xref: /openbmc/linux/drivers/bluetooth/btusb.c (revision 4da722ca)
1 /*
2  *
3  *  Generic Bluetooth USB driver
4  *
5  *  Copyright (C) 2005-2008  Marcel Holtmann <marcel@holtmann.org>
6  *
7  *
8  *  This program is free software; you can redistribute it and/or modify
9  *  it under the terms of the GNU General Public License as published by
10  *  the Free Software Foundation; either version 2 of the License, or
11  *  (at your option) any later version.
12  *
13  *  This program is distributed in the hope that it will be useful,
14  *  but WITHOUT ANY WARRANTY; without even the implied warranty of
15  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
16  *  GNU General Public License for more details.
17  *
18  *  You should have received a copy of the GNU General Public License
19  *  along with this program; if not, write to the Free Software
20  *  Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
21  *
22  */
23 
24 #include <linux/module.h>
25 #include <linux/usb.h>
26 #include <linux/firmware.h>
27 #include <linux/of_device.h>
28 #include <linux/of_irq.h>
29 #include <linux/suspend.h>
30 #include <asm/unaligned.h>
31 
32 #include <net/bluetooth/bluetooth.h>
33 #include <net/bluetooth/hci_core.h>
34 
35 #include "btintel.h"
36 #include "btbcm.h"
37 #include "btrtl.h"
38 
39 #define VERSION "0.8"
40 
41 static bool disable_scofix;
42 static bool force_scofix;
43 
44 static bool reset = true;
45 
46 static struct usb_driver btusb_driver;
47 
48 #define BTUSB_IGNORE		0x01
49 #define BTUSB_DIGIANSWER	0x02
50 #define BTUSB_CSR		0x04
51 #define BTUSB_SNIFFER		0x08
52 #define BTUSB_BCM92035		0x10
53 #define BTUSB_BROKEN_ISOC	0x20
54 #define BTUSB_WRONG_SCO_MTU	0x40
55 #define BTUSB_ATH3012		0x80
56 #define BTUSB_INTEL		0x100
57 #define BTUSB_INTEL_BOOT	0x200
58 #define BTUSB_BCM_PATCHRAM	0x400
59 #define BTUSB_MARVELL		0x800
60 #define BTUSB_SWAVE		0x1000
61 #define BTUSB_INTEL_NEW		0x2000
62 #define BTUSB_AMP		0x4000
63 #define BTUSB_QCA_ROME		0x8000
64 #define BTUSB_BCM_APPLE		0x10000
65 #define BTUSB_REALTEK		0x20000
66 #define BTUSB_BCM2045		0x40000
67 #define BTUSB_IFNUM_2		0x80000
68 #define BTUSB_CW6622		0x100000
69 
70 static const struct usb_device_id btusb_table[] = {
71 	/* Generic Bluetooth USB device */
72 	{ USB_DEVICE_INFO(0xe0, 0x01, 0x01) },
73 
74 	/* Generic Bluetooth AMP device */
75 	{ USB_DEVICE_INFO(0xe0, 0x01, 0x04), .driver_info = BTUSB_AMP },
76 
77 	/* Generic Bluetooth USB interface */
78 	{ USB_INTERFACE_INFO(0xe0, 0x01, 0x01) },
79 
80 	/* Apple-specific (Broadcom) devices */
81 	{ USB_VENDOR_AND_INTERFACE_INFO(0x05ac, 0xff, 0x01, 0x01),
82 	  .driver_info = BTUSB_BCM_APPLE | BTUSB_IFNUM_2 },
83 
84 	/* MediaTek MT76x0E */
85 	{ USB_DEVICE(0x0e8d, 0x763f) },
86 
87 	/* Broadcom SoftSailing reporting vendor specific */
88 	{ USB_DEVICE(0x0a5c, 0x21e1) },
89 
90 	/* Apple MacBookPro 7,1 */
91 	{ USB_DEVICE(0x05ac, 0x8213) },
92 
93 	/* Apple iMac11,1 */
94 	{ USB_DEVICE(0x05ac, 0x8215) },
95 
96 	/* Apple MacBookPro6,2 */
97 	{ USB_DEVICE(0x05ac, 0x8218) },
98 
99 	/* Apple MacBookAir3,1, MacBookAir3,2 */
100 	{ USB_DEVICE(0x05ac, 0x821b) },
101 
102 	/* Apple MacBookAir4,1 */
103 	{ USB_DEVICE(0x05ac, 0x821f) },
104 
105 	/* Apple MacBookPro8,2 */
106 	{ USB_DEVICE(0x05ac, 0x821a) },
107 
108 	/* Apple MacMini5,1 */
109 	{ USB_DEVICE(0x05ac, 0x8281) },
110 
111 	/* AVM BlueFRITZ! USB v2.0 */
112 	{ USB_DEVICE(0x057c, 0x3800), .driver_info = BTUSB_SWAVE },
113 
114 	/* Bluetooth Ultraport Module from IBM */
115 	{ USB_DEVICE(0x04bf, 0x030a) },
116 
117 	/* ALPS Modules with non-standard id */
