprintf(fwname, max_size, "qca/nvm_usb_%08x.bin",
3906                         rom_version);
3907         }
3908
3909 }
3910
3911 static int btusb_setup_qca_load_nvm(struct hci_dev *hdev,
3912                                     struct qca_version *ver,
3913                                     const struct qca_device_info *info)
3914 {
3915         const struct firmware *fw;
3916         char fwname[64];
3917         int err;
3918
3919         btusb_generate_qca_nvm_name(fwname, sizeof(fwname), ver);
3920
3921         err = request_firmware(&fw, fwname, &hdev->dev);
3922         if (err) {
3923                 bt_dev_err(hdev, "failed to request NVM file: %s (%d)",
3924                            fwname, err);
3925                 return err;
3926         }
3927
3928         bt_dev_info(hdev, "using NVM file: %s", fwname);
3929
3930         err = btusb_setup_qca_download_fw(hdev, fw, info->nvm_hdr);
3931
3932         release_firmware(fw);
3933
3934         return err;
3935 }
3936
3937 /* identify the ROM version and check whether patches are needed */
3938 static bool btusb_qca_need_patch(struct usb_device *udev)
3939 {
3940         struct qca_version ver;
3941
3942         if (btusb_qca_send_vendor_req(udev, QCA_GET_TARGET_VERSION, &ver,
3943                                       sizeof(ver)) < 0)
3944                 return false;
3945         /* only low ROM versions need patches */
3946         return !(le32_to_cpu(ver.rom_version) & ~0xffffU);
3947 }
3948
3949 static int btusb_setup_qca(struct hci_dev *hdev)
3950 {
3951         struct btusb_data *btdata = hci_get_drvdata(hdev);
3952         struct usb_device *udev = btdata->udev;
3953         const struct qca_device_info *info = NULL;
3954         struct qca_version ver;
3955         u32 ver_rom;
3956         u8 status;
3957         int i, err;
3958
3959         err = btusb_qca_send_vendor_req(udev, QCA_GET_TARGET_VERSION, &ver,
3960                                         sizeof(ver));
3961         if (err < 0)
3962                 return err;
3963
3964         ver_rom = le32_to_cpu(ver.rom_version);
3965
3966         for (i = 0; i < ARRAY_SIZE(qca_devices_table); i++) {
3967                 if (ver_rom == qca_devices_table[i].rom_version)
3968                         info = &qca_devices_table[i];
3969         }
3970         if (!info) {
3971                 /* If the rom_version is not matched in the qca_devices_table
3972                  * and the high ROM version is not zero, we assume this chip no
3973                  * need to load the rampatch and nvm.
3974                  */
3975                 if (ver_rom & ~0xffffU)
3976                         return 0;
3977
3978                 bt_dev_err(hdev, "don't support firmware rome 0x%x", ver_rom);
3979                 return -ENODEV;
3980         }
3981
3982         err = btusb_qca_send_vendor_req(udev, QCA_CHECK_STATUS, &status,
3983                                         sizeof(status));
3984         if (err < 0)
3985                 return err;
3986
3987         if (!(status & QCA_PATCH_UPDATED)) {
3988                 err = btusb_setup_qca_load_rampatch(hdev, &ver, info);
3989                 if (err < 0)
3990                         return err;
3991         }
3992
3993         err = btusb_qca_send_vendor_req(udev, QCA_GET_TARGET_VERSION, &ver,
3994                                         sizeof(ver));
3995         if (err < 0)
3996                 return err;
3997
3998         btdata->qca_dump.fw_version = le32_to_cpu(ver.patch_version);
3999         btdata->qca_dump.controller_id = le32_to_cpu(ver.rom_version);
4000
4001         if (!(status & QCA_SYSCFG_UPDATED)) {
4002                 err = btusb_setup_qca_load_nvm(hdev, &ver, info);
4003                 if (err < 0)
4004                         return err;
4005
4006                 /* WCN6855 2.1 and later will reset to apply firmware downloaded here, so
4007                  * wait ~100ms for reset Done then go ahead, otherwise, it maybe
4008                  * cause potential enable failure.
4009                  */
4010                 if (info->rom_version >= 0x00130201)
4011                         msleep(QCA_BT_RESET_WAIT_MS);
4012         }
4013
4014         /* Mark HCI_OP_ENHANCED_SETUP_SYNC_CONN as broken as it doesn't seem to
4015          * work with the likes of HSP/HFP mSBC.
