CoCalc -- btusb.c

GitHub Repository: torvalds/linux
Path: blob/master/drivers/bluetooth/btusb.c
²⁶³⁷⁸ views
1
// SPDX-License-Identifier: GPL-2.0-or-later
2
/*
3
 *
4
 *  Generic Bluetooth USB driver
5
 *
6
 *  Copyright (C) 2005-2008  Marcel Holtmann <[email protected]>
7
 */
8

9
#include <linux/dmi.h>
10
#include <linux/module.h>
11
#include <linux/usb.h>
12
#include <linux/usb/quirks.h>
13
#include <linux/firmware.h>
14
#include <linux/iopoll.h>
15
#include <linux/of_device.h>
16
#include <linux/of_irq.h>
17
#include <linux/suspend.h>
18
#include <linux/gpio/consumer.h>
19
#include <linux/debugfs.h>
20
#include <linux/unaligned.h>
21

22
#include <net/bluetooth/bluetooth.h>
23
#include <net/bluetooth/hci_core.h>
24
#include <net/bluetooth/hci_drv.h>
25

26
#include "btintel.h"
27
#include "btbcm.h"
28
#include "btrtl.h"
29
#include "btmtk.h"
30

31
#define VERSION "0.8"
32

33
static bool disable_scofix;
34
static bool force_scofix;
35
static bool enable_autosuspend = IS_ENABLED(CONFIG_BT_HCIBTUSB_AUTOSUSPEND);
36
static bool enable_poll_sync = IS_ENABLED(CONFIG_BT_HCIBTUSB_POLL_SYNC);
37
static bool reset = true;
38

39
static struct usb_driver btusb_driver;
40

41
#define BTUSB_IGNORE			BIT(0)
42
#define BTUSB_DIGIANSWER		BIT(1)
43
#define BTUSB_CSR			BIT(2)
44
#define BTUSB_SNIFFER			BIT(3)
45
#define BTUSB_BCM92035			BIT(4)
46
#define BTUSB_BROKEN_ISOC		BIT(5)
47
#define BTUSB_WRONG_SCO_MTU		BIT(6)
48
#define BTUSB_ATH3012			BIT(7)
49
#define BTUSB_INTEL_COMBINED		BIT(8)
50
#define BTUSB_INTEL_BOOT		BIT(9)
51
#define BTUSB_BCM_PATCHRAM		BIT(10)
52
#define BTUSB_MARVELL			BIT(11)
53
#define BTUSB_SWAVE			BIT(12)
54
#define BTUSB_AMP			BIT(13)
55
#define BTUSB_QCA_ROME			BIT(14)
56
#define BTUSB_BCM_APPLE			BIT(15)
57
#define BTUSB_REALTEK			BIT(16)
58
#define BTUSB_BCM2045			BIT(17)
59
#define BTUSB_IFNUM_2			BIT(18)
60
#define BTUSB_CW6622			BIT(19)
61
#define BTUSB_MEDIATEK			BIT(20)
62
#define BTUSB_WIDEBAND_SPEECH		BIT(21)
63
#define BTUSB_INVALID_LE_STATES		BIT(22)
64
#define BTUSB_QCA_WCN6855		BIT(23)
65
#define BTUSB_INTEL_BROKEN_SHUTDOWN_LED	BIT(24)
66
#define BTUSB_INTEL_BROKEN_INITIAL_NCMD BIT(25)
67
#define BTUSB_INTEL_NO_WBS_SUPPORT	BIT(26)
68
#define BTUSB_ACTIONS_SEMI		BIT(27)
69

70
static const struct usb_device_id btusb_table[] = {
71
	/* Generic Bluetooth USB device */
72
	{ USB_DEVICE_INFO(0xe0, 0x01, 0x01) },
73

74
	/* Generic Bluetooth AMP device */
75
	{ USB_DEVICE_INFO(0xe0, 0x01, 0x04), .driver_info = BTUSB_AMP },
76

77
	/* Generic Bluetooth USB interface */
78
	{ USB_INTERFACE_INFO(0xe0, 0x01, 0x01) },
79

80
	/* Apple-specific (Broadcom) devices */
81
	{ USB_VENDOR_AND_INTERFACE_INFO(0x05ac, 0xff, 0x01, 0x01),
82
	  .driver_info = BTUSB_BCM_APPLE | BTUSB_IFNUM_2 },
83

84
	/* MediaTek MT76x0E */
85
	{ USB_DEVICE(0x0e8d, 0x763f) },
86

87
	/* Broadcom SoftSailing reporting vendor specific */
88
	{ USB_DEVICE(0x0a5c, 0x21e1) },
89

90
	/* Apple MacBookPro 7,1 */
91
	{ USB_DEVICE(0x05ac, 0x8213) },
92

93
	/* Apple iMac11,1 */
94
	{ USB_DEVICE(0x05ac, 0x8215) },
95

96
	/* Apple MacBookPro6,2 */
97
	{ USB_DEVICE(0x05ac, 0x8218) },
98

99
	/* Apple MacBookAir3,1, MacBookAir3,2 */
100
	{ USB_DEVICE(0x05ac, 0x821b) },
101

102
	/* Apple MacBookAir4,1 */
103
	{ USB_DEVICE(0x05ac, 0x821f) },
104

105
	/* Apple MacBookPro8,2 */
106
	{ USB_DEVICE(0x05ac, 0x821a) },
107

108
	/* Apple MacMini5,1 */
109
	{ USB_DEVICE(0x05ac, 0x8281) },
110

111
	/* AVM BlueFRITZ! USB v2.0 */
112
	{ USB_DEVICE(0x057c, 0x3800), .driver_info = BTUSB_SWAVE },
113

114
	/* Bluetooth Ultraport Module from IBM */
115
	{ USB_DEVICE(0x04bf, 0x030a) },
116

117
	/* ALPS Modules with non-standard id */
118
	{ USB_DEVICE(0x044e, 0x3001) },
119
	{ USB_DEVICE(0x044e, 0x3002) },
120

121
	/* Ericsson with non-standard id */
122
	{ USB_DEVICE(0x0bdb, 0x1002) },
123

124
	/* Canyon CN-BTU1 with HID interfaces */
125
	{ USB_DEVICE(0x0c10, 0x0000) },
126

127
	/* Broadcom BCM20702B0 (Dynex/Insignia) */
128
	{ USB_DEVICE(0x19ff, 0x0239), .driver_info = BTUSB_BCM_PATCHRAM },
129

130
	/* Broadcom BCM43142A0 (Foxconn/Lenovo) */
131
	{ USB_VENDOR_AND_INTERFACE_INFO(0x105b, 0xff, 0x01, 0x01),
132
	  .driver_info = BTUSB_BCM_PATCHRAM },
133

134
	/* Broadcom BCM920703 (HTC Vive) */
135
	{ USB_VENDOR_AND_INTERFACE_INFO(0x0bb4, 0xff, 0x01, 0x01),
136
	  .driver_info = BTUSB_BCM_PATCHRAM },
137

138
	/* Foxconn - Hon Hai */
139
	{ USB_VENDOR_AND_INTERFACE_INFO(0x0489, 0xff, 0x01, 0x01),
140
	  .driver_info = BTUSB_BCM_PATCHRAM },
141

142
	/* Lite-On Technology - Broadcom based */
143
	{ USB_VENDOR_AND_INTERFACE_INFO(0x04ca, 0xff, 0x01, 0x01),
144
	  .driver_info = BTUSB_BCM_PATCHRAM },
145

146
	/* Broadcom devices with vendor specific id */
147
	{ USB_VENDOR_AND_INTERFACE_INFO(0x0a5c, 0xff, 0x01, 0x01),
148
	  .driver_info = BTUSB_BCM_PATCHRAM },
149

150
	/* ASUSTek Computer - Broadcom based */
151
	{ USB_VENDOR_AND_INTERFACE_INFO(0x0b05, 0xff, 0x01, 0x01),
152
	  .driver_info = BTUSB_BCM_PATCHRAM },
153

154
	/* Belkin F8065bf - Broadcom based */
155
	{ USB_VENDOR_AND_INTERFACE_INFO(0x050d, 0xff, 0x01, 0x01),
156
	  .driver_info = BTUSB_BCM_PATCHRAM },
157

158
	/* IMC Networks - Broadcom based */
159
	{ USB_VENDOR_AND_INTERFACE_INFO(0x13d3, 0xff, 0x01, 0x01),
160
	  .driver_info = BTUSB_BCM_PATCHRAM },
161

162
	/* Dell Computer - Broadcom based  */
163
	{ USB_VENDOR_AND_INTERFACE_INFO(0x413c, 0xff, 0x01, 0x01),
164
	  .driver_info = BTUSB_BCM_PATCHRAM },
165

166
	/* Toshiba Corp - Broadcom based */
167
	{ USB_VENDOR_AND_INTERFACE_INFO(0x0930, 0xff, 0x01, 0x01),
168
	  .driver_info = BTUSB_BCM_PATCHRAM },
169

170
	/* Intel Bluetooth USB Bootloader (RAM module) */
171
	{ USB_DEVICE(0x8087, 0x0a5a),
172
	  .driver_info = BTUSB_INTEL_BOOT | BTUSB_BROKEN_ISOC },
173

174
	{ }	/* Terminating entry */
175
};
176

177
MODULE_DEVICE_TABLE(usb, btusb_table);
178

179
static const struct usb_device_id quirks_table[] = {
180
	/* CSR BlueCore devices */
181
	{ USB_DEVICE(0x0a12, 0x0001), .driver_info = BTUSB_CSR },
182

183
	/* Broadcom BCM2033 without firmware */
184
	{ USB_DEVICE(0x0a5c, 0x2033), .driver_info = BTUSB_IGNORE },
185

186
	/* Broadcom BCM2045 devices */
187
	{ USB_DEVICE(0x0a5c, 0x2045), .driver_info = BTUSB_BCM2045 },
188

189
	/* Atheros 3011 with sflash firmware */
190
	{ USB_DEVICE(0x0489, 0xe027), .driver_info = BTUSB_IGNORE },
191
	{ USB_DEVICE(0x0489, 0xe03d), .driver_info = BTUSB_IGNORE },
192
	{ USB_DEVICE(0x04f2, 0xaff1), .driver_info = BTUSB_IGNORE },
193
	{ USB_DEVICE(0x0930, 0x0215), .driver_info = BTUSB_IGNORE },
194
	{ USB_DEVICE(0x0cf3, 0x3002), .driver_info = BTUSB_IGNORE },
195
	{ USB_DEVICE(0x0cf3, 0xe019), .driver_info = BTUSB_IGNORE },
196
	{ USB_DEVICE(0x13d3, 0x3304), .driver_info = BTUSB_IGNORE },
197

198
	/* Atheros AR9285 Malbec with sflash firmware */
199
	{ USB_DEVICE(0x03f0, 0x311d), .driver_info = BTUSB_IGNORE },
200

201
	/* Atheros 3012 with sflash firmware */
202
	{ USB_DEVICE(0x0489, 0xe04d), .driver_info = BTUSB_ATH3012 },
203
	{ USB_DEVICE(0x0489, 0xe04e), .driver_info = BTUSB_ATH3012 },
204
	{ USB_DEVICE(0x0489, 0xe056), .driver_info = BTUSB_ATH3012 },
205
	{ USB_DEVICE(0x0489, 0xe057), .driver_info = BTUSB_ATH3012 },
206
	{ USB_DEVICE(0x0489, 0xe05f), .driver_info = BTUSB_ATH3012 },
207
	{ USB_DEVICE(0x0489, 0xe076), .driver_info = BTUSB_ATH3012 },
208
	{ USB_DEVICE(0x0489, 0xe078), .driver_info = BTUSB_ATH3012 },
209
	{ USB_DEVICE(0x0489, 0xe095), .driver_info = BTUSB_ATH3012 },
210
	{ USB_DEVICE(0x04c5, 0x1330), .driver_info = BTUSB_ATH3012 },
211
	{ USB_DEVICE(0x04ca, 0x3004), .driver_info = BTUSB_ATH3012 },
212
	{ USB_DEVICE(0x04ca, 0x3005), .driver_info = BTUSB_ATH3012 },
213
	{ USB_DEVICE(0x04ca, 0x3006), .driver_info = BTUSB_ATH3012 },
214
	{ USB_DEVICE(0x04ca, 0x3007), .driver_info = BTUSB_ATH3012 },
215
	{ USB_DEVICE(0x04ca, 0x3008), .driver_info = BTUSB_ATH3012 },
216
	{ USB_DEVICE(0x04ca, 0x300b), .driver_info = BTUSB_ATH3012 },
217
	{ USB_DEVICE(0x04ca, 0x300d), .driver_info = BTUSB_ATH3012 },
218
	{ USB_DEVICE(0x04ca, 0x300f), .driver_info = BTUSB_ATH3012 },
219
	{ USB_DEVICE(0x04ca, 0x3010), .driver_info = BTUSB_ATH3012 },
220
	{ USB_DEVICE(0x04ca, 0x3014), .driver_info = BTUSB_ATH3012 },
221
	{ USB_DEVICE(0x04ca, 0x3018), .driver_info = BTUSB_ATH3012 },
222
	{ USB_DEVICE(0x0930, 0x0219), .driver_info = BTUSB_ATH3012 },
223
	{ USB_DEVICE(0x0930, 0x021c), .driver_info = BTUSB_ATH3012 },
224
	{ USB_DEVICE(0x0930, 0x0220), .driver_info = BTUSB_ATH3012 },
225
	{ USB_DEVICE(0x0930, 0x0227), .driver_info = BTUSB_ATH3012 },
226
	{ USB_DEVICE(0x0b05, 0x17d0), .driver_info = BTUSB_ATH3012 },
227
	{ USB_DEVICE(0x0cf3, 0x0036), .driver_info = BTUSB_ATH3012 },
228
	{ USB_DEVICE(0x0cf3, 0x3004), .driver_info = BTUSB_ATH3012 },
229
	{ USB_DEVICE(0x0cf3, 0x3008), .driver_info = BTUSB_ATH3012 },
230
	{ USB_DEVICE(0x0cf3, 0x311d), .driver_info = BTUSB_ATH3012 },
231
	{ USB_DEVICE(0x0cf3, 0x311e), .driver_info = BTUSB_ATH3012 },
232
	{ USB_DEVICE(0x0cf3, 0x311f), .driver_info = BTUSB_ATH3012 },
233
	{ USB_DEVICE(0x0cf3, 0x3121), .driver_info = BTUSB_ATH3012 },
234
	{ USB_DEVICE(0x0cf3, 0x817a), .driver_info = BTUSB_ATH3012 },
235
	{ USB_DEVICE(0x0cf3, 0x817b), .driver_info = BTUSB_ATH3012 },
236
	{ USB_DEVICE(0x0cf3, 0xe003), .driver_info = BTUSB_ATH3012 },
237
	{ USB_DEVICE(0x0cf3, 0xe004), .driver_info = BTUSB_ATH3012 },
238
	{ USB_DEVICE(0x0cf3, 0xe005), .driver_info = BTUSB_ATH3012 },
239
	{ USB_DEVICE(0x0cf3, 0xe006), .driver_info = BTUSB_ATH3012 },
240
	{ USB_DEVICE(0x13d3, 0x3362), .driver_info = BTUSB_ATH3012 },
241
	{ USB_DEVICE(0x13d3, 0x3375), .driver_info = BTUSB_ATH3012 },
242
	{ USB_DEVICE(0x13d3, 0x3393), .driver_info = BTUSB_ATH3012 },
243
	{ USB_DEVICE(0x13d3, 0x3395), .driver_info = BTUSB_ATH3012 },
244
	{ USB_DEVICE(0x13d3, 0x3402), .driver_info = BTUSB_ATH3012 },
245
	{ USB_DEVICE(0x13d3, 0x3408), .driver_info = BTUSB_ATH3012 },
246
	{ USB_DEVICE(0x13d3, 0x3423), .driver_info = BTUSB_ATH3012 },
247
	{ USB_DEVICE(0x13d3, 0x3432), .driver_info = BTUSB_ATH3012 },
248
	{ USB_DEVICE(0x13d3, 0x3472), .driver_info = BTUSB_ATH3012 },
249
	{ USB_DEVICE(0x13d3, 0x3474), .driver_info = BTUSB_ATH3012 },
250
	{ USB_DEVICE(0x13d3, 0x3487), .driver_info = BTUSB_ATH3012 },
251
	{ USB_DEVICE(0x13d3, 0x3490), .driver_info = BTUSB_ATH3012 },
252

253
	/* Atheros AR5BBU12 with sflash firmware */
254
	{ USB_DEVICE(0x0489, 0xe02c), .driver_info = BTUSB_IGNORE },
255

256
	/* Atheros AR5BBU12 with sflash firmware */
257
	{ USB_DEVICE(0x0489, 0xe036), .driver_info = BTUSB_ATH3012 },
258
	{ USB_DEVICE(0x0489, 0xe03c), .driver_info = BTUSB_ATH3012 },
259

260
	/* QCA ROME chipset */
261
	{ USB_DEVICE(0x0cf3, 0x535b), .driver_info = BTUSB_QCA_ROME |
262
						     BTUSB_WIDEBAND_SPEECH },
263
	{ USB_DEVICE(0x0cf3, 0xe007), .driver_info = BTUSB_QCA_ROME |
264
						     BTUSB_WIDEBAND_SPEECH },
265
	{ USB_DEVICE(0x0cf3, 0xe009), .driver_info = BTUSB_QCA_ROME |
266
						     BTUSB_WIDEBAND_SPEECH },
267
	{ USB_DEVICE(0x0cf3, 0xe010), .driver_info = BTUSB_QCA_ROME |
268
						     BTUSB_WIDEBAND_SPEECH },
269
	{ USB_DEVICE(0x0cf3, 0xe300), .driver_info = BTUSB_QCA_ROME |
270
						     BTUSB_WIDEBAND_SPEECH },
271
	{ USB_DEVICE(0x0cf3, 0xe301), .driver_info = BTUSB_QCA_ROME |
272
						     BTUSB_WIDEBAND_SPEECH },
273
	{ USB_DEVICE(0x0cf3, 0xe360), .driver_info = BTUSB_QCA_ROME |
274
						     BTUSB_WIDEBAND_SPEECH },
275
	{ USB_DEVICE(0x0cf3, 0xe500), .driver_info = BTUSB_QCA_ROME |
276
						     BTUSB_WIDEBAND_SPEECH },
277
	{ USB_DEVICE(0x0489, 0xe092), .driver_info = BTUSB_QCA_ROME |
278
						     BTUSB_WIDEBAND_SPEECH },
279
	{ USB_DEVICE(0x0489, 0xe09f), .driver_info = BTUSB_QCA_ROME |
280
						     BTUSB_WIDEBAND_SPEECH },
281
	{ USB_DEVICE(0x0489, 0xe0a2), .driver_info = BTUSB_QCA_ROME |
282
						     BTUSB_WIDEBAND_SPEECH },
283
	{ USB_DEVICE(0x04ca, 0x3011), .driver_info = BTUSB_QCA_ROME |
284
						     BTUSB_WIDEBAND_SPEECH },
285
	{ USB_DEVICE(0x04ca, 0x3015), .driver_info = BTUSB_QCA_ROME |
286
						     BTUSB_WIDEBAND_SPEECH },
287
	{ USB_DEVICE(0x04ca, 0x3016), .driver_info = BTUSB_QCA_ROME |
288
						     BTUSB_WIDEBAND_SPEECH },
289
	{ USB_DEVICE(0x04ca, 0x301a), .driver_info = BTUSB_QCA_ROME |
290
						     BTUSB_WIDEBAND_SPEECH },
291
	{ USB_DEVICE(0x04ca, 0x3021), .driver_info = BTUSB_QCA_ROME |
292
						     BTUSB_WIDEBAND_SPEECH },
293
	{ USB_DEVICE(0x13d3, 0x3491), .driver_info = BTUSB_QCA_ROME |
294
						     BTUSB_WIDEBAND_SPEECH },
295
	{ USB_DEVICE(0x13d3, 0x3496), .driver_info = BTUSB_QCA_ROME |
296
						     BTUSB_WIDEBAND_SPEECH },
297
	{ USB_DEVICE(0x13d3, 0x3501), .driver_info = BTUSB_QCA_ROME |
298
						     BTUSB_WIDEBAND_SPEECH },
299

300
	/* QCA WCN6855 chipset */
301
	{ USB_DEVICE(0x0489, 0xe0c7), .driver_info = BTUSB_QCA_WCN6855 |
302
						     BTUSB_WIDEBAND_SPEECH },
303
	{ USB_DEVICE(0x0489, 0xe0c9), .driver_info = BTUSB_QCA_WCN6855 |
304
						     BTUSB_WIDEBAND_SPEECH },
305
	{ USB_DEVICE(0x0489, 0xe0ca), .driver_info = BTUSB_QCA_WCN6855 |
306
						     BTUSB_WIDEBAND_SPEECH },
307
	{ USB_DEVICE(0x0489, 0xe0cb), .driver_info = BTUSB_QCA_WCN6855 |
308
						     BTUSB_WIDEBAND_SPEECH },
309
	{ USB_DEVICE(0x0489, 0xe0cc), .driver_info = BTUSB_QCA_WCN6855 |
310
						     BTUSB_WIDEBAND_SPEECH },
311
	{ USB_DEVICE(0x0489, 0xe0ce), .driver_info = BTUSB_QCA_WCN6855 |
312
						     BTUSB_WIDEBAND_SPEECH },
313
	{ USB_DEVICE(0x0489, 0xe0d0), .driver_info = BTUSB_QCA_WCN6855 |
314
						     BTUSB_WIDEBAND_SPEECH },
315
	{ USB_DEVICE(0x0489, 0xe0d6), .driver_info = BTUSB_QCA_WCN6855 |
316
						     BTUSB_WIDEBAND_SPEECH },
317
	{ USB_DEVICE(0x0489, 0xe0de), .driver_info = BTUSB_QCA_WCN6855 |
318
						     BTUSB_WIDEBAND_SPEECH },
319
	{ USB_DEVICE(0x0489, 0xe0df), .driver_info = BTUSB_QCA_WCN6855 |
320
						     BTUSB_WIDEBAND_SPEECH },
321
	{ USB_DEVICE(0x0489, 0xe0e1), .driver_info = BTUSB_QCA_WCN6855 |
322
						     BTUSB_WIDEBAND_SPEECH },
323
	{ USB_DEVICE(0x0489, 0xe0e3), .driver_info = BTUSB_QCA_WCN6855 |
324
						     BTUSB_WIDEBAND_SPEECH },
325
	{ USB_DEVICE(0x0489, 0xe0ea), .driver_info = BTUSB_QCA_WCN6855 |
326
						     BTUSB_WIDEBAND_SPEECH },
327
	{ USB_DEVICE(0x0489, 0xe0ec), .driver_info = BTUSB_QCA_WCN6855 |
328
						     BTUSB_WIDEBAND_SPEECH },
329
	{ USB_DEVICE(0x04ca, 0x3022), .driver_info = BTUSB_QCA_WCN6855 |
330
						     BTUSB_WIDEBAND_SPEECH },
331
	{ USB_DEVICE(0x04ca, 0x3023), .driver_info = BTUSB_QCA_WCN6855 |
332
						     BTUSB_WIDEBAND_SPEECH },
333
	{ USB_DEVICE(0x04ca, 0x3024), .driver_info = BTUSB_QCA_WCN6855 |
334
						     BTUSB_WIDEBAND_SPEECH },
335
	{ USB_DEVICE(0x04ca, 0x3a22), .driver_info = BTUSB_QCA_WCN6855 |
336
						     BTUSB_WIDEBAND_SPEECH },
337
	{ USB_DEVICE(0x04ca, 0x3a24), .driver_info = BTUSB_QCA_WCN6855 |
338
						     BTUSB_WIDEBAND_SPEECH },
339
	{ USB_DEVICE(0x04ca, 0x3a26), .driver_info = BTUSB_QCA_WCN6855 |
340
						     BTUSB_WIDEBAND_SPEECH },
341
	{ USB_DEVICE(0x04ca, 0x3a27), .driver_info = BTUSB_QCA_WCN6855 |
342
						     BTUSB_WIDEBAND_SPEECH },
343
	{ USB_DEVICE(0x0cf3, 0xe600), .driver_info = BTUSB_QCA_WCN6855 |
344
						     BTUSB_WIDEBAND_SPEECH },
345
	{ USB_DEVICE(0x10ab, 0x9108), .driver_info = BTUSB_QCA_WCN6855 |
346
						     BTUSB_WIDEBAND_SPEECH },
347
	{ USB_DEVICE(0x10ab, 0x9109), .driver_info = BTUSB_QCA_WCN6855 |
348
						     BTUSB_WIDEBAND_SPEECH },
349
	{ USB_DEVICE(0x10ab, 0x9208), .driver_info = BTUSB_QCA_WCN6855 |
350
						     BTUSB_WIDEBAND_SPEECH },
351
	{ USB_DEVICE(0x10ab, 0x9209), .driver_info = BTUSB_QCA_WCN6855 |
352
						     BTUSB_WIDEBAND_SPEECH },
353
	{ USB_DEVICE(0x10ab, 0x9308), .driver_info = BTUSB_QCA_WCN6855 |
354
						     BTUSB_WIDEBAND_SPEECH },
355
	{ USB_DEVICE(0x10ab, 0x9309), .driver_info = BTUSB_QCA_WCN6855 |
356
						     BTUSB_WIDEBAND_SPEECH },
357
	{ USB_DEVICE(0x10ab, 0x9408), .driver_info = BTUSB_QCA_WCN6855 |
358
						     BTUSB_WIDEBAND_SPEECH },
359
	{ USB_DEVICE(0x10ab, 0x9409), .driver_info = BTUSB_QCA_WCN6855 |
360
						     BTUSB_WIDEBAND_SPEECH },
361
	{ USB_DEVICE(0x10ab, 0x9508), .driver_info = BTUSB_QCA_WCN6855 |
362
						     BTUSB_WIDEBAND_SPEECH },
363
	{ USB_DEVICE(0x10ab, 0x9509), .driver_info = BTUSB_QCA_WCN6855 |
364
						     BTUSB_WIDEBAND_SPEECH },
365
	{ USB_DEVICE(0x10ab, 0x9608), .driver_info = BTUSB_QCA_WCN6855 |
366
						     BTUSB_WIDEBAND_SPEECH },
367
	{ USB_DEVICE(0x10ab, 0x9609), .driver_info = BTUSB_QCA_WCN6855 |
368
						     BTUSB_WIDEBAND_SPEECH },
369
	{ USB_DEVICE(0x10ab, 0x9f09), .driver_info = BTUSB_QCA_WCN6855 |
370
						     BTUSB_WIDEBAND_SPEECH },
371
	{ USB_DEVICE(0x28de, 0x1401), .driver_info = BTUSB_QCA_WCN6855 |
372
						     BTUSB_WIDEBAND_SPEECH },
373

