drivers/bluetooth/btusb.c

   1 /*
   2  *
   3  *  Generic Bluetooth USB driver
   4  *
   5  *  Copyright (C) 2005-2008  Marcel Holtmann <[email protected]>
   6  *
   7  *
   8  *  This program is free software; you can redistribute it and/or modify
   9  *  it under the terms of the GNU General Public License as published by
  10  *  the Free Software Foundation; either version 2 of the License, or
  11  *  (at your option) any later version.
  12  *
  13  *  This program is distributed in the hope that it will be useful,
  14  *  but WITHOUT ANY WARRANTY; without even the implied warranty of
  15  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  16  *  GNU General Public License for more details.
  17  *
  18  *  You should have received a copy of the GNU General Public License
  19  *  along with this program; if not, write to the Free Software
  20  *  Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
  21  *
  22  */
  23
  24 #include <linux/dmi.h>
  25 #include <linux/module.h>
  26 #include <linux/usb.h>
  27 #include <linux/usb/quirks.h>
  28 #include <linux/firmware.h>
  29 #include <linux/of_device.h>
  30 #include <linux/of_irq.h>
  31 #include <linux/suspend.h>
  32 #include <asm/unaligned.h>
  33
  34 #include <net/bluetooth/bluetooth.h>
  35 #include <net/bluetooth/hci_core.h>
  36
  37 #include "btintel.h"
  38 #include "btbcm.h"
  39 #include "btrtl.h"
  40
  41 #define VERSION "0.8"
  42
  43 static bool disable_scofix;
  44 static bool force_scofix;
  45 static bool enable_autosuspend = IS_ENABLED(CONFIG_BT_HCIBTUSB_AUTOSUSPEND);
  46
  47 static bool reset = true;
  48
  49 static struct usb_driver btusb_driver;
  50
  51 #define BTUSB_IGNORE            0x01
  52 #define BTUSB_DIGIANSWER        0x02
  53 #define BTUSB_CSR               0x04
  54 #define BTUSB_SNIFFER           0x08
  55 #define BTUSB_BCM92035          0x10
  56 #define BTUSB_BROKEN_ISOC       0x20
  57 #define BTUSB_WRONG_SCO_MTU     0x40
  58 #define BTUSB_ATH3012           0x80
  59 #define BTUSB_INTEL             0x100
  60 #define BTUSB_INTEL_BOOT        0x200
  61 #define BTUSB_BCM_PATCHRAM      0x400
  62 #define BTUSB_MARVELL           0x800
  63 #define BTUSB_SWAVE             0x1000
  64 #define BTUSB_INTEL_NEW         0x2000
  65 #define BTUSB_AMP               0x4000
  66 #define BTUSB_QCA_ROME          0x8000
  67 #define BTUSB_BCM_APPLE         0x10000
  68 #define BTUSB_REALTEK           0x20000
  69 #define BTUSB_BCM2045           0x40000
  70 #define BTUSB_IFNUM_2           0x80000
  71 #define BTUSB_CW6622            0x100000
  72
  73 static const struct usb_device_id btusb_table[] = {
  74         /* Generic Bluetooth USB device */
  75         { USB_DEVICE_INFO(0xe0, 0x01, 0x01) },
  76
  77         /* Generic Bluetooth AMP device */
  78         { USB_DEVICE_INFO(0xe0, 0x01, 0x04), .driver_info = BTUSB_AMP },
  79
  80         /* Generic Bluetooth USB interface */
  81         { USB_INTERFACE_INFO(0xe0, 0x01, 0x01) },
  82
  83         /* Apple-specific (Broadcom) devices */
  84         { USB_VENDOR_AND_INTERFACE_INFO(0x05ac, 0xff, 0x01, 0x01),
  85           .driver_info = BTUSB_BCM_APPLE | BTUSB_IFNUM_2 },
  86
  87         /* MediaTek MT76x0E */
  88         { USB_DEVICE(0x0e8d, 0x763f) },
  89
  90         /* Broadcom SoftSailing reporting vendor specific */
  91         { USB_DEVICE(0x0a5c, 0x21e1) },
  92
  93         /* Apple MacBookPro 7,1 */
  94         { USB_DEVICE(0x05ac, 0x8213) },
  95
  96         /* Apple iMac11,1 */
  97         { USB_DEVICE(0x05ac, 0x8215) },
  98
  99         /* Apple MacBookPro6,2 */
 100         { USB_DEVICE(0x05ac, 0x8218) },
 101
 102         /* Apple MacBookAir3,1, MacBookAir3,2 */
 103         { USB_DEVICE(0x05ac, 0x821b) },
 104
 105         /* Apple MacBookAir4,1 */
 106         { USB_DEVICE(0x05ac, 0x821f) },
 107
 108         /* Apple MacBookPro8,2 */
 109         { USB_DEVICE(0x05ac, 0x821a) },
 110
 111         /* Apple MacMini5,1 */
 112         { USB_DEVICE(0x05ac, 0x8281) },
 113
 114         /* AVM BlueFRITZ! USB v2.0 */
 115         { USB_DEVICE(0x057c, 0x3800), .driver_info = BTUSB_SWAVE },
 116
 117         /* Bluetooth Ultraport Module from IBM */
 118         { USB_DEVICE(0x04bf, 0x030a) },
 119
 120         /* ALPS Modules with non-standard id */
 121         { USB_DEVICE(0x044e, 0x3001) },
 122         { USB_DEVICE(0x044e, 0x3002) },
 123
 124         /* Ericsson with non-standard id */
 125         { USB_DEVICE(0x0bdb, 0x1002) },
 126
 127         /* Canyon CN-BTU1 with HID interfaces */
 128         { USB_DEVICE(0x0c10, 0x0000) },
 129
 130         /* Broadcom BCM20702A0 */
 131         { USB_DEVICE(0x413c, 0x8197) },
 132
 133         /* Broadcom BCM20702B0 (Dynex/Insignia) */
 134         { USB_DEVICE(0x19ff, 0x0239), .driver_info = BTUSB_BCM_PATCHRAM },
 135
 136         /* Broadcom BCM43142A0 (Foxconn/Lenovo) */
 137         { USB_VENDOR_AND_INTERFACE_INFO(0x105b, 0xff, 0x01, 0x01),
 138           .driver_info = BTUSB_BCM_PATCHRAM },
 139
 140         /* Broadcom BCM920703 (HTC Vive) */
 141         { USB_VENDOR_AND_INTERFACE_INFO(0x0bb4, 0xff, 0x01, 0x01),
 142           .driver_info = BTUSB_BCM_PATCHRAM },
 143
 144         /* Foxconn - Hon Hai */
 145         { USB_VENDOR_AND_INTERFACE_INFO(0x0489, 0xff, 0x01, 0x01),
 146           .driver_info = BTUSB_BCM_PATCHRAM },
 147
 148         /* Lite-On Technology - Broadcom based */
 149         { USB_VENDOR_AND_INTERFACE_INFO(0x04ca, 0xff, 0x01, 0x01),
 150           .driver_info = BTUSB_BCM_PATCHRAM },
 151
 152         /* Broadcom devices with vendor specific id */
 153         { USB_VENDOR_AND_INTERFACE_INFO(0x0a5c, 0xff, 0x01, 0x01),
 154           .driver_info = BTUSB_BCM_PATCHRAM },
 155
 156         /* ASUSTek Computer - Broadcom based */
 157         { USB_VENDOR_AND_INTERFACE_INFO(0x0b05, 0xff, 0x01, 0x01),
 158           .driver_info = BTUSB_BCM_PATCHRAM },
 159
 160         /* Belkin F8065bf - Broadcom based */
 161         { USB_VENDOR_AND_INTERFACE_INFO(0x050d, 0xff, 0x01, 0x01),
 162           .driver_info = BTUSB_BCM_PATCHRAM },
 163
 164         /* IMC Networks - Broadcom based */
 165         { USB_VENDOR_AND_INTERFACE_INFO(0x13d3, 0xff, 0x01, 0x01),
 166           .driver_info = BTUSB_BCM_PATCHRAM },
 167
 168         /* Dell Computer - Broadcom based  */
 169         { USB_VENDOR_AND_INTERFACE_INFO(0x413c, 0xff, 0x01, 0x01),
 170           .driver_info = BTUSB_BCM_PATCHRAM },
 171
 172         /* Toshiba Corp - Broadcom based */
 173         { USB_VENDOR_AND_INTERFACE_INFO(0x0930, 0xff, 0x01, 0x01),
 174           .driver_info = BTUSB_BCM_PATCHRAM },
 175
 176         /* Intel Bluetooth USB Bootloader (RAM module) */
 177         { USB_DEVICE(0x8087, 0x0a5a),
 178           .driver_info = BTUSB_INTEL_BOOT | BTUSB_BROKEN_ISOC },
 179
 180         { }     /* Terminating entry */
 181 };
 182
 183 MODULE_DEVICE_TABLE(usb, btusb_table);
 184
 185 static const struct usb_device_id blacklist_table[] = {
 186         /* CSR BlueCore devices */
 187         { USB_DEVICE(0x0a12, 0x0001), .driver_info = BTUSB_CSR },
 188
 189         /* Broadcom BCM2033 without firmware */
 190         { USB_DEVICE(0x0a5c, 0x2033), .driver_info = BTUSB_IGNORE },
 191
 192         /* Broadcom BCM2045 devices */
 193         { USB_DEVICE(0x0a5c, 0x2045), .driver_info = BTUSB_BCM2045 },
 194
 195         /* Atheros 3011 with sflash firmware */
 196         { USB_DEVICE(0x0489, 0xe027), .driver_info = BTUSB_IGNORE },
 197         { USB_DEVICE(0x0489, 0xe03d), .driver_info = BTUSB_IGNORE },
 198         { USB_DEVICE(0x04f2, 0xaff1), .driver_info = BTUSB_IGNORE },
 199         { USB_DEVICE(0x0930, 0x0215), .driver_info = BTUSB_IGNORE },
 200         { USB_DEVICE(0x0cf3, 0x3002), .driver_info = BTUSB_IGNORE },
 201         { USB_DEVICE(0x0cf3, 0xe019), .driver_info = BTUSB_IGNORE },
 202         { USB_DEVICE(0x13d3, 0x3304), .driver_info = BTUSB_IGNORE },
 203
 204         /* Atheros AR9285 Malbec with sflash firmware */
 205         { USB_DEVICE(0x03f0, 0x311d), .driver_info = BTUSB_IGNORE },
 206
 207         /* Atheros 3012 with sflash firmware */
 208         { USB_DEVICE(0x0489, 0xe04d), .driver_info = BTUSB_ATH3012 },
 209         { USB_DEVICE(0x0489, 0xe04e), .driver_info = BTUSB_ATH3012 },
 210         { USB_DEVICE(0x0489, 0xe056), .driver_info = BTUSB_ATH3012 },
 211         { USB_DEVICE(0x0489, 0xe057), .driver_info = BTUSB_ATH3012 },
 212         { USB_DEVICE(0x0489, 0xe05f), .driver_info = BTUSB_ATH3012 },
 213         { USB_DEVICE(0x0489, 0xe076), .driver_info = BTUSB_ATH3012 },
 214         { USB_DEVICE(0x0489, 0xe078), .driver_info = BTUSB_ATH3012 },
 215         { USB_DEVICE(0x0489, 0xe095), .driver_info = BTUSB_ATH3012 },
 216         { USB_DEVICE(0x04c5, 0x1330), .driver_info = BTUSB_ATH3012 },
 217         { USB_DEVICE(0x04ca, 0x3004), .driver_info = BTUSB_ATH3012 },
 218         { USB_DEVICE(0x04ca, 0x3005), .driver_info = BTUSB_ATH3012 },
 219         { USB_DEVICE(0x04ca, 0x3006), .driver_info = BTUSB_ATH3012 },
 220         { USB_DEVICE(0x04ca, 0x3007), .driver_info = BTUSB_ATH3012 },
 221         { USB_DEVICE(0x04ca, 0x3008), .driver_info = BTUSB_ATH3012 },
 222         { USB_DEVICE(0x04ca, 0x300b), .driver_info = BTUSB_ATH3012 },
 223         { USB_DEVICE(0x04ca, 0x300d), .driver_info = BTUSB_ATH3012 },
 224         { USB_DEVICE(0x04ca, 0x300f), .driver_info = BTUSB_ATH3012 },
 225         { USB_DEVICE(0x04ca, 0x3010), .driver_info = BTUSB_ATH3012 },
 226         { USB_DEVICE(0x04ca, 0x3014), .driver_info = BTUSB_ATH3012 },
 227         { USB_DEVICE(0x04ca, 0x3018), .driver_info = BTUSB_ATH3012 },
 228         { USB_DEVICE(0x0930, 0x0219), .driver_info = BTUSB_ATH3012 },
 229         { USB_DEVICE(0x0930, 0x021c), .driver_info = BTUSB_ATH3012 },
 230         { USB_DEVICE(0x0930, 0x0220), .driver_info = BTUSB_ATH3012 },
 231         { USB_DEVICE(0x0930, 0x0227), .driver_info = BTUSB_ATH3012 },
 232         { USB_DEVICE(0x0b05, 0x17d0), .driver_info = BTUSB_ATH3012 },
 233         { USB_DEVICE(0x0cf3, 0x0036), .driver_info = BTUSB_ATH3012 },
 234         { USB_DEVICE(0x0cf3, 0x3004), .driver_info = BTUSB_ATH3012 },
 235         { USB_DEVICE(0x0cf3, 0x3008), .driver_info = BTUSB_ATH3012 },
 236         { USB_DEVICE(0x0cf3, 0x311d), .driver_info = BTUSB_ATH3012 },
 237         { USB_DEVICE(0x0cf3, 0x311e), .driver_info = BTUSB_ATH3012 },
 238         { USB_DEVICE(0x0cf3, 0x311f), .driver_info = BTUSB_ATH3012 },
 239         { USB_DEVICE(0x0cf3, 0x3121), .driver_info = BTUSB_ATH3012 },
 240         { USB_DEVICE(0x0cf3, 0x817a), .driver_info = BTUSB_ATH3012 },
 241         { USB_DEVICE(0x0cf3, 0x817b), .driver_info = BTUSB_ATH3012 },
 242         { USB_DEVICE(0x0cf3, 0xe003), .driver_info = BTUSB_ATH3012 },
 243         { USB_DEVICE(0x0cf3, 0xe004), .driver_info = BTUSB_ATH3012 },
 244         { USB_DEVICE(0x0cf3, 0xe005), .driver_info = BTUSB_ATH3012 },
 245         { USB_DEVICE(0x0cf3, 0xe006), .driver_info = BTUSB_ATH3012 },
 246         { USB_DEVICE(0x13d3, 0x3362), .driver_info = BTUSB_ATH3012 },
 247         { USB_DEVICE(0x13d3, 0x3375), .driver_info = BTUSB_ATH3012 },
 248         { USB_DEVICE(0x13d3, 0x3393), .driver_info = BTUSB_ATH3012 },
 249         { USB_DEVICE(0x13d3, 0x3395), .driver_info = BTUSB_ATH3012 },
 250         { USB_DEVICE(0x13d3, 0x3402), .driver_info = BTUSB_ATH3012 },
 251         { USB_DEVICE(0x13d3, 0x3408), .driver_info = BTUSB_ATH3012 },
 252         { USB_DEVICE(0x13d3, 0x3423), .driver_info = BTUSB_ATH3012 },
 253         { USB_DEVICE(0x13d3, 0x3432), .driver_info = BTUSB_ATH3012 },
 254         { USB_DEVICE(0x13d3, 0x3472), .driver_info = BTUSB_ATH3012 },
 255         { USB_DEVICE(0x13d3, 0x3474), .driver_info = BTUSB_ATH3012 },
 256         { USB_DEVICE(0x13d3, 0x3487), .driver_info = BTUSB_ATH3012 },
 257         { USB_DEVICE(0x13d3, 0x3490), .driver_info = BTUSB_ATH3012 },
 258
 259         /* Atheros AR5BBU12 with sflash firmware */
 260         { USB_DEVICE(0x0489, 0xe02c), .driver_info = BTUSB_IGNORE },
 261
 262         /* Atheros AR5BBU12 with sflash firmware */
 263         { USB_DEVICE(0x0489, 0xe036), .driver_info = BTUSB_ATH3012 },
 264         { USB_DEVICE(0x0489, 0xe03c), .driver_info = BTUSB_ATH3012 },
 265
 266         /* QCA ROME chipset */
 267         { USB_DEVICE(0x0cf3, 0xe007), .driver_info = BTUSB_QCA_ROME },
 268         { USB_DEVICE(0x0cf3, 0xe009), .driver_info = BTUSB_QCA_ROME },
 269         { USB_DEVICE(0x0cf3, 0xe010), .driver_info = BTUSB_QCA_ROME },
 270         { USB_DEVICE(0x0cf3, 0xe300), .driver_info = BTUSB_QCA_ROME },
 271         { USB_DEVICE(0x0cf3, 0xe301), .driver_info = BTUSB_QCA_ROME },
 272         { USB_DEVICE(0x0cf3, 0xe360), .driver_info = BTUSB_QCA_ROME },
 273         { USB_DEVICE(0x0489, 0xe092), .driver_info = BTUSB_QCA_ROME },
 274         { USB_DEVICE(0x0489, 0xe09f), .driver_info = BTUSB_QCA_ROME },
 275         { USB_DEVICE(0x0489, 0xe0a2), .driver_info = BTUSB_QCA_ROME },
 276         { USB_DEVICE(0x04ca, 0x3011), .driver_info = BTUSB_QCA_ROME },
 277         { USB_DEVICE(0x04ca, 0x3015), .driver_info = BTUSB_QCA_ROME },
 278         { USB_DEVICE(0x04ca, 0x3016), .driver_info = BTUSB_QCA_ROME },
 279
 280         /* Broadcom BCM2035 */
 281         { USB_DEVICE(0x0a5c, 0x2009), .driver_info = BTUSB_BCM92035 },
 282         { USB_DEVICE(0x0a5c, 0x200a), .driver_info = BTUSB_WRONG_SCO_MTU },
 283         { USB_DEVICE(0x0a5c, 0x2035), .driver_info = BTUSB_WRONG_SCO_MTU },
 284
 285         /* Broadcom BCM2045 */
 286         { USB_DEVICE(0x0a5c, 0x2039), .driver_info = BTUSB_WRONG_SCO_MTU },
 287         { USB_DEVICE(0x0a5c, 0x2101), .driver_info = BTUSB_WRONG_SCO_MTU },
 288
 289         /* IBM/Lenovo ThinkPad with Broadcom chip */
 290         { USB_DEVICE(0x0a5c, 0x201e), .driver_info = BTUSB_WRONG_SCO_MTU },
 291         { USB_DEVICE(0x0a5c, 0x2110), .driver_info = BTUSB_WRONG_SCO_MTU },
 292
 293         /* HP laptop with Broadcom chip */
 294         { USB_DEVICE(0x03f0, 0x171d), .driver_info = BTUSB_WRONG_SCO_MTU },
 295
 296         /* Dell laptop with Broadcom chip */
 297         { USB_DEVICE(0x413c, 0x8126), .driver_info = BTUSB_WRONG_SCO_MTU },
 298
 299         /* Dell Wireless 370 and 410 devices */
 300         { USB_DEVICE(0x413c, 0x8152), .driver_info = BTUSB_WRONG_SCO_MTU },
 301         { USB_DEVICE(0x413c, 0x8156), .driver_info = BTUSB_WRONG_SCO_MTU },
 302
 303         /* Belkin F8T012 and F8T013 devices */
 304         { USB_DEVICE(0x050d, 0x0012), .driver_info = BTUSB_WRONG_SCO_MTU },
 305         { USB_DEVICE(0x050d, 0x0013), .driver_info = BTUSB_WRONG_SCO_MTU },
 306
 307         /* Asus WL-BTD202 device */
 308         { USB_DEVICE(0x0b05, 0x1715), .driver_info = BTUSB_WRONG_SCO_MTU },
 309
 310         /* Kensington Bluetooth USB adapter */
 311         { USB_DEVICE(0x047d, 0x105e), .driver_info = BTUSB_WRONG_SCO_MTU },
 312
 313         /* RTX Telecom based adapters with buggy SCO support */
 314         { USB_DEVICE(0x0400, 0x0807), .driver_info = BTUSB_BROKEN_ISOC },
 315         { USB_DEVICE(0x0400, 0x080a), .driver_info = BTUSB_BROKEN_ISOC },
 316
 317         /* CONWISE Technology based adapters with buggy SCO support */
 318         { USB_DEVICE(0x0e5e, 0x6622),
 319           .driver_info = BTUSB_BROKEN_ISOC | BTUSB_CW6622},
 320
 321         /* Roper Class 1 Bluetooth Dongle (Silicon Wave based) */
 322         { USB_DEVICE(0x1310, 0x0001), .driver_info = BTUSB_SWAVE },
 323
 324         /* Digianswer devices */
 325         { USB_DEVICE(0x08fd, 0x0001), .driver_info = BTUSB_DIGIANSWER },
