drivers/bluetooth/btusb.c

   1 // SPDX-License-Identifier: GPL-2.0-or-later
   2 /*
   3  *
   4  *  Generic Bluetooth USB driver
   5  *
   6  *  Copyright (C) 2005-2008  Marcel Holtmann <[email protected]>
   7  */
   8
   9 #include <linux/dmi.h>
  10 #include <linux/module.h>
  11 #include <linux/usb.h>
  12 #include <linux/usb/quirks.h>
  13 #include <linux/firmware.h>
  14 #include <linux/iopoll.h>
  15 #include <linux/of_device.h>
  16 #include <linux/of_irq.h>
  17 #include <linux/suspend.h>
  18 #include <linux/gpio/consumer.h>
  19 #include <linux/debugfs.h>
  20 #include <asm/unaligned.h>
  21
  22 #include <net/bluetooth/bluetooth.h>
  23 #include <net/bluetooth/hci_core.h>
  24
  25 #include "btintel.h"
  26 #include "btbcm.h"
  27 #include "btrtl.h"
  28 #include "btmtk.h"
  29
  30 #define VERSION "0.8"
  31
  32 static bool disable_scofix;
  33 static bool force_scofix;
  34 static bool enable_autosuspend = IS_ENABLED(CONFIG_BT_HCIBTUSB_AUTOSUSPEND);
  35 static bool enable_poll_sync = IS_ENABLED(CONFIG_BT_HCIBTUSB_POLL_SYNC);
  36 static bool reset = true;
  37
  38 static struct usb_driver btusb_driver;
  39
  40 #define BTUSB_IGNORE                    BIT(0)
  41 #define BTUSB_DIGIANSWER                BIT(1)
  42 #define BTUSB_CSR                       BIT(2)
  43 #define BTUSB_SNIFFER                   BIT(3)
  44 #define BTUSB_BCM92035                  BIT(4)
  45 #define BTUSB_BROKEN_ISOC               BIT(5)
  46 #define BTUSB_WRONG_SCO_MTU             BIT(6)
  47 #define BTUSB_ATH3012                   BIT(7)
  48 #define BTUSB_INTEL_COMBINED            BIT(8)
  49 #define BTUSB_INTEL_BOOT                BIT(9)
  50 #define BTUSB_BCM_PATCHRAM              BIT(10)
  51 #define BTUSB_MARVELL                   BIT(11)
  52 #define BTUSB_SWAVE                     BIT(12)
  53 #define BTUSB_AMP                       BIT(13)
  54 #define BTUSB_QCA_ROME                  BIT(14)
  55 #define BTUSB_BCM_APPLE                 BIT(15)
  56 #define BTUSB_REALTEK                   BIT(16)
  57 #define BTUSB_BCM2045                   BIT(17)
  58 #define BTUSB_IFNUM_2                   BIT(18)
  59 #define BTUSB_CW6622                    BIT(19)
  60 #define BTUSB_MEDIATEK                  BIT(20)
  61 #define BTUSB_WIDEBAND_SPEECH           BIT(21)
  62 #define BTUSB_VALID_LE_STATES           BIT(22)
  63 #define BTUSB_QCA_WCN6855               BIT(23)
  64 #define BTUSB_INTEL_BROKEN_SHUTDOWN_LED BIT(24)
  65 #define BTUSB_INTEL_BROKEN_INITIAL_NCMD BIT(25)
  66 #define BTUSB_INTEL_NO_WBS_SUPPORT      BIT(26)
  67
  68 static const struct usb_device_id btusb_table[] = {
  69         /* Generic Bluetooth USB device */
  70         { USB_DEVICE_INFO(0xe0, 0x01, 0x01) },
  71
  72         /* Generic Bluetooth AMP device */
  73         { USB_DEVICE_INFO(0xe0, 0x01, 0x04), .driver_info = BTUSB_AMP },
  74
  75         /* Generic Bluetooth USB interface */
  76         { USB_INTERFACE_INFO(0xe0, 0x01, 0x01) },
  77
  78         /* Apple-specific (Broadcom) devices */
  79         { USB_VENDOR_AND_INTERFACE_INFO(0x05ac, 0xff, 0x01, 0x01),
  80           .driver_info = BTUSB_BCM_APPLE | BTUSB_IFNUM_2 },
  81
  82         /* MediaTek MT76x0E */
  83         { USB_DEVICE(0x0e8d, 0x763f) },
  84
  85         /* Broadcom SoftSailing reporting vendor specific */
  86         { USB_DEVICE(0x0a5c, 0x21e1) },
  87
  88         /* Apple MacBookPro 7,1 */
  89         { USB_DEVICE(0x05ac, 0x8213) },
  90
  91         /* Apple iMac11,1 */
  92         { USB_DEVICE(0x05ac, 0x8215) },
  93
  94         /* Apple MacBookPro6,2 */
  95         { USB_DEVICE(0x05ac, 0x8218) },
  96
  97         /* Apple MacBookAir3,1, MacBookAir3,2 */
  98         { USB_DEVICE(0x05ac, 0x821b) },
  99
 100         /* Apple MacBookAir4,1 */
 101         { USB_DEVICE(0x05ac, 0x821f) },
 102
 103         /* Apple MacBookPro8,2 */
 104         { USB_DEVICE(0x05ac, 0x821a) },
 105
 106         /* Apple MacMini5,1 */
 107         { USB_DEVICE(0x05ac, 0x8281) },
 108
 109         /* AVM BlueFRITZ! USB v2.0 */
 110         { USB_DEVICE(0x057c, 0x3800), .driver_info = BTUSB_SWAVE },
 111
 112         /* Bluetooth Ultraport Module from IBM */
 113         { USB_DEVICE(0x04bf, 0x030a) },
 114
 115         /* ALPS Modules with non-standard id */
 116         { USB_DEVICE(0x044e, 0x3001) },
 117         { USB_DEVICE(0x044e, 0x3002) },
 118
 119         /* Ericsson with non-standard id */
 120         { USB_DEVICE(0x0bdb, 0x1002) },
 121
 122         /* Canyon CN-BTU1 with HID interfaces */
 123         { USB_DEVICE(0x0c10, 0x0000) },
 124
 125         /* Broadcom BCM20702B0 (Dynex/Insignia) */
 126         { USB_DEVICE(0x19ff, 0x0239), .driver_info = BTUSB_BCM_PATCHRAM },
 127
 128         /* Broadcom BCM43142A0 (Foxconn/Lenovo) */
 129         { USB_VENDOR_AND_INTERFACE_INFO(0x105b, 0xff, 0x01, 0x01),
 130           .driver_info = BTUSB_BCM_PATCHRAM },
 131
 132         /* Broadcom BCM920703 (HTC Vive) */
 133         { USB_VENDOR_AND_INTERFACE_INFO(0x0bb4, 0xff, 0x01, 0x01),
 134           .driver_info = BTUSB_BCM_PATCHRAM },
 135
 136         /* Foxconn - Hon Hai */
 137         { USB_VENDOR_AND_INTERFACE_INFO(0x0489, 0xff, 0x01, 0x01),
 138           .driver_info = BTUSB_BCM_PATCHRAM },
 139
 140         /* Lite-On Technology - Broadcom based */
 141         { USB_VENDOR_AND_INTERFACE_INFO(0x04ca, 0xff, 0x01, 0x01),
 142           .driver_info = BTUSB_BCM_PATCHRAM },
 143
 144         /* Broadcom devices with vendor specific id */
 145         { USB_VENDOR_AND_INTERFACE_INFO(0x0a5c, 0xff, 0x01, 0x01),
 146           .driver_info = BTUSB_BCM_PATCHRAM },
 147
 148         /* ASUSTek Computer - Broadcom based */
 149         { USB_VENDOR_AND_INTERFACE_INFO(0x0b05, 0xff, 0x01, 0x01),
 150           .driver_info = BTUSB_BCM_PATCHRAM },
 151
 152         /* Belkin F8065bf - Broadcom based */
 153         { USB_VENDOR_AND_INTERFACE_INFO(0x050d, 0xff, 0x01, 0x01),
 154           .driver_info = BTUSB_BCM_PATCHRAM },
 155
 156         /* IMC Networks - Broadcom based */
 157         { USB_VENDOR_AND_INTERFACE_INFO(0x13d3, 0xff, 0x01, 0x01),
 158           .driver_info = BTUSB_BCM_PATCHRAM },
 159
 160         /* Dell Computer - Broadcom based  */
 161         { USB_VENDOR_AND_INTERFACE_INFO(0x413c, 0xff, 0x01, 0x01),
 162           .driver_info = BTUSB_BCM_PATCHRAM },
 163
 164         /* Toshiba Corp - Broadcom based */
 165         { USB_VENDOR_AND_INTERFACE_INFO(0x0930, 0xff, 0x01, 0x01),
 166           .driver_info = BTUSB_BCM_PATCHRAM },
 167
 168         /* Intel Bluetooth USB Bootloader (RAM module) */
 169         { USB_DEVICE(0x8087, 0x0a5a),
 170           .driver_info = BTUSB_INTEL_BOOT | BTUSB_BROKEN_ISOC },
 171
 172         { }     /* Terminating entry */
 173 };
 174
 175 MODULE_DEVICE_TABLE(usb, btusb_table);
 176
 177 static const struct usb_device_id blacklist_table[] = {
 178         /* CSR BlueCore devices */
 179         { USB_DEVICE(0x0a12, 0x0001), .driver_info = BTUSB_CSR },
 180
 181         /* Broadcom BCM2033 without firmware */
 182         { USB_DEVICE(0x0a5c, 0x2033), .driver_info = BTUSB_IGNORE },
 183
 184         /* Broadcom BCM2045 devices */
 185         { USB_DEVICE(0x0a5c, 0x2045), .driver_info = BTUSB_BCM2045 },
 186
 187         /* Atheros 3011 with sflash firmware */
 188         { USB_DEVICE(0x0489, 0xe027), .driver_info = BTUSB_IGNORE },
 189         { USB_DEVICE(0x0489, 0xe03d), .driver_info = BTUSB_IGNORE },
 190         { USB_DEVICE(0x04f2, 0xaff1), .driver_info = BTUSB_IGNORE },
 191         { USB_DEVICE(0x0930, 0x0215), .driver_info = BTUSB_IGNORE },
 192         { USB_DEVICE(0x0cf3, 0x3002), .driver_info = BTUSB_IGNORE },
 193         { USB_DEVICE(0x0cf3, 0xe019), .driver_info = BTUSB_IGNORE },
 194         { USB_DEVICE(0x13d3, 0x3304), .driver_info = BTUSB_IGNORE },
 195
 196         /* Atheros AR9285 Malbec with sflash firmware */
 197         { USB_DEVICE(0x03f0, 0x311d), .driver_info = BTUSB_IGNORE },
 198
 199         /* Atheros 3012 with sflash firmware */
 200         { USB_DEVICE(0x0489, 0xe04d), .driver_info = BTUSB_ATH3012 },
 201         { USB_DEVICE(0x0489, 0xe04e), .driver_info = BTUSB_ATH3012 },
 202         { USB_DEVICE(0x0489, 0xe056), .driver_info = BTUSB_ATH3012 },
 203         { USB_DEVICE(0x0489, 0xe057), .driver_info = BTUSB_ATH3012 },
 204         { USB_DEVICE(0x0489, 0xe05f), .driver_info = BTUSB_ATH3012 },
 205         { USB_DEVICE(0x0489, 0xe076), .driver_info = BTUSB_ATH3012 },
 206         { USB_DEVICE(0x0489, 0xe078), .driver_info = BTUSB_ATH3012 },
 207         { USB_DEVICE(0x0489, 0xe095), .driver_info = BTUSB_ATH3012 },
 208         { USB_DEVICE(0x04c5, 0x1330), .driver_info = BTUSB_ATH3012 },
 209         { USB_DEVICE(0x04ca, 0x3004), .driver_info = BTUSB_ATH3012 },
 210         { USB_DEVICE(0x04ca, 0x3005), .driver_info = BTUSB_ATH3012 },
 211         { USB_DEVICE(0x04ca, 0x3006), .driver_info = BTUSB_ATH3012 },
 212         { USB_DEVICE(0x04ca, 0x3007), .driver_info = BTUSB_ATH3012 },
 213         { USB_DEVICE(0x04ca, 0x3008), .driver_info = BTUSB_ATH3012 },
 214         { USB_DEVICE(0x04ca, 0x300b), .driver_info = BTUSB_ATH3012 },
 215         { USB_DEVICE(0x04ca, 0x300d), .driver_info = BTUSB_ATH3012 },
 216         { USB_DEVICE(0x04ca, 0x300f), .driver_info = BTUSB_ATH3012 },
 217         { USB_DEVICE(0x04ca, 0x3010), .driver_info = BTUSB_ATH3012 },
 218         { USB_DEVICE(0x04ca, 0x3014), .driver_info = BTUSB_ATH3012 },
 219         { USB_DEVICE(0x04ca, 0x3018), .driver_info = BTUSB_ATH3012 },
 220         { USB_DEVICE(0x0930, 0x0219), .driver_info = BTUSB_ATH3012 },
 221         { USB_DEVICE(0x0930, 0x021c), .driver_info = BTUSB_ATH3012 },
 222         { USB_DEVICE(0x0930, 0x0220), .driver_info = BTUSB_ATH3012 },
 223         { USB_DEVICE(0x0930, 0x0227), .driver_info = BTUSB_ATH3012 },
 224         { USB_DEVICE(0x0b05, 0x17d0), .driver_info = BTUSB_ATH3012 },
 225         { USB_DEVICE(0x0cf3, 0x0036), .driver_info = BTUSB_ATH3012 },
 226         { USB_DEVICE(0x0cf3, 0x3004), .driver_info = BTUSB_ATH3012 },
 227         { USB_DEVICE(0x0cf3, 0x3008), .driver_info = BTUSB_ATH3012 },
 228         { USB_DEVICE(0x0cf3, 0x311d), .driver_info = BTUSB_ATH3012 },
 229         { USB_DEVICE(0x0cf3, 0x311e), .driver_info = BTUSB_ATH3012 },
 230         { USB_DEVICE(0x0cf3, 0x311f), .driver_info = BTUSB_ATH3012 },
 231         { USB_DEVICE(0x0cf3, 0x3121), .driver_info = BTUSB_ATH3012 },
 232         { USB_DEVICE(0x0cf3, 0x817a), .driver_info = BTUSB_ATH3012 },
 233         { USB_DEVICE(0x0cf3, 0x817b), .driver_info = BTUSB_ATH3012 },
 234         { USB_DEVICE(0x0cf3, 0xe003), .driver_info = BTUSB_ATH3012 },
 235         { USB_DEVICE(0x0cf3, 0xe004), .driver_info = BTUSB_ATH3012 },
 236         { USB_DEVICE(0x0cf3, 0xe005), .driver_info = BTUSB_ATH3012 },
 237         { USB_DEVICE(0x0cf3, 0xe006), .driver_info = BTUSB_ATH3012 },
 238         { USB_DEVICE(0x13d3, 0x3362), .driver_info = BTUSB_ATH3012 },
 239         { USB_DEVICE(0x13d3, 0x3375), .driver_info = BTUSB_ATH3012 },
 240         { USB_DEVICE(0x13d3, 0x3393), .driver_info = BTUSB_ATH3012 },
 241         { USB_DEVICE(0x13d3, 0x3395), .driver_info = BTUSB_ATH3012 },
 242         { USB_DEVICE(0x13d3, 0x3402), .driver_info = BTUSB_ATH3012 },
 243         { USB_DEVICE(0x13d3, 0x3408), .driver_info = BTUSB_ATH3012 },
 244         { USB_DEVICE(0x13d3, 0x3423), .driver_info = BTUSB_ATH3012 },
 245         { USB_DEVICE(0x13d3, 0x3432), .driver_info = BTUSB_ATH3012 },
 246         { USB_DEVICE(0x13d3, 0x3472), .driver_info = BTUSB_ATH3012 },
 247         { USB_DEVICE(0x13d3, 0x3474), .driver_info = BTUSB_ATH3012 },
 248         { USB_DEVICE(0x13d3, 0x3487), .driver_info = BTUSB_ATH3012 },
 249         { USB_DEVICE(0x13d3, 0x3490), .driver_info = BTUSB_ATH3012 },
 250
 251         /* Atheros AR5BBU12 with sflash firmware */
 252         { USB_DEVICE(0x0489, 0xe02c), .driver_info = BTUSB_IGNORE },
 253
 254         /* Atheros AR5BBU12 with sflash firmware */
 255         { USB_DEVICE(0x0489, 0xe036), .driver_info = BTUSB_ATH3012 },
 256         { USB_DEVICE(0x0489, 0xe03c), .driver_info = BTUSB_ATH3012 },
 257
 258         /* QCA ROME chipset */
 259         { USB_DEVICE(0x0cf3, 0x535b), .driver_info = BTUSB_QCA_ROME |
 260                                                      BTUSB_WIDEBAND_SPEECH },
 261         { USB_DEVICE(0x0cf3, 0xe007), .driver_info = BTUSB_QCA_ROME |
 262                                                      BTUSB_WIDEBAND_SPEECH },
 263         { USB_DEVICE(0x0cf3, 0xe009), .driver_info = BTUSB_QCA_ROME |
 264                                                      BTUSB_WIDEBAND_SPEECH },
 265         { USB_DEVICE(0x0cf3, 0xe010), .driver_info = BTUSB_QCA_ROME |
 266                                                      BTUSB_WIDEBAND_SPEECH },
 267         { USB_DEVICE(0x0cf3, 0xe300), .driver_info = BTUSB_QCA_ROME |
 268                                                      BTUSB_WIDEBAND_SPEECH },
 269         { USB_DEVICE(0x0cf3, 0xe301), .driver_info = BTUSB_QCA_ROME |
 270                                                      BTUSB_WIDEBAND_SPEECH },
 271         { USB_DEVICE(0x0cf3, 0xe360), .driver_info = BTUSB_QCA_ROME |
 272                                                      BTUSB_WIDEBAND_SPEECH },
 273         { USB_DEVICE(0x0cf3, 0xe500), .driver_info = BTUSB_QCA_ROME |
 274                                                      BTUSB_WIDEBAND_SPEECH },
 275         { USB_DEVICE(0x0489, 0xe092), .driver_info = BTUSB_QCA_ROME |
 276                                                      BTUSB_WIDEBAND_SPEECH },
 277         { USB_DEVICE(0x0489, 0xe09f), .driver_info = BTUSB_QCA_ROME |
 278                                                      BTUSB_WIDEBAND_SPEECH },
 279         { USB_DEVICE(0x0489, 0xe0a2), .driver_info = BTUSB_QCA_ROME |
 280                                                      BTUSB_WIDEBAND_SPEECH },
 281         { USB_DEVICE(0x04ca, 0x3011), .driver_info = BTUSB_QCA_ROME |
 282                                                      BTUSB_WIDEBAND_SPEECH },
 283         { USB_DEVICE(0x04ca, 0x3015), .driver_info = BTUSB_QCA_ROME |
 284                                                      BTUSB_WIDEBAND_SPEECH },
 285         { USB_DEVICE(0x04ca, 0x3016), .driver_info = BTUSB_QCA_ROME |
 286                                                      BTUSB_WIDEBAND_SPEECH },
 287         { USB_DEVICE(0x04ca, 0x301a), .driver_info = BTUSB_QCA_ROME |
 288                                                      BTUSB_WIDEBAND_SPEECH },
 289         { USB_DEVICE(0x04ca, 0x3021), .driver_info = BTUSB_QCA_ROME |
 290                                                      BTUSB_WIDEBAND_SPEECH },
 291         { USB_DEVICE(0x13d3, 0x3491), .driver_info = BTUSB_QCA_ROME |
 292                                                      BTUSB_WIDEBAND_SPEECH },
 293         { USB_DEVICE(0x13d3, 0x3496), .driver_info = BTUSB_QCA_ROME |
 294                                                      BTUSB_WIDEBAND_SPEECH },
 295         { USB_DEVICE(0x13d3, 0x3501), .driver_info = BTUSB_QCA_ROME |
 296                                                      BTUSB_WIDEBAND_SPEECH },
 297
 298         /* QCA WCN6855 chipset */
 299         { USB_DEVICE(0x0cf3, 0xe600), .driver_info = BTUSB_QCA_WCN6855 |
 300                                                      BTUSB_WIDEBAND_SPEECH |
 301                                                      BTUSB_VALID_LE_STATES },
 302         { USB_DEVICE(0x0489, 0xe0cc), .driver_info = BTUSB_QCA_WCN6855 |
 303                                                      BTUSB_WIDEBAND_SPEECH |
 304                                                      BTUSB_VALID_LE_STATES },
 305         { USB_DEVICE(0x0489, 0xe0d6), .driver_info = BTUSB_QCA_WCN6855 |
 306                                                      BTUSB_WIDEBAND_SPEECH |
 307                                                      BTUSB_VALID_LE_STATES },
 308         { USB_DEVICE(0x0489, 0xe0e3), .driver_info = BTUSB_QCA_WCN6855 |
 309                                                      BTUSB_WIDEBAND_SPEECH |
 310                                                      BTUSB_VALID_LE_STATES },
 311         { USB_DEVICE(0x10ab, 0x9309), .driver_info = BTUSB_QCA_WCN6855 |
 312                                                      BTUSB_WIDEBAND_SPEECH |
 313                                                      BTUSB_VALID_LE_STATES },
 314         { USB_DEVICE(0x10ab, 0x9409), .driver_info = BTUSB_QCA_WCN6855 |
 315                                                      BTUSB_WIDEBAND_SPEECH |
 316                                                      BTUSB_VALID_LE_STATES },
 317         { USB_DEVICE(0x0489, 0xe0d0), .driver_info = BTUSB_QCA_WCN6855 |
 318                                                      BTUSB_WIDEBAND_SPEECH |
 319                                                      BTUSB_VALID_LE_STATES },
 320         { USB_DEVICE(0x10ab, 0x9108), .driver_info = BTUSB_QCA_WCN6855 |
 321                                                      BTUSB_WIDEBAND_SPEECH |
 322                                                      BTUSB_VALID_LE_STATES },
 323         { USB_DEVICE(0x10ab, 0x9109), .driver_info = BTUSB_QCA_WCN6855 |
 324                                                      BTUSB_WIDEBAND_SPEECH |
 325                                                      BTUSB_VALID_LE_STATES },
 326         { USB_DEVICE(0x10ab, 0x9208), .driver_info = BTUSB_QCA_WCN6855 |
 327                                                      BTUSB_WIDEBAND_SPEECH |
 328                                                      BTUSB_VALID_LE_STATES },
 329         { USB_DEVICE(0x10ab, 0x9209), .driver_info = BTUSB_QCA_WCN6855 |
 330                                                      BTUSB_WIDEBAND_SPEECH |
 331                                                      BTUSB_VALID_LE_STATES },
 332         { USB_DEVICE(0x10ab, 0x9308), .driver_info = BTUSB_QCA_WCN6855 |
 333                                                      BTUSB_WIDEBAND_SPEECH |
 334                                                      BTUSB_VALID_LE_STATES },
 335         { USB_DEVICE(0x10ab, 0x9408), .driver_info = BTUSB_QCA_WCN6855 |
 336                                                      BTUSB_WIDEBAND_SPEECH |
 337                                                      BTUSB_VALID_LE_STATES },
 338         { USB_DEVICE(0x10ab, 0x9508), .driver_info = BTUSB_QCA_WCN6855 |
 339                                                      BTUSB_WIDEBAND_SPEECH |
 340                                                      BTUSB_VALID_LE_STATES },
 341         { USB_DEVICE(0x10ab, 0x9509), .driver_info = BTUSB_QCA_WCN6855 |
 342                                                      BTUSB_WIDEBAND_SPEECH |
 343                                                      BTUSB_VALID_LE_STATES },
 344         { USB_DEVICE(0x10ab, 0x9608), .driver_info = BTUSB_QCA_WCN6855 |
 345                                                      BTUSB_WIDEBAND_SPEECH |
 346                                                      BTUSB_VALID_LE_STATES },
 347         { USB_DEVICE(0x10ab, 0x9609), .driver_info = BTUSB_QCA_WCN6855 |
 348                                                      BTUSB_WIDEBAND_SPEECH |
 349                                                      BTUSB_VALID_LE_STATES },
 350         { USB_DEVICE(0x10ab, 0x9f09), .driver_info = BTUSB_QCA_WCN6855 |
 351                                                      BTUSB_WIDEBAND_SPEECH |
 352                                                      BTUSB_VALID_LE_STATES },
 353         { USB_DEVICE(0x04ca, 0x3022), .driver_info = BTUSB_QCA_WCN6855 |
 354                                                      BTUSB_WIDEBAND_SPEECH |
 355                                                      BTUSB_VALID_LE_STATES },
 356         { USB_DEVICE(0x0489, 0xe0c7), .driver_info = BTUSB_QCA_WCN6855 |
 357                                                      BTUSB_WIDEBAND_SPEECH |
 358                                                      BTUSB_VALID_LE_STATES },
 359         { USB_DEVICE(0x0489, 0xe0c9), .driver_info = BTUSB_QCA_WCN6855 |
 360                                                      BTUSB_WIDEBAND_SPEECH |
 361                                                      BTUSB_VALID_LE_STATES },
 362         { USB_DEVICE(0x0489, 0xe0ca), .driver_info = BTUSB_QCA_WCN6855 |
 363                                                      BTUSB_WIDEBAND_SPEECH |
 364                                                      BTUSB_VALID_LE_STATES },
 365         { USB_DEVICE(0x0489, 0xe0cb), .driver_info = BTUSB_QCA_WCN6855 |
 366                                                      BTUSB_WIDEBAND_SPEECH |
 367                                                      BTUSB_VALID_LE_STATES },
 368         { USB_DEVICE(0x0489, 0xe0ce), .driver_info = BTUSB_QCA_WCN6855 |