4016          */
4017         set_bit(HCI_QUIRK_BROKEN_ENHANCED_SETUP_SYNC_CONN, &hdev->quirks);
4018
4019         return 0;
4020 }
4021
4022 static inline int __set_diag_interface(struct hci_dev *hdev)
4023 {
4024         struct btusb_data *data = hci_get_drvdata(hdev);
4025         struct usb_interface *intf = data->diag;
4026         int i;
4027
4028         if (!data->diag)
4029                 return -ENODEV;
4030
4031         data->diag_tx_ep = NULL;
4032         data->diag_rx_ep = NULL;
4033
4034         for (i = 0; i < intf->cur_altsetting->desc.bNumEndpoints; i++) {
4035                 struct usb_endpoint_descriptor *ep_desc;
4036
4037                 ep_desc = &intf->cur_altsetting->endpoint[i].desc;
4038
4039                 if (!data->diag_tx_ep && usb_endpoint_is_bulk_out(ep_desc)) {
4040                         data->diag_tx_ep = ep_desc;
4041                         continue;
4042                 }
4043
4044                 if (!data->diag_rx_ep && usb_endpoint_is_bulk_in(ep_desc)) {
4045                         data->diag_rx_ep = ep_desc;
4046                         continue;
4047                 }
4048         }
4049
4050         if (!data->diag_tx_ep || !data->diag_rx_ep) {
4051                 bt_dev_err(hdev, "invalid diagnostic descriptors");
4052                 return -ENODEV;
4053         }
4054
4055         return 0;
4056 }
4057
4058 static struct urb *alloc_diag_urb(struct hci_dev *hdev, bool enable)
4059 {
4060         struct btusb_data *data = hci_get_drvdata(hdev);
4061         struct sk_buff *skb;
4062         struct urb *urb;
4063         unsigned int pipe;
4064
4065         if (!data->diag_tx_ep)
4066                 return ERR_PTR(-ENODEV);
4067
4068         urb = usb_alloc_urb(0, GFP_KERNEL);
4069         if (!urb)
4070                 return ERR_PTR(-ENOMEM);
4071
4072         skb = bt_skb_alloc(2, GFP_KERNEL);
4073         if (!skb) {
4074                 usb_free_urb(urb);
4075                 return ERR_PTR(-ENOMEM);
4076         }
4077
4078         skb_put_u8(skb, 0xf0);
4079         skb_put_u8(skb, enable);
4080
4081         pipe = usb_sndbulkpipe(data->udev, data->diag_tx_ep->bEndpointAddress);
4082
4083         usb_fill_bulk_urb(urb, data->udev, pipe,
4084                           skb->data, skb->len, btusb_tx_complete, skb);
4085
4086         skb->dev = (void *)hdev;
4087
4088         return urb;
4089 }
4090
4091 static int btusb_bcm_set_diag(struct hci_dev *hdev, bool enable)
4092 {
4093         struct btusb_data *data = hci_get_drvdata(hdev);
4094         struct urb *urb;
4095
4096         if (!data->diag)
4097                 return -ENODEV;
4098
4099         if (!test_bit(HCI_RUNNING, &hdev->flags))
4100                 return -ENETDOWN;
4101
4102         urb = alloc_diag_urb(hdev, enable);
4103         if (IS_ERR(urb))
4104                 return PTR_ERR(urb);
4105
4106         return submit_or_queue_tx_urb(hdev, urb);
4107 }
4108
4109 #ifdef CONFIG_PM
4110 static irqreturn_t btusb_oob_wake_handler(int irq, void *priv)
4111 {
4112         struct btusb_data *data = priv;
4113
4114         pm_wakeup_event(&data->udev->dev, 0);
4115         pm_system_wakeup();
4116
4117         /* Disable only if not already disabled (keep it balanced) */
4118         if (test_and_clear_bit(BTUSB_OOB_WAKE_ENABLED, &data->flags)) {
4119                 disable_irq_nosync(irq);
4120                 disable_irq_wake(irq);
4121         }
4122         return IRQ_HANDLED;
4123 }
4124
4125 static const struct of_device_id btusb_match_table[] = {
4126         { .compatible = "usb1286,204e" },
4127         { .compatible = "usbcf3,e300" }, /* QCA6174A */
4128         { .compatible = "usb4ca,301a" }, /* QCA6174A (Lite-On) */
4129         { }
4130 };
4131 MODULE_DEVICE_TABLE(of, btusb_match_table);
4132
4133 /* Use an oob wakeup pin? */
4134 static int btusb_config_oob_wake(struct hci_dev *hdev)
4135 {
4136         struct btusb_data *data = hci_get_drvdata(hdev);
4137         struct device *dev = &data->udev->dev;
4138         int irq, ret;
4139
4140         clear_bit(BTUSB_OOB_WAKE_ENABLED, &data->flags);
4141
4142         if (!of_match_device(btusb_match_table, dev))
4143                 return 0;
4144
4145         /* Move on if no IRQ specified */
4146         irq = of_irq_get_byname(dev->of_node, "wakeup");
4147         if (irq <= 0) {
4148                 bt_dev_dbg(hdev, "%s: no OOB Wakeup IRQ in DT", __func__);
4149                 return 0;
4150         }
4151
4152         irq_set_status_flags(irq, IRQ_NOAUTOEN);