 326         { USB_DEVICE(0x08fd, 0x0002), .driver_info = BTUSB_IGNORE },
 327
 328         /* CSR BlueCore Bluetooth Sniffer */
 329         { USB_DEVICE(0x0a12, 0x0002),
 330           .driver_info = BTUSB_SNIFFER | BTUSB_BROKEN_ISOC },
 331
 332         /* Frontline ComProbe Bluetooth Sniffer */
 333         { USB_DEVICE(0x16d3, 0x0002),
 334           .driver_info = BTUSB_SNIFFER | BTUSB_BROKEN_ISOC },
 335
 336         /* Marvell Bluetooth devices */
 337         { USB_DEVICE(0x1286, 0x2044), .driver_info = BTUSB_MARVELL },
 338         { USB_DEVICE(0x1286, 0x2046), .driver_info = BTUSB_MARVELL },
 339         { USB_DEVICE(0x1286, 0x204e), .driver_info = BTUSB_MARVELL },
 340
 341         /* Intel Bluetooth devices */
 342         { USB_DEVICE(0x8087, 0x0025), .driver_info = BTUSB_INTEL_NEW },
 343         { USB_DEVICE(0x8087, 0x0026), .driver_info = BTUSB_INTEL_NEW },
 344         { USB_DEVICE(0x8087, 0x07da), .driver_info = BTUSB_CSR },
 345         { USB_DEVICE(0x8087, 0x07dc), .driver_info = BTUSB_INTEL },
 346         { USB_DEVICE(0x8087, 0x0a2a), .driver_info = BTUSB_INTEL },
 347         { USB_DEVICE(0x8087, 0x0a2b), .driver_info = BTUSB_INTEL_NEW },
 348         { USB_DEVICE(0x8087, 0x0aa7), .driver_info = BTUSB_INTEL },
 349         { USB_DEVICE(0x8087, 0x0aaa), .driver_info = BTUSB_INTEL_NEW },
 350
 351         /* Other Intel Bluetooth devices */
 352         { USB_VENDOR_AND_INTERFACE_INFO(0x8087, 0xe0, 0x01, 0x01),
 353           .driver_info = BTUSB_IGNORE },
 354
 355         /* Realtek Bluetooth devices */
 356         { USB_VENDOR_AND_INTERFACE_INFO(0x0bda, 0xe0, 0x01, 0x01),
 357           .driver_info = BTUSB_REALTEK },
 358
 359         /* Additional Realtek 8723AE Bluetooth devices */
 360         { USB_DEVICE(0x0930, 0x021d), .driver_info = BTUSB_REALTEK },
 361         { USB_DEVICE(0x13d3, 0x3394), .driver_info = BTUSB_REALTEK },
 362
 363         /* Additional Realtek 8723BE Bluetooth devices */
 364         { USB_DEVICE(0x0489, 0xe085), .driver_info = BTUSB_REALTEK },
 365         { USB_DEVICE(0x0489, 0xe08b), .driver_info = BTUSB_REALTEK },
 366         { USB_DEVICE(0x13d3, 0x3410), .driver_info = BTUSB_REALTEK },
 367         { USB_DEVICE(0x13d3, 0x3416), .driver_info = BTUSB_REALTEK },
 368         { USB_DEVICE(0x13d3, 0x3459), .driver_info = BTUSB_REALTEK },
 369         { USB_DEVICE(0x13d3, 0x3494), .driver_info = BTUSB_REALTEK },
 370
 371         /* Additional Realtek 8821AE Bluetooth devices */
 372         { USB_DEVICE(0x0b05, 0x17dc), .driver_info = BTUSB_REALTEK },
 373         { USB_DEVICE(0x13d3, 0x3414), .driver_info = BTUSB_REALTEK },
 374         { USB_DEVICE(0x13d3, 0x3458), .driver_info = BTUSB_REALTEK },
 375         { USB_DEVICE(0x13d3, 0x3461), .driver_info = BTUSB_REALTEK },
 376         { USB_DEVICE(0x13d3, 0x3462), .driver_info = BTUSB_REALTEK },
 377
 378         /* Additional Realtek 8822BE Bluetooth devices */
 379         { USB_DEVICE(0x0b05, 0x185c), .driver_info = BTUSB_REALTEK },
 380
 381         /* Silicon Wave based devices */
 382         { USB_DEVICE(0x0c10, 0x0000), .driver_info = BTUSB_SWAVE },
 383
 384         { }     /* Terminating entry */
 385 };
 386
 387 /* The Bluetooth USB module build into some devices needs to be reset on resume,
 388  * this is a problem with the platform (likely shutting off all power) not with
 389  * the module itself. So we use a DMI list to match known broken platforms.
 390  */
 391 static const struct dmi_system_id btusb_needs_reset_resume_table[] = {
 392         {
 393                 /* Lenovo Yoga 920 (QCA Rome device 0cf3:e300) */
 394                 .matches = {
 395                         DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
 396                         DMI_MATCH(DMI_PRODUCT_VERSION, "Lenovo YOGA 920"),
 397                 },
 398         },
 399         {}
 400 };
 401
 402 #define BTUSB_MAX_ISOC_FRAMES   10
 403
 404 #define BTUSB_INTR_RUNNING      0
 405 #define BTUSB_BULK_RUNNING      1
 406 #define BTUSB_ISOC_RUNNING      2
 407 #define BTUSB_SUSPENDING        3
 408 #define BTUSB_DID_ISO_RESUME    4
 409 #define BTUSB_BOOTLOADER        5
 410 #define BTUSB_DOWNLOADING       6
 411 #define BTUSB_FIRMWARE_LOADED   7
 412 #define BTUSB_FIRMWARE_FAILED   8
 413 #define BTUSB_BOOTING           9
 414 #define BTUSB_DIAG_RUNNING      10
 415 #define BTUSB_OOB_WAKE_ENABLED  11
 416
 417 struct btusb_data {
 418         struct hci_dev       *hdev;
 419         struct usb_device    *udev;
 420         struct usb_interface *intf;
 421         struct usb_interface *isoc;
 422         struct usb_interface *diag;
 423         unsigned isoc_ifnum;
 424
 425         unsigned long flags;
 426
 427         struct work_struct work;
 428         struct work_struct waker;
 429
 430         struct usb_anchor deferred;
 431         struct usb_anchor tx_anchor;
 432         int tx_in_flight;
 433         spinlock_t txlock;
 434
 435         struct usb_anchor intr_anchor;
 436         struct usb_anchor bulk_anchor;
 437         struct usb_anchor isoc_anchor;
 438         struct usb_anchor diag_anchor;
 439         spinlock_t rxlock;
 440
 441         struct sk_buff *evt_skb;
 442         struct sk_buff *acl_skb;
 443         struct sk_buff *sco_skb;
 444
 445         struct usb_endpoint_descriptor *intr_ep;
 446         struct usb_endpoint_descriptor *bulk_tx_ep;
 447         struct usb_endpoint_descriptor *bulk_rx_ep;
 448         struct usb_endpoint_descriptor *isoc_tx_ep;
 449         struct usb_endpoint_descriptor *isoc_rx_ep;
 450         struct usb_endpoint_descriptor *diag_tx_ep;
 451         struct usb_endpoint_descriptor *diag_rx_ep;
 452
 453         __u8 cmdreq_type;
 454         __u8 cmdreq;
 455
 456         unsigned int sco_num;
 457         int isoc_altsetting;
 458         int suspend_count;
 459
 460         int (*recv_event)(struct hci_dev *hdev, struct sk_buff *skb);
 461         int (*recv_bulk)(struct btusb_data *data, void *buffer, int count);
 462
 463         int (*setup_on_usb)(struct hci_dev *hdev);
 464
 465         int oob_wake_irq;   /* irq for out-of-band wake-on-bt */
 466 };
 467
 468 static inline void btusb_free_frags(struct btusb_data *data)
 469 {
 470         unsigned long flags;
 471
 472         spin_lock_irqsave(&data->rxlock, flags);
 473
 474         kfree_skb(data->evt_skb);
 475         data->evt_skb = NULL;
 476
 477         kfree_skb(data->acl_skb);
 478         data->acl_skb = NULL;
 479
 480         kfree_skb(data->sco_skb);
 481         data->sco_skb = NULL;
 482
 483         spin_unlock_irqrestore(&data->rxlock, flags);
 484 }
 485
 486 static int btusb_recv_intr(struct btusb_data *data, void *buffer, int count)
 487 {
 488         struct sk_buff *skb;
 489         int err = 0;
 490
 491         spin_lock(&data->rxlock);
 492         skb = data->evt_skb;
 493
 494         while (count) {
 495                 int len;
 496
 497                 if (!skb) {
 498                         skb = bt_skb_alloc(HCI_MAX_EVENT_SIZE, GFP_ATOMIC);
 499                         if (!skb) {
 500                                 err = -ENOMEM;
 501                                 break;
 502                         }
 503
 504                         hci_skb_pkt_type(skb) = HCI_EVENT_PKT;
 505                         hci_skb_expect(skb) = HCI_EVENT_HDR_SIZE;
 506                 }
 507
 508                 len = min_t(uint, hci_skb_expect(skb), count);
 509                 skb_put_data(skb, buffer, len);
 510
 511                 count -= len;
 512                 buffer += len;
 513                 hci_skb_expect(skb) -= len;
 514
 515                 if (skb->len == HCI_EVENT_HDR_SIZE) {
 516                         /* Complete event header */
 517                         hci_skb_expect(skb) = hci_event_hdr(skb)->plen;
 518
 519                         if (skb_tailroom(skb) < hci_skb_expect(skb)) {
 520                                 kfree_skb(skb);
 521                                 skb = NULL;
 522
 523                                 err = -EILSEQ;
 524                                 break;
 525                         }
 526                 }
 527
 528                 if (!hci_skb_expect(skb)) {
 529                         /* Complete frame */
 530                         data->recv_event(data->hdev, skb);
 531                         skb = NULL;
 532                 }
 533         }
 534
 535         data->evt_skb = skb;
 536         spin_unlock(&data->rxlock);
 537
 538         return err;
 539 }
 540
 541 static int btusb_recv_bulk(struct btusb_data *data, void *buffer, int count)
 542 {
 543         struct sk_buff *skb;
 544         int err = 0;
 545
 546         spin_lock(&data->rxlock);
 547         skb = data->acl_skb;
 548
 549         while (count) {
 550                 int len;
 551
 552                 if (!skb) {
 553                         skb = bt_skb_alloc(HCI_MAX_FRAME_SIZE, GFP_ATOMIC);
 554                         if (!skb) {
 555                                 err = -ENOMEM;
 556                                 break;
 557                         }
 558
 559                         hci_skb_pkt_type(skb) = HCI_ACLDATA_PKT;
 560                         hci_skb_expect(skb) = HCI_ACL_HDR_SIZE;
 561                 }
 562
 563                 len = min_t(uint, hci_skb_expect(skb), count);
 564                 skb_put_data(skb, buffer, len);
 565
 566                 count -= len;
 567                 buffer += len;
 568                 hci_skb_expect(skb) -= len;
 569
 570                 if (skb->len == HCI_ACL_HDR_SIZE) {
 571                         __le16 dlen = hci_acl_hdr(skb)->dlen;
 572
 573                         /* Complete ACL header */
 574                         hci_skb_expect(skb) = __le16_to_cpu(dlen);
 575
 576                         if (skb_tailroom(skb) < hci_skb_expect(skb)) {
 577                                 kfree_skb(skb);
 578                                 skb = NULL;
 579
 580                                 err = -EILSEQ;
 581                                 break;
 582                         }
 583                 }
 584
 585                 if (!hci_skb_expect(skb)) {
 586                         /* Complete frame */
 587                         hci_recv_frame(data->hdev, skb);
 588                         skb = NULL;
 589                 }
 590         }
 591
 592         data->acl_skb = skb;
 593         spin_unlock(&data->rxlock);
 594
 595         return err;
 596 }
 597
 598 static int btusb_recv_isoc(struct btusb_data *data, void *buffer, int count)
 599 {
 600         struct sk_buff *skb;
 601         int err = 0;
 602
 603         spin_lock(&data->rxlock);
 604         skb = data->sco_skb;
 605
 606         while (count) {
 607                 int len;
 608
 609                 if (!skb) {
 610                         skb = bt_skb_alloc(HCI_MAX_SCO_SIZE, GFP_ATOMIC);
 611                         if (!skb) {
 612                                 err = -ENOMEM;
 613                                 break;
 614                         }
 615
 616                         hci_skb_pkt_type(skb) = HCI_SCODATA_PKT;
 617                         hci_skb_expect(skb) = HCI_SCO_HDR_SIZE;
 618                 }
 619
 620                 len = min_t(uint, hci_skb_expect(skb), count);
 621                 skb_put_data(skb, buffer, len);
 622
 623                 count -= len;
 624                 buffer += len;
 625                 hci_skb_expect(skb) -= len;
 626
 627                 if (skb->len == HCI_SCO_HDR_SIZE) {
 628                         /* Complete SCO header */
 629                         hci_skb_expect(skb) = hci_sco_hdr(skb)->dlen;
 630
 631                         if (skb_tailroom(skb) < hci_skb_expect(skb)) {
 632                                 kfree_skb(skb);
 633                                 skb = NULL;
 634
 635                                 err = -EILSEQ;
 636                                 break;
 637                         }
 638                 }
 639
 640                 if (!hci_skb_expect(skb)) {
 641                         /* Complete frame */
 642                         hci_recv_frame(data->hdev, skb);
 643                         skb = NULL;
 644                 }
 645         }
 646
 647         data->sco_skb = skb;
 648         spin_unlock(&data->rxlock);
 649
 650         return err;
 651 }
 652
 653 static void btusb_intr_complete(struct urb *urb)
 654 {
 655         struct hci_dev *hdev = urb->context;
 656         struct btusb_data *data = hci_get_drvdata(hdev);
 657         int err;
 658
 659         BT_DBG("%s urb %p status %d count %d", hdev->name, urb, urb->status,
 660                urb->actual_length);
 661
 662         if (!test_bit(HCI_RUNNING, &hdev->flags))
 663                 return;
 664
 665         if (urb->status == 0) {
 666                 hdev->stat.byte_rx += urb->actual_length;
 667
 668                 if (btusb_recv_intr(data, urb->transfer_buffer,
 669                                     urb->actual_length) < 0) {
 670                         bt_dev_err(hdev, "corrupted event packet");
 671                         hdev->stat.err_rx++;
 672                 }
 673         } else if (urb->status == -ENOENT) {
 674                 /* Avoid suspend failed when usb_kill_urb */
 675                 return;
 676         }
 677
 678         if (!test_bit(BTUSB_INTR_RUNNING, &data->flags))
 679                 return;
 680
 681         usb_mark_last_busy(data->udev);
 682         usb_anchor_urb(urb, &data->intr_anchor);
 683
 684         err = usb_submit_urb(urb, GFP_ATOMIC);
 685         if (err < 0) {
 686                 /* -EPERM: urb is being killed;
 687                  * -ENODEV: device got disconnected
 688                  */
 689                 if (err != -EPERM && err != -ENODEV)
 690                         bt_dev_err(hdev, "urb %p failed to resubmit (%d)",
 691                                    urb, -err);
 692                 usb_unanchor_urb(urb);
 693         }
 694 }
 695
 696 static int btusb_submit_intr_urb(struct hci_dev *hdev, gfp_t mem_flags)
 697 {
 698         struct btusb_data *data = hci_get_drvdata(hdev);
 699         struct urb *urb;
 700         unsigned char *buf;
 701         unsigned int pipe;
 702         int err, size;
 703
 704         BT_DBG("%s", hdev->name);
 705
 706         if (!data->intr_ep)
 707                 return -ENODEV;
 708
 709         urb = usb_alloc_urb(0, mem_flags);
 710         if (!urb)
 711                 return -ENOMEM;
 712
 713         size = le16_to_cpu(data->intr_ep->wMaxPacketSize);
 714
 715         buf = kmalloc(size, mem_flags);
 716         if (!buf) {
 717                 usb_free_urb(urb);
 718                 return -ENOMEM;
 719         }
 720
 721         pipe = usb_rcvintpipe(data->udev, data->intr_ep->bEndpointAddress);
 722
 723         usb_fill_int_urb(urb, data->udev, pipe, buf, size,
 724                          btusb_intr_complete, hdev, data->intr_ep->bInterval);
 725
 726         urb->transfer_flags |= URB_FREE_BUFFER;
 727
 728         usb_anchor_urb(urb, &data->intr_anchor);
 729
 730         err = usb_submit_urb(urb, mem_flags);
 731         if (err < 0) {
 732                 if (err != -EPERM && err != -ENODEV)
 733                         bt_dev_err(hdev, "urb %p submission failed (%d)",
 734                                    urb, -err);
 735                 usb_unanchor_urb(urb);
 736         }
 737
 738         usb_free_urb(urb);
 739
 740         return err;
 741 }
 742
 743 static void btusb_bulk_complete(struct urb *urb)
 744 {