 369                                                      BTUSB_WIDEBAND_SPEECH |
 370                                                      BTUSB_VALID_LE_STATES },
 371         { USB_DEVICE(0x0489, 0xe0de), .driver_info = BTUSB_QCA_WCN6855 |
 372                                                      BTUSB_WIDEBAND_SPEECH |
 373                                                      BTUSB_VALID_LE_STATES },
 374         { USB_DEVICE(0x0489, 0xe0df), .driver_info = BTUSB_QCA_WCN6855 |
 375                                                      BTUSB_WIDEBAND_SPEECH |
 376                                                      BTUSB_VALID_LE_STATES },
 377         { USB_DEVICE(0x0489, 0xe0e1), .driver_info = BTUSB_QCA_WCN6855 |
 378                                                      BTUSB_WIDEBAND_SPEECH |
 379                                                      BTUSB_VALID_LE_STATES },
 380         { USB_DEVICE(0x0489, 0xe0ea), .driver_info = BTUSB_QCA_WCN6855 |
 381                                                      BTUSB_WIDEBAND_SPEECH |
 382                                                      BTUSB_VALID_LE_STATES },
 383         { USB_DEVICE(0x0489, 0xe0ec), .driver_info = BTUSB_QCA_WCN6855 |
 384                                                      BTUSB_WIDEBAND_SPEECH |
 385                                                      BTUSB_VALID_LE_STATES },
 386         { USB_DEVICE(0x04ca, 0x3023), .driver_info = BTUSB_QCA_WCN6855 |
 387                                                      BTUSB_WIDEBAND_SPEECH |
 388                                                      BTUSB_VALID_LE_STATES },
 389         { USB_DEVICE(0x04ca, 0x3024), .driver_info = BTUSB_QCA_WCN6855 |
 390                                                      BTUSB_WIDEBAND_SPEECH |
 391                                                      BTUSB_VALID_LE_STATES },
 392         { USB_DEVICE(0x04ca, 0x3a22), .driver_info = BTUSB_QCA_WCN6855 |
 393                                                      BTUSB_WIDEBAND_SPEECH |
 394                                                      BTUSB_VALID_LE_STATES },
 395         { USB_DEVICE(0x04ca, 0x3a24), .driver_info = BTUSB_QCA_WCN6855 |
 396                                                      BTUSB_WIDEBAND_SPEECH |
 397                                                      BTUSB_VALID_LE_STATES },
 398         { USB_DEVICE(0x04ca, 0x3a26), .driver_info = BTUSB_QCA_WCN6855 |
 399                                                      BTUSB_WIDEBAND_SPEECH |
 400                                                      BTUSB_VALID_LE_STATES },
 401         { USB_DEVICE(0x04ca, 0x3a27), .driver_info = BTUSB_QCA_WCN6855 |
 402                                                      BTUSB_WIDEBAND_SPEECH |
 403                                                      BTUSB_VALID_LE_STATES },
 404
 405         /* QCA WCN785x chipset */
 406         { USB_DEVICE(0x0cf3, 0xe700), .driver_info = BTUSB_QCA_WCN6855 |
 407                                                      BTUSB_WIDEBAND_SPEECH |
 408                                                      BTUSB_VALID_LE_STATES },
 409
 410         /* Broadcom BCM2035 */
 411         { USB_DEVICE(0x0a5c, 0x2009), .driver_info = BTUSB_BCM92035 },
 412         { USB_DEVICE(0x0a5c, 0x200a), .driver_info = BTUSB_WRONG_SCO_MTU },
 413         { USB_DEVICE(0x0a5c, 0x2035), .driver_info = BTUSB_WRONG_SCO_MTU },
 414
 415         /* Broadcom BCM2045 */
 416         { USB_DEVICE(0x0a5c, 0x2039), .driver_info = BTUSB_WRONG_SCO_MTU },
 417         { USB_DEVICE(0x0a5c, 0x2101), .driver_info = BTUSB_WRONG_SCO_MTU },
 418
 419         /* IBM/Lenovo ThinkPad with Broadcom chip */
 420         { USB_DEVICE(0x0a5c, 0x201e), .driver_info = BTUSB_WRONG_SCO_MTU },
 421         { USB_DEVICE(0x0a5c, 0x2110), .driver_info = BTUSB_WRONG_SCO_MTU },
 422
 423         /* HP laptop with Broadcom chip */
 424         { USB_DEVICE(0x03f0, 0x171d), .driver_info = BTUSB_WRONG_SCO_MTU },
 425
 426         /* Dell laptop with Broadcom chip */
 427         { USB_DEVICE(0x413c, 0x8126), .driver_info = BTUSB_WRONG_SCO_MTU },
 428
 429         /* Dell Wireless 370 and 410 devices */
 430         { USB_DEVICE(0x413c, 0x8152), .driver_info = BTUSB_WRONG_SCO_MTU },
 431         { USB_DEVICE(0x413c, 0x8156), .driver_info = BTUSB_WRONG_SCO_MTU },
 432
 433         /* Belkin F8T012 and F8T013 devices */
 434         { USB_DEVICE(0x050d, 0x0012), .driver_info = BTUSB_WRONG_SCO_MTU },
 435         { USB_DEVICE(0x050d, 0x0013), .driver_info = BTUSB_WRONG_SCO_MTU },
 436
 437         /* Asus WL-BTD202 device */
 438         { USB_DEVICE(0x0b05, 0x1715), .driver_info = BTUSB_WRONG_SCO_MTU },
 439
 440         /* Kensington Bluetooth USB adapter */
 441         { USB_DEVICE(0x047d, 0x105e), .driver_info = BTUSB_WRONG_SCO_MTU },
 442
 443         /* RTX Telecom based adapters with buggy SCO support */
 444         { USB_DEVICE(0x0400, 0x0807), .driver_info = BTUSB_BROKEN_ISOC },
 445         { USB_DEVICE(0x0400, 0x080a), .driver_info = BTUSB_BROKEN_ISOC },
 446
 447         /* CONWISE Technology based adapters with buggy SCO support */
 448         { USB_DEVICE(0x0e5e, 0x6622),
 449           .driver_info = BTUSB_BROKEN_ISOC | BTUSB_CW6622},
 450
 451         /* Roper Class 1 Bluetooth Dongle (Silicon Wave based) */
 452         { USB_DEVICE(0x1310, 0x0001), .driver_info = BTUSB_SWAVE },
 453
 454         /* Digianswer devices */
 455         { USB_DEVICE(0x08fd, 0x0001), .driver_info = BTUSB_DIGIANSWER },
 456         { USB_DEVICE(0x08fd, 0x0002), .driver_info = BTUSB_IGNORE },
 457
 458         /* CSR BlueCore Bluetooth Sniffer */
 459         { USB_DEVICE(0x0a12, 0x0002),
 460           .driver_info = BTUSB_SNIFFER | BTUSB_BROKEN_ISOC },
 461
 462         /* Frontline ComProbe Bluetooth Sniffer */
 463         { USB_DEVICE(0x16d3, 0x0002),
 464           .driver_info = BTUSB_SNIFFER | BTUSB_BROKEN_ISOC },
 465
 466         /* Marvell Bluetooth devices */
 467         { USB_DEVICE(0x1286, 0x2044), .driver_info = BTUSB_MARVELL },
 468         { USB_DEVICE(0x1286, 0x2046), .driver_info = BTUSB_MARVELL },
 469         { USB_DEVICE(0x1286, 0x204e), .driver_info = BTUSB_MARVELL },
 470
 471         /* Intel Bluetooth devices */
 472         { USB_DEVICE(0x8087, 0x0025), .driver_info = BTUSB_INTEL_COMBINED },
 473         { USB_DEVICE(0x8087, 0x0026), .driver_info = BTUSB_INTEL_COMBINED },
 474         { USB_DEVICE(0x8087, 0x0029), .driver_info = BTUSB_INTEL_COMBINED },
 475         { USB_DEVICE(0x8087, 0x0032), .driver_info = BTUSB_INTEL_COMBINED },
 476         { USB_DEVICE(0x8087, 0x0033), .driver_info = BTUSB_INTEL_COMBINED },
 477         { USB_DEVICE(0x8087, 0x0035), .driver_info = BTUSB_INTEL_COMBINED },
 478         { USB_DEVICE(0x8087, 0x07da), .driver_info = BTUSB_CSR },
 479         { USB_DEVICE(0x8087, 0x07dc), .driver_info = BTUSB_INTEL_COMBINED |
 480                                                      BTUSB_INTEL_NO_WBS_SUPPORT |
 481                                                      BTUSB_INTEL_BROKEN_INITIAL_NCMD |
 482                                                      BTUSB_INTEL_BROKEN_SHUTDOWN_LED },
 483         { USB_DEVICE(0x8087, 0x0a2a), .driver_info = BTUSB_INTEL_COMBINED |
 484                                                      BTUSB_INTEL_NO_WBS_SUPPORT |
 485                                                      BTUSB_INTEL_BROKEN_SHUTDOWN_LED },
 486         { USB_DEVICE(0x8087, 0x0a2b), .driver_info = BTUSB_INTEL_COMBINED },
 487         { USB_DEVICE(0x8087, 0x0aa7), .driver_info = BTUSB_INTEL_COMBINED |
 488                                                      BTUSB_INTEL_BROKEN_SHUTDOWN_LED },
 489         { USB_DEVICE(0x8087, 0x0aaa), .driver_info = BTUSB_INTEL_COMBINED },
 490
 491         /* Other Intel Bluetooth devices */
 492         { USB_VENDOR_AND_INTERFACE_INFO(0x8087, 0xe0, 0x01, 0x01),
 493           .driver_info = BTUSB_IGNORE },
 494
 495         /* Realtek 8822CE Bluetooth devices */
 496         { USB_DEVICE(0x0bda, 0xb00c), .driver_info = BTUSB_REALTEK |
 497                                                      BTUSB_WIDEBAND_SPEECH },
 498         { USB_DEVICE(0x0bda, 0xc822), .driver_info = BTUSB_REALTEK |
 499                                                      BTUSB_WIDEBAND_SPEECH },
 500
 501         /* Realtek 8822CU Bluetooth devices */
 502         { USB_DEVICE(0x13d3, 0x3549), .driver_info = BTUSB_REALTEK |
 503                                                      BTUSB_WIDEBAND_SPEECH },
 504
 505         /* Realtek 8852AE Bluetooth devices */
 506         { USB_DEVICE(0x0bda, 0x2852), .driver_info = BTUSB_REALTEK |
 507                                                      BTUSB_WIDEBAND_SPEECH },
 508         { USB_DEVICE(0x0bda, 0xc852), .driver_info = BTUSB_REALTEK |
 509                                                      BTUSB_WIDEBAND_SPEECH },
 510         { USB_DEVICE(0x0bda, 0x385a), .driver_info = BTUSB_REALTEK |
 511                                                      BTUSB_WIDEBAND_SPEECH },
 512         { USB_DEVICE(0x0bda, 0x4852), .driver_info = BTUSB_REALTEK |
 513                                                      BTUSB_WIDEBAND_SPEECH },
 514         { USB_DEVICE(0x04c5, 0x165c), .driver_info = BTUSB_REALTEK |
 515                                                      BTUSB_WIDEBAND_SPEECH },
 516         { USB_DEVICE(0x04ca, 0x4006), .driver_info = BTUSB_REALTEK |
 517                                                      BTUSB_WIDEBAND_SPEECH },
 518         { USB_DEVICE(0x0cb8, 0xc549), .driver_info = BTUSB_REALTEK |
 519                                                      BTUSB_WIDEBAND_SPEECH },
 520
 521         /* Realtek 8852CE Bluetooth devices */
 522         { USB_DEVICE(0x04ca, 0x4007), .driver_info = BTUSB_REALTEK |
 523                                                      BTUSB_WIDEBAND_SPEECH },
 524         { USB_DEVICE(0x04c5, 0x1675), .driver_info = BTUSB_REALTEK |
 525                                                      BTUSB_WIDEBAND_SPEECH },
 526         { USB_DEVICE(0x0cb8, 0xc558), .driver_info = BTUSB_REALTEK |
 527                                                      BTUSB_WIDEBAND_SPEECH },
 528         { USB_DEVICE(0x13d3, 0x3587), .driver_info = BTUSB_REALTEK |
 529                                                      BTUSB_WIDEBAND_SPEECH },
 530         { USB_DEVICE(0x13d3, 0x3586), .driver_info = BTUSB_REALTEK |
 531                                                      BTUSB_WIDEBAND_SPEECH },
 532         { USB_DEVICE(0x13d3, 0x3592), .driver_info = BTUSB_REALTEK |
 533                                                      BTUSB_WIDEBAND_SPEECH },
 534
 535         /* Realtek 8852BE Bluetooth devices */
 536         { USB_DEVICE(0x0cb8, 0xc559), .driver_info = BTUSB_REALTEK |
 537                                                      BTUSB_WIDEBAND_SPEECH },
 538
 539         /* Realtek Bluetooth devices */
 540         { USB_VENDOR_AND_INTERFACE_INFO(0x0bda, 0xe0, 0x01, 0x01),
 541           .driver_info = BTUSB_REALTEK },
 542
 543         /* MediaTek Bluetooth devices */
 544         { USB_VENDOR_AND_INTERFACE_INFO(0x0e8d, 0xe0, 0x01, 0x01),
 545           .driver_info = BTUSB_MEDIATEK |
 546                          BTUSB_WIDEBAND_SPEECH |
 547                          BTUSB_VALID_LE_STATES },
 548
 549         /* Additional MediaTek MT7615E Bluetooth devices */
 550         { USB_DEVICE(0x13d3, 0x3560), .driver_info = BTUSB_MEDIATEK},
 551
 552         /* Additional MediaTek MT7663 Bluetooth devices */
 553         { USB_DEVICE(0x043e, 0x310c), .driver_info = BTUSB_MEDIATEK |
 554                                                      BTUSB_WIDEBAND_SPEECH |
 555                                                      BTUSB_VALID_LE_STATES },
 556
 557         /* Additional MediaTek MT7668 Bluetooth devices */
 558         { USB_DEVICE(0x043e, 0x3109), .driver_info = BTUSB_MEDIATEK |
 559                                                      BTUSB_WIDEBAND_SPEECH |
 560                                                      BTUSB_VALID_LE_STATES },
 561
 562         /* Additional MediaTek MT7921 Bluetooth devices */
 563         { USB_DEVICE(0x0489, 0xe0c8), .driver_info = BTUSB_MEDIATEK |
 564                                                      BTUSB_WIDEBAND_SPEECH |
 565                                                      BTUSB_VALID_LE_STATES },
 566         { USB_DEVICE(0x0489, 0xe0e0), .driver_info = BTUSB_MEDIATEK |
 567                                                      BTUSB_WIDEBAND_SPEECH |
 568                                                      BTUSB_VALID_LE_STATES },
 569         { USB_DEVICE(0x04ca, 0x3802), .driver_info = BTUSB_MEDIATEK |
 570                                                      BTUSB_WIDEBAND_SPEECH |
 571                                                      BTUSB_VALID_LE_STATES },
 572         { USB_DEVICE(0x13d3, 0x3563), .driver_info = BTUSB_MEDIATEK |
 573                                                      BTUSB_WIDEBAND_SPEECH |
 574                                                      BTUSB_VALID_LE_STATES },
 575         { USB_DEVICE(0x13d3, 0x3564), .driver_info = BTUSB_MEDIATEK |
 576                                                      BTUSB_WIDEBAND_SPEECH |
 577                                                      BTUSB_VALID_LE_STATES },
 578         { USB_DEVICE(0x13d3, 0x3567), .driver_info = BTUSB_MEDIATEK |
 579                                                      BTUSB_WIDEBAND_SPEECH |
 580                                                      BTUSB_VALID_LE_STATES },
 581         { USB_DEVICE(0x13d3, 0x3578), .driver_info = BTUSB_MEDIATEK |
 582                                                      BTUSB_WIDEBAND_SPEECH |
 583                                                      BTUSB_VALID_LE_STATES },
 584         { USB_DEVICE(0x13d3, 0x3583), .driver_info = BTUSB_MEDIATEK |
 585                                                      BTUSB_WIDEBAND_SPEECH |
 586                                                      BTUSB_VALID_LE_STATES },
 587         { USB_DEVICE(0x0489, 0xe0cd), .driver_info = BTUSB_MEDIATEK |
 588                                                      BTUSB_WIDEBAND_SPEECH |
 589                                                      BTUSB_VALID_LE_STATES },
 590         { USB_DEVICE(0x0e8d, 0x0608), .driver_info = BTUSB_MEDIATEK |
 591                                                      BTUSB_WIDEBAND_SPEECH |
 592                                                      BTUSB_VALID_LE_STATES },
 593
 594         /* MediaTek MT7922A Bluetooth devices */
 595         { USB_DEVICE(0x0489, 0xe0d8), .driver_info = BTUSB_MEDIATEK |
 596                                                      BTUSB_WIDEBAND_SPEECH |
 597                                                      BTUSB_VALID_LE_STATES },
 598         { USB_DEVICE(0x0489, 0xe0d9), .driver_info = BTUSB_MEDIATEK |
 599                                                      BTUSB_WIDEBAND_SPEECH |
 600                                                      BTUSB_VALID_LE_STATES },
 601         { USB_DEVICE(0x13d3, 0x3568), .driver_info = BTUSB_MEDIATEK |
 602                                                      BTUSB_WIDEBAND_SPEECH |
 603                                                      BTUSB_VALID_LE_STATES },
 604         { USB_DEVICE(0x0489, 0xe0e2), .driver_info = BTUSB_MEDIATEK |
 605                                                      BTUSB_WIDEBAND_SPEECH |
 606                                                      BTUSB_VALID_LE_STATES },
 607         { USB_DEVICE(0x0489, 0xe0f2), .driver_info = BTUSB_MEDIATEK |
 608                                                      BTUSB_WIDEBAND_SPEECH |
 609                                                      BTUSB_VALID_LE_STATES },
 610
 611         /* Additional Realtek 8723AE Bluetooth devices */
 612         { USB_DEVICE(0x0930, 0x021d), .driver_info = BTUSB_REALTEK },
 613         { USB_DEVICE(0x13d3, 0x3394), .driver_info = BTUSB_REALTEK },
 614
 615         /* Additional Realtek 8723BE Bluetooth devices */
 616         { USB_DEVICE(0x0489, 0xe085), .driver_info = BTUSB_REALTEK },
 617         { USB_DEVICE(0x0489, 0xe08b), .driver_info = BTUSB_REALTEK },
 618         { USB_DEVICE(0x04f2, 0xb49f), .driver_info = BTUSB_REALTEK },
 619         { USB_DEVICE(0x13d3, 0x3410), .driver_info = BTUSB_REALTEK },
 620         { USB_DEVICE(0x13d3, 0x3416), .driver_info = BTUSB_REALTEK },
 621         { USB_DEVICE(0x13d3, 0x3459), .driver_info = BTUSB_REALTEK },
 622         { USB_DEVICE(0x13d3, 0x3494), .driver_info = BTUSB_REALTEK },
 623
 624         /* Additional Realtek 8723BU Bluetooth devices */
 625         { USB_DEVICE(0x7392, 0xa611), .driver_info = BTUSB_REALTEK },
 626
 627         /* Additional Realtek 8723DE Bluetooth devices */
 628         { USB_DEVICE(0x0bda, 0xb009), .driver_info = BTUSB_REALTEK },
 629         { USB_DEVICE(0x2ff8, 0xb011), .driver_info = BTUSB_REALTEK },
 630
 631         /* Additional Realtek 8761BUV Bluetooth devices */
 632         { USB_DEVICE(0x2357, 0x0604), .driver_info = BTUSB_REALTEK |
 633                                                      BTUSB_WIDEBAND_SPEECH },
 634         { USB_DEVICE(0x0b05, 0x190e), .driver_info = BTUSB_REALTEK |
 635                                                      BTUSB_WIDEBAND_SPEECH },
 636         { USB_DEVICE(0x2550, 0x8761), .driver_info = BTUSB_REALTEK |
 637                                                      BTUSB_WIDEBAND_SPEECH },
 638         { USB_DEVICE(0x0bda, 0x8771), .driver_info = BTUSB_REALTEK |
 639                                                      BTUSB_WIDEBAND_SPEECH },
 640         { USB_DEVICE(0x7392, 0xc611), .driver_info = BTUSB_REALTEK |
 641                                                      BTUSB_WIDEBAND_SPEECH },
 642         { USB_DEVICE(0x2b89, 0x8761), .driver_info = BTUSB_REALTEK |
 643                                                      BTUSB_WIDEBAND_SPEECH },
 644
 645         /* Additional Realtek 8821AE Bluetooth devices */
 646         { USB_DEVICE(0x0b05, 0x17dc), .driver_info = BTUSB_REALTEK },
 647         { USB_DEVICE(0x13d3, 0x3414), .driver_info = BTUSB_REALTEK },
 648         { USB_DEVICE(0x13d3, 0x3458), .driver_info = BTUSB_REALTEK },
 649         { USB_DEVICE(0x13d3, 0x3461), .driver_info = BTUSB_REALTEK },
 650         { USB_DEVICE(0x13d3, 0x3462), .driver_info = BTUSB_REALTEK },
 651
 652         /* Additional Realtek 8822BE Bluetooth devices */
 653         { USB_DEVICE(0x13d3, 0x3526), .driver_info = BTUSB_REALTEK },
 654         { USB_DEVICE(0x0b05, 0x185c), .driver_info = BTUSB_REALTEK },
 655
 656         /* Additional Realtek 8822CE Bluetooth devices */
 657         { USB_DEVICE(0x04ca, 0x4005), .driver_info = BTUSB_REALTEK |
 658                                                      BTUSB_WIDEBAND_SPEECH },
 659         { USB_DEVICE(0x04c5, 0x161f), .driver_info = BTUSB_REALTEK |
 660                                                      BTUSB_WIDEBAND_SPEECH },
 661         { USB_DEVICE(0x0b05, 0x18ef), .driver_info = BTUSB_REALTEK |
 662                                                      BTUSB_WIDEBAND_SPEECH },
 663         { USB_DEVICE(0x13d3, 0x3548), .driver_info = BTUSB_REALTEK |
 664                                                      BTUSB_WIDEBAND_SPEECH },
 665         { USB_DEVICE(0x13d3, 0x3549), .driver_info = BTUSB_REALTEK |
 666                                                      BTUSB_WIDEBAND_SPEECH },
 667         { USB_DEVICE(0x13d3, 0x3553), .driver_info = BTUSB_REALTEK |
 668                                                      BTUSB_WIDEBAND_SPEECH },
 669         { USB_DEVICE(0x13d3, 0x3555), .driver_info = BTUSB_REALTEK |
 670                                                      BTUSB_WIDEBAND_SPEECH },
 671         { USB_DEVICE(0x2ff8, 0x3051), .driver_info = BTUSB_REALTEK |
 672                                                      BTUSB_WIDEBAND_SPEECH },
 673         { USB_DEVICE(0x1358, 0xc123), .driver_info = BTUSB_REALTEK |
 674                                                      BTUSB_WIDEBAND_SPEECH },
 675         { USB_DEVICE(0x0bda, 0xc123), .driver_info = BTUSB_REALTEK |
 676                                                      BTUSB_WIDEBAND_SPEECH },
 677         { USB_DEVICE(0x0cb5, 0xc547), .driver_info = BTUSB_REALTEK |
 678                                                      BTUSB_WIDEBAND_SPEECH },
 679
 680         /* Silicon Wave based devices */
 681         { USB_DEVICE(0x0c10, 0x0000), .driver_info = BTUSB_SWAVE },
 682
 683         { }     /* Terminating entry */
 684 };
 685
 686 /* The Bluetooth USB module build into some devices needs to be reset on resume,
 687  * this is a problem with the platform (likely shutting off all power) not with
 688  * the module itself. So we use a DMI list to match known broken platforms.