4153         ret = devm_request_irq(&hdev->dev, irq, btusb_oob_wake_handler,
4154                                0, "OOB Wake-on-BT", data);
4155         if (ret) {
4156                 bt_dev_err(hdev, "%s: IRQ request failed", __func__);
4157                 return ret;
4158         }
4159
4160         ret = device_init_wakeup(dev, true);
4161         if (ret) {
4162                 bt_dev_err(hdev, "%s: failed to init_wakeup", __func__);
4163                 return ret;
4164         }
4165
4166         data->oob_wake_irq = irq;
4167         bt_dev_info(hdev, "OOB Wake-on-BT configured at IRQ %u", irq);
4168         return 0;
4169 }
4170 #endif
4171
4172 static void btusb_check_needs_reset_resume(struct usb_interface *intf)
4173 {
4174         if (dmi_check_system(btusb_needs_reset_resume_table))
4175                 interface_to_usbdev(intf)->quirks |= USB_QUIRK_RESET_RESUME;
4176 }
4177
4178 static bool btusb_wakeup(struct hci_dev *hdev)
4179 {
4180         struct btusb_data *data = hci_get_drvdata(hdev);
4181
4182         return device_may_wakeup(&data->udev->dev);
4183 }
4184
4185 static int btusb_shutdown_qca(struct hci_dev *hdev)
4186 {
4187         struct sk_buff *skb;
4188
4189         skb = __hci_cmd_sync(hdev, HCI_OP_RESET, 0, NULL, HCI_INIT_TIMEOUT);
4190         if (IS_ERR(skb)) {
4191                 bt_dev_err(hdev, "HCI reset during shutdown failed");
4192                 return PTR_ERR(skb);
4193         }
4194         kfree_skb(skb);
4195
4196         return 0;
4197 }
4198
4199 static ssize_t force_poll_sync_read(struct file *file, char __user *user_buf,
4200                                     size_t count, loff_t *ppos)
4201 {
4202         struct btusb_data *data = file->private_data;
4203         char buf[3];
4204
4205         buf[0] = data->poll_sync ? 'Y' : 'N';
4206         buf[1] = '\n';
4207         buf[2] = '\0';
4208         return simple_read_from_buffer(user_buf, count, ppos, buf, 2);
4209 }
4210
4211 static ssize_t force_poll_sync_write(struct file *file,
4212                                      const char __user *user_buf,
4213                                      size_t count, loff_t *ppos)
4214 {
4215         struct btusb_data *data = file->private_data;
4216         bool enable;
4217         int err;
4218
4219         err = kstrtobool_from_user(user_buf, count, &enable);
4220         if (err)
4221                 return err;
4222
4223         /* Only allow changes while the adapter is down */
4224         if (test_bit(HCI_UP, &data->hdev->flags))
4225                 return -EPERM;
4226
4227         if (data->poll_sync == enable)
4228                 return -EALREADY;
4229
4230         data->poll_sync = enable;
4231
4232         return count;
4233 }
4234
4235 static const struct file_operations force_poll_sync_fops = {
4236         .open           = simple_open,
4237         .read           = force_poll_sync_read,
4238         .write          = force_poll_sync_write,
4239         .llseek         = default_llseek,
4240 };
4241
4242 static int btusb_probe(struct usb_interface *intf,
4243                        const struct usb_device_id *id)
4244 {
4245         struct usb_endpoint_descriptor *ep_desc;
4246         struct gpio_desc *reset_gpio;
4247         struct btusb_data *data;
4248         struct hci_dev *hdev;
4249         unsigned ifnum_base;
4250         int i, err, priv_size;
4251
4252         BT_DBG("intf %p id %p", intf, id);
4253
4254         if ((id->driver_info & BTUSB_IFNUM_2) &&
4255             (intf->cur_altsetting->desc.bInterfaceNumber != 0) &&
4256             (intf->cur_altsetting->desc.bInterfaceNumber != 2))
4257                 return -ENODEV;
4258
4259         ifnum_base = intf->cur_altsetting->desc.bInterfaceNumber;
4260
4261         if (!id->driver_info) {
4262                 const struct usb_device_id *match;
4263
4264                 match = usb_match_id(intf, blacklist_table);
4265                 if (match)
4266                         id = match;
4267         }
4268
4269         if (id->driver_info == BTUSB_IGNORE)
4270                 return -ENODEV;
4271
4272         if (id->driver_info & BTUSB_ATH3012) {
4273                 struct usb_device *udev = interface_to_usbdev(intf);
4274
4275                 /* Old firmware would otherwise let ath3k driver load
4276                  * patch and sysconfig files
4277                  */
4278                 if (le16_to_cpu(udev->descriptor.bcdDevice) <= 0x0001 &&
4279                     !btusb_qca_need_patch(udev))
4280                         return -ENODEV;