 745         struct hci_dev *hdev = urb->context;
 746         struct btusb_data *data = hci_get_drvdata(hdev);
 747         int err;
 748
 749         BT_DBG("%s urb %p status %d count %d", hdev->name, urb, urb->status,
 750                urb->actual_length);
 751
 752         if (!test_bit(HCI_RUNNING, &hdev->flags))
 753                 return;
 754
 755         if (urb->status == 0) {
 756                 hdev->stat.byte_rx += urb->actual_length;
 757
 758                 if (data->recv_bulk(data, urb->transfer_buffer,
 759                                     urb->actual_length) < 0) {
 760                         bt_dev_err(hdev, "corrupted ACL packet");
 761                         hdev->stat.err_rx++;
 762                 }
 763         } else if (urb->status == -ENOENT) {
 764                 /* Avoid suspend failed when usb_kill_urb */
 765                 return;
 766         }
 767
 768         if (!test_bit(BTUSB_BULK_RUNNING, &data->flags))
 769                 return;
 770
 771         usb_anchor_urb(urb, &data->bulk_anchor);
 772         usb_mark_last_busy(data->udev);
 773
 774         err = usb_submit_urb(urb, GFP_ATOMIC);
 775         if (err < 0) {
 776                 /* -EPERM: urb is being killed;
 777                  * -ENODEV: device got disconnected
 778                  */
 779                 if (err != -EPERM && err != -ENODEV)
 780                         bt_dev_err(hdev, "urb %p failed to resubmit (%d)",
 781                                    urb, -err);
 782                 usb_unanchor_urb(urb);
 783         }
 784 }
 785
 786 static int btusb_submit_bulk_urb(struct hci_dev *hdev, gfp_t mem_flags)
 787 {
 788         struct btusb_data *data = hci_get_drvdata(hdev);
 789         struct urb *urb;
 790         unsigned char *buf;
 791         unsigned int pipe;
 792         int err, size = HCI_MAX_FRAME_SIZE;
 793
 794         BT_DBG("%s", hdev->name);
 795
 796         if (!data->bulk_rx_ep)
 797                 return -ENODEV;
 798
 799         urb = usb_alloc_urb(0, mem_flags);
 800         if (!urb)
 801                 return -ENOMEM;
 802
 803         buf = kmalloc(size, mem_flags);
 804         if (!buf) {
 805                 usb_free_urb(urb);
 806                 return -ENOMEM;
 807         }
 808
 809         pipe = usb_rcvbulkpipe(data->udev, data->bulk_rx_ep->bEndpointAddress);
 810
 811         usb_fill_bulk_urb(urb, data->udev, pipe, buf, size,
 812                           btusb_bulk_complete, hdev);
 813
 814         urb->transfer_flags |= URB_FREE_BUFFER;
 815
 816         usb_mark_last_busy(data->udev);
 817         usb_anchor_urb(urb, &data->bulk_anchor);
 818
 819         err = usb_submit_urb(urb, mem_flags);
 820         if (err < 0) {
 821                 if (err != -EPERM && err != -ENODEV)
 822                         bt_dev_err(hdev, "urb %p submission failed (%d)",
 823                                    urb, -err);
 824                 usb_unanchor_urb(urb);
 825         }
 826
 827         usb_free_urb(urb);
 828
 829         return err;
 830 }
 831
 832 static void btusb_isoc_complete(struct urb *urb)
 833 {
 834         struct hci_dev *hdev = urb->context;
 835         struct btusb_data *data = hci_get_drvdata(hdev);
 836         int i, err;
 837
 838         BT_DBG("%s urb %p status %d count %d", hdev->name, urb, urb->status,
 839                urb->actual_length);
 840
 841         if (!test_bit(HCI_RUNNING, &hdev->flags))
 842                 return;
 843
 844         if (urb->status == 0) {
 845                 for (i = 0; i < urb->number_of_packets; i++) {
 846                         unsigned int offset = urb->iso_frame_desc[i].offset;
 847                         unsigned int length = urb->iso_frame_desc[i].actual_length;
 848
 849                         if (urb->iso_frame_desc[i].status)
 850                                 continue;
 851
 852                         hdev->stat.byte_rx += length;
 853
 854                         if (btusb_recv_isoc(data, urb->transfer_buffer + offset,
 855                                             length) < 0) {
 856                                 bt_dev_err(hdev, "corrupted SCO packet");
 857                                 hdev->stat.err_rx++;
 858                         }
 859                 }
 860         } else if (urb->status == -ENOENT) {
 861                 /* Avoid suspend failed when usb_kill_urb */
 862                 return;
 863         }
 864
 865         if (!test_bit(BTUSB_ISOC_RUNNING, &data->flags))
 866                 return;
 867
 868         usb_anchor_urb(urb, &data->isoc_anchor);
 869
 870         err = usb_submit_urb(urb, GFP_ATOMIC);
 871         if (err < 0) {
 872                 /* -EPERM: urb is being killed;
 873                  * -ENODEV: device got disconnected
 874                  */
 875                 if (err != -EPERM && err != -ENODEV)
 876                         bt_dev_err(hdev, "urb %p failed to resubmit (%d)",
 877                                    urb, -err);
 878                 usb_unanchor_urb(urb);
 879         }
 880 }
 881
 882 static inline void __fill_isoc_descriptor(struct urb *urb, int len, int mtu)
 883 {
 884         int i, offset = 0;
 885
 886         BT_DBG("len %d mtu %d", len, mtu);
 887
 888         for (i = 0; i < BTUSB_MAX_ISOC_FRAMES && len >= mtu;
 889                                         i++, offset += mtu, len -= mtu) {
 890                 urb->iso_frame_desc[i].offset = offset;
 891                 urb->iso_frame_desc[i].length = mtu;
 892         }
 893
 894         if (len && i < BTUSB_MAX_ISOC_FRAMES) {
 895                 urb->iso_frame_desc[i].offset = offset;
 896                 urb->iso_frame_desc[i].length = len;
 897                 i++;
 898         }
 899
 900         urb->number_of_packets = i;
 901 }
 902
 903 static int btusb_submit_isoc_urb(struct hci_dev *hdev, gfp_t mem_flags)
 904 {
 905         struct btusb_data *data = hci_get_drvdata(hdev);
 906         struct urb *urb;
 907         unsigned char *buf;
 908         unsigned int pipe;
 909         int err, size;
 910
 911         BT_DBG("%s", hdev->name);
 912
 913         if (!data->isoc_rx_ep)
 914                 return -ENODEV;
 915
 916         urb = usb_alloc_urb(BTUSB_MAX_ISOC_FRAMES, mem_flags);
 917         if (!urb)
 918                 return -ENOMEM;
 919
 920         size = le16_to_cpu(data->isoc_rx_ep->wMaxPacketSize) *
 921                                                 BTUSB_MAX_ISOC_FRAMES;
 922
 923         buf = kmalloc(size, mem_flags);
 924         if (!buf) {
 925                 usb_free_urb(urb);
 926                 return -ENOMEM;
 927         }
 928
 929         pipe = usb_rcvisocpipe(data->udev, data->isoc_rx_ep->bEndpointAddress);
 930
 931         usb_fill_int_urb(urb, data->udev, pipe, buf, size, btusb_isoc_complete,
 932                          hdev, data->isoc_rx_ep->bInterval);
 933
 934         urb->transfer_flags = URB_FREE_BUFFER | URB_ISO_ASAP;
 935
 936         __fill_isoc_descriptor(urb, size,
 937                                le16_to_cpu(data->isoc_rx_ep->wMaxPacketSize));
 938
 939         usb_anchor_urb(urb, &data->isoc_anchor);
 940
 941         err = usb_submit_urb(urb, mem_flags);
 942         if (err < 0) {
 943                 if (err != -EPERM && err != -ENODEV)
 944                         bt_dev_err(hdev, "urb %p submission failed (%d)",
 945                                    urb, -err);
 946                 usb_unanchor_urb(urb);
 947         }
 948
 949         usb_free_urb(urb);
 950
 951         return err;
 952 }
 953
 954 static void btusb_diag_complete(struct urb *urb)
 955 {
 956         struct hci_dev *hdev = urb->context;
 957         struct btusb_data *data = hci_get_drvdata(hdev);
 958         int err;
 959
 960         BT_DBG("%s urb %p status %d count %d", hdev->name, urb, urb->status,
 961                urb->actual_length);
 962
 963         if (urb->status == 0) {
 964                 struct sk_buff *skb;
 965
 966                 skb = bt_skb_alloc(urb->actual_length, GFP_ATOMIC);
 967                 if (skb) {
 968                         skb_put_data(skb, urb->transfer_buffer,
 969                                      urb->actual_length);
 970                         hci_recv_diag(hdev, skb);
 971                 }
 972         } else if (urb->status == -ENOENT) {
 973                 /* Avoid suspend failed when usb_kill_urb */
 974                 return;
 975         }
 976
 977         if (!test_bit(BTUSB_DIAG_RUNNING, &data->flags))
 978                 return;
 979
 980         usb_anchor_urb(urb, &data->diag_anchor);
 981         usb_mark_last_busy(data->udev);
 982
 983         err = usb_submit_urb(urb, GFP_ATOMIC);
 984         if (err < 0) {
 985                 /* -EPERM: urb is being killed;
 986                  * -ENODEV: device got disconnected
 987                  */
 988                 if (err != -EPERM && err != -ENODEV)
 989                         bt_dev_err(hdev, "urb %p failed to resubmit (%d)",
 990                                    urb, -err);
 991                 usb_unanchor_urb(urb);
 992         }
 993 }
 994
 995 static int btusb_submit_diag_urb(struct hci_dev *hdev, gfp_t mem_flags)
 996 {
 997         struct btusb_data *data = hci_get_drvdata(hdev);
 998         struct urb *urb;
 999         unsigned char *buf;
1000         unsigned int pipe;
1001         int err, size = HCI_MAX_FRAME_SIZE;
1002
1003         BT_DBG("%s", hdev->name);
1004
1005         if (!data->diag_rx_ep)
1006                 return -ENODEV;
1007
1008         urb = usb_alloc_urb(0, mem_flags);
1009         if (!urb)
1010                 return -ENOMEM;
1011
1012         buf = kmalloc(size, mem_flags);
1013         if (!buf) {
1014                 usb_free_urb(urb);
1015                 return -ENOMEM;
1016         }
1017
1018         pipe = usb_rcvbulkpipe(data->udev, data->diag_rx_ep->bEndpointAddress);
1019
1020         usb_fill_bulk_urb(urb, data->udev, pipe, buf, size,
1021                           btusb_diag_complete, hdev);
1022
1023         urb->transfer_flags |= URB_FREE_BUFFER;
1024
1025         usb_mark_last_busy(data->udev);
1026         usb_anchor_urb(urb, &data->diag_anchor);
1027
1028         err = usb_submit_urb(urb, mem_flags);
1029         if (err < 0) {
1030                 if (err != -EPERM && err != -ENODEV)
1031                         bt_dev_err(hdev, "urb %p submission failed (%d)",
1032                                    urb, -err);
1033                 usb_unanchor_urb(urb);
1034         }
1035
1036         usb_free_urb(urb);
1037
1038         return err;
1039 }
1040
1041 static void btusb_tx_complete(struct urb *urb)
1042 {
1043         struct sk_buff *skb = urb->context;
1044         struct hci_dev *hdev = (struct hci_dev *)skb->dev;
1045         struct btusb_data *data = hci_get_drvdata(hdev);
1046
1047         BT_DBG("%s urb %p status %d count %d", hdev->name, urb, urb->status,
1048                urb->actual_length);
1049
1050         if (!test_bit(HCI_RUNNING, &hdev->flags))
1051                 goto done;
1052
1053         if (!urb->status)
1054                 hdev->stat.byte_tx += urb->transfer_buffer_length;
1055         else
1056                 hdev->stat.err_tx++;
1057
1058 done:
1059         spin_lock(&data->txlock);
1060         data->tx_in_flight--;
1061         spin_unlock(&data->txlock);
1062
1063         kfree(urb->setup_packet);
1064
1065         kfree_skb(skb);
1066 }
1067
1068 static void btusb_isoc_tx_complete(struct urb *urb)
1069 {
1070         struct sk_buff *skb = urb->context;
1071         struct hci_dev *hdev = (struct hci_dev *)skb->dev;
1072
1073         BT_DBG("%s urb %p status %d count %d", hdev->name, urb, urb->status,
1074                urb->actual_length);
1075
1076         if (!test_bit(HCI_RUNNING, &hdev->flags))
1077                 goto done;
1078
1079         if (!urb->status)
1080                 hdev->stat.byte_tx += urb->transfer_buffer_length;
1081         else
1082                 hdev->stat.err_tx++;
1083
1084 done:
1085         kfree(urb->setup_packet);
1086
1087         kfree_skb(skb);
1088 }
1089
1090 static int btusb_open(struct hci_dev *hdev)
1091 {
1092         struct btusb_data *data = hci_get_drvdata(hdev);
1093         int err;
1094
1095         BT_DBG("%s", hdev->name);
1096
1097         err = usb_autopm_get_interface(data->intf);
1098         if (err < 0)
1099                 return err;
1100
1101         /* Patching USB firmware files prior to starting any URBs of HCI path
1102          * It is more safe to use USB bulk channel for downloading USB patch
1103          */
1104         if (data->setup_on_usb) {
1105                 err = data->setup_on_usb(hdev);
1106                 if (err < 0)
1107                         return err;
1108         }
1109
1110         data->intf->needs_remote_wakeup = 1;
1111         /* device specific wakeup source enabled and required for USB
1112          * remote wakeup while host is suspended
1113          */
1114         device_wakeup_enable(&data->udev->dev);
1115
1116         if (test_and_set_bit(BTUSB_INTR_RUNNING, &data->flags))
1117                 goto done;
1118
1119         err = btusb_submit_intr_urb(hdev, GFP_KERNEL);
1120         if (err < 0)
1121                 goto failed;
1122
1123         err = btusb_submit_bulk_urb(hdev, GFP_KERNEL);
1124         if (err < 0) {
1125                 usb_kill_anchored_urbs(&data->intr_anchor);
1126                 goto failed;
1127         }
1128
1129         set_bit(BTUSB_BULK_RUNNING, &data->flags);
1130         btusb_submit_bulk_urb(hdev, GFP_KERNEL);
1131
1132         if (data->diag) {
1133                 if (!btusb_submit_diag_urb(hdev, GFP_KERNEL))
1134                         set_bit(BTUSB_DIAG_RUNNING, &data->flags);
1135         }
1136
1137 done:
1138         usb_autopm_put_interface(data->intf);
1139         return 0;
1140
1141 failed:
1142         clear_bit(BTUSB_INTR_RUNNING, &data->flags);
1143         usb_autopm_put_interface(data->intf);
1144         return err;
1145 }
1146
1147 static void btusb_stop_traffic(struct btusb_data *data)
1148 {
1149         usb_kill_anchored_urbs(&data->intr_anchor);
1150         usb_kill_anchored_urbs(&data->bulk_anchor);
1151         usb_kill_anchored_urbs(&data->isoc_anchor);
1152         usb_kill_anchored_urbs(&data->diag_anchor);
1153 }
1154
1155 static int btusb_close(struct hci_dev *hdev)
1156 {
1157         struct btusb_data *data = hci_get_drvdata(hdev);
1158         int err;
1159
1160         BT_DBG("%s", hdev->name);
1161
1162         cancel_work_sync(&data->work);
1163         cancel_work_sync(&data->waker);
1164
1165         clear_bit(BTUSB_ISOC_RUNNING, &data->flags);
1166         clear_bit(BTUSB_BULK_RUNNING, &data->flags);
1167         clear_bit(BTUSB_INTR_RUNNING, &data->flags);
1168         clear_bit(BTUSB_DIAG_RUNNING, &data->flags);
1169
1170         btusb_stop_traffic(data);
1171         btusb_free_frags(data);
1172
1173         err = usb_autopm_get_interface(data->intf);
1174         if (err < 0)
1175                 goto failed;
1176
1177         data->intf->needs_remote_wakeup = 0;
1178         device_wakeup_disable(&data->udev->dev);
1179         usb_autopm_put_interface(data->intf);
1180
1181 failed:
1182         usb_scuttle_anchored_urbs(&data->deferred);
1183         return 0;
1184 }
1185
1186 static int btusb_flush(struct hci_dev *hdev)
1187 {
1188         struct btusb_data *data = hci_get_drvdata(hdev);
1189
1190         BT_DBG("%s", hdev->name);
1191
1192         usb_kill_anchored_urbs(&data->tx_anchor);