 689  */
 690 static const struct dmi_system_id btusb_needs_reset_resume_table[] = {
 691         {
 692                 /* Dell OptiPlex 3060 (QCA ROME device 0cf3:e007) */
 693                 .matches = {
 694                         DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."),
 695                         DMI_MATCH(DMI_PRODUCT_NAME, "OptiPlex 3060"),
 696                 },
 697         },
 698         {
 699                 /* Dell XPS 9360 (QCA ROME device 0cf3:e300) */
 700                 .matches = {
 701                         DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."),
 702                         DMI_MATCH(DMI_PRODUCT_NAME, "XPS 13 9360"),
 703                 },
 704         },
 705         {
 706                 /* Dell Inspiron 5565 (QCA ROME device 0cf3:e009) */
 707                 .matches = {
 708                         DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."),
 709                         DMI_MATCH(DMI_PRODUCT_NAME, "Inspiron 5565"),
 710                 },
 711         },
 712         {}
 713 };
 714
 715 #define BTUSB_MAX_ISOC_FRAMES   10
 716
 717 #define BTUSB_INTR_RUNNING      0
 718 #define BTUSB_BULK_RUNNING      1
 719 #define BTUSB_ISOC_RUNNING      2
 720 #define BTUSB_SUSPENDING        3
 721 #define BTUSB_DID_ISO_RESUME    4
 722 #define BTUSB_BOOTLOADER        5
 723 #define BTUSB_DOWNLOADING       6
 724 #define BTUSB_FIRMWARE_LOADED   7
 725 #define BTUSB_FIRMWARE_FAILED   8
 726 #define BTUSB_BOOTING           9
 727 #define BTUSB_DIAG_RUNNING      10
 728 #define BTUSB_OOB_WAKE_ENABLED  11
 729 #define BTUSB_HW_RESET_ACTIVE   12
 730 #define BTUSB_TX_WAIT_VND_EVT   13
 731 #define BTUSB_WAKEUP_AUTOSUSPEND        14
 732 #define BTUSB_USE_ALT3_FOR_WBS  15
 733 #define BTUSB_ALT6_CONTINUOUS_TX        16
 734
 735 struct btusb_data {
 736         struct hci_dev       *hdev;
 737         struct usb_device    *udev;
 738         struct usb_interface *intf;
 739         struct usb_interface *isoc;
 740         struct usb_interface *diag;
 741         unsigned isoc_ifnum;
 742
 743         unsigned long flags;
 744
 745         bool poll_sync;
 746         int intr_interval;
 747         struct work_struct  work;
 748         struct work_struct  waker;
 749         struct delayed_work rx_work;
 750
 751         struct sk_buff_head acl_q;
 752
 753         struct usb_anchor deferred;
 754         struct usb_anchor tx_anchor;
 755         int tx_in_flight;
 756         spinlock_t txlock;
 757
 758         struct usb_anchor intr_anchor;
 759         struct usb_anchor bulk_anchor;
 760         struct usb_anchor isoc_anchor;
 761         struct usb_anchor diag_anchor;
 762         struct usb_anchor ctrl_anchor;
 763         spinlock_t rxlock;
 764
 765         struct sk_buff *evt_skb;
 766         struct sk_buff *acl_skb;
 767         struct sk_buff *sco_skb;
 768
 769         struct usb_endpoint_descriptor *intr_ep;
 770         struct usb_endpoint_descriptor *bulk_tx_ep;
 771         struct usb_endpoint_descriptor *bulk_rx_ep;
 772         struct usb_endpoint_descriptor *isoc_tx_ep;
 773         struct usb_endpoint_descriptor *isoc_rx_ep;
 774         struct usb_endpoint_descriptor *diag_tx_ep;
 775         struct usb_endpoint_descriptor *diag_rx_ep;
 776
 777         struct gpio_desc *reset_gpio;
 778
 779         __u8 cmdreq_type;
 780         __u8 cmdreq;
 781
 782         unsigned int sco_num;
 783         unsigned int air_mode;
 784         bool usb_alt6_packet_flow;
 785         int isoc_altsetting;
 786         int suspend_count;
 787
 788         int (*recv_event)(struct hci_dev *hdev, struct sk_buff *skb);
 789         int (*recv_acl)(struct hci_dev *hdev, struct sk_buff *skb);
 790         int (*recv_bulk)(struct btusb_data *data, void *buffer, int count);
 791
 792         int (*setup_on_usb)(struct hci_dev *hdev);
 793
 794         int oob_wake_irq;   /* irq for out-of-band wake-on-bt */
 795         unsigned cmd_timeout_cnt;
 796 };
 797
 798 static void btusb_reset(struct hci_dev *hdev)
 799 {
 800         struct btusb_data *data;
 801         int err;
 802
 803         if (hdev->reset) {
 804                 hdev->reset(hdev);
 805                 return;
 806         }
 807
 808         data = hci_get_drvdata(hdev);
 809         /* This is not an unbalanced PM reference since the device will reset */
 810         err = usb_autopm_get_interface(data->intf);
 811         if (err) {
 812                 bt_dev_err(hdev, "Failed usb_autopm_get_interface: %d", err);
 813                 return;
 814         }
 815
 816         bt_dev_err(hdev, "Resetting usb device.");
 817         usb_queue_reset_device(data->intf);
 818 }
 819
 820 static void btusb_intel_cmd_timeout(struct hci_dev *hdev)
 821 {
 822         struct btusb_data *data = hci_get_drvdata(hdev);
 823         struct gpio_desc *reset_gpio = data->reset_gpio;
 824
 825         if (++data->cmd_timeout_cnt < 5)
 826                 return;
 827
 828         if (!reset_gpio) {
 829                 btusb_reset(hdev);
 830                 return;
 831         }
 832
 833         /*
 834          * Toggle the hard reset line if the platform provides one. The reset
 835          * is going to yank the device off the USB and then replug. So doing
 836          * once is enough. The cleanup is handled correctly on the way out
 837          * (standard USB disconnect), and the new device is detected cleanly
 838          * and bound to the driver again like it should be.
 839          */
 840         if (test_and_set_bit(BTUSB_HW_RESET_ACTIVE, &data->flags)) {
 841                 bt_dev_err(hdev, "last reset failed? Not resetting again");
 842                 return;
 843         }
 844
 845         bt_dev_err(hdev, "Initiating HW reset via gpio");
 846         gpiod_set_value_cansleep(reset_gpio, 1);
 847         msleep(100);
 848         gpiod_set_value_cansleep(reset_gpio, 0);
 849 }
 850
 851 static void btusb_rtl_cmd_timeout(struct hci_dev *hdev)
 852 {
 853         struct btusb_data *data = hci_get_drvdata(hdev);
 854         struct gpio_desc *reset_gpio = data->reset_gpio;
 855
 856         if (++data->cmd_timeout_cnt < 5)
 857                 return;
 858
 859         if (!reset_gpio) {
 860                 btusb_reset(hdev);
 861                 return;
 862         }
 863
 864         /* Toggle the hard reset line. The Realtek device is going to
 865          * yank itself off the USB and then replug. The cleanup is handled
 866          * correctly on the way out (standard USB disconnect), and the new
 867          * device is detected cleanly and bound to the driver again like
 868          * it should be.
 869          */
 870         if (test_and_set_bit(BTUSB_HW_RESET_ACTIVE, &data->flags)) {
 871                 bt_dev_err(hdev, "last reset failed? Not resetting again");
 872                 return;
 873         }
 874
 875         bt_dev_err(hdev, "Reset Realtek device via gpio");
 876         gpiod_set_value_cansleep(reset_gpio, 1);
 877         msleep(200);
 878         gpiod_set_value_cansleep(reset_gpio, 0);
 879 }
 880
 881 static void btusb_qca_cmd_timeout(struct hci_dev *hdev)
 882 {
 883         struct btusb_data *data = hci_get_drvdata(hdev);
 884         struct gpio_desc *reset_gpio = data->reset_gpio;
 885
 886         if (++data->cmd_timeout_cnt < 5)
 887                 return;
 888
 889         if (reset_gpio) {
 890                 bt_dev_err(hdev, "Reset qca device via bt_en gpio");
 891
 892                 /* Toggle the hard reset line. The qca bt device is going to
 893                  * yank itself off the USB and then replug. The cleanup is handled
 894                  * correctly on the way out (standard USB disconnect), and the new
 895                  * device is detected cleanly and bound to the driver again like
 896                  * it should be.
 897                  */
 898                 if (test_and_set_bit(BTUSB_HW_RESET_ACTIVE, &data->flags)) {
 899                         bt_dev_err(hdev, "last reset failed? Not resetting again");
 900                         return;
 901                 }
 902
 903                 gpiod_set_value_cansleep(reset_gpio, 0);
 904                 msleep(200);
 905                 gpiod_set_value_cansleep(reset_gpio, 1);
 906
 907                 return;
 908         }
 909
 910         btusb_reset(hdev);
 911 }
 912
 913 static inline void btusb_free_frags(struct btusb_data *data)
 914 {
 915         unsigned long flags;
 916
 917         spin_lock_irqsave(&data->rxlock, flags);
 918
 919         dev_kfree_skb_irq(data->evt_skb);
 920         data->evt_skb = NULL;
 921
 922         dev_kfree_skb_irq(data->acl_skb);
 923         data->acl_skb = NULL;
 924
 925         dev_kfree_skb_irq(data->sco_skb);
 926         data->sco_skb = NULL;
 927
 928         spin_unlock_irqrestore(&data->rxlock, flags);
 929 }
 930
 931 static int btusb_recv_event(struct btusb_data *data, struct sk_buff *skb)
 932 {
 933         if (data->intr_interval) {
 934                 /* Trigger dequeue immediatelly if an event is received */
 935                 schedule_delayed_work(&data->rx_work, 0);
 936         }
 937
 938         return data->recv_event(data->hdev, skb);
 939 }
 940
 941 static int btusb_recv_intr(struct btusb_data *data, void *buffer, int count)
 942 {
 943         struct sk_buff *skb;
 944         unsigned long flags;
 945         int err = 0;
 946
 947         spin_lock_irqsave(&data->rxlock, flags);
 948         skb = data->evt_skb;
 949
 950         while (count) {
 951                 int len;
 952
 953                 if (!skb) {
 954                         skb = bt_skb_alloc(HCI_MAX_EVENT_SIZE, GFP_ATOMIC);
 955                         if (!skb) {
 956                                 err = -ENOMEM;
 957                                 break;
 958                         }
 959
 960                         hci_skb_pkt_type(skb) = HCI_EVENT_PKT;
 961                         hci_skb_expect(skb) = HCI_EVENT_HDR_SIZE;
 962                 }
 963
 964                 len = min_t(uint, hci_skb_expect(skb), count);
 965                 skb_put_data(skb, buffer, len);
 966
 967                 count -= len;
 968                 buffer += len;
 969                 hci_skb_expect(skb) -= len;
 970
 971                 if (skb->len == HCI_EVENT_HDR_SIZE) {
 972                         /* Complete event header */
 973                         hci_skb_expect(skb) = hci_event_hdr(skb)->plen;
 974
 975                         if (skb_tailroom(skb) < hci_skb_expect(skb)) {
 976                                 kfree_skb(skb);
 977                                 skb = NULL;
 978
 979                                 err = -EILSEQ;
 980                                 break;
 981                         }
 982                 }
 983
 984                 if (!hci_skb_expect(skb)) {
 985                         /* Complete frame */
 986                         btusb_recv_event(data, skb);
 987                         skb = NULL;
 988                 }
 989         }
 990
 991         data->evt_skb = skb;
 992         spin_unlock_irqrestore(&data->rxlock, flags);
 993
 994         return err;
 995 }
 996
 997 static int btusb_recv_acl(struct btusb_data *data, struct sk_buff *skb)
 998 {
 999         /* Only queue ACL packet if intr_interval is set as it means
1000          * force_poll_sync has been enabled.
1001          */
1002         if (!data->intr_interval)
1003                 return data->recv_acl(data->hdev, skb);
1004
1005         skb_queue_tail(&data->acl_q, skb);
1006         schedule_delayed_work(&data->rx_work, data->intr_interval);
1007
1008         return 0;
1009 }
1010
1011 static int btusb_recv_bulk(struct btusb_data *data, void *buffer, int count)
1012 {
1013         struct sk_buff *skb;
1014         unsigned long flags;
1015         int err = 0;
1016
1017         spin_lock_irqsave(&data->rxlock, flags);
1018         skb = data->acl_skb;
1019
1020         while (count) {
1021                 int len;
1022
1023                 if (!skb) {
1024                         skb = bt_skb_alloc(HCI_MAX_FRAME_SIZE, GFP_ATOMIC);
1025                         if (!skb) {
1026                                 err = -ENOMEM;
1027                                 break;
1028                         }
1029
1030                         hci_skb_pkt_type(skb) = HCI_ACLDATA_PKT;
1031                         hci_skb_expect(skb) = HCI_ACL_HDR_SIZE;
1032                 }
1033
1034                 len = min_t(uint, hci_skb_expect(skb), count);
1035                 skb_put_data(skb, buffer, len);
1036
1037                 count -= len;
1038                 buffer += len;
1039                 hci_skb_expect(skb) -= len;
1040
1041                 if (skb->len == HCI_ACL_HDR_SIZE) {
1042                         __u16 handle = __le16_to_cpu(hci_acl_hdr(skb)->handle);
1043                         __le16 dlen = hci_acl_hdr(skb)->dlen;
1044                         __u8 type;
1045
1046                         /* Complete ACL header */
1047                         hci_skb_expect(skb) = __le16_to_cpu(dlen);
1048
1049                         /* Detect if ISO packet has been sent over bulk */
1050                         if (hci_conn_num(data->hdev, ISO_LINK)) {
1051                                 type = hci_conn_lookup_type(data->hdev,
1052                                                             hci_handle(handle));
1053                                 if (type == ISO_LINK)
1054                                         hci_skb_pkt_type(skb) = HCI_ISODATA_PKT;
1055                         }
1056
1057                         if (skb_tailroom(skb) < hci_skb_expect(skb)) {
1058                                 kfree_skb(skb);
1059                                 skb = NULL;
1060
1061                                 err = -EILSEQ;
1062                                 break;
1063                         }
1064                 }
1065
1066                 if (!hci_skb_expect(skb)) {
1067                         /* Complete frame */
1068                         btusb_recv_acl(data, skb);
1069                         skb = NULL;
1070                 }
1071         }
1072
1073         data->acl_skb = skb;
1074         spin_unlock_irqrestore(&data->rxlock, flags);
1075
1076         return err;
1077 }
1078
1079 static bool btusb_validate_sco_handle(struct hci_dev *hdev,
1080                                       struct hci_sco_hdr *hdr)
1081 {
1082         __u16 handle;
1083
1084         if (hci_dev_test_flag(hdev, HCI_USER_CHANNEL))
1085                 // Can't validate, userspace controls everything.
1086                 return true;
1087
1088         /*
1089          * USB isochronous transfers are not designed to be reliable and may
1090          * lose fragments.  When this happens, the next first fragment
1091          * encountered might actually be a continuation fragment.
1092          * Validate the handle to detect it and drop it, or else the upper
1093          * layer will get garbage for a while.
1094          */
1095
1096         handle = hci_handle(__le16_to_cpu(hdr->handle));
1097
1098         switch (hci_conn_lookup_type(hdev, handle)) {
1099         case SCO_LINK:
1100         case ESCO_LINK:
1101                 return true;
1102         default:
1103                 return false;
1104         }
1105 }
1106
1107 static int btusb_recv_isoc(struct btusb_data *data, void *buffer, int count)
1108 {
1109         struct sk_buff *skb;
1110         unsigned long flags;
1111         int err = 0;
1112
1113         spin_lock_irqsave(&data->rxlock, flags);
1114         skb = data->sco_skb;
1115
1116         while (count) {
1117                 int len;
1118
1119                 if (!skb) {
1120                         skb = bt_skb_alloc(HCI_MAX_SCO_SIZE, GFP_ATOMIC);
1121                         if (!skb) {
1122                                 err = -ENOMEM;
1123                                 break;
1124                         }
1125
1126                         hci_skb_pkt_type(skb) = HCI_SCODATA_PKT;
1127                         hci_skb_expect(skb) = HCI_SCO_HDR_SIZE;
1128                 }
1129
1130                 len = min_t(uint, hci_skb_expect(skb), count);
1131                 skb_put_data(skb, buffer, len);
1132
1133                 count -= len;
1134                 buffer += len;
1135                 hci_skb_expect(skb) -= len;
1136
1137                 if (skb->len == HCI_SCO_HDR_SIZE) {
1138                         /* Complete SCO header */
1139                         struct hci_sco_hdr *hdr = hci_sco_hdr(skb);
1140
1141                         hci_skb_expect(skb) = hdr->dlen;
1142
1143                         if (skb_tailroom(skb) < hci_skb_expect(skb) ||
1144                             !btusb_validate_sco_handle(data->hdev, hdr)) {
1145                                 kfree_skb(skb);
1146                                 skb = NULL;
1147
1148                                 err = -EILSEQ;
1149                                 break;
1150                         }
1151                 }
1152
1153                 if (!hci_skb_expect(skb)) {
1154                         /* Complete frame */
1155                         hci_recv_frame(data->hdev, skb);
1156                         skb = NULL;
1157                 }
1158         }
1159
1160         data->sco_skb = skb;
1161         spin_unlock_irqrestore(&data->rxlock, flags);
1162
1163         return err;
1164 }
1165
1166 static void btusb_intr_complete(struct urb *urb)
1167 {
1168         struct hci_dev *hdev = urb->context;
1169         struct btusb_data *data = hci_get_drvdata(hdev);
1170         int err;
1171
1172         BT_DBG("%s urb %p status %d count %d", hdev->name, urb, urb->status,
1173                urb->actual_length);
1174
1175         if (!test_bit(HCI_RUNNING, &hdev->flags))
1176                 return;
1177
1178         if (urb->status == 0) {
1179                 hdev->stat.byte_rx += urb->actual_length;
1180
1181                 if (btusb_recv_intr(data, urb->transfer_buffer,
1182                                     urb->actual_length) < 0) {
1183                         bt_dev_err(hdev, "corrupted event packet");
1184                         hdev->stat.err_rx++;
1185                 }
1186         } else if (urb->status == -ENOENT) {
1187                 /* Avoid suspend failed when usb_kill_urb */
1188                 return;
1189         }
1190
1191         if (!test_bit(BTUSB_INTR_RUNNING, &data->flags))
1192                 return;
1193
1194         usb_mark_last_busy(data->udev);
1195         usb_anchor_urb(urb, &data->intr_anchor);
1196
1197         err = usb_submit_urb(urb, GFP_ATOMIC);
1198         if (err < 0) {
1199                 /* -EPERM: urb is being killed;
1200                  * -ENODEV: device got disconnected
1201                  */
1202                 if (err != -EPERM && err != -ENODEV)
1203                         bt_dev_err(hdev, "urb %p failed to resubmit (%d)",
1204                                    urb, -err);
1205                 if (err != -EPERM)
1206                         hci_cmd_sync_cancel(hdev, -err);
1207                 usb_unanchor_urb(urb);
1208         }
1209 }
1210
1211 static int btusb_submit_intr_urb(struct hci_dev *hdev, gfp_t mem_flags)
1212 {
1213         struct btusb_data *data = hci_get_drvdata(hdev);
1214         struct urb *urb;
1215         unsigned char *buf;
1216         unsigned int pipe;
1217         int err, size;
1218
1219         BT_DBG("%s", hdev->name);
1220
1221         if (!data->intr_ep)
1222                 return -ENODEV;
1223
1224         urb = usb_alloc_urb(0, mem_flags);
1225         if (!urb)
1226                 return -ENOMEM;
1227
1228         size = le16_to_cpu(data->intr_ep->wMaxPacketSize);
1229
1230         buf = kmalloc(size, mem_flags);
1231         if (!buf) {
1232                 usb_free_urb(urb);
1233                 return -ENOMEM;
1234         }
1235
1236         pipe = usb_rcvintpipe(data->udev, data->intr_ep->bEndpointAddress);
1237
1238         usb_fill_int_urb(urb, data->udev, pipe, buf, size,
1239                          btusb_intr_complete, hdev, data->intr_ep->bInterval);
1240
1241         urb->transfer_flags |= URB_FREE_BUFFER;
1242
1243         usb_anchor_urb(urb, &data->intr_anchor);
1244
1245         err = usb_submit_urb(urb, mem_flags);
1246         if (err < 0) {
1247                 if (err != -EPERM && err != -ENODEV)
1248                         bt_dev_err(hdev, "urb %p submission failed (%d)",
1249                                    urb, -err);
1250                 if (err != -EPERM)
1251                         hci_cmd_sync_cancel(hdev, -err);
1252                 usb_unanchor_urb(urb);
1253         }
1254
1255         /* Only initialize intr_interval if URB poll sync is enabled */
1256         if (!data->poll_sync)
1257                 goto done;
1258
1259         /* The units are frames (milliseconds) for full and low speed devices,
1260          * and microframes (1/8 millisecond) for highspeed and SuperSpeed
1261          * devices.
1262          *
1263          * This is done once on open/resume so it shouldn't change even if
1264          * force_poll_sync changes.
1265          */
1266         switch (urb->dev->speed) {
1267         case USB_SPEED_SUPER_PLUS:
1268         case USB_SPEED_SUPER:   /* units are 125us */
1269                 data->intr_interval = usecs_to_jiffies(urb->interval * 125);
1270                 break;
1271         default:
1272                 data->intr_interval = msecs_to_jiffies(urb->interval);
1273                 break;
1274         }
1275
1276 done:
1277         usb_free_urb(urb);
1278
1279         return err;
1280 }
1281
1282 static void btusb_bulk_complete(struct urb *urb)
1283 {
1284         struct hci_dev *hdev = urb->context;
1285         struct btusb_data *data = hci_get_drvdata(hdev);
1286         int err;
1287
1288         BT_DBG("%s urb %p status %d count %d", hdev->name, urb, urb->status,
1289                urb->actual_length);
1290
1291         if (!test_bit(HCI_RUNNING, &hdev->flags))
1292                 return;
1293
1294         if (urb->status == 0) {
1295                 hdev->stat.byte_rx += urb->actual_length;
1296
1297                 if (data->recv_bulk(data, urb->transfer_buffer,
1298                                     urb->actual_length) < 0) {
1299                         bt_dev_err(hdev, "corrupted ACL packet");
1300                         hdev->stat.err_rx++;
1301                 }
1302         } else if (urb->status == -ENOENT) {
1303                 /* Avoid suspend failed when usb_kill_urb */
1304                 return;
1305         }
1306
1307         if (!test_bit(BTUSB_BULK_RUNNING, &data->flags))
1308                 return;
1309
1310         usb_anchor_urb(urb, &data->bulk_anchor);
1311         usb_mark_last_busy(data->udev);
1312
1313         err = usb_submit_urb(urb, GFP_ATOMIC);
1314         if (err < 0) {
1315                 /* -EPERM: urb is being killed;
1316                  * -ENODEV: device got disconnected
1317                  */
1318                 if (err != -EPERM && err != -ENODEV)
1319                         bt_dev_err(hdev, "urb %p failed to resubmit (%d)",
1320                                    urb, -err);
1321                 usb_unanchor_urb(urb);
1322         }
1323 }
1324
1325 static int btusb_submit_bulk_urb(struct hci_dev *hdev, gfp_t mem_flags)
1326 {
1327         struct btusb_data *data = hci_get_drvdata(hdev);
1328         struct urb *urb;
1329         unsigned char *buf;
1330         unsigned int pipe;
1331         int err, size = HCI_MAX_FRAME_SIZE;
1332
1333         BT_DBG("%s", hdev->name);
1334
1335         if (!data->bulk_rx_ep)
1336                 return -ENODEV;
1337
1338         urb = usb_alloc_urb(0, mem_flags);
1339         if (!urb)
1340                 return -ENOMEM;
1341
1342         buf = kmalloc(size, mem_flags);
1343         if (!buf) {
1344                 usb_free_urb(urb);
1345                 return -ENOMEM;
1346         }
1347
1348         pipe = usb_rcvbulkpipe(data->udev, data->bulk_rx_ep->bEndpointAddress);
1349
1350         usb_fill_bulk_urb(urb, data->udev, pipe, buf, size,
1351                           btusb_bulk_complete, hdev);
1352
1353         urb->transfer_flags |= URB_FREE_BUFFER;
1354
1355         usb_mark_last_busy(data->udev);
1356         usb_anchor_urb(urb, &data->bulk_anchor);
1357
1358         err = usb_submit_urb(urb, mem_flags);
1359         if (err < 0) {
1360                 if (err != -EPERM && err != -ENODEV)
1361                         bt_dev_err(hdev, "urb %p submission failed (%d)",
1362                                    urb, -err);
1363                 usb_unanchor_urb(urb);
1364         }
1365
1366         usb_free_urb(urb);
1367
1368         return err;
1369 }
1370
1371 static void btusb_isoc_complete(struct urb *urb)
1372 {
1373         struct hci_dev *hdev = urb->context;
1374         struct btusb_data *data = hci_get_drvdata(hdev);
1375         int i, err;
1376
1377         BT_DBG("%s urb %p status %d count %d", hdev->name, urb, urb->status,
1378                urb->actual_length);
1379
1380         if (!test_bit(HCI_RUNNING, &hdev->flags))
1381                 return;
1382
1383         if (urb->status == 0) {
1384                 for (i = 0; i < urb->number_of_packets; i++) {
1385                         unsigned int offset = urb->iso_frame_desc[i].offset;
1386                         unsigned int length = urb->iso_frame_desc[i].actual_length;
1387
1388                         if (urb->iso_frame_desc[i].status)
1389                                 continue;
1390
1391                         hdev->stat.byte_rx += length;
1392
1393                         if (btusb_recv_isoc(data, urb->transfer_buffer + offset,
1394                                             length) < 0) {
1395                                 bt_dev_err(hdev, "corrupted SCO packet");
1396                                 hdev->stat.err_rx++;
1397                         }
1398                 }
1399         } else if (urb->status == -ENOENT) {
1400                 /* Avoid suspend failed when usb_kill_urb */
1401                 return;
1402         }
1403
1404         if (!test_bit(BTUSB_ISOC_RUNNING, &data->flags))
1405                 return;
1406
1407         usb_anchor_urb(urb, &data->isoc_anchor);
1408
1409         err = usb_submit_urb(urb, GFP_ATOMIC);
1410         if (err < 0) {
1411                 /* -EPERM: urb is being killed;
1412                  * -ENODEV: device got disconnected
1413                  */
1414                 if (err != -EPERM && err != -ENODEV)
1415                         bt_dev_err(hdev, "urb %p failed to resubmit (%d)",
1416                                    urb, -err);
1417                 usb_unanchor_urb(urb);
1418         }
1419 }
1420
1421 static inline void __fill_isoc_descriptor_msbc(struct urb *urb, int len,
1422                                                int mtu, struct btusb_data *data)
1423 {
1424         int i = 0, offset = 0;
1425         unsigned int interval;
1426
1427         BT_DBG("len %d mtu %d", len, mtu);
1428
1429         /* For mSBC ALT 6 settings some chips need to transmit the data
1430          * continuously without the zero length of USB packets.