4281         }
4282
4283         data = devm_kzalloc(&intf->dev, sizeof(*data), GFP_KERNEL);
4284         if (!data)
4285                 return -ENOMEM;
4286
4287         for (i = 0; i < intf->cur_altsetting->desc.bNumEndpoints; i++) {
4288                 ep_desc = &intf->cur_altsetting->endpoint[i].desc;
4289
4290                 if (!data->intr_ep && usb_endpoint_is_int_in(ep_desc)) {
4291                         data->intr_ep = ep_desc;
4292                         continue;
4293                 }
4294
4295                 if (!data->bulk_tx_ep && usb_endpoint_is_bulk_out(ep_desc)) {
4296                         data->bulk_tx_ep = ep_desc;
4297                         continue;
4298                 }
4299
4300                 if (!data->bulk_rx_ep && usb_endpoint_is_bulk_in(ep_desc)) {
4301                         data->bulk_rx_ep = ep_desc;
4302                         continue;
4303                 }
4304         }
4305
4306         if (!data->intr_ep || !data->bulk_tx_ep || !data->bulk_rx_ep)
4307                 return -ENODEV;
4308
4309         if (id->driver_info & BTUSB_AMP) {
4310                 data->cmdreq_type = USB_TYPE_CLASS | 0x01;
4311                 data->cmdreq = 0x2b;
4312         } else {
4313                 data->cmdreq_type = USB_TYPE_CLASS;
4314                 data->cmdreq = 0x00;
4315         }
4316
4317         data->udev = interface_to_usbdev(intf);
4318         data->intf = intf;
4319
4320         INIT_WORK(&data->work, btusb_work);
4321         INIT_WORK(&data->waker, btusb_waker);
4322         INIT_DELAYED_WORK(&data->rx_work, btusb_rx_work);
4323
4324         skb_queue_head_init(&data->acl_q);
4325
4326         init_usb_anchor(&data->deferred);
4327         init_usb_anchor(&data->tx_anchor);
4328         spin_lock_init(&data->txlock);
4329
4330         init_usb_anchor(&data->intr_anchor);
4331         init_usb_anchor(&data->bulk_anchor);
4332         init_usb_anchor(&data->isoc_anchor);
4333         init_usb_anchor(&data->diag_anchor);
4334         init_usb_anchor(&data->ctrl_anchor);
4335         spin_lock_init(&data->rxlock);
4336
4337         priv_size = 0;
4338
4339         data->recv_event = hci_recv_frame;
4340         data->recv_bulk = btusb_recv_bulk;
4341
4342         if (id->driver_info & BTUSB_INTEL_COMBINED) {
4343                 /* Allocate extra space for Intel device */
4344                 priv_size += sizeof(struct btintel_data);
4345
4346                 /* Override the rx handlers */
4347                 data->recv_event = btusb_recv_event_intel;
4348                 data->recv_bulk = btusb_recv_bulk_intel;
4349         } else if (id->driver_info & BTUSB_REALTEK) {
4350                 /* Allocate extra space for Realtek device */
4351                 priv_size += sizeof(struct btrealtek_data);
4352
4353                 data->recv_event = btusb_recv_event_realtek;
4354         } else if (id->driver_info & BTUSB_MEDIATEK) {
4355                 /* Allocate extra space for Mediatek device */
4356                 priv_size += sizeof(struct btmediatek_data);
4357         }
4358
4359         data->recv_acl = hci_recv_frame;
4360
4361         hdev = hci_alloc_dev_priv(priv_size);
4362         if (!hdev)
4363                 return -ENOMEM;
4364
4365         hdev->bus = HCI_USB;
4366         hci_set_drvdata(hdev, data);
4367
4368         if (id->driver_info & BTUSB_AMP)
4369                 hdev->dev_type = HCI_AMP;
4370         else
4371                 hdev->dev_type = HCI_PRIMARY;
4372
4373         data->hdev = hdev;
4374
4375         SET_HCIDEV_DEV(hdev, &intf->dev);
4376
4377         reset_gpio = gpiod_get_optional(&data->udev->dev, "reset",
4378                                         GPIOD_OUT_LOW);
4379         if (IS_ERR(reset_gpio)) {
4380                 err = PTR_ERR(reset_gpio);
4381                 goto out_free_dev;
4382         } else if (reset_gpio) {
4383                 data->reset_gpio = reset_gpio;
4384         }
4385
4386         hdev->open   = btusb_open;
4387         hdev->close  = btusb_close;
4388         hdev->flush  = btusb_flush;
4389         hdev->send   = btusb_send_frame;
4390         hdev->notify = btusb_notify;
4391         hdev->wakeup = btusb_wakeup;
4392
4393 #ifdef CONFIG_PM
4394         err = btusb_config_oob_wake(hdev);
4395         if (err)
4396                 goto out_free_dev;
4397
4398         /* Marvell devices may need a specific chip configuration */
4399         if (id->driver_info & BTUSB_MARVELL && data->oob_wake_irq) {