1193         btusb_free_frags(data);
1194
1195         return 0;
1196 }
1197
1198 static struct urb *alloc_ctrl_urb(struct hci_dev *hdev, struct sk_buff *skb)
1199 {
1200         struct btusb_data *data = hci_get_drvdata(hdev);
1201         struct usb_ctrlrequest *dr;
1202         struct urb *urb;
1203         unsigned int pipe;
1204
1205         urb = usb_alloc_urb(0, GFP_KERNEL);
1206         if (!urb)
1207                 return ERR_PTR(-ENOMEM);
1208
1209         dr = kmalloc(sizeof(*dr), GFP_KERNEL);
1210         if (!dr) {
1211                 usb_free_urb(urb);
1212                 return ERR_PTR(-ENOMEM);
1213         }
1214
1215         dr->bRequestType = data->cmdreq_type;
1216         dr->bRequest     = data->cmdreq;
1217         dr->wIndex       = 0;
1218         dr->wValue       = 0;
1219         dr->wLength      = __cpu_to_le16(skb->len);
1220
1221         pipe = usb_sndctrlpipe(data->udev, 0x00);
1222
1223         usb_fill_control_urb(urb, data->udev, pipe, (void *)dr,
1224                              skb->data, skb->len, btusb_tx_complete, skb);
1225
1226         skb->dev = (void *)hdev;
1227
1228         return urb;
1229 }
1230
1231 static struct urb *alloc_bulk_urb(struct hci_dev *hdev, struct sk_buff *skb)
1232 {
1233         struct btusb_data *data = hci_get_drvdata(hdev);
1234         struct urb *urb;
1235         unsigned int pipe;
1236
1237         if (!data->bulk_tx_ep)
1238                 return ERR_PTR(-ENODEV);
1239
1240         urb = usb_alloc_urb(0, GFP_KERNEL);
1241         if (!urb)
1242                 return ERR_PTR(-ENOMEM);
1243
1244         pipe = usb_sndbulkpipe(data->udev, data->bulk_tx_ep->bEndpointAddress);
1245
1246         usb_fill_bulk_urb(urb, data->udev, pipe,
1247                           skb->data, skb->len, btusb_tx_complete, skb);
1248
1249         skb->dev = (void *)hdev;
1250
1251         return urb;
1252 }
1253
1254 static struct urb *alloc_isoc_urb(struct hci_dev *hdev, struct sk_buff *skb)
1255 {
1256         struct btusb_data *data = hci_get_drvdata(hdev);
1257         struct urb *urb;
1258         unsigned int pipe;
1259
1260         if (!data->isoc_tx_ep)
1261                 return ERR_PTR(-ENODEV);
1262
1263         urb = usb_alloc_urb(BTUSB_MAX_ISOC_FRAMES, GFP_KERNEL);
1264         if (!urb)
1265                 return ERR_PTR(-ENOMEM);
1266
1267         pipe = usb_sndisocpipe(data->udev, data->isoc_tx_ep->bEndpointAddress);
1268
1269         usb_fill_int_urb(urb, data->udev, pipe,
1270                          skb->data, skb->len, btusb_isoc_tx_complete,
1271                          skb, data->isoc_tx_ep->bInterval);
1272
1273         urb->transfer_flags  = URB_ISO_ASAP;
1274
1275         __fill_isoc_descriptor(urb, skb->len,
1276                                le16_to_cpu(data->isoc_tx_ep->wMaxPacketSize));
1277
1278         skb->dev = (void *)hdev;
1279
1280         return urb;
1281 }
1282
1283 static int submit_tx_urb(struct hci_dev *hdev, struct urb *urb)
1284 {
1285         struct btusb_data *data = hci_get_drvdata(hdev);
1286         int err;
1287
1288         usb_anchor_urb(urb, &data->tx_anchor);
1289
1290         err = usb_submit_urb(urb, GFP_KERNEL);
1291         if (err < 0) {
1292                 if (err != -EPERM && err != -ENODEV)
1293                         bt_dev_err(hdev, "urb %p submission failed (%d)",
1294                                    urb, -err);
1295                 kfree(urb->setup_packet);
1296                 usb_unanchor_urb(urb);
1297         } else {
1298                 usb_mark_last_busy(data->udev);
1299         }
1300
1301         usb_free_urb(urb);
1302         return err;
1303 }
1304
1305 static int submit_or_queue_tx_urb(struct hci_dev *hdev, struct urb *urb)
1306 {
1307         struct btusb_data *data = hci_get_drvdata(hdev);
1308         unsigned long flags;
1309         bool suspending;
1310
1311         spin_lock_irqsave(&data->txlock, flags);
1312         suspending = test_bit(BTUSB_SUSPENDING, &data->flags);
1313         if (!suspending)
1314                 data->tx_in_flight++;
1315         spin_unlock_irqrestore(&data->txlock, flags);
1316
1317         if (!suspending)
1318                 return submit_tx_urb(hdev, urb);
1319
1320         usb_anchor_urb(urb, &data->deferred);
1321         schedule_work(&data->waker);
1322
1323         usb_free_urb(urb);
1324         return 0;
1325 }
1326
1327 static int btusb_send_frame(struct hci_dev *hdev, struct sk_buff *skb)
1328 {
1329         struct urb *urb;
1330
1331         BT_DBG("%s", hdev->name);
1332
1333         switch (hci_skb_pkt_type(skb)) {
1334         case HCI_COMMAND_PKT:
1335                 urb = alloc_ctrl_urb(hdev, skb);
1336                 if (IS_ERR(urb))
1337                         return PTR_ERR(urb);
1338
1339                 hdev->stat.cmd_tx++;
1340                 return submit_or_queue_tx_urb(hdev, urb);
1341
1342         case HCI_ACLDATA_PKT:
1343                 urb = alloc_bulk_urb(hdev, skb);
1344                 if (IS_ERR(urb))
1345                         return PTR_ERR(urb);
1346
1347                 hdev->stat.acl_tx++;
1348                 return submit_or_queue_tx_urb(hdev, urb);
1349
1350         case HCI_SCODATA_PKT:
1351                 if (hci_conn_num(hdev, SCO_LINK) < 1)
1352                         return -ENODEV;
1353
1354                 urb = alloc_isoc_urb(hdev, skb);
1355                 if (IS_ERR(urb))
1356                         return PTR_ERR(urb);
1357
1358                 hdev->stat.sco_tx++;
1359                 return submit_tx_urb(hdev, urb);
1360         }
1361
1362         return -EILSEQ;
1363 }
1364
1365 static void btusb_notify(struct hci_dev *hdev, unsigned int evt)
1366 {
1367         struct btusb_data *data = hci_get_drvdata(hdev);
1368
1369         BT_DBG("%s evt %d", hdev->name, evt);
1370
1371         if (hci_conn_num(hdev, SCO_LINK) != data->sco_num) {
1372                 data->sco_num = hci_conn_num(hdev, SCO_LINK);
1373                 schedule_work(&data->work);
1374         }
1375 }
1376
1377 static inline int __set_isoc_interface(struct hci_dev *hdev, int altsetting)
1378 {
1379         struct btusb_data *data = hci_get_drvdata(hdev);
1380         struct usb_interface *intf = data->isoc;
1381         struct usb_endpoint_descriptor *ep_desc;
1382         int i, err;
1383
1384         if (!data->isoc)
1385                 return -ENODEV;
1386
1387         err = usb_set_interface(data->udev, data->isoc_ifnum, altsetting);
1388         if (err < 0) {
1389                 bt_dev_err(hdev, "setting interface failed (%d)", -err);
1390                 return err;
1391         }
1392
1393         data->isoc_altsetting = altsetting;
1394
1395         data->isoc_tx_ep = NULL;
1396         data->isoc_rx_ep = NULL;
1397
1398         for (i = 0; i < intf->cur_altsetting->desc.bNumEndpoints; i++) {
1399                 ep_desc = &intf->cur_altsetting->endpoint[i].desc;
1400
1401                 if (!data->isoc_tx_ep && usb_endpoint_is_isoc_out(ep_desc)) {
1402                         data->isoc_tx_ep = ep_desc;
1403                         continue;
1404                 }
1405
1406                 if (!data->isoc_rx_ep && usb_endpoint_is_isoc_in(ep_desc)) {
1407                         data->isoc_rx_ep = ep_desc;
1408                         continue;
1409                 }
1410         }
1411
1412         if (!data->isoc_tx_ep || !data->isoc_rx_ep) {
1413                 bt_dev_err(hdev, "invalid SCO descriptors");
1414                 return -ENODEV;
1415         }
1416
1417         return 0;
1418 }
1419
1420 static void btusb_work(struct work_struct *work)
1421 {
1422         struct btusb_data *data = container_of(work, struct btusb_data, work);
1423         struct hci_dev *hdev = data->hdev;
1424         int new_alts;
1425         int err;
1426
1427         if (data->sco_num > 0) {
1428                 if (!test_bit(BTUSB_DID_ISO_RESUME, &data->flags)) {
1429                         err = usb_autopm_get_interface(data->isoc ? data->isoc : data->intf);
1430                         if (err < 0) {
1431                                 clear_bit(BTUSB_ISOC_RUNNING, &data->flags);
1432                                 usb_kill_anchored_urbs(&data->isoc_anchor);
1433                                 return;
1434                         }
1435
1436                         set_bit(BTUSB_DID_ISO_RESUME, &data->flags);
1437                 }
1438
1439                 if (hdev->voice_setting & 0x0020) {
1440                         static const int alts[3] = { 2, 4, 5 };
1441
1442                         new_alts = alts[data->sco_num - 1];
1443                 } else {
1444                         new_alts = data->sco_num;
1445                 }
1446
1447                 if (data->isoc_altsetting != new_alts) {
1448                         unsigned long flags;
1449
1450                         clear_bit(BTUSB_ISOC_RUNNING, &data->flags);
1451                         usb_kill_anchored_urbs(&data->isoc_anchor);
1452
1453                         /* When isochronous alternate setting needs to be
1454                          * changed, because SCO connection has been added
1455                          * or removed, a packet fragment may be left in the
1456                          * reassembling state. This could lead to wrongly
1457                          * assembled fragments.
1458                          *
1459                          * Clear outstanding fragment when selecting a new
1460                          * alternate setting.
1461                          */
1462                         spin_lock_irqsave(&data->rxlock, flags);
1463                         kfree_skb(data->sco_skb);
1464                         data->sco_skb = NULL;
1465                         spin_unlock_irqrestore(&data->rxlock, flags);
1466
1467                         if (__set_isoc_interface(hdev, new_alts) < 0)
1468                                 return;
1469                 }
1470
1471                 if (!test_and_set_bit(BTUSB_ISOC_RUNNING, &data->flags)) {
1472                         if (btusb_submit_isoc_urb(hdev, GFP_KERNEL) < 0)
1473                                 clear_bit(BTUSB_ISOC_RUNNING, &data->flags);
1474                         else
1475                                 btusb_submit_isoc_urb(hdev, GFP_KERNEL);
1476                 }
1477         } else {
1478                 clear_bit(BTUSB_ISOC_RUNNING, &data->flags);
1479                 usb_kill_anchored_urbs(&data->isoc_anchor);
1480
1481                 __set_isoc_interface(hdev, 0);
1482                 if (test_and_clear_bit(BTUSB_DID_ISO_RESUME, &data->flags))
1483                         usb_autopm_put_interface(data->isoc ? data->isoc : data->intf);
1484         }
1485 }
1486
1487 static void btusb_waker(struct work_struct *work)
1488 {
1489         struct btusb_data *data = container_of(work, struct btusb_data, waker);
1490         int err;
1491
1492         err = usb_autopm_get_interface(data->intf);
1493         if (err < 0)
1494                 return;
1495
1496         usb_autopm_put_interface(data->intf);
1497 }
1498
1499 static int btusb_setup_bcm92035(struct hci_dev *hdev)
1500 {
1501         struct sk_buff *skb;
1502         u8 val = 0x00;
1503
1504         BT_DBG("%s", hdev->name);
1505
1506         skb = __hci_cmd_sync(hdev, 0xfc3b, 1, &val, HCI_INIT_TIMEOUT);
1507         if (IS_ERR(skb))
1508                 bt_dev_err(hdev, "BCM92035 command failed (%ld)", PTR_ERR(skb));
1509         else
1510                 kfree_skb(skb);
1511
1512         return 0;
1513 }
1514
1515 static int btusb_setup_csr(struct hci_dev *hdev)
1516 {
1517         struct hci_rp_read_local_version *rp;
1518         struct sk_buff *skb;
1519
1520         BT_DBG("%s", hdev->name);
1521
1522         skb = __hci_cmd_sync(hdev, HCI_OP_READ_LOCAL_VERSION, 0, NULL,
1523                              HCI_INIT_TIMEOUT);
1524         if (IS_ERR(skb)) {
1525                 int err = PTR_ERR(skb);
1526                 bt_dev_err(hdev, "CSR: Local version failed (%d)", err);
1527                 return err;
1528         }
1529
1530         if (skb->len != sizeof(struct hci_rp_read_local_version)) {
1531                 bt_dev_err(hdev, "CSR: Local version length mismatch");
1532                 kfree_skb(skb);
1533                 return -EIO;
1534         }
1535
1536         rp = (struct hci_rp_read_local_version *)skb->data;
1537
1538         /* Detect controllers which aren't real CSR ones. */
1539         if (le16_to_cpu(rp->manufacturer) != 10 ||
1540             le16_to_cpu(rp->lmp_subver) == 0x0c5c) {
1541                 /* Clear the reset quirk since this is not an actual
1542                  * early Bluetooth 1.1 device from CSR.
1543                  */
1544                 clear_bit(HCI_QUIRK_RESET_ON_CLOSE, &hdev->quirks);
1545
1546                 /* These fake CSR controllers have all a broken
1547                  * stored link key handling and so just disable it.
1548                  */
1549                 set_bit(HCI_QUIRK_BROKEN_STORED_LINK_KEY, &hdev->quirks);
1550         }
1551
1552         kfree_skb(skb);
1553
1554         return 0;
1555 }
1556
1557 static const struct firmware *btusb_setup_intel_get_fw(struct hci_dev *hdev,
1558                                                        struct intel_version *ver)
1559 {
1560         const struct firmware *fw;
1561         char fwname[64];
1562         int ret;
1563
1564         snprintf(fwname, sizeof(fwname),
1565                  "intel/ibt-hw-%x.%x.%x-fw-%x.%x.%x.%x.%x.bseq",
1566                  ver->hw_platform, ver->hw_variant, ver->hw_revision,
1567                  ver->fw_variant,  ver->fw_revision, ver->fw_build_num,
1568                  ver->fw_build_ww, ver->fw_build_yy);
1569
1570         ret = request_firmware(&fw, fwname, &hdev->dev);
1571         if (ret < 0) {
1572                 if (ret == -EINVAL) {
1573                         BT_ERR("%s Intel firmware file request failed (%d)",
1574                                hdev->name, ret);
1575                         return NULL;
1576                 }
1577
1578                 BT_ERR("%s failed to open Intel firmware file: %s(%d)",
1579                        hdev->name, fwname, ret);
1580
1581                 /* If the correct firmware patch file is not found, use the
1582                  * default firmware patch file instead
1583                  */
1584                 snprintf(fwname, sizeof(fwname), "intel/ibt-hw-%x.%x.bseq",
1585                          ver->hw_platform, ver->hw_variant);
1586                 if (request_firmware(&fw, fwname, &hdev->dev) < 0) {
1587                         BT_ERR("%s failed to open default Intel fw file: %s",
1588                                hdev->name, fwname);
1589                         return NULL;
1590                 }
1591         }
1592
1593         bt_dev_info(hdev, "Intel Bluetooth firmware file: %s", fwname);
1594
1595         return fw;
1596 }
1597
1598 static int btusb_setup_intel_patching(struct hci_dev *hdev,
1599                                       const struct firmware *fw,
1600                                       const u8 **fw_ptr, int *disable_patch)
1601 {
1602         struct sk_buff *skb;
1603         struct hci_command_hdr *cmd;
1604         const u8 *cmd_param;
1605         struct hci_event_hdr *evt = NULL;
1606         const u8 *evt_param = NULL;
1607         int remain = fw->size - (*fw_ptr - fw->data);
1608
1609         /* The first byte indicates the types of the patch command or event.