118 	{ USB_DEVICE(0x044e, 0x3001) },
119 	{ USB_DEVICE(0x044e, 0x3002) },
120 
121 	/* Ericsson with non-standard id */
122 	{ USB_DEVICE(0x0bdb, 0x1002) },
123 
124 	/* Canyon CN-BTU1 with HID interfaces */
125 	{ USB_DEVICE(0x0c10, 0x0000) },
126 
127 	/* Broadcom BCM20702A0 */
128 	{ USB_DEVICE(0x413c, 0x8197) },
129 
130 	/* Broadcom BCM20702B0 (Dynex/Insignia) */
131 	{ USB_DEVICE(0x19ff, 0x0239), .driver_info = BTUSB_BCM_PATCHRAM },
132 
133 	/* Broadcom BCM43142A0 (Foxconn/Lenovo) */
134 	{ USB_DEVICE(0x105b, 0xe065), .driver_info = BTUSB_BCM_PATCHRAM },
135 
136 	/* Broadcom BCM920703 (HTC Vive) */
137 	{ USB_VENDOR_AND_INTERFACE_INFO(0x0bb4, 0xff, 0x01, 0x01),
138 	  .driver_info = BTUSB_BCM_PATCHRAM },
139 
140 	/* Foxconn - Hon Hai */
141 	{ USB_VENDOR_AND_INTERFACE_INFO(0x0489, 0xff, 0x01, 0x01),
142 	  .driver_info = BTUSB_BCM_PATCHRAM },
143 
144 	/* Lite-On Technology - Broadcom based */
145 	{ USB_VENDOR_AND_INTERFACE_INFO(0x04ca, 0xff, 0x01, 0x01),
146 	  .driver_info = BTUSB_BCM_PATCHRAM },
147 
148 	/* Broadcom devices with vendor specific id */
149 	{ USB_VENDOR_AND_INTERFACE_INFO(0x0a5c, 0xff, 0x01, 0x01),
150 	  .driver_info = BTUSB_BCM_PATCHRAM },
151 
152 	/* ASUSTek Computer - Broadcom based */
153 	{ USB_VENDOR_AND_INTERFACE_INFO(0x0b05, 0xff, 0x01, 0x01),
154 	  .driver_info = BTUSB_BCM_PATCHRAM },
155 
156 	/* Belkin F8065bf - Broadcom based */
157 	{ USB_VENDOR_AND_INTERFACE_INFO(0x050d, 0xff, 0x01, 0x01),
158 	  .driver_info = BTUSB_BCM_PATCHRAM },
159 
160 	/* IMC Networks - Broadcom based */
161 	{ USB_VENDOR_AND_INTERFACE_INFO(0x13d3, 0xff, 0x01, 0x01),
162 	  .driver_info = BTUSB_BCM_PATCHRAM },
163 
164 	/* Dell Computer - Broadcom based  */
165 	{ USB_VENDOR_AND_INTERFACE_INFO(0x413c, 0xff, 0x01, 0x01),
166 	  .driver_info = BTUSB_BCM_PATCHRAM },
167 
168 	/* Toshiba Corp - Broadcom based */
169 	{ USB_VENDOR_AND_INTERFACE_INFO(0x0930, 0xff, 0x01, 0x01),
170 	  .driver_info = BTUSB_BCM_PATCHRAM },
171 
172 	/* Intel Bluetooth USB Bootloader (RAM module) */
173 	{ USB_DEVICE(0x8087, 0x0a5a),
174 	  .driver_info = BTUSB_INTEL_BOOT | BTUSB_BROKEN_ISOC },
175 
176 	{ }	/* Terminating entry */
177 };
178 
179 MODULE_DEVICE_TABLE(usb, btusb_table);
180 
181 static const struct usb_device_id blacklist_table[] = {
182 	/* CSR BlueCore devices */
183 	{ USB_DEVICE(0x0a12, 0x0001), .driver_info = BTUSB_CSR },
184 
185 	/* Broadcom BCM2033 without firmware */
186 	{ USB_DEVICE(0x0a5c, 0x2033), .driver_info = BTUSB_IGNORE },
187 
188 	/* Broadcom BCM2045 devices */
189 	{ USB_DEVICE(0x0a5c, 0x2045), .driver_info = BTUSB_BCM2045 },
190 
191 	/* Atheros 3011 with sflash firmware */
192 	{ USB_DEVICE(0x0489, 0xe027), .driver_info = BTUSB_IGNORE },
193 	{ USB_DEVICE(0x0489, 0xe03d), .driver_info = BTUSB_IGNORE },
194 	{ USB_DEVICE(0x04f2, 0xaff1), .driver_info = BTUSB_IGNORE },
195 	{ USB_DEVICE(0x0930, 0x0215), .driver_info = BTUSB_IGNORE },
196 	{ USB_DEVICE(0x0cf3, 0x3002), .driver_info = BTUSB_IGNORE },
197 	{ USB_DEVICE(0x0cf3, 0xe019), .driver_info = BTUSB_IGNORE },
198 	{ USB_DEVICE(0x13d3, 0x3304), .driver_info = BTUSB_IGNORE },
199 
200 	/* Atheros AR9285 Malbec with sflash firmware */
201 	{ USB_DEVICE(0x03f0, 0x311d), .driver_info = BTUSB_IGNORE },
202 
203 	/* Atheros 3012 with sflash firmware */
204 	{ USB_DEVICE(0x0489, 0xe04d), .driver_info = BTUSB_ATH3012 },
205 	{ USB_DEVICE(0x0489, 0xe04e), .driver_info = BTUSB_ATH3012 },
206 	{ USB_DEVICE(0x0489, 0xe056), .driver_info = BTUSB_ATH3012 },
207 	{ USB_DEVICE(0x0489, 0xe057), .driver_info = BTUSB_ATH3012 },
208 	{ USB_DEVICE(0x0489, 0xe05f), .driver_info = BTUSB_ATH3012 },