4400                 err = marvell_config_oob_wake(hdev);
4401                 if (err)
4402                         goto out_free_dev;
4403         }
4404 #endif
4405         if (id->driver_info & BTUSB_CW6622)
4406                 set_bit(HCI_QUIRK_BROKEN_STORED_LINK_KEY, &hdev->quirks);
4407
4408         if (id->driver_info & BTUSB_BCM2045)
4409                 set_bit(HCI_QUIRK_BROKEN_STORED_LINK_KEY, &hdev->quirks);
4410
4411         if (id->driver_info & BTUSB_BCM92035)
4412                 hdev->setup = btusb_setup_bcm92035;
4413
4414         if (IS_ENABLED(CONFIG_BT_HCIBTUSB_BCM) &&
4415             (id->driver_info & BTUSB_BCM_PATCHRAM)) {
4416                 hdev->manufacturer = 15;
4417                 hdev->setup = btbcm_setup_patchram;
4418                 hdev->set_diag = btusb_bcm_set_diag;
4419                 hdev->set_bdaddr = btbcm_set_bdaddr;
4420
4421                 /* Broadcom LM_DIAG Interface numbers are hardcoded */
4422                 data->diag = usb_ifnum_to_if(data->udev, ifnum_base + 2);
4423         }
4424
4425         if (IS_ENABLED(CONFIG_BT_HCIBTUSB_BCM) &&
4426             (id->driver_info & BTUSB_BCM_APPLE)) {
4427                 hdev->manufacturer = 15;
4428                 hdev->setup = btbcm_setup_apple;
4429                 hdev->set_diag = btusb_bcm_set_diag;
4430
4431                 /* Broadcom LM_DIAG Interface numbers are hardcoded */
4432                 data->diag = usb_ifnum_to_if(data->udev, ifnum_base + 2);
4433         }
4434
4435         /* Combined Intel Device setup to support multiple setup routine */
4436         if (id->driver_info & BTUSB_INTEL_COMBINED) {
4437                 err = btintel_configure_setup(hdev, btusb_driver.name);
4438                 if (err)
4439                         goto out_free_dev;
4440
4441                 /* Transport specific configuration */
4442                 hdev->send = btusb_send_frame_intel;
4443                 hdev->cmd_timeout = btusb_intel_cmd_timeout;
4444
4445                 if (id->driver_info & BTUSB_INTEL_NO_WBS_SUPPORT)
4446                         btintel_set_flag(hdev, INTEL_ROM_LEGACY_NO_WBS_SUPPORT);
4447
4448                 if (id->driver_info & BTUSB_INTEL_BROKEN_INITIAL_NCMD)
4449                         btintel_set_flag(hdev, INTEL_BROKEN_INITIAL_NCMD);
4450
4451                 if (id->driver_info & BTUSB_INTEL_BROKEN_SHUTDOWN_LED)
4452                         btintel_set_flag(hdev, INTEL_BROKEN_SHUTDOWN_LED);
4453         }
4454
4455         if (id->driver_info & BTUSB_MARVELL)
4456                 hdev->set_bdaddr = btusb_set_bdaddr_marvell;
4457
4458         if (IS_ENABLED(CONFIG_BT_HCIBTUSB_MTK) &&
4459             (id->driver_info & BTUSB_MEDIATEK)) {
4460                 hdev->setup = btusb_mtk_setup;
4461                 hdev->shutdown = btusb_mtk_shutdown;
4462                 hdev->manufacturer = 70;
4463                 hdev->cmd_timeout = btmtk_reset_sync;
4464                 hdev->set_bdaddr = btmtk_set_bdaddr;
4465                 set_bit(HCI_QUIRK_BROKEN_ENHANCED_SETUP_SYNC_CONN, &hdev->quirks);
4466                 set_bit(HCI_QUIRK_NON_PERSISTENT_SETUP, &hdev->quirks);
4467                 data->recv_acl = btusb_recv_acl_mtk;
4468         }
4469
4470         if (id->driver_info & BTUSB_SWAVE) {
4471                 set_bit(HCI_QUIRK_FIXUP_INQUIRY_MODE, &hdev->quirks);
4472                 set_bit(HCI_QUIRK_BROKEN_LOCAL_COMMANDS, &hdev->quirks);
4473         }
4474
4475         if (id->driver_info & BTUSB_INTEL_BOOT) {
4476                 hdev->manufacturer = 2;
4477                 set_bit(HCI_QUIRK_RAW_DEVICE, &hdev->quirks);
4478         }
4479
4480         if (id->driver_info & BTUSB_ATH3012) {
4481                 data->setup_on_usb = btusb_setup_qca;
4482                 hdev->set_bdaddr = btusb_set_bdaddr_ath3012;
4483                 set_bit(HCI_QUIRK_SIMULTANEOUS_DISCOVERY, &hdev->quirks);
4484                 set_bit(HCI_QUIRK_STRICT_DUPLICATE_FILTER, &hdev->quirks);
4485         }
4486
4487         if (id->driver_info & BTUSB_QCA_ROME) {
4488                 data->setup_on_usb = btusb_setup_qca;
4489                 hdev->set_bdaddr = btusb_set_bdaddr_ath3012;
4490                 hdev->cmd_timeout = btusb_qca_cmd_timeout;
4491                 set_bit(HCI_QUIRK_SIMULTANEOUS_DISCOVERY, &hdev->quirks);
4492                 btusb_check_needs_reset_resume(intf);
4493         }
4494
4495         if (id->driver_info & BTUSB_QCA_WCN6855) {
4496                 data->qca_dump.id_vendor = id->idVendor;