374
	/* QCA WCN785x chipset */
375
	{ USB_DEVICE(0x0cf3, 0xe700), .driver_info = BTUSB_QCA_WCN6855 |
376
						     BTUSB_WIDEBAND_SPEECH },
377
	{ USB_DEVICE(0x0489, 0xe0fc), .driver_info = BTUSB_QCA_WCN6855 |
378
						     BTUSB_WIDEBAND_SPEECH },
379
	{ USB_DEVICE(0x0489, 0xe0f3), .driver_info = BTUSB_QCA_WCN6855 |
380
						     BTUSB_WIDEBAND_SPEECH },
381
	{ USB_DEVICE(0x0489, 0xe100), .driver_info = BTUSB_QCA_WCN6855 |
382
						     BTUSB_WIDEBAND_SPEECH },
383
	{ USB_DEVICE(0x0489, 0xe103), .driver_info = BTUSB_QCA_WCN6855 |
384
						     BTUSB_WIDEBAND_SPEECH },
385
	{ USB_DEVICE(0x0489, 0xe10a), .driver_info = BTUSB_QCA_WCN6855 |
386
						     BTUSB_WIDEBAND_SPEECH },
387
	{ USB_DEVICE(0x0489, 0xe10d), .driver_info = BTUSB_QCA_WCN6855 |
388
						     BTUSB_WIDEBAND_SPEECH },
389
	{ USB_DEVICE(0x0489, 0xe11b), .driver_info = BTUSB_QCA_WCN6855 |
390
						     BTUSB_WIDEBAND_SPEECH },
391
	{ USB_DEVICE(0x0489, 0xe11c), .driver_info = BTUSB_QCA_WCN6855 |
392
						     BTUSB_WIDEBAND_SPEECH },
393
	{ USB_DEVICE(0x0489, 0xe11f), .driver_info = BTUSB_QCA_WCN6855 |
394
						     BTUSB_WIDEBAND_SPEECH },
395
	{ USB_DEVICE(0x0489, 0xe141), .driver_info = BTUSB_QCA_WCN6855 |
396
						     BTUSB_WIDEBAND_SPEECH },
397
	{ USB_DEVICE(0x0489, 0xe14a), .driver_info = BTUSB_QCA_WCN6855 |
398
						     BTUSB_WIDEBAND_SPEECH },
399
	{ USB_DEVICE(0x0489, 0xe14b), .driver_info = BTUSB_QCA_WCN6855 |
400
						     BTUSB_WIDEBAND_SPEECH },
401
	{ USB_DEVICE(0x0489, 0xe14d), .driver_info = BTUSB_QCA_WCN6855 |
402
						     BTUSB_WIDEBAND_SPEECH },
403
	{ USB_DEVICE(0x13d3, 0x3623), .driver_info = BTUSB_QCA_WCN6855 |
404
						     BTUSB_WIDEBAND_SPEECH },
405
	{ USB_DEVICE(0x13d3, 0x3624), .driver_info = BTUSB_QCA_WCN6855 |
406
						     BTUSB_WIDEBAND_SPEECH },
407
	{ USB_DEVICE(0x2c7c, 0x0130), .driver_info = BTUSB_QCA_WCN6855 |
408
						     BTUSB_WIDEBAND_SPEECH },
409
	{ USB_DEVICE(0x2c7c, 0x0131), .driver_info = BTUSB_QCA_WCN6855 |
410
						     BTUSB_WIDEBAND_SPEECH },
411
	{ USB_DEVICE(0x2c7c, 0x0132), .driver_info = BTUSB_QCA_WCN6855 |
412
						     BTUSB_WIDEBAND_SPEECH },
413

414
	/* Broadcom BCM2035 */
415
	{ USB_DEVICE(0x0a5c, 0x2009), .driver_info = BTUSB_BCM92035 },
416
	{ USB_DEVICE(0x0a5c, 0x200a), .driver_info = BTUSB_WRONG_SCO_MTU },
417
	{ USB_DEVICE(0x0a5c, 0x2035), .driver_info = BTUSB_WRONG_SCO_MTU },
418

419
	/* Broadcom BCM2045 */
420
	{ USB_DEVICE(0x0a5c, 0x2039), .driver_info = BTUSB_WRONG_SCO_MTU },
421
	{ USB_DEVICE(0x0a5c, 0x2101), .driver_info = BTUSB_WRONG_SCO_MTU },
422

423
	/* IBM/Lenovo ThinkPad with Broadcom chip */
424
	{ USB_DEVICE(0x0a5c, 0x201e), .driver_info = BTUSB_WRONG_SCO_MTU },
425
	{ USB_DEVICE(0x0a5c, 0x2110), .driver_info = BTUSB_WRONG_SCO_MTU },
426

427
	/* HP laptop with Broadcom chip */
428
	{ USB_DEVICE(0x03f0, 0x171d), .driver_info = BTUSB_WRONG_SCO_MTU },
429

430
	/* Dell laptop with Broadcom chip */
431
	{ USB_DEVICE(0x413c, 0x8126), .driver_info = BTUSB_WRONG_SCO_MTU },
432

433
	/* Dell Wireless 370 and 410 devices */
434
	{ USB_DEVICE(0x413c, 0x8152), .driver_info = BTUSB_WRONG_SCO_MTU },
435
	{ USB_DEVICE(0x413c, 0x8156), .driver_info = BTUSB_WRONG_SCO_MTU },
436

437
	/* Belkin F8T012 and F8T013 devices */
438
	{ USB_DEVICE(0x050d, 0x0012), .driver_info = BTUSB_WRONG_SCO_MTU },
439
	{ USB_DEVICE(0x050d, 0x0013), .driver_info = BTUSB_WRONG_SCO_MTU },
440

441
	/* Asus WL-BTD202 device */
442
	{ USB_DEVICE(0x0b05, 0x1715), .driver_info = BTUSB_WRONG_SCO_MTU },
443

444
	/* Kensington Bluetooth USB adapter */
445
	{ USB_DEVICE(0x047d, 0x105e), .driver_info = BTUSB_WRONG_SCO_MTU },
446

447
	/* RTX Telecom based adapters with buggy SCO support */
448
	{ USB_DEVICE(0x0400, 0x0807), .driver_info = BTUSB_BROKEN_ISOC },
449
	{ USB_DEVICE(0x0400, 0x080a), .driver_info = BTUSB_BROKEN_ISOC },
450

451
	/* CONWISE Technology based adapters with buggy SCO support */
452
	{ USB_DEVICE(0x0e5e, 0x6622),
453
	  .driver_info = BTUSB_BROKEN_ISOC | BTUSB_CW6622},
454

455
	/* Roper Class 1 Bluetooth Dongle (Silicon Wave based) */
456
	{ USB_DEVICE(0x1310, 0x0001), .driver_info = BTUSB_SWAVE },
457

458
	/* Digianswer devices */
459
	{ USB_DEVICE(0x08fd, 0x0001), .driver_info = BTUSB_DIGIANSWER },
460
	{ USB_DEVICE(0x08fd, 0x0002), .driver_info = BTUSB_IGNORE },
461

462
	/* CSR BlueCore Bluetooth Sniffer */
463
	{ USB_DEVICE(0x0a12, 0x0002),
464
	  .driver_info = BTUSB_SNIFFER | BTUSB_BROKEN_ISOC },
465

466
	/* Frontline ComProbe Bluetooth Sniffer */
467
	{ USB_DEVICE(0x16d3, 0x0002),
468
	  .driver_info = BTUSB_SNIFFER | BTUSB_BROKEN_ISOC },
469

470
	/* Marvell Bluetooth devices */
471
	{ USB_DEVICE(0x1286, 0x2044), .driver_info = BTUSB_MARVELL },
472
	{ USB_DEVICE(0x1286, 0x2046), .driver_info = BTUSB_MARVELL },
473
	{ USB_DEVICE(0x1286, 0x204e), .driver_info = BTUSB_MARVELL },
474

475
	/* Intel Bluetooth devices */
476
	{ USB_DEVICE(0x8087, 0x0025), .driver_info = BTUSB_INTEL_COMBINED },
477
	{ USB_DEVICE(0x8087, 0x0026), .driver_info = BTUSB_INTEL_COMBINED },
478
	{ USB_DEVICE(0x8087, 0x0029), .driver_info = BTUSB_INTEL_COMBINED },
479
	{ USB_DEVICE(0x8087, 0x0032), .driver_info = BTUSB_INTEL_COMBINED },
480
	{ USB_DEVICE(0x8087, 0x0033), .driver_info = BTUSB_INTEL_COMBINED },
481
	{ USB_DEVICE(0x8087, 0x0035), .driver_info = BTUSB_INTEL_COMBINED },
482
	{ USB_DEVICE(0x8087, 0x0036), .driver_info = BTUSB_INTEL_COMBINED },
483
	{ USB_DEVICE(0x8087, 0x0037), .driver_info = BTUSB_INTEL_COMBINED },
484
	{ USB_DEVICE(0x8087, 0x0038), .driver_info = BTUSB_INTEL_COMBINED },
485
	{ USB_DEVICE(0x8087, 0x0039), .driver_info = BTUSB_INTEL_COMBINED },
486
	{ USB_DEVICE(0x8087, 0x07da), .driver_info = BTUSB_CSR },
487
	{ USB_DEVICE(0x8087, 0x07dc), .driver_info = BTUSB_INTEL_COMBINED |
488
						     BTUSB_INTEL_NO_WBS_SUPPORT |
489
						     BTUSB_INTEL_BROKEN_INITIAL_NCMD |
490
						     BTUSB_INTEL_BROKEN_SHUTDOWN_LED },
491
	{ USB_DEVICE(0x8087, 0x0a2a), .driver_info = BTUSB_INTEL_COMBINED |
492
						     BTUSB_INTEL_NO_WBS_SUPPORT |
493
						     BTUSB_INTEL_BROKEN_SHUTDOWN_LED },
494
	{ USB_DEVICE(0x8087, 0x0a2b), .driver_info = BTUSB_INTEL_COMBINED },
495
	{ USB_DEVICE(0x8087, 0x0aa7), .driver_info = BTUSB_INTEL_COMBINED |
496
						     BTUSB_INTEL_BROKEN_SHUTDOWN_LED },
497
	{ USB_DEVICE(0x8087, 0x0aaa), .driver_info = BTUSB_INTEL_COMBINED },
498

499
	/* Other Intel Bluetooth devices */
500
	{ USB_VENDOR_AND_INTERFACE_INFO(0x8087, 0xe0, 0x01, 0x01),
501
	  .driver_info = BTUSB_IGNORE },
502

503
	/* Realtek 8821CE Bluetooth devices */
504
	{ USB_DEVICE(0x13d3, 0x3529), .driver_info = BTUSB_REALTEK |
505
						     BTUSB_WIDEBAND_SPEECH },
506

507
	/* Realtek 8822CE Bluetooth devices */
508
	{ USB_DEVICE(0x0bda, 0xb00c), .driver_info = BTUSB_REALTEK |
509
						     BTUSB_WIDEBAND_SPEECH },
510
	{ USB_DEVICE(0x0bda, 0xc822), .driver_info = BTUSB_REALTEK |
511
						     BTUSB_WIDEBAND_SPEECH },
512

513
	/* Realtek 8822CU Bluetooth devices */
514
	{ USB_DEVICE(0x13d3, 0x3549), .driver_info = BTUSB_REALTEK |
515
						     BTUSB_WIDEBAND_SPEECH },
516

517
	/* Realtek 8851BE Bluetooth devices */
518
	{ USB_DEVICE(0x0bda, 0xb850), .driver_info = BTUSB_REALTEK },
519
	{ USB_DEVICE(0x13d3, 0x3600), .driver_info = BTUSB_REALTEK },
520
	{ USB_DEVICE(0x13d3, 0x3601), .driver_info = BTUSB_REALTEK },
521

522
	/* Realtek 8851BU Bluetooth devices */
523
	{ USB_DEVICE(0x3625, 0x010b), .driver_info = BTUSB_REALTEK |
524
						     BTUSB_WIDEBAND_SPEECH },
525

526
	/* Realtek 8852AE Bluetooth devices */
527
	{ USB_DEVICE(0x0bda, 0x2852), .driver_info = BTUSB_REALTEK |
528
						     BTUSB_WIDEBAND_SPEECH },
529
	{ USB_DEVICE(0x0bda, 0xc852), .driver_info = BTUSB_REALTEK |
530
						     BTUSB_WIDEBAND_SPEECH },
531
	{ USB_DEVICE(0x0bda, 0x385a), .driver_info = BTUSB_REALTEK |
532
						     BTUSB_WIDEBAND_SPEECH },
533
	{ USB_DEVICE(0x0bda, 0x4852), .driver_info = BTUSB_REALTEK |
534
						     BTUSB_WIDEBAND_SPEECH },
535
	{ USB_DEVICE(0x04c5, 0x165c), .driver_info = BTUSB_REALTEK |
536
						     BTUSB_WIDEBAND_SPEECH },
537
	{ USB_DEVICE(0x04ca, 0x4006), .driver_info = BTUSB_REALTEK |
538
						     BTUSB_WIDEBAND_SPEECH },
539
	{ USB_DEVICE(0x0cb8, 0xc549), .driver_info = BTUSB_REALTEK |
540
						     BTUSB_WIDEBAND_SPEECH },
541

542
	/* Realtek 8852CE Bluetooth devices */
543
	{ USB_DEVICE(0x04ca, 0x4007), .driver_info = BTUSB_REALTEK |
544
						     BTUSB_WIDEBAND_SPEECH },
545
	{ USB_DEVICE(0x04c5, 0x1675), .driver_info = BTUSB_REALTEK |
546
						     BTUSB_WIDEBAND_SPEECH },
547
	{ USB_DEVICE(0x0cb8, 0xc558), .driver_info = BTUSB_REALTEK |
548
						     BTUSB_WIDEBAND_SPEECH },
549
	{ USB_DEVICE(0x13d3, 0x3587), .driver_info = BTUSB_REALTEK |
550
						     BTUSB_WIDEBAND_SPEECH },
551
	{ USB_DEVICE(0x13d3, 0x3586), .driver_info = BTUSB_REALTEK |
552
						     BTUSB_WIDEBAND_SPEECH },
553
	{ USB_DEVICE(0x13d3, 0x3592), .driver_info = BTUSB_REALTEK |
554
						     BTUSB_WIDEBAND_SPEECH },
555
	{ USB_DEVICE(0x0489, 0xe122), .driver_info = BTUSB_REALTEK |
556
						     BTUSB_WIDEBAND_SPEECH },
557

558
	/* Realtek 8852BE Bluetooth devices */
559
	{ USB_DEVICE(0x0cb8, 0xc559), .driver_info = BTUSB_REALTEK |
560
						     BTUSB_WIDEBAND_SPEECH },
561
	{ USB_DEVICE(0x0bda, 0x4853), .driver_info = BTUSB_REALTEK |
562
						     BTUSB_WIDEBAND_SPEECH },
563
	{ USB_DEVICE(0x0bda, 0x887b), .driver_info = BTUSB_REALTEK |
564
						     BTUSB_WIDEBAND_SPEECH },
565
	{ USB_DEVICE(0x0bda, 0xb85b), .driver_info = BTUSB_REALTEK |
566
						     BTUSB_WIDEBAND_SPEECH },
567
	{ USB_DEVICE(0x13d3, 0x3570), .driver_info = BTUSB_REALTEK |
568
						     BTUSB_WIDEBAND_SPEECH },
569
	{ USB_DEVICE(0x13d3, 0x3571), .driver_info = BTUSB_REALTEK |
570
						     BTUSB_WIDEBAND_SPEECH },
571
	{ USB_DEVICE(0x13d3, 0x3572), .driver_info = BTUSB_REALTEK |
572
						     BTUSB_WIDEBAND_SPEECH },
573
	{ USB_DEVICE(0x13d3, 0x3591), .driver_info = BTUSB_REALTEK |
574
						     BTUSB_WIDEBAND_SPEECH },
575
	{ USB_DEVICE(0x13d3, 0x3618), .driver_info = BTUSB_REALTEK |
576
						     BTUSB_WIDEBAND_SPEECH },
577
	{ USB_DEVICE(0x0489, 0xe123), .driver_info = BTUSB_REALTEK |
578
						     BTUSB_WIDEBAND_SPEECH },
579
	{ USB_DEVICE(0x0489, 0xe125), .driver_info = BTUSB_REALTEK |
580
						     BTUSB_WIDEBAND_SPEECH },
581

582
	/* Realtek 8852BT/8852BE-VT Bluetooth devices */
583
	{ USB_DEVICE(0x0bda, 0x8520), .driver_info = BTUSB_REALTEK |
584
						     BTUSB_WIDEBAND_SPEECH },
585

586
	/* Realtek 8922AE Bluetooth devices */
587
	{ USB_DEVICE(0x0bda, 0x8922), .driver_info = BTUSB_REALTEK |
588
						     BTUSB_WIDEBAND_SPEECH },
589
	{ USB_DEVICE(0x13d3, 0x3617), .driver_info = BTUSB_REALTEK |
590
						     BTUSB_WIDEBAND_SPEECH },
591
	{ USB_DEVICE(0x13d3, 0x3616), .driver_info = BTUSB_REALTEK |
592
						     BTUSB_WIDEBAND_SPEECH },
593
	{ USB_DEVICE(0x0489, 0xe130), .driver_info = BTUSB_REALTEK |
594
						     BTUSB_WIDEBAND_SPEECH },
595

596
	/* Realtek Bluetooth devices */
597
	{ USB_VENDOR_AND_INTERFACE_INFO(0x0bda, 0xe0, 0x01, 0x01),
598
	  .driver_info = BTUSB_REALTEK },
599

600
	/* MediaTek Bluetooth devices */
601
	{ USB_VENDOR_AND_INTERFACE_INFO(0x0e8d, 0xe0, 0x01, 0x01),
602
	  .driver_info = BTUSB_MEDIATEK |
603
			 BTUSB_WIDEBAND_SPEECH },
604

605
	/* Additional MediaTek MT7615E Bluetooth devices */
606
	{ USB_DEVICE(0x13d3, 0x3560), .driver_info = BTUSB_MEDIATEK},
607

608
	/* Additional MediaTek MT7663 Bluetooth devices */
609
	{ USB_DEVICE(0x043e, 0x310c), .driver_info = BTUSB_MEDIATEK |
610
						     BTUSB_WIDEBAND_SPEECH },
611
	{ USB_DEVICE(0x04ca, 0x3801), .driver_info = BTUSB_MEDIATEK |
612
						     BTUSB_WIDEBAND_SPEECH },
613

614
	/* Additional MediaTek MT7668 Bluetooth devices */
615
	{ USB_DEVICE(0x043e, 0x3109), .driver_info = BTUSB_MEDIATEK |
616
						     BTUSB_WIDEBAND_SPEECH },
617

618
	/* Additional MediaTek MT7920 Bluetooth devices */
619
	{ USB_DEVICE(0x0489, 0xe134), .driver_info = BTUSB_MEDIATEK |
620
						     BTUSB_WIDEBAND_SPEECH },
621
	{ USB_DEVICE(0x13d3, 0x3620), .driver_info = BTUSB_MEDIATEK |
622
						     BTUSB_WIDEBAND_SPEECH },
623
	{ USB_DEVICE(0x13d3, 0x3621), .driver_info = BTUSB_MEDIATEK |
624
						     BTUSB_WIDEBAND_SPEECH },
625
	{ USB_DEVICE(0x13d3, 0x3622), .driver_info = BTUSB_MEDIATEK |
626
						     BTUSB_WIDEBAND_SPEECH },
627

628
	/* Additional MediaTek MT7921 Bluetooth devices */
629
	{ USB_DEVICE(0x0489, 0xe0c8), .driver_info = BTUSB_MEDIATEK |
630
						     BTUSB_WIDEBAND_SPEECH },
631
	{ USB_DEVICE(0x0489, 0xe0cd), .driver_info = BTUSB_MEDIATEK |
632
						     BTUSB_WIDEBAND_SPEECH },
633
	{ USB_DEVICE(0x0489, 0xe0e0), .driver_info = BTUSB_MEDIATEK |
634
						     BTUSB_WIDEBAND_SPEECH },
635
	{ USB_DEVICE(0x0489, 0xe0f2), .driver_info = BTUSB_MEDIATEK |
636
						     BTUSB_WIDEBAND_SPEECH },
637
	{ USB_DEVICE(0x04ca, 0x3802), .driver_info = BTUSB_MEDIATEK |
638
						     BTUSB_WIDEBAND_SPEECH },
639
	{ USB_DEVICE(0x0e8d, 0x0608), .driver_info = BTUSB_MEDIATEK |
640
						     BTUSB_WIDEBAND_SPEECH },
641
	{ USB_DEVICE(0x13d3, 0x3563), .driver_info = BTUSB_MEDIATEK |
642
						     BTUSB_WIDEBAND_SPEECH },
643
	{ USB_DEVICE(0x13d3, 0x3564), .driver_info = BTUSB_MEDIATEK |
644
						     BTUSB_WIDEBAND_SPEECH },
645
	{ USB_DEVICE(0x13d3, 0x3567), .driver_info = BTUSB_MEDIATEK |
646
						     BTUSB_WIDEBAND_SPEECH },
647
	{ USB_DEVICE(0x13d3, 0x3576), .driver_info = BTUSB_MEDIATEK |
648
						     BTUSB_WIDEBAND_SPEECH },
649
	{ USB_DEVICE(0x13d3, 0x3578), .driver_info = BTUSB_MEDIATEK |
650
						     BTUSB_WIDEBAND_SPEECH },
651
	{ USB_DEVICE(0x13d3, 0x3583), .driver_info = BTUSB_MEDIATEK |
652
						     BTUSB_WIDEBAND_SPEECH },
653
	{ USB_DEVICE(0x13d3, 0x3606), .driver_info = BTUSB_MEDIATEK |
654
						     BTUSB_WIDEBAND_SPEECH },
655

656
	/* MediaTek MT7922 Bluetooth devices */
657
	{ USB_DEVICE(0x13d3, 0x3585), .driver_info = BTUSB_MEDIATEK |
658
						     BTUSB_WIDEBAND_SPEECH },
659
	{ USB_DEVICE(0x13d3, 0x3610), .driver_info = BTUSB_MEDIATEK |
660
						     BTUSB_WIDEBAND_SPEECH },
661

662
	/* MediaTek MT7922A Bluetooth devices */
663
	{ USB_DEVICE(0x0489, 0xe0d8), .driver_info = BTUSB_MEDIATEK |
664
						     BTUSB_WIDEBAND_SPEECH },
665
	{ USB_DEVICE(0x0489, 0xe0d9), .driver_info = BTUSB_MEDIATEK |
666
						     BTUSB_WIDEBAND_SPEECH },
667
	{ USB_DEVICE(0x0489, 0xe0e2), .driver_info = BTUSB_MEDIATEK |
668
						     BTUSB_WIDEBAND_SPEECH },
669
	{ USB_DEVICE(0x0489, 0xe0e4), .driver_info = BTUSB_MEDIATEK |
670
						     BTUSB_WIDEBAND_SPEECH },
671
	{ USB_DEVICE(0x0489, 0xe0f1), .driver_info = BTUSB_MEDIATEK |
672
						     BTUSB_WIDEBAND_SPEECH },
673
	{ USB_DEVICE(0x0489, 0xe0f2), .driver_info = BTUSB_MEDIATEK |
674
						     BTUSB_WIDEBAND_SPEECH },
675
	{ USB_DEVICE(0x0489, 0xe0f5), .driver_info = BTUSB_MEDIATEK |
676
						     BTUSB_WIDEBAND_SPEECH },
677
	{ USB_DEVICE(0x0489, 0xe0f6), .driver_info = BTUSB_MEDIATEK |
678
						     BTUSB_WIDEBAND_SPEECH },
679
	{ USB_DEVICE(0x0489, 0xe102), .driver_info = BTUSB_MEDIATEK |
680
						     BTUSB_WIDEBAND_SPEECH },
681
	{ USB_DEVICE(0x0489, 0xe152), .driver_info = BTUSB_MEDIATEK |
682
						     BTUSB_WIDEBAND_SPEECH },
683
	{ USB_DEVICE(0x0489, 0xe153), .driver_info = BTUSB_MEDIATEK |
684
						     BTUSB_WIDEBAND_SPEECH },
685
	{ USB_DEVICE(0x04ca, 0x3804), .driver_info = BTUSB_MEDIATEK |
686
						     BTUSB_WIDEBAND_SPEECH },
687
	{ USB_DEVICE(0x04ca, 0x38e4), .driver_info = BTUSB_MEDIATEK |
688
						     BTUSB_WIDEBAND_SPEECH },
689
	{ USB_DEVICE(0x13d3, 0x3568), .driver_info = BTUSB_MEDIATEK |
690
						     BTUSB_WIDEBAND_SPEECH },
691
	{ USB_DEVICE(0x13d3, 0x3584), .driver_info = BTUSB_MEDIATEK |
692
						     BTUSB_WIDEBAND_SPEECH },
693
	{ USB_DEVICE(0x13d3, 0x3605), .driver_info = BTUSB_MEDIATEK |
694
						     BTUSB_WIDEBAND_SPEECH },
695
	{ USB_DEVICE(0x13d3, 0x3607), .driver_info = BTUSB_MEDIATEK |
696
						     BTUSB_WIDEBAND_SPEECH },
697
	{ USB_DEVICE(0x13d3, 0x3614), .driver_info = BTUSB_MEDIATEK |
698
						     BTUSB_WIDEBAND_SPEECH },
699
	{ USB_DEVICE(0x13d3, 0x3615), .driver_info = BTUSB_MEDIATEK |
700
						     BTUSB_WIDEBAND_SPEECH },
701
	{ USB_DEVICE(0x35f5, 0x7922), .driver_info = BTUSB_MEDIATEK |
702
						     BTUSB_WIDEBAND_SPEECH },
703