209 	{ USB_DEVICE(0x0489, 0xe076), .driver_info = BTUSB_ATH3012 },
210 	{ USB_DEVICE(0x0489, 0xe078), .driver_info = BTUSB_ATH3012 },
211 	{ USB_DEVICE(0x0489, 0xe095), .driver_info = BTUSB_ATH3012 },
212 	{ USB_DEVICE(0x04c5, 0x1330), .driver_info = BTUSB_ATH3012 },
213 	{ USB_DEVICE(0x04ca, 0x3004), .driver_info = BTUSB_ATH3012 },
214 	{ USB_DEVICE(0x04ca, 0x3005), .driver_info = BTUSB_ATH3012 },
215 	{ USB_DEVICE(0x04ca, 0x3006), .driver_info = BTUSB_ATH3012 },
216 	{ USB_DEVICE(0x04ca, 0x3007), .driver_info = BTUSB_ATH3012 },
217 	{ USB_DEVICE(0x04ca, 0x3008), .driver_info = BTUSB_ATH3012 },
218 	{ USB_DEVICE(0x04ca, 0x300b), .driver_info = BTUSB_ATH3012 },
219 	{ USB_DEVICE(0x04ca, 0x300d), .driver_info = BTUSB_ATH3012 },
220 	{ USB_DEVICE(0x04ca, 0x300f), .driver_info = BTUSB_ATH3012 },
221 	{ USB_DEVICE(0x04ca, 0x3010), .driver_info = BTUSB_ATH3012 },
222 	{ USB_DEVICE(0x04ca, 0x3014), .driver_info = BTUSB_ATH3012 },
223 	{ USB_DEVICE(0x04ca, 0x3018), .driver_info = BTUSB_ATH3012 },
224 	{ USB_DEVICE(0x0930, 0x0219), .driver_info = BTUSB_ATH3012 },
225 	{ USB_DEVICE(0x0930, 0x021c), .driver_info = BTUSB_ATH3012 },
226 	{ USB_DEVICE(0x0930, 0x0220), .driver_info = BTUSB_ATH3012 },
227 	{ USB_DEVICE(0x0930, 0x0227), .driver_info = BTUSB_ATH3012 },
228 	{ USB_DEVICE(0x0b05, 0x17d0), .driver_info = BTUSB_ATH3012 },
229 	{ USB_DEVICE(0x0cf3, 0x0036), .driver_info = BTUSB_ATH3012 },
230 	{ USB_DEVICE(0x0cf3, 0x3004), .driver_info = BTUSB_ATH3012 },
231 	{ USB_DEVICE(0x0cf3, 0x3008), .driver_info = BTUSB_ATH3012 },
232 	{ USB_DEVICE(0x0cf3, 0x311d), .driver_info = BTUSB_ATH3012 },
233 	{ USB_DEVICE(0x0cf3, 0x311e), .driver_info = BTUSB_ATH3012 },
234 	{ USB_DEVICE(0x0cf3, 0x311f), .driver_info = BTUSB_ATH3012 },
235 	{ USB_DEVICE(0x0cf3, 0x3121), .driver_info = BTUSB_ATH3012 },
236 	{ USB_DEVICE(0x0cf3, 0x817a), .driver_info = BTUSB_ATH3012 },
237 	{ USB_DEVICE(0x0cf3, 0x817b), .driver_info = BTUSB_ATH3012 },
238 	{ USB_DEVICE(0x0cf3, 0xe003), .driver_info = BTUSB_ATH3012 },
239 	{ USB_DEVICE(0x0cf3, 0xe004), .driver_info = BTUSB_ATH3012 },
240 	{ USB_DEVICE(0x0cf3, 0xe005), .driver_info = BTUSB_ATH3012 },
241 	{ USB_DEVICE(0x0cf3, 0xe006), .driver_info = BTUSB_ATH3012 },
242 	{ USB_DEVICE(0x13d3, 0x3362), .driver_info = BTUSB_ATH3012 },
243 	{ USB_DEVICE(0x13d3, 0x3375), .driver_info = BTUSB_ATH3012 },
244 	{ USB_DEVICE(0x13d3, 0x3393), .driver_info = BTUSB_ATH3012 },
245 	{ USB_DEVICE(0x13d3, 0x3395), .driver_info = BTUSB_ATH3012 },
246 	{ USB_DEVICE(0x13d3, 0x3402), .driver_info = BTUSB_ATH3012 },
247 	{ USB_DEVICE(0x13d3, 0x3408), .driver_info = BTUSB_ATH3012 },
248 	{ USB_DEVICE(0x13d3, 0x3423), .driver_info = BTUSB_ATH3012 },
249 	{ USB_DEVICE(0x13d3, 0x3432), .driver_info = BTUSB_ATH3012 },
250 	{ USB_DEVICE(0x13d3, 0x3472), .driver_info = BTUSB_ATH3012 },
251 	{ USB_DEVICE(0x13d3, 0x3474), .driver_info = BTUSB_ATH3012 },
252 	{ USB_DEVICE(0x13d3, 0x3487), .driver_info = BTUSB_ATH3012 },
253 	{ USB_DEVICE(0x13d3, 0x3490), .driver_info = BTUSB_ATH3012 },
254 
255 	/* Atheros AR5BBU12 with sflash firmware */
256 	{ USB_DEVICE(0x0489, 0xe02c), .driver_info = BTUSB_IGNORE },
257 
258 	/* Atheros AR5BBU12 with sflash firmware */
259 	{ USB_DEVICE(0x0489, 0xe036), .driver_info = BTUSB_ATH3012 },
260 	{ USB_DEVICE(0x0489, 0xe03c), .driver_info = BTUSB_ATH3012 },
261 
262 	/* QCA ROME chipset */
263 	{ USB_DEVICE(0x0cf3, 0xe007), .driver_info = BTUSB_QCA_ROME },
264 	{ USB_DEVICE(0x0cf3, 0xe009), .driver_info = BTUSB_QCA_ROME },
265 	{ USB_DEVICE(0x0cf3, 0xe300), .driver_info = BTUSB_QCA_ROME },
266 	{ USB_DEVICE(0x0cf3, 0xe301), .driver_info = BTUSB_QCA_ROME },