1431          */
1432         if (test_bit(BTUSB_ALT6_CONTINUOUS_TX, &data->flags))
1433                 goto ignore_usb_alt6_packet_flow;
1434
1435         /* For mSBC ALT 6 setting the host will send the packet at continuous
1436          * flow. As per core spec 5, vol 4, part B, table 2.1. For ALT setting
1437          * 6 the HCI PACKET INTERVAL should be 7.5ms for every usb packets.
1438          * To maintain the rate we send 63bytes of usb packets alternatively for
1439          * 7ms and 8ms to maintain the rate as 7.5ms.
1440          */
1441         if (data->usb_alt6_packet_flow) {
1442                 interval = 7;
1443                 data->usb_alt6_packet_flow = false;
1444         } else {
1445                 interval = 6;
1446                 data->usb_alt6_packet_flow = true;
1447         }
1448
1449         for (i = 0; i < interval; i++) {
1450                 urb->iso_frame_desc[i].offset = offset;
1451                 urb->iso_frame_desc[i].length = offset;
1452         }
1453
1454 ignore_usb_alt6_packet_flow:
1455         if (len && i < BTUSB_MAX_ISOC_FRAMES) {
1456                 urb->iso_frame_desc[i].offset = offset;
1457                 urb->iso_frame_desc[i].length = len;
1458                 i++;
1459         }
1460
1461         urb->number_of_packets = i;
1462 }
1463
1464 static inline void __fill_isoc_descriptor(struct urb *urb, int len, int mtu)
1465 {
1466         int i, offset = 0;
1467
1468         BT_DBG("len %d mtu %d", len, mtu);
1469
1470         for (i = 0; i < BTUSB_MAX_ISOC_FRAMES && len >= mtu;
1471                                         i++, offset += mtu, len -= mtu) {
1472                 urb->iso_frame_desc[i].offset = offset;
1473                 urb->iso_frame_desc[i].length = mtu;
1474         }
1475
1476         if (len && i < BTUSB_MAX_ISOC_FRAMES) {
1477                 urb->iso_frame_desc[i].offset = offset;
1478                 urb->iso_frame_desc[i].length = len;
1479                 i++;
1480         }
1481
1482         urb->number_of_packets = i;
1483 }
1484
1485 static int btusb_submit_isoc_urb(struct hci_dev *hdev, gfp_t mem_flags)
1486 {
1487         struct btusb_data *data = hci_get_drvdata(hdev);
1488         struct urb *urb;
1489         unsigned char *buf;
1490         unsigned int pipe;
1491         int err, size;
1492
1493         BT_DBG("%s", hdev->name);
1494
1495         if (!data->isoc_rx_ep)
1496                 return -ENODEV;
1497
1498         urb = usb_alloc_urb(BTUSB_MAX_ISOC_FRAMES, mem_flags);
1499         if (!urb)
1500                 return -ENOMEM;
1501
1502         size = le16_to_cpu(data->isoc_rx_ep->wMaxPacketSize) *
1503                                                 BTUSB_MAX_ISOC_FRAMES;
1504
1505         buf = kmalloc(size, mem_flags);
1506         if (!buf) {
1507                 usb_free_urb(urb);
1508                 return -ENOMEM;
1509         }
1510
1511         pipe = usb_rcvisocpipe(data->udev, data->isoc_rx_ep->bEndpointAddress);
1512
1513         usb_fill_int_urb(urb, data->udev, pipe, buf, size, btusb_isoc_complete,
1514                          hdev, data->isoc_rx_ep->bInterval);
1515
1516         urb->transfer_flags = URB_FREE_BUFFER | URB_ISO_ASAP;
1517
1518         __fill_isoc_descriptor(urb, size,
1519                                le16_to_cpu(data->isoc_rx_ep->wMaxPacketSize));
1520
1521         usb_anchor_urb(urb, &data->isoc_anchor);
1522
1523         err = usb_submit_urb(urb, mem_flags);
1524         if (err < 0) {
1525                 if (err != -EPERM && err != -ENODEV)
1526                         bt_dev_err(hdev, "urb %p submission failed (%d)",
1527                                    urb, -err);
1528                 usb_unanchor_urb(urb);
1529         }
1530
1531         usb_free_urb(urb);
1532
1533         return err;
1534 }
1535
1536 static void btusb_diag_complete(struct urb *urb)
1537 {
1538         struct hci_dev *hdev = urb->context;
1539         struct btusb_data *data = hci_get_drvdata(hdev);
1540         int err;
1541
1542         BT_DBG("%s urb %p status %d count %d", hdev->name, urb, urb->status,
1543                urb->actual_length);
1544
1545         if (urb->status == 0) {
1546                 struct sk_buff *skb;
1547
1548                 skb = bt_skb_alloc(urb->actual_length, GFP_ATOMIC);
1549                 if (skb) {
1550                         skb_put_data(skb, urb->transfer_buffer,
1551                                      urb->actual_length);
1552                         hci_recv_diag(hdev, skb);
1553                 }
1554         } else if (urb->status == -ENOENT) {
1555                 /* Avoid suspend failed when usb_kill_urb */
1556                 return;
1557         }
1558
1559         if (!test_bit(BTUSB_DIAG_RUNNING, &data->flags))
1560                 return;
1561
1562         usb_anchor_urb(urb, &data->diag_anchor);
1563         usb_mark_last_busy(data->udev);
1564
1565         err = usb_submit_urb(urb, GFP_ATOMIC);
1566         if (err < 0) {
1567                 /* -EPERM: urb is being killed;
1568                  * -ENODEV: device got disconnected
1569                  */
1570                 if (err != -EPERM && err != -ENODEV)
1571                         bt_dev_err(hdev, "urb %p failed to resubmit (%d)",
1572                                    urb, -err);
1573                 usb_unanchor_urb(urb);
1574         }
1575 }
1576
1577 static int btusb_submit_diag_urb(struct hci_dev *hdev, gfp_t mem_flags)
1578 {
1579         struct btusb_data *data = hci_get_drvdata(hdev);
1580         struct urb *urb;
1581         unsigned char *buf;
1582         unsigned int pipe;
1583         int err, size = HCI_MAX_FRAME_SIZE;
1584
1585         BT_DBG("%s", hdev->name);
1586
1587         if (!data->diag_rx_ep)
1588                 return -ENODEV;
1589
1590         urb = usb_alloc_urb(0, mem_flags);
1591         if (!urb)
1592                 return -ENOMEM;
1593
1594         buf = kmalloc(size, mem_flags);
1595         if (!buf) {
1596                 usb_free_urb(urb);
1597                 return -ENOMEM;
1598         }
1599
1600         pipe = usb_rcvbulkpipe(data->udev, data->diag_rx_ep->bEndpointAddress);
1601
1602         usb_fill_bulk_urb(urb, data->udev, pipe, buf, size,
1603                           btusb_diag_complete, hdev);
1604
1605         urb->transfer_flags |= URB_FREE_BUFFER;
1606
1607         usb_mark_last_busy(data->udev);
1608         usb_anchor_urb(urb, &data->diag_anchor);
1609
1610         err = usb_submit_urb(urb, mem_flags);
1611         if (err < 0) {
1612                 if (err != -EPERM && err != -ENODEV)
1613                         bt_dev_err(hdev, "urb %p submission failed (%d)",
1614                                    urb, -err);
1615                 usb_unanchor_urb(urb);
1616         }
1617
1618         usb_free_urb(urb);
1619
1620         return err;
1621 }
1622
1623 static void btusb_tx_complete(struct urb *urb)
1624 {
1625         struct sk_buff *skb = urb->context;
1626         struct hci_dev *hdev = (struct hci_dev *)skb->dev;
1627         struct btusb_data *data = hci_get_drvdata(hdev);
1628         unsigned long flags;
1629
1630         BT_DBG("%s urb %p status %d count %d", hdev->name, urb, urb->status,
1631                urb->actual_length);
1632
1633         if (!test_bit(HCI_RUNNING, &hdev->flags))
1634                 goto done;
1635
1636         if (!urb->status) {
1637                 hdev->stat.byte_tx += urb->transfer_buffer_length;
1638         } else {
1639                 if (hci_skb_pkt_type(skb) == HCI_COMMAND_PKT)
1640                         hci_cmd_sync_cancel(hdev, -urb->status);
1641                 hdev->stat.err_tx++;
1642         }
1643
1644 done:
1645         spin_lock_irqsave(&data->txlock, flags);
1646         data->tx_in_flight--;
1647         spin_unlock_irqrestore(&data->txlock, flags);
1648
1649         kfree(urb->setup_packet);
1650
1651         kfree_skb(skb);
1652 }
1653
1654 static void btusb_isoc_tx_complete(struct urb *urb)
1655 {
1656         struct sk_buff *skb = urb->context;
1657         struct hci_dev *hdev = (struct hci_dev *)skb->dev;
1658
1659         BT_DBG("%s urb %p status %d count %d", hdev->name, urb, urb->status,
1660                urb->actual_length);
1661
1662         if (!test_bit(HCI_RUNNING, &hdev->flags))
1663                 goto done;
1664
1665         if (!urb->status)
1666                 hdev->stat.byte_tx += urb->transfer_buffer_length;
1667         else
1668                 hdev->stat.err_tx++;
1669
1670 done:
1671         kfree(urb->setup_packet);
1672
1673         kfree_skb(skb);
1674 }
1675
1676 static int btusb_open(struct hci_dev *hdev)
1677 {
1678         struct btusb_data *data = hci_get_drvdata(hdev);
1679         int err;
1680
1681         BT_DBG("%s", hdev->name);
1682
1683         err = usb_autopm_get_interface(data->intf);
1684         if (err < 0)
1685                 return err;
1686
1687         /* Patching USB firmware files prior to starting any URBs of HCI path
1688          * It is more safe to use USB bulk channel for downloading USB patch
1689          */
1690         if (data->setup_on_usb) {
1691                 err = data->setup_on_usb(hdev);
1692                 if (err < 0)
1693                         goto setup_fail;
1694         }
1695
1696         data->intf->needs_remote_wakeup = 1;
1697
1698         if (test_and_set_bit(BTUSB_INTR_RUNNING, &data->flags))
1699                 goto done;
1700
1701         err = btusb_submit_intr_urb(hdev, GFP_KERNEL);
1702         if (err < 0)
1703                 goto failed;
1704
1705         err = btusb_submit_bulk_urb(hdev, GFP_KERNEL);
1706         if (err < 0) {
1707                 usb_kill_anchored_urbs(&data->intr_anchor);
1708                 goto failed;
1709         }
1710
1711         set_bit(BTUSB_BULK_RUNNING, &data->flags);
1712         btusb_submit_bulk_urb(hdev, GFP_KERNEL);
1713
1714         if (data->diag) {
1715                 if (!btusb_submit_diag_urb(hdev, GFP_KERNEL))
1716                         set_bit(BTUSB_DIAG_RUNNING, &data->flags);
1717         }
1718
1719 done:
1720         usb_autopm_put_interface(data->intf);
1721         return 0;
1722
1723 failed:
1724         clear_bit(BTUSB_INTR_RUNNING, &data->flags);
1725 setup_fail:
1726         usb_autopm_put_interface(data->intf);
1727         return err;
1728 }
1729
1730 static void btusb_stop_traffic(struct btusb_data *data)
1731 {
1732         usb_kill_anchored_urbs(&data->intr_anchor);
1733         usb_kill_anchored_urbs(&data->bulk_anchor);
1734         usb_kill_anchored_urbs(&data->isoc_anchor);
1735         usb_kill_anchored_urbs(&data->diag_anchor);
1736         usb_kill_anchored_urbs(&data->ctrl_anchor);
1737 }
1738
1739 static int btusb_close(struct hci_dev *hdev)
1740 {
1741         struct btusb_data *data = hci_get_drvdata(hdev);
1742         int err;
1743
1744         BT_DBG("%s", hdev->name);
1745
1746         cancel_delayed_work(&data->rx_work);
1747         cancel_work_sync(&data->work);
1748         cancel_work_sync(&data->waker);
1749
1750         skb_queue_purge(&data->acl_q);
1751
1752         clear_bit(BTUSB_ISOC_RUNNING, &data->flags);
1753         clear_bit(BTUSB_BULK_RUNNING, &data->flags);
1754         clear_bit(BTUSB_INTR_RUNNING, &data->flags);
1755         clear_bit(BTUSB_DIAG_RUNNING, &data->flags);
1756
1757         btusb_stop_traffic(data);
1758         btusb_free_frags(data);
1759
1760         err = usb_autopm_get_interface(data->intf);
1761         if (err < 0)
1762                 goto failed;
1763
1764         data->intf->needs_remote_wakeup = 0;
1765
1766         /* Enable remote wake up for auto-suspend */
1767         if (test_bit(BTUSB_WAKEUP_AUTOSUSPEND, &data->flags))
1768                 data->intf->needs_remote_wakeup = 1;
1769
1770         usb_autopm_put_interface(data->intf);
1771
1772 failed:
1773         usb_scuttle_anchored_urbs(&data->deferred);
1774         return 0;
1775 }
1776
1777 static int btusb_flush(struct hci_dev *hdev)
1778 {
1779         struct btusb_data *data = hci_get_drvdata(hdev);
1780
1781         BT_DBG("%s", hdev->name);
1782
1783         cancel_delayed_work(&data->rx_work);
1784
1785         skb_queue_purge(&data->acl_q);
1786
1787         usb_kill_anchored_urbs(&data->tx_anchor);
1788         btusb_free_frags(data);
1789
1790         return 0;
1791 }
1792
1793 static struct urb *alloc_ctrl_urb(struct hci_dev *hdev, struct sk_buff *skb)
1794 {
1795         struct btusb_data *data = hci_get_drvdata(hdev);
1796         struct usb_ctrlrequest *dr;
1797         struct urb *urb;
1798         unsigned int pipe;
1799
1800         urb = usb_alloc_urb(0, GFP_KERNEL);
1801         if (!urb)
1802                 return ERR_PTR(-ENOMEM);
1803
1804         dr = kmalloc(sizeof(*dr), GFP_KERNEL);
1805         if (!dr) {
1806                 usb_free_urb(urb);
1807                 return ERR_PTR(-ENOMEM);
1808         }
1809
1810         dr->bRequestType = data->cmdreq_type;
1811         dr->bRequest     = data->cmdreq;
1812         dr->wIndex       = 0;
1813         dr->wValue       = 0;
1814         dr->wLength      = __cpu_to_le16(skb->len);
1815
1816         pipe = usb_sndctrlpipe(data->udev, 0x00);
1817
1818         usb_fill_control_urb(urb, data->udev, pipe, (void *)dr,
1819                              skb->data, skb->len, btusb_tx_complete, skb);
1820
1821         skb->dev = (void *)hdev;
1822
1823         return urb;
1824 }
1825
1826 static struct urb *alloc_bulk_urb(struct hci_dev *hdev, struct sk_buff *skb)
1827 {
1828         struct btusb_data *data = hci_get_drvdata(hdev);
1829         struct urb *urb;
1830         unsigned int pipe;
1831
1832         if (!data->bulk_tx_ep)
1833                 return ERR_PTR(-ENODEV);
1834
1835         urb = usb_alloc_urb(0, GFP_KERNEL);
1836         if (!urb)
1837                 return ERR_PTR(-ENOMEM);
1838
1839         pipe = usb_sndbulkpipe(data->udev, data->bulk_tx_ep->bEndpointAddress);
1840
1841         usb_fill_bulk_urb(urb, data->udev, pipe,
1842                           skb->data, skb->len, btusb_tx_complete, skb);
1843
1844         skb->dev = (void *)hdev;
1845
1846         return urb;
1847 }
1848
1849 static struct urb *alloc_isoc_urb(struct hci_dev *hdev, struct sk_buff *skb)
1850 {
1851         struct btusb_data *data = hci_get_drvdata(hdev);
1852         struct urb *urb;
1853         unsigned int pipe;
1854
1855         if (!data->isoc_tx_ep)
1856                 return ERR_PTR(-ENODEV);
1857
1858         urb = usb_alloc_urb(BTUSB_MAX_ISOC_FRAMES, GFP_KERNEL);
1859         if (!urb)
1860                 return ERR_PTR(-ENOMEM);
1861
1862         pipe = usb_sndisocpipe(data->udev, data->isoc_tx_ep->bEndpointAddress);
1863
1864         usb_fill_int_urb(urb, data->udev, pipe,
1865                          skb->data, skb->len, btusb_isoc_tx_complete,
1866                          skb, data->isoc_tx_ep->bInterval);
1867
1868         urb->transfer_flags  = URB_ISO_ASAP;
1869
1870         if (data->isoc_altsetting == 6)
1871                 __fill_isoc_descriptor_msbc(urb, skb->len,
1872                                             le16_to_cpu(data->isoc_tx_ep->wMaxPacketSize),
1873                                             data);
1874         else
1875                 __fill_isoc_descriptor(urb, skb->len,
1876                                        le16_to_cpu(data->isoc_tx_ep->wMaxPacketSize));
1877         skb->dev = (void *)hdev;
1878
1879         return urb;
1880 }
1881
1882 static int submit_tx_urb(struct hci_dev *hdev, struct urb *urb)
1883 {
1884         struct btusb_data *data = hci_get_drvdata(hdev);
1885         int err;
1886
1887         usb_anchor_urb(urb, &data->tx_anchor);
1888
1889         err = usb_submit_urb(urb, GFP_KERNEL);
1890         if (err < 0) {
1891                 if (err != -EPERM && err != -ENODEV)
1892                         bt_dev_err(hdev, "urb %p submission failed (%d)",
1893                                    urb, -err);
1894                 kfree(urb->setup_packet);
1895                 usb_unanchor_urb(urb);
1896         } else {
1897                 usb_mark_last_busy(data->udev);
1898         }
1899
1900         usb_free_urb(urb);
1901         return err;
1902 }
1903
1904 static int submit_or_queue_tx_urb(struct hci_dev *hdev, struct urb *urb)
1905 {
1906         struct btusb_data *data = hci_get_drvdata(hdev);
1907         unsigned long flags;
1908         bool suspending;
1909
1910         spin_lock_irqsave(&data->txlock, flags);
1911         suspending = test_bit(BTUSB_SUSPENDING, &data->flags);
1912         if (!suspending)
1913                 data->tx_in_flight++;
1914         spin_unlock_irqrestore(&data->txlock, flags);
1915
1916         if (!suspending)
1917                 return submit_tx_urb(hdev, urb);
1918
1919         usb_anchor_urb(urb, &data->deferred);
1920         schedule_work(&data->waker);
1921
1922         usb_free_urb(urb);
1923         return 0;
1924 }
1925
1926 static int btusb_send_frame(struct hci_dev *hdev, struct sk_buff *skb)
1927 {
1928         struct urb *urb;
1929
1930         BT_DBG("%s", hdev->name);
1931
1932         switch (hci_skb_pkt_type(skb)) {
1933         case HCI_COMMAND_PKT:
1934                 urb = alloc_ctrl_urb(hdev, skb);
1935                 if (IS_ERR(urb))
1936                         return PTR_ERR(urb);
1937
1938                 hdev->stat.cmd_tx++;
1939                 return submit_or_queue_tx_urb(hdev, urb);
1940
1941         case HCI_ACLDATA_PKT:
1942                 urb = alloc_bulk_urb(hdev, skb);
1943                 if (IS_ERR(urb))
1944                         return PTR_ERR(urb);
1945
1946                 hdev->stat.acl_tx++;
1947                 return submit_or_queue_tx_urb(hdev, urb);
1948
1949         case HCI_SCODATA_PKT:
1950                 if (hci_conn_num(hdev, SCO_LINK) < 1)
1951                         return -ENODEV;
1952
1953                 urb = alloc_isoc_urb(hdev, skb);
1954                 if (IS_ERR(urb))
1955                         return PTR_ERR(urb);
1956
1957                 hdev->stat.sco_tx++;
1958                 return submit_tx_urb(hdev, urb);
1959
1960         case HCI_ISODATA_PKT:
1961                 urb = alloc_bulk_urb(hdev, skb);
1962                 if (IS_ERR(urb))
1963                         return PTR_ERR(urb);
1964
1965                 return submit_or_queue_tx_urb(hdev, urb);
1966         }
1967
1968         return -EILSEQ;
1969 }
1970
1971 static void btusb_notify(struct hci_dev *hdev, unsigned int evt)
1972 {
1973         struct btusb_data *data = hci_get_drvdata(hdev);
1974
1975         BT_DBG("%s evt %d", hdev->name, evt);
1976
1977         if (hci_conn_num(hdev, SCO_LINK) != data->sco_num) {
1978                 data->sco_num = hci_conn_num(hdev, SCO_LINK);
1979                 data->air_mode = evt;
1980                 schedule_work(&data->work);
1981         }
1982 }
1983
1984 static inline int __set_isoc_interface(struct hci_dev *hdev, int altsetting)
1985 {
1986         struct btusb_data *data = hci_get_drvdata(hdev);
1987         struct usb_interface *intf = data->isoc;
1988         struct usb_endpoint_descriptor *ep_desc;
1989         int i, err;
1990
1991         if (!data->isoc)
1992                 return -ENODEV;
1993
1994         err = usb_set_interface(data->udev, data->isoc_ifnum, altsetting);
1995         if (err < 0) {
1996                 bt_dev_err(hdev, "setting interface failed (%d)", -err);
1997                 return err;
1998         }
1999
2000         data->isoc_altsetting = altsetting;
2001
2002         data->isoc_tx_ep = NULL;
2003         data->isoc_rx_ep = NULL;
2004
2005         for (i = 0; i < intf->cur_altsetting->desc.bNumEndpoints; i++) {
2006                 ep_desc = &intf->cur_altsetting->endpoint[i].desc;
2007
2008                 if (!data->isoc_tx_ep && usb_endpoint_is_isoc_out(ep_desc)) {
2009                         data->isoc_tx_ep = ep_desc;
2010                         continue;
2011                 }
2012
2013                 if (!data->isoc_rx_ep && usb_endpoint_is_isoc_in(ep_desc)) {
2014                         data->isoc_rx_ep = ep_desc;
2015                         continue;
2016                 }
2017         }
2018
2019         if (!data->isoc_tx_ep || !data->isoc_rx_ep) {
2020                 bt_dev_err(hdev, "invalid SCO descriptors");
2021                 return -ENODEV;
2022         }
2023
2024         return 0;
2025 }
2026
2027 static int btusb_switch_alt_setting(struct hci_dev *hdev, int new_alts)
2028 {
2029         struct btusb_data *data = hci_get_drvdata(hdev);
2030         int err;
2031
2032         if (data->isoc_altsetting != new_alts) {
2033                 unsigned long flags;
2034
2035                 clear_bit(BTUSB_ISOC_RUNNING, &data->flags);
2036                 usb_kill_anchored_urbs(&data->isoc_anchor);
2037
2038                 /* When isochronous alternate setting needs to be
2039                  * changed, because SCO connection has been added
2040                  * or removed, a packet fragment may be left in the
2041                  * reassembling state. This could lead to wrongly
2042                  * assembled fragments.