704
	/* Additional MediaTek MT7925 Bluetooth devices */
705
	{ USB_DEVICE(0x0489, 0xe111), .driver_info = BTUSB_MEDIATEK |
706
						     BTUSB_WIDEBAND_SPEECH },
707
	{ USB_DEVICE(0x0489, 0xe113), .driver_info = BTUSB_MEDIATEK |
708
						     BTUSB_WIDEBAND_SPEECH },
709
	{ USB_DEVICE(0x0489, 0xe118), .driver_info = BTUSB_MEDIATEK |
710
						     BTUSB_WIDEBAND_SPEECH },
711
	{ USB_DEVICE(0x0489, 0xe11e), .driver_info = BTUSB_MEDIATEK |
712
						     BTUSB_WIDEBAND_SPEECH },
713
	{ USB_DEVICE(0x0489, 0xe124), .driver_info = BTUSB_MEDIATEK |
714
						     BTUSB_WIDEBAND_SPEECH },
715
	{ USB_DEVICE(0x0489, 0xe139), .driver_info = BTUSB_MEDIATEK |
716
						     BTUSB_WIDEBAND_SPEECH },
717
	{ USB_DEVICE(0x0489, 0xe14e), .driver_info = BTUSB_MEDIATEK |
718
						     BTUSB_WIDEBAND_SPEECH },
719
	{ USB_DEVICE(0x0489, 0xe14f), .driver_info = BTUSB_MEDIATEK |
720
						     BTUSB_WIDEBAND_SPEECH },
721
	{ USB_DEVICE(0x0489, 0xe150), .driver_info = BTUSB_MEDIATEK |
722
						     BTUSB_WIDEBAND_SPEECH },
723
	{ USB_DEVICE(0x0489, 0xe151), .driver_info = BTUSB_MEDIATEK |
724
						     BTUSB_WIDEBAND_SPEECH },
725
	{ USB_DEVICE(0x13d3, 0x3602), .driver_info = BTUSB_MEDIATEK |
726
						     BTUSB_WIDEBAND_SPEECH },
727
	{ USB_DEVICE(0x13d3, 0x3603), .driver_info = BTUSB_MEDIATEK |
728
						     BTUSB_WIDEBAND_SPEECH },
729
	{ USB_DEVICE(0x13d3, 0x3604), .driver_info = BTUSB_MEDIATEK |
730
						     BTUSB_WIDEBAND_SPEECH },
731
	{ USB_DEVICE(0x13d3, 0x3608), .driver_info = BTUSB_MEDIATEK |
732
						     BTUSB_WIDEBAND_SPEECH },
733
	{ USB_DEVICE(0x13d3, 0x3613), .driver_info = BTUSB_MEDIATEK |
734
						     BTUSB_WIDEBAND_SPEECH },
735
	{ USB_DEVICE(0x13d3, 0x3628), .driver_info = BTUSB_MEDIATEK |
736
						     BTUSB_WIDEBAND_SPEECH },
737
	{ USB_DEVICE(0x13d3, 0x3630), .driver_info = BTUSB_MEDIATEK |
738
						     BTUSB_WIDEBAND_SPEECH },
739
	{ USB_DEVICE(0x2c7c, 0x7009), .driver_info = BTUSB_MEDIATEK |
740
						     BTUSB_WIDEBAND_SPEECH },
741

742
	/* Additional Realtek 8723AE Bluetooth devices */
743
	{ USB_DEVICE(0x0930, 0x021d), .driver_info = BTUSB_REALTEK },
744
	{ USB_DEVICE(0x13d3, 0x3394), .driver_info = BTUSB_REALTEK },
745

746
	/* Additional Realtek 8723BE Bluetooth devices */
747
	{ USB_DEVICE(0x0489, 0xe085), .driver_info = BTUSB_REALTEK },
748
	{ USB_DEVICE(0x0489, 0xe08b), .driver_info = BTUSB_REALTEK },
749
	{ USB_DEVICE(0x04f2, 0xb49f), .driver_info = BTUSB_REALTEK },
750
	{ USB_DEVICE(0x13d3, 0x3410), .driver_info = BTUSB_REALTEK },
751
	{ USB_DEVICE(0x13d3, 0x3416), .driver_info = BTUSB_REALTEK },
752
	{ USB_DEVICE(0x13d3, 0x3459), .driver_info = BTUSB_REALTEK },
753
	{ USB_DEVICE(0x13d3, 0x3494), .driver_info = BTUSB_REALTEK },
754

755
	/* Additional Realtek 8723BU Bluetooth devices */
756
	{ USB_DEVICE(0x7392, 0xa611), .driver_info = BTUSB_REALTEK },
757

758
	/* Additional Realtek 8723DE Bluetooth devices */
759
	{ USB_DEVICE(0x0bda, 0xb009), .driver_info = BTUSB_REALTEK },
760
	{ USB_DEVICE(0x2ff8, 0xb011), .driver_info = BTUSB_REALTEK },
761

762
	/* Additional Realtek 8761BUV Bluetooth devices */
763
	{ USB_DEVICE(0x2357, 0x0604), .driver_info = BTUSB_REALTEK |
764
						     BTUSB_WIDEBAND_SPEECH },
765
	{ USB_DEVICE(0x0b05, 0x190e), .driver_info = BTUSB_REALTEK |
766
	  					     BTUSB_WIDEBAND_SPEECH },
767
	{ USB_DEVICE(0x2550, 0x8761), .driver_info = BTUSB_REALTEK |
768
						     BTUSB_WIDEBAND_SPEECH },
769
	{ USB_DEVICE(0x0bda, 0x8771), .driver_info = BTUSB_REALTEK |
770
						     BTUSB_WIDEBAND_SPEECH },
771
	{ USB_DEVICE(0x6655, 0x8771), .driver_info = BTUSB_REALTEK |
772
						     BTUSB_WIDEBAND_SPEECH },
773
	{ USB_DEVICE(0x7392, 0xc611), .driver_info = BTUSB_REALTEK |
774
						     BTUSB_WIDEBAND_SPEECH },
775
	{ USB_DEVICE(0x2b89, 0x8761), .driver_info = BTUSB_REALTEK |
776
						     BTUSB_WIDEBAND_SPEECH },
777

778
	/* Additional Realtek 8821AE Bluetooth devices */
779
	{ USB_DEVICE(0x0b05, 0x17dc), .driver_info = BTUSB_REALTEK },
780
	{ USB_DEVICE(0x13d3, 0x3414), .driver_info = BTUSB_REALTEK },
781
	{ USB_DEVICE(0x13d3, 0x3458), .driver_info = BTUSB_REALTEK },
782
	{ USB_DEVICE(0x13d3, 0x3461), .driver_info = BTUSB_REALTEK },
783
	{ USB_DEVICE(0x13d3, 0x3462), .driver_info = BTUSB_REALTEK },
784

785
	/* Additional Realtek 8822BE Bluetooth devices */
786
	{ USB_DEVICE(0x13d3, 0x3526), .driver_info = BTUSB_REALTEK },
787
	{ USB_DEVICE(0x0b05, 0x185c), .driver_info = BTUSB_REALTEK },
788

789
	/* Additional Realtek 8822CE Bluetooth devices */
790
	{ USB_DEVICE(0x04ca, 0x4005), .driver_info = BTUSB_REALTEK |
791
						     BTUSB_WIDEBAND_SPEECH },
792
	{ USB_DEVICE(0x04c5, 0x161f), .driver_info = BTUSB_REALTEK |
793
						     BTUSB_WIDEBAND_SPEECH },
794
	{ USB_DEVICE(0x0b05, 0x18ef), .driver_info = BTUSB_REALTEK |
795
						     BTUSB_WIDEBAND_SPEECH },
796
	{ USB_DEVICE(0x13d3, 0x3548), .driver_info = BTUSB_REALTEK |
797
						     BTUSB_WIDEBAND_SPEECH },
798
	{ USB_DEVICE(0x13d3, 0x3549), .driver_info = BTUSB_REALTEK |
799
						     BTUSB_WIDEBAND_SPEECH },
800
	{ USB_DEVICE(0x13d3, 0x3553), .driver_info = BTUSB_REALTEK |
801
						     BTUSB_WIDEBAND_SPEECH },
802
	{ USB_DEVICE(0x13d3, 0x3555), .driver_info = BTUSB_REALTEK |
803
						     BTUSB_WIDEBAND_SPEECH },
804
	{ USB_DEVICE(0x2ff8, 0x3051), .driver_info = BTUSB_REALTEK |
805
						     BTUSB_WIDEBAND_SPEECH },
806
	{ USB_DEVICE(0x1358, 0xc123), .driver_info = BTUSB_REALTEK |
807
						     BTUSB_WIDEBAND_SPEECH },
808
	{ USB_DEVICE(0x0bda, 0xc123), .driver_info = BTUSB_REALTEK |
809
						     BTUSB_WIDEBAND_SPEECH },
810
	{ USB_DEVICE(0x0cb5, 0xc547), .driver_info = BTUSB_REALTEK |
811
						     BTUSB_WIDEBAND_SPEECH },
812

813
	/* Actions Semiconductor ATS2851 based devices */
814
	{ USB_DEVICE(0x10d7, 0xb012), .driver_info = BTUSB_ACTIONS_SEMI },
815

816
	/* Silicon Wave based devices */
817
	{ USB_DEVICE(0x0c10, 0x0000), .driver_info = BTUSB_SWAVE },
818

819
	{ }	/* Terminating entry */
820
};
821

822
/* The Bluetooth USB module build into some devices needs to be reset on resume,
823
 * this is a problem with the platform (likely shutting off all power) not with
824
 * the module itself. So we use a DMI list to match known broken platforms.
825
 */
826
static const struct dmi_system_id btusb_needs_reset_resume_table[] = {
827
	{
828
		/* Dell OptiPlex 3060 (QCA ROME device 0cf3:e007) */
829
		.matches = {
830
			DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."),
831
			DMI_MATCH(DMI_PRODUCT_NAME, "OptiPlex 3060"),
832
		},
833
	},
834
	{
835
		/* Dell XPS 9360 (QCA ROME device 0cf3:e300) */
836
		.matches = {
837
			DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."),
838
			DMI_MATCH(DMI_PRODUCT_NAME, "XPS 13 9360"),
839
		},
840
	},
841
	{
842
		/* Dell Inspiron 5565 (QCA ROME device 0cf3:e009) */
843
		.matches = {
844
			DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."),
845
			DMI_MATCH(DMI_PRODUCT_NAME, "Inspiron 5565"),
846
		},
847
	},
848
	{}
849
};
850

851
struct qca_dump_info {
852
	/* fields for dump collection */
853
	u16 id_vendor;
854
	u16 id_product;
855
	u32 fw_version;
856
	u32 controller_id;
857
	u32 ram_dump_size;
858
	u16 ram_dump_seqno;
859
};
860

861
#define BTUSB_MAX_ISOC_FRAMES	10
862

863
#define BTUSB_INTR_RUNNING	0
864
#define BTUSB_BULK_RUNNING	1
865
#define BTUSB_ISOC_RUNNING	2
866
#define BTUSB_SUSPENDING	3
867
#define BTUSB_DID_ISO_RESUME	4
868
#define BTUSB_BOOTLOADER	5
869
#define BTUSB_DOWNLOADING	6
870
#define BTUSB_FIRMWARE_LOADED	7
871
#define BTUSB_FIRMWARE_FAILED	8
872
#define BTUSB_BOOTING		9
873
#define BTUSB_DIAG_RUNNING	10
874
#define BTUSB_OOB_WAKE_ENABLED	11
875
#define BTUSB_HW_RESET_ACTIVE	12
876
#define BTUSB_TX_WAIT_VND_EVT	13
877
#define BTUSB_WAKEUP_AUTOSUSPEND	14
878
#define BTUSB_USE_ALT3_FOR_WBS	15
879
#define BTUSB_ALT6_CONTINUOUS_TX	16
880
#define BTUSB_HW_SSR_ACTIVE	17
881

882
struct btusb_data {
883
	struct hci_dev       *hdev;
884
	struct usb_device    *udev;
885
	struct usb_interface *intf;
886
	struct usb_interface *isoc;
887
	struct usb_interface *diag;
888
	unsigned isoc_ifnum;
889

890
	unsigned long flags;
891

892
	bool poll_sync;
893
	int intr_interval;
894
	struct work_struct  work;
895
	struct work_struct  waker;
896
	struct delayed_work rx_work;
897

898
	struct sk_buff_head acl_q;
899

900
	struct usb_anchor deferred;
901
	struct usb_anchor tx_anchor;
902
	int tx_in_flight;
903
	spinlock_t txlock;
904

905
	struct usb_anchor intr_anchor;
906
	struct usb_anchor bulk_anchor;
907
	struct usb_anchor isoc_anchor;
908
	struct usb_anchor diag_anchor;
909
	struct usb_anchor ctrl_anchor;
910
	spinlock_t rxlock;
911

912
	struct sk_buff *evt_skb;
913
	struct sk_buff *acl_skb;
914
	struct sk_buff *sco_skb;
915

916
	struct usb_endpoint_descriptor *intr_ep;
917
	struct usb_endpoint_descriptor *bulk_tx_ep;
918
	struct usb_endpoint_descriptor *bulk_rx_ep;
919
	struct usb_endpoint_descriptor *isoc_tx_ep;
920
	struct usb_endpoint_descriptor *isoc_rx_ep;
921
	struct usb_endpoint_descriptor *diag_tx_ep;
922
	struct usb_endpoint_descriptor *diag_rx_ep;
923

924
	struct gpio_desc *reset_gpio;
925

926
	__u8 cmdreq_type;
927
	__u8 cmdreq;
928

929
	unsigned int sco_num;
930
	unsigned int air_mode;
931
	bool usb_alt6_packet_flow;
932
	int isoc_altsetting;
933
	int suspend_count;
934

935
	int (*recv_event)(struct hci_dev *hdev, struct sk_buff *skb);
936
	int (*recv_acl)(struct hci_dev *hdev, struct sk_buff *skb);
937
	int (*recv_bulk)(struct btusb_data *data, void *buffer, int count);
938

939
	int (*setup_on_usb)(struct hci_dev *hdev);
940

941
	int (*suspend)(struct hci_dev *hdev);
942
	int (*resume)(struct hci_dev *hdev);
943
	int (*disconnect)(struct hci_dev *hdev);
944

945
	int oob_wake_irq;   /* irq for out-of-band wake-on-bt */
946

947
	struct qca_dump_info qca_dump;
948
};
949

950
static void btusb_reset(struct hci_dev *hdev)
951
{
952
	struct btusb_data *data;
953
	int err;
954

955
	data = hci_get_drvdata(hdev);
956
	/* This is not an unbalanced PM reference since the device will reset */
957
	err = usb_autopm_get_interface(data->intf);
958
	if (err) {
959
		bt_dev_err(hdev, "Failed usb_autopm_get_interface: %d", err);
960
		return;
961
	}
962

963
	bt_dev_err(hdev, "Resetting usb device.");
964
	usb_queue_reset_device(data->intf);
965
}
966

967
static void btusb_intel_reset(struct hci_dev *hdev)
968
{
969
	struct btusb_data *data = hci_get_drvdata(hdev);
970
	struct gpio_desc *reset_gpio = data->reset_gpio;
971
	struct btintel_data *intel_data = hci_get_priv(hdev);
972

973
	if (intel_data->acpi_reset_method) {
974
		if (test_and_set_bit(INTEL_ACPI_RESET_ACTIVE, intel_data->flags)) {
975
			bt_dev_err(hdev, "acpi: last reset failed ? Not resetting again");
976
			return;
977
		}
978

979
		bt_dev_err(hdev, "Initiating acpi reset method");
980
		/* If ACPI reset method fails, lets try with legacy GPIO
981
		 * toggling
982
		 */
983
		if (!intel_data->acpi_reset_method(hdev)) {
984
			return;
985
		}
986
	}
987

988
	if (!reset_gpio) {
989
		btusb_reset(hdev);
990
		return;
991
	}
992

993
	/*
994
	 * Toggle the hard reset line if the platform provides one. The reset
995
	 * is going to yank the device off the USB and then replug. So doing
996
	 * once is enough. The cleanup is handled correctly on the way out
997
	 * (standard USB disconnect), and the new device is detected cleanly
998
	 * and bound to the driver again like it should be.
999
	 */
1000
	if (test_and_set_bit(BTUSB_HW_RESET_ACTIVE, &data->flags)) {
1001
		bt_dev_err(hdev, "last reset failed? Not resetting again");
1002
		return;
1003
	}
1004

1005
	bt_dev_err(hdev, "Initiating HW reset via gpio");
1006
	gpiod_set_value_cansleep(reset_gpio, 1);
1007
	msleep(100);
1008
	gpiod_set_value_cansleep(reset_gpio, 0);
1009
}
1010

1011
#define RTK_DEVCOREDUMP_CODE_MEMDUMP		0x01
1012
#define RTK_DEVCOREDUMP_CODE_HW_ERR		0x02
1013
#define RTK_DEVCOREDUMP_CODE_CMD_TIMEOUT	0x03
1014

1015
#define RTK_SUB_EVENT_CODE_COREDUMP		0x34
1016

1017
struct rtk_dev_coredump_hdr {
1018
	u8 type;
1019
	u8 code;
1020
	u8 reserved[2];
1021
} __packed;
1022

1023
static inline void btusb_rtl_alloc_devcoredump(struct hci_dev *hdev,
1024
		struct rtk_dev_coredump_hdr *hdr, u8 *buf, u32 len)
1025
{
1026
	struct sk_buff *skb;
1027

1028
	skb = alloc_skb(len + sizeof(*hdr), GFP_ATOMIC);
1029
	if (!skb)
1030
		return;
1031

1032
	skb_put_data(skb, hdr, sizeof(*hdr));
1033
	if (len)
1034
		skb_put_data(skb, buf, len);
1035

1036
	if (!hci_devcd_init(hdev, skb->len)) {
1037
		hci_devcd_append(hdev, skb);
1038
		hci_devcd_complete(hdev);
1039
	} else {
1040
		bt_dev_err(hdev, "RTL: Failed to generate devcoredump");
1041
		kfree_skb(skb);
1042
	}
1043
}
1044

1045
static void btusb_rtl_reset(struct hci_dev *hdev)
1046
{
1047
	struct btusb_data *data = hci_get_drvdata(hdev);
1048
	struct gpio_desc *reset_gpio = data->reset_gpio;
1049
	struct rtk_dev_coredump_hdr hdr = {
1050
		.type = RTK_DEVCOREDUMP_CODE_CMD_TIMEOUT,
1051
	};
1052

1053
	btusb_rtl_alloc_devcoredump(hdev, &hdr, NULL, 0);
1054

1055
	if (!reset_gpio) {
1056
		btusb_reset(hdev);
1057
		return;
1058
	}
1059

1060
	/* Toggle the hard reset line. The Realtek device is going to
1061
	 * yank itself off the USB and then replug. The cleanup is handled
1062
	 * correctly on the way out (standard USB disconnect), and the new
1063
	 * device is detected cleanly and bound to the driver again like
1064
	 * it should be.
1065
	 */
1066
	if (test_and_set_bit(BTUSB_HW_RESET_ACTIVE, &data->flags)) {
1067
		bt_dev_err(hdev, "last reset failed? Not resetting again");
1068
		return;
1069
	}
1070

1071
	bt_dev_err(hdev, "Reset Realtek device via gpio");
1072
	gpiod_set_value_cansleep(reset_gpio, 1);
1073
	msleep(200);
1074
	gpiod_set_value_cansleep(reset_gpio, 0);
1075
}
1076

1077
static void btusb_rtl_hw_error(struct hci_dev *hdev, u8 code)
1078
{
1079
	struct rtk_dev_coredump_hdr hdr = {
1080
		.type = RTK_DEVCOREDUMP_CODE_HW_ERR,
1081
		.code = code,
1082
	};
1083

1084
	bt_dev_err(hdev, "RTL: hw err, trigger devcoredump (%d)", code);
1085

1086
	btusb_rtl_alloc_devcoredump(hdev, &hdr, NULL, 0);
1087
}
1088

1089
static void btusb_qca_reset(struct hci_dev *hdev)
1090
{
1091
	struct btusb_data *data = hci_get_drvdata(hdev);
1092
	struct gpio_desc *reset_gpio = data->reset_gpio;
1093

1094
	if (test_bit(BTUSB_HW_SSR_ACTIVE, &data->flags)) {
1095
		bt_dev_info(hdev, "Ramdump in progress, defer reset");
1096
		return;
1097
	}
1098

1099
	if (reset_gpio) {
1100
		bt_dev_err(hdev, "Reset qca device via bt_en gpio");
1101

1102
		/* Toggle the hard reset line. The qca bt device is going to
1103
		 * yank itself off the USB and then replug. The cleanup is handled
1104
		 * correctly on the way out (standard USB disconnect), and the new
1105
		 * device is detected cleanly and bound to the driver again like
1106
		 * it should be.
1107
		 */
1108
		if (test_and_set_bit(BTUSB_HW_RESET_ACTIVE, &data->flags)) {
1109
			bt_dev_err(hdev, "last reset failed? Not resetting again");
1110
			return;
1111
		}
1112

1113
		gpiod_set_value_cansleep(reset_gpio, 0);
1114
		msleep(200);
1115
		gpiod_set_value_cansleep(reset_gpio, 1);
1116

1117
		return;
1118
	}
1119

1120
	btusb_reset(hdev);
1121
}
1122

1123
static inline void btusb_free_frags(struct btusb_data *data)
1124
{
1125
	unsigned long flags;
1126

1127
	spin_lock_irqsave(&data->rxlock, flags);
1128

1129
	dev_kfree_skb_irq(data->evt_skb);
1130
	data->evt_skb = NULL;
1131

1132
	dev_kfree_skb_irq(data->acl_skb);
1133
	data->acl_skb = NULL;
1134

1135
	dev_kfree_skb_irq(data->sco_skb);
1136
	data->sco_skb = NULL;
1137

1138
	spin_unlock_irqrestore(&data->rxlock, flags);
1139
}
1140

1141
static int btusb_recv_event(struct btusb_data *data, struct sk_buff *skb)
1142
{
1143
	if (data->intr_interval) {
1144
		/* Trigger dequeue immediately if an event is received */
1145
		schedule_delayed_work(&data->rx_work, 0);
1146
	}
1147

1148
	return data->recv_event(data->hdev, skb);
1149
}
1150

1151
static int btusb_recv_intr(struct btusb_data *data, void *buffer, int count)
1152
{
1153
	struct sk_buff *skb;
1154
	unsigned long flags;
1155
	int err = 0;
1156

1157
	spin_lock_irqsave(&data->rxlock, flags);
1158
	skb = data->evt_skb;
1159

1160
	while (count) {
1161
		int len;
1162

1163
		if (!skb) {
1164
			skb = bt_skb_alloc(HCI_MAX_EVENT_SIZE, GFP_ATOMIC);
1165
			if (!skb) {
1166
				err = -ENOMEM;
1167
				break;
1168
			}
1169

1170
			hci_skb_pkt_type(skb) = HCI_EVENT_PKT;
1171
			hci_skb_expect(skb) = HCI_EVENT_HDR_SIZE;
1172
		}
1173

1174
		len = min_t(uint, hci_skb_expect(skb), count);
1175
		skb_put_data(skb, buffer, len);
1176

1177
		count -= len;
1178
		buffer += len;
1179
		hci_skb_expect(skb) -= len;
1180

1181
		if (skb->len == HCI_EVENT_HDR_SIZE) {
1182
			/* Complete event header */
1183
			hci_skb_expect(skb) = hci_event_hdr(skb)->plen;
1184

1185
			if (skb_tailroom(skb) < hci_skb_expect(skb)) {
1186
				kfree_skb(skb);
1187
				skb = NULL;
1188

1189
				err = -EILSEQ;
1190
				break;
1191
			}
1192
		}
1193

1194
		if (!hci_skb_expect(skb)) {
1195
			/* Complete frame */
1196
			btusb_recv_event(data, skb);
1197
			skb = NULL;
1198
		}
1199
	}
1200

1201
	data->evt_skb = skb;
1202
	spin_unlock_irqrestore(&data->rxlock, flags);
1203

1204
	return err;
1205
}
1206

1207
static int btusb_recv_acl(struct btusb_data *data, struct sk_buff *skb)
1208
{
1209
	/* Only queue ACL packet if intr_interval is set as it means
1210
	 * force_poll_sync has been enabled.
1211
	 */
1212
	if (!data->intr_interval)
1213
		return data->recv_acl(data->hdev, skb);
1214

1215
	skb_queue_tail(&data->acl_q, skb);
1216
	schedule_delayed_work(&data->rx_work, data->intr_interval);
1217

1218
	return 0;
1219
}
1220

1221
static int btusb_recv_bulk(struct btusb_data *data, void *buffer, int count)
1222
{
1223
	struct sk_buff *skb;
1224
	unsigned long flags;
1225
	int err = 0;
1226

1227
	spin_lock_irqsave(&data->rxlock, flags);
1228
	skb = data->acl_skb;
1229

1230
	while (count) {
1231
		int len;
1232

1233
		if (!skb) {
1234
			skb = bt_skb_alloc(HCI_MAX_FRAME_SIZE, GFP_ATOMIC);
1235
			if (!skb) {
1236
				err = -ENOMEM;
1237
				break;
1238
			}
1239

1240
			hci_skb_pkt_type(skb) = HCI_ACLDATA_PKT;
1241
			hci_skb_expect(skb) = HCI_ACL_HDR_SIZE;
1242
		}
1243

1244
		len = min_t(uint, hci_skb_expect(skb), count);
1245
		skb_put_data(skb, buffer, len);
1246

1247
		count -= len;
1248
		buffer += len;
1249
		hci_skb_expect(skb) -= len;
1250

1251
		if (skb->len == HCI_ACL_HDR_SIZE) {
1252
			__le16 dlen = hci_acl_hdr(skb)->dlen;
1253

1254
			/* Complete ACL header */
1255
			hci_skb_expect(skb) = __le16_to_cpu(dlen);
1256

1257
			if (skb_tailroom(skb) < hci_skb_expect(skb)) {
1258
				kfree_skb(skb);
1259
				skb = NULL;
1260

1261
				err = -EILSEQ;
1262
				break;
1263
			}
1264
		}
1265

1266
		if (!hci_skb_expect(skb)) {
1267
			/* Complete frame */
1268
			btusb_recv_acl(data, skb);
1269
			skb = NULL;
1270
		}
1271
	}
1272

1273
	data->acl_skb = skb;
1274
	spin_unlock_irqrestore(&data->rxlock, flags);
1275

1276
	return err;
1277
}
1278

1279
static bool btusb_validate_sco_handle(struct hci_dev *hdev,
1280
				      struct hci_sco_hdr *hdr)
1281
{
1282
	__u16 handle;
1283

1284
	if (hci_dev_test_flag(hdev, HCI_USER_CHANNEL))
1285
		// Can't validate, userspace controls everything.
1286
		return true;
1287

1288
	/*
1289
	 * USB isochronous transfers are not designed to be reliable and may
1290
	 * lose fragments.  When this happens, the next first fragment
1291
	 * encountered might actually be a continuation fragment.
1292
	 * Validate the handle to detect it and drop it, or else the upper
1293
	 * layer will get garbage for a while.
1294
	 */
1295

1296
	handle = hci_handle(__le16_to_cpu(hdr->handle));
1297

1298
	switch (hci_conn_lookup_type(hdev, handle)) {
1299
	case SCO_LINK:
1300
	case ESCO_LINK:
1301
		return true;
1302
	default:
1303
		return false;
1304
	}
1305
}
1306

1307
static int btusb_recv_isoc(struct btusb_data *data, void *buffer, int count)
1308
{
1309
	struct sk_buff *skb;
1310
	unsigned long flags;
1311
	int err = 0;
1312

1313
	spin_lock_irqsave(&data->rxlock, flags);
1314
	skb = data->sco_skb;
1315

1316
	while (count) {
1317
		int len;
1318

1319
		if (!skb) {
1320
			skb = bt_skb_alloc(HCI_MAX_SCO_SIZE, GFP_ATOMIC);
1321
			if (!skb) {
1322
				err = -ENOMEM;
1323
				break;
1324
			}
1325

1326
			hci_skb_pkt_type(skb) = HCI_SCODATA_PKT;
1327
			hci_skb_expect(skb) = HCI_SCO_HDR_SIZE;
1328
		}
1329

1330
		len = min_t(uint, hci_skb_expect(skb), count);
1331
		skb_put_data(skb, buffer, len);
1332