1610          * 0x01 means HCI command and 0x02 is HCI event. If the first bytes
1611          * in the current firmware buffer doesn't start with 0x01 or
1612          * the size of remain buffer is smaller than HCI command header,
1613          * the firmware file is corrupted and it should stop the patching
1614          * process.
1615          */
1616         if (remain > HCI_COMMAND_HDR_SIZE && *fw_ptr[0] != 0x01) {
1617                 BT_ERR("%s Intel fw corrupted: invalid cmd read", hdev->name);
1618                 return -EINVAL;
1619         }
1620         (*fw_ptr)++;
1621         remain--;
1622
1623         cmd = (struct hci_command_hdr *)(*fw_ptr);
1624         *fw_ptr += sizeof(*cmd);
1625         remain -= sizeof(*cmd);
1626
1627         /* Ensure that the remain firmware data is long enough than the length
1628          * of command parameter. If not, the firmware file is corrupted.
1629          */
1630         if (remain < cmd->plen) {
1631                 BT_ERR("%s Intel fw corrupted: invalid cmd len", hdev->name);
1632                 return -EFAULT;
1633         }
1634
1635         /* If there is a command that loads a patch in the firmware
1636          * file, then enable the patch upon success, otherwise just
1637          * disable the manufacturer mode, for example patch activation
1638          * is not required when the default firmware patch file is used
1639          * because there are no patch data to load.
1640          */
1641         if (*disable_patch && le16_to_cpu(cmd->opcode) == 0xfc8e)
1642                 *disable_patch = 0;
1643
1644         cmd_param = *fw_ptr;
1645         *fw_ptr += cmd->plen;
1646         remain -= cmd->plen;
1647
1648         /* This reads the expected events when the above command is sent to the
1649          * device. Some vendor commands expects more than one events, for
1650          * example command status event followed by vendor specific event.
1651          * For this case, it only keeps the last expected event. so the command
1652          * can be sent with __hci_cmd_sync_ev() which returns the sk_buff of
1653          * last expected event.
1654          */
1655         while (remain > HCI_EVENT_HDR_SIZE && *fw_ptr[0] == 0x02) {
1656                 (*fw_ptr)++;
1657                 remain--;
1658
1659                 evt = (struct hci_event_hdr *)(*fw_ptr);
1660                 *fw_ptr += sizeof(*evt);
1661                 remain -= sizeof(*evt);
1662
1663                 if (remain < evt->plen) {
1664                         BT_ERR("%s Intel fw corrupted: invalid evt len",
1665                                hdev->name);
1666                         return -EFAULT;
1667                 }
1668
1669                 evt_param = *fw_ptr;
1670                 *fw_ptr += evt->plen;
1671                 remain -= evt->plen;
1672         }
1673
1674         /* Every HCI commands in the firmware file has its correspond event.
1675          * If event is not found or remain is smaller than zero, the firmware
1676          * file is corrupted.
1677          */
1678         if (!evt || !evt_param || remain < 0) {
1679                 BT_ERR("%s Intel fw corrupted: invalid evt read", hdev->name);
1680                 return -EFAULT;
1681         }
1682
1683         skb = __hci_cmd_sync_ev(hdev, le16_to_cpu(cmd->opcode), cmd->plen,
1684                                 cmd_param, evt->evt, HCI_INIT_TIMEOUT);
1685         if (IS_ERR(skb)) {
1686                 BT_ERR("%s sending Intel patch command (0x%4.4x) failed (%ld)",
1687                        hdev->name, cmd->opcode, PTR_ERR(skb));
1688                 return PTR_ERR(skb);
1689         }
1690
1691         /* It ensures that the returned event matches the event data read from
1692          * the firmware file. At fist, it checks the length and then
1693          * the contents of the event.
1694          */
1695         if (skb->len != evt->plen) {
1696                 BT_ERR("%s mismatch event length (opcode 0x%4.4x)", hdev->name,
1697                        le16_to_cpu(cmd->opcode));
1698                 kfree_skb(skb);
1699                 return -EFAULT;
1700         }
1701
1702         if (memcmp(skb->data, evt_param, evt->plen)) {
1703                 BT_ERR("%s mismatch event parameter (opcode 0x%4.4x)",
1704                        hdev->name, le16_to_cpu(cmd->opcode));
1705                 kfree_skb(skb);
1706                 return -EFAULT;
1707         }
1708         kfree_skb(skb);
1709
1710         return 0;
1711 }
1712
1713 static int btusb_setup_intel(struct hci_dev *hdev)
1714 {
1715         struct sk_buff *skb;
1716         const struct firmware *fw;
1717         const u8 *fw_ptr;
1718         int disable_patch, err;
1719         struct intel_version ver;
1720
1721         BT_DBG("%s", hdev->name);
1722
1723         /* The controller has a bug with the first HCI command sent to it
1724          * returning number of completed commands as zero. This would stall the
1725          * command processing in the Bluetooth core.
1726          *
1727          * As a workaround, send HCI Reset command first which will reset the
1728          * number of completed commands and allow normal command processing
1729          * from now on.
1730          */
1731         skb = __hci_cmd_sync(hdev, HCI_OP_RESET, 0, NULL, HCI_INIT_TIMEOUT);
1732         if (IS_ERR(skb)) {
1733                 BT_ERR("%s sending initial HCI reset command failed (%ld)",
1734                        hdev->name, PTR_ERR(skb));
1735                 return PTR_ERR(skb);
1736         }
1737         kfree_skb(skb);
1738
1739         /* Read Intel specific controller version first to allow selection of
1740          * which firmware file to load.
1741          *
1742          * The returned information are hardware variant and revision plus
1743          * firmware variant, revision and build number.
1744          */
1745         err = btintel_read_version(hdev, &ver);
1746         if (err)
1747                 return err;
1748
1749         bt_dev_info(hdev, "read Intel version: %02x%02x%02x%02x%02x%02x%02x%02x%02x",
1750                     ver.hw_platform, ver.hw_variant, ver.hw_revision,
1751                     ver.fw_variant,  ver.fw_revision, ver.fw_build_num,
1752                     ver.fw_build_ww, ver.fw_build_yy, ver.fw_patch_num);
1753
1754         /* fw_patch_num indicates the version of patch the device currently
1755          * have. If there is no patch data in the device, it is always 0x00.
1756          * So, if it is other than 0x00, no need to patch the device again.
1757          */
1758         if (ver.fw_patch_num) {
1759                 bt_dev_info(hdev, "Intel device is already patched. "
1760                             "patch num: %02x", ver.fw_patch_num);
1761                 goto complete;
1762         }
1763
1764         /* Opens the firmware patch file based on the firmware version read
1765          * from the controller. If it fails to open the matching firmware
1766          * patch file, it tries to open the default firmware patch file.
1767          * If no patch file is found, allow the device to operate without
1768          * a patch.
1769          */
1770         fw = btusb_setup_intel_get_fw(hdev, &ver);
1771         if (!fw)
1772                 goto complete;
1773         fw_ptr = fw->data;
1774
1775         /* Enable the manufacturer mode of the controller.
1776          * Only while this mode is enabled, the driver can download the
1777          * firmware patch data and configuration parameters.
1778          */
1779         err = btintel_enter_mfg(hdev);
1780         if (err) {
1781                 release_firmware(fw);
1782                 return err;
1783         }
1784
1785         disable_patch = 1;
1786
1787         /* The firmware data file consists of list of Intel specific HCI
1788          * commands and its expected events. The first byte indicates the
1789          * type of the message, either HCI command or HCI event.
1790          *
1791          * It reads the command and its expected event from the firmware file,
1792          * and send to the controller. Once __hci_cmd_sync_ev() returns,
1793          * the returned event is compared with the event read from the firmware
1794          * file and it will continue until all the messages are downloaded to
1795          * the controller.
1796          *
1797          * Once the firmware patching is completed successfully,
1798          * the manufacturer mode is disabled with reset and activating the
1799          * downloaded patch.
1800          *
1801          * If the firmware patching fails, the manufacturer mode is
1802          * disabled with reset and deactivating the patch.
1803          *
1804          * If the default patch file is used, no reset is done when disabling
1805          * the manufacturer.
1806          */
1807         while (fw->size > fw_ptr - fw->data) {
1808                 int ret;
1809
1810                 ret = btusb_setup_intel_patching(hdev, fw, &fw_ptr,
1811                                                  &disable_patch);
1812                 if (ret < 0)
1813                         goto exit_mfg_deactivate;
1814         }
1815
1816         release_firmware(fw);
1817
1818         if (disable_patch)
1819                 goto exit_mfg_disable;
1820
1821         /* Patching completed successfully and disable the manufacturer mode
1822          * with reset and activate the downloaded firmware patches.
1823          */
1824         err = btintel_exit_mfg(hdev, true, true);
1825         if (err)
1826                 return err;
1827
1828         bt_dev_info(hdev, "Intel firmware patch completed and activated");
1829
1830         goto complete;
1831
1832 exit_mfg_disable:
1833         /* Disable the manufacturer mode without reset */
1834         err = btintel_exit_mfg(hdev, false, false);
1835         if (err)
1836                 return err;
1837
1838         bt_dev_info(hdev, "Intel firmware patch completed");
1839
1840         goto complete;
1841
1842 exit_mfg_deactivate:
1843         release_firmware(fw);
1844
1845         /* Patching failed. Disable the manufacturer mode with reset and
1846          * deactivate the downloaded firmware patches.
1847          */
1848         err = btintel_exit_mfg(hdev, true, false);
1849         if (err)
1850                 return err;
1851
1852         bt_dev_info(hdev, "Intel firmware patch completed and deactivated");
1853
1854 complete:
1855         /* Set the event mask for Intel specific vendor events. This enables
1856          * a few extra events that are useful during general operation.
1857          */
1858         btintel_set_event_mask_mfg(hdev, false);
1859
1860         btintel_check_bdaddr(hdev);
1861         return 0;
1862 }
1863
1864 static int inject_cmd_complete(struct hci_dev *hdev, __u16 opcode)
1865 {
1866         struct sk_buff *skb;
1867         struct hci_event_hdr *hdr;
1868         struct hci_ev_cmd_complete *evt;
1869
1870         skb = bt_skb_alloc(sizeof(*hdr) + sizeof(*evt) + 1, GFP_ATOMIC);
1871         if (!skb)
1872                 return -ENOMEM;
1873
1874         hdr = skb_put(skb, sizeof(*hdr));
1875         hdr->evt = HCI_EV_CMD_COMPLETE;
1876         hdr->plen = sizeof(*evt) + 1;
1877
1878         evt = skb_put(skb, sizeof(*evt));
1879         evt->ncmd = 0x01;
1880         evt->opcode = cpu_to_le16(opcode);
1881
1882         skb_put_u8(skb, 0x00);
1883
1884         hci_skb_pkt_type(skb) = HCI_EVENT_PKT;
1885
1886         return hci_recv_frame(hdev, skb);
1887 }
1888
1889 static int btusb_recv_bulk_intel(struct btusb_data *data, void *buffer,
1890                                  int count)
1891 {
1892         /* When the device is in bootloader mode, then it can send
1893          * events via the bulk endpoint. These events are treated the
1894          * same way as the ones received from the interrupt endpoint.
1895          */
1896         if (test_bit(BTUSB_BOOTLOADER, &data->flags))
1897                 return btusb_recv_intr(data, buffer, count);
1898
1899         return btusb_recv_bulk(data, buffer, count);
1900 }
1901
1902 static void btusb_intel_bootup(struct btusb_data *data, const void *ptr,
1903                                unsigned int len)
1904 {
1905         const struct intel_bootup *evt = ptr;
1906
1907         if (len != sizeof(*evt))
1908                 return;
1909
1910         if (test_and_clear_bit(BTUSB_BOOTING, &data->flags)) {
1911                 smp_mb__after_atomic();
1912                 wake_up_bit(&data->flags, BTUSB_BOOTING);
1913         }
1914 }
1915
1916 static void btusb_intel_secure_send_result(struct btusb_data *data,
1917                                            const void *ptr, unsigned int len)
1918 {
1919         const struct intel_secure_send_result *evt = ptr;
1920
1921         if (len != sizeof(*evt))
1922                 return;
1923
1924         if (evt->result)
1925                 set_bit(BTUSB_FIRMWARE_FAILED, &data->flags);
1926
1927         if (test_and_clear_bit(BTUSB_DOWNLOADING, &data->flags) &&
1928             test_bit(BTUSB_FIRMWARE_LOADED, &data->flags)) {
1929                 smp_mb__after_atomic();
1930                 wake_up_bit(&data->flags, BTUSB_DOWNLOADING);
1931         }
1932 }
1933
1934 static int btusb_recv_event_intel(struct hci_dev *hdev, struct sk_buff *skb)
1935 {
1936         struct btusb_data *data = hci_get_drvdata(hdev);
1937
1938         if (test_bit(BTUSB_BOOTLOADER, &data->flags)) {
1939                 struct hci_event_hdr *hdr = (void *)skb->data;
1940
1941                 if (skb->len > HCI_EVENT_HDR_SIZE && hdr->evt == 0xff &&
1942                     hdr->plen > 0) {
1943                         const void *ptr = skb->data + HCI_EVENT_HDR_SIZE + 1;
1944                         unsigned int len = skb->len - HCI_EVENT_HDR_SIZE - 1;
1945
1946                         switch (skb->data[2]) {
1947                         case 0x02:
1948                                 /* When switching to the operational firmware
1949                                  * the device sends a vendor specific event
1950                                  * indicating that the bootup completed.
1951                                  */
1952                                 btusb_intel_bootup(data, ptr, len);
1953                                 break;
1954                         case 0x06:
1955                                 /* When the firmware loading completes the
1956                                  * device sends out a vendor specific event
1957                                  * indicating the result of the firmware
1958                                  * loading.
1959                                  */
1960                                 btusb_intel_secure_send_result(data, ptr, len);
1961                                 break;
1962                         }
1963                 }
1964         }
1965
1966         return hci_recv_frame(hdev, skb);
1967 }
1968
1969 static int btusb_send_frame_intel(struct hci_dev *hdev, struct sk_buff *skb)
1970 {
1971         struct btusb_data *data = hci_get_drvdata(hdev);
1972         struct urb *urb;
1973
1974         BT_DBG("%s", hdev->name);
1975
1976         switch (hci_skb_pkt_type(skb)) {
1977         case HCI_COMMAND_PKT:
1978                 if (test_bit(BTUSB_BOOTLOADER, &data->flags)) {
1979                         struct hci_command_hdr *cmd = (void *)skb->data;
1980                         __u16 opcode = le16_to_cpu(cmd->opcode);
1981
1982                         /* When in bootloader mode and the command 0xfc09
1983                          * is received, it needs to be send down the
1984                          * bulk endpoint. So allocate a bulk URB instead.
1985                          */
1986                         if (opcode == 0xfc09)
1987                                 urb = alloc_bulk_urb(hdev, skb);
1988                         else
1989                                 urb = alloc_ctrl_urb(hdev, skb);
1990
1991                         /* When the 0xfc01 command is issued to boot into
1992                          * the operational firmware, it will actually not
1993                          * send a command complete event. To keep the flow
1994                          * control working inject that event here.
1995                          */
1996                         if (opcode == 0xfc01)
1997                                 inject_cmd_complete(hdev, opcode);
1998                 } else {
1999                         urb = alloc_ctrl_urb(hdev, skb);
2000                 }
2001                 if (IS_ERR(urb))
2002                         return PTR_ERR(urb);
2003
2004                 hdev->stat.cmd_tx++;
2005                 return submit_or_queue_tx_urb(hdev, urb);
2006
2007         case HCI_ACLDATA_PKT:
2008                 urb = alloc_bulk_urb(hdev, skb);
2009                 if (IS_ERR(urb))
2010                         return PTR_ERR(urb);
2011
2012                 hdev->stat.acl_tx++;
2013                 return submit_or_queue_tx_urb(hdev, urb);
2014
2015         case HCI_SCODATA_PKT:
2016                 if (hci_conn_num(hdev, SCO_LINK) < 1)
2017                         return -ENODEV;
2018
2019                 urb = alloc_isoc_urb(hdev, skb);
2020                 if (IS_ERR(urb))
2021                         return PTR_ERR(urb);
2022
2023                 hdev->stat.sco_tx++;
2024                 return submit_tx_urb(hdev, urb);
2025         }
2026
2027         return -EILSEQ;
2028 }
2029
2030 static int btusb_setup_intel_new(struct hci_dev *hdev)
2031 {
2032         struct btusb_data *data = hci_get_drvdata(hdev);
2033         struct intel_version ver;
2034         struct intel_boot_params params;
2035         const struct firmware *fw;
2036         u32 boot_param;
2037         char fwname[64];
2038         ktime_t calltime, delta, rettime;
2039         unsigned long long duration;
2040         int err;
2041
2042         BT_DBG("%s", hdev->name);
2043
2044         /* Set the default boot parameter to 0x0 and it is updated to
2045          * SKU specific boot parameter after reading Intel_Write_Boot_Params
2046          * command while downloading the firmware.