2043                  *
2044                  * Clear outstanding fragment when selecting a new
2045                  * alternate setting.
2046                  */
2047                 spin_lock_irqsave(&data->rxlock, flags);
2048                 kfree_skb(data->sco_skb);
2049                 data->sco_skb = NULL;
2050                 spin_unlock_irqrestore(&data->rxlock, flags);
2051
2052                 err = __set_isoc_interface(hdev, new_alts);
2053                 if (err < 0)
2054                         return err;
2055         }
2056
2057         if (!test_and_set_bit(BTUSB_ISOC_RUNNING, &data->flags)) {
2058                 if (btusb_submit_isoc_urb(hdev, GFP_KERNEL) < 0)
2059                         clear_bit(BTUSB_ISOC_RUNNING, &data->flags);
2060                 else
2061                         btusb_submit_isoc_urb(hdev, GFP_KERNEL);
2062         }
2063
2064         return 0;
2065 }
2066
2067 static struct usb_host_interface *btusb_find_altsetting(struct btusb_data *data,
2068                                                         int alt)
2069 {
2070         struct usb_interface *intf = data->isoc;
2071         int i;
2072
2073         BT_DBG("Looking for Alt no :%d", alt);
2074
2075         if (!intf)
2076                 return NULL;
2077
2078         for (i = 0; i < intf->num_altsetting; i++) {
2079                 if (intf->altsetting[i].desc.bAlternateSetting == alt)
2080                         return &intf->altsetting[i];
2081         }
2082
2083         return NULL;
2084 }
2085
2086 static void btusb_work(struct work_struct *work)
2087 {
2088         struct btusb_data *data = container_of(work, struct btusb_data, work);
2089         struct hci_dev *hdev = data->hdev;
2090         int new_alts = 0;
2091         int err;
2092
2093         if (data->sco_num > 0) {
2094                 if (!test_bit(BTUSB_DID_ISO_RESUME, &data->flags)) {
2095                         err = usb_autopm_get_interface(data->isoc ? data->isoc : data->intf);
2096                         if (err < 0) {
2097                                 clear_bit(BTUSB_ISOC_RUNNING, &data->flags);
2098                                 usb_kill_anchored_urbs(&data->isoc_anchor);
2099                                 return;
2100                         }
2101
2102                         set_bit(BTUSB_DID_ISO_RESUME, &data->flags);
2103                 }
2104
2105                 if (data->air_mode == HCI_NOTIFY_ENABLE_SCO_CVSD) {
2106                         if (hdev->voice_setting & 0x0020) {
2107                                 static const int alts[3] = { 2, 4, 5 };
2108
2109                                 new_alts = alts[data->sco_num - 1];
2110                         } else {
2111                                 new_alts = data->sco_num;
2112                         }
2113                 } else if (data->air_mode == HCI_NOTIFY_ENABLE_SCO_TRANSP) {
2114                         /* Bluetooth USB spec recommends alt 6 (63 bytes), but
2115                          * many adapters do not support it.  Alt 1 appears to
2116                          * work for all adapters that do not have alt 6, and
2117                          * which work with WBS at all.  Some devices prefer
2118                          * alt 3 (HCI payload >= 60 Bytes let air packet
2119                          * data satisfy 60 bytes), requiring
2120                          * MTU >= 3 (packets) * 25 (size) - 3 (headers) = 72
2121                          * see also Core spec 5, vol 4, B 2.1.1 & Table 2.1.
2122                          */
2123                         if (btusb_find_altsetting(data, 6))
2124                                 new_alts = 6;
2125                         else if (btusb_find_altsetting(data, 3) &&
2126                                  hdev->sco_mtu >= 72 &&
2127                                  test_bit(BTUSB_USE_ALT3_FOR_WBS, &data->flags))
2128                                 new_alts = 3;
2129                         else
2130                                 new_alts = 1;
2131                 }
2132
2133                 if (btusb_switch_alt_setting(hdev, new_alts) < 0)
2134                         bt_dev_err(hdev, "set USB alt:(%d) failed!", new_alts);
2135         } else {
2136                 usb_kill_anchored_urbs(&data->isoc_anchor);
2137
2138                 if (test_and_clear_bit(BTUSB_ISOC_RUNNING, &data->flags))
2139                         __set_isoc_interface(hdev, 0);
2140
2141                 if (test_and_clear_bit(BTUSB_DID_ISO_RESUME, &data->flags))
2142                         usb_autopm_put_interface(data->isoc ? data->isoc : data->intf);
2143         }
2144 }
2145
2146 static void btusb_waker(struct work_struct *work)
2147 {
2148         struct btusb_data *data = container_of(work, struct btusb_data, waker);
2149         int err;
2150
2151         err = usb_autopm_get_interface(data->intf);
2152         if (err < 0)
2153                 return;
2154
2155         usb_autopm_put_interface(data->intf);
2156 }
2157
2158 static void btusb_rx_work(struct work_struct *work)
2159 {
2160         struct btusb_data *data = container_of(work, struct btusb_data,
2161                                                rx_work.work);
2162         struct sk_buff *skb;
2163
2164         /* Dequeue ACL data received during the interval */
2165         while ((skb = skb_dequeue(&data->acl_q)))
2166                 data->recv_acl(data->hdev, skb);
2167 }
2168
2169 static int btusb_setup_bcm92035(struct hci_dev *hdev)
2170 {
2171         struct sk_buff *skb;
2172         u8 val = 0x00;
2173
2174         BT_DBG("%s", hdev->name);
2175
2176         skb = __hci_cmd_sync(hdev, 0xfc3b, 1, &val, HCI_INIT_TIMEOUT);
2177         if (IS_ERR(skb))
2178                 bt_dev_err(hdev, "BCM92035 command failed (%ld)", PTR_ERR(skb));
2179         else
2180                 kfree_skb(skb);
2181
2182         return 0;
2183 }
2184
2185 static int btusb_setup_csr(struct hci_dev *hdev)
2186 {
2187         struct btusb_data *data = hci_get_drvdata(hdev);
2188         u16 bcdDevice = le16_to_cpu(data->udev->descriptor.bcdDevice);
2189         struct hci_rp_read_local_version *rp;
2190         struct sk_buff *skb;
2191         bool is_fake = false;
2192         int ret;
2193
2194         BT_DBG("%s", hdev->name);
2195
2196         skb = __hci_cmd_sync(hdev, HCI_OP_READ_LOCAL_VERSION, 0, NULL,
2197                              HCI_INIT_TIMEOUT);
2198         if (IS_ERR(skb)) {
2199                 int err = PTR_ERR(skb);
2200                 bt_dev_err(hdev, "CSR: Local version failed (%d)", err);
2201                 return err;
2202         }
2203
2204         rp = skb_pull_data(skb, sizeof(*rp));
2205         if (!rp) {
2206                 bt_dev_err(hdev, "CSR: Local version length mismatch");
2207                 kfree_skb(skb);
2208                 return -EIO;
2209         }
2210
2211         bt_dev_info(hdev, "CSR: Setting up dongle with HCI ver=%u rev=%04x",
2212                     rp->hci_ver, le16_to_cpu(rp->hci_rev));
2213
2214         bt_dev_info(hdev, "LMP ver=%u subver=%04x; manufacturer=%u",
2215                     rp->lmp_ver, le16_to_cpu(rp->lmp_subver),
2216                     le16_to_cpu(rp->manufacturer));
2217
2218         /* Detect a wide host of Chinese controllers that aren't CSR.
2219          *
2220          * Known fake bcdDevices: 0x0100, 0x0134, 0x1915, 0x2520, 0x7558, 0x8891
2221          *
2222          * The main thing they have in common is that these are really popular low-cost
2223          * options that support newer Bluetooth versions but rely on heavy VID/PID
2224          * squatting of this poor old Bluetooth 1.1 device. Even sold as such.
2225          *
2226          * We detect actual CSR devices by checking that the HCI manufacturer code
2227          * is Cambridge Silicon Radio (10) and ensuring that LMP sub-version and
2228          * HCI rev values always match. As they both store the firmware number.
2229          */
2230         if (le16_to_cpu(rp->manufacturer) != 10 ||
2231             le16_to_cpu(rp->hci_rev) != le16_to_cpu(rp->lmp_subver))
2232                 is_fake = true;
2233
2234         /* Known legit CSR firmware build numbers and their supported BT versions:
2235          * - 1.1 (0x1) -> 0x0073, 0x020d, 0x033c, 0x034e
2236          * - 1.2 (0x2) ->                 0x04d9, 0x0529
2237          * - 2.0 (0x3) ->         0x07a6, 0x07ad, 0x0c5c
2238          * - 2.1 (0x4) ->         0x149c, 0x1735, 0x1899 (0x1899 is a BlueCore4-External)
2239          * - 4.0 (0x6) ->         0x1d86, 0x2031, 0x22bb
2240          *
2241          * e.g. Real CSR dongles with LMP subversion 0x73 are old enough that
2242          *      support BT 1.1 only; so it's a dead giveaway when some
2243          *      third-party BT 4.0 dongle reuses it.
2244          */
2245         else if (le16_to_cpu(rp->lmp_subver) <= 0x034e &&
2246                  rp->hci_ver > BLUETOOTH_VER_1_1)
2247                 is_fake = true;
2248
2249         else if (le16_to_cpu(rp->lmp_subver) <= 0x0529 &&
2250                  rp->hci_ver > BLUETOOTH_VER_1_2)
2251                 is_fake = true;
2252
2253         else if (le16_to_cpu(rp->lmp_subver) <= 0x0c5c &&
2254                  rp->hci_ver > BLUETOOTH_VER_2_0)
2255                 is_fake = true;
2256
2257         else if (le16_to_cpu(rp->lmp_subver) <= 0x1899 &&
2258                  rp->hci_ver > BLUETOOTH_VER_2_1)
2259                 is_fake = true;
2260
2261         else if (le16_to_cpu(rp->lmp_subver) <= 0x22bb &&
2262                  rp->hci_ver > BLUETOOTH_VER_4_0)
2263                 is_fake = true;
2264
2265         /* Other clones which beat all the above checks */
2266         else if (bcdDevice == 0x0134 &&
2267                  le16_to_cpu(rp->lmp_subver) == 0x0c5c &&
2268                  rp->hci_ver == BLUETOOTH_VER_2_0)
2269                 is_fake = true;
2270
2271         if (is_fake) {
2272                 bt_dev_warn(hdev, "CSR: Unbranded CSR clone detected; adding workarounds and force-suspending once...");
2273
2274                 /* Generally these clones have big discrepancies between
2275                  * advertised features and what's actually supported.
2276                  * Probably will need to be expanded in the future;
2277                  * without these the controller will lock up.
2278                  */
2279                 set_bit(HCI_QUIRK_BROKEN_STORED_LINK_KEY, &hdev->quirks);
2280                 set_bit(HCI_QUIRK_BROKEN_ERR_DATA_REPORTING, &hdev->quirks);
2281                 set_bit(HCI_QUIRK_BROKEN_FILTER_CLEAR_ALL, &hdev->quirks);
2282                 set_bit(HCI_QUIRK_NO_SUSPEND_NOTIFIER, &hdev->quirks);
2283
2284                 /* Clear the reset quirk since this is not an actual
2285                  * early Bluetooth 1.1 device from CSR.
2286                  */
2287                 clear_bit(HCI_QUIRK_RESET_ON_CLOSE, &hdev->quirks);
2288                 clear_bit(HCI_QUIRK_SIMULTANEOUS_DISCOVERY, &hdev->quirks);
2289
2290                 /*
2291                  * Special workaround for these BT 4.0 chip clones, and potentially more:
2292                  *
2293                  * - 0x0134: a Barrot 8041a02                 (HCI rev: 0x0810 sub: 0x1012)
2294                  * - 0x7558: IC markings FR3191AHAL 749H15143 (HCI rev/sub-version: 0x0709)
2295                  *
2296                  * These controllers are really messed-up.
2297                  *
2298                  * 1. Their bulk RX endpoint will never report any data unless
2299                  *    the device was suspended at least once (yes, really).
2300                  * 2. They will not wakeup when autosuspended and receiving data
2301                  *    on their bulk RX endpoint from e.g. a keyboard or mouse
2302                  *    (IOW remote-wakeup support is broken for the bulk endpoint).
2303                  *
2304                  * To fix 1. enable runtime-suspend, force-suspend the
2305                  * HCI and then wake-it up by disabling runtime-suspend.
2306                  *
2307                  * To fix 2. clear the HCI's can_wake flag, this way the HCI
2308                  * will still be autosuspended when it is not open.
2309                  *
2310                  * --
2311                  *
2312                  * Because these are widespread problems we prefer generic solutions; so
2313                  * apply this initialization quirk to every controller that gets here,
2314                  * it should be harmless. The alternative is to not work at all.
2315                  */
2316                 pm_runtime_allow(&data->udev->dev);
2317
2318                 ret = pm_runtime_suspend(&data->udev->dev);
2319                 if (ret >= 0)
2320                         msleep(200);
2321                 else
2322                         bt_dev_warn(hdev, "CSR: Couldn't suspend the device for our Barrot 8041a02 receive-issue workaround");
2323
2324                 pm_runtime_forbid(&data->udev->dev);
2325
2326                 device_set_wakeup_capable(&data->udev->dev, false);
2327
2328                 /* Re-enable autosuspend if this was requested */
2329                 if (enable_autosuspend)
2330                         usb_enable_autosuspend(data->udev);
2331         }
2332
2333         kfree_skb(skb);
2334
2335         return 0;
2336 }
2337
2338 static int inject_cmd_complete(struct hci_dev *hdev, __u16 opcode)
2339 {
2340         struct sk_buff *skb;
2341         struct hci_event_hdr *hdr;
2342         struct hci_ev_cmd_complete *evt;
2343
2344         skb = bt_skb_alloc(sizeof(*hdr) + sizeof(*evt) + 1, GFP_KERNEL);
2345         if (!skb)
2346                 return -ENOMEM;
2347
2348         hdr = skb_put(skb, sizeof(*hdr));
2349         hdr->evt = HCI_EV_CMD_COMPLETE;
2350         hdr->plen = sizeof(*evt) + 1;
2351
2352         evt = skb_put(skb, sizeof(*evt));
2353         evt->ncmd = 0x01;
2354         evt->opcode = cpu_to_le16(opcode);
2355
2356         skb_put_u8(skb, 0x00);
2357
2358         hci_skb_pkt_type(skb) = HCI_EVENT_PKT;
2359
2360         return hci_recv_frame(hdev, skb);
2361 }
2362
2363 static int btusb_recv_bulk_intel(struct btusb_data *data, void *buffer,
2364                                  int count)
2365 {
2366         struct hci_dev *hdev = data->hdev;
2367
2368         /* When the device is in bootloader mode, then it can send
2369          * events via the bulk endpoint. These events are treated the
2370          * same way as the ones received from the interrupt endpoint.
2371          */
2372         if (btintel_test_flag(hdev, INTEL_BOOTLOADER))
2373                 return btusb_recv_intr(data, buffer, count);
2374
2375         return btusb_recv_bulk(data, buffer, count);
2376 }
2377
2378 static int btusb_recv_event_intel(struct hci_dev *hdev, struct sk_buff *skb)
2379 {
2380         if (btintel_test_flag(hdev, INTEL_BOOTLOADER)) {
2381                 struct hci_event_hdr *hdr = (void *)skb->data;
2382
2383                 if (skb->len > HCI_EVENT_HDR_SIZE && hdr->evt == 0xff &&
2384                     hdr->plen > 0) {
2385                         const void *ptr = skb->data + HCI_EVENT_HDR_SIZE + 1;
2386                         unsigned int len = skb->len - HCI_EVENT_HDR_SIZE - 1;
2387
2388                         switch (skb->data[2]) {
2389                         case 0x02:
2390                                 /* When switching to the operational firmware
2391                                  * the device sends a vendor specific event
2392                                  * indicating that the bootup completed.
2393                                  */
2394                                 btintel_bootup(hdev, ptr, len);
2395                                 break;
2396                         case 0x06:
2397                                 /* When the firmware loading completes the
2398                                  * device sends out a vendor specific event
2399                                  * indicating the result of the firmware
2400                                  * loading.
2401                                  */
2402                                 btintel_secure_send_result(hdev, ptr, len);
2403                                 break;
2404                         }
2405                 }
2406         }
2407
2408         return hci_recv_frame(hdev, skb);
2409 }
2410
2411 static int btusb_send_frame_intel(struct hci_dev *hdev, struct sk_buff *skb)
2412 {
2413         struct urb *urb;
2414
2415         BT_DBG("%s", hdev->name);
2416
2417         switch (hci_skb_pkt_type(skb)) {
2418         case HCI_COMMAND_PKT:
2419                 if (btintel_test_flag(hdev, INTEL_BOOTLOADER)) {
2420                         struct hci_command_hdr *cmd = (void *)skb->data;
2421                         __u16 opcode = le16_to_cpu(cmd->opcode);
2422
2423                         /* When in bootloader mode and the command 0xfc09
2424                          * is received, it needs to be send down the
2425                          * bulk endpoint. So allocate a bulk URB instead.
2426                          */
2427                         if (opcode == 0xfc09)
2428                                 urb = alloc_bulk_urb(hdev, skb);
2429                         else
2430                                 urb = alloc_ctrl_urb(hdev, skb);
2431
2432                         /* When the 0xfc01 command is issued to boot into
2433                          * the operational firmware, it will actually not
2434                          * send a command complete event. To keep the flow
2435                          * control working inject that event here.
2436                          */
2437                         if (opcode == 0xfc01)
2438                                 inject_cmd_complete(hdev, opcode);
2439                 } else {
2440                         urb = alloc_ctrl_urb(hdev, skb);
2441                 }
2442                 if (IS_ERR(urb))
2443                         return PTR_ERR(urb);
2444
2445                 hdev->stat.cmd_tx++;
2446                 return submit_or_queue_tx_urb(hdev, urb);
2447
2448         case HCI_ACLDATA_PKT:
2449                 urb = alloc_bulk_urb(hdev, skb);
2450                 if (IS_ERR(urb))
2451                         return PTR_ERR(urb);
2452
2453                 hdev->stat.acl_tx++;
2454                 return submit_or_queue_tx_urb(hdev, urb);
2455
2456         case HCI_SCODATA_PKT:
2457                 if (hci_conn_num(hdev, SCO_LINK) < 1)
2458                         return -ENODEV;
2459
2460                 urb = alloc_isoc_urb(hdev, skb);
2461                 if (IS_ERR(urb))
2462                         return PTR_ERR(urb);
2463
2464                 hdev->stat.sco_tx++;
2465                 return submit_tx_urb(hdev, urb);
2466
2467         case HCI_ISODATA_PKT:
2468                 urb = alloc_bulk_urb(hdev, skb);
2469                 if (IS_ERR(urb))
2470                         return PTR_ERR(urb);
2471
2472                 return submit_or_queue_tx_urb(hdev, urb);
2473         }
2474
2475         return -EILSEQ;
2476 }
2477
2478 static int btusb_setup_realtek(struct hci_dev *hdev)
2479 {
2480         struct btusb_data *data = hci_get_drvdata(hdev);
2481         int ret;
2482
2483         ret = btrtl_setup_realtek(hdev);
2484
2485         if (btrealtek_test_flag(data->hdev, REALTEK_ALT6_CONTINUOUS_TX_CHIP))
2486                 set_bit(BTUSB_ALT6_CONTINUOUS_TX, &data->flags);
2487
2488         return ret;
2489 }
2490
2491 /* UHW CR mapping */
2492 #define MTK_BT_MISC             0x70002510
2493 #define MTK_BT_SUBSYS_RST       0x70002610
2494 #define MTK_UDMA_INT_STA_BT     0x74000024
2495 #define MTK_UDMA_INT_STA_BT1    0x74000308
2496 #define MTK_BT_WDT_STATUS       0x740003A0
2497 #define MTK_EP_RST_OPT          0x74011890
2498 #define MTK_EP_RST_IN_OUT_OPT   0x00010001
2499 #define MTK_BT_RST_DONE         0x00000100
2500 #define MTK_BT_RESET_WAIT_MS    100
2501 #define MTK_BT_RESET_NUM_TRIES  10
2502
2503 static void btusb_mtk_wmt_recv(struct urb *urb)
2504 {
2505         struct hci_dev *hdev = urb->context;
2506         struct btusb_data *data = hci_get_drvdata(hdev);
2507         struct sk_buff *skb;
2508         int err;
2509
2510         if (urb->status == 0 && urb->actual_length > 0) {
2511                 hdev->stat.byte_rx += urb->actual_length;
2512
2513                 /* WMT event shouldn't be fragmented and the size should be
2514                  * less than HCI_WMT_MAX_EVENT_SIZE.
2515                  */
2516                 skb = bt_skb_alloc(HCI_WMT_MAX_EVENT_SIZE, GFP_ATOMIC);
2517                 if (!skb) {
2518                         hdev->stat.err_rx++;
2519                         kfree(urb->setup_packet);
2520                         return;
2521                 }
2522
2523                 hci_skb_pkt_type(skb) = HCI_EVENT_PKT;
2524                 skb_put_data(skb, urb->transfer_buffer, urb->actual_length);
2525
2526                 /* When someone waits for the WMT event, the skb is being cloned
2527                  * and being processed the events from there then.
2528                  */
2529                 if (test_bit(BTUSB_TX_WAIT_VND_EVT, &data->flags)) {
2530                         data->evt_skb = skb_clone(skb, GFP_ATOMIC);
2531                         if (!data->evt_skb) {
2532                                 kfree_skb(skb);
2533                                 kfree(urb->setup_packet);
2534                                 return;
2535                         }
2536                 }
2537
2538                 err = hci_recv_frame(hdev, skb);
2539                 if (err < 0) {
2540                         kfree_skb(data->evt_skb);
2541                         data->evt_skb = NULL;
2542                         kfree(urb->setup_packet);
2543                         return;
2544                 }
2545
2546                 if (test_and_clear_bit(BTUSB_TX_WAIT_VND_EVT,
2547                                        &data->flags)) {
2548                         /* Barrier to sync with other CPUs */
2549                         smp_mb__after_atomic();
2550                         wake_up_bit(&data->flags,
2551                                     BTUSB_TX_WAIT_VND_EVT);
2552                 }
2553                 kfree(urb->setup_packet);
2554                 return;
2555         } else if (urb->status == -ENOENT) {
2556                 /* Avoid suspend failed when usb_kill_urb */
2557                 return;
2558         }
2559
2560         usb_mark_last_busy(data->udev);
2561
2562         /* The URB complete handler is still called with urb->actual_length = 0
2563          * when the event is not available, so we should keep re-submitting
2564          * URB until WMT event returns, Also, It's necessary to wait some time
2565          * between the two consecutive control URBs to relax the target device
2566          * to generate the event. Otherwise, the WMT event cannot return from
2567          * the device successfully.