4497                 data->qca_dump.id_product = id->idProduct;
4498                 data->recv_event = btusb_recv_evt_qca;
4499                 data->recv_acl = btusb_recv_acl_qca;
4500                 hci_devcd_register(hdev, btusb_coredump_qca, btusb_dump_hdr_qca, NULL);
4501                 data->setup_on_usb = btusb_setup_qca;
4502                 hdev->shutdown = btusb_shutdown_qca;
4503                 hdev->set_bdaddr = btusb_set_bdaddr_wcn6855;
4504                 hdev->cmd_timeout = btusb_qca_cmd_timeout;
4505                 set_bit(HCI_QUIRK_SIMULTANEOUS_DISCOVERY, &hdev->quirks);
4506                 hci_set_msft_opcode(hdev, 0xFD70);
4507         }
4508
4509         if (id->driver_info & BTUSB_AMP) {
4510                 /* AMP controllers do not support SCO packets */
4511                 data->isoc = NULL;
4512         } else {
4513                 /* Interface orders are hardcoded in the specification */
4514                 data->isoc = usb_ifnum_to_if(data->udev, ifnum_base + 1);
4515                 data->isoc_ifnum = ifnum_base + 1;
4516         }
4517
4518         if (IS_ENABLED(CONFIG_BT_HCIBTUSB_RTL) &&
4519             (id->driver_info & BTUSB_REALTEK)) {
4520                 btrtl_set_driver_name(hdev, btusb_driver.name);
4521                 hdev->setup = btusb_setup_realtek;
4522                 hdev->shutdown = btrtl_shutdown_realtek;
4523                 hdev->cmd_timeout = btusb_rtl_cmd_timeout;
4524                 hdev->hw_error = btusb_rtl_hw_error;
4525
4526                 /* Realtek devices need to set remote wakeup on auto-suspend */
4527                 set_bit(BTUSB_WAKEUP_AUTOSUSPEND, &data->flags);
4528                 set_bit(BTUSB_USE_ALT3_FOR_WBS, &data->flags);
4529         }
4530
4531         if (id->driver_info & BTUSB_ACTIONS_SEMI) {
4532                 /* Support is advertised, but not implemented */
4533                 set_bit(HCI_QUIRK_BROKEN_ERR_DATA_REPORTING, &hdev->quirks);
4534                 set_bit(HCI_QUIRK_BROKEN_READ_TRANSMIT_POWER, &hdev->quirks);
4535                 set_bit(HCI_QUIRK_BROKEN_SET_RPA_TIMEOUT, &hdev->quirks);
4536                 set_bit(HCI_QUIRK_BROKEN_EXT_SCAN, &hdev->quirks);
4537         }
4538
4539         if (!reset)
4540                 set_bit(HCI_QUIRK_RESET_ON_CLOSE, &hdev->quirks);
4541
4542         if (force_scofix || id->driver_info & BTUSB_WRONG_SCO_MTU) {
4543                 if (!disable_scofix)
4544                         set_bit(HCI_QUIRK_FIXUP_BUFFER_SIZE, &hdev->quirks);
4545         }
4546
4547         if (id->driver_info & BTUSB_BROKEN_ISOC)
4548                 data->isoc = NULL;
4549
4550         if (id->driver_info & BTUSB_WIDEBAND_SPEECH)
4551                 set_bit(HCI_QUIRK_WIDEBAND_SPEECH_SUPPORTED, &hdev->quirks);
4552
4553         if (id->driver_info & BTUSB_VALID_LE_STATES)
4554                 set_bit(HCI_QUIRK_VALID_LE_STATES, &hdev->quirks);
4555
4556         if (id->driver_info & BTUSB_DIGIANSWER) {
4557                 data->cmdreq_type = USB_TYPE_VENDOR;
4558                 set_bit(HCI_QUIRK_RESET_ON_CLOSE, &hdev->quirks);
4559         }
4560
4561         if (id->driver_info & BTUSB_CSR) {
4562                 struct usb_device *udev = data->udev;
4563                 u16 bcdDevice = le16_to_cpu(udev->descriptor.bcdDevice);
4564
4565                 /* Old firmware would otherwise execute USB reset */
4566                 if (bcdDevice < 0x117)
4567                         set_bit(HCI_QUIRK_RESET_ON_CLOSE, &hdev->quirks);
4568
4569                 /* This must be set first in case we disable it for fakes */
4570                 set_bit(HCI_QUIRK_SIMULTANEOUS_DISCOVERY, &hdev->quirks);
4571
4572                 /* Fake CSR devices with broken commands */
4573                 if (le16_to_cpu(udev->descriptor.idVendor)  == 0x0a12 &&
4574                     le16_to_cpu(udev->descriptor.idProduct) == 0x0001)
4575                         hdev->setup = btusb_setup_csr;
4576         }
4577
4578         if (id->driver_info & BTUSB_SNIFFER) {
4579                 struct usb_device *udev = data->udev;
4580
4581                 /* New sniffer firmware has crippled HCI interface */
4582                 if (le16_to_cpu(udev->descriptor.bcdDevice) > 0x997)
4583                         set_bit(HCI_QUIRK_RAW_DEVICE, &hdev->quirks);
4584         }
4585
4586         if (id->driver_info & BTUSB_INTEL_BOOT) {
4587                 /* A bug in the bootloader causes that interrupt interface is
4588                  * only enabled after receiving SetInterface(0, AltSetting=0).