267 	{ USB_DEVICE(0x0cf3, 0xe360), .driver_info = BTUSB_QCA_ROME },
268 	{ USB_DEVICE(0x0489, 0xe092), .driver_info = BTUSB_QCA_ROME },
269 	{ USB_DEVICE(0x0489, 0xe0a2), .driver_info = BTUSB_QCA_ROME },
270 	{ USB_DEVICE(0x04ca, 0x3011), .driver_info = BTUSB_QCA_ROME },
271 
272 	/* Broadcom BCM2035 */
273 	{ USB_DEVICE(0x0a5c, 0x2009), .driver_info = BTUSB_BCM92035 },
274 	{ USB_DEVICE(0x0a5c, 0x200a), .driver_info = BTUSB_WRONG_SCO_MTU },
275 	{ USB_DEVICE(0x0a5c, 0x2035), .driver_info = BTUSB_WRONG_SCO_MTU },
276 
277 	/* Broadcom BCM2045 */
278 	{ USB_DEVICE(0x0a5c, 0x2039), .driver_info = BTUSB_WRONG_SCO_MTU },
279 	{ USB_DEVICE(0x0a5c, 0x2101), .driver_info = BTUSB_WRONG_SCO_MTU },
280 
281 	/* IBM/Lenovo ThinkPad with Broadcom chip */
282 	{ USB_DEVICE(0x0a5c, 0x201e), .driver_info = BTUSB_WRONG_SCO_MTU },
283 	{ USB_DEVICE(0x0a5c, 0x2110), .driver_info = BTUSB_WRONG_SCO_MTU },
284 
285 	/* HP laptop with Broadcom chip */
286 	{ USB_DEVICE(0x03f0, 0x171d), .driver_info = BTUSB_WRONG_SCO_MTU },
287 
288 	/* Dell laptop with Broadcom chip */
289 	{ USB_DEVICE(0x413c, 0x8126), .driver_info = BTUSB_WRONG_SCO_MTU },
290 
291 	/* Dell Wireless 370 and 410 devices */
292 	{ USB_DEVICE(0x413c, 0x8152), .driver_info = BTUSB_WRONG_SCO_MTU },
293 	{ USB_DEVICE(0x413c, 0x8156), .driver_info = BTUSB_WRONG_SCO_MTU },
294 
295 	/* Belkin F8T012 and F8T013 devices */
296 	{ USB_DEVICE(0x050d, 0x0012), .driver_info = BTUSB_WRONG_SCO_MTU },
297 	{ USB_DEVICE(0x050d, 0x0013), .driver_info = BTUSB_WRONG_SCO_MTU },
298 
299 	/* Asus WL-BTD202 device */
300 	{ USB_DEVICE(0x0b05, 0x1715), .driver_info = BTUSB_WRONG_SCO_MTU },
301 
302 	/* Kensington Bluetooth USB adapter */
303 	{ USB_DEVICE(0x047d, 0x105e), .driver_info = BTUSB_WRONG_SCO_MTU },
304 
305 	/* RTX Telecom based adapters with buggy SCO support */
306 	{ USB_DEVICE(0x0400, 0x0807), .driver_info = BTUSB_BROKEN_ISOC },
307 	{ USB_DEVICE(0x0400, 0x080a), .driver_info = BTUSB_BROKEN_ISOC },
308 
309 	/* CONWISE Technology based adapters with buggy SCO support */
310 	{ USB_DEVICE(0x0e5e, 0x6622),
311 	  .driver_info = BTUSB_BROKEN_ISOC | BTUSB_CW6622},
312 
313 	/* Roper Class 1 Bluetooth Dongle (Silicon Wave based) */
314 	{ USB_DEVICE(0x1310, 0x0001), .driver_info = BTUSB_SWAVE },
315 
316 	/* Digianswer devices */
317 	{ USB_DEVICE(0x08fd, 0x0001), .driver_info = BTUSB_DIGIANSWER },
318 	{ USB_DEVICE(0x08fd, 0x0002), .driver_info = BTUSB_IGNORE },
319 
320 	/* CSR BlueCore Bluetooth Sniffer */
321 	{ USB_DEVICE(0x0a12, 0x0002),
322 	  .driver_info = BTUSB_SNIFFER | BTUSB_BROKEN_ISOC },
323 
324 	/* Frontline ComProbe Bluetooth Sniffer */
325 	{ USB_DEVICE(0x16d3, 0x0002),
326 	  .driver_info = BTUSB_SNIFFER | BTUSB_BROKEN_ISOC },
327 
328 	/* Marvell Bluetooth devices */
329 	{ USB_DEVICE(0x1286, 0x2044), .driver_info = BTUSB_MARVELL },
330 	{ USB_DEVICE(0x1286, 0x2046), .driver_info = BTUSB_MARVELL },
331 	{ USB_DEVICE(0x1286, 0x204e), .driver_info = BTUSB_MARVELL },
332 
333 	/* Intel Bluetooth devices */
334 	{ USB_DEVICE(0x8087, 0x0025), .driver_info = BTUSB_INTEL_NEW },
335 	{ USB_DEVICE(0x8087, 0x07da), .driver_info = BTUSB_CSR },
336 	{ USB_DEVICE(0x8087, 0x07dc), .driver_info = BTUSB_INTEL },
337 	{ USB_DEVICE(0x8087, 0x0a2a), .driver_info = BTUSB_INTEL },
338 	{ USB_DEVICE(0x8087, 0x0a2b), .driver_info = BTUSB_INTEL_NEW },
339 	{ USB_DEVICE(0x8087, 0x0aa7), .driver_info = BTUSB_INTEL },
340 	{ USB_DEVICE(0x8087, 0x0aaa), .driver_info = BTUSB_INTEL_NEW },
341 
342 	/* Other Intel Bluetooth devices */
343 	{ USB_VENDOR_AND_INTERFACE_INFO(0x8087, 0xe0, 0x01, 0x01),
344 	  .driver_info = BTUSB_IGNORE },