1333
		count -= len;
1334
		buffer += len;
1335
		hci_skb_expect(skb) -= len;
1336

1337
		if (skb->len == HCI_SCO_HDR_SIZE) {
1338
			/* Complete SCO header */
1339
			struct hci_sco_hdr *hdr = hci_sco_hdr(skb);
1340

1341
			hci_skb_expect(skb) = hdr->dlen;
1342

1343
			if (skb_tailroom(skb) < hci_skb_expect(skb) ||
1344
			    !btusb_validate_sco_handle(data->hdev, hdr)) {
1345
				kfree_skb(skb);
1346
				skb = NULL;
1347

1348
				err = -EILSEQ;
1349
				break;
1350
			}
1351
		}
1352

1353
		if (!hci_skb_expect(skb)) {
1354
			/* Complete frame */
1355
			hci_recv_frame(data->hdev, skb);
1356
			skb = NULL;
1357
		}
1358
	}
1359

1360
	data->sco_skb = skb;
1361
	spin_unlock_irqrestore(&data->rxlock, flags);
1362

1363
	return err;
1364
}
1365

1366
static void btusb_intr_complete(struct urb *urb)
1367
{
1368
	struct hci_dev *hdev = urb->context;
1369
	struct btusb_data *data = hci_get_drvdata(hdev);
1370
	int err;
1371

1372
	BT_DBG("%s urb %p status %d count %d", hdev->name, urb, urb->status,
1373
	       urb->actual_length);
1374

1375
	if (!test_bit(HCI_RUNNING, &hdev->flags))
1376
		return;
1377

1378
	if (urb->status == 0) {
1379
		hdev->stat.byte_rx += urb->actual_length;
1380

1381
		if (btusb_recv_intr(data, urb->transfer_buffer,
1382
				    urb->actual_length) < 0) {
1383
			bt_dev_err(hdev, "corrupted event packet");
1384
			hdev->stat.err_rx++;
1385
		}
1386
	} else if (urb->status == -ENOENT) {
1387
		/* Avoid suspend failed when usb_kill_urb */
1388
		return;
1389
	}
1390

1391
	if (!test_bit(BTUSB_INTR_RUNNING, &data->flags))
1392
		return;
1393

1394
	usb_mark_last_busy(data->udev);
1395
	usb_anchor_urb(urb, &data->intr_anchor);
1396

1397
	err = usb_submit_urb(urb, GFP_ATOMIC);
1398
	if (err < 0) {
1399
		/* -EPERM: urb is being killed;
1400
		 * -ENODEV: device got disconnected
1401
		 */
1402
		if (err != -EPERM && err != -ENODEV)
1403
			bt_dev_err(hdev, "urb %p failed to resubmit (%d)",
1404
				   urb, -err);
1405
		if (err != -EPERM)
1406
			hci_cmd_sync_cancel(hdev, -err);
1407
		usb_unanchor_urb(urb);
1408
	}
1409
}
1410

1411
static int btusb_submit_intr_urb(struct hci_dev *hdev, gfp_t mem_flags)
1412
{
1413
	struct btusb_data *data = hci_get_drvdata(hdev);
1414
	struct urb *urb;
1415
	unsigned char *buf;
1416
	unsigned int pipe;
1417
	int err, size;
1418

1419
	BT_DBG("%s", hdev->name);
1420

1421
	if (!data->intr_ep)
1422
		return -ENODEV;
1423

1424
	urb = usb_alloc_urb(0, mem_flags);
1425
	if (!urb)
1426
		return -ENOMEM;
1427

1428
	if (le16_to_cpu(data->udev->descriptor.idVendor)  == 0x0a12 &&
1429
	    le16_to_cpu(data->udev->descriptor.idProduct) == 0x0001)
1430
		/* Fake CSR devices don't seem to support sort-transter */
1431
		size = le16_to_cpu(data->intr_ep->wMaxPacketSize);
1432
	else
1433
		/* Use maximum HCI Event size so the USB stack handles
1434
		 * ZPL/short-transfer automatically.
1435
		 */
1436
		size = HCI_MAX_EVENT_SIZE;
1437

1438
	buf = kmalloc(size, mem_flags);
1439
	if (!buf) {
1440
		usb_free_urb(urb);
1441
		return -ENOMEM;
1442
	}
1443

1444
	pipe = usb_rcvintpipe(data->udev, data->intr_ep->bEndpointAddress);
1445

1446
	usb_fill_int_urb(urb, data->udev, pipe, buf, size,
1447
			 btusb_intr_complete, hdev, data->intr_ep->bInterval);
1448

1449
	urb->transfer_flags |= URB_FREE_BUFFER;
1450

1451
	usb_anchor_urb(urb, &data->intr_anchor);
1452

1453
	err = usb_submit_urb(urb, mem_flags);
1454
	if (err < 0) {
1455
		if (err != -EPERM && err != -ENODEV)
1456
			bt_dev_err(hdev, "urb %p submission failed (%d)",
1457
				   urb, -err);
1458
		if (err != -EPERM)
1459
			hci_cmd_sync_cancel(hdev, -err);
1460
		usb_unanchor_urb(urb);
1461
	}
1462

1463
	/* Only initialize intr_interval if URB poll sync is enabled */
1464
	if (!data->poll_sync)
1465
		goto done;
1466

1467
	/* The units are frames (milliseconds) for full and low speed devices,
1468
	 * and microframes (1/8 millisecond) for highspeed and SuperSpeed
1469
	 * devices.
1470
	 *
1471
	 * This is done once on open/resume so it shouldn't change even if
1472
	 * force_poll_sync changes.
1473
	 */
1474
	switch (urb->dev->speed) {
1475
	case USB_SPEED_SUPER_PLUS:
1476
	case USB_SPEED_SUPER:	/* units are 125us */
1477
		data->intr_interval = usecs_to_jiffies(urb->interval * 125);
1478
		break;
1479
	default:
1480
		data->intr_interval = msecs_to_jiffies(urb->interval);
1481
		break;
1482
	}
1483

1484
done:
1485
	usb_free_urb(urb);
1486

1487
	return err;
1488
}
1489

1490
static void btusb_bulk_complete(struct urb *urb)
1491
{
1492
	struct hci_dev *hdev = urb->context;
1493
	struct btusb_data *data = hci_get_drvdata(hdev);
1494
	int err;
1495

1496
	BT_DBG("%s urb %p status %d count %d", hdev->name, urb, urb->status,
1497
	       urb->actual_length);
1498

1499
	if (!test_bit(HCI_RUNNING, &hdev->flags))
1500
		return;
1501

1502
	if (urb->status == 0) {
1503
		hdev->stat.byte_rx += urb->actual_length;
1504

1505
		if (data->recv_bulk(data, urb->transfer_buffer,
1506
				    urb->actual_length) < 0) {
1507
			bt_dev_err(hdev, "corrupted ACL packet");
1508
			hdev->stat.err_rx++;
1509
		}
1510
	} else if (urb->status == -ENOENT) {
1511
		/* Avoid suspend failed when usb_kill_urb */
1512
		return;
1513
	}
1514

1515
	if (!test_bit(BTUSB_BULK_RUNNING, &data->flags))
1516
		return;
1517

1518
	usb_anchor_urb(urb, &data->bulk_anchor);
1519
	usb_mark_last_busy(data->udev);
1520

1521
	err = usb_submit_urb(urb, GFP_ATOMIC);
1522
	if (err < 0) {
1523
		/* -EPERM: urb is being killed;
1524
		 * -ENODEV: device got disconnected
1525
		 */
1526
		if (err != -EPERM && err != -ENODEV)
1527
			bt_dev_err(hdev, "urb %p failed to resubmit (%d)",
1528
				   urb, -err);
1529
		usb_unanchor_urb(urb);
1530
	}
1531
}
1532

1533
static int btusb_submit_bulk_urb(struct hci_dev *hdev, gfp_t mem_flags)
1534
{
1535
	struct btusb_data *data = hci_get_drvdata(hdev);
1536
	struct urb *urb;
1537
	unsigned char *buf;
1538
	unsigned int pipe;
1539
	int err, size = HCI_MAX_FRAME_SIZE;
1540

1541
	BT_DBG("%s", hdev->name);
1542

1543
	if (!data->bulk_rx_ep)
1544
		return -ENODEV;
1545

1546
	urb = usb_alloc_urb(0, mem_flags);
1547
	if (!urb)
1548
		return -ENOMEM;
1549

1550
	buf = kmalloc(size, mem_flags);
1551
	if (!buf) {
1552
		usb_free_urb(urb);
1553
		return -ENOMEM;
1554
	}
1555

1556
	pipe = usb_rcvbulkpipe(data->udev, data->bulk_rx_ep->bEndpointAddress);
1557

1558
	usb_fill_bulk_urb(urb, data->udev, pipe, buf, size,
1559
			  btusb_bulk_complete, hdev);
1560

1561
	urb->transfer_flags |= URB_FREE_BUFFER;
1562

1563
	usb_mark_last_busy(data->udev);
1564
	usb_anchor_urb(urb, &data->bulk_anchor);
1565

1566
	err = usb_submit_urb(urb, mem_flags);
1567
	if (err < 0) {
1568
		if (err != -EPERM && err != -ENODEV)
1569
			bt_dev_err(hdev, "urb %p submission failed (%d)",
1570
				   urb, -err);
1571
		usb_unanchor_urb(urb);
1572
	}
1573

1574
	usb_free_urb(urb);
1575

1576
	return err;
1577
}
1578

1579
static void btusb_isoc_complete(struct urb *urb)
1580
{
1581
	struct hci_dev *hdev = urb->context;
1582
	struct btusb_data *data = hci_get_drvdata(hdev);
1583
	int i, err;
1584

1585
	BT_DBG("%s urb %p status %d count %d", hdev->name, urb, urb->status,
1586
	       urb->actual_length);
1587

1588
	if (!test_bit(HCI_RUNNING, &hdev->flags))
1589
		return;
1590

1591
	if (urb->status == 0) {
1592
		for (i = 0; i < urb->number_of_packets; i++) {
1593
			unsigned int offset = urb->iso_frame_desc[i].offset;
1594
			unsigned int length = urb->iso_frame_desc[i].actual_length;
1595

1596
			if (urb->iso_frame_desc[i].status)
1597
				continue;
1598

1599
			hdev->stat.byte_rx += length;
1600

1601
			if (btusb_recv_isoc(data, urb->transfer_buffer + offset,
1602
					    length) < 0) {
1603
				bt_dev_err(hdev, "corrupted SCO packet");
1604
				hdev->stat.err_rx++;
1605
			}
1606
		}
1607
	} else if (urb->status == -ENOENT) {
1608
		/* Avoid suspend failed when usb_kill_urb */
1609
		return;
1610
	}
1611

1612
	if (!test_bit(BTUSB_ISOC_RUNNING, &data->flags))
1613
		return;
1614

1615
	usb_anchor_urb(urb, &data->isoc_anchor);
1616

1617
	err = usb_submit_urb(urb, GFP_ATOMIC);
1618
	if (err < 0) {
1619
		/* -EPERM: urb is being killed;
1620
		 * -ENODEV: device got disconnected
1621
		 */
1622
		if (err != -EPERM && err != -ENODEV)
1623
			bt_dev_err(hdev, "urb %p failed to resubmit (%d)",
1624
				   urb, -err);
1625
		usb_unanchor_urb(urb);
1626
	}
1627
}
1628

1629
static inline void __fill_isoc_descriptor_msbc(struct urb *urb, int len,
1630
					       int mtu, struct btusb_data *data)
1631
{
1632
	int i = 0, offset = 0;
1633
	unsigned int interval;
1634

1635
	BT_DBG("len %d mtu %d", len, mtu);
1636

1637
	/* For mSBC ALT 6 settings some chips need to transmit the data
1638
	 * continuously without the zero length of USB packets.
1639
	 */
1640
	if (test_bit(BTUSB_ALT6_CONTINUOUS_TX, &data->flags))
1641
		goto ignore_usb_alt6_packet_flow;
1642

1643
	/* For mSBC ALT 6 setting the host will send the packet at continuous
1644
	 * flow. As per core spec 5, vol 4, part B, table 2.1. For ALT setting
1645
	 * 6 the HCI PACKET INTERVAL should be 7.5ms for every usb packets.
1646
	 * To maintain the rate we send 63bytes of usb packets alternatively for
1647
	 * 7ms and 8ms to maintain the rate as 7.5ms.
1648
	 */
1649
	if (data->usb_alt6_packet_flow) {
1650
		interval = 7;
1651
		data->usb_alt6_packet_flow = false;
1652
	} else {
1653
		interval = 6;
1654
		data->usb_alt6_packet_flow = true;
1655
	}
1656

1657
	for (i = 0; i < interval; i++) {
1658
		urb->iso_frame_desc[i].offset = offset;
1659
		urb->iso_frame_desc[i].length = offset;
1660
	}
1661

1662
ignore_usb_alt6_packet_flow:
1663
	if (len && i < BTUSB_MAX_ISOC_FRAMES) {
1664
		urb->iso_frame_desc[i].offset = offset;
1665
		urb->iso_frame_desc[i].length = len;
1666
		i++;
1667
	}
1668

1669
	urb->number_of_packets = i;
1670
}
1671

1672
static inline void __fill_isoc_descriptor(struct urb *urb, int len, int mtu)
1673
{
1674
	int i, offset = 0;
1675

1676
	BT_DBG("len %d mtu %d", len, mtu);
1677

1678
	for (i = 0; i < BTUSB_MAX_ISOC_FRAMES && len >= mtu;
1679
					i++, offset += mtu, len -= mtu) {
1680
		urb->iso_frame_desc[i].offset = offset;
1681
		urb->iso_frame_desc[i].length = mtu;
1682
	}
1683

1684
	if (len && i < BTUSB_MAX_ISOC_FRAMES) {
1685
		urb->iso_frame_desc[i].offset = offset;
1686
		urb->iso_frame_desc[i].length = len;
1687
		i++;
1688
	}
1689

1690
	urb->number_of_packets = i;
1691
}
1692

1693
static int btusb_submit_isoc_urb(struct hci_dev *hdev, gfp_t mem_flags)
1694
{
1695
	struct btusb_data *data = hci_get_drvdata(hdev);
1696
	struct urb *urb;
1697
	unsigned char *buf;
1698
	unsigned int pipe;
1699
	int err, size;
1700

1701
	BT_DBG("%s", hdev->name);
1702

1703
	if (!data->isoc_rx_ep)
1704
		return -ENODEV;
1705

1706
	urb = usb_alloc_urb(BTUSB_MAX_ISOC_FRAMES, mem_flags);
1707
	if (!urb)
1708
		return -ENOMEM;
1709

1710
	size = le16_to_cpu(data->isoc_rx_ep->wMaxPacketSize) *
1711
						BTUSB_MAX_ISOC_FRAMES;
1712

1713
	buf = kmalloc(size, mem_flags);
1714
	if (!buf) {
1715
		usb_free_urb(urb);
1716
		return -ENOMEM;
1717
	}
1718

1719
	pipe = usb_rcvisocpipe(data->udev, data->isoc_rx_ep->bEndpointAddress);
1720

1721
	usb_fill_int_urb(urb, data->udev, pipe, buf, size, btusb_isoc_complete,
1722
			 hdev, data->isoc_rx_ep->bInterval);
1723

1724
	urb->transfer_flags = URB_FREE_BUFFER | URB_ISO_ASAP;
1725

1726
	__fill_isoc_descriptor(urb, size,
1727
			       le16_to_cpu(data->isoc_rx_ep->wMaxPacketSize));
1728

1729
	usb_anchor_urb(urb, &data->isoc_anchor);
1730

1731
	err = usb_submit_urb(urb, mem_flags);
1732
	if (err < 0) {
1733
		if (err != -EPERM && err != -ENODEV)
1734
			bt_dev_err(hdev, "urb %p submission failed (%d)",
1735
				   urb, -err);
1736
		usb_unanchor_urb(urb);
1737
	}
1738

1739
	usb_free_urb(urb);
1740

1741
	return err;
1742
}
1743

1744
static void btusb_diag_complete(struct urb *urb)
1745
{
1746
	struct hci_dev *hdev = urb->context;
1747
	struct btusb_data *data = hci_get_drvdata(hdev);
1748
	int err;
1749

1750
	BT_DBG("%s urb %p status %d count %d", hdev->name, urb, urb->status,
1751
	       urb->actual_length);
1752

1753
	if (urb->status == 0) {
1754
		struct sk_buff *skb;
1755

1756
		skb = bt_skb_alloc(urb->actual_length, GFP_ATOMIC);
1757
		if (skb) {
1758
			skb_put_data(skb, urb->transfer_buffer,
1759
				     urb->actual_length);
1760
			hci_recv_diag(hdev, skb);
1761
		}
1762
	} else if (urb->status == -ENOENT) {
1763
		/* Avoid suspend failed when usb_kill_urb */
1764
		return;
1765
	}
1766

1767
	if (!test_bit(BTUSB_DIAG_RUNNING, &data->flags))
1768
		return;
1769

1770
	usb_anchor_urb(urb, &data->diag_anchor);
1771
	usb_mark_last_busy(data->udev);
1772

1773
	err = usb_submit_urb(urb, GFP_ATOMIC);
1774
	if (err < 0) {
1775
		/* -EPERM: urb is being killed;
1776
		 * -ENODEV: device got disconnected
1777
		 */
1778
		if (err != -EPERM && err != -ENODEV)
1779
			bt_dev_err(hdev, "urb %p failed to resubmit (%d)",
1780
				   urb, -err);
1781
		usb_unanchor_urb(urb);
1782
	}
1783
}
1784

1785
static int btusb_submit_diag_urb(struct hci_dev *hdev, gfp_t mem_flags)
1786
{
1787
	struct btusb_data *data = hci_get_drvdata(hdev);
1788
	struct urb *urb;
1789
	unsigned char *buf;
1790
	unsigned int pipe;
1791
	int err, size = HCI_MAX_FRAME_SIZE;
1792

1793
	BT_DBG("%s", hdev->name);
1794

1795
	if (!data->diag_rx_ep)
1796
		return -ENODEV;
1797

1798
	urb = usb_alloc_urb(0, mem_flags);
1799
	if (!urb)
1800
		return -ENOMEM;
1801

1802
	buf = kmalloc(size, mem_flags);
1803
	if (!buf) {
1804
		usb_free_urb(urb);
1805
		return -ENOMEM;
1806
	}
1807

1808
	pipe = usb_rcvbulkpipe(data->udev, data->diag_rx_ep->bEndpointAddress);
1809

1810
	usb_fill_bulk_urb(urb, data->udev, pipe, buf, size,
1811
			  btusb_diag_complete, hdev);
1812

1813
	urb->transfer_flags |= URB_FREE_BUFFER;
1814

1815
	usb_mark_last_busy(data->udev);
1816
	usb_anchor_urb(urb, &data->diag_anchor);
1817

1818
	err = usb_submit_urb(urb, mem_flags);
1819
	if (err < 0) {
1820
		if (err != -EPERM && err != -ENODEV)
1821
			bt_dev_err(hdev, "urb %p submission failed (%d)",
1822
				   urb, -err);
1823
		usb_unanchor_urb(urb);
1824
	}
1825

1826
	usb_free_urb(urb);
1827

1828
	return err;
1829
}
1830

1831
static void btusb_tx_complete(struct urb *urb)
1832
{
1833
	struct sk_buff *skb = urb->context;
1834
	struct hci_dev *hdev = (struct hci_dev *)skb->dev;
1835
	struct btusb_data *data = hci_get_drvdata(hdev);
1836
	unsigned long flags;
1837

1838
	BT_DBG("%s urb %p status %d count %d", hdev->name, urb, urb->status,
1839
	       urb->actual_length);
1840

1841
	if (!test_bit(HCI_RUNNING, &hdev->flags))
1842
		goto done;
1843

1844
	if (!urb->status) {
1845
		hdev->stat.byte_tx += urb->transfer_buffer_length;
1846
	} else {
1847
		if (hci_skb_pkt_type(skb) == HCI_COMMAND_PKT)
1848
			hci_cmd_sync_cancel(hdev, -urb->status);
1849
		hdev->stat.err_tx++;
1850
	}
1851

1852
done:
1853
	spin_lock_irqsave(&data->txlock, flags);
1854
	data->tx_in_flight--;
1855
	spin_unlock_irqrestore(&data->txlock, flags);
1856

1857
	kfree(urb->setup_packet);
1858

1859
	kfree_skb(skb);
1860
}
1861

1862
static void btusb_isoc_tx_complete(struct urb *urb)
1863
{
1864
	struct sk_buff *skb = urb->context;
1865
	struct hci_dev *hdev = (struct hci_dev *)skb->dev;
1866

1867
	BT_DBG("%s urb %p status %d count %d", hdev->name, urb, urb->status,
1868
	       urb->actual_length);
1869

1870
	if (!test_bit(HCI_RUNNING, &hdev->flags))
1871
		goto done;
1872

1873
	if (!urb->status)
1874
		hdev->stat.byte_tx += urb->transfer_buffer_length;
1875
	else
1876
		hdev->stat.err_tx++;
1877

1878
done:
1879
	kfree(urb->setup_packet);
1880

1881
	kfree_skb(skb);
1882
}
1883

1884
static int btusb_open(struct hci_dev *hdev)
1885
{
1886
	struct btusb_data *data = hci_get_drvdata(hdev);
1887
	int err;
1888

1889
	BT_DBG("%s", hdev->name);
1890

1891
	err = usb_autopm_get_interface(data->intf);
1892
	if (err < 0)
1893
		return err;
1894

1895
	/* Patching USB firmware files prior to starting any URBs of HCI path
1896
	 * It is more safe to use USB bulk channel for downloading USB patch
1897
	 */
1898
	if (data->setup_on_usb) {
1899
		err = data->setup_on_usb(hdev);
1900
		if (err < 0)
1901
			goto setup_fail;
1902
	}
1903

1904
	data->intf->needs_remote_wakeup = 1;
1905

1906
	if (test_and_set_bit(BTUSB_INTR_RUNNING, &data->flags))
1907
		goto done;
1908

1909
	err = btusb_submit_intr_urb(hdev, GFP_KERNEL);
1910
	if (err < 0)
1911
		goto failed;
1912

1913
	err = btusb_submit_bulk_urb(hdev, GFP_KERNEL);
1914
	if (err < 0) {
1915
		usb_kill_anchored_urbs(&data->intr_anchor);
1916
		goto failed;
1917
	}
1918

1919
	set_bit(BTUSB_BULK_RUNNING, &data->flags);
1920
	btusb_submit_bulk_urb(hdev, GFP_KERNEL);
1921

1922
	if (data->diag) {
1923
		if (!btusb_submit_diag_urb(hdev, GFP_KERNEL))
1924
			set_bit(BTUSB_DIAG_RUNNING, &data->flags);
1925
	}
1926

1927
done:
1928
	usb_autopm_put_interface(data->intf);
1929
	return 0;
1930

1931
failed:
1932
	clear_bit(BTUSB_INTR_RUNNING, &data->flags);
1933
setup_fail:
1934
	usb_autopm_put_interface(data->intf);
1935
	return err;
1936
}
1937

1938
static void btusb_stop_traffic(struct btusb_data *data)
1939
{
1940
	usb_kill_anchored_urbs(&data->intr_anchor);
1941
	usb_kill_anchored_urbs(&data->bulk_anchor);
1942
	usb_kill_anchored_urbs(&data->isoc_anchor);
1943
	usb_kill_anchored_urbs(&data->diag_anchor);
1944
	usb_kill_anchored_urbs(&data->ctrl_anchor);
1945
}
1946

1947
static int btusb_close(struct hci_dev *hdev)
1948
{
1949
	struct btusb_data *data = hci_get_drvdata(hdev);
1950
	int err;
1951

1952
	BT_DBG("%s", hdev->name);
1953

1954
	cancel_delayed_work(&data->rx_work);
1955
	cancel_work_sync(&data->work);
1956
	cancel_work_sync(&data->waker);
1957

1958
	skb_queue_purge(&data->acl_q);
1959

1960
	clear_bit(BTUSB_ISOC_RUNNING, &data->flags);
1961
	clear_bit(BTUSB_BULK_RUNNING, &data->flags);
1962
	clear_bit(BTUSB_INTR_RUNNING, &data->flags);
1963
	clear_bit(BTUSB_DIAG_RUNNING, &data->flags);
1964

1965
	btusb_stop_traffic(data);
1966
	btusb_free_frags(data);
1967

1968
	err = usb_autopm_get_interface(data->intf);
1969
	if (err < 0)
1970
		goto failed;
1971

1972
	data->intf->needs_remote_wakeup = 0;
1973

1974
	/* Enable remote wake up for auto-suspend */
1975
	if (test_bit(BTUSB_WAKEUP_AUTOSUSPEND, &data->flags))
1976
		data->intf->needs_remote_wakeup = 1;
1977

1978
	usb_autopm_put_interface(data->intf);
1979

1980
failed:
1981
	usb_scuttle_anchored_urbs(&data->deferred);
1982
	return 0;
1983
}
1984

1985
static int btusb_flush(struct hci_dev *hdev)
1986
{
1987
	struct btusb_data *data = hci_get_drvdata(hdev);
1988

1989
	BT_DBG("%s", hdev->name);
1990

1991
	cancel_delayed_work(&data->rx_work);
1992

1993
	skb_queue_purge(&data->acl_q);
1994

1995
	usb_kill_anchored_urbs(&data->tx_anchor);
1996
	btusb_free_frags(data);
1997

1998
	return 0;
1999
}
2000

2001
static struct urb *alloc_ctrl_urb(struct hci_dev *hdev, struct sk_buff *skb)
2002
{
2003
	struct btusb_data *data = hci_get_drvdata(hdev);
2004
	struct usb_ctrlrequest *dr;
2005
	struct urb *urb;
2006
	unsigned int pipe;
2007

2008
	urb = usb_alloc_urb(0, GFP_KERNEL);
2009
	if (!urb)
2010
		return ERR_PTR(-ENOMEM);
2011

2012
	dr = kmalloc(sizeof(*dr), GFP_KERNEL);
2013
	if (!dr) {
2014
		usb_free_urb(urb);
2015
		return ERR_PTR(-ENOMEM);
2016
	}
2017

2018
	dr->bRequestType = data->cmdreq_type;
2019
	dr->bRequest     = data->cmdreq;
2020
	dr->wIndex       = 0;
2021
	dr->wValue       = 0;
2022
	dr->wLength      = __cpu_to_le16(skb->len);
2023

2024
	pipe = usb_sndctrlpipe(data->udev, 0x00);
2025

2026
	usb_fill_control_urb(urb, data->udev, pipe, (void *)dr,
2027
			     skb->data, skb->len, btusb_tx_complete, skb);
2028

2029
	skb->dev = (void *)hdev;
2030

2031
	return urb;
2032
}
2033

2034
static struct urb *alloc_bulk_urb(struct hci_dev *hdev, struct sk_buff *skb)
2035
{
2036
	struct btusb_data *data = hci_get_drvdata(hdev);
2037
	struct urb *urb;
2038
	unsigned int pipe;
2039