2568          */
2569         udelay(500);
2570
2571         usb_anchor_urb(urb, &data->ctrl_anchor);
2572         err = usb_submit_urb(urb, GFP_ATOMIC);
2573         if (err < 0) {
2574                 kfree(urb->setup_packet);
2575                 /* -EPERM: urb is being killed;
2576                  * -ENODEV: device got disconnected
2577                  */
2578                 if (err != -EPERM && err != -ENODEV)
2579                         bt_dev_err(hdev, "urb %p failed to resubmit (%d)",
2580                                    urb, -err);
2581                 usb_unanchor_urb(urb);
2582         }
2583 }
2584
2585 static int btusb_mtk_submit_wmt_recv_urb(struct hci_dev *hdev)
2586 {
2587         struct btusb_data *data = hci_get_drvdata(hdev);
2588         struct usb_ctrlrequest *dr;
2589         unsigned char *buf;
2590         int err, size = 64;
2591         unsigned int pipe;
2592         struct urb *urb;
2593
2594         urb = usb_alloc_urb(0, GFP_KERNEL);
2595         if (!urb)
2596                 return -ENOMEM;
2597
2598         dr = kmalloc(sizeof(*dr), GFP_KERNEL);
2599         if (!dr) {
2600                 usb_free_urb(urb);
2601                 return -ENOMEM;
2602         }
2603
2604         dr->bRequestType = USB_TYPE_VENDOR | USB_DIR_IN;
2605         dr->bRequest     = 1;
2606         dr->wIndex       = cpu_to_le16(0);
2607         dr->wValue       = cpu_to_le16(48);
2608         dr->wLength      = cpu_to_le16(size);
2609
2610         buf = kmalloc(size, GFP_KERNEL);
2611         if (!buf) {
2612                 kfree(dr);
2613                 usb_free_urb(urb);
2614                 return -ENOMEM;
2615         }
2616
2617         pipe = usb_rcvctrlpipe(data->udev, 0);
2618
2619         usb_fill_control_urb(urb, data->udev, pipe, (void *)dr,
2620                              buf, size, btusb_mtk_wmt_recv, hdev);
2621
2622         urb->transfer_flags |= URB_FREE_BUFFER;
2623
2624         usb_anchor_urb(urb, &data->ctrl_anchor);
2625         err = usb_submit_urb(urb, GFP_KERNEL);
2626         if (err < 0) {
2627                 if (err != -EPERM && err != -ENODEV)
2628                         bt_dev_err(hdev, "urb %p submission failed (%d)",
2629                                    urb, -err);
2630                 usb_unanchor_urb(urb);
2631         }
2632
2633         usb_free_urb(urb);
2634
2635         return err;
2636 }
2637
2638 static int btusb_mtk_hci_wmt_sync(struct hci_dev *hdev,
2639                                   struct btmtk_hci_wmt_params *wmt_params)
2640 {
2641         struct btusb_data *data = hci_get_drvdata(hdev);
2642         struct btmtk_hci_wmt_evt_funcc *wmt_evt_funcc;
2643         u32 hlen, status = BTMTK_WMT_INVALID;
2644         struct btmtk_hci_wmt_evt *wmt_evt;
2645         struct btmtk_hci_wmt_cmd *wc;
2646         struct btmtk_wmt_hdr *hdr;
2647         int err;
2648
2649         /* Send the WMT command and wait until the WMT event returns */
2650         hlen = sizeof(*hdr) + wmt_params->dlen;
2651         if (hlen > 255)
2652                 return -EINVAL;
2653
2654         wc = kzalloc(hlen, GFP_KERNEL);
2655         if (!wc)
2656                 return -ENOMEM;
2657
2658         hdr = &wc->hdr;
2659         hdr->dir = 1;
2660         hdr->op = wmt_params->op;
2661         hdr->dlen = cpu_to_le16(wmt_params->dlen + 1);
2662         hdr->flag = wmt_params->flag;
2663         memcpy(wc->data, wmt_params->data, wmt_params->dlen);
2664
2665         set_bit(BTUSB_TX_WAIT_VND_EVT, &data->flags);
2666
2667         /* WMT cmd/event doesn't follow up the generic HCI cmd/event handling,
2668          * it needs constantly polling control pipe until the host received the
2669          * WMT event, thus, we should require to specifically acquire PM counter
2670          * on the USB to prevent the interface from entering auto suspended
2671          * while WMT cmd/event in progress.
2672          */
2673         err = usb_autopm_get_interface(data->intf);
2674         if (err < 0)
2675                 goto err_free_wc;
2676
2677         err = __hci_cmd_send(hdev, 0xfc6f, hlen, wc);
2678
2679         if (err < 0) {
2680                 clear_bit(BTUSB_TX_WAIT_VND_EVT, &data->flags);
2681                 usb_autopm_put_interface(data->intf);
2682                 goto err_free_wc;
2683         }
2684
2685         /* Submit control IN URB on demand to process the WMT event */
2686         err = btusb_mtk_submit_wmt_recv_urb(hdev);
2687
2688         usb_autopm_put_interface(data->intf);
2689
2690         if (err < 0)
2691                 goto err_free_wc;
2692
2693         /* The vendor specific WMT commands are all answered by a vendor
2694          * specific event and will have the Command Status or Command
2695          * Complete as with usual HCI command flow control.
2696          *
2697          * After sending the command, wait for BTUSB_TX_WAIT_VND_EVT
2698          * state to be cleared. The driver specific event receive routine
2699          * will clear that state and with that indicate completion of the
2700          * WMT command.
2701          */
2702         err = wait_on_bit_timeout(&data->flags, BTUSB_TX_WAIT_VND_EVT,
2703                                   TASK_INTERRUPTIBLE, HCI_INIT_TIMEOUT);
2704         if (err == -EINTR) {
2705                 bt_dev_err(hdev, "Execution of wmt command interrupted");
2706                 clear_bit(BTUSB_TX_WAIT_VND_EVT, &data->flags);
2707                 goto err_free_wc;
2708         }
2709
2710         if (err) {
2711                 bt_dev_err(hdev, "Execution of wmt command timed out");
2712                 clear_bit(BTUSB_TX_WAIT_VND_EVT, &data->flags);
2713                 err = -ETIMEDOUT;
2714                 goto err_free_wc;
2715         }
2716
2717         /* Parse and handle the return WMT event */
2718         wmt_evt = (struct btmtk_hci_wmt_evt *)data->evt_skb->data;
2719         if (wmt_evt->whdr.op != hdr->op) {
2720                 bt_dev_err(hdev, "Wrong op received %d expected %d",
2721                            wmt_evt->whdr.op, hdr->op);
2722                 err = -EIO;
2723                 goto err_free_skb;
2724         }
2725
2726         switch (wmt_evt->whdr.op) {
2727         case BTMTK_WMT_SEMAPHORE:
2728                 if (wmt_evt->whdr.flag == 2)
2729                         status = BTMTK_WMT_PATCH_UNDONE;
2730                 else
2731                         status = BTMTK_WMT_PATCH_DONE;
2732                 break;
2733         case BTMTK_WMT_FUNC_CTRL:
2734                 wmt_evt_funcc = (struct btmtk_hci_wmt_evt_funcc *)wmt_evt;
2735                 if (be16_to_cpu(wmt_evt_funcc->status) == 0x404)
2736                         status = BTMTK_WMT_ON_DONE;
2737                 else if (be16_to_cpu(wmt_evt_funcc->status) == 0x420)
2738                         status = BTMTK_WMT_ON_PROGRESS;
2739                 else
2740                         status = BTMTK_WMT_ON_UNDONE;
2741                 break;
2742         case BTMTK_WMT_PATCH_DWNLD:
2743                 if (wmt_evt->whdr.flag == 2)
2744                         status = BTMTK_WMT_PATCH_DONE;
2745                 else if (wmt_evt->whdr.flag == 1)
2746                         status = BTMTK_WMT_PATCH_PROGRESS;
2747                 else
2748                         status = BTMTK_WMT_PATCH_UNDONE;
2749                 break;
2750         }
2751
2752         if (wmt_params->status)
2753                 *wmt_params->status = status;
2754
2755 err_free_skb:
2756         kfree_skb(data->evt_skb);
2757         data->evt_skb = NULL;
2758 err_free_wc:
2759         kfree(wc);
2760         return err;
2761 }
2762
2763 static int btusb_mtk_func_query(struct hci_dev *hdev)
2764 {
2765         struct btmtk_hci_wmt_params wmt_params;
2766         int status, err;
2767         u8 param = 0;
2768
2769         /* Query whether the function is enabled */
2770         wmt_params.op = BTMTK_WMT_FUNC_CTRL;
2771         wmt_params.flag = 4;
2772         wmt_params.dlen = sizeof(param);
2773         wmt_params.data = &param;
2774         wmt_params.status = &status;
2775
2776         err = btusb_mtk_hci_wmt_sync(hdev, &wmt_params);
2777         if (err < 0) {
2778                 bt_dev_err(hdev, "Failed to query function status (%d)", err);
2779                 return err;
2780         }
2781
2782         return status;
2783 }
2784
2785 static int btusb_mtk_uhw_reg_write(struct btusb_data *data, u32 reg, u32 val)
2786 {
2787         struct hci_dev *hdev = data->hdev;
2788         int pipe, err;
2789         void *buf;
2790
2791         buf = kzalloc(4, GFP_KERNEL);
2792         if (!buf)
2793                 return -ENOMEM;
2794
2795         put_unaligned_le32(val, buf);
2796
2797         pipe = usb_sndctrlpipe(data->udev, 0);
2798         err = usb_control_msg(data->udev, pipe, 0x02,
2799                               0x5E,
2800                               reg >> 16, reg & 0xffff,
2801                               buf, 4, USB_CTRL_SET_TIMEOUT);
2802         if (err < 0) {
2803                 bt_dev_err(hdev, "Failed to write uhw reg(%d)", err);
2804                 goto err_free_buf;
2805         }
2806
2807 err_free_buf:
2808         kfree(buf);
2809
2810         return err;
2811 }
2812
2813 static int btusb_mtk_uhw_reg_read(struct btusb_data *data, u32 reg, u32 *val)
2814 {
2815         struct hci_dev *hdev = data->hdev;
2816         int pipe, err;
2817         void *buf;
2818
2819         buf = kzalloc(4, GFP_KERNEL);
2820         if (!buf)
2821                 return -ENOMEM;
2822
2823         pipe = usb_rcvctrlpipe(data->udev, 0);
2824         err = usb_control_msg(data->udev, pipe, 0x01,
2825                               0xDE,
2826                               reg >> 16, reg & 0xffff,
2827                               buf, 4, USB_CTRL_SET_TIMEOUT);
2828         if (err < 0) {
2829                 bt_dev_err(hdev, "Failed to read uhw reg(%d)", err);
2830                 goto err_free_buf;
2831         }
2832
2833         *val = get_unaligned_le32(buf);
2834         bt_dev_dbg(hdev, "reg=%x, value=0x%08x", reg, *val);
2835
2836 err_free_buf:
2837         kfree(buf);
2838
2839         return err;
2840 }
2841
2842 static int btusb_mtk_reg_read(struct btusb_data *data, u32 reg, u32 *val)
2843 {
2844         int pipe, err, size = sizeof(u32);
2845         void *buf;
2846
2847         buf = kzalloc(size, GFP_KERNEL);
2848         if (!buf)
2849                 return -ENOMEM;
2850
2851         pipe = usb_rcvctrlpipe(data->udev, 0);
2852         err = usb_control_msg(data->udev, pipe, 0x63,
2853                               USB_TYPE_VENDOR | USB_DIR_IN,
2854                               reg >> 16, reg & 0xffff,
2855                               buf, size, USB_CTRL_SET_TIMEOUT);
2856         if (err < 0)
2857                 goto err_free_buf;
2858
2859         *val = get_unaligned_le32(buf);
2860
2861 err_free_buf:
2862         kfree(buf);
2863
2864         return err;
2865 }
2866
2867 static int btusb_mtk_id_get(struct btusb_data *data, u32 reg, u32 *id)
2868 {
2869         return btusb_mtk_reg_read(data, reg, id);
2870 }
2871
2872 static int btusb_mtk_setup(struct hci_dev *hdev)
2873 {
2874         struct btusb_data *data = hci_get_drvdata(hdev);
2875         struct btmtk_hci_wmt_params wmt_params;
2876         ktime_t calltime, delta, rettime;
2877         struct btmtk_tci_sleep tci_sleep;
2878         unsigned long long duration;
2879         struct sk_buff *skb;
2880         const char *fwname;
2881         int err, status;
2882         u32 dev_id;
2883         char fw_bin_name[64];
2884         u32 fw_version = 0;
2885         u8 param;
2886
2887         calltime = ktime_get();
2888
2889         err = btusb_mtk_id_get(data, 0x80000008, &dev_id);
2890         if (err < 0) {
2891                 bt_dev_err(hdev, "Failed to get device id (%d)", err);
2892                 return err;
2893         }
2894
2895         if (!dev_id) {
2896                 err = btusb_mtk_id_get(data, 0x70010200, &dev_id);
2897                 if (err < 0) {
2898                         bt_dev_err(hdev, "Failed to get device id (%d)", err);
2899                         return err;
2900                 }
2901                 err = btusb_mtk_id_get(data, 0x80021004, &fw_version);
2902                 if (err < 0) {
2903                         bt_dev_err(hdev, "Failed to get fw version (%d)", err);
2904                         return err;
2905                 }
2906         }
2907
2908         switch (dev_id) {
2909         case 0x7663:
2910                 fwname = FIRMWARE_MT7663;
2911                 break;
2912         case 0x7668:
2913                 fwname = FIRMWARE_MT7668;
2914                 break;
2915         case 0x7922:
2916         case 0x7961:
2917                 snprintf(fw_bin_name, sizeof(fw_bin_name),
2918                         "mediatek/BT_RAM_CODE_MT%04x_1_%x_hdr.bin",
2919                          dev_id & 0xffff, (fw_version & 0xff) + 1);
2920                 err = btmtk_setup_firmware_79xx(hdev, fw_bin_name,
2921                                                 btusb_mtk_hci_wmt_sync);
2922                 if (err < 0) {
2923                         bt_dev_err(hdev, "Failed to set up firmware (%d)", err);
2924                         return err;
2925                 }
2926
2927                 /* It's Device EndPoint Reset Option Register */
2928                 btusb_mtk_uhw_reg_write(data, MTK_EP_RST_OPT, MTK_EP_RST_IN_OUT_OPT);
2929
2930                 /* Enable Bluetooth protocol */
2931                 param = 1;
2932                 wmt_params.op = BTMTK_WMT_FUNC_CTRL;
2933                 wmt_params.flag = 0;
2934                 wmt_params.dlen = sizeof(param);
2935                 wmt_params.data = &param;
2936                 wmt_params.status = NULL;
2937
2938                 err = btusb_mtk_hci_wmt_sync(hdev, &wmt_params);
2939                 if (err < 0) {
2940                         bt_dev_err(hdev, "Failed to send wmt func ctrl (%d)", err);
2941                         return err;
2942                 }
2943
2944                 hci_set_msft_opcode(hdev, 0xFD30);
2945                 hci_set_aosp_capable(hdev);
2946                 goto done;
2947         default:
2948                 bt_dev_err(hdev, "Unsupported hardware variant (%08x)",
2949                            dev_id);
2950                 return -ENODEV;
2951         }
2952
2953         /* Query whether the firmware is already download */
2954         wmt_params.op = BTMTK_WMT_SEMAPHORE;
2955         wmt_params.flag = 1;
2956         wmt_params.dlen = 0;
2957         wmt_params.data = NULL;
2958         wmt_params.status = &status;
2959
2960         err = btusb_mtk_hci_wmt_sync(hdev, &wmt_params);
2961         if (err < 0) {
2962                 bt_dev_err(hdev, "Failed to query firmware status (%d)", err);
2963                 return err;
2964         }
2965
2966         if (status == BTMTK_WMT_PATCH_DONE) {
2967                 bt_dev_info(hdev, "firmware already downloaded");
2968                 goto ignore_setup_fw;
2969         }
2970
2971         /* Setup a firmware which the device definitely requires */
2972         err = btmtk_setup_firmware(hdev, fwname,
2973                                    btusb_mtk_hci_wmt_sync);
2974         if (err < 0)
2975                 return err;
2976
2977 ignore_setup_fw:
2978         err = readx_poll_timeout(btusb_mtk_func_query, hdev, status,
2979                                  status < 0 || status != BTMTK_WMT_ON_PROGRESS,
2980                                  2000, 5000000);
2981         /* -ETIMEDOUT happens */
2982         if (err < 0)
2983                 return err;
2984
2985         /* The other errors happen in btusb_mtk_func_query */
2986         if (status < 0)
2987                 return status;
2988
2989         if (status == BTMTK_WMT_ON_DONE) {
2990                 bt_dev_info(hdev, "function already on");
2991                 goto ignore_func_on;
2992         }
2993
2994         /* Enable Bluetooth protocol */
2995         param = 1;
2996         wmt_params.op = BTMTK_WMT_FUNC_CTRL;
2997         wmt_params.flag = 0;
2998         wmt_params.dlen = sizeof(param);
2999         wmt_params.data = &param;
3000         wmt_params.status = NULL;
3001
3002         err = btusb_mtk_hci_wmt_sync(hdev, &wmt_params);
3003         if (err < 0) {
3004                 bt_dev_err(hdev, "Failed to send wmt func ctrl (%d)", err);
3005                 return err;
3006         }
3007
3008 ignore_func_on:
3009         /* Apply the low power environment setup */
3010         tci_sleep.mode = 0x5;
3011         tci_sleep.duration = cpu_to_le16(0x640);
3012         tci_sleep.host_duration = cpu_to_le16(0x640);
3013         tci_sleep.host_wakeup_pin = 0;
3014         tci_sleep.time_compensation = 0;
3015
3016         skb = __hci_cmd_sync(hdev, 0xfc7a, sizeof(tci_sleep), &tci_sleep,
3017                              HCI_INIT_TIMEOUT);
3018         if (IS_ERR(skb)) {
3019                 err = PTR_ERR(skb);
3020                 bt_dev_err(hdev, "Failed to apply low power setting (%d)", err);
3021                 return err;
3022         }
3023         kfree_skb(skb);
3024
3025 done:
3026         rettime = ktime_get();
3027         delta = ktime_sub(rettime, calltime);
3028         duration = (unsigned long long)ktime_to_ns(delta) >> 10;
3029
3030         bt_dev_info(hdev, "Device setup in %llu usecs", duration);
3031
3032         return 0;
3033 }
3034
3035 static int btusb_mtk_shutdown(struct hci_dev *hdev)
3036 {
3037         struct btmtk_hci_wmt_params wmt_params;
3038         u8 param = 0;
3039         int err;
3040
3041         /* Disable the device */
3042         wmt_params.op = BTMTK_WMT_FUNC_CTRL;
3043         wmt_params.flag = 0;
3044         wmt_params.dlen = sizeof(param);
3045         wmt_params.data = &param;
3046         wmt_params.status = NULL;
3047
3048         err = btusb_mtk_hci_wmt_sync(hdev, &wmt_params);
3049         if (err < 0) {
3050                 bt_dev_err(hdev, "Failed to send wmt func ctrl (%d)", err);
3051                 return err;
3052         }
3053
3054         return 0;
3055 }
3056
3057 static void btusb_mtk_cmd_timeout(struct hci_dev *hdev)
3058 {
3059         struct btusb_data *data = hci_get_drvdata(hdev);
3060         u32 val;
3061         int err, retry = 0;
3062
3063         /* It's MediaTek specific bluetooth reset mechanism via USB */
3064         if (test_and_set_bit(BTUSB_HW_RESET_ACTIVE, &data->flags)) {
3065                 bt_dev_err(hdev, "last reset failed? Not resetting again");
3066                 return;
3067         }
3068
3069         err = usb_autopm_get_interface(data->intf);
3070         if (err < 0)
3071                 return;
3072
3073         btusb_stop_traffic(data);
3074         usb_kill_anchored_urbs(&data->tx_anchor);
3075
3076         /* It's Device EndPoint Reset Option Register */
3077         bt_dev_dbg(hdev, "Initiating reset mechanism via uhw");
3078         btusb_mtk_uhw_reg_write(data, MTK_EP_RST_OPT, MTK_EP_RST_IN_OUT_OPT);
3079         btusb_mtk_uhw_reg_read(data, MTK_BT_WDT_STATUS, &val);
3080
3081         /* Reset the bluetooth chip via USB interface. */
3082         btusb_mtk_uhw_reg_write(data, MTK_BT_SUBSYS_RST, 1);
3083         btusb_mtk_uhw_reg_write(data, MTK_UDMA_INT_STA_BT, 0x000000FF);
3084         btusb_mtk_uhw_reg_read(data, MTK_UDMA_INT_STA_BT, &val);
3085         btusb_mtk_uhw_reg_write(data, MTK_UDMA_INT_STA_BT1, 0x000000FF);
3086         btusb_mtk_uhw_reg_read(data, MTK_UDMA_INT_STA_BT1, &val);
3087         /* MT7921 need to delay 20ms between toggle reset bit */
3088         msleep(20);
3089         btusb_mtk_uhw_reg_write(data, MTK_BT_SUBSYS_RST, 0);
3090         btusb_mtk_uhw_reg_read(data, MTK_BT_SUBSYS_RST, &val);
3091
3092         /* Poll the register until reset is completed */
3093         do {
3094                 btusb_mtk_uhw_reg_read(data, MTK_BT_MISC, &val);
3095                 if (val & MTK_BT_RST_DONE) {
3096                         bt_dev_dbg(hdev, "Bluetooth Reset Successfully");
3097                         break;
3098                 }
3099
3100                 bt_dev_dbg(hdev, "Polling Bluetooth Reset CR");
3101                 retry++;
3102                 msleep(MTK_BT_RESET_WAIT_MS);
3103         } while (retry < MTK_BT_RESET_NUM_TRIES);
3104
3105         btusb_mtk_id_get(data, 0x70010200, &val);
3106         if (!val)
3107                 bt_dev_err(hdev, "Can't get device id, subsys reset fail.");
3108
3109         usb_queue_reset_device(data->intf);
3110
3111         clear_bit(BTUSB_HW_RESET_ACTIVE, &data->flags);
3112 }
3113
3114 static int btusb_recv_acl_mtk(struct hci_dev *hdev, struct sk_buff *skb)
3115 {
3116         struct btusb_data *data = hci_get_drvdata(hdev);
3117         u16 handle = le16_to_cpu(hci_acl_hdr(skb)->handle);
3118
3119         switch (handle) {
3120         case 0xfc6f:            /* Firmware dump from device */
3121                 /* When the firmware hangs, the device can no longer
3122                  * suspend and thus disable auto-suspend.