4589                  */
4590                 err = usb_set_interface(data->udev, 0, 0);
4591                 if (err < 0) {
4592                         BT_ERR("failed to set interface 0, alt 0 %d", err);
4593                         goto out_free_dev;
4594                 }
4595         }
4596
4597         if (data->isoc) {
4598                 err = usb_driver_claim_interface(&btusb_driver,
4599                                                  data->isoc, data);
4600                 if (err < 0)
4601                         goto out_free_dev;
4602         }
4603
4604         if (IS_ENABLED(CONFIG_BT_HCIBTUSB_BCM) && data->diag) {
4605                 if (!usb_driver_claim_interface(&btusb_driver,
4606                                                 data->diag, data))
4607                         __set_diag_interface(hdev);
4608                 else
4609                         data->diag = NULL;
4610         }
4611
4612         if (enable_autosuspend)
4613                 usb_enable_autosuspend(data->udev);
4614
4615         data->poll_sync = enable_poll_sync;
4616
4617         err = hci_register_dev(hdev);
4618         if (err < 0)
4619                 goto out_free_dev;
4620
4621         usb_set_intfdata(intf, data);
4622
4623         debugfs_create_file("force_poll_sync", 0644, hdev->debugfs, data,
4624                             &force_poll_sync_fops);
4625
4626         return 0;
4627
4628 out_free_dev:
4629         if (data->reset_gpio)
4630                 gpiod_put(data->reset_gpio);
4631         hci_free_dev(hdev);
4632         return err;
4633 }
4634
4635 static void btusb_disconnect(struct usb_interface *intf)
4636 {
4637         struct btusb_data *data = usb_get_intfdata(intf);
4638         struct hci_dev *hdev;
4639
4640         BT_DBG("intf %p", intf);
4641
4642         if (!data)
4643                 return;
4644
4645         hdev = data->hdev;
4646         usb_set_intfdata(data->intf, NULL);
4647
4648         if (data->isoc)
4649                 usb_set_intfdata(data->isoc, NULL);
4650
4651         if (data->diag)
4652                 usb_set_intfdata(data->diag, NULL);
4653
4654         hci_unregister_dev(hdev);
4655
4656         if (intf == data->intf) {
4657                 if (data->isoc)
4658                         usb_driver_release_interface(&btusb_driver, data->isoc);
4659                 if (data->diag)
4660                         usb_driver_release_interface(&btusb_driver, data->diag);
4661         } else if (intf == data->isoc) {
4662                 if (data->diag)
4663                         usb_driver_release_interface(&btusb_driver, data->diag);
4664                 usb_driver_release_interface(&btusb_driver, data->intf);
4665         } else if (intf == data->diag) {
4666                 usb_driver_release_interface(&btusb_driver, data->intf);
4667                 if (data->isoc)
4668                         usb_driver_release_interface(&btusb_driver, data->isoc);
4669         }
4670
4671         if (data->oob_wake_irq)
4672                 device_init_wakeup(&data->udev->dev, false);
4673
4674         if (data->reset_gpio)
4675                 gpiod_put(data->reset_gpio);
4676
4677         hci_free_dev(hdev);
4678 }
4679
4680 #ifdef CONFIG_PM
4681 static int btusb_suspend(struct usb_interface *intf, pm_message_t message)
4682 {
4683         struct btusb_data *data = usb_get_intfdata(intf);
4684
4685         BT_DBG("intf %p", intf);
4686
4687         if (data->suspend_count++)
4688                 return 0;
4689
4690         spin_lock_irq(&data->txlock);
4691         if (!(PMSG_IS_AUTO(message) && data->tx_in_flight)) {
4692                 set_bit(BTUSB_SUSPENDING, &data->flags);
4693                 spin_unlock_irq(&data->txlock);
4694         } else {
4695                 spin_unlock_irq(&data->txlock);
4696                 data->suspend_count--;
4697                 return -EBUSY;
4698         }
4699
4700         cancel_work_sync(&data->work);
4701
4702         btusb_stop_traffic(data);
4703         usb_kill_anchored_urbs(&data->tx_anchor);
4704
4705         if (data->oob_wake_irq && device_may_wakeup(&data->udev->dev)) {
4706                 set_bit(BTUSB_OOB_WAKE_ENABLED, &data->flags);
4707                 enable_irq_wake(data->oob_wake_irq);
4708                 enable_irq(data->oob_wake_irq);
4709         }
4710
4711         /* For global suspend, Realtek devices lose the loaded fw
4712          * in them. But for autosuspend, firmware should remain.
4713          * Actually, it depends on whether the usb host sends
4714          * set feature (enable wakeup) or not.