2047          */
2048         boot_param = 0x00000000;
2049
2050         calltime = ktime_get();
2051
2052         /* Read the Intel version information to determine if the device
2053          * is in bootloader mode or if it already has operational firmware
2054          * loaded.
2055          */
2056         err = btintel_read_version(hdev, &ver);
2057         if (err)
2058                 return err;
2059
2060         /* The hardware platform number has a fixed value of 0x37 and
2061          * for now only accept this single value.
2062          */
2063         if (ver.hw_platform != 0x37) {
2064                 BT_ERR("%s: Unsupported Intel hardware platform (%u)",
2065                        hdev->name, ver.hw_platform);
2066                 return -EINVAL;
2067         }
2068
2069         /* Check for supported iBT hardware variants of this firmware
2070          * loading method.
2071          *
2072          * This check has been put in place to ensure correct forward
2073          * compatibility options when newer hardware variants come along.
2074          */
2075         switch (ver.hw_variant) {
2076         case 0x0b:      /* SfP */
2077         case 0x0c:      /* WsP */
2078         case 0x11:      /* JfP */
2079         case 0x12:      /* ThP */
2080         case 0x13:      /* HrP */
2081         case 0x14:      /* QnJ, IcP */
2082                 break;
2083         default:
2084                 BT_ERR("%s: Unsupported Intel hardware variant (%u)",
2085                        hdev->name, ver.hw_variant);
2086                 return -EINVAL;
2087         }
2088
2089         btintel_version_info(hdev, &ver);
2090
2091         /* The firmware variant determines if the device is in bootloader
2092          * mode or is running operational firmware. The value 0x06 identifies
2093          * the bootloader and the value 0x23 identifies the operational
2094          * firmware.
2095          *
2096          * When the operational firmware is already present, then only
2097          * the check for valid Bluetooth device address is needed. This
2098          * determines if the device will be added as configured or
2099          * unconfigured controller.
2100          *
2101          * It is not possible to use the Secure Boot Parameters in this
2102          * case since that command is only available in bootloader mode.
2103          */
2104         if (ver.fw_variant == 0x23) {
2105                 clear_bit(BTUSB_BOOTLOADER, &data->flags);
2106                 btintel_check_bdaddr(hdev);
2107                 return 0;
2108         }
2109
2110         /* If the device is not in bootloader mode, then the only possible
2111          * choice is to return an error and abort the device initialization.
2112          */
2113         if (ver.fw_variant != 0x06) {
2114                 BT_ERR("%s: Unsupported Intel firmware variant (%u)",
2115                        hdev->name, ver.fw_variant);
2116                 return -ENODEV;
2117         }
2118
2119         /* Read the secure boot parameters to identify the operating
2120          * details of the bootloader.
2121          */
2122         err = btintel_read_boot_params(hdev, &params);
2123         if (err)
2124                 return err;
2125
2126         /* It is required that every single firmware fragment is acknowledged
2127          * with a command complete event. If the boot parameters indicate
2128          * that this bootloader does not send them, then abort the setup.
2129          */
2130         if (params.limited_cce != 0x00) {
2131                 BT_ERR("%s: Unsupported Intel firmware loading method (%u)",
2132                        hdev->name, params.limited_cce);
2133                 return -EINVAL;
2134         }
2135
2136         /* If the OTP has no valid Bluetooth device address, then there will
2137          * also be no valid address for the operational firmware.
2138          */
2139         if (!bacmp(&params.otp_bdaddr, BDADDR_ANY)) {
2140                 bt_dev_info(hdev, "No device address configured");
2141                 set_bit(HCI_QUIRK_INVALID_BDADDR, &hdev->quirks);
2142         }
2143
2144         /* With this Intel bootloader only the hardware variant and device
2145          * revision information are used to select the right firmware for SfP
2146          * and WsP.
2147          *
2148          * The firmware filename is ibt-<hw_variant>-<dev_revid>.sfi.
2149          *
2150          * Currently the supported hardware variants are:
2151          *   11 (0x0b) for iBT3.0 (LnP/SfP)
2152          *   12 (0x0c) for iBT3.5 (WsP)
2153          *
2154          * For ThP/JfP and for future SKU's, the FW name varies based on HW
2155          * variant, HW revision and FW revision, as these are dependent on CNVi
2156          * and RF Combination.
2157          *
2158          *   17 (0x11) for iBT3.5 (JfP)
2159          *   18 (0x12) for iBT3.5 (ThP)
2160          *
2161          * The firmware file name for these will be
2162          * ibt-<hw_variant>-<hw_revision>-<fw_revision>.sfi.
2163          *
2164          */
2165         switch (ver.hw_variant) {
2166         case 0x0b:      /* SfP */
2167         case 0x0c:      /* WsP */
2168                 snprintf(fwname, sizeof(fwname), "intel/ibt-%u-%u.sfi",
2169                          le16_to_cpu(ver.hw_variant),
2170                          le16_to_cpu(params.dev_revid));
2171                 break;
2172         case 0x11:      /* JfP */
2173         case 0x12:      /* ThP */
2174         case 0x13:      /* HrP */
2175         case 0x14:      /* QnJ, IcP */
2176                 snprintf(fwname, sizeof(fwname), "intel/ibt-%u-%u-%u.sfi",
2177                          le16_to_cpu(ver.hw_variant),
2178                          le16_to_cpu(ver.hw_revision),
2179                          le16_to_cpu(ver.fw_revision));
2180                 break;
2181         default:
2182                 BT_ERR("%s: Unsupported Intel firmware naming", hdev->name);
2183                 return -EINVAL;
2184         }
2185
2186         err = request_firmware(&fw, fwname, &hdev->dev);
2187         if (err < 0) {
2188                 BT_ERR("%s: Failed to load Intel firmware file (%d)",
2189                        hdev->name, err);
2190                 return err;
2191         }
2192
2193         bt_dev_info(hdev, "Found device firmware: %s", fwname);
2194
2195         /* Save the DDC file name for later use to apply once the firmware
2196          * downloading is done.
2197          */
2198         switch (ver.hw_variant) {
2199         case 0x0b:      /* SfP */
2200         case 0x0c:      /* WsP */
2201                 snprintf(fwname, sizeof(fwname), "intel/ibt-%u-%u.ddc",
2202                          le16_to_cpu(ver.hw_variant),
2203                          le16_to_cpu(params.dev_revid));
2204                 break;
2205         case 0x11:      /* JfP */
2206         case 0x12:      /* ThP */
2207         case 0x13:      /* HrP */
2208         case 0x14:      /* QnJ, IcP */
2209                 snprintf(fwname, sizeof(fwname), "intel/ibt-%u-%u-%u.ddc",
2210                          le16_to_cpu(ver.hw_variant),
2211                          le16_to_cpu(ver.hw_revision),
2212                          le16_to_cpu(ver.fw_revision));
2213                 break;
2214         default:
2215                 BT_ERR("%s: Unsupported Intel firmware naming", hdev->name);
2216                 return -EINVAL;
2217         }
2218
2219         if (fw->size < 644) {
2220                 BT_ERR("%s: Invalid size of firmware file (%zu)",
2221                        hdev->name, fw->size);
2222                 err = -EBADF;
2223                 goto done;
2224         }
2225
2226         set_bit(BTUSB_DOWNLOADING, &data->flags);
2227
2228         /* Start firmware downloading and get boot parameter */
2229         err = btintel_download_firmware(hdev, fw, &boot_param);
2230         if (err < 0)
2231                 goto done;
2232
2233         set_bit(BTUSB_FIRMWARE_LOADED, &data->flags);
2234
2235         bt_dev_info(hdev, "Waiting for firmware download to complete");
2236
2237         /* Before switching the device into operational mode and with that
2238          * booting the loaded firmware, wait for the bootloader notification
2239          * that all fragments have been successfully received.
2240          *
2241          * When the event processing receives the notification, then the
2242          * BTUSB_DOWNLOADING flag will be cleared.
2243          *
2244          * The firmware loading should not take longer than 5 seconds
2245          * and thus just timeout if that happens and fail the setup
2246          * of this device.
2247          */
2248         err = wait_on_bit_timeout(&data->flags, BTUSB_DOWNLOADING,
2249                                   TASK_INTERRUPTIBLE,
2250                                   msecs_to_jiffies(5000));
2251         if (err == -EINTR) {
2252                 BT_ERR("%s: Firmware loading interrupted", hdev->name);
2253                 goto done;
2254         }
2255
2256         if (err) {
2257                 BT_ERR("%s: Firmware loading timeout", hdev->name);
2258                 err = -ETIMEDOUT;
2259                 goto done;
2260         }
2261
2262         if (test_bit(BTUSB_FIRMWARE_FAILED, &data->flags)) {
2263                 BT_ERR("%s: Firmware loading failed", hdev->name);
2264                 err = -ENOEXEC;
2265                 goto done;
2266         }
2267
2268         rettime = ktime_get();
2269         delta = ktime_sub(rettime, calltime);
2270         duration = (unsigned long long) ktime_to_ns(delta) >> 10;
2271
2272         bt_dev_info(hdev, "Firmware loaded in %llu usecs", duration);
2273
2274 done:
2275         release_firmware(fw);
2276
2277         if (err < 0)
2278                 return err;
2279
2280         calltime = ktime_get();
2281
2282         set_bit(BTUSB_BOOTING, &data->flags);
2283
2284         err = btintel_send_intel_reset(hdev, boot_param);
2285         if (err)
2286                 return err;
2287
2288         /* The bootloader will not indicate when the device is ready. This
2289          * is done by the operational firmware sending bootup notification.
2290          *
2291          * Booting into operational firmware should not take longer than
2292          * 1 second. However if that happens, then just fail the setup
2293          * since something went wrong.
2294          */
2295         bt_dev_info(hdev, "Waiting for device to boot");
2296
2297         err = wait_on_bit_timeout(&data->flags, BTUSB_BOOTING,
2298                                   TASK_INTERRUPTIBLE,
2299                                   msecs_to_jiffies(1000));
2300
2301         if (err == -EINTR) {
2302                 BT_ERR("%s: Device boot interrupted", hdev->name);
2303                 return -EINTR;
2304         }
2305
2306         if (err) {
2307                 BT_ERR("%s: Device boot timeout", hdev->name);
2308                 return -ETIMEDOUT;
2309         }
2310
2311         rettime = ktime_get();
2312         delta = ktime_sub(rettime, calltime);
2313         duration = (unsigned long long) ktime_to_ns(delta) >> 10;
2314
2315         bt_dev_info(hdev, "Device booted in %llu usecs", duration);
2316
2317         clear_bit(BTUSB_BOOTLOADER, &data->flags);
2318
2319         /* Once the device is running in operational mode, it needs to apply
2320          * the device configuration (DDC) parameters.
2321          *
2322          * The device can work without DDC parameters, so even if it fails
2323          * to load the file, no need to fail the setup.
2324          */
2325         btintel_load_ddc_config(hdev, fwname);
2326
2327         /* Set the event mask for Intel specific vendor events. This enables
2328          * a few extra events that are useful during general operation. It
2329          * does not enable any debugging related events.
2330          *
2331          * The device will function correctly without these events enabled
2332          * and thus no need to fail the setup.
2333          */
2334         btintel_set_event_mask(hdev, false);
2335
2336         return 0;
2337 }
2338
2339 static int btusb_shutdown_intel(struct hci_dev *hdev)
2340 {
2341         struct sk_buff *skb;
2342         long ret;
2343
2344         /* Some platforms have an issue with BT LED when the interface is
2345          * down or BT radio is turned off, which takes 5 seconds to BT LED
2346          * goes off. This command turns off the BT LED immediately.
2347          */
2348         skb = __hci_cmd_sync(hdev, 0xfc3f, 0, NULL, HCI_INIT_TIMEOUT);
2349         if (IS_ERR(skb)) {
2350                 ret = PTR_ERR(skb);
2351                 BT_ERR("%s: turning off Intel device LED failed (%ld)",
2352                        hdev->name, ret);
2353                 return ret;
2354         }
2355         kfree_skb(skb);
2356
2357         return 0;
2358 }
2359
2360 #ifdef CONFIG_PM
2361 /* Configure an out-of-band gpio as wake-up pin, if specified in device tree */
2362 static int marvell_config_oob_wake(struct hci_dev *hdev)
2363 {
2364         struct sk_buff *skb;
2365         struct btusb_data *data = hci_get_drvdata(hdev);
2366         struct device *dev = &data->udev->dev;
2367         u16 pin, gap, opcode;
2368         int ret;
2369         u8 cmd[5];
2370
2371         /* Move on if no wakeup pin specified */
2372         if (of_property_read_u16(dev->of_node, "marvell,wakeup-pin", &pin) ||
2373             of_property_read_u16(dev->of_node, "marvell,wakeup-gap-ms", &gap))
2374                 return 0;
2375
2376         /* Vendor specific command to configure a GPIO as wake-up pin */
2377         opcode = hci_opcode_pack(0x3F, 0x59);
2378         cmd[0] = opcode & 0xFF;
2379         cmd[1] = opcode >> 8;
2380         cmd[2] = 2; /* length of parameters that follow */
2381         cmd[3] = pin;
2382         cmd[4] = gap; /* time in ms, for which wakeup pin should be asserted */
2383
2384         skb = bt_skb_alloc(sizeof(cmd), GFP_KERNEL);
2385         if (!skb) {
2386                 bt_dev_err(hdev, "%s: No memory\n", __func__);
2387                 return -ENOMEM;
2388         }
2389
2390         skb_put_data(skb, cmd, sizeof(cmd));
2391         hci_skb_pkt_type(skb) = HCI_COMMAND_PKT;
2392
2393         ret = btusb_send_frame(hdev, skb);
2394         if (ret) {
2395                 bt_dev_err(hdev, "%s: configuration failed\n", __func__);
2396                 kfree_skb(skb);
2397                 return ret;
2398         }
2399
2400         return 0;
2401 }
2402 #endif
2403
2404 static int btusb_set_bdaddr_marvell(struct hci_dev *hdev,
2405                                     const bdaddr_t *bdaddr)
2406 {
2407         struct sk_buff *skb;
2408         u8 buf[8];
2409         long ret;
2410
2411         buf[0] = 0xfe;
2412         buf[1] = sizeof(bdaddr_t);
2413         memcpy(buf + 2, bdaddr, sizeof(bdaddr_t));
2414
2415         skb = __hci_cmd_sync(hdev, 0xfc22, sizeof(buf), buf, HCI_INIT_TIMEOUT);
2416         if (IS_ERR(skb)) {
2417                 ret = PTR_ERR(skb);
2418                 bt_dev_err(hdev, "changing Marvell device address failed (%ld)",
2419                            ret);
2420                 return ret;
2421         }
2422         kfree_skb(skb);
2423
2424         return 0;
2425 }
2426
2427 static int btusb_set_bdaddr_ath3012(struct hci_dev *hdev,
2428                                     const bdaddr_t *bdaddr)
2429 {
2430         struct sk_buff *skb;
2431         u8 buf[10];
2432         long ret;
2433
2434         buf[0] = 0x01;
2435         buf[1] = 0x01;
2436         buf[2] = 0x00;
2437         buf[3] = sizeof(bdaddr_t);
2438         memcpy(buf + 4, bdaddr, sizeof(bdaddr_t));
2439
2440         skb = __hci_cmd_sync(hdev, 0xfc0b, sizeof(buf), buf, HCI_INIT_TIMEOUT);
2441         if (IS_ERR(skb)) {
2442                 ret = PTR_ERR(skb);
2443                 bt_dev_err(hdev, "Change address command failed (%ld)", ret);
2444                 return ret;
2445         }
2446         kfree_skb(skb);
2447
2448         return 0;
2449 }
2450
2451 #define QCA_DFU_PACKET_LEN      4096
2452
2453 #define QCA_GET_TARGET_VERSION  0x09
2454 #define QCA_CHECK_STATUS        0x05
2455 #define QCA_DFU_DOWNLOAD        0x01
2456
2457 #define QCA_SYSCFG_UPDATED      0x40
2458 #define QCA_PATCH_UPDATED       0x80
2459 #define QCA_DFU_TIMEOUT         3000
2460
2461 struct qca_version {
2462         __le32  rom_version;
2463         __le32  patch_version;
2464         __le32  ram_version;
2465         __le32  ref_clock;
2466         __u8    reserved[4];
2467 } __packed;
2468
2469 struct qca_rampatch_version {
2470         __le16  rom_version;
2471         __le16  patch_version;
2472 } __packed;
2473
2474 struct qca_device_info {
2475         u32     rom_version;
2476         u8      rampatch_hdr;   /* length of header in rampatch */
2477         u8      nvm_hdr;        /* length of header in NVM */
2478         u8      ver_offset;     /* offset of version structure in rampatch */
2479 };
2480
2481 static const struct qca_device_info qca_devices_table[] = {
2482         { 0x00000100, 20, 4, 10 }, /* Rome 1.0 */
2483         { 0x00000101, 20, 4, 10 }, /* Rome 1.1 */
2484         { 0x00000200, 28, 4, 18 }, /* Rome 2.0 */
2485         { 0x00000201, 28, 4, 18 }, /* Rome 2.1 */
2486         { 0x00000300, 28, 4, 18 }, /* Rome 3.0 */
2487         { 0x00000302, 28, 4, 18 }, /* Rome 3.2 */
2488 };
2489
2490 static int btusb_qca_send_vendor_req(struct hci_dev *hdev, u8 request,
2491                                      void *data, u16 size)
2492 {
2493         struct btusb_data *btdata = hci_get_drvdata(hdev);
2494         struct usb_device *udev = btdata->udev;
2495         int pipe, err;
2496         u8 *buf;
2497
2498         buf = kmalloc(size, GFP_KERNEL);
2499         if (!buf)
2500                 return -ENOMEM;
2501
2502         /* Found some of USB hosts have IOT issues with ours so that we should
2503          * not wait until HCI layer is ready.