3123                  */
3124                 usb_disable_autosuspend(data->udev);
3125                 fallthrough;
3126         case 0x05ff:            /* Firmware debug logging 1 */
3127         case 0x05fe:            /* Firmware debug logging 2 */
3128                 return hci_recv_diag(hdev, skb);
3129         }
3130
3131         return hci_recv_frame(hdev, skb);
3132 }
3133
3134 #ifdef CONFIG_PM
3135 /* Configure an out-of-band gpio as wake-up pin, if specified in device tree */
3136 static int marvell_config_oob_wake(struct hci_dev *hdev)
3137 {
3138         struct sk_buff *skb;
3139         struct btusb_data *data = hci_get_drvdata(hdev);
3140         struct device *dev = &data->udev->dev;
3141         u16 pin, gap, opcode;
3142         int ret;
3143         u8 cmd[5];
3144
3145         /* Move on if no wakeup pin specified */
3146         if (of_property_read_u16(dev->of_node, "marvell,wakeup-pin", &pin) ||
3147             of_property_read_u16(dev->of_node, "marvell,wakeup-gap-ms", &gap))
3148                 return 0;
3149
3150         /* Vendor specific command to configure a GPIO as wake-up pin */
3151         opcode = hci_opcode_pack(0x3F, 0x59);
3152         cmd[0] = opcode & 0xFF;
3153         cmd[1] = opcode >> 8;
3154         cmd[2] = 2; /* length of parameters that follow */
3155         cmd[3] = pin;
3156         cmd[4] = gap; /* time in ms, for which wakeup pin should be asserted */
3157
3158         skb = bt_skb_alloc(sizeof(cmd), GFP_KERNEL);
3159         if (!skb) {
3160                 bt_dev_err(hdev, "%s: No memory", __func__);
3161                 return -ENOMEM;
3162         }
3163
3164         skb_put_data(skb, cmd, sizeof(cmd));
3165         hci_skb_pkt_type(skb) = HCI_COMMAND_PKT;
3166
3167         ret = btusb_send_frame(hdev, skb);
3168         if (ret) {
3169                 bt_dev_err(hdev, "%s: configuration failed", __func__);
3170                 kfree_skb(skb);
3171                 return ret;
3172         }
3173
3174         return 0;
3175 }
3176 #endif
3177
3178 static int btusb_set_bdaddr_marvell(struct hci_dev *hdev,
3179                                     const bdaddr_t *bdaddr)
3180 {
3181         struct sk_buff *skb;
3182         u8 buf[8];
3183         long ret;
3184
3185         buf[0] = 0xfe;
3186         buf[1] = sizeof(bdaddr_t);
3187         memcpy(buf + 2, bdaddr, sizeof(bdaddr_t));
3188
3189         skb = __hci_cmd_sync(hdev, 0xfc22, sizeof(buf), buf, HCI_INIT_TIMEOUT);
3190         if (IS_ERR(skb)) {
3191                 ret = PTR_ERR(skb);
3192                 bt_dev_err(hdev, "changing Marvell device address failed (%ld)",
3193                            ret);
3194                 return ret;
3195         }
3196         kfree_skb(skb);
3197
3198         return 0;
3199 }
3200
3201 static int btusb_set_bdaddr_ath3012(struct hci_dev *hdev,
3202                                     const bdaddr_t *bdaddr)
3203 {
3204         struct sk_buff *skb;
3205         u8 buf[10];
3206         long ret;
3207
3208         buf[0] = 0x01;
3209         buf[1] = 0x01;
3210         buf[2] = 0x00;
3211         buf[3] = sizeof(bdaddr_t);
3212         memcpy(buf + 4, bdaddr, sizeof(bdaddr_t));
3213
3214         skb = __hci_cmd_sync(hdev, 0xfc0b, sizeof(buf), buf, HCI_INIT_TIMEOUT);
3215         if (IS_ERR(skb)) {
3216                 ret = PTR_ERR(skb);
3217                 bt_dev_err(hdev, "Change address command failed (%ld)", ret);
3218                 return ret;
3219         }
3220         kfree_skb(skb);
3221
3222         return 0;
3223 }
3224
3225 static int btusb_set_bdaddr_wcn6855(struct hci_dev *hdev,
3226                                 const bdaddr_t *bdaddr)
3227 {
3228         struct sk_buff *skb;
3229         u8 buf[6];
3230         long ret;
3231
3232         memcpy(buf, bdaddr, sizeof(bdaddr_t));
3233
3234         skb = __hci_cmd_sync_ev(hdev, 0xfc14, sizeof(buf), buf,
3235                                 HCI_EV_CMD_COMPLETE, HCI_INIT_TIMEOUT);
3236         if (IS_ERR(skb)) {
3237                 ret = PTR_ERR(skb);
3238                 bt_dev_err(hdev, "Change address command failed (%ld)", ret);
3239                 return ret;
3240         }
3241         kfree_skb(skb);
3242
3243         return 0;
3244 }
3245
3246 #define QCA_DFU_PACKET_LEN      4096
3247
3248 #define QCA_GET_TARGET_VERSION  0x09
3249 #define QCA_CHECK_STATUS        0x05
3250 #define QCA_DFU_DOWNLOAD        0x01
3251
3252 #define QCA_SYSCFG_UPDATED      0x40
3253 #define QCA_PATCH_UPDATED       0x80
3254 #define QCA_DFU_TIMEOUT         3000
3255 #define QCA_FLAG_MULTI_NVM      0x80
3256 #define QCA_BT_RESET_WAIT_MS    100
3257
3258 #define WCN6855_2_0_RAM_VERSION_GF 0x400c1200
3259 #define WCN6855_2_1_RAM_VERSION_GF 0x400c1211
3260
3261 struct qca_version {
3262         __le32  rom_version;
3263         __le32  patch_version;
3264         __le32  ram_version;
3265         __u8    chip_id;
3266         __u8    platform_id;
3267         __le16  flag;
3268         __u8    reserved[4];
3269 } __packed;
3270
3271 struct qca_rampatch_version {
3272         __le16  rom_version_high;
3273         __le16  rom_version_low;
3274         __le16  patch_version;
3275 } __packed;
3276
3277 struct qca_device_info {
3278         u32     rom_version;
3279         u8      rampatch_hdr;   /* length of header in rampatch */
3280         u8      nvm_hdr;        /* length of header in NVM */
3281         u8      ver_offset;     /* offset of version structure in rampatch */
3282 };
3283
3284 static const struct qca_device_info qca_devices_table[] = {
3285         { 0x00000100, 20, 4,  8 }, /* Rome 1.0 */
3286         { 0x00000101, 20, 4,  8 }, /* Rome 1.1 */
3287         { 0x00000200, 28, 4, 16 }, /* Rome 2.0 */
3288         { 0x00000201, 28, 4, 16 }, /* Rome 2.1 */
3289         { 0x00000300, 28, 4, 16 }, /* Rome 3.0 */
3290         { 0x00000302, 28, 4, 16 }, /* Rome 3.2 */
3291         { 0x00130100, 40, 4, 16 }, /* WCN6855 1.0 */
3292         { 0x00130200, 40, 4, 16 }, /* WCN6855 2.0 */
3293         { 0x00130201, 40, 4, 16 }, /* WCN6855 2.1 */
3294         { 0x00190200, 40, 4, 16 }, /* WCN785x 2.0 */
3295 };
3296
3297 static int btusb_qca_send_vendor_req(struct usb_device *udev, u8 request,
3298                                      void *data, u16 size)
3299 {
3300         int pipe, err;
3301         u8 *buf;
3302
3303         buf = kmalloc(size, GFP_KERNEL);
3304         if (!buf)
3305                 return -ENOMEM;
3306
3307         /* Found some of USB hosts have IOT issues with ours so that we should
3308          * not wait until HCI layer is ready.
3309          */
3310         pipe = usb_rcvctrlpipe(udev, 0);
3311         err = usb_control_msg(udev, pipe, request, USB_TYPE_VENDOR | USB_DIR_IN,
3312                               0, 0, buf, size, USB_CTRL_SET_TIMEOUT);
3313         if (err < 0) {
3314                 dev_err(&udev->dev, "Failed to access otp area (%d)", err);
3315                 goto done;
3316         }
3317
3318         memcpy(data, buf, size);
3319
3320 done:
3321         kfree(buf);
3322
3323         return err;
3324 }
3325
3326 static int btusb_setup_qca_download_fw(struct hci_dev *hdev,
3327                                        const struct firmware *firmware,
3328                                        size_t hdr_size)
3329 {
3330         struct btusb_data *btdata = hci_get_drvdata(hdev);
3331         struct usb_device *udev = btdata->udev;
3332         size_t count, size, sent = 0;
3333         int pipe, len, err;
3334         u8 *buf;
3335
3336         buf = kmalloc(QCA_DFU_PACKET_LEN, GFP_KERNEL);
3337         if (!buf)
3338                 return -ENOMEM;
3339
3340         count = firmware->size;
3341
3342         size = min_t(size_t, count, hdr_size);
3343         memcpy(buf, firmware->data, size);
3344
3345         /* USB patches should go down to controller through USB path
3346          * because binary format fits to go down through USB channel.
3347          * USB control path is for patching headers and USB bulk is for
3348          * patch body.
3349          */
3350         pipe = usb_sndctrlpipe(udev, 0);
3351         err = usb_control_msg(udev, pipe, QCA_DFU_DOWNLOAD, USB_TYPE_VENDOR,
3352                               0, 0, buf, size, USB_CTRL_SET_TIMEOUT);
3353         if (err < 0) {
3354                 bt_dev_err(hdev, "Failed to send headers (%d)", err);
3355                 goto done;
3356         }
3357
3358         sent += size;
3359         count -= size;
3360
3361         /* ep2 need time to switch from function acl to function dfu,
3362          * so we add 20ms delay here.
3363          */
3364         msleep(20);
3365
3366         while (count) {
3367                 size = min_t(size_t, count, QCA_DFU_PACKET_LEN);
3368
3369                 memcpy(buf, firmware->data + sent, size);
3370
3371                 pipe = usb_sndbulkpipe(udev, 0x02);
3372                 err = usb_bulk_msg(udev, pipe, buf, size, &len,
3373                                    QCA_DFU_TIMEOUT);
3374                 if (err < 0) {
3375                         bt_dev_err(hdev, "Failed to send body at %zd of %zd (%d)",
3376                                    sent, firmware->size, err);
3377                         break;
3378                 }
3379
3380                 if (size != len) {
3381                         bt_dev_err(hdev, "Failed to get bulk buffer");
3382                         err = -EILSEQ;
3383                         break;
3384                 }
3385
3386                 sent  += size;
3387                 count -= size;
3388         }
3389
3390 done:
3391         kfree(buf);
3392         return err;
3393 }
3394
3395 static int btusb_setup_qca_load_rampatch(struct hci_dev *hdev,
3396                                          struct qca_version *ver,
3397                                          const struct qca_device_info *info)
3398 {
3399         struct qca_rampatch_version *rver;
3400         const struct firmware *fw;
3401         u32 ver_rom, ver_patch, rver_rom;
3402         u16 rver_rom_low, rver_rom_high, rver_patch;
3403         char fwname[64];
3404         int err;
3405
3406         ver_rom = le32_to_cpu(ver->rom_version);
3407         ver_patch = le32_to_cpu(ver->patch_version);
3408
3409         snprintf(fwname, sizeof(fwname), "qca/rampatch_usb_%08x.bin", ver_rom);
3410
3411         err = request_firmware(&fw, fwname, &hdev->dev);
3412         if (err) {
3413                 bt_dev_err(hdev, "failed to request rampatch file: %s (%d)",
3414                            fwname, err);
3415                 return err;
3416         }
3417
3418         bt_dev_info(hdev, "using rampatch file: %s", fwname);
3419
3420         rver = (struct qca_rampatch_version *)(fw->data + info->ver_offset);
3421         rver_rom_low = le16_to_cpu(rver->rom_version_low);
3422         rver_patch = le16_to_cpu(rver->patch_version);
3423
3424         if (ver_rom & ~0xffffU) {
3425                 rver_rom_high = le16_to_cpu(rver->rom_version_high);
3426                 rver_rom = rver_rom_high << 16 | rver_rom_low;
3427         } else {
3428                 rver_rom = rver_rom_low;
3429         }
3430
3431         bt_dev_info(hdev, "QCA: patch rome 0x%x build 0x%x, "
3432                     "firmware rome 0x%x build 0x%x",
3433                     rver_rom, rver_patch, ver_rom, ver_patch);
3434
3435         if (rver_rom != ver_rom || rver_patch <= ver_patch) {
3436                 bt_dev_err(hdev, "rampatch file version did not match with firmware");
3437                 err = -EINVAL;
3438                 goto done;
3439         }
3440
3441         err = btusb_setup_qca_download_fw(hdev, fw, info->rampatch_hdr);
3442
3443 done:
3444         release_firmware(fw);
3445
3446         return err;
3447 }
3448
3449 static void btusb_generate_qca_nvm_name(char *fwname, size_t max_size,
3450                                         const struct qca_version *ver)
3451 {
3452         u32 rom_version = le32_to_cpu(ver->rom_version);
3453         u16 flag = le16_to_cpu(ver->flag);
3454
3455         if (((flag >> 8) & 0xff) == QCA_FLAG_MULTI_NVM) {
3456                 /* The board_id should be split into two bytes
3457                  * The 1st byte is chip ID, and the 2nd byte is platform ID
3458                  * For example, board ID 0x010A, 0x01 is platform ID. 0x0A is chip ID
3459                  * we have several platforms, and platform IDs are continuously added
3460                  * Platform ID:
3461                  * 0x00 is for Mobile
3462                  * 0x01 is for X86
3463                  * 0x02 is for Automotive
3464                  * 0x03 is for Consumer electronic
3465                  */
3466                 u16 board_id = (ver->chip_id << 8) + ver->platform_id;
3467                 const char *variant;
3468
3469                 switch (le32_to_cpu(ver->ram_version)) {
3470                 case WCN6855_2_0_RAM_VERSION_GF:
3471                 case WCN6855_2_1_RAM_VERSION_GF:
3472                         variant = "_gf";
3473                         break;
3474                 default:
3475                         variant = "";
3476                         break;
3477                 }
3478
3479                 if (board_id == 0) {
3480                         snprintf(fwname, max_size, "qca/nvm_usb_%08x%s.bin",
3481                                 rom_version, variant);
3482                 } else {
3483                         snprintf(fwname, max_size, "qca/nvm_usb_%08x%s_%04x.bin",
3484                                 rom_version, variant, board_id);
3485                 }
3486         } else {
3487                 snprintf(fwname, max_size, "qca/nvm_usb_%08x.bin",
3488                         rom_version);
3489         }
3490
3491 }
3492
3493 static int btusb_setup_qca_load_nvm(struct hci_dev *hdev,
3494                                     struct qca_version *ver,
3495                                     const struct qca_device_info *info)
3496 {
3497         const struct firmware *fw;
3498         char fwname[64];
3499         int err;
3500
3501         btusb_generate_qca_nvm_name(fwname, sizeof(fwname), ver);
3502
3503         err = request_firmware(&fw, fwname, &hdev->dev);
3504         if (err) {
3505                 bt_dev_err(hdev, "failed to request NVM file: %s (%d)",
3506                            fwname, err);
3507                 return err;
3508         }
3509
3510         bt_dev_info(hdev, "using NVM file: %s", fwname);
3511
3512         err = btusb_setup_qca_download_fw(hdev, fw, info->nvm_hdr);
3513
3514         release_firmware(fw);
3515
3516         return err;
3517 }
3518
3519 /* identify the ROM version and check whether patches are needed */
3520 static bool btusb_qca_need_patch(struct usb_device *udev)
3521 {
3522         struct qca_version ver;
3523
3524         if (btusb_qca_send_vendor_req(udev, QCA_GET_TARGET_VERSION, &ver,
3525                                       sizeof(ver)) < 0)
3526                 return false;
3527         /* only low ROM versions need patches */
3528         return !(le32_to_cpu(ver.rom_version) & ~0xffffU);
3529 }
3530
3531 static int btusb_setup_qca(struct hci_dev *hdev)
3532 {
3533         struct btusb_data *btdata = hci_get_drvdata(hdev);
3534         struct usb_device *udev = btdata->udev;
3535         const struct qca_device_info *info = NULL;
3536         struct qca_version ver;
3537         u32 ver_rom;
3538         u8 status;
3539         int i, err;
3540
3541         err = btusb_qca_send_vendor_req(udev, QCA_GET_TARGET_VERSION, &ver,
3542                                         sizeof(ver));
3543         if (err < 0)
3544                 return err;
3545
3546         ver_rom = le32_to_cpu(ver.rom_version);
3547
3548         for (i = 0; i < ARRAY_SIZE(qca_devices_table); i++) {
3549                 if (ver_rom == qca_devices_table[i].rom_version)
3550                         info = &qca_devices_table[i];
3551         }
3552         if (!info) {
3553                 /* If the rom_version is not matched in the qca_devices_table
3554                  * and the high ROM version is not zero, we assume this chip no
3555                  * need to load the rampatch and nvm.
3556                  */
3557                 if (ver_rom & ~0xffffU)
3558                         return 0;
3559
3560                 bt_dev_err(hdev, "don't support firmware rome 0x%x", ver_rom);
3561                 return -ENODEV;
3562         }
3563
3564         err = btusb_qca_send_vendor_req(udev, QCA_CHECK_STATUS, &status,
3565                                         sizeof(status));
3566         if (err < 0)
3567                 return err;
3568
3569         if (!(status & QCA_PATCH_UPDATED)) {
3570                 err = btusb_setup_qca_load_rampatch(hdev, &ver, info);
3571                 if (err < 0)
3572                         return err;
3573         }
3574
3575         err = btusb_qca_send_vendor_req(udev, QCA_GET_TARGET_VERSION, &ver,
3576                                         sizeof(ver));
3577         if (err < 0)
3578                 return err;
3579
3580         if (!(status & QCA_SYSCFG_UPDATED)) {
3581                 err = btusb_setup_qca_load_nvm(hdev, &ver, info);
3582                 if (err < 0)
3583                         return err;
3584
3585                 /* WCN6855 2.1 and later will reset to apply firmware downloaded here, so
3586                  * wait ~100ms for reset Done then go ahead, otherwise, it maybe
3587                  * cause potential enable failure.
3588                  */
3589                 if (info->rom_version >= 0x00130201)
3590                         msleep(QCA_BT_RESET_WAIT_MS);
3591         }
3592
3593         /* Mark HCI_OP_ENHANCED_SETUP_SYNC_CONN as broken as it doesn't seem to
3594          * work with the likes of HSP/HFP mSBC.
3595          */
3596         set_bit(HCI_QUIRK_BROKEN_ENHANCED_SETUP_SYNC_CONN, &hdev->quirks);
3597
3598         return 0;
3599 }
3600
3601 static inline int __set_diag_interface(struct hci_dev *hdev)
3602 {
3603         struct btusb_data *data = hci_get_drvdata(hdev);
3604         struct usb_interface *intf = data->diag;
3605         int i;
3606
3607         if (!data->diag)
3608                 return -ENODEV;
3609
3610         data->diag_tx_ep = NULL;
3611         data->diag_rx_ep = NULL;
3612
3613         for (i = 0; i < intf->cur_altsetting->desc.bNumEndpoints; i++) {
3614                 struct usb_endpoint_descriptor *ep_desc;
3615
3616                 ep_desc = &intf->cur_altsetting->endpoint[i].desc;
3617
3618                 if (!data->diag_tx_ep && usb_endpoint_is_bulk_out(ep_desc)) {
3619                         data->diag_tx_ep = ep_desc;
3620                         continue;
3621                 }
3622
3623                 if (!data->diag_rx_ep && usb_endpoint_is_bulk_in(ep_desc)) {
3624                         data->diag_rx_ep = ep_desc;
3625                         continue;
3626                 }
3627         }
3628
3629         if (!data->diag_tx_ep || !data->diag_rx_ep) {
3630                 bt_dev_err(hdev, "invalid diagnostic descriptors");
3631                 return -ENODEV;
3632         }
3633
3634         return 0;
3635 }
3636
3637 static struct urb *alloc_diag_urb(struct hci_dev *hdev, bool enable)
3638 {
3639         struct btusb_data *data = hci_get_drvdata(hdev);
3640         struct sk_buff *skb;
3641         struct urb *urb;
3642         unsigned int pipe;
3643
3644         if (!data->diag_tx_ep)
3645                 return ERR_PTR(-ENODEV);
3646
3647         urb = usb_alloc_urb(0, GFP_KERNEL);
3648         if (!urb)
3649                 return ERR_PTR(-ENOMEM);
3650
3651         skb = bt_skb_alloc(2, GFP_KERNEL);
3652         if (!skb) {
3653                 usb_free_urb(urb);
3654                 return ERR_PTR(-ENOMEM);
3655         }
3656
3657         skb_put_u8(skb, 0xf0);
3658         skb_put_u8(skb, enable);
3659
3660         pipe = usb_sndbulkpipe(data->udev, data->diag_tx_ep->bEndpointAddress);
3661
3662         usb_fill_bulk_urb(urb, data->udev, pipe,
3663                           skb->data, skb->len, btusb_tx_complete, skb);
3664
3665         skb->dev = (void *)hdev;
3666
3667         return urb;
3668 }
3669
3670 static int btusb_bcm_set_diag(struct hci_dev *hdev, bool enable)
3671 {
3672         struct btusb_data *data = hci_get_drvdata(hdev);
3673         struct urb *urb;
3674
3675         if (!data->diag)
3676                 return -ENODEV;
3677
3678         if (!test_bit(HCI_RUNNING, &hdev->flags))
3679                 return -ENETDOWN;
3680
3681         urb = alloc_diag_urb(hdev, enable);
3682         if (IS_ERR(urb))
3683                 return PTR_ERR(urb);
3684
3685         return submit_or_queue_tx_urb(hdev, urb);
3686 }
3687
3688 #ifdef CONFIG_PM
3689 static irqreturn_t btusb_oob_wake_handler(int irq, void *priv)
3690 {
3691         struct btusb_data *data = priv;
3692
3693         pm_wakeup_event(&data->udev->dev, 0);
3694         pm_system_wakeup();
3695
3696         /* Disable only if not already disabled (keep it balanced) */
3697         if (test_and_clear_bit(BTUSB_OOB_WAKE_ENABLED, &data->flags)) {
3698                 disable_irq_nosync(irq);
3699                 disable_irq_wake(irq);
3700         }
3701         return IRQ_HANDLED;
3702 }
3703
3704 static const struct of_device_id btusb_match_table[] = {
3705         { .compatible = "usb1286,204e" },
3706         { .compatible = "usbcf3,e300" }, /* QCA6174A */
3707         { .compatible = "usb4ca,301a" }, /* QCA6174A (Lite-On) */
3708         { }
3709 };
3710 MODULE_DEVICE_TABLE(of, btusb_match_table);
3711
3712 /* Use an oob wakeup pin? */
3713 static int btusb_config_oob_wake(struct hci_dev *hdev)
3714 {
3715         struct btusb_data *data = hci_get_drvdata(hdev);
3716         struct device *dev = &data->udev->dev;
3717         int irq, ret;
3718
3719         clear_bit(BTUSB_OOB_WAKE_ENABLED, &data->flags);
3720
3721         if (!of_match_device(btusb_match_table, dev))
3722                 return 0;
3723
3724         /* Move on if no IRQ specified */
3725         irq = of_irq_get_byname(dev->of_node, "wakeup");
3726         if (irq <= 0) {
3727                 bt_dev_dbg(hdev, "%s: no OOB Wakeup IRQ in DT", __func__);
3728                 return 0;
3729         }
3730
3731         irq_set_status_flags(irq, IRQ_NOAUTOEN);
3732         ret = devm_request_irq(&hdev->dev, irq, btusb_oob_wake_handler,
3733                                0, "OOB Wake-on-BT", data);
3734         if (ret) {
3735                 bt_dev_err(hdev, "%s: IRQ request failed", __func__);
3736                 return ret;
3737         }
3738
3739         ret = device_init_wakeup(dev, true);
3740         if (ret) {
3741                 bt_dev_err(hdev, "%s: failed to init_wakeup", __func__);
3742                 return ret;
3743         }
3744
3745         data->oob_wake_irq = irq;
3746         bt_dev_info(hdev, "OOB Wake-on-BT configured at IRQ %u", irq);
3747         return 0;
3748 }
3749 #endif
3750
3751 static void btusb_check_needs_reset_resume(struct usb_interface *intf)
3752 {
3753         if (dmi_check_system(btusb_needs_reset_resume_table))
3754                 interface_to_usbdev(intf)->quirks |= USB_QUIRK_RESET_RESUME;
3755 }
3756
3757 static bool btusb_wakeup(struct hci_dev *hdev)
3758 {
3759         struct btusb_data *data = hci_get_drvdata(hdev);
3760
3761         return device_may_wakeup(&data->udev->dev);
3762 }
3763
3764 static int btusb_shutdown_qca(struct hci_dev *hdev)
3765 {
3766         struct sk_buff *skb;
3767
3768         skb = __hci_cmd_sync(hdev, HCI_OP_RESET, 0, NULL, HCI_INIT_TIMEOUT);
3769         if (IS_ERR(skb)) {
3770                 bt_dev_err(hdev, "HCI reset during shutdown failed");
3771                 return PTR_ERR(skb);
3772         }
3773         kfree_skb(skb);
3774
3775         return 0;
3776 }
3777
3778 static ssize_t force_poll_sync_read(struct file *file, char __user *user_buf,
3779                                     size_t count, loff_t *ppos)
3780 {
3781         struct btusb_data *data = file->private_data;
3782         char buf[3];
3783
3784         buf[0] = data->poll_sync ? 'Y' : 'N';
3785         buf[1] = '\n';
3786         buf[2] = '\0';
3787         return simple_read_from_buffer(user_buf, count, ppos, buf, 2);
3788 }
3789
3790 static ssize_t force_poll_sync_write(struct file *file,
3791                                      const char __user *user_buf,
3792                                      size_t count, loff_t *ppos)
3793 {
3794         struct btusb_data *data = file->private_data;
3795         bool enable;