345 
346 	/* Realtek Bluetooth devices */
347 	{ USB_VENDOR_AND_INTERFACE_INFO(0x0bda, 0xe0, 0x01, 0x01),
348 	  .driver_info = BTUSB_REALTEK },
349 
350 	/* Additional Realtek 8723AE Bluetooth devices */
351 	{ USB_DEVICE(0x0930, 0x021d), .driver_info = BTUSB_REALTEK },
352 	{ USB_DEVICE(0x13d3, 0x3394), .driver_info = BTUSB_REALTEK },
353 
354 	/* Additional Realtek 8723BE Bluetooth devices */
355 	{ USB_DEVICE(0x0489, 0xe085), .driver_info = BTUSB_REALTEK },
356 	{ USB_DEVICE(0x0489, 0xe08b), .driver_info = BTUSB_REALTEK },
357 	{ USB_DEVICE(0x13d3, 0x3410), .driver_info = BTUSB_REALTEK },
358 	{ USB_DEVICE(0x13d3, 0x3416), .driver_info = BTUSB_REALTEK },
359 	{ USB_DEVICE(0x13d3, 0x3459), .driver_info = BTUSB_REALTEK },
360 
361 	/* Additional Realtek 8821AE Bluetooth devices */
362 	{ USB_DEVICE(0x0b05, 0x17dc), .driver_info = BTUSB_REALTEK },
363 	{ USB_DEVICE(0x13d3, 0x3414), .driver_info = BTUSB_REALTEK },
364 	{ USB_DEVICE(0x13d3, 0x3458), .driver_info = BTUSB_REALTEK },
365 	{ USB_DEVICE(0x13d3, 0x3461), .driver_info = BTUSB_REALTEK },
366 	{ USB_DEVICE(0x13d3, 0x3462), .driver_info = BTUSB_REALTEK },
367 
368 	/* Silicon Wave based devices */
369 	{ USB_DEVICE(0x0c10, 0x0000), .driver_info = BTUSB_SWAVE },
370 
371 	{ }	/* Terminating entry */
372 };
373 
374 #define BTUSB_MAX_ISOC_FRAMES	10
375 
376 #define BTUSB_INTR_RUNNING	0
377 #define BTUSB_BULK_RUNNING	1
378 #define BTUSB_ISOC_RUNNING	2
379 #define BTUSB_SUSPENDING	3
380 #define BTUSB_DID_ISO_RESUME	4
381 #define BTUSB_BOOTLOADER	5
382 #define BTUSB_DOWNLOADING	6
383 #define BTUSB_FIRMWARE_LOADED	7
384 #define BTUSB_FIRMWARE_FAILED	8
385 #define BTUSB_BOOTING		9
386 #define BTUSB_RESET_RESUME	10
387 #define BTUSB_DIAG_RUNNING	11
388 #define BTUSB_OOB_WAKE_ENABLED	12
389 
390 struct btusb_data {
391 	struct hci_dev       *hdev;
392 	struct usb_device    *udev;
393 	struct usb_interface *intf;
394 	struct usb_interface *isoc;
395 	struct usb_interface *diag;
396 
397 	unsigned long flags;
398 
399 	struct work_struct work;
400 	struct work_struct waker;
401 
402 	struct usb_anchor deferred;
403 	struct usb_anchor tx_anchor;
404 	int tx_in_flight;
405 	spinlock_t txlock;
406 
407 	struct usb_anchor intr_anchor;
408 	struct usb_anchor bulk_anchor;
409 	struct usb_anchor isoc_anchor;
410 	struct usb_anchor diag_anchor;
411 	spinlock_t rxlock;
412 
413 	struct sk_buff *evt_skb;
414 	struct sk_buff *acl_skb;
415 	struct sk_buff *sco_skb;
416 
417 	struct usb_endpoint_descriptor *intr_ep;
418 	struct usb_endpoint_descriptor *bulk_tx_ep;
419 	struct usb_endpoint_descriptor *bulk_rx_ep;
420 	struct usb_endpoint_descriptor *isoc_tx_ep;
421 	struct usb_endpoint_descriptor *isoc_rx_ep;
422 	struct usb_endpoint_descriptor *diag_tx_ep;
423 	struct usb_endpoint_descriptor *diag_rx_ep;
424 
425 	__u8 cmdreq_type;
426 	__u8 cmdreq;
427 
428 	unsigned int sco_num;
429 	int isoc_altsetting;
430 	int suspend_count;
431 
432 	int (*recv_event)(struct hci_dev *hdev, struct sk_buff *skb);
433 	int (*recv_bulk)(struct btusb_data *data, void *buffer, int count);
434 
435 	int (*setup_on_usb)(struct hci_dev *hdev);
436 
437 	int oob_wake_irq;   /* irq for out-of-band wake-on-bt */
438 };
439 
440 static inline void btusb_free_frags(struct btusb_data *data)
441 {
442 	unsigned long flags;
443 
444 	spin_lock_irqsave(&data->rxlock, flags);
445 
446 	kfree_skb(data->evt_skb);
447 	data->evt_skb = NULL;
448 
449 	kfree_skb(data->acl_skb);
450 	data->acl_skb = NULL;
451 
452 	kfree_skb(data->sco_skb);
453 	data->sco_skb = NULL;
454 
455 	spin_unlock_irqrestore(&data->rxlock, flags);
456 }
457 