2040
	if (!data->bulk_tx_ep)
2041
		return ERR_PTR(-ENODEV);
2042

2043
	urb = usb_alloc_urb(0, GFP_KERNEL);
2044
	if (!urb)
2045
		return ERR_PTR(-ENOMEM);
2046

2047
	pipe = usb_sndbulkpipe(data->udev, data->bulk_tx_ep->bEndpointAddress);
2048

2049
	usb_fill_bulk_urb(urb, data->udev, pipe,
2050
			  skb->data, skb->len, btusb_tx_complete, skb);
2051

2052
	skb->dev = (void *)hdev;
2053

2054
	return urb;
2055
}
2056

2057
static struct urb *alloc_isoc_urb(struct hci_dev *hdev, struct sk_buff *skb)
2058
{
2059
	struct btusb_data *data = hci_get_drvdata(hdev);
2060
	struct urb *urb;
2061
	unsigned int pipe;
2062

2063
	if (!data->isoc_tx_ep)
2064
		return ERR_PTR(-ENODEV);
2065

2066
	urb = usb_alloc_urb(BTUSB_MAX_ISOC_FRAMES, GFP_KERNEL);
2067
	if (!urb)
2068
		return ERR_PTR(-ENOMEM);
2069

2070
	pipe = usb_sndisocpipe(data->udev, data->isoc_tx_ep->bEndpointAddress);
2071

2072
	usb_fill_int_urb(urb, data->udev, pipe,
2073
			 skb->data, skb->len, btusb_isoc_tx_complete,
2074
			 skb, data->isoc_tx_ep->bInterval);
2075

2076
	urb->transfer_flags  = URB_ISO_ASAP;
2077

2078
	if (data->isoc_altsetting == 6)
2079
		__fill_isoc_descriptor_msbc(urb, skb->len,
2080
					    le16_to_cpu(data->isoc_tx_ep->wMaxPacketSize),
2081
					    data);
2082
	else
2083
		__fill_isoc_descriptor(urb, skb->len,
2084
				       le16_to_cpu(data->isoc_tx_ep->wMaxPacketSize));
2085
	skb->dev = (void *)hdev;
2086

2087
	return urb;
2088
}
2089

2090
static int submit_tx_urb(struct hci_dev *hdev, struct urb *urb)
2091
{
2092
	struct btusb_data *data = hci_get_drvdata(hdev);
2093
	int err;
2094

2095
	usb_anchor_urb(urb, &data->tx_anchor);
2096

2097
	err = usb_submit_urb(urb, GFP_KERNEL);
2098
	if (err < 0) {
2099
		if (err != -EPERM && err != -ENODEV)
2100
			bt_dev_err(hdev, "urb %p submission failed (%d)",
2101
				   urb, -err);
2102
		kfree(urb->setup_packet);
2103
		usb_unanchor_urb(urb);
2104
	} else {
2105
		usb_mark_last_busy(data->udev);
2106
	}
2107

2108
	usb_free_urb(urb);
2109
	return err;
2110
}
2111

2112
static int submit_or_queue_tx_urb(struct hci_dev *hdev, struct urb *urb)
2113
{
2114
	struct btusb_data *data = hci_get_drvdata(hdev);
2115
	unsigned long flags;
2116
	bool suspending;
2117

2118
	spin_lock_irqsave(&data->txlock, flags);
2119
	suspending = test_bit(BTUSB_SUSPENDING, &data->flags);
2120
	if (!suspending)
2121
		data->tx_in_flight++;
2122
	spin_unlock_irqrestore(&data->txlock, flags);
2123

2124
	if (!suspending)
2125
		return submit_tx_urb(hdev, urb);
2126

2127
	usb_anchor_urb(urb, &data->deferred);
2128
	schedule_work(&data->waker);
2129

2130
	usb_free_urb(urb);
2131
	return 0;
2132
}
2133

2134
static int btusb_send_frame(struct hci_dev *hdev, struct sk_buff *skb)
2135
{
2136
	struct urb *urb;
2137

2138
	BT_DBG("%s", hdev->name);
2139

2140
	switch (hci_skb_pkt_type(skb)) {
2141
	case HCI_COMMAND_PKT:
2142
		urb = alloc_ctrl_urb(hdev, skb);
2143
		if (IS_ERR(urb))
2144
			return PTR_ERR(urb);
2145

2146
		hdev->stat.cmd_tx++;
2147
		return submit_or_queue_tx_urb(hdev, urb);
2148

2149
	case HCI_ACLDATA_PKT:
2150
		urb = alloc_bulk_urb(hdev, skb);
2151
		if (IS_ERR(urb))
2152
			return PTR_ERR(urb);
2153

2154
		hdev->stat.acl_tx++;
2155
		return submit_or_queue_tx_urb(hdev, urb);
2156

2157
	case HCI_SCODATA_PKT:
2158
		if (!hci_dev_test_flag(hdev, HCI_USER_CHANNEL) &&
2159
		    hci_conn_num(hdev, SCO_LINK) < 1)
2160
			return -ENODEV;
2161

2162
		urb = alloc_isoc_urb(hdev, skb);
2163
		if (IS_ERR(urb))
2164
			return PTR_ERR(urb);
2165

2166
		hdev->stat.sco_tx++;
2167
		return submit_tx_urb(hdev, urb);
2168

2169
	case HCI_ISODATA_PKT:
2170
		urb = alloc_bulk_urb(hdev, skb);
2171
		if (IS_ERR(urb))
2172
			return PTR_ERR(urb);
2173

2174
		return submit_or_queue_tx_urb(hdev, urb);
2175
	}
2176

2177
	return -EILSEQ;
2178
}
2179

2180
static void btusb_notify(struct hci_dev *hdev, unsigned int evt)
2181
{
2182
	struct btusb_data *data = hci_get_drvdata(hdev);
2183

2184
	BT_DBG("%s evt %d", hdev->name, evt);
2185

2186
	if (hci_conn_num(hdev, SCO_LINK) != data->sco_num) {
2187
		data->sco_num = hci_conn_num(hdev, SCO_LINK);
2188
		data->air_mode = evt;
2189
		schedule_work(&data->work);
2190
	}
2191
}
2192

2193
static inline int __set_isoc_interface(struct hci_dev *hdev, int altsetting)
2194
{
2195
	struct btusb_data *data = hci_get_drvdata(hdev);
2196
	struct usb_interface *intf = data->isoc;
2197
	struct usb_endpoint_descriptor *ep_desc;
2198
	int i, err;
2199

2200
	if (!data->isoc)
2201
		return -ENODEV;
2202

2203
	err = usb_set_interface(data->udev, data->isoc_ifnum, altsetting);
2204
	if (err < 0) {
2205
		bt_dev_err(hdev, "setting interface failed (%d)", -err);
2206
		return err;
2207
	}
2208

2209
	data->isoc_altsetting = altsetting;
2210

2211
	data->isoc_tx_ep = NULL;
2212
	data->isoc_rx_ep = NULL;
2213

2214
	for (i = 0; i < intf->cur_altsetting->desc.bNumEndpoints; i++) {
2215
		ep_desc = &intf->cur_altsetting->endpoint[i].desc;
2216

2217
		if (!data->isoc_tx_ep && usb_endpoint_is_isoc_out(ep_desc)) {
2218
			data->isoc_tx_ep = ep_desc;
2219
			continue;
2220
		}
2221

2222
		if (!data->isoc_rx_ep && usb_endpoint_is_isoc_in(ep_desc)) {
2223
			data->isoc_rx_ep = ep_desc;
2224
			continue;
2225
		}
2226
	}
2227

2228
	if (!data->isoc_tx_ep || !data->isoc_rx_ep) {
2229
		bt_dev_err(hdev, "invalid SCO descriptors");
2230
		return -ENODEV;
2231
	}
2232

2233
	return 0;
2234
}
2235

2236
static int btusb_switch_alt_setting(struct hci_dev *hdev, int new_alts)
2237
{
2238
	struct btusb_data *data = hci_get_drvdata(hdev);
2239
	int err;
2240

2241
	if (data->isoc_altsetting != new_alts) {
2242
		unsigned long flags;
2243

2244
		clear_bit(BTUSB_ISOC_RUNNING, &data->flags);
2245
		usb_kill_anchored_urbs(&data->isoc_anchor);
2246

2247
		/* When isochronous alternate setting needs to be
2248
		 * changed, because SCO connection has been added
2249
		 * or removed, a packet fragment may be left in the
2250
		 * reassembling state. This could lead to wrongly
2251
		 * assembled fragments.
2252
		 *
2253
		 * Clear outstanding fragment when selecting a new
2254
		 * alternate setting.
2255
		 */
2256
		spin_lock_irqsave(&data->rxlock, flags);
2257
		dev_kfree_skb_irq(data->sco_skb);
2258
		data->sco_skb = NULL;
2259
		spin_unlock_irqrestore(&data->rxlock, flags);
2260

2261
		err = __set_isoc_interface(hdev, new_alts);
2262
		if (err < 0)
2263
			return err;
2264
	}
2265

2266
	if (!test_and_set_bit(BTUSB_ISOC_RUNNING, &data->flags)) {
2267
		if (btusb_submit_isoc_urb(hdev, GFP_KERNEL) < 0)
2268
			clear_bit(BTUSB_ISOC_RUNNING, &data->flags);
2269
		else
2270
			btusb_submit_isoc_urb(hdev, GFP_KERNEL);
2271
	}
2272

2273
	return 0;
2274
}
2275

2276
static struct usb_host_interface *btusb_find_altsetting(struct btusb_data *data,
2277
							int alt)
2278
{
2279
	struct usb_interface *intf = data->isoc;
2280
	int i;
2281

2282
	BT_DBG("Looking for Alt no :%d", alt);
2283

2284
	if (!intf)
2285
		return NULL;
2286

2287
	for (i = 0; i < intf->num_altsetting; i++) {
2288
		if (intf->altsetting[i].desc.bAlternateSetting == alt)
2289
			return &intf->altsetting[i];
2290
	}
2291

2292
	return NULL;
2293
}
2294

2295
static void btusb_work(struct work_struct *work)
2296
{
2297
	struct btusb_data *data = container_of(work, struct btusb_data, work);
2298
	struct hci_dev *hdev = data->hdev;
2299
	int new_alts = 0;
2300
	int err;
2301

2302
	if (data->sco_num > 0) {
2303
		if (!test_bit(BTUSB_DID_ISO_RESUME, &data->flags)) {
2304
			err = usb_autopm_get_interface(data->isoc ? data->isoc : data->intf);
2305
			if (err < 0) {
2306
				clear_bit(BTUSB_ISOC_RUNNING, &data->flags);
2307
				usb_kill_anchored_urbs(&data->isoc_anchor);
2308
				return;
2309
			}
2310

2311
			set_bit(BTUSB_DID_ISO_RESUME, &data->flags);
2312
		}
2313

2314
		if (data->air_mode == HCI_NOTIFY_ENABLE_SCO_CVSD) {
2315
			if (hdev->voice_setting & 0x0020) {
2316
				static const int alts[3] = { 2, 4, 5 };
2317

2318
				new_alts = alts[data->sco_num - 1];
2319
			} else {
2320
				new_alts = data->sco_num;
2321
			}
2322
		} else if (data->air_mode == HCI_NOTIFY_ENABLE_SCO_TRANSP) {
2323
			/* Bluetooth USB spec recommends alt 6 (63 bytes), but
2324
			 * many adapters do not support it.  Alt 1 appears to
2325
			 * work for all adapters that do not have alt 6, and
2326
			 * which work with WBS at all.  Some devices prefer
2327
			 * alt 3 (HCI payload >= 60 Bytes let air packet
2328
			 * data satisfy 60 bytes), requiring
2329
			 * MTU >= 3 (packets) * 25 (size) - 3 (headers) = 72
2330
			 * see also Core spec 5, vol 4, B 2.1.1 & Table 2.1.
2331
			 */
2332
			if (btusb_find_altsetting(data, 6))
2333
				new_alts = 6;
2334
			else if (btusb_find_altsetting(data, 3) &&
2335
				 hdev->sco_mtu >= 72 &&
2336
				 test_bit(BTUSB_USE_ALT3_FOR_WBS, &data->flags))
2337
				new_alts = 3;
2338
			else
2339
				new_alts = 1;
2340
		}
2341

2342
		if (btusb_switch_alt_setting(hdev, new_alts) < 0)
2343
			bt_dev_err(hdev, "set USB alt:(%d) failed!", new_alts);
2344
	} else {
2345
		usb_kill_anchored_urbs(&data->isoc_anchor);
2346

2347
		if (test_and_clear_bit(BTUSB_ISOC_RUNNING, &data->flags))
2348
			__set_isoc_interface(hdev, 0);
2349

2350
		if (test_and_clear_bit(BTUSB_DID_ISO_RESUME, &data->flags))
2351
			usb_autopm_put_interface(data->isoc ? data->isoc : data->intf);
2352
	}
2353
}
2354

2355
static void btusb_waker(struct work_struct *work)
2356
{
2357
	struct btusb_data *data = container_of(work, struct btusb_data, waker);
2358
	int err;
2359

2360
	err = usb_autopm_get_interface(data->intf);
2361
	if (err < 0)
2362
		return;
2363

2364
	usb_autopm_put_interface(data->intf);
2365
}
2366

2367
static void btusb_rx_work(struct work_struct *work)
2368
{
2369
	struct btusb_data *data = container_of(work, struct btusb_data,
2370
					       rx_work.work);
2371
	struct sk_buff *skb;
2372

2373
	/* Dequeue ACL data received during the interval */
2374
	while ((skb = skb_dequeue(&data->acl_q)))
2375
		data->recv_acl(data->hdev, skb);
2376
}
2377

2378
static int btusb_setup_bcm92035(struct hci_dev *hdev)
2379
{
2380
	struct sk_buff *skb;
2381
	u8 val = 0x00;
2382

2383
	BT_DBG("%s", hdev->name);
2384

2385
	skb = __hci_cmd_sync(hdev, 0xfc3b, 1, &val, HCI_INIT_TIMEOUT);
2386
	if (IS_ERR(skb))
2387
		bt_dev_err(hdev, "BCM92035 command failed (%ld)", PTR_ERR(skb));
2388
	else
2389
		kfree_skb(skb);
2390

2391
	return 0;
2392
}
2393

2394
static int btusb_setup_csr(struct hci_dev *hdev)
2395
{
2396
	struct btusb_data *data = hci_get_drvdata(hdev);
2397
	u16 bcdDevice = le16_to_cpu(data->udev->descriptor.bcdDevice);
2398
	struct hci_rp_read_local_version *rp;
2399
	struct sk_buff *skb;
2400
	bool is_fake = false;
2401
	int ret;
2402

2403
	BT_DBG("%s", hdev->name);
2404

2405
	skb = __hci_cmd_sync(hdev, HCI_OP_READ_LOCAL_VERSION, 0, NULL,
2406
			     HCI_INIT_TIMEOUT);
2407
	if (IS_ERR(skb)) {
2408
		int err = PTR_ERR(skb);
2409
		bt_dev_err(hdev, "CSR: Local version failed (%d)", err);
2410
		return err;
2411
	}
2412

2413
	rp = skb_pull_data(skb, sizeof(*rp));
2414
	if (!rp) {
2415
		bt_dev_err(hdev, "CSR: Local version length mismatch");
2416
		kfree_skb(skb);
2417
		return -EIO;
2418
	}
2419

2420
	bt_dev_info(hdev, "CSR: Setting up dongle with HCI ver=%u rev=%04x",
2421
		    rp->hci_ver, le16_to_cpu(rp->hci_rev));
2422

2423
	bt_dev_info(hdev, "LMP ver=%u subver=%04x; manufacturer=%u",
2424
		    rp->lmp_ver, le16_to_cpu(rp->lmp_subver),
2425
		    le16_to_cpu(rp->manufacturer));
2426

2427
	/* Detect a wide host of Chinese controllers that aren't CSR.
2428
	 *
2429
	 * Known fake bcdDevices: 0x0100, 0x0134, 0x1915, 0x2520, 0x7558, 0x8891
2430
	 *
2431
	 * The main thing they have in common is that these are really popular low-cost
2432
	 * options that support newer Bluetooth versions but rely on heavy VID/PID
2433
	 * squatting of this poor old Bluetooth 1.1 device. Even sold as such.
2434
	 *
2435
	 * We detect actual CSR devices by checking that the HCI manufacturer code
2436
	 * is Cambridge Silicon Radio (10) and ensuring that LMP sub-version and
2437
	 * HCI rev values always match. As they both store the firmware number.
2438
	 */
2439
	if (le16_to_cpu(rp->manufacturer) != 10 ||
2440
	    le16_to_cpu(rp->hci_rev) != le16_to_cpu(rp->lmp_subver))
2441
		is_fake = true;
2442

2443
	/* Known legit CSR firmware build numbers and their supported BT versions:
2444
	 * - 1.1 (0x1) -> 0x0073, 0x020d, 0x033c, 0x034e
2445
	 * - 1.2 (0x2) ->                 0x04d9, 0x0529
2446
	 * - 2.0 (0x3) ->         0x07a6, 0x07ad, 0x0c5c
2447
	 * - 2.1 (0x4) ->         0x149c, 0x1735, 0x1899 (0x1899 is a BlueCore4-External)
2448
	 * - 4.0 (0x6) ->         0x1d86, 0x2031, 0x22bb
2449
	 *
2450
	 * e.g. Real CSR dongles with LMP subversion 0x73 are old enough that
2451
	 *      support BT 1.1 only; so it's a dead giveaway when some
2452
	 *      third-party BT 4.0 dongle reuses it.
2453
	 */
2454
	else if (le16_to_cpu(rp->lmp_subver) <= 0x034e &&
2455
		 rp->hci_ver > BLUETOOTH_VER_1_1)
2456
		is_fake = true;
2457

2458
	else if (le16_to_cpu(rp->lmp_subver) <= 0x0529 &&
2459
		 rp->hci_ver > BLUETOOTH_VER_1_2)
2460
		is_fake = true;
2461

2462
	else if (le16_to_cpu(rp->lmp_subver) <= 0x0c5c &&
2463
		 rp->hci_ver > BLUETOOTH_VER_2_0)
2464
		is_fake = true;
2465

2466
	else if (le16_to_cpu(rp->lmp_subver) <= 0x1899 &&
2467
		 rp->hci_ver > BLUETOOTH_VER_2_1)
2468
		is_fake = true;
2469

2470
	else if (le16_to_cpu(rp->lmp_subver) <= 0x22bb &&
2471
		 rp->hci_ver > BLUETOOTH_VER_4_0)
2472
		is_fake = true;
2473

2474
	/* Other clones which beat all the above checks */
2475
	else if (bcdDevice == 0x0134 &&
2476
		 le16_to_cpu(rp->lmp_subver) == 0x0c5c &&
2477
		 rp->hci_ver == BLUETOOTH_VER_2_0)
2478
		is_fake = true;
2479

2480
	if (is_fake) {
2481
		bt_dev_warn(hdev, "CSR: Unbranded CSR clone detected; adding workarounds and force-suspending once...");
2482

2483
		/* Generally these clones have big discrepancies between
2484
		 * advertised features and what's actually supported.
2485
		 * Probably will need to be expanded in the future;
2486
		 * without these the controller will lock up.
2487
		 */
2488
		hci_set_quirk(hdev, HCI_QUIRK_BROKEN_STORED_LINK_KEY);
2489
		hci_set_quirk(hdev, HCI_QUIRK_BROKEN_ERR_DATA_REPORTING);
2490
		hci_set_quirk(hdev, HCI_QUIRK_BROKEN_FILTER_CLEAR_ALL);
2491
		hci_set_quirk(hdev, HCI_QUIRK_NO_SUSPEND_NOTIFIER);
2492
		hci_set_quirk(hdev, HCI_QUIRK_BROKEN_READ_VOICE_SETTING);
2493
		hci_set_quirk(hdev, HCI_QUIRK_BROKEN_READ_PAGE_SCAN_TYPE);
2494

2495
		/* Clear the reset quirk since this is not an actual
2496
		 * early Bluetooth 1.1 device from CSR.
2497
		 */
2498
		hci_clear_quirk(hdev, HCI_QUIRK_RESET_ON_CLOSE);
2499
		hci_clear_quirk(hdev, HCI_QUIRK_SIMULTANEOUS_DISCOVERY);
2500

2501
		/*
2502
		 * Special workaround for these BT 4.0 chip clones, and potentially more:
2503
		 *
2504
		 * - 0x0134: a Barrot 8041a02                 (HCI rev: 0x0810 sub: 0x1012)
2505
		 * - 0x7558: IC markings FR3191AHAL 749H15143 (HCI rev/sub-version: 0x0709)
2506
		 *
2507
		 * These controllers are really messed-up.
2508
		 *
2509
		 * 1. Their bulk RX endpoint will never report any data unless
2510
		 *    the device was suspended at least once (yes, really).
2511
		 * 2. They will not wakeup when autosuspended and receiving data
2512
		 *    on their bulk RX endpoint from e.g. a keyboard or mouse
2513
		 *    (IOW remote-wakeup support is broken for the bulk endpoint).
2514
		 *
2515
		 * To fix 1. enable runtime-suspend, force-suspend the
2516
		 * HCI and then wake-it up by disabling runtime-suspend.
2517
		 *
2518
		 * To fix 2. clear the HCI's can_wake flag, this way the HCI
2519
		 * will still be autosuspended when it is not open.
2520
		 *
2521
		 * --
2522
		 *
2523
		 * Because these are widespread problems we prefer generic solutions; so
2524
		 * apply this initialization quirk to every controller that gets here,
2525
		 * it should be harmless. The alternative is to not work at all.
2526
		 */
2527
		pm_runtime_allow(&data->udev->dev);
2528

2529
		ret = pm_runtime_suspend(&data->udev->dev);
2530
		if (ret >= 0)
2531
			msleep(200);
2532
		else
2533
			bt_dev_warn(hdev, "CSR: Couldn't suspend the device for our Barrot 8041a02 receive-issue workaround");
2534

2535
		pm_runtime_forbid(&data->udev->dev);
2536

2537
		device_set_wakeup_capable(&data->udev->dev, false);
2538

2539
		/* Re-enable autosuspend if this was requested */
2540
		if (enable_autosuspend)
2541
			usb_enable_autosuspend(data->udev);
2542
	}
2543

2544
	kfree_skb(skb);
2545

2546
	return 0;
2547
}
2548

2549
static int inject_cmd_complete(struct hci_dev *hdev, __u16 opcode)
2550
{
2551
	struct sk_buff *skb;
2552
	struct hci_event_hdr *hdr;
2553
	struct hci_ev_cmd_complete *evt;
2554

2555
	skb = bt_skb_alloc(sizeof(*hdr) + sizeof(*evt) + 1, GFP_KERNEL);
2556
	if (!skb)
2557
		return -ENOMEM;
2558

2559
	hdr = skb_put(skb, sizeof(*hdr));
2560
	hdr->evt = HCI_EV_CMD_COMPLETE;
2561
	hdr->plen = sizeof(*evt) + 1;
2562

2563
	evt = skb_put(skb, sizeof(*evt));
2564
	evt->ncmd = 0x01;
2565
	evt->opcode = cpu_to_le16(opcode);
2566

2567
	skb_put_u8(skb, 0x00);
2568

2569
	hci_skb_pkt_type(skb) = HCI_EVENT_PKT;
2570

2571
	return hci_recv_frame(hdev, skb);
2572
}
2573

2574
static int btusb_recv_bulk_intel(struct btusb_data *data, void *buffer,
2575
				 int count)
2576
{
2577
	struct hci_dev *hdev = data->hdev;
2578

2579
	/* When the device is in bootloader mode, then it can send
2580
	 * events via the bulk endpoint. These events are treated the
2581
	 * same way as the ones received from the interrupt endpoint.
2582
	 */
2583
	if (btintel_test_flag(hdev, INTEL_BOOTLOADER))
2584
		return btusb_recv_intr(data, buffer, count);
2585

2586
	return btusb_recv_bulk(data, buffer, count);
2587
}
2588

2589
static int btusb_send_frame_intel(struct hci_dev *hdev, struct sk_buff *skb)
2590
{
2591
	struct urb *urb;
2592

2593
	BT_DBG("%s", hdev->name);
2594

2595
	switch (hci_skb_pkt_type(skb)) {
2596
	case HCI_COMMAND_PKT:
2597
		if (btintel_test_flag(hdev, INTEL_BOOTLOADER)) {
2598
			struct hci_command_hdr *cmd = (void *)skb->data;
2599
			__u16 opcode = le16_to_cpu(cmd->opcode);
2600

2601
			/* When in bootloader mode and the command 0xfc09
2602
			 * is received, it needs to be send down the
2603
			 * bulk endpoint. So allocate a bulk URB instead.
2604
			 */
2605
			if (opcode == 0xfc09)
2606
				urb = alloc_bulk_urb(hdev, skb);
2607
			else
2608
				urb = alloc_ctrl_urb(hdev, skb);
2609

2610
			/* When the BTINTEL_HCI_OP_RESET command is issued to
2611
			 * boot into the operational firmware, it will actually
2612
			 * not send a command complete event. To keep the flow
2613
			 * control working inject that event here.
2614
			 */
2615
			if (opcode == BTINTEL_HCI_OP_RESET)
2616
				inject_cmd_complete(hdev, opcode);
2617
		} else {
2618
			urb = alloc_ctrl_urb(hdev, skb);
2619
		}
2620
		if (IS_ERR(urb))
2621
			return PTR_ERR(urb);
2622

2623
		hdev->stat.cmd_tx++;
2624
		return submit_or_queue_tx_urb(hdev, urb);
2625

2626
	case HCI_ACLDATA_PKT:
2627
		urb = alloc_bulk_urb(hdev, skb);
2628
		if (IS_ERR(urb))
2629
			return PTR_ERR(urb);
2630

2631
		hdev->stat.acl_tx++;
2632
		return submit_or_queue_tx_urb(hdev, urb);
2633

2634
	case HCI_SCODATA_PKT:
2635
		if (!hci_dev_test_flag(hdev, HCI_USER_CHANNEL) &&
2636
		    hci_conn_num(hdev, SCO_LINK) < 1)
2637
			return -ENODEV;
2638

2639
		urb = alloc_isoc_urb(hdev, skb);
2640
		if (IS_ERR(urb))
2641
			return PTR_ERR(urb);
2642

2643
		hdev->stat.sco_tx++;
2644
		return submit_tx_urb(hdev, urb);
2645

2646
	case HCI_ISODATA_PKT:
2647
		urb = alloc_bulk_urb(hdev, skb);
2648
		if (IS_ERR(urb))
2649
			return PTR_ERR(urb);
2650

2651
		return submit_or_queue_tx_urb(hdev, urb);
2652
	}
2653

2654
	return -EILSEQ;
2655
}
2656

2657
static int btusb_setup_realtek(struct hci_dev *hdev)
2658
{
2659
	struct btusb_data *data = hci_get_drvdata(hdev);
2660
	int ret;
2661

2662
	ret = btrtl_setup_realtek(hdev);
2663

2664
	if (btrealtek_test_flag(data->hdev, REALTEK_ALT6_CONTINUOUS_TX_CHIP))
2665
		set_bit(BTUSB_ALT6_CONTINUOUS_TX, &data->flags);
2666