2504          */
2505         pipe = usb_rcvctrlpipe(udev, 0);
2506         err = usb_control_msg(udev, pipe, request, USB_TYPE_VENDOR | USB_DIR_IN,
2507                               0, 0, buf, size, USB_CTRL_SET_TIMEOUT);
2508         if (err < 0) {
2509                 bt_dev_err(hdev, "Failed to access otp area (%d)", err);
2510                 goto done;
2511         }
2512
2513         memcpy(data, buf, size);
2514
2515 done:
2516         kfree(buf);
2517
2518         return err;
2519 }
2520
2521 static int btusb_setup_qca_download_fw(struct hci_dev *hdev,
2522                                        const struct firmware *firmware,
2523                                        size_t hdr_size)
2524 {
2525         struct btusb_data *btdata = hci_get_drvdata(hdev);
2526         struct usb_device *udev = btdata->udev;
2527         size_t count, size, sent = 0;
2528         int pipe, len, err;
2529         u8 *buf;
2530
2531         buf = kmalloc(QCA_DFU_PACKET_LEN, GFP_KERNEL);
2532         if (!buf)
2533                 return -ENOMEM;
2534
2535         count = firmware->size;
2536
2537         size = min_t(size_t, count, hdr_size);
2538         memcpy(buf, firmware->data, size);
2539
2540         /* USB patches should go down to controller through USB path
2541          * because binary format fits to go down through USB channel.
2542          * USB control path is for patching headers and USB bulk is for
2543          * patch body.
2544          */
2545         pipe = usb_sndctrlpipe(udev, 0);
2546         err = usb_control_msg(udev, pipe, QCA_DFU_DOWNLOAD, USB_TYPE_VENDOR,
2547                               0, 0, buf, size, USB_CTRL_SET_TIMEOUT);
2548         if (err < 0) {
2549                 bt_dev_err(hdev, "Failed to send headers (%d)", err);
2550                 goto done;
2551         }
2552
2553         sent += size;
2554         count -= size;
2555
2556         while (count) {
2557                 size = min_t(size_t, count, QCA_DFU_PACKET_LEN);
2558
2559                 memcpy(buf, firmware->data + sent, size);
2560
2561                 pipe = usb_sndbulkpipe(udev, 0x02);
2562                 err = usb_bulk_msg(udev, pipe, buf, size, &len,
2563                                    QCA_DFU_TIMEOUT);
2564                 if (err < 0) {
2565                         bt_dev_err(hdev, "Failed to send body at %zd of %zd (%d)",
2566                                    sent, firmware->size, err);
2567                         break;
2568                 }
2569
2570                 if (size != len) {
2571                         bt_dev_err(hdev, "Failed to get bulk buffer");
2572                         err = -EILSEQ;
2573                         break;
2574                 }
2575
2576                 sent  += size;
2577                 count -= size;
2578         }
2579
2580 done:
2581         kfree(buf);
2582         return err;
2583 }
2584
2585 static int btusb_setup_qca_load_rampatch(struct hci_dev *hdev,
2586                                          struct qca_version *ver,
2587                                          const struct qca_device_info *info)
2588 {
2589         struct qca_rampatch_version *rver;
2590         const struct firmware *fw;
2591         u32 ver_rom, ver_patch;
2592         u16 rver_rom, rver_patch;
2593         char fwname[64];
2594         int err;
2595
2596         ver_rom = le32_to_cpu(ver->rom_version);
2597         ver_patch = le32_to_cpu(ver->patch_version);
2598
2599         snprintf(fwname, sizeof(fwname), "qca/rampatch_usb_%08x.bin", ver_rom);
2600
2601         err = request_firmware(&fw, fwname, &hdev->dev);
2602         if (err) {
2603                 bt_dev_err(hdev, "failed to request rampatch file: %s (%d)",
2604                            fwname, err);
2605                 return err;
2606         }
2607
2608         bt_dev_info(hdev, "using rampatch file: %s", fwname);
2609
2610         rver = (struct qca_rampatch_version *)(fw->data + info->ver_offset);
2611         rver_rom = le16_to_cpu(rver->rom_version);
2612         rver_patch = le16_to_cpu(rver->patch_version);
2613
2614         bt_dev_info(hdev, "QCA: patch rome 0x%x build 0x%x, "
2615                     "firmware rome 0x%x build 0x%x",
2616                     rver_rom, rver_patch, ver_rom, ver_patch);
2617
2618         if (rver_rom != ver_rom || rver_patch <= ver_patch) {
2619                 bt_dev_err(hdev, "rampatch file version did not match with firmware");
2620                 err = -EINVAL;
2621                 goto done;
2622         }
2623
2624         err = btusb_setup_qca_download_fw(hdev, fw, info->rampatch_hdr);
2625
2626 done:
2627         release_firmware(fw);
2628
2629         return err;
2630 }
2631
2632 static int btusb_setup_qca_load_nvm(struct hci_dev *hdev,
2633                                     struct qca_version *ver,
2634                                     const struct qca_device_info *info)
2635 {
2636         const struct firmware *fw;
2637         char fwname[64];
2638         int err;
2639
2640         snprintf(fwname, sizeof(fwname), "qca/nvm_usb_%08x.bin",
2641                  le32_to_cpu(ver->rom_version));
2642
2643         err = request_firmware(&fw, fwname, &hdev->dev);
2644         if (err) {
2645                 bt_dev_err(hdev, "failed to request NVM file: %s (%d)",
2646                            fwname, err);
2647                 return err;
2648         }
2649
2650         bt_dev_info(hdev, "using NVM file: %s", fwname);
2651
2652         err = btusb_setup_qca_download_fw(hdev, fw, info->nvm_hdr);
2653
2654         release_firmware(fw);
2655
2656         return err;
2657 }
2658
2659 static int btusb_setup_qca(struct hci_dev *hdev)
2660 {
2661         const struct qca_device_info *info = NULL;
2662         struct qca_version ver;
2663         u32 ver_rom;
2664         u8 status;
2665         int i, err;
2666
2667         err = btusb_qca_send_vendor_req(hdev, QCA_GET_TARGET_VERSION, &ver,
2668                                         sizeof(ver));
2669         if (err < 0)
2670                 return err;
2671
2672         ver_rom = le32_to_cpu(ver.rom_version);
2673         for (i = 0; i < ARRAY_SIZE(qca_devices_table); i++) {
2674                 if (ver_rom == qca_devices_table[i].rom_version)
2675                         info = &qca_devices_table[i];
2676         }
2677         if (!info) {
2678                 bt_dev_err(hdev, "don't support firmware rome 0x%x", ver_rom);
2679                 return -ENODEV;
2680         }
2681
2682         err = btusb_qca_send_vendor_req(hdev, QCA_CHECK_STATUS, &status,
2683                                         sizeof(status));
2684         if (err < 0)
2685                 return err;
2686
2687         if (!(status & QCA_PATCH_UPDATED)) {
2688                 err = btusb_setup_qca_load_rampatch(hdev, &ver, info);
2689                 if (err < 0)
2690                         return err;
2691         }
2692
2693         if (!(status & QCA_SYSCFG_UPDATED)) {
2694                 err = btusb_setup_qca_load_nvm(hdev, &ver, info);
2695                 if (err < 0)
2696                         return err;
2697         }
2698
2699         return 0;
2700 }
2701
2702 #ifdef CONFIG_BT_HCIBTUSB_BCM
2703 static inline int __set_diag_interface(struct hci_dev *hdev)
2704 {
2705         struct btusb_data *data = hci_get_drvdata(hdev);
2706         struct usb_interface *intf = data->diag;
2707         int i;
2708
2709         if (!data->diag)
2710                 return -ENODEV;
2711
2712         data->diag_tx_ep = NULL;
2713         data->diag_rx_ep = NULL;
2714
2715         for (i = 0; i < intf->cur_altsetting->desc.bNumEndpoints; i++) {
2716                 struct usb_endpoint_descriptor *ep_desc;
2717
2718                 ep_desc = &intf->cur_altsetting->endpoint[i].desc;
2719
2720                 if (!data->diag_tx_ep && usb_endpoint_is_bulk_out(ep_desc)) {
2721                         data->diag_tx_ep = ep_desc;
2722                         continue;
2723                 }
2724
2725                 if (!data->diag_rx_ep && usb_endpoint_is_bulk_in(ep_desc)) {
2726                         data->diag_rx_ep = ep_desc;
2727                         continue;
2728                 }
2729         }
2730
2731         if (!data->diag_tx_ep || !data->diag_rx_ep) {
2732                 bt_dev_err(hdev, "invalid diagnostic descriptors");
2733                 return -ENODEV;
2734         }
2735
2736         return 0;
2737 }
2738
2739 static struct urb *alloc_diag_urb(struct hci_dev *hdev, bool enable)
2740 {
2741         struct btusb_data *data = hci_get_drvdata(hdev);
2742         struct sk_buff *skb;
2743         struct urb *urb;
2744         unsigned int pipe;
2745
2746         if (!data->diag_tx_ep)
2747                 return ERR_PTR(-ENODEV);
2748
2749         urb = usb_alloc_urb(0, GFP_KERNEL);
2750         if (!urb)
2751                 return ERR_PTR(-ENOMEM);
2752
2753         skb = bt_skb_alloc(2, GFP_KERNEL);
2754         if (!skb) {
2755                 usb_free_urb(urb);
2756                 return ERR_PTR(-ENOMEM);
2757         }
2758
2759         skb_put_u8(skb, 0xf0);
2760         skb_put_u8(skb, enable);
2761
2762         pipe = usb_sndbulkpipe(data->udev, data->diag_tx_ep->bEndpointAddress);
2763
2764         usb_fill_bulk_urb(urb, data->udev, pipe,
2765                           skb->data, skb->len, btusb_tx_complete, skb);
2766
2767         skb->dev = (void *)hdev;
2768
2769         return urb;
2770 }
2771
2772 static int btusb_bcm_set_diag(struct hci_dev *hdev, bool enable)
2773 {
2774         struct btusb_data *data = hci_get_drvdata(hdev);
2775         struct urb *urb;
2776
2777         if (!data->diag)
2778                 return -ENODEV;
2779
2780         if (!test_bit(HCI_RUNNING, &hdev->flags))
2781                 return -ENETDOWN;
2782
2783         urb = alloc_diag_urb(hdev, enable);
2784         if (IS_ERR(urb))
2785                 return PTR_ERR(urb);
2786
2787         return submit_or_queue_tx_urb(hdev, urb);
2788 }
2789 #endif
2790
2791 #ifdef CONFIG_PM
2792 static irqreturn_t btusb_oob_wake_handler(int irq, void *priv)
2793 {
2794         struct btusb_data *data = priv;
2795
2796         pm_wakeup_event(&data->udev->dev, 0);
2797         pm_system_wakeup();
2798
2799         /* Disable only if not already disabled (keep it balanced) */
2800         if (test_and_clear_bit(BTUSB_OOB_WAKE_ENABLED, &data->flags)) {
2801                 disable_irq_nosync(irq);
2802                 disable_irq_wake(irq);
2803         }
2804         return IRQ_HANDLED;
2805 }
2806
2807 static const struct of_device_id btusb_match_table[] = {
2808         { .compatible = "usb1286,204e" },
2809         { }
2810 };
2811 MODULE_DEVICE_TABLE(of, btusb_match_table);
2812
2813 /* Use an oob wakeup pin? */
2814 static int btusb_config_oob_wake(struct hci_dev *hdev)
2815 {
2816         struct btusb_data *data = hci_get_drvdata(hdev);
2817         struct device *dev = &data->udev->dev;
2818         int irq, ret;
2819
2820         clear_bit(BTUSB_OOB_WAKE_ENABLED, &data->flags);
2821
2822         if (!of_match_device(btusb_match_table, dev))
2823                 return 0;
2824
2825         /* Move on if no IRQ specified */
2826         irq = of_irq_get_byname(dev->of_node, "wakeup");
2827         if (irq <= 0) {
2828                 bt_dev_dbg(hdev, "%s: no OOB Wakeup IRQ in DT", __func__);
2829                 return 0;
2830         }
2831
2832         ret = devm_request_irq(&hdev->dev, irq, btusb_oob_wake_handler,
2833                                0, "OOB Wake-on-BT", data);
2834         if (ret) {
2835                 bt_dev_err(hdev, "%s: IRQ request failed", __func__);
2836                 return ret;
2837         }
2838
2839         ret = device_init_wakeup(dev, true);
2840         if (ret) {
2841                 bt_dev_err(hdev, "%s: failed to init_wakeup", __func__);
2842                 return ret;
2843         }
2844
2845         data->oob_wake_irq = irq;
2846         disable_irq(irq);
2847         bt_dev_info(hdev, "OOB Wake-on-BT configured at IRQ %u", irq);
2848         return 0;
2849 }
2850 #endif
2851
2852 static int btusb_probe(struct usb_interface *intf,
2853                        const struct usb_device_id *id)
2854 {
2855         struct usb_endpoint_descriptor *ep_desc;
2856         struct btusb_data *data;
2857         struct hci_dev *hdev;
2858         unsigned ifnum_base;
2859         int i, err;
2860
2861         BT_DBG("intf %p id %p", intf, id);
2862
2863         /* interface numbers are hardcoded in the spec */
2864         if (intf->cur_altsetting->desc.bInterfaceNumber != 0) {
2865                 if (!(id->driver_info & BTUSB_IFNUM_2))
2866                         return -ENODEV;
2867                 if (intf->cur_altsetting->desc.bInterfaceNumber != 2)
2868                         return -ENODEV;
2869         }
2870
2871         ifnum_base = intf->cur_altsetting->desc.bInterfaceNumber;
2872
2873         if (!id->driver_info) {
2874                 const struct usb_device_id *match;
2875
2876                 match = usb_match_id(intf, blacklist_table);
2877                 if (match)
2878                         id = match;
2879         }
2880
2881         if (id->driver_info == BTUSB_IGNORE)
2882                 return -ENODEV;
2883
2884         if (id->driver_info & BTUSB_ATH3012) {
2885                 struct usb_device *udev = interface_to_usbdev(intf);
2886
2887                 /* Old firmware would otherwise let ath3k driver load
2888                  * patch and sysconfig files
2889                  */
2890                 if (le16_to_cpu(udev->descriptor.bcdDevice) <= 0x0001)
2891                         return -ENODEV;
2892         }
2893
2894         data = devm_kzalloc(&intf->dev, sizeof(*data), GFP_KERNEL);
2895         if (!data)
2896                 return -ENOMEM;
2897
2898         for (i = 0; i < intf->cur_altsetting->desc.bNumEndpoints; i++) {
2899                 ep_desc = &intf->cur_altsetting->endpoint[i].desc;
2900
2901                 if (!data->intr_ep && usb_endpoint_is_int_in(ep_desc)) {
2902                         data->intr_ep = ep_desc;
2903                         continue;
2904                 }
2905
2906                 if (!data->bulk_tx_ep && usb_endpoint_is_bulk_out(ep_desc)) {
2907                         data->bulk_tx_ep = ep_desc;
2908                         continue;
2909                 }
2910
2911                 if (!data->bulk_rx_ep && usb_endpoint_is_bulk_in(ep_desc)) {
2912                         data->bulk_rx_ep = ep_desc;
2913                         continue;
2914                 }
2915         }
2916
2917         if (!data->intr_ep || !data->bulk_tx_ep || !data->bulk_rx_ep)
2918                 return -ENODEV;
2919
2920         if (id->driver_info & BTUSB_AMP) {
2921                 data->cmdreq_type = USB_TYPE_CLASS | 0x01;
2922                 data->cmdreq = 0x2b;
2923         } else {
2924                 data->cmdreq_type = USB_TYPE_CLASS;
2925                 data->cmdreq = 0x00;
2926         }
2927
2928         data->udev = interface_to_usbdev(intf);
2929         data->intf = intf;
2930
2931         INIT_WORK(&data->work, btusb_work);
2932         INIT_WORK(&data->waker, btusb_waker);
2933         init_usb_anchor(&data->deferred);
2934         init_usb_anchor(&data->tx_anchor);
2935         spin_lock_init(&data->txlock);
2936
2937         init_usb_anchor(&data->intr_anchor);
2938         init_usb_anchor(&data->bulk_anchor);
2939         init_usb_anchor(&data->isoc_anchor);
2940         init_usb_anchor(&data->diag_anchor);
2941         spin_lock_init(&data->rxlock);
2942
2943         if (id->driver_info & BTUSB_INTEL_NEW) {
2944                 data->recv_event = btusb_recv_event_intel;
2945                 data->recv_bulk = btusb_recv_bulk_intel;
2946                 set_bit(BTUSB_BOOTLOADER, &data->flags);
2947         } else {
2948                 data->recv_event = hci_recv_frame;
2949                 data->recv_bulk = btusb_recv_bulk;
2950         }
2951
2952         hdev = hci_alloc_dev();