458 static int btusb_recv_intr(struct btusb_data *data, void *buffer, int count)
459 {
460 	struct sk_buff *skb;
461 	int err = 0;
462 
463 	spin_lock(&data->rxlock);
464 	skb = data->evt_skb;
465 
466 	while (count) {
467 		int len;
468 
469 		if (!skb) {
470 			skb = bt_skb_alloc(HCI_MAX_EVENT_SIZE, GFP_ATOMIC);
471 			if (!skb) {
472 				err = -ENOMEM;
473 				break;
474 			}
475 
476 			hci_skb_pkt_type(skb) = HCI_EVENT_PKT;
477 			hci_skb_expect(skb) = HCI_EVENT_HDR_SIZE;
478 		}
479 
480 		len = min_t(uint, hci_skb_expect(skb), count);
481 		skb_put_data(skb, buffer, len);
482 
483 		count -= len;
484 		buffer += len;
485 		hci_skb_expect(skb) -= len;
486 
487 		if (skb->len == HCI_EVENT_HDR_SIZE) {
488 			/* Complete event header */
489 			hci_skb_expect(skb) = hci_event_hdr(skb)->plen;
490 
491 			if (skb_tailroom(skb) < hci_skb_expect(skb)) {
492 				kfree_skb(skb);
493 				skb = NULL;
494 
495 				err = -EILSEQ;
496 				break;
497 			}
498 		}
499 
500 		if (!hci_skb_expect(skb)) {
501 			/* Complete frame */
502 			data->recv_event(data->hdev, skb);
503 			skb = NULL;
504 		}
505 	}
506 
507 	data->evt_skb = skb;
508 	spin_unlock(&data->rxlock);
509 
510 	return err;
511 }
512 
513 static int btusb_recv_bulk(struct btusb_data *data, void *buffer, int count)
514 {
515 	struct sk_buff *skb;
516 	int err = 0;
517 
518 	spin_lock(&data->rxlock);
519 	skb = data->acl_skb;
520 
521 	while (count) {
522 		int len;
523 
524 		if (!skb) {
525 			skb = bt_skb_alloc(HCI_MAX_FRAME_SIZE, GFP_ATOMIC);
526 			if (!skb) {
527 				err = -ENOMEM;
528 				break;
529 			}
530 
531 			hci_skb_pkt_type(skb) = HCI_ACLDATA_PKT;
532 			hci_skb_expect(skb) = HCI_ACL_HDR_SIZE;
533 		}
534 
535 		len = min_t(uint, hci_skb_expect(skb), count);
536 		skb_put_data(skb, buffer, len);
537 
538 		count -= len;
539 		buffer += len;
540 		hci_skb_expect(skb) -= len;
541 
542 		if (skb->len == HCI_ACL_HDR_SIZE) {
543 			__le16 dlen = hci_acl_hdr(skb)->dlen;
544 
545 			/* Complete ACL header */
546 			hci_skb_expect(skb) = __le16_to_cpu(dlen);
547 
548 			if (skb_tailroom(skb) < hci_skb_expect(skb)) {
549 				kfree_skb(skb);
550 				skb = NULL;
551 
552 				err = -EILSEQ;
553 				break;
554 			}
555 		}
556 
557 		if (!hci_skb_expect(skb)) {
558 			/* Complete frame */
559 			hci_recv_frame(data->hdev, skb);
560 			skb = NULL;
561 		}
562 	}
563 
564 	data->acl_skb = skb;
565 	spin_unlock(&data->rxlock);
566 
567 	return err;
568 }
569 
570 static int btusb_recv_isoc(struct btusb_data *data, void *buffer, int count)
571 {
572 	struct sk_buff *skb;
573 	int err = 0;
574 
575 	spin_lock(&data->rxlock);
576 	skb = data->sco_skb;
577 
578 	while (count) {
579 		int len;
580 
581 		if (!skb) {
582 			skb = bt_skb_alloc(HCI_MAX_SCO_SIZE, GFP_ATOMIC);
583 			if (!skb) {
584 				err = -ENOMEM;
585 				break;
586 			}
587 
588 			hci_skb_pkt_type(skb) = HCI_SCODATA_PKT;
589 			hci_skb_expect(skb) = HCI_SCO_HDR_SIZE;
590 		}
591 
592 		len = min_t(uint, hci_skb_expect(skb), count);
593 		skb_put_data(skb, buffer, len);
594 
595 		count -= len;
596 		buffer += len;
597 		hci_skb_expect(skb) -= len;
598 
599 		if (skb->len == HCI_SCO_HDR_SIZE) {
600 			/* Complete SCO header */
601 			hci_skb_expect(skb) = hci_sco_hdr(skb)->dlen;
602 
603 			if (skb_tailroom(skb) < hci_skb_expect(skb)) {
604 				kfree_skb(skb);
605 				skb = NULL;
606 
607 				err = -EILSEQ;
608 				break;
609 			}
610 		}
611 
612 		if (!hci_skb_expect(skb)) {
613 			/* Complete frame */
614 			hci_recv_frame(data->hdev, skb);
615 			skb = NULL;
616 		}
617 	}
618 
619 	data->sco_skb = skb;
620 	spin_unlock(&data->rxlock);