2667
	return ret;
2668
}
2669

2670
static int btusb_recv_event_realtek(struct hci_dev *hdev, struct sk_buff *skb)
2671
{
2672
	if (skb->data[0] == HCI_VENDOR_PKT && skb->data[2] == RTK_SUB_EVENT_CODE_COREDUMP) {
2673
		struct rtk_dev_coredump_hdr hdr = {
2674
			.code = RTK_DEVCOREDUMP_CODE_MEMDUMP,
2675
		};
2676

2677
		bt_dev_dbg(hdev, "RTL: received coredump vendor evt, len %u",
2678
			skb->len);
2679

2680
		btusb_rtl_alloc_devcoredump(hdev, &hdr, skb->data, skb->len);
2681
		kfree_skb(skb);
2682

2683
		return 0;
2684
	}
2685

2686
	return hci_recv_frame(hdev, skb);
2687
}
2688

2689
static void btusb_mtk_claim_iso_intf(struct btusb_data *data)
2690
{
2691
	struct btmtk_data *btmtk_data = hci_get_priv(data->hdev);
2692
	int err;
2693

2694
	/*
2695
	 * The function usb_driver_claim_interface() is documented to need
2696
	 * locks held if it's not called from a probe routine. The code here
2697
	 * is called from the hci_power_on workqueue, so grab the lock.
2698
	 */
2699
	device_lock(&btmtk_data->isopkt_intf->dev);
2700
	err = usb_driver_claim_interface(&btusb_driver,
2701
					 btmtk_data->isopkt_intf, data);
2702
	device_unlock(&btmtk_data->isopkt_intf->dev);
2703
	if (err < 0) {
2704
		btmtk_data->isopkt_intf = NULL;
2705
		bt_dev_err(data->hdev, "Failed to claim iso interface: %d", err);
2706
		return;
2707
	}
2708

2709
	set_bit(BTMTK_ISOPKT_OVER_INTR, &btmtk_data->flags);
2710
	init_usb_anchor(&btmtk_data->isopkt_anchor);
2711
}
2712

2713
static void btusb_mtk_release_iso_intf(struct hci_dev *hdev)
2714
{
2715
	struct btmtk_data *btmtk_data = hci_get_priv(hdev);
2716

2717
	if (test_bit(BTMTK_ISOPKT_OVER_INTR, &btmtk_data->flags)) {
2718
		usb_kill_anchored_urbs(&btmtk_data->isopkt_anchor);
2719
		clear_bit(BTMTK_ISOPKT_RUNNING, &btmtk_data->flags);
2720

2721
		dev_kfree_skb_irq(btmtk_data->isopkt_skb);
2722
		btmtk_data->isopkt_skb = NULL;
2723
		usb_set_intfdata(btmtk_data->isopkt_intf, NULL);
2724
		usb_driver_release_interface(&btusb_driver,
2725
					     btmtk_data->isopkt_intf);
2726
	}
2727

2728
	clear_bit(BTMTK_ISOPKT_OVER_INTR, &btmtk_data->flags);
2729
}
2730

2731
static int btusb_mtk_disconnect(struct hci_dev *hdev)
2732
{
2733
	/* This function describes the specific additional steps taken by MediaTek
2734
	 * when Bluetooth usb driver's resume function is called.
2735
	 */
2736
	btusb_mtk_release_iso_intf(hdev);
2737

2738
	return 0;
2739
}
2740

2741
static int btusb_mtk_reset(struct hci_dev *hdev, void *rst_data)
2742
{
2743
	struct btusb_data *data = hci_get_drvdata(hdev);
2744
	struct btmtk_data *btmtk_data = hci_get_priv(hdev);
2745
	int err;
2746

2747
	/* It's MediaTek specific bluetooth reset mechanism via USB */
2748
	if (test_and_set_bit(BTMTK_HW_RESET_ACTIVE, &btmtk_data->flags)) {
2749
		bt_dev_err(hdev, "last reset failed? Not resetting again");
2750
		return -EBUSY;
2751
	}
2752

2753
	err = usb_autopm_get_interface(data->intf);
2754
	if (err < 0)
2755
		return err;
2756

2757
	/* Release MediaTek ISO data interface */
2758
	btusb_mtk_release_iso_intf(hdev);
2759

2760
	btusb_stop_traffic(data);
2761
	usb_kill_anchored_urbs(&data->tx_anchor);
2762

2763
	err = btmtk_usb_subsys_reset(hdev, btmtk_data->dev_id);
2764

2765
	usb_queue_reset_device(data->intf);
2766
	clear_bit(BTMTK_HW_RESET_ACTIVE, &btmtk_data->flags);
2767

2768
	return err;
2769
}
2770

2771
static int btusb_send_frame_mtk(struct hci_dev *hdev, struct sk_buff *skb)
2772
{
2773
	struct urb *urb;
2774

2775
	BT_DBG("%s", hdev->name);
2776

2777
	if (hci_skb_pkt_type(skb) == HCI_ISODATA_PKT) {
2778
		urb = alloc_mtk_intr_urb(hdev, skb, btusb_tx_complete);
2779
		if (IS_ERR(urb))
2780
			return PTR_ERR(urb);
2781

2782
		return submit_or_queue_tx_urb(hdev, urb);
2783
	} else {
2784
		return btusb_send_frame(hdev, skb);
2785
	}
2786
}
2787

2788
static int btusb_mtk_setup(struct hci_dev *hdev)
2789
{
2790
	struct btusb_data *data = hci_get_drvdata(hdev);
2791
	struct btmtk_data *btmtk_data = hci_get_priv(hdev);
2792

2793
	/* MediaTek WMT vendor cmd requiring below USB resources to
2794
	 * complete the handshake.
2795
	 */
2796
	btmtk_data->drv_name = btusb_driver.name;
2797
	btmtk_data->intf = data->intf;
2798
	btmtk_data->udev = data->udev;
2799
	btmtk_data->ctrl_anchor = &data->ctrl_anchor;
2800
	btmtk_data->reset_sync = btusb_mtk_reset;
2801

2802
	/* Claim ISO data interface and endpoint */
2803
	if (!test_bit(BTMTK_ISOPKT_OVER_INTR, &btmtk_data->flags)) {
2804
		btmtk_data->isopkt_intf = usb_ifnum_to_if(data->udev, MTK_ISO_IFNUM);
2805
		btusb_mtk_claim_iso_intf(data);
2806
	}
2807

2808
	return btmtk_usb_setup(hdev);
2809
}
2810

2811
static int btusb_mtk_shutdown(struct hci_dev *hdev)
2812
{
2813
	int ret;
2814

2815
	ret = btmtk_usb_shutdown(hdev);
2816

2817
	/* Release MediaTek iso interface after shutdown */
2818
	btusb_mtk_release_iso_intf(hdev);
2819

2820
	return ret;
2821
}
2822

2823
#ifdef CONFIG_PM
2824
/* Configure an out-of-band gpio as wake-up pin, if specified in device tree */
2825
static int marvell_config_oob_wake(struct hci_dev *hdev)
2826
{
2827
	struct sk_buff *skb;
2828
	struct btusb_data *data = hci_get_drvdata(hdev);
2829
	struct device *dev = &data->udev->dev;
2830
	u16 pin, gap, opcode;
2831
	int ret;
2832
	u8 cmd[5];
2833

2834
	/* Move on if no wakeup pin specified */
2835
	if (of_property_read_u16(dev->of_node, "marvell,wakeup-pin", &pin) ||
2836
	    of_property_read_u16(dev->of_node, "marvell,wakeup-gap-ms", &gap))
2837
		return 0;
2838

2839
	/* Vendor specific command to configure a GPIO as wake-up pin */
2840
	opcode = hci_opcode_pack(0x3F, 0x59);
2841
	cmd[0] = opcode & 0xFF;
2842
	cmd[1] = opcode >> 8;
2843
	cmd[2] = 2; /* length of parameters that follow */
2844
	cmd[3] = pin;
2845
	cmd[4] = gap; /* time in ms, for which wakeup pin should be asserted */
2846

2847
	skb = bt_skb_alloc(sizeof(cmd), GFP_KERNEL);
2848
	if (!skb) {
2849
		bt_dev_err(hdev, "%s: No memory", __func__);
2850
		return -ENOMEM;
2851
	}
2852

2853
	skb_put_data(skb, cmd, sizeof(cmd));
2854
	hci_skb_pkt_type(skb) = HCI_COMMAND_PKT;
2855

2856
	ret = btusb_send_frame(hdev, skb);
2857
	if (ret) {
2858
		bt_dev_err(hdev, "%s: configuration failed", __func__);
2859
		kfree_skb(skb);
2860
		return ret;
2861
	}
2862

2863
	return 0;
2864
}
2865
#endif
2866

2867
static int btusb_set_bdaddr_marvell(struct hci_dev *hdev,
2868
				    const bdaddr_t *bdaddr)
2869
{
2870
	struct sk_buff *skb;
2871
	u8 buf[8];
2872
	long ret;
2873

2874
	buf[0] = 0xfe;
2875
	buf[1] = sizeof(bdaddr_t);
2876
	memcpy(buf + 2, bdaddr, sizeof(bdaddr_t));
2877

2878
	skb = __hci_cmd_sync(hdev, 0xfc22, sizeof(buf), buf, HCI_INIT_TIMEOUT);
2879
	if (IS_ERR(skb)) {
2880
		ret = PTR_ERR(skb);
2881
		bt_dev_err(hdev, "changing Marvell device address failed (%ld)",
2882
			   ret);
2883
		return ret;
2884
	}
2885
	kfree_skb(skb);
2886

2887
	return 0;
2888
}
2889

2890
static int btusb_set_bdaddr_ath3012(struct hci_dev *hdev,
2891
				    const bdaddr_t *bdaddr)
2892
{
2893
	struct sk_buff *skb;
2894
	u8 buf[10];
2895
	long ret;
2896

2897
	buf[0] = 0x01;
2898
	buf[1] = 0x01;
2899
	buf[2] = 0x00;
2900
	buf[3] = sizeof(bdaddr_t);
2901
	memcpy(buf + 4, bdaddr, sizeof(bdaddr_t));
2902

2903
	skb = __hci_cmd_sync(hdev, 0xfc0b, sizeof(buf), buf, HCI_INIT_TIMEOUT);
2904
	if (IS_ERR(skb)) {
2905
		ret = PTR_ERR(skb);
2906
		bt_dev_err(hdev, "Change address command failed (%ld)", ret);
2907
		return ret;
2908
	}
2909
	kfree_skb(skb);
2910

2911
	return 0;
2912
}
2913

2914
static int btusb_set_bdaddr_wcn6855(struct hci_dev *hdev,
2915
				const bdaddr_t *bdaddr)
2916
{
2917
	struct sk_buff *skb;
2918
	u8 buf[6];
2919
	long ret;
2920

2921
	memcpy(buf, bdaddr, sizeof(bdaddr_t));
2922

2923
	skb = __hci_cmd_sync_ev(hdev, 0xfc14, sizeof(buf), buf,
2924
				HCI_EV_CMD_COMPLETE, HCI_INIT_TIMEOUT);
2925
	if (IS_ERR(skb)) {
2926
		ret = PTR_ERR(skb);
2927
		bt_dev_err(hdev, "Change address command failed (%ld)", ret);
2928
		return ret;
2929
	}
2930
	kfree_skb(skb);
2931

2932
	return 0;
2933
}
2934

2935
#define QCA_MEMDUMP_ACL_HANDLE 0x2EDD
2936
#define QCA_MEMDUMP_SIZE_MAX  0x100000
2937
#define QCA_MEMDUMP_VSE_CLASS 0x01
2938
#define QCA_MEMDUMP_MSG_TYPE 0x08
2939
#define QCA_MEMDUMP_PKT_SIZE 248
2940
#define QCA_LAST_SEQUENCE_NUM 0xffff
2941

2942
struct qca_dump_hdr {
2943
	u8 vse_class;
2944
	u8 msg_type;
2945
	__le16 seqno;
2946
	u8 reserved;
2947
	union {
2948
		u8 data[0];
2949
		struct {
2950
			__le32 ram_dump_size;
2951
			u8 data0[0];
2952
		} __packed;
2953
	};
2954
} __packed;
2955

2956

2957
static void btusb_dump_hdr_qca(struct hci_dev *hdev, struct sk_buff *skb)
2958
{
2959
	char buf[128];
2960
	struct btusb_data *btdata = hci_get_drvdata(hdev);
2961

2962
	snprintf(buf, sizeof(buf), "Controller Name: 0x%x\n",
2963
			btdata->qca_dump.controller_id);
2964
	skb_put_data(skb, buf, strlen(buf));
2965

2966
	snprintf(buf, sizeof(buf), "Firmware Version: 0x%x\n",
2967
			btdata->qca_dump.fw_version);
2968
	skb_put_data(skb, buf, strlen(buf));
2969

2970
	snprintf(buf, sizeof(buf), "Driver: %s\nVendor: qca\n",
2971
			btusb_driver.name);
2972
	skb_put_data(skb, buf, strlen(buf));
2973

2974
	snprintf(buf, sizeof(buf), "VID: 0x%x\nPID:0x%x\n",
2975
			btdata->qca_dump.id_vendor, btdata->qca_dump.id_product);
2976
	skb_put_data(skb, buf, strlen(buf));
2977

2978
	snprintf(buf, sizeof(buf), "Lmp Subversion: 0x%x\n",
2979
			hdev->lmp_subver);
2980
	skb_put_data(skb, buf, strlen(buf));
2981
}
2982

2983
static void btusb_coredump_qca(struct hci_dev *hdev)
2984
{
2985
	int err;
2986
	static const u8 param[] = { 0x26 };
2987

2988
	err = __hci_cmd_send(hdev, 0xfc0c, 1, param);
2989
	if (err < 0)
2990
		bt_dev_err(hdev, "%s: triggle crash failed (%d)", __func__, err);
2991
}
2992

2993
/* Return: 0 on success, negative errno on failure. */
2994
static int handle_dump_pkt_qca(struct hci_dev *hdev, struct sk_buff *skb)
2995
{
2996
	int ret = 0;
2997
	unsigned int skip = 0;
2998
	u8 pkt_type;
2999
	u16 seqno;
3000
	u32 dump_size;
3001

3002
	struct qca_dump_hdr *dump_hdr;
3003
	struct btusb_data *btdata = hci_get_drvdata(hdev);
3004
	struct usb_device *udev = btdata->udev;
3005

3006
	pkt_type = hci_skb_pkt_type(skb);
3007
	skip = sizeof(struct hci_event_hdr);
3008
	if (pkt_type == HCI_ACLDATA_PKT)
3009
		skip += sizeof(struct hci_acl_hdr);
3010

3011
	skb_pull(skb, skip);
3012
	dump_hdr = (struct qca_dump_hdr *)skb->data;
3013

3014
	seqno = le16_to_cpu(dump_hdr->seqno);
3015
	if (seqno == 0) {
3016
		set_bit(BTUSB_HW_SSR_ACTIVE, &btdata->flags);
3017
		dump_size = le32_to_cpu(dump_hdr->ram_dump_size);
3018
		if (!dump_size || (dump_size > QCA_MEMDUMP_SIZE_MAX)) {
3019
			ret = -EILSEQ;
3020
			bt_dev_err(hdev, "Invalid memdump size(%u)",
3021
				   dump_size);
3022
			goto out;
3023
		}
3024

3025
		ret = hci_devcd_init(hdev, dump_size);
3026
		if (ret < 0) {
3027
			bt_dev_err(hdev, "memdump init error(%d)", ret);
3028
			goto out;
3029
		}
3030

3031
		btdata->qca_dump.ram_dump_size = dump_size;
3032
		btdata->qca_dump.ram_dump_seqno = 0;
3033

3034
		skb_pull(skb, offsetof(struct qca_dump_hdr, data0));
3035

3036
		usb_disable_autosuspend(udev);
3037
		bt_dev_info(hdev, "%s memdump size(%u)\n",
3038
			    (pkt_type == HCI_ACLDATA_PKT) ? "ACL" : "event",
3039
			    dump_size);
3040
	} else {
3041
		skb_pull(skb, offsetof(struct qca_dump_hdr, data));
3042
	}
3043

3044
	if (!btdata->qca_dump.ram_dump_size) {
3045
		ret = -EINVAL;
3046
		bt_dev_err(hdev, "memdump is not active");
3047
		goto out;
3048
	}
3049

3050
	if ((seqno > btdata->qca_dump.ram_dump_seqno + 1) && (seqno != QCA_LAST_SEQUENCE_NUM)) {
3051
		dump_size = QCA_MEMDUMP_PKT_SIZE * (seqno - btdata->qca_dump.ram_dump_seqno - 1);
3052
		hci_devcd_append_pattern(hdev, 0x0, dump_size);
3053
		bt_dev_err(hdev,
3054
			   "expected memdump seqno(%u) is not received(%u)\n",
3055
			   btdata->qca_dump.ram_dump_seqno, seqno);
3056
		btdata->qca_dump.ram_dump_seqno = seqno;
3057
		kfree_skb(skb);
3058
		return ret;
3059
	}
3060

3061
	hci_devcd_append(hdev, skb);
3062
	btdata->qca_dump.ram_dump_seqno++;
3063
	if (seqno == QCA_LAST_SEQUENCE_NUM) {
3064
		bt_dev_info(hdev,
3065
				"memdump done: pkts(%u), total(%u)\n",
3066
				btdata->qca_dump.ram_dump_seqno, btdata->qca_dump.ram_dump_size);
3067

3068
		hci_devcd_complete(hdev);
3069
		goto out;
3070
	}
3071
	return ret;
3072

3073
out:
3074
	if (btdata->qca_dump.ram_dump_size)
3075
		usb_enable_autosuspend(udev);
3076
	btdata->qca_dump.ram_dump_size = 0;
3077
	btdata->qca_dump.ram_dump_seqno = 0;
3078
	clear_bit(BTUSB_HW_SSR_ACTIVE, &btdata->flags);
3079

3080
	if (ret < 0)
3081
		kfree_skb(skb);
3082
	return ret;
3083
}
3084

3085
/* Return: true if the ACL packet is a dump packet, false otherwise. */
3086
static bool acl_pkt_is_dump_qca(struct hci_dev *hdev, struct sk_buff *skb)
3087
{
3088
	struct hci_event_hdr *event_hdr;
3089
	struct hci_acl_hdr *acl_hdr;
3090
	struct qca_dump_hdr *dump_hdr;
3091
	struct sk_buff *clone = skb_clone(skb, GFP_ATOMIC);
3092
	bool is_dump = false;
3093

3094
	if (!clone)
3095
		return false;
3096

3097
	acl_hdr = skb_pull_data(clone, sizeof(*acl_hdr));
3098
	if (!acl_hdr || (le16_to_cpu(acl_hdr->handle) != QCA_MEMDUMP_ACL_HANDLE))
3099
		goto out;
3100

3101
	event_hdr = skb_pull_data(clone, sizeof(*event_hdr));
3102
	if (!event_hdr || (event_hdr->evt != HCI_VENDOR_PKT))
3103
		goto out;
3104

3105
	dump_hdr = skb_pull_data(clone, sizeof(*dump_hdr));
3106
	if (!dump_hdr || (dump_hdr->vse_class != QCA_MEMDUMP_VSE_CLASS) ||
3107
	   (dump_hdr->msg_type != QCA_MEMDUMP_MSG_TYPE))
3108
		goto out;
3109

3110
	is_dump = true;
3111
out:
3112
	consume_skb(clone);
3113
	return is_dump;
3114
}
3115

3116
/* Return: true if the event packet is a dump packet, false otherwise. */
3117
static bool evt_pkt_is_dump_qca(struct hci_dev *hdev, struct sk_buff *skb)
3118
{
3119
	struct hci_event_hdr *event_hdr;
3120
	struct qca_dump_hdr *dump_hdr;
3121
	struct sk_buff *clone = skb_clone(skb, GFP_ATOMIC);
3122
	bool is_dump = false;
3123

3124
	if (!clone)
3125
		return false;
3126

3127
	event_hdr = skb_pull_data(clone, sizeof(*event_hdr));
3128
	if (!event_hdr || (event_hdr->evt != HCI_VENDOR_PKT))
3129
		goto out;
3130

3131
	dump_hdr = skb_pull_data(clone, sizeof(*dump_hdr));
3132
	if (!dump_hdr || (dump_hdr->vse_class != QCA_MEMDUMP_VSE_CLASS) ||
3133
	   (dump_hdr->msg_type != QCA_MEMDUMP_MSG_TYPE))
3134
		goto out;
3135

3136
	is_dump = true;
3137
out:
3138
	consume_skb(clone);
3139
	return is_dump;
3140
}
3141

3142
static int btusb_recv_acl_qca(struct hci_dev *hdev, struct sk_buff *skb)
3143
{
3144
	if (acl_pkt_is_dump_qca(hdev, skb))
3145
		return handle_dump_pkt_qca(hdev, skb);
3146
	return hci_recv_frame(hdev, skb);
3147
}
3148

3149
static int btusb_recv_evt_qca(struct hci_dev *hdev, struct sk_buff *skb)
3150
{
3151
	if (evt_pkt_is_dump_qca(hdev, skb))
3152
		return handle_dump_pkt_qca(hdev, skb);
3153
	return hci_recv_frame(hdev, skb);
3154
}
3155

3156

3157
#define QCA_DFU_PACKET_LEN	4096
3158

3159
#define QCA_GET_TARGET_VERSION	0x09
3160
#define QCA_CHECK_STATUS	0x05
3161
#define QCA_DFU_DOWNLOAD	0x01
3162

3163
#define QCA_SYSCFG_UPDATED	0x40
3164
#define QCA_PATCH_UPDATED	0x80
3165
#define QCA_DFU_TIMEOUT		3000
3166
#define QCA_FLAG_MULTI_NVM      0x80
3167
#define QCA_BT_RESET_WAIT_MS    100
3168

3169
#define WCN6855_2_0_RAM_VERSION_GF 0x400c1200
3170
#define WCN6855_2_1_RAM_VERSION_GF 0x400c1211
3171

3172
struct qca_version {
3173
	__le32	rom_version;
3174
	__le32	patch_version;
3175
	__le32	ram_version;
3176
	__u8	chip_id;
3177
	__u8	platform_id;
3178
	__le16	flag;
3179
	__u8	reserved[4];
3180
} __packed;
3181

3182
struct qca_rampatch_version {
3183
	__le16	rom_version_high;
3184
	__le16  rom_version_low;
3185
	__le16	patch_version;
3186
} __packed;
3187

3188
struct qca_device_info {
3189
	u32	rom_version;
3190
	u8	rampatch_hdr;	/* length of header in rampatch */
3191
	u8	nvm_hdr;	/* length of header in NVM */
3192
	u8	ver_offset;	/* offset of version structure in rampatch */
3193
};
3194

3195
struct qca_custom_firmware {
3196
	u32 rom_version;
3197
	u16 board_id;
3198
	const char *subdirectory;
3199
};
3200

3201
static const struct qca_device_info qca_devices_table[] = {
3202
	{ 0x00000100, 20, 4,  8 }, /* Rome 1.0 */
3203
	{ 0x00000101, 20, 4,  8 }, /* Rome 1.1 */
3204
	{ 0x00000200, 28, 4, 16 }, /* Rome 2.0 */
3205
	{ 0x00000201, 28, 4, 16 }, /* Rome 2.1 */
3206
	{ 0x00000300, 28, 4, 16 }, /* Rome 3.0 */
3207
	{ 0x00000302, 28, 4, 16 }, /* Rome 3.2 */
3208
	{ 0x00130100, 40, 4, 16 }, /* WCN6855 1.0 */
3209
	{ 0x00130200, 40, 4, 16 }, /* WCN6855 2.0 */
3210
	{ 0x00130201, 40, 4, 16 }, /* WCN6855 2.1 */
3211
	{ 0x00190200, 40, 4, 16 }, /* WCN785x 2.0 */
3212
};
3213

3214
static const struct qca_custom_firmware qca_custom_btfws[] = {
3215
	{ 0x00130201, 0x030A, "QCA2066" },
3216
	{ },
3217
};
3218

3219
static u16 qca_extract_board_id(const struct qca_version *ver)
3220
{
3221
	u16 flag = le16_to_cpu(ver->flag);
3222
	u16 board_id = 0;
3223

3224
	if (((flag >> 8) & 0xff) == QCA_FLAG_MULTI_NVM) {
3225
		/* The board_id should be split into two bytes
3226
		 * The 1st byte is chip ID, and the 2nd byte is platform ID
3227
		 * For example, board ID 0x010A, 0x01 is platform ID. 0x0A is chip ID
3228
		 * we have several platforms, and platform IDs are continuously added
3229
		 * Platform ID:
3230
		 * 0x00 is for Mobile
3231
		 * 0x01 is for X86
3232
		 * 0x02 is for Automotive
3233
		 * 0x03 is for Consumer electronic
3234
		 */
3235
		board_id = (ver->chip_id << 8) + ver->platform_id;
3236
	}
3237

3238
	/* Take 0xffff as invalid board ID */
3239
	if (board_id == 0xffff)
3240
		board_id = 0;
3241

3242
	return board_id;
3243
}
3244

3245
static const char *qca_get_fw_subdirectory(const struct qca_version *ver)
3246
{
3247
	const struct qca_custom_firmware *ptr;
3248
	u32 rom_ver;
3249
	u16 board_id;
3250

3251
	rom_ver = le32_to_cpu(ver->rom_version);
3252
	board_id = qca_extract_board_id(ver);
3253
	if (!board_id)
3254
		return NULL;
3255

3256
	for (ptr = qca_custom_btfws; ptr->rom_version; ptr++) {
3257
		if (ptr->rom_version == rom_ver &&
3258
		    ptr->board_id == board_id)
3259
			return ptr->subdirectory;
3260
	}
3261

3262
	return NULL;
3263
}
3264

3265
static int btusb_qca_send_vendor_req(struct usb_device *udev, u8 request,
3266
				     void *data, u16 size)
3267
{
3268
	int pipe, err;
3269
	u8 *buf;
3270

3271
	buf = kmalloc(size, GFP_KERNEL);
3272
	if (!buf)
3273
		return -ENOMEM;
3274

3275
	/* Found some of USB hosts have IOT issues with ours so that we should
3276
	 * not wait until HCI layer is ready.
3277
	 */
3278
	pipe = usb_rcvctrlpipe(udev, 0);
3279
	err = usb_control_msg(udev, pipe, request, USB_TYPE_VENDOR | USB_DIR_IN,
3280
			      0, 0, buf, size, USB_CTRL_GET_TIMEOUT);
3281
	if (err < 0) {
3282
		dev_err(&udev->dev, "Failed to access otp area (%d)", err);
3283
		goto done;
3284
	}
3285

3286
	memcpy(data, buf, size);
3287

3288
done:
3289
	kfree(buf);
3290

3291
	return err;
3292
}
3293

3294
static int btusb_setup_qca_download_fw(struct hci_dev *hdev,
3295
				       const struct firmware *firmware,
3296
				       size_t hdr_size)
3297
{
3298
	struct btusb_data *btdata = hci_get_drvdata(hdev);
3299
	struct usb_device *udev = btdata->udev;
3300
	size_t count, size, sent = 0;
3301
	int pipe, len, err;
3302
	u8 *buf;
3303