3796         int err;
3797
3798         err = kstrtobool_from_user(user_buf, count, &enable);
3799         if (err)
3800                 return err;
3801
3802         /* Only allow changes while the adapter is down */
3803         if (test_bit(HCI_UP, &data->hdev->flags))
3804                 return -EPERM;
3805
3806         if (data->poll_sync == enable)
3807                 return -EALREADY;
3808
3809         data->poll_sync = enable;
3810
3811         return count;
3812 }
3813
3814 static const struct file_operations force_poll_sync_fops = {
3815         .open           = simple_open,
3816         .read           = force_poll_sync_read,
3817         .write          = force_poll_sync_write,
3818         .llseek         = default_llseek,
3819 };
3820
3821 static int btusb_probe(struct usb_interface *intf,
3822                        const struct usb_device_id *id)
3823 {
3824         struct usb_endpoint_descriptor *ep_desc;
3825         struct gpio_desc *reset_gpio;
3826         struct btusb_data *data;
3827         struct hci_dev *hdev;
3828         unsigned ifnum_base;
3829         int i, err, priv_size;
3830
3831         BT_DBG("intf %p id %p", intf, id);
3832
3833         /* interface numbers are hardcoded in the spec */
3834         if (intf->cur_altsetting->desc.bInterfaceNumber != 0) {
3835                 if (!(id->driver_info & BTUSB_IFNUM_2))
3836                         return -ENODEV;
3837                 if (intf->cur_altsetting->desc.bInterfaceNumber != 2)
3838                         return -ENODEV;
3839         }
3840
3841         ifnum_base = intf->cur_altsetting->desc.bInterfaceNumber;
3842
3843         if (!id->driver_info) {
3844                 const struct usb_device_id *match;
3845
3846                 match = usb_match_id(intf, blacklist_table);
3847                 if (match)
3848                         id = match;
3849         }
3850
3851         if (id->driver_info == BTUSB_IGNORE)
3852                 return -ENODEV;
3853
3854         if (id->driver_info & BTUSB_ATH3012) {
3855                 struct usb_device *udev = interface_to_usbdev(intf);
3856
3857                 /* Old firmware would otherwise let ath3k driver load
3858                  * patch and sysconfig files
3859                  */
3860                 if (le16_to_cpu(udev->descriptor.bcdDevice) <= 0x0001 &&
3861                     !btusb_qca_need_patch(udev))
3862                         return -ENODEV;
3863         }
3864
3865         data = devm_kzalloc(&intf->dev, sizeof(*data), GFP_KERNEL);
3866         if (!data)
3867                 return -ENOMEM;
3868
3869         for (i = 0; i < intf->cur_altsetting->desc.bNumEndpoints; i++) {
3870                 ep_desc = &intf->cur_altsetting->endpoint[i].desc;
3871
3872                 if (!data->intr_ep && usb_endpoint_is_int_in(ep_desc)) {
3873                         data->intr_ep = ep_desc;
3874                         continue;
3875                 }
3876
3877                 if (!data->bulk_tx_ep && usb_endpoint_is_bulk_out(ep_desc)) {
3878                         data->bulk_tx_ep = ep_desc;
3879                         continue;
3880                 }
3881
3882                 if (!data->bulk_rx_ep && usb_endpoint_is_bulk_in(ep_desc)) {
3883                         data->bulk_rx_ep = ep_desc;
3884                         continue;
3885                 }
3886         }
3887
3888         if (!data->intr_ep || !data->bulk_tx_ep || !data->bulk_rx_ep)
3889                 return -ENODEV;
3890
3891         if (id->driver_info & BTUSB_AMP) {
3892                 data->cmdreq_type = USB_TYPE_CLASS | 0x01;
3893                 data->cmdreq = 0x2b;
3894         } else {
3895                 data->cmdreq_type = USB_TYPE_CLASS;
3896                 data->cmdreq = 0x00;
3897         }
3898
3899         data->udev = interface_to_usbdev(intf);
3900         data->intf = intf;
3901
3902         INIT_WORK(&data->work, btusb_work);
3903         INIT_WORK(&data->waker, btusb_waker);
3904         INIT_DELAYED_WORK(&data->rx_work, btusb_rx_work);
3905
3906         skb_queue_head_init(&data->acl_q);
3907
3908         init_usb_anchor(&data->deferred);
3909         init_usb_anchor(&data->tx_anchor);
3910         spin_lock_init(&data->txlock);
3911
3912         init_usb_anchor(&data->intr_anchor);
3913         init_usb_anchor(&data->bulk_anchor);
3914         init_usb_anchor(&data->isoc_anchor);
3915         init_usb_anchor(&data->diag_anchor);
3916         init_usb_anchor(&data->ctrl_anchor);
3917         spin_lock_init(&data->rxlock);
3918
3919         priv_size = 0;
3920
3921         data->recv_event = hci_recv_frame;
3922         data->recv_bulk = btusb_recv_bulk;
3923
3924         if (id->driver_info & BTUSB_INTEL_COMBINED) {
3925                 /* Allocate extra space for Intel device */
3926                 priv_size += sizeof(struct btintel_data);
3927
3928                 /* Override the rx handlers */
3929                 data->recv_event = btusb_recv_event_intel;
3930                 data->recv_bulk = btusb_recv_bulk_intel;
3931         } else if (id->driver_info & BTUSB_REALTEK) {
3932                 /* Allocate extra space for Realtek device */
3933                 priv_size += sizeof(struct btrealtek_data);
3934         }
3935
3936         data->recv_acl = hci_recv_frame;
3937
3938         hdev = hci_alloc_dev_priv(priv_size);
3939         if (!hdev)
3940                 return -ENOMEM;
3941
3942         hdev->bus = HCI_USB;
3943         hci_set_drvdata(hdev, data);
3944
3945         if (id->driver_info & BTUSB_AMP)
3946                 hdev->dev_type = HCI_AMP;
3947         else
3948                 hdev->dev_type = HCI_PRIMARY;
3949
3950         data->hdev = hdev;
3951
3952         SET_HCIDEV_DEV(hdev, &intf->dev);
3953
3954         reset_gpio = gpiod_get_optional(&data->udev->dev, "reset",
3955                                         GPIOD_OUT_LOW);
3956         if (IS_ERR(reset_gpio)) {
3957                 err = PTR_ERR(reset_gpio);
3958                 goto out_free_dev;
3959         } else if (reset_gpio) {
3960                 data->reset_gpio = reset_gpio;
3961         }
3962
3963         hdev->open   = btusb_open;
3964         hdev->close  = btusb_close;
3965         hdev->flush  = btusb_flush;
3966         hdev->send   = btusb_send_frame;
3967         hdev->notify = btusb_notify;
3968         hdev->wakeup = btusb_wakeup;
3969
3970 #ifdef CONFIG_PM
3971         err = btusb_config_oob_wake(hdev);
3972         if (err)
3973                 goto out_free_dev;
3974
3975         /* Marvell devices may need a specific chip configuration */
3976         if (id->driver_info & BTUSB_MARVELL && data->oob_wake_irq) {
3977                 err = marvell_config_oob_wake(hdev);
3978                 if (err)
3979                         goto out_free_dev;
3980         }
3981 #endif
3982         if (id->driver_info & BTUSB_CW6622)
3983                 set_bit(HCI_QUIRK_BROKEN_STORED_LINK_KEY, &hdev->quirks);
3984
3985         if (id->driver_info & BTUSB_BCM2045)
3986                 set_bit(HCI_QUIRK_BROKEN_STORED_LINK_KEY, &hdev->quirks);
3987
3988         if (id->driver_info & BTUSB_BCM92035)
3989                 hdev->setup = btusb_setup_bcm92035;
3990
3991         if (IS_ENABLED(CONFIG_BT_HCIBTUSB_BCM) &&
3992             (id->driver_info & BTUSB_BCM_PATCHRAM)) {
3993                 hdev->manufacturer = 15;
3994                 hdev->setup = btbcm_setup_patchram;
3995                 hdev->set_diag = btusb_bcm_set_diag;
3996                 hdev->set_bdaddr = btbcm_set_bdaddr;
3997
3998                 /* Broadcom LM_DIAG Interface numbers are hardcoded */
3999                 data->diag = usb_ifnum_to_if(data->udev, ifnum_base + 2);
4000         }
4001
4002         if (IS_ENABLED(CONFIG_BT_HCIBTUSB_BCM) &&
4003             (id->driver_info & BTUSB_BCM_APPLE)) {
4004                 hdev->manufacturer = 15;
4005                 hdev->setup = btbcm_setup_apple;
4006                 hdev->set_diag = btusb_bcm_set_diag;
4007
4008                 /* Broadcom LM_DIAG Interface numbers are hardcoded */
4009                 data->diag = usb_ifnum_to_if(data->udev, ifnum_base + 2);
4010         }
4011
4012         /* Combined Intel Device setup to support multiple setup routine */
4013         if (id->driver_info & BTUSB_INTEL_COMBINED) {
4014                 err = btintel_configure_setup(hdev);
4015                 if (err)
4016                         goto out_free_dev;
4017
4018                 /* Transport specific configuration */
4019                 hdev->send = btusb_send_frame_intel;
4020                 hdev->cmd_timeout = btusb_intel_cmd_timeout;
4021
4022                 if (id->driver_info & BTUSB_INTEL_NO_WBS_SUPPORT)
4023                         btintel_set_flag(hdev, INTEL_ROM_LEGACY_NO_WBS_SUPPORT);
4024
4025                 if (id->driver_info & BTUSB_INTEL_BROKEN_INITIAL_NCMD)
4026                         btintel_set_flag(hdev, INTEL_BROKEN_INITIAL_NCMD);
4027
4028                 if (id->driver_info & BTUSB_INTEL_BROKEN_SHUTDOWN_LED)
4029                         btintel_set_flag(hdev, INTEL_BROKEN_SHUTDOWN_LED);
4030         }
4031
4032         if (id->driver_info & BTUSB_MARVELL)
4033                 hdev->set_bdaddr = btusb_set_bdaddr_marvell;
4034
4035         if (IS_ENABLED(CONFIG_BT_HCIBTUSB_MTK) &&
4036             (id->driver_info & BTUSB_MEDIATEK)) {
4037                 hdev->setup = btusb_mtk_setup;
4038                 hdev->shutdown = btusb_mtk_shutdown;
4039                 hdev->manufacturer = 70;
4040                 hdev->cmd_timeout = btusb_mtk_cmd_timeout;
4041                 hdev->set_bdaddr = btmtk_set_bdaddr;
4042                 set_bit(HCI_QUIRK_BROKEN_ENHANCED_SETUP_SYNC_CONN, &hdev->quirks);
4043                 set_bit(HCI_QUIRK_NON_PERSISTENT_SETUP, &hdev->quirks);
4044                 data->recv_acl = btusb_recv_acl_mtk;
4045         }
4046
4047         if (id->driver_info & BTUSB_SWAVE) {
4048                 set_bit(HCI_QUIRK_FIXUP_INQUIRY_MODE, &hdev->quirks);
4049                 set_bit(HCI_QUIRK_BROKEN_LOCAL_COMMANDS, &hdev->quirks);
4050         }
4051
4052         if (id->driver_info & BTUSB_INTEL_BOOT) {
4053                 hdev->manufacturer = 2;
4054                 set_bit(HCI_QUIRK_RAW_DEVICE, &hdev->quirks);
4055         }
4056
4057         if (id->driver_info & BTUSB_ATH3012) {
4058                 data->setup_on_usb = btusb_setup_qca;
4059                 hdev->set_bdaddr = btusb_set_bdaddr_ath3012;
4060                 set_bit(HCI_QUIRK_SIMULTANEOUS_DISCOVERY, &hdev->quirks);
4061                 set_bit(HCI_QUIRK_STRICT_DUPLICATE_FILTER, &hdev->quirks);
4062         }
4063
4064         if (id->driver_info & BTUSB_QCA_ROME) {
4065                 data->setup_on_usb = btusb_setup_qca;
4066                 hdev->set_bdaddr = btusb_set_bdaddr_ath3012;
4067                 hdev->cmd_timeout = btusb_qca_cmd_timeout;
4068                 set_bit(HCI_QUIRK_SIMULTANEOUS_DISCOVERY, &hdev->quirks);
4069                 btusb_check_needs_reset_resume(intf);
4070         }
4071
4072         if (id->driver_info & BTUSB_QCA_WCN6855) {
4073                 data->setup_on_usb = btusb_setup_qca;
4074                 hdev->shutdown = btusb_shutdown_qca;
4075                 hdev->set_bdaddr = btusb_set_bdaddr_wcn6855;
4076                 hdev->cmd_timeout = btusb_qca_cmd_timeout;
4077                 set_bit(HCI_QUIRK_SIMULTANEOUS_DISCOVERY, &hdev->quirks);
4078                 hci_set_msft_opcode(hdev, 0xFD70);
4079         }
4080
4081         if (id->driver_info & BTUSB_AMP) {
4082                 /* AMP controllers do not support SCO packets */
4083                 data->isoc = NULL;
4084         } else {
4085                 /* Interface orders are hardcoded in the specification */
4086                 data->isoc = usb_ifnum_to_if(data->udev, ifnum_base + 1);
4087                 data->isoc_ifnum = ifnum_base + 1;
4088         }
4089
4090         if (IS_ENABLED(CONFIG_BT_HCIBTUSB_RTL) &&
4091             (id->driver_info & BTUSB_REALTEK)) {
4092                 hdev->setup = btusb_setup_realtek;
4093                 hdev->shutdown = btrtl_shutdown_realtek;
4094                 hdev->cmd_timeout = btusb_rtl_cmd_timeout;
4095
4096                 /* Realtek devices need to set remote wakeup on auto-suspend */
4097                 set_bit(BTUSB_WAKEUP_AUTOSUSPEND, &data->flags);
4098                 set_bit(BTUSB_USE_ALT3_FOR_WBS, &data->flags);
4099         }
4100
4101         if (!reset)
4102                 set_bit(HCI_QUIRK_RESET_ON_CLOSE, &hdev->quirks);
4103
4104         if (force_scofix || id->driver_info & BTUSB_WRONG_SCO_MTU) {
4105                 if (!disable_scofix)
4106                         set_bit(HCI_QUIRK_FIXUP_BUFFER_SIZE, &hdev->quirks);
4107         }
4108
4109         if (id->driver_info & BTUSB_BROKEN_ISOC)
4110                 data->isoc = NULL;
4111
4112         if (id->driver_info & BTUSB_WIDEBAND_SPEECH)
4113                 set_bit(HCI_QUIRK_WIDEBAND_SPEECH_SUPPORTED, &hdev->quirks);
4114
4115         if (id->driver_info & BTUSB_VALID_LE_STATES)
4116                 set_bit(HCI_QUIRK_VALID_LE_STATES, &hdev->quirks);
4117
4118         if (id->driver_info & BTUSB_DIGIANSWER) {
4119                 data->cmdreq_type = USB_TYPE_VENDOR;
4120                 set_bit(HCI_QUIRK_RESET_ON_CLOSE, &hdev->quirks);
4121         }
4122
4123         if (id->driver_info & BTUSB_CSR) {
4124                 struct usb_device *udev = data->udev;
4125                 u16 bcdDevice = le16_to_cpu(udev->descriptor.bcdDevice);
4126
4127                 /* Old firmware would otherwise execute USB reset */
4128                 if (bcdDevice < 0x117)
4129                         set_bit(HCI_QUIRK_RESET_ON_CLOSE, &hdev->quirks);
4130
4131                 /* This must be set first in case we disable it for fakes */
4132                 set_bit(HCI_QUIRK_SIMULTANEOUS_DISCOVERY, &hdev->quirks);
4133
4134                 /* Fake CSR devices with broken commands */
4135                 if (le16_to_cpu(udev->descriptor.idVendor)  == 0x0a12 &&
4136                     le16_to_cpu(udev->descriptor.idProduct) == 0x0001)
4137                         hdev->setup = btusb_setup_csr;
4138         }
4139
4140         if (id->driver_info & BTUSB_SNIFFER) {
4141                 struct usb_device *udev = data->udev;
4142
4143                 /* New sniffer firmware has crippled HCI interface */
4144                 if (le16_to_cpu(udev->descriptor.bcdDevice) > 0x997)
4145                         set_bit(HCI_QUIRK_RAW_DEVICE, &hdev->quirks);
4146         }
4147
4148         if (id->driver_info & BTUSB_INTEL_BOOT) {
4149                 /* A bug in the bootloader causes that interrupt interface is
4150                  * only enabled after receiving SetInterface(0, AltSetting=0).
4151                  */
4152                 err = usb_set_interface(data->udev, 0, 0);
4153                 if (err < 0) {
4154                         BT_ERR("failed to set interface 0, alt 0 %d", err);
4155                         goto out_free_dev;
4156                 }
4157         }
4158
4159         if (data->isoc) {
4160                 err = usb_driver_claim_interface(&btusb_driver,
4161                                                  data->isoc, data);
4162                 if (err < 0)
4163                         goto out_free_dev;
4164         }
4165
4166         if (IS_ENABLED(CONFIG_BT_HCIBTUSB_BCM) && data->diag) {
4167                 if (!usb_driver_claim_interface(&btusb_driver,
4168                                                 data->diag, data))
4169                         __set_diag_interface(hdev);
4170                 else
4171                         data->diag = NULL;
4172         }
4173
4174         if (enable_autosuspend)
4175                 usb_enable_autosuspend(data->udev);
4176
4177         data->poll_sync = enable_poll_sync;
4178
4179         err = hci_register_dev(hdev);
4180         if (err < 0)
4181                 goto out_free_dev;
4182
4183         usb_set_intfdata(intf, data);
4184
4185         debugfs_create_file("force_poll_sync", 0644, hdev->debugfs, data,
4186                             &force_poll_sync_fops);
4187
4188         return 0;
4189
4190 out_free_dev:
4191         if (data->reset_gpio)
4192                 gpiod_put(data->reset_gpio);
4193         hci_free_dev(hdev);
4194         return err;
4195 }
4196
4197 static void btusb_disconnect(struct usb_interface *intf)
4198 {
4199         struct btusb_data *data = usb_get_intfdata(intf);
4200         struct hci_dev *hdev;
4201
4202         BT_DBG("intf %p", intf);
4203
4204         if (!data)
4205                 return;
4206
4207         hdev = data->hdev;
4208         usb_set_intfdata(data->intf, NULL);
4209
4210         if (data->isoc)
4211                 usb_set_intfdata(data->isoc, NULL);
4212
4213         if (data->diag)
4214                 usb_set_intfdata(data->diag, NULL);
4215
4216         hci_unregister_dev(hdev);
4217
4218         if (intf == data->intf) {
4219                 if (data->isoc)
4220                         usb_driver_release_interface(&btusb_driver, data->isoc);
4221                 if (data->diag)
4222                         usb_driver_release_interface(&btusb_driver, data->diag);
4223         } else if (intf == data->isoc) {
4224                 if (data->diag)
4225                         usb_driver_release_interface(&btusb_driver, data->diag);
4226                 usb_driver_release_interface(&btusb_driver, data->intf);
4227         } else if (intf == data->diag) {
4228                 usb_driver_release_interface(&btusb_driver, data->intf);
4229                 if (data->isoc)
4230                         usb_driver_release_interface(&btusb_driver, data->isoc);
4231         }
4232
4233         if (data->oob_wake_irq)
4234                 device_init_wakeup(&data->udev->dev, false);
4235
4236         if (data->reset_gpio)
4237                 gpiod_put(data->reset_gpio);
4238
4239         hci_free_dev(hdev);
4240 }
4241
4242 #ifdef CONFIG_PM
4243 static int btusb_suspend(struct usb_interface *intf, pm_message_t message)
4244 {
4245         struct btusb_data *data = usb_get_intfdata(intf);
4246
4247         BT_DBG("intf %p", intf);
4248
4249         if (data->suspend_count++)
4250                 return 0;
4251
4252         spin_lock_irq(&data->txlock);
4253         if (!(PMSG_IS_AUTO(message) && data->tx_in_flight)) {
4254                 set_bit(BTUSB_SUSPENDING, &data->flags);
4255                 spin_unlock_irq(&data->txlock);
4256         } else {
4257                 spin_unlock_irq(&data->txlock);
4258                 data->suspend_count--;
4259                 return -EBUSY;
4260         }
4261
4262         cancel_work_sync(&data->work);
4263
4264         btusb_stop_traffic(data);
4265         usb_kill_anchored_urbs(&data->tx_anchor);
4266
4267         if (data->oob_wake_irq && device_may_wakeup(&data->udev->dev)) {
4268                 set_bit(BTUSB_OOB_WAKE_ENABLED, &data->flags);
4269                 enable_irq_wake(data->oob_wake_irq);
4270                 enable_irq(data->oob_wake_irq);
4271         }
4272
4273         /* For global suspend, Realtek devices lose the loaded fw
4274          * in them. But for autosuspend, firmware should remain.
4275          * Actually, it depends on whether the usb host sends
4276          * set feature (enable wakeup) or not.
4277          */
4278         if (test_bit(BTUSB_WAKEUP_AUTOSUSPEND, &data->flags)) {
4279                 if (PMSG_IS_AUTO(message) &&
4280                     device_can_wakeup(&data->udev->dev))
4281                         data->udev->do_remote_wakeup = 1;
4282                 else if (!PMSG_IS_AUTO(message) &&
4283                          !device_may_wakeup(&data->udev->dev)) {
4284                         data->udev->do_remote_wakeup = 0;
4285                         data->udev->reset_resume = 1;
4286                 }
4287         }
4288
4289         return 0;
4290 }
4291
4292 static void play_deferred(struct btusb_data *data)
4293 {
4294         struct urb *urb;
4295         int err;
4296
4297         while ((urb = usb_get_from_anchor(&data->deferred))) {
4298                 usb_anchor_urb(urb, &data->tx_anchor);
4299
4300                 err = usb_submit_urb(urb, GFP_ATOMIC);
4301                 if (err < 0) {
4302                         if (err != -EPERM && err != -ENODEV)
4303                                 BT_ERR("%s urb %p submission failed (%d)",
4304                                        data->hdev->name, urb, -err);
4305                         kfree(urb->setup_packet);
4306                         usb_unanchor_urb(urb);
4307                         usb_free_urb(urb);
4308                         break;
4309                 }
4310
4311                 data->tx_in_flight++;
4312                 usb_free_urb(urb);
4313         }
4314
4315         /* Cleanup the rest deferred urbs. */
4316         while ((urb = usb_get_from_anchor(&data->deferred))) {
4317                 kfree(urb->setup_packet);
4318                 usb_free_urb(urb);
4319         }
4320 }
4321
4322 static int btusb_resume(struct usb_interface *intf)
4323 {
4324         struct btusb_data *data = usb_get_intfdata(intf);
4325         struct hci_dev *hdev = data->hdev;
4326         int err = 0;
4327
4328         BT_DBG("intf %p", intf);
4329
4330         if (--data->suspend_count)
4331                 return 0;
4332
4333         /* Disable only if not already disabled (keep it balanced) */
4334         if (test_and_clear_bit(BTUSB_OOB_WAKE_ENABLED, &data->flags)) {
4335                 disable_irq(data->oob_wake_irq);
4336                 disable_irq_wake(data->oob_wake_irq);
4337         }
4338
4339         if (!test_bit(HCI_RUNNING, &hdev->flags))
4340                 goto done;
4341
4342         if (test_bit(BTUSB_INTR_RUNNING, &data->flags)) {
4343                 err = btusb_submit_intr_urb(hdev, GFP_NOIO);
4344                 if (err < 0) {
4345                         clear_bit(BTUSB_INTR_RUNNING, &data->flags);
4346                         goto failed;
4347                 }
4348         }
4349
4350         if (test_bit(BTUSB_BULK_RUNNING, &data->flags)) {
4351                 err = btusb_submit_bulk_urb(hdev, GFP_NOIO);
4352                 if (err < 0) {
4353                         clear_bit(BTUSB_BULK_RUNNING, &data->flags);
4354                         goto failed;
4355                 }
4356
4357                 btusb_submit_bulk_urb(hdev, GFP_NOIO);
4358         }
4359
4360         if (test_bit(BTUSB_ISOC_RUNNING, &data->flags)) {
4361                 if (btusb_submit_isoc_urb(hdev, GFP_NOIO) < 0)
4362                         clear_bit(BTUSB_ISOC_RUNNING, &data->flags);
4363                 else
4364                         btusb_submit_isoc_urb(hdev, GFP_NOIO);
4365         }
4366
4367         spin_lock_irq(&data->txlock);
4368         play_deferred(data);
4369         clear_bit(BTUSB_SUSPENDING, &data->flags);
4370         spin_unlock_irq(&data->txlock);
4371         schedule_work(&data->work);
4372
4373         return 0;
4374
4375 failed:
4376         usb_scuttle_anchored_urbs(&data->deferred);
4377 done:
4378         spin_lock_irq(&data->txlock);
4379         clear_bit(BTUSB_SUSPENDING, &data->flags);
4380         spin_unlock_irq(&data->txlock);
4381
4382         return err;
4383 }
4384 #endif
4385
4386 static struct usb_driver btusb_driver = {
4387         .name           = "btusb",
4388         .probe          = btusb_probe,
4389         .disconnect     = btusb_disconnect,
4390 #ifdef CONFIG_PM
4391         .suspend        = btusb_suspend,
4392         .resume         = btusb_resume,
4393 #endif
4394         .id_table       = btusb_table,
4395         .supports_autosuspend = 1,
4396         .disable_hub_initiated_lpm = 1,
4397 };
4398
4399 module_usb_driver(btusb_driver);
4400
4401 module_param(disable_scofix, bool, 0644);
4402 MODULE_PARM_DESC(disable_scofix, "Disable fixup of wrong SCO buffer size");
4403
4404 module_param(force_scofix, bool, 0644);
4405 MODULE_PARM_DESC(force_scofix, "Force fixup of wrong SCO buffers size");
4406
4407 module_param(enable_autosuspend, bool, 0644);
4408 MODULE_PARM_DESC(enable_autosuspend, "Enable USB autosuspend by default");
4409
4410 module_param(reset, bool, 0644);
4411 MODULE_PARM_DESC(reset, "Send HCI reset command on initialization");
4412
4413 MODULE_AUTHOR("Marcel Holtmann <[email protected]>");
4414 MODULE_DESCRIPTION("Generic Bluetooth USB driver ver " VERSION);
4415 MODULE_VERSION(VERSION);
4416 MODULE_LICENSE("GPL");