621 
622 	return err;
623 }
624 
625 static void btusb_intr_complete(struct urb *urb)
626 {
627 	struct hci_dev *hdev = urb->context;
628 	struct btusb_data *data = hci_get_drvdata(hdev);
629 	int err;
630 
631 	BT_DBG("%s urb %p status %d count %d", hdev->name, urb, urb->status,
632 	       urb->actual_length);
633 
634 	if (!test_bit(HCI_RUNNING, &hdev->flags))
635 		return;
636 
637 	if (urb->status == 0) {
638 		hdev->stat.byte_rx += urb->actual_length;
639 
640 		if (btusb_recv_intr(data, urb->transfer_buffer,
641 				    urb->actual_length) < 0) {
642 			BT_ERR("%s corrupted event packet", hdev->name);
643 			hdev->stat.err_rx++;
644 		}
645 	} else if (urb->status == -ENOENT) {
646 		/* Avoid suspend failed when usb_kill_urb */
647 		return;
648 	}
649 
650 	if (!test_bit(BTUSB_INTR_RUNNING, &data->flags))
651 		return;
652 
653 	usb_mark_last_busy(data->udev);
654 	usb_anchor_urb(urb, &data->intr_anchor);
655 
656 	err = usb_submit_urb(urb, GFP_ATOMIC);
657 	if (err < 0) {
658 		/* -EPERM: urb is being killed;
659 		 * -ENODEV: device got disconnected */
660 		if (err != -EPERM && err != -ENODEV)
661 			BT_ERR("%s urb %p failed to resubmit (%d)",
662 			       hdev->name, urb, -err);
663 		usb_unanchor_urb(urb);
664 	}
665 }
666 
667 static int btusb_submit_intr_urb(struct hci_dev *hdev, gfp_t mem_flags)
668 {
669 	struct btusb_data *data = hci_get_drvdata(hdev);
670 	struct urb *urb;
671 	unsigned char *buf;
672 	unsigned int pipe;
673 	int err, size;
674 
675 	BT_DBG("%s", hdev->name);
676 
677 	if (!data->intr_ep)
678 		return -ENODEV;
679 
680 	urb = usb_alloc_urb(0, mem_flags);
681 	if (!urb)
682 		return -ENOMEM;
683 
684 	size = le16_to_cpu(data->intr_ep->wMaxPacketSize);
685 
686 	buf = kmalloc(size, mem_flags);
687 	if (!buf) {
688 		usb_free_urb(urb);
689 		return -ENOMEM;
690 	}
691 
692 	pipe = usb_rcvintpipe(data->udev, data->intr_ep->bEndpointAddress);
693 
694 	usb_fill_int_urb(urb, data->udev, pipe, buf, size,
695 			 btusb_intr_complete, hdev, data->intr_ep->bInterval);
696 
697 	urb->transfer_flags |= URB_FREE_BUFFER;
698 
699 	usb_anchor_urb(urb, &data->intr_anchor);
700 
701 	err = usb_submit_urb(urb, mem_flags);
702 	if (err < 0) {
703 		if (err != -EPERM && err != -ENODEV)
704 			BT_ERR("%s urb %p submission failed (%d)",
705 			       hdev->name, urb, -err);
706 		usb_unanchor_urb(urb);
707 	}
708 
709 	usb_free_urb(urb);
710 
711 	return err;
712 }
713 
714 static void btusb_bulk_complete(struct urb *urb)
715 {
716 	struct hci_dev *hdev = urb->context;
717 	struct btusb_data *data = hci_get_drvdata(hdev);
718 	int err;
719 
720 	BT_DBG("%s urb %p status %d count %d", hdev->name, urb, urb->status,
721 	       urb->actual_length);
722 
723 	if (!test_bit(HCI_RUNNING, &hdev->flags))
724 		return;
725 
726 	if (urb->status == 0) {
727 		hdev->stat.byte_rx += urb->actual_length;
728 
729 		if (data->recv_bulk(data, urb->transfer_buffer,
730 				    urb->actual_length) < 0) {
731 			BT_ERR("%s corrupted ACL packet", hdev->name);
732 			hdev->stat.err_rx++;
733 		}
734 	} else if (urb->status == -ENOENT) {
735 		/* Avoid suspend failed when usb_kill_urb */
736 		return;
737 	}
738 
739 	if (!test_bit(BTUSB_BULK_RUNNING, &data->flags))
740 		return;
741 
742 	usb_anchor_urb(urb, &data->bulk_anchor);
743 	usb_mark_last_busy(data->udev);
744 
745 	err = usb_submit_urb(urb, GFP_ATOMIC);
746 	if (err < 0) {
747 		/* -EPERM: urb is being killed;
748 		 * -ENODEV: device got disconnected */
749 		if (err != -EPERM && err != -ENODEV)
750 			BT_ERR("%s urb %p failed to resubmit (%d)",
751 			       hdev->name, urb, -err);