4715          */
4716         if (test_bit(BTUSB_WAKEUP_AUTOSUSPEND, &data->flags)) {
4717                 if (PMSG_IS_AUTO(message) &&
4718                     device_can_wakeup(&data->udev->dev))
4719                         data->udev->do_remote_wakeup = 1;
4720                 else if (!PMSG_IS_AUTO(message) &&
4721                          !device_may_wakeup(&data->udev->dev)) {
4722                         data->udev->do_remote_wakeup = 0;
4723                         data->udev->reset_resume = 1;
4724                 }
4725         }
4726
4727         return 0;
4728 }
4729
4730 static void play_deferred(struct btusb_data *data)
4731 {
4732         struct urb *urb;
4733         int err;
4734
4735         while ((urb = usb_get_from_anchor(&data->deferred))) {
4736                 usb_anchor_urb(urb, &data->tx_anchor);
4737
4738                 err = usb_submit_urb(urb, GFP_ATOMIC);
4739                 if (err < 0) {
4740                         if (err != -EPERM && err != -ENODEV)
4741                                 BT_ERR("%s urb %p submission failed (%d)",
4742                                        data->hdev->name, urb, -err);
4743                         kfree(urb->setup_packet);
4744                         usb_unanchor_urb(urb);
4745                         usb_free_urb(urb);
4746                         break;
4747                 }
4748
4749                 data->tx_in_flight++;
4750                 usb_free_urb(urb);
4751         }
4752
4753         /* Cleanup the rest deferred urbs. */
4754         while ((urb = usb_get_from_anchor(&data->deferred))) {
4755                 kfree(urb->setup_packet);
4756                 usb_free_urb(urb);
4757         }
4758 }
4759
4760 static int btusb_resume(struct usb_interface *intf)
4761 {
4762         struct btusb_data *data = usb_get_intfdata(intf);
4763         struct hci_dev *hdev = data->hdev;
4764         int err = 0;
4765
4766         BT_DBG("intf %p", intf);
4767
4768         if (--data->suspend_count)
4769                 return 0;
4770
4771         /* Disable only if not already disabled (keep it balanced) */
4772         if (test_and_clear_bit(BTUSB_OOB_WAKE_ENABLED, &data->flags)) {
4773                 disable_irq(data->oob_wake_irq);
4774                 disable_irq_wake(data->oob_wake_irq);
4775         }
4776
4777         if (!test_bit(HCI_RUNNING, &hdev->flags))
4778                 goto done;
4779
4780         if (test_bit(BTUSB_INTR_RUNNING, &data->flags)) {
4781                 err = btusb_submit_intr_urb(hdev, GFP_NOIO);
4782                 if (err < 0) {
4783                         clear_bit(BTUSB_INTR_RUNNING, &data->flags);
4784                         goto failed;
4785                 }
4786         }
4787
4788         if (test_bit(BTUSB_BULK_RUNNING, &data->flags)) {
4789                 err = btusb_submit_bulk_urb(hdev, GFP_NOIO);
4790                 if (err < 0) {
4791                         clear_bit(BTUSB_BULK_RUNNING, &data->flags);
4792                         goto failed;
4793                 }
4794
4795                 btusb_submit_bulk_urb(hdev, GFP_NOIO);
4796         }
4797
4798         if (test_bit(BTUSB_ISOC_RUNNING, &data->flags)) {
4799                 if (btusb_submit_isoc_urb(hdev, GFP_NOIO) < 0)
4800                         clear_bit(BTUSB_ISOC_RUNNING, &data->flags);
4801                 else
4802                         btusb_submit_isoc_urb(hdev, GFP_NOIO);
4803         }
4804
4805         spin_lock_irq(&data->txlock);
4806         play_deferred(data);
4807         clear_bit(BTUSB_SUSPENDING, &data->flags);
4808         spin_unlock_irq(&data->txlock);
4809         schedule_work(&data->work);
4810
4811         return 0;
4812
4813 failed:
4814         usb_scuttle_anchored_urbs(&data->deferred);
4815 done:
4816         spin_lock_irq(&data->txlock);
4817         clear_bit(BTUSB_SUSPENDING, &data->flags);
4818         spin_unlock_irq(&data->txlock);
4819
4820         return err;
4821 }
4822 #endif
4823
4824 #ifdef CONFIG_DEV_COREDUMP
4825 static void btusb_coredump(struct device *dev)
4826 {
4827         struct btusb_data *data = dev_get_drvdata(dev);
4828         struct hci_dev *hdev = data->hdev;
4829
4830         if (hdev->dump.coredump)
4831                 hdev->dump.coredump(hdev);
4832 }
4833 #endif
4834
4835 static struct usb_driver btusb_driver = {
4836         .name           = "btusb",
4837         .probe          = btusb_probe,
4838         .disconnect     = btusb_disconnect,
4839 #ifdef CONFIG_PM
4840         .suspend        = btusb_suspend,
4841         .resume         = btusb_resume,
4842 #endif
4843         .id_table       = btusb_table,
4844         .supports_autosuspend = 1,
4845         .disable_hub_initiated_lpm = 1,
4846
4847 #ifdef CONFIG_DEV_COREDUMP
4848         .drvwrap = {
4849                 .driver = {
4850                         .coredump = btusb_coredump,
4851                 },
4852         },
4853 #endif
4854 };
4855
4856 module_usb_driver(btusb_driver);
4857
4858 module_param(disable_scofix, bool, 0644);
4859 MODULE_PARM_DESC(disable_scofix, "Disable fixup of wrong SCO buffer size");
4860
4861 module_param(force_scofix, bool, 0644);
4862 MODULE_PARM_DESC(force_scofix, "Force fixup of wrong SCO buffers size");
4863
4864 module_param(enable_autosuspend, bool, 0644);
4865 MODULE_PARM_DESC(enable_autosuspend, "Enable USB autosuspend by default");
4866
4867 module_param(reset, bool, 0644);
4868 MODULE_PARM_DESC(reset, "Send HCI reset command on initialization");
4869
4870 MODULE_AUTHOR("Marcel Holtmann <marcel@holtmann.org>");
4871 MODULE_DESCRIPTION("Generic Bluetooth USB driver ver " VERSION);
4872 MODULE_VERSION(VERSION);
4873 MODULE_LICENSE("GPL");