2953         if (!hdev)
2954                 return -ENOMEM;
2955
2956         hdev->bus = HCI_USB;
2957         hci_set_drvdata(hdev, data);
2958
2959         if (id->driver_info & BTUSB_AMP)
2960                 hdev->dev_type = HCI_AMP;
2961         else
2962                 hdev->dev_type = HCI_PRIMARY;
2963
2964         data->hdev = hdev;
2965
2966         SET_HCIDEV_DEV(hdev, &intf->dev);
2967
2968         hdev->open   = btusb_open;
2969         hdev->close  = btusb_close;
2970         hdev->flush  = btusb_flush;
2971         hdev->send   = btusb_send_frame;
2972         hdev->notify = btusb_notify;
2973
2974         if (dmi_check_system(btusb_needs_reset_resume_table))
2975                 interface_to_usbdev(intf)->quirks |= USB_QUIRK_RESET_RESUME;
2976
2977 #ifdef CONFIG_PM
2978         err = btusb_config_oob_wake(hdev);
2979         if (err)
2980                 goto out_free_dev;
2981
2982         /* Marvell devices may need a specific chip configuration */
2983         if (id->driver_info & BTUSB_MARVELL && data->oob_wake_irq) {
2984                 err = marvell_config_oob_wake(hdev);
2985                 if (err)
2986                         goto out_free_dev;
2987         }
2988 #endif
2989         if (id->driver_info & BTUSB_CW6622)
2990                 set_bit(HCI_QUIRK_BROKEN_STORED_LINK_KEY, &hdev->quirks);
2991
2992         if (id->driver_info & BTUSB_BCM2045)
2993                 set_bit(HCI_QUIRK_BROKEN_STORED_LINK_KEY, &hdev->quirks);
2994
2995         if (id->driver_info & BTUSB_BCM92035)
2996                 hdev->setup = btusb_setup_bcm92035;
2997
2998 #ifdef CONFIG_BT_HCIBTUSB_BCM
2999         if (id->driver_info & BTUSB_BCM_PATCHRAM) {
3000                 hdev->manufacturer = 15;
3001                 hdev->setup = btbcm_setup_patchram;
3002                 hdev->set_diag = btusb_bcm_set_diag;
3003                 hdev->set_bdaddr = btbcm_set_bdaddr;
3004
3005                 /* Broadcom LM_DIAG Interface numbers are hardcoded */
3006                 data->diag = usb_ifnum_to_if(data->udev, ifnum_base + 2);
3007         }
3008
3009         if (id->driver_info & BTUSB_BCM_APPLE) {
3010                 hdev->manufacturer = 15;
3011                 hdev->setup = btbcm_setup_apple;
3012                 hdev->set_diag = btusb_bcm_set_diag;
3013
3014                 /* Broadcom LM_DIAG Interface numbers are hardcoded */
3015                 data->diag = usb_ifnum_to_if(data->udev, ifnum_base + 2);
3016         }
3017 #endif
3018
3019         if (id->driver_info & BTUSB_INTEL) {
3020                 hdev->manufacturer = 2;
3021                 hdev->setup = btusb_setup_intel;
3022                 hdev->shutdown = btusb_shutdown_intel;
3023                 hdev->set_diag = btintel_set_diag_mfg;
3024                 hdev->set_bdaddr = btintel_set_bdaddr;
3025                 set_bit(HCI_QUIRK_STRICT_DUPLICATE_FILTER, &hdev->quirks);
3026                 set_bit(HCI_QUIRK_SIMULTANEOUS_DISCOVERY, &hdev->quirks);
3027                 set_bit(HCI_QUIRK_NON_PERSISTENT_DIAG, &hdev->quirks);
3028         }
3029
3030         if (id->driver_info & BTUSB_INTEL_NEW) {
3031                 hdev->manufacturer = 2;
3032                 hdev->send = btusb_send_frame_intel;
3033                 hdev->setup = btusb_setup_intel_new;
3034                 hdev->hw_error = btintel_hw_error;
3035                 hdev->set_diag = btintel_set_diag;
3036                 hdev->set_bdaddr = btintel_set_bdaddr;
3037                 set_bit(HCI_QUIRK_STRICT_DUPLICATE_FILTER, &hdev->quirks);
3038                 set_bit(HCI_QUIRK_NON_PERSISTENT_DIAG, &hdev->quirks);
3039         }
3040
3041         if (id->driver_info & BTUSB_MARVELL)
3042                 hdev->set_bdaddr = btusb_set_bdaddr_marvell;
3043
3044         if (id->driver_info & BTUSB_SWAVE) {
3045                 set_bit(HCI_QUIRK_FIXUP_INQUIRY_MODE, &hdev->quirks);
3046                 set_bit(HCI_QUIRK_BROKEN_LOCAL_COMMANDS, &hdev->quirks);
3047         }
3048
3049         if (id->driver_info & BTUSB_INTEL_BOOT) {
3050                 hdev->manufacturer = 2;
3051                 set_bit(HCI_QUIRK_RAW_DEVICE, &hdev->quirks);
3052         }
3053
3054         if (id->driver_info & BTUSB_ATH3012) {
3055                 hdev->set_bdaddr = btusb_set_bdaddr_ath3012;
3056                 set_bit(HCI_QUIRK_SIMULTANEOUS_DISCOVERY, &hdev->quirks);
3057                 set_bit(HCI_QUIRK_STRICT_DUPLICATE_FILTER, &hdev->quirks);
3058         }
3059
3060         if (id->driver_info & BTUSB_QCA_ROME) {
3061                 data->setup_on_usb = btusb_setup_qca;
3062                 hdev->set_bdaddr = btusb_set_bdaddr_ath3012;
3063         }
3064
3065 #ifdef CONFIG_BT_HCIBTUSB_RTL
3066         if (id->driver_info & BTUSB_REALTEK) {
3067                 hdev->setup = btrtl_setup_realtek;
3068
3069                 /* Realtek devices lose their updated firmware over suspend,
3070                  * but the USB hub doesn't notice any status change.
3071                  * Explicitly request a device reset on resume.
3072                  */
3073                 interface_to_usbdev(intf)->quirks |= USB_QUIRK_RESET_RESUME;
3074         }
3075 #endif
3076
3077         if (id->driver_info & BTUSB_AMP) {
3078                 /* AMP controllers do not support SCO packets */
3079                 data->isoc = NULL;
3080         } else {
3081                 /* Interface orders are hardcoded in the specification */
3082                 data->isoc = usb_ifnum_to_if(data->udev, ifnum_base + 1);
3083                 data->isoc_ifnum = ifnum_base + 1;
3084         }
3085
3086         if (!reset)
3087                 set_bit(HCI_QUIRK_RESET_ON_CLOSE, &hdev->quirks);
3088
3089         if (force_scofix || id->driver_info & BTUSB_WRONG_SCO_MTU) {
3090                 if (!disable_scofix)
3091                         set_bit(HCI_QUIRK_FIXUP_BUFFER_SIZE, &hdev->quirks);
3092         }
3093
3094         if (id->driver_info & BTUSB_BROKEN_ISOC)
3095                 data->isoc = NULL;
3096
3097         if (id->driver_info & BTUSB_DIGIANSWER) {
3098                 data->cmdreq_type = USB_TYPE_VENDOR;
3099                 set_bit(HCI_QUIRK_RESET_ON_CLOSE, &hdev->quirks);
3100         }
3101
3102         if (id->driver_info & BTUSB_CSR) {
3103                 struct usb_device *udev = data->udev;
3104                 u16 bcdDevice = le16_to_cpu(udev->descriptor.bcdDevice);
3105
3106                 /* Old firmware would otherwise execute USB reset */
3107                 if (bcdDevice < 0x117)
3108                         set_bit(HCI_QUIRK_RESET_ON_CLOSE, &hdev->quirks);
3109
3110                 /* Fake CSR devices with broken commands */
3111                 if (bcdDevice <= 0x100 || bcdDevice == 0x134)
3112                         hdev->setup = btusb_setup_csr;
3113
3114                 set_bit(HCI_QUIRK_SIMULTANEOUS_DISCOVERY, &hdev->quirks);
3115         }
3116
3117         if (id->driver_info & BTUSB_SNIFFER) {
3118                 struct usb_device *udev = data->udev;
3119
3120                 /* New sniffer firmware has crippled HCI interface */
3121                 if (le16_to_cpu(udev->descriptor.bcdDevice) > 0x997)
3122                         set_bit(HCI_QUIRK_RAW_DEVICE, &hdev->quirks);
3123         }
3124
3125         if (id->driver_info & BTUSB_INTEL_BOOT) {
3126                 /* A bug in the bootloader causes that interrupt interface is
3127                  * only enabled after receiving SetInterface(0, AltSetting=0).
3128                  */
3129                 err = usb_set_interface(data->udev, 0, 0);
3130                 if (err < 0) {
3131                         BT_ERR("failed to set interface 0, alt 0 %d", err);
3132                         goto out_free_dev;
3133                 }
3134         }
3135
3136         if (data->isoc) {
3137                 err = usb_driver_claim_interface(&btusb_driver,
3138                                                  data->isoc, data);
3139                 if (err < 0)
3140                         goto out_free_dev;
3141         }
3142
3143 #ifdef CONFIG_BT_HCIBTUSB_BCM
3144         if (data->diag) {
3145                 if (!usb_driver_claim_interface(&btusb_driver,
3146                                                 data->diag, data))
3147                         __set_diag_interface(hdev);
3148                 else
3149                         data->diag = NULL;
3150         }
3151 #endif
3152
3153         if (enable_autosuspend)
3154                 usb_enable_autosuspend(data->udev);
3155
3156         err = hci_register_dev(hdev);
3157         if (err < 0)
3158                 goto out_free_dev;
3159
3160         usb_set_intfdata(intf, data);
3161
3162         return 0;
3163
3164 out_free_dev:
3165         hci_free_dev(hdev);
3166         return err;
3167 }
3168
3169 static void btusb_disconnect(struct usb_interface *intf)
3170 {
3171         struct btusb_data *data = usb_get_intfdata(intf);
3172         struct hci_dev *hdev;
3173
3174         BT_DBG("intf %p", intf);
3175
3176         if (!data)
3177                 return;
3178
3179         hdev = data->hdev;
3180         usb_set_intfdata(data->intf, NULL);
3181
3182         if (data->isoc)
3183                 usb_set_intfdata(data->isoc, NULL);
3184
3185         if (data->diag)
3186                 usb_set_intfdata(data->diag, NULL);
3187
3188         hci_unregister_dev(hdev);
3189
3190         if (intf == data->intf) {
3191                 if (data->isoc)
3192                         usb_driver_release_interface(&btusb_driver, data->isoc);
3193                 if (data->diag)
3194                         usb_driver_release_interface(&btusb_driver, data->diag);
3195         } else if (intf == data->isoc) {
3196                 if (data->diag)
3197                         usb_driver_release_interface(&btusb_driver, data->diag);
3198                 usb_driver_release_interface(&btusb_driver, data->intf);
3199         } else if (intf == data->diag) {
3200                 usb_driver_release_interface(&btusb_driver, data->intf);
3201                 if (data->isoc)
3202                         usb_driver_release_interface(&btusb_driver, data->isoc);
3203         }
3204
3205         if (data->oob_wake_irq)
3206                 device_init_wakeup(&data->udev->dev, false);
3207
3208         hci_free_dev(hdev);
3209 }
3210
3211 #ifdef CONFIG_PM
3212 static int btusb_suspend(struct usb_interface *intf, pm_message_t message)
3213 {
3214         struct btusb_data *data = usb_get_intfdata(intf);
3215
3216         BT_DBG("intf %p", intf);
3217
3218         if (data->suspend_count++)
3219                 return 0;
3220
3221         spin_lock_irq(&data->txlock);
3222         if (!(PMSG_IS_AUTO(message) && data->tx_in_flight)) {
3223                 set_bit(BTUSB_SUSPENDING, &data->flags);
3224                 spin_unlock_irq(&data->txlock);
3225         } else {
3226                 spin_unlock_irq(&data->txlock);
3227                 data->suspend_count--;
3228                 return -EBUSY;
3229         }
3230
3231         cancel_work_sync(&data->work);
3232
3233         btusb_stop_traffic(data);
3234         usb_kill_anchored_urbs(&data->tx_anchor);
3235
3236         if (data->oob_wake_irq && device_may_wakeup(&data->udev->dev)) {
3237                 set_bit(BTUSB_OOB_WAKE_ENABLED, &data->flags);
3238                 enable_irq_wake(data->oob_wake_irq);
3239                 enable_irq(data->oob_wake_irq);
3240         }
3241
3242         return 0;
3243 }
3244
3245 static void play_deferred(struct btusb_data *data)
3246 {
3247         struct urb *urb;
3248         int err;
3249
3250         while ((urb = usb_get_from_anchor(&data->deferred))) {
3251                 usb_anchor_urb(urb, &data->tx_anchor);
3252
3253                 err = usb_submit_urb(urb, GFP_ATOMIC);
3254                 if (err < 0) {
3255                         if (err != -EPERM && err != -ENODEV)
3256                                 BT_ERR("%s urb %p submission failed (%d)",
3257                                        data->hdev->name, urb, -err);
3258                         kfree(urb->setup_packet);
3259                         usb_unanchor_urb(urb);
3260                         usb_free_urb(urb);
3261                         break;
3262                 }
3263
3264                 data->tx_in_flight++;
3265                 usb_free_urb(urb);
3266         }
3267
3268         /* Cleanup the rest deferred urbs. */
3269         while ((urb = usb_get_from_anchor(&data->deferred))) {
3270                 kfree(urb->setup_packet);
3271                 usb_free_urb(urb);
3272         }
3273 }
3274
3275 static int btusb_resume(struct usb_interface *intf)
3276 {
3277         struct btusb_data *data = usb_get_intfdata(intf);
3278         struct hci_dev *hdev = data->hdev;
3279         int err = 0;
3280
3281         BT_DBG("intf %p", intf);
3282
3283         if (--data->suspend_count)
3284                 return 0;
3285
3286         /* Disable only if not already disabled (keep it balanced) */
3287         if (test_and_clear_bit(BTUSB_OOB_WAKE_ENABLED, &data->flags)) {
3288                 disable_irq(data->oob_wake_irq);
3289                 disable_irq_wake(data->oob_wake_irq);
3290         }
3291
3292         if (!test_bit(HCI_RUNNING, &hdev->flags))
3293                 goto done;
3294
3295         if (test_bit(BTUSB_INTR_RUNNING, &data->flags)) {
3296                 err = btusb_submit_intr_urb(hdev, GFP_NOIO);
3297                 if (err < 0) {
3298                         clear_bit(BTUSB_INTR_RUNNING, &data->flags);
3299                         goto failed;
3300                 }
3301         }
3302
3303         if (test_bit(BTUSB_BULK_RUNNING, &data->flags)) {
3304                 err = btusb_submit_bulk_urb(hdev, GFP_NOIO);
3305                 if (err < 0) {
3306                         clear_bit(BTUSB_BULK_RUNNING, &data->flags);
3307                         goto failed;
3308                 }
3309
3310                 btusb_submit_bulk_urb(hdev, GFP_NOIO);
3311         }
3312
3313         if (test_bit(BTUSB_ISOC_RUNNING, &data->flags)) {
3314                 if (btusb_submit_isoc_urb(hdev, GFP_NOIO) < 0)
3315                         clear_bit(BTUSB_ISOC_RUNNING, &data->flags);
3316                 else
3317                         btusb_submit_isoc_urb(hdev, GFP_NOIO);
3318         }
3319
3320         spin_lock_irq(&data->txlock);
3321         play_deferred(data);
3322         clear_bit(BTUSB_SUSPENDING, &data->flags);
3323         spin_unlock_irq(&data->txlock);
3324         schedule_work(&data->work);
3325
3326         return 0;
3327
3328 failed:
3329         usb_scuttle_anchored_urbs(&data->deferred);
3330 done:
3331         spin_lock_irq(&data->txlock);
3332         clear_bit(BTUSB_SUSPENDING, &data->flags);
3333         spin_unlock_irq(&data->txlock);
3334
3335         return err;
3336 }
3337 #endif
3338
3339 static struct usb_driver btusb_driver = {
3340         .name           = "btusb",
3341         .probe          = btusb_probe,
3342         .disconnect     = btusb_disconnect,
3343 #ifdef CONFIG_PM
3344         .suspend        = btusb_suspend,
3345         .resume         = btusb_resume,
3346 #endif
3347         .id_table       = btusb_table,
3348         .supports_autosuspend = 1,
3349         .disable_hub_initiated_lpm = 1,
3350 };
3351
3352 module_usb_driver(btusb_driver);
3353
3354 module_param(disable_scofix, bool, 0644);
3355 MODULE_PARM_DESC(disable_scofix, "Disable fixup of wrong SCO buffer size");
3356
3357 module_param(force_scofix, bool, 0644);
3358 MODULE_PARM_DESC(force_scofix, "Force fixup of wrong SCO buffers size");
3359
3360 module_param(enable_autosuspend, bool, 0644);
3361 MODULE_PARM_DESC(enable_autosuspend, "Enable USB autosuspend by default");
3362
3363 module_param(reset, bool, 0644);
3364 MODULE_PARM_DESC(reset, "Send HCI reset command on initialization");
3365
3366 MODULE_AUTHOR("Marcel Holtmann <[email protected]>");
3367 MODULE_DESCRIPTION("Generic Bluetooth USB driver ver " VERSION);
3368 MODULE_VERSION(VERSION);
3369 MODULE_LICENSE("GPL");