3304
	buf = kmalloc(QCA_DFU_PACKET_LEN, GFP_KERNEL);
3305
	if (!buf)
3306
		return -ENOMEM;
3307

3308
	count = firmware->size;
3309

3310
	size = min_t(size_t, count, hdr_size);
3311
	memcpy(buf, firmware->data, size);
3312

3313
	/* USB patches should go down to controller through USB path
3314
	 * because binary format fits to go down through USB channel.
3315
	 * USB control path is for patching headers and USB bulk is for
3316
	 * patch body.
3317
	 */
3318
	pipe = usb_sndctrlpipe(udev, 0);
3319
	err = usb_control_msg(udev, pipe, QCA_DFU_DOWNLOAD, USB_TYPE_VENDOR,
3320
			      0, 0, buf, size, USB_CTRL_SET_TIMEOUT);
3321
	if (err < 0) {
3322
		bt_dev_err(hdev, "Failed to send headers (%d)", err);
3323
		goto done;
3324
	}
3325

3326
	sent += size;
3327
	count -= size;
3328

3329
	/* ep2 need time to switch from function acl to function dfu,
3330
	 * so we add 20ms delay here.
3331
	 */
3332
	msleep(20);
3333

3334
	while (count) {
3335
		size = min_t(size_t, count, QCA_DFU_PACKET_LEN);
3336

3337
		memcpy(buf, firmware->data + sent, size);
3338

3339
		pipe = usb_sndbulkpipe(udev, 0x02);
3340
		err = usb_bulk_msg(udev, pipe, buf, size, &len,
3341
				   QCA_DFU_TIMEOUT);
3342
		if (err < 0) {
3343
			bt_dev_err(hdev, "Failed to send body at %zd of %zd (%d)",
3344
				   sent, firmware->size, err);
3345
			break;
3346
		}
3347

3348
		if (size != len) {
3349
			bt_dev_err(hdev, "Failed to get bulk buffer");
3350
			err = -EILSEQ;
3351
			break;
3352
		}
3353

3354
		sent  += size;
3355
		count -= size;
3356
	}
3357

3358
done:
3359
	kfree(buf);
3360
	return err;
3361
}
3362

3363
static int btusb_setup_qca_load_rampatch(struct hci_dev *hdev,
3364
					 struct qca_version *ver,
3365
					 const struct qca_device_info *info)
3366
{
3367
	struct qca_rampatch_version *rver;
3368
	const struct firmware *fw;
3369
	const char *fw_subdir;
3370
	u32 ver_rom, ver_patch, rver_rom;
3371
	u16 rver_rom_low, rver_rom_high, rver_patch;
3372
	char fwname[80];
3373
	int err;
3374

3375
	ver_rom = le32_to_cpu(ver->rom_version);
3376
	ver_patch = le32_to_cpu(ver->patch_version);
3377

3378
	fw_subdir = qca_get_fw_subdirectory(ver);
3379
	if (fw_subdir)
3380
		snprintf(fwname, sizeof(fwname), "qca/%s/rampatch_usb_%08x.bin",
3381
			 fw_subdir, ver_rom);
3382
	else
3383
		snprintf(fwname, sizeof(fwname), "qca/rampatch_usb_%08x.bin",
3384
			 ver_rom);
3385

3386
	err = request_firmware(&fw, fwname, &hdev->dev);
3387
	if (err) {
3388
		bt_dev_err(hdev, "failed to request rampatch file: %s (%d)",
3389
			   fwname, err);
3390
		return err;
3391
	}
3392

3393
	bt_dev_info(hdev, "using rampatch file: %s", fwname);
3394

3395
	rver = (struct qca_rampatch_version *)(fw->data + info->ver_offset);
3396
	rver_rom_low = le16_to_cpu(rver->rom_version_low);
3397
	rver_patch = le16_to_cpu(rver->patch_version);
3398

3399
	if (ver_rom & ~0xffffU) {
3400
		rver_rom_high = le16_to_cpu(rver->rom_version_high);
3401
		rver_rom = rver_rom_high << 16 | rver_rom_low;
3402
	} else {
3403
		rver_rom = rver_rom_low;
3404
	}
3405

3406
	bt_dev_info(hdev, "QCA: patch rome 0x%x build 0x%x, "
3407
		    "firmware rome 0x%x build 0x%x",
3408
		    rver_rom, rver_patch, ver_rom, ver_patch);
3409

3410
	if (rver_rom != ver_rom || rver_patch <= ver_patch) {
3411
		bt_dev_err(hdev, "rampatch file version did not match with firmware");
3412
		err = -EINVAL;
3413
		goto done;
3414
	}
3415

3416
	err = btusb_setup_qca_download_fw(hdev, fw, info->rampatch_hdr);
3417

3418
done:
3419
	release_firmware(fw);
3420

3421
	return err;
3422
}
3423

3424
static void btusb_generate_qca_nvm_name(char *fwname, size_t max_size,
3425
					const struct qca_version *ver)
3426
{
3427
	u32 rom_version = le32_to_cpu(ver->rom_version);
3428
	const char *variant, *fw_subdir;
3429
	int len;
3430
	u16 board_id;
3431

3432
	fw_subdir = qca_get_fw_subdirectory(ver);
3433
	board_id = qca_extract_board_id(ver);
3434

3435
	switch (le32_to_cpu(ver->ram_version)) {
3436
	case WCN6855_2_0_RAM_VERSION_GF:
3437
	case WCN6855_2_1_RAM_VERSION_GF:
3438
		variant = "_gf";
3439
		break;
3440
	default:
3441
		variant = NULL;
3442
		break;
3443
	}
3444

3445
	if (fw_subdir)
3446
		len = snprintf(fwname, max_size, "qca/%s/nvm_usb_%08x",
3447
			       fw_subdir, rom_version);
3448
	else
3449
		len = snprintf(fwname, max_size, "qca/nvm_usb_%08x",
3450
			       rom_version);
3451
	if (variant)
3452
		len += snprintf(fwname + len, max_size - len, "%s", variant);
3453
	if (board_id)
3454
		len += snprintf(fwname + len, max_size - len, "_%04x", board_id);
3455
	len += snprintf(fwname + len, max_size - len, ".bin");
3456
}
3457

3458
static int btusb_setup_qca_load_nvm(struct hci_dev *hdev,
3459
				    struct qca_version *ver,
3460
				    const struct qca_device_info *info)
3461
{
3462
	const struct firmware *fw;
3463
	char fwname[80];
3464
	int err;
3465

3466
	btusb_generate_qca_nvm_name(fwname, sizeof(fwname), ver);
3467

3468
	err = request_firmware(&fw, fwname, &hdev->dev);
3469
	if (err) {
3470
		bt_dev_err(hdev, "failed to request NVM file: %s (%d)",
3471
			   fwname, err);
3472
		return err;
3473
	}
3474

3475
	bt_dev_info(hdev, "using NVM file: %s", fwname);
3476

3477
	err = btusb_setup_qca_download_fw(hdev, fw, info->nvm_hdr);
3478

3479
	release_firmware(fw);
3480

3481
	return err;
3482
}
3483

3484
/* identify the ROM version and check whether patches are needed */
3485
static bool btusb_qca_need_patch(struct usb_device *udev)
3486
{
3487
	struct qca_version ver;
3488

3489
	if (btusb_qca_send_vendor_req(udev, QCA_GET_TARGET_VERSION, &ver,
3490
				      sizeof(ver)) < 0)
3491
		return false;
3492
	/* only low ROM versions need patches */
3493
	return !(le32_to_cpu(ver.rom_version) & ~0xffffU);
3494
}
3495

3496
static int btusb_setup_qca(struct hci_dev *hdev)
3497
{
3498
	struct btusb_data *btdata = hci_get_drvdata(hdev);
3499
	struct usb_device *udev = btdata->udev;
3500
	const struct qca_device_info *info = NULL;
3501
	struct qca_version ver;
3502
	u32 ver_rom;
3503
	u8 status;
3504
	int i, err;
3505

3506
	err = btusb_qca_send_vendor_req(udev, QCA_GET_TARGET_VERSION, &ver,
3507
					sizeof(ver));
3508
	if (err < 0)
3509
		return err;
3510

3511
	ver_rom = le32_to_cpu(ver.rom_version);
3512

3513
	for (i = 0; i < ARRAY_SIZE(qca_devices_table); i++) {
3514
		if (ver_rom == qca_devices_table[i].rom_version)
3515
			info = &qca_devices_table[i];
3516
	}
3517
	if (!info) {
3518
		/* If the rom_version is not matched in the qca_devices_table
3519
		 * and the high ROM version is not zero, we assume this chip no
3520
		 * need to load the rampatch and nvm.
3521
		 */
3522
		if (ver_rom & ~0xffffU)
3523
			return 0;
3524

3525
		bt_dev_err(hdev, "don't support firmware rome 0x%x", ver_rom);
3526
		return -ENODEV;
3527
	}
3528

3529
	err = btusb_qca_send_vendor_req(udev, QCA_CHECK_STATUS, &status,
3530
					sizeof(status));
3531
	if (err < 0)
3532
		return err;
3533

3534
	if (!(status & QCA_PATCH_UPDATED)) {
3535
		err = btusb_setup_qca_load_rampatch(hdev, &ver, info);
3536
		if (err < 0)
3537
			return err;
3538
	}
3539

3540
	err = btusb_qca_send_vendor_req(udev, QCA_GET_TARGET_VERSION, &ver,
3541
					sizeof(ver));
3542
	if (err < 0)
3543
		return err;
3544

3545
	btdata->qca_dump.fw_version = le32_to_cpu(ver.patch_version);
3546
	btdata->qca_dump.controller_id = le32_to_cpu(ver.rom_version);
3547

3548
	if (!(status & QCA_SYSCFG_UPDATED)) {
3549
		err = btusb_setup_qca_load_nvm(hdev, &ver, info);
3550
		if (err < 0)
3551
			return err;
3552

3553
		/* WCN6855 2.1 and later will reset to apply firmware downloaded here, so
3554
		 * wait ~100ms for reset Done then go ahead, otherwise, it maybe
3555
		 * cause potential enable failure.
3556
		 */
3557
		if (info->rom_version >= 0x00130201)
3558
			msleep(QCA_BT_RESET_WAIT_MS);
3559
	}
3560

3561
	/* Mark HCI_OP_ENHANCED_SETUP_SYNC_CONN as broken as it doesn't seem to
3562
	 * work with the likes of HSP/HFP mSBC.
3563
	 */
3564
	hci_set_quirk(hdev, HCI_QUIRK_BROKEN_ENHANCED_SETUP_SYNC_CONN);
3565

3566
	return 0;
3567
}
3568

3569
static inline int __set_diag_interface(struct hci_dev *hdev)
3570
{
3571
	struct btusb_data *data = hci_get_drvdata(hdev);
3572
	struct usb_interface *intf = data->diag;
3573
	int i;
3574

3575
	if (!data->diag)
3576
		return -ENODEV;
3577

3578
	data->diag_tx_ep = NULL;
3579
	data->diag_rx_ep = NULL;
3580

3581
	for (i = 0; i < intf->cur_altsetting->desc.bNumEndpoints; i++) {
3582
		struct usb_endpoint_descriptor *ep_desc;
3583

3584
		ep_desc = &intf->cur_altsetting->endpoint[i].desc;
3585

3586
		if (!data->diag_tx_ep && usb_endpoint_is_bulk_out(ep_desc)) {
3587
			data->diag_tx_ep = ep_desc;
3588
			continue;
3589
		}
3590

3591
		if (!data->diag_rx_ep && usb_endpoint_is_bulk_in(ep_desc)) {
3592
			data->diag_rx_ep = ep_desc;
3593
			continue;
3594
		}
3595
	}
3596

3597
	if (!data->diag_tx_ep || !data->diag_rx_ep) {
3598
		bt_dev_err(hdev, "invalid diagnostic descriptors");
3599
		return -ENODEV;
3600
	}
3601

3602
	return 0;
3603
}
3604

3605
static struct urb *alloc_diag_urb(struct hci_dev *hdev, bool enable)
3606
{
3607
	struct btusb_data *data = hci_get_drvdata(hdev);
3608
	struct sk_buff *skb;
3609
	struct urb *urb;
3610
	unsigned int pipe;
3611

3612
	if (!data->diag_tx_ep)
3613
		return ERR_PTR(-ENODEV);
3614

3615
	urb = usb_alloc_urb(0, GFP_KERNEL);
3616
	if (!urb)
3617
		return ERR_PTR(-ENOMEM);
3618

3619
	skb = bt_skb_alloc(2, GFP_KERNEL);
3620
	if (!skb) {
3621
		usb_free_urb(urb);
3622
		return ERR_PTR(-ENOMEM);
3623
	}
3624

3625
	skb_put_u8(skb, 0xf0);
3626
	skb_put_u8(skb, enable);
3627

3628
	pipe = usb_sndbulkpipe(data->udev, data->diag_tx_ep->bEndpointAddress);
3629

3630
	usb_fill_bulk_urb(urb, data->udev, pipe,
3631
			  skb->data, skb->len, btusb_tx_complete, skb);
3632

3633
	skb->dev = (void *)hdev;
3634

3635
	return urb;
3636
}
3637

3638
static int btusb_bcm_set_diag(struct hci_dev *hdev, bool enable)
3639
{
3640
	struct btusb_data *data = hci_get_drvdata(hdev);
3641
	struct urb *urb;
3642

3643
	if (!data->diag)
3644
		return -ENODEV;
3645

3646
	if (!test_bit(HCI_RUNNING, &hdev->flags))
3647
		return -ENETDOWN;
3648

3649
	urb = alloc_diag_urb(hdev, enable);
3650
	if (IS_ERR(urb))
3651
		return PTR_ERR(urb);
3652

3653
	return submit_or_queue_tx_urb(hdev, urb);
3654
}
3655

3656
#ifdef CONFIG_PM
3657
static irqreturn_t btusb_oob_wake_handler(int irq, void *priv)
3658
{
3659
	struct btusb_data *data = priv;
3660

3661
	pm_wakeup_event(&data->udev->dev, 0);
3662
	pm_system_wakeup();
3663

3664
	/* Disable only if not already disabled (keep it balanced) */
3665
	if (test_and_clear_bit(BTUSB_OOB_WAKE_ENABLED, &data->flags)) {
3666
		disable_irq_nosync(irq);
3667
		disable_irq_wake(irq);
3668
	}
3669
	return IRQ_HANDLED;
3670
}
3671

3672
static const struct of_device_id btusb_match_table[] = {
3673
	{ .compatible = "usb1286,204e" },
3674
	{ .compatible = "usbcf3,e300" }, /* QCA6174A */
3675
	{ .compatible = "usb4ca,301a" }, /* QCA6174A (Lite-On) */
3676
	{ }
3677
};
3678
MODULE_DEVICE_TABLE(of, btusb_match_table);
3679

3680
/* Use an oob wakeup pin? */
3681
static int btusb_config_oob_wake(struct hci_dev *hdev)
3682
{
3683
	struct btusb_data *data = hci_get_drvdata(hdev);
3684
	struct device *dev = &data->udev->dev;
3685
	int irq, ret;
3686

3687
	clear_bit(BTUSB_OOB_WAKE_ENABLED, &data->flags);
3688

3689
	if (!of_match_device(btusb_match_table, dev))
3690
		return 0;
3691

3692
	/* Move on if no IRQ specified */
3693
	irq = of_irq_get_byname(dev->of_node, "wakeup");
3694
	if (irq <= 0) {
3695
		bt_dev_dbg(hdev, "%s: no OOB Wakeup IRQ in DT", __func__);
3696
		return 0;
3697
	}
3698

3699
	irq_set_status_flags(irq, IRQ_NOAUTOEN);
3700
	ret = devm_request_irq(&hdev->dev, irq, btusb_oob_wake_handler,
3701
			       0, "OOB Wake-on-BT", data);
3702
	if (ret) {
3703
		bt_dev_err(hdev, "%s: IRQ request failed", __func__);
3704
		return ret;
3705
	}
3706

3707
	ret = device_init_wakeup(dev, true);
3708
	if (ret) {
3709
		bt_dev_err(hdev, "%s: failed to init_wakeup", __func__);
3710
		return ret;
3711
	}
3712

3713
	data->oob_wake_irq = irq;
3714
	bt_dev_info(hdev, "OOB Wake-on-BT configured at IRQ %u", irq);
3715
	return 0;
3716
}
3717
#endif
3718

3719
static void btusb_check_needs_reset_resume(struct usb_interface *intf)
3720
{
3721
	if (dmi_check_system(btusb_needs_reset_resume_table))
3722
		interface_to_usbdev(intf)->quirks |= USB_QUIRK_RESET_RESUME;
3723
}
3724

3725
static bool btusb_wakeup(struct hci_dev *hdev)
3726
{
3727
	struct btusb_data *data = hci_get_drvdata(hdev);
3728

3729
	return device_may_wakeup(&data->udev->dev);
3730
}
3731

3732
static int btusb_shutdown_qca(struct hci_dev *hdev)
3733
{
3734
	struct sk_buff *skb;
3735

3736
	skb = __hci_cmd_sync(hdev, HCI_OP_RESET, 0, NULL, HCI_INIT_TIMEOUT);
3737
	if (IS_ERR(skb)) {
3738
		bt_dev_err(hdev, "HCI reset during shutdown failed");
3739
		return PTR_ERR(skb);
3740
	}
3741
	kfree_skb(skb);
3742

3743
	return 0;
3744
}
3745

3746
static ssize_t force_poll_sync_read(struct file *file, char __user *user_buf,
3747
				    size_t count, loff_t *ppos)
3748
{
3749
	struct btusb_data *data = file->private_data;
3750
	char buf[3];
3751

3752
	buf[0] = data->poll_sync ? 'Y' : 'N';
3753
	buf[1] = '\n';
3754
	buf[2] = '\0';
3755
	return simple_read_from_buffer(user_buf, count, ppos, buf, 2);
3756
}
3757

3758
static ssize_t force_poll_sync_write(struct file *file,
3759
				     const char __user *user_buf,
3760
				     size_t count, loff_t *ppos)
3761
{
3762
	struct btusb_data *data = file->private_data;
3763
	bool enable;
3764
	int err;
3765

3766
	err = kstrtobool_from_user(user_buf, count, &enable);
3767
	if (err)
3768
		return err;
3769

3770
	/* Only allow changes while the adapter is down */
3771
	if (test_bit(HCI_UP, &data->hdev->flags))
3772
		return -EPERM;
3773

3774
	if (data->poll_sync == enable)
3775
		return -EALREADY;
3776

3777
	data->poll_sync = enable;
3778

3779
	return count;
3780
}
3781

3782
static const struct file_operations force_poll_sync_fops = {
3783
	.owner		= THIS_MODULE,
3784
	.open		= simple_open,
3785
	.read		= force_poll_sync_read,
3786
	.write		= force_poll_sync_write,
3787
	.llseek		= default_llseek,
3788
};
3789

3790
#define BTUSB_HCI_DRV_OP_SUPPORTED_ALTSETTINGS \
3791
		hci_opcode_pack(HCI_DRV_OGF_DRIVER_SPECIFIC, 0x0000)
3792
#define BTUSB_HCI_DRV_SUPPORTED_ALTSETTINGS_SIZE	0
3793
struct btusb_hci_drv_rp_supported_altsettings {
3794
	__u8	num;
3795
	__u8	altsettings[];
3796
} __packed;
3797

3798
#define BTUSB_HCI_DRV_OP_SWITCH_ALTSETTING \
3799
		hci_opcode_pack(HCI_DRV_OGF_DRIVER_SPECIFIC, 0x0001)
3800
#define BTUSB_HCI_DRV_SWITCH_ALTSETTING_SIZE		1
3801
struct btusb_hci_drv_cmd_switch_altsetting {
3802
	__u8	altsetting;
3803
} __packed;
3804

3805
static const struct {
3806
	u16 opcode;
3807
	const char *desc;
3808
} btusb_hci_drv_supported_commands[] = {
3809
	/* Common commands */
3810
	{ HCI_DRV_OP_READ_INFO, "Read Info" },
3811

3812
	/* Driver specific commands */
3813
	{ BTUSB_HCI_DRV_OP_SUPPORTED_ALTSETTINGS, "Supported Altsettings" },
3814
	{ BTUSB_HCI_DRV_OP_SWITCH_ALTSETTING,     "Switch Altsetting" },
3815
};
3816
static int btusb_hci_drv_read_info(struct hci_dev *hdev, void *data,
3817
				   u16 data_len)
3818
{
3819
	struct hci_drv_rp_read_info *rp;
3820
	size_t rp_size;
3821
	int err, i;
3822
	u16 opcode, num_supported_commands =
3823
		ARRAY_SIZE(btusb_hci_drv_supported_commands);
3824

3825
	rp_size = sizeof(*rp) + num_supported_commands * 2;
3826

3827
	rp = kmalloc(rp_size, GFP_KERNEL);
3828
	if (!rp)
3829
		return -ENOMEM;
3830

3831
	strscpy_pad(rp->driver_name, btusb_driver.name);
3832

3833
	rp->num_supported_commands = cpu_to_le16(num_supported_commands);
3834
	for (i = 0; i < num_supported_commands; i++) {
3835
		opcode = btusb_hci_drv_supported_commands[i].opcode;
3836
		bt_dev_info(hdev,
3837
			    "Supported HCI Drv command (0x%02x|0x%04x): %s",
3838
			    hci_opcode_ogf(opcode),
3839
			    hci_opcode_ocf(opcode),
3840
			    btusb_hci_drv_supported_commands[i].desc);
3841
		rp->supported_commands[i] = cpu_to_le16(opcode);
3842
	}
3843

3844
	err = hci_drv_cmd_complete(hdev, HCI_DRV_OP_READ_INFO,
3845
				   HCI_DRV_STATUS_SUCCESS, rp, rp_size);
3846

3847
	kfree(rp);
3848
	return err;
3849
}
3850

3851
static int btusb_hci_drv_supported_altsettings(struct hci_dev *hdev, void *data,
3852
					       u16 data_len)
3853
{
3854
	struct btusb_data *drvdata = hci_get_drvdata(hdev);
3855
	struct btusb_hci_drv_rp_supported_altsettings *rp;
3856
	size_t rp_size;
3857
	int err;
3858
	u8 i;
3859

3860
	/* There are at most 7 alt (0 - 6) */
3861
	rp = kmalloc(sizeof(*rp) + 7, GFP_KERNEL);
3862
	if (!rp)
3863
		return -ENOMEM;
3864

3865
	rp->num = 0;
3866
	if (!drvdata->isoc)
3867
		goto done;
3868

3869
	for (i = 0; i <= 6; i++) {
3870
		if (btusb_find_altsetting(drvdata, i))
3871
			rp->altsettings[rp->num++] = i;
3872
	}
3873

3874
done:
3875
	rp_size = sizeof(*rp) + rp->num;
3876

3877
	err = hci_drv_cmd_complete(hdev, BTUSB_HCI_DRV_OP_SUPPORTED_ALTSETTINGS,
3878
				   HCI_DRV_STATUS_SUCCESS, rp, rp_size);
3879
	kfree(rp);
3880
	return err;
3881
}
3882

3883
static int btusb_hci_drv_switch_altsetting(struct hci_dev *hdev, void *data,
3884
					   u16 data_len)
3885
{
3886
	struct btusb_hci_drv_cmd_switch_altsetting *cmd = data;
3887
	u8 status;
3888

3889
	if (cmd->altsetting > 6) {
3890
		status = HCI_DRV_STATUS_INVALID_PARAMETERS;
3891
	} else {
3892
		if (btusb_switch_alt_setting(hdev, cmd->altsetting))
3893
			status = HCI_DRV_STATUS_UNSPECIFIED_ERROR;
3894
		else
3895
			status = HCI_DRV_STATUS_SUCCESS;
3896
	}
3897

3898
	return hci_drv_cmd_status(hdev, BTUSB_HCI_DRV_OP_SWITCH_ALTSETTING,
3899
				  status);
3900
}
3901

3902
static const struct hci_drv_handler btusb_hci_drv_common_handlers[] = {
3903
	{ btusb_hci_drv_read_info,	HCI_DRV_READ_INFO_SIZE },
3904
};
3905

3906
static const struct hci_drv_handler btusb_hci_drv_specific_handlers[] = {
3907
	{ btusb_hci_drv_supported_altsettings,
3908
				BTUSB_HCI_DRV_SUPPORTED_ALTSETTINGS_SIZE },
3909
	{ btusb_hci_drv_switch_altsetting,
3910
				BTUSB_HCI_DRV_SWITCH_ALTSETTING_SIZE },
3911
};
3912

3913
static struct hci_drv btusb_hci_drv = {
3914
	.common_handler_count	= ARRAY_SIZE(btusb_hci_drv_common_handlers),
3915
	.common_handlers	= btusb_hci_drv_common_handlers,
3916
	.specific_handler_count	= ARRAY_SIZE(btusb_hci_drv_specific_handlers),
3917
	.specific_handlers	= btusb_hci_drv_specific_handlers,
3918
};
3919

3920
static int btusb_probe(struct usb_interface *intf,
3921
		       const struct usb_device_id *id)
3922
{
3923
	struct usb_endpoint_descriptor *ep_desc;
3924
	struct gpio_desc *reset_gpio;
3925
	struct btusb_data *data;
3926
	struct hci_dev *hdev;
3927
	unsigned ifnum_base;
3928
	int i, err, priv_size;
3929

3930
	BT_DBG("intf %p id %p", intf, id);
3931

3932
	if ((id->driver_info & BTUSB_IFNUM_2) &&
3933
	    (intf->cur_altsetting->desc.bInterfaceNumber != 0) &&
3934
	    (intf->cur_altsetting->desc.bInterfaceNumber != 2))
3935
		return -ENODEV;
3936

3937
	ifnum_base = intf->cur_altsetting->desc.bInterfaceNumber;
3938

3939
	if (!id->driver_info) {
3940
		const struct usb_device_id *match;
3941

3942
		match = usb_match_id(intf, quirks_table);
3943
		if (match)
3944
			id = match;
3945
	}
3946

3947
	if (id->driver_info == BTUSB_IGNORE)
3948
		return -ENODEV;
3949

3950
	if (id->driver_info & BTUSB_ATH3012) {
3951
		struct usb_device *udev = interface_to_usbdev(intf);
3952

3953
		/* Old firmware would otherwise let ath3k driver load
3954
		 * patch and sysconfig files
3955
		 */
3956
		if (le16_to_cpu(udev->descriptor.bcdDevice) <= 0x0001 &&
3957
		    !btusb_qca_need_patch(udev))
3958
			return -ENODEV;
3959
	}
3960

3961
	data = devm_kzalloc(&intf->dev, sizeof(*data), GFP_KERNEL);
3962
	if (!data)
3963
		return -ENOMEM;
3964

3965
	for (i = 0; i < intf->cur_altsetting->desc.bNumEndpoints; i++) {
3966
		ep_desc = &intf->cur_altsetting->endpoint[i].desc;
3967

3968
		if (!data->intr_ep && usb_endpoint_is_int_in(ep_desc)) {
3969
			data->intr_ep = ep_desc;
3970
			continue;
3971
		}
3972

3973
		if (!data->bulk_tx_ep && usb_endpoint_is_bulk_out(ep_desc)) {
3974
			data->bulk_tx_ep = ep_desc;
3975
			continue;
3976
		}
3977

3978
		if (!data->bulk_rx_ep && usb_endpoint_is_bulk_in(ep_desc)) {
3979
			data->bulk_rx_ep = ep_desc;
3980
			continue;
3981
		}
3982
	}
3983

3984
	if (!data->intr_ep || !data->bulk_tx_ep || !data->bulk_rx_ep)
3985
		return -ENODEV;
3986

3987
	if (id->driver_info & BTUSB_AMP) {
3988
		data->cmdreq_type = USB_TYPE_CLASS | 0x01;
3989
		data->cmdreq = 0x2b;
3990
	} else {
3991
		data->cmdreq_type = USB_TYPE_CLASS;
3992
		data->cmdreq = 0x00;
3993
	}
3994

3995
	data->udev = interface_to_usbdev(intf);
3996
	data->intf = intf;
3997

3998
	INIT_WORK(&data->work, btusb_work);
3999
	INIT_WORK(&data->waker, btusb_waker);
4000
	INIT_DELAYED_WORK(&data->rx_work, btusb_rx_work);
4001

4002
	skb_queue_head_init(&data->acl_q);
4003

4004
	init_usb_anchor(&data->deferred);
4005
	init_usb_anchor(&data->tx_anchor);
4006
	spin_lock_init(&data->txlock);
4007

4008
	init_usb_anchor(&data->intr_anchor);
4009
	init_usb_anchor(&data->bulk_anchor);
4010
	init_usb_anchor(&data->isoc_anchor);
4011
	init_usb_anchor(&data->diag_anchor);
4012
	init_usb_anchor(&data->ctrl_anchor);
4013
	spin_lock_init(&data->rxlock);
4014

4015
	priv_size = 0;
4016

4017
	data->recv_event = hci_recv_frame;
4018
	data->recv_bulk = btusb_recv_bulk;
4019

4020
	if (id->driver_info & BTUSB_INTEL_COMBINED) {
4021
		/* Allocate extra space for Intel device */
4022
		priv_size += sizeof(struct btintel_data);
4023

4024
		/* Override the rx handlers */
4025
		data->recv_event = btintel_recv_event;
4026
		data->recv_bulk = btusb_recv_bulk_intel;
4027
	} else if (id->driver_info & BTUSB_REALTEK) {
4028
		/* Allocate extra space for Realtek device */
4029
		priv_size += sizeof(struct btrealtek_data);
4030

4031
		data->recv_event = btusb_recv_event_realtek;
4032
	} else if (id->driver_info & BTUSB_MEDIATEK) {
4033
		/* Allocate extra space for Mediatek device */
4034
		priv_size += sizeof(struct btmtk_data);
4035
	}
4036

4037
	data->recv_acl = hci_recv_frame;
4038

4039
	hdev = hci_alloc_dev_priv(priv_size);
4040
	if (!hdev)
4041
		return -ENOMEM;
4042

4043
	hdev->bus = HCI_USB;
4044
	hci_set_drvdata(hdev, data);
4045

4046
	data->hdev = hdev;
4047

4048
	SET_HCIDEV_DEV(hdev, &intf->dev);
4049

4050
	reset_gpio = gpiod_get_optional(&data->udev->dev, "reset",
4051
					GPIOD_OUT_LOW);
4052
	if (IS_ERR(reset_gpio)) {
4053
		err = PTR_ERR(reset_gpio);
4054
		goto out_free_dev;
4055
	} else if (reset_gpio) {
4056
		data->reset_gpio = reset_gpio;
4057
	}
4058

4059
	hdev->open    = btusb_open;
4060
	hdev->close   = btusb_close;
4061
	hdev->flush   = btusb_flush;
4062
	hdev->send    = btusb_send_frame;
4063
	hdev->notify  = btusb_notify;
4064
	hdev->wakeup  = btusb_wakeup;
4065
	hdev->hci_drv = &btusb_hci_drv;
4066

4067
#ifdef CONFIG_PM
4068
	err = btusb_config_oob_wake(hdev);
4069
	if (err)
4070
		goto out_free_dev;
4071

4072
	/* Marvell devices may need a specific chip configuration */
4073
	if (id->driver_info & BTUSB_MARVELL && data->oob_wake_irq) {
4074
		err = marvell_config_oob_wake(hdev);
4075
		if (err)
4076
			goto out_free_dev;
4077
	}
4078
#endif
4079
	if (id->driver_info & BTUSB_CW6622)
4080
		hci_set_quirk(hdev, HCI_QUIRK_BROKEN_STORED_LINK_KEY);
4081

4082
	if (id->driver_info & BTUSB_BCM2045)
4083
		hci_set_quirk(hdev, HCI_QUIRK_BROKEN_STORED_LINK_KEY);
4084

4085
	if (id->driver_info & BTUSB_BCM92035)
4086
		hdev->setup = btusb_setup_bcm92035;
4087

4088
	if (IS_ENABLED(CONFIG_BT_HCIBTUSB_BCM) &&
4089
	    (id->driver_info & BTUSB_BCM_PATCHRAM)) {
4090
		hdev->manufacturer = 15;
4091
		hdev->setup = btbcm_setup_patchram;
4092
		hdev->set_diag = btusb_bcm_set_diag;
4093
		hdev->set_bdaddr = btbcm_set_bdaddr;
4094

4095
		/* Broadcom LM_DIAG Interface numbers are hardcoded */
4096
		data->diag = usb_ifnum_to_if(data->udev, ifnum_base + 2);
4097
	}
4098

4099
	if (IS_ENABLED(CONFIG_BT_HCIBTUSB_BCM) &&
4100
	    (id->driver_info & BTUSB_BCM_APPLE)) {
4101
		hdev->manufacturer = 15;
4102
		hdev->setup = btbcm_setup_apple;
4103
		hdev->set_diag = btusb_bcm_set_diag;
4104

4105
		/* Broadcom LM_DIAG Interface numbers are hardcoded */
4106
		data->diag = usb_ifnum_to_if(data->udev, ifnum_base + 2);
4107
	}
4108

4109
	/* Combined Intel Device setup to support multiple setup routine */
4110
	if (id->driver_info & BTUSB_INTEL_COMBINED) {
4111
		err = btintel_configure_setup(hdev, btusb_driver.name);
4112
		if (err)
4113
			goto out_free_dev;
4114

4115
		/* Transport specific configuration */
4116
		hdev->send = btusb_send_frame_intel;
4117
		hdev->reset = btusb_intel_reset;
4118

4119
		if (id->driver_info & BTUSB_INTEL_NO_WBS_SUPPORT)
4120
			btintel_set_flag(hdev, INTEL_ROM_LEGACY_NO_WBS_SUPPORT);
4121

4122
		if (id->driver_info & BTUSB_INTEL_BROKEN_INITIAL_NCMD)
4123
			btintel_set_flag(hdev, INTEL_BROKEN_INITIAL_NCMD);
4124

4125
		if (id->driver_info & BTUSB_INTEL_BROKEN_SHUTDOWN_LED)
4126
			btintel_set_flag(hdev, INTEL_BROKEN_SHUTDOWN_LED);
4127
	}
4128

4129
	if (id->driver_info & BTUSB_MARVELL)
4130
		hdev->set_bdaddr = btusb_set_bdaddr_marvell;
4131

4132
	if (IS_ENABLED(CONFIG_BT_HCIBTUSB_MTK) &&
4133
	    (id->driver_info & BTUSB_MEDIATEK)) {
4134
		hdev->setup = btusb_mtk_setup;
4135
		hdev->shutdown = btusb_mtk_shutdown;
4136
		hdev->manufacturer = 70;
4137
		hdev->reset = btmtk_reset_sync;
4138
		hdev->set_bdaddr = btmtk_set_bdaddr;
4139
		hdev->send = btusb_send_frame_mtk;
4140
		hci_set_quirk(hdev, HCI_QUIRK_BROKEN_ENHANCED_SETUP_SYNC_CONN);
4141
		hci_set_quirk(hdev, HCI_QUIRK_NON_PERSISTENT_SETUP);
4142
		data->recv_acl = btmtk_usb_recv_acl;
4143
		data->suspend = btmtk_usb_suspend;
4144
		data->resume = btmtk_usb_resume;
4145
		data->disconnect = btusb_mtk_disconnect;
4146
	}
4147

4148
	if (id->driver_info & BTUSB_SWAVE) {
4149
		hci_set_quirk(hdev, HCI_QUIRK_FIXUP_INQUIRY_MODE);
4150
		hci_set_quirk(hdev, HCI_QUIRK_BROKEN_LOCAL_COMMANDS);
4151
	}
4152

4153
	if (id->driver_info & BTUSB_INTEL_BOOT) {
4154
		hdev->manufacturer = 2;
4155
		hci_set_quirk(hdev, HCI_QUIRK_RAW_DEVICE);
4156
	}
4157

4158
	if (id->driver_info & BTUSB_ATH3012) {
4159
		data->setup_on_usb = btusb_setup_qca;
4160
		hdev->set_bdaddr = btusb_set_bdaddr_ath3012;
4161
		hci_set_quirk(hdev, HCI_QUIRK_SIMULTANEOUS_DISCOVERY);
4162
		hci_set_quirk(hdev, HCI_QUIRK_STRICT_DUPLICATE_FILTER);
4163
	}
4164

4165
	if (id->driver_info & BTUSB_QCA_ROME) {
4166
		data->setup_on_usb = btusb_setup_qca;
4167
		hdev->shutdown = btusb_shutdown_qca;
4168
		hdev->set_bdaddr = btusb_set_bdaddr_ath3012;
4169
		hdev->reset = btusb_qca_reset;
4170
		hci_set_quirk(hdev, HCI_QUIRK_SIMULTANEOUS_DISCOVERY);
4171
		btusb_check_needs_reset_resume(intf);
4172
	}
4173

4174
	if (id->driver_info & BTUSB_QCA_WCN6855) {
4175
		data->qca_dump.id_vendor = id->idVendor;
4176
		data->qca_dump.id_product = id->idProduct;
4177
		data->recv_event = btusb_recv_evt_qca;
4178
		data->recv_acl = btusb_recv_acl_qca;
4179
		hci_devcd_register(hdev, btusb_coredump_qca, btusb_dump_hdr_qca, NULL);
4180
		data->setup_on_usb = btusb_setup_qca;
4181
		hdev->shutdown = btusb_shutdown_qca;
4182
		hdev->set_bdaddr = btusb_set_bdaddr_wcn6855;
4183
		hdev->reset = btusb_qca_reset;
4184
		hci_set_quirk(hdev, HCI_QUIRK_SIMULTANEOUS_DISCOVERY);
4185
		hci_set_msft_opcode(hdev, 0xFD70);
4186
	}
4187

4188
	if (id->driver_info & BTUSB_AMP) {
4189
		/* AMP controllers do not support SCO packets */
4190
		data->isoc = NULL;
4191
	} else {
4192
		/* Interface orders are hardcoded in the specification */
4193
		data->isoc = usb_ifnum_to_if(data->udev, ifnum_base + 1);
4194
		data->isoc_ifnum = ifnum_base + 1;
4195
	}
4196

4197
	if (IS_ENABLED(CONFIG_BT_HCIBTUSB_RTL) &&
4198
	    (id->driver_info & BTUSB_REALTEK)) {
4199
		btrtl_set_driver_name(hdev, btusb_driver.name);
4200
		hdev->setup = btusb_setup_realtek;
4201
		hdev->shutdown = btrtl_shutdown_realtek;
4202
		hdev->reset = btusb_rtl_reset;
4203
		hdev->hw_error = btusb_rtl_hw_error;
4204

4205
		/* Realtek devices need to set remote wakeup on auto-suspend */
4206
		set_bit(BTUSB_WAKEUP_AUTOSUSPEND, &data->flags);
4207
		set_bit(BTUSB_USE_ALT3_FOR_WBS, &data->flags);
4208
	}
4209

4210
	if (id->driver_info & BTUSB_ACTIONS_SEMI) {
4211
		/* Support is advertised, but not implemented */
4212
		hci_set_quirk(hdev, HCI_QUIRK_BROKEN_ERR_DATA_REPORTING);
4213
		hci_set_quirk(hdev, HCI_QUIRK_BROKEN_READ_TRANSMIT_POWER);
4214
		hci_set_quirk(hdev, HCI_QUIRK_BROKEN_SET_RPA_TIMEOUT);
4215
		hci_set_quirk(hdev, HCI_QUIRK_BROKEN_EXT_SCAN);
4216
		hci_set_quirk(hdev, HCI_QUIRK_BROKEN_READ_ENC_KEY_SIZE);
4217
		hci_set_quirk(hdev, HCI_QUIRK_BROKEN_EXT_CREATE_CONN);
4218
		hci_set_quirk(hdev, HCI_QUIRK_BROKEN_WRITE_AUTH_PAYLOAD_TIMEOUT);
4219
	}
4220

4221
	if (!reset)
4222
		hci_set_quirk(hdev, HCI_QUIRK_RESET_ON_CLOSE);
4223

4224
	if (force_scofix || id->driver_info & BTUSB_WRONG_SCO_MTU) {
4225
		if (!disable_scofix)
4226
			hci_set_quirk(hdev, HCI_QUIRK_FIXUP_BUFFER_SIZE);
4227
	}
4228

4229
	if (id->driver_info & BTUSB_BROKEN_ISOC)
4230
		data->isoc = NULL;
4231

4232
	if (id->driver_info & BTUSB_WIDEBAND_SPEECH)
4233
		hci_set_quirk(hdev, HCI_QUIRK_WIDEBAND_SPEECH_SUPPORTED);
4234

4235
	if (id->driver_info & BTUSB_INVALID_LE_STATES)
4236
		hci_set_quirk(hdev, HCI_QUIRK_BROKEN_LE_STATES);
4237

4238
	if (id->driver_info & BTUSB_DIGIANSWER) {
4239
		data->cmdreq_type = USB_TYPE_VENDOR;
4240
		hci_set_quirk(hdev, HCI_QUIRK_RESET_ON_CLOSE);
4241
	}
4242

4243
	if (id->driver_info & BTUSB_CSR) {
4244
		struct usb_device *udev = data->udev;
4245
		u16 bcdDevice = le16_to_cpu(udev->descriptor.bcdDevice);
4246

4247
		/* Old firmware would otherwise execute USB reset */
4248
		if (bcdDevice < 0x117)
4249
			hci_set_quirk(hdev, HCI_QUIRK_RESET_ON_CLOSE);
4250

4251
		/* This must be set first in case we disable it for fakes */
4252
		hci_set_quirk(hdev, HCI_QUIRK_SIMULTANEOUS_DISCOVERY);
4253

4254
		/* Fake CSR devices with broken commands */
4255
		if (le16_to_cpu(udev->descriptor.idVendor)  == 0x0a12 &&
4256
		    le16_to_cpu(udev->descriptor.idProduct) == 0x0001)
4257
			hdev->setup = btusb_setup_csr;
4258
	}
4259

4260
	if (id->driver_info & BTUSB_SNIFFER) {
4261
		struct usb_device *udev = data->udev;
4262

4263
		/* New sniffer firmware has crippled HCI interface */
4264
		if (le16_to_cpu(udev->descriptor.bcdDevice) > 0x997)
4265
			hci_set_quirk(hdev, HCI_QUIRK_RAW_DEVICE);
4266
	}
4267

4268
	if (id->driver_info & BTUSB_INTEL_BOOT) {
4269
		/* A bug in the bootloader causes that interrupt interface is
4270
		 * only enabled after receiving SetInterface(0, AltSetting=0).
4271
		 */
4272
		err = usb_set_interface(data->udev, 0, 0);
4273
		if (err < 0) {
4274
			BT_ERR("failed to set interface 0, alt 0 %d", err);
4275
			goto out_free_dev;
4276
		}
4277
	}
4278

4279
	if (data->isoc) {
4280
		err = usb_driver_claim_interface(&btusb_driver,
4281
						 data->isoc, data);
4282
		if (err < 0)
4283
			goto out_free_dev;
4284
	}
4285

4286
	if (IS_ENABLED(CONFIG_BT_HCIBTUSB_BCM) && data->diag) {
4287
		if (!usb_driver_claim_interface(&btusb_driver,
4288
						data->diag, data))
4289
			__set_diag_interface(hdev);
4290
		else
4291
			data->diag = NULL;
4292
	}
4293

4294
	if (enable_autosuspend)
4295
		usb_enable_autosuspend(data->udev);
4296

4297
	data->poll_sync = enable_poll_sync;
4298

4299
	err = hci_register_dev(hdev);
4300
	if (err < 0)
4301
		goto out_free_dev;
4302

4303
	usb_set_intfdata(intf, data);
4304

4305
	debugfs_create_file("force_poll_sync", 0644, hdev->debugfs, data,
4306
			    &force_poll_sync_fops);
4307

4308
	return 0;
4309

4310
out_free_dev:
4311
	if (data->reset_gpio)
4312
		gpiod_put(data->reset_gpio);
4313
	hci_free_dev(hdev);
4314
	return err;
4315
}
4316

4317
static void btusb_disconnect(struct usb_interface *intf)
4318
{
4319
	struct btusb_data *data = usb_get_intfdata(intf);
4320
	struct hci_dev *hdev;
4321

4322
	BT_DBG("intf %p", intf);
4323

4324
	if (!data)
4325
		return;
4326

4327
	hdev = data->hdev;
4328
	usb_set_intfdata(data->intf, NULL);
4329

4330
	if (data->isoc)
4331
		usb_set_intfdata(data->isoc, NULL);
4332

4333
	if (data->diag)
4334
		usb_set_intfdata(data->diag, NULL);
4335

4336
	if (data->disconnect)
4337
		data->disconnect(hdev);
4338

4339
	hci_unregister_dev(hdev);
4340

4341
	if (intf == data->intf) {
4342
		if (data->isoc)
4343
			usb_driver_release_interface(&btusb_driver, data->isoc);
4344
		if (data->diag)
4345
			usb_driver_release_interface(&btusb_driver, data->diag);
4346
	} else if (intf == data->isoc) {
4347
		if (data->diag)
4348
			usb_driver_release_interface(&btusb_driver, data->diag);
4349
		usb_driver_release_interface(&btusb_driver, data->intf);
4350
	} else if (intf == data->diag) {
4351
		usb_driver_release_interface(&btusb_driver, data->intf);
4352
		if (data->isoc)
4353
			usb_driver_release_interface(&btusb_driver, data->isoc);
4354
	}
4355

4356
	if (data->oob_wake_irq)
4357
		device_init_wakeup(&data->udev->dev, false);
4358

4359
	if (data->reset_gpio)
4360
		gpiod_put(data->reset_gpio);
4361

4362
	hci_free_dev(hdev);
4363
}
4364

4365
#ifdef CONFIG_PM
4366
static int btusb_suspend(struct usb_interface *intf, pm_message_t message)
4367
{
4368
	struct btusb_data *data = usb_get_intfdata(intf);
4369

4370
	BT_DBG("intf %p", intf);
4371

4372
	/* Don't auto-suspend if there are connections; external suspend calls
4373
	 * shall never fail.
4374
	 */
4375
	if (PMSG_IS_AUTO(message) && hci_conn_count(data->hdev))
4376
		return -EBUSY;
4377

4378
	if (data->suspend_count++)
4379
		return 0;
4380

4381
	spin_lock_irq(&data->txlock);
4382
	if (!(PMSG_IS_AUTO(message) && data->tx_in_flight)) {
4383
		set_bit(BTUSB_SUSPENDING, &data->flags);
4384
		spin_unlock_irq(&data->txlock);
4385
	} else {
4386
		spin_unlock_irq(&data->txlock);
4387
		data->suspend_count--;
4388
		return -EBUSY;
4389
	}
4390

4391
	cancel_work_sync(&data->work);
4392

4393
	if (data->suspend)
4394
		data->suspend(data->hdev);
4395

4396
	btusb_stop_traffic(data);
4397
	usb_kill_anchored_urbs(&data->tx_anchor);
4398

4399
	if (data->oob_wake_irq && device_may_wakeup(&data->udev->dev)) {
4400
		set_bit(BTUSB_OOB_WAKE_ENABLED, &data->flags);
4401
		enable_irq_wake(data->oob_wake_irq);
4402
		enable_irq(data->oob_wake_irq);
4403
	}
4404

4405
	/* For global suspend, Realtek devices lose the loaded fw
4406
	 * in them. But for autosuspend, firmware should remain.
4407
	 * Actually, it depends on whether the usb host sends
4408
	 * set feature (enable wakeup) or not.
4409
	 */
4410
	if (test_bit(BTUSB_WAKEUP_AUTOSUSPEND, &data->flags)) {
4411
		if (PMSG_IS_AUTO(message) &&
4412
		    device_can_wakeup(&data->udev->dev))
4413
			data->udev->do_remote_wakeup = 1;
4414
		else if (!PMSG_IS_AUTO(message) &&
4415
			 !device_may_wakeup(&data->udev->dev)) {
4416
			data->udev->do_remote_wakeup = 0;
4417
			data->udev->reset_resume = 1;
4418
		}
4419
	}
4420

4421
	return 0;
4422
}
4423

4424
static void play_deferred(struct btusb_data *data)
4425
{
4426
	struct urb *urb;
4427
	int err;
4428

4429
	while ((urb = usb_get_from_anchor(&data->deferred))) {
4430
		usb_anchor_urb(urb, &data->tx_anchor);
4431

4432
		err = usb_submit_urb(urb, GFP_ATOMIC);
4433
		if (err < 0) {
4434
			if (err != -EPERM && err != -ENODEV)
4435
				BT_ERR("%s urb %p submission failed (%d)",
4436
				       data->hdev->name, urb, -err);
4437
			kfree(urb->setup_packet);
4438
			usb_unanchor_urb(urb);
4439
			usb_free_urb(urb);
4440
			break;
4441
		}
4442

4443
		data->tx_in_flight++;
4444
		usb_free_urb(urb);
4445
	}
4446

4447
	/* Cleanup the rest deferred urbs. */
4448
	while ((urb = usb_get_from_anchor(&data->deferred))) {
4449
		kfree(urb->setup_packet);
4450
		usb_free_urb(urb);
4451
	}
4452
}
4453

4454
static int btusb_resume(struct usb_interface *intf)
4455
{
4456
	struct btusb_data *data = usb_get_intfdata(intf);
4457
	struct hci_dev *hdev = data->hdev;
4458
	int err = 0;
4459

4460
	BT_DBG("intf %p", intf);
4461

4462
	if (--data->suspend_count)
4463
		return 0;
4464

4465
	/* Disable only if not already disabled (keep it balanced) */
4466
	if (test_and_clear_bit(BTUSB_OOB_WAKE_ENABLED, &data->flags)) {
4467
		disable_irq(data->oob_wake_irq);
4468
		disable_irq_wake(data->oob_wake_irq);
4469
	}
4470

4471
	if (!test_bit(HCI_RUNNING, &hdev->flags))
4472
		goto done;
4473

4474
	if (test_bit(BTUSB_INTR_RUNNING, &data->flags)) {
4475
		err = btusb_submit_intr_urb(hdev, GFP_NOIO);
4476
		if (err < 0) {
4477
			clear_bit(BTUSB_INTR_RUNNING, &data->flags);
4478
			goto failed;
4479
		}
4480
	}
4481

4482
	if (test_bit(BTUSB_BULK_RUNNING, &data->flags)) {
4483
		err = btusb_submit_bulk_urb(hdev, GFP_NOIO);
4484
		if (err < 0) {
4485
			clear_bit(BTUSB_BULK_RUNNING, &data->flags);
4486
			goto failed;
4487
		}
4488

4489
		btusb_submit_bulk_urb(hdev, GFP_NOIO);
4490
	}
4491

4492
	if (test_bit(BTUSB_ISOC_RUNNING, &data->flags)) {
4493
		if (btusb_submit_isoc_urb(hdev, GFP_NOIO) < 0)
4494
			clear_bit(BTUSB_ISOC_RUNNING, &data->flags);
4495
		else
4496
			btusb_submit_isoc_urb(hdev, GFP_NOIO);
4497
	}
4498

4499
	if (data->resume)
4500
		data->resume(hdev);
4501

4502
	spin_lock_irq(&data->txlock);
4503
	play_deferred(data);
4504
	clear_bit(BTUSB_SUSPENDING, &data->flags);
4505
	spin_unlock_irq(&data->txlock);
4506
	schedule_work(&data->work);
4507

4508
	return 0;
4509

4510
failed:
4511
	usb_scuttle_anchored_urbs(&data->deferred);
4512
done:
4513
	spin_lock_irq(&data->txlock);
4514
	clear_bit(BTUSB_SUSPENDING, &data->flags);
4515
	spin_unlock_irq(&data->txlock);
4516

4517
	return err;
4518
}
4519
#endif
4520

4521
#ifdef CONFIG_DEV_COREDUMP
4522
static void btusb_coredump(struct device *dev)
4523
{
4524
	struct btusb_data *data = dev_get_drvdata(dev);
4525
	struct hci_dev *hdev = data->hdev;
4526

4527
	if (hdev->dump.coredump)
4528
		hdev->dump.coredump(hdev);
4529
}
4530
#endif
4531

4532
static struct usb_driver btusb_driver = {
4533
	.name		= "btusb",
4534
	.probe		= btusb_probe,
4535
	.disconnect	= btusb_disconnect,
4536
#ifdef CONFIG_PM
4537
	.suspend	= btusb_suspend,
4538
	.resume		= btusb_resume,
4539
#endif
4540
	.id_table	= btusb_table,
4541
	.supports_autosuspend = 1,
4542
	.disable_hub_initiated_lpm = 1,
4543

4544
#ifdef CONFIG_DEV_COREDUMP
4545
	.driver = {
4546
		.coredump = btusb_coredump,
4547
	},
4548
#endif
4549
};
4550

4551
module_usb_driver(btusb_driver);
4552

4553
module_param(disable_scofix, bool, 0644);
4554
MODULE_PARM_DESC(disable_scofix, "Disable fixup of wrong SCO buffer size");
4555

4556
module_param(force_scofix, bool, 0644);
4557
MODULE_PARM_DESC(force_scofix, "Force fixup of wrong SCO buffers size");
4558

4559
module_param(enable_autosuspend, bool, 0644);
4560
MODULE_PARM_DESC(enable_autosuspend, "Enable USB autosuspend by default");
4561

4562
module_param(reset, bool, 0644);
4563
MODULE_PARM_DESC(reset, "Send HCI reset command on initialization");
4564

4565
MODULE_AUTHOR("Marcel Holtmann <[email protected]>");
4566
MODULE_DESCRIPTION("Generic Bluetooth USB driver ver " VERSION);
4567
MODULE_VERSION(VERSION);
4568
MODULE_LICENSE("GPL");
4569

4570
Product

Resources

Company