752 		usb_unanchor_urb(urb);
753 	}
754 }
755 
756 static int btusb_submit_bulk_urb(struct hci_dev *hdev, gfp_t mem_flags)
757 {
758 	struct btusb_data *data = hci_get_drvdata(hdev);
759 	struct urb *urb;
760 	unsigned char *buf;
761 	unsigned int pipe;
762 	int err, size = HCI_MAX_FRAME_SIZE;
763 
764 	BT_DBG("%s", hdev->name);
765 
766 	if (!data->bulk_rx_ep)
767 		return -ENODEV;
768 
769 	urb = usb_alloc_urb(0, mem_flags);
770 	if (!urb)
771 		return -ENOMEM;
772 
773 	buf = kmalloc(size, mem_flags);
774 	if (!buf) {
775 		usb_free_urb(urb);
776 		return -ENOMEM;
777 	}
778 
779 	pipe = usb_rcvbulkpipe(data->udev, data->bulk_rx_ep->bEndpointAddress);
780 
781 	usb_fill_bulk_urb(urb, data->udev, pipe, buf, size,
782 			  btusb_bulk_complete, hdev);
783 
784 	urb->transfer_flags |= URB_FREE_BUFFER;
785 
786 	usb_mark_last_busy(data->udev);
787 	usb_anchor_urb(urb, &data->bulk_anchor);
788 
789 	err = usb_submit_urb(urb, mem_flags);
790 	if (err < 0) {
791 		if (err != -EPERM && err != -ENODEV)
792 			BT_ERR("%s urb %p submission failed (%d)",
793 			       hdev->name, urb, -err);
794 		usb_unanchor_urb(urb);
795 	}
796 
797 	usb_free_urb(urb);
798 
799 	return err;
800 }
801 
802 static void btusb_isoc_complete(struct urb *urb)
803 {
804 	struct hci_dev *hdev = urb->context;
805 	struct btusb_data *data = hci_get_drvdata(hdev);
806 	int i, err;
807 
808 	BT_DBG("%s urb %p status %d count %d", hdev->name, urb, urb->status,
809 	       urb->actual_length);
810 
811 	if (!test_bit(HCI_RUNNING, &hdev->flags))
812 		return;
813 
814 	if (urb->status == 0) {
815 		for (i = 0; i < urb->number_of_packets; i++) {
816 			unsigned int offset = urb->iso_frame_desc[i].offset;
817 			unsigned int length = urb->iso_frame_desc[i].actual_length;
818 
819 			if (urb->iso_frame_desc[i].status)
820 				continue;
821 
822 			hdev->stat.byte_rx += length;
823 
824 			if (btusb_recv_isoc(data, urb->transfer_buffer + offset,
825 					    length) < 0) {
826 				BT_ERR("%s corrupted SCO packet", hdev->name);
827 				hdev->stat.err_rx++;
828 			}
829 		}
830 	} else if (urb->status == -ENOENT) {
831 		/* Avoid suspend failed when usb_kill_urb */
832 		return;
833 	}
834 
835 	if (!test_bit(BTUSB_ISOC_RUNNING, &data->flags))
836 		return;
837 
838 	usb_anchor_urb(urb, &data->isoc_anchor);
839 
840 	err = usb_submit_urb(urb, GFP_ATOMIC);
841 	if (err < 0) {
842 		/* -EPERM: urb is being killed;
843 		 * -ENODEV: device got disconnected */
844 		if (err != -EPERM && err != -ENODEV)
845 			BT_ERR("%s urb %p failed to resubmit (%d)",
846 			       hdev->name, urb, -err);
847 		usb_unanchor_urb(urb);
848 	}
849 }
850 
851 static inline void __fill_isoc_descriptor(struct urb *urb, int len, int mtu)
852 {
853 	int i, offset = 0;
854 
855 	BT_DBG("len %d mtu %d", len, mtu);
856 
857 	for (i = 0; i < BTUSB_MAX_ISOC_FRAMES && len >= mtu;
858 					i++, offset += mtu, len -= mtu) {
859 		urb->iso_frame_desc[i].offset = offset;
860 		urb->iso_frame_desc[i].length = mtu;
861 	}
862 
863 	if (len && i < BTUSB_MAX_ISOC_FRAMES) {
864 		urb->iso_frame_desc[i].offset = offset;
865 		urb->iso_frame_desc[i].length = len;
866 		i++;
867 	}
868 
869 	urb->number_of_packets = i;
870 }
871 
872 static int btusb_submit_isoc_urb(struct hci_dev *hdev, gfp_t mem_flags)
873 {
874 	struct btusb_data *data = hci_get_drvdata(hdev);
875 	struct urb *urb;
876 	unsigned char *buf;
877 	unsigned int pipe;
878 	int err, size;
879 
880 	BT_DBG("%s", hdev->name);
881 
882 	if (!data->isoc_rx_ep)
883 		return -ENODEV;
884 
885 	urb = usb_alloc_urb(BTUSB_MAX_ISOC_FRAMES, mem_flags);
886 	if (!urb)
887 		return -ENOMEM;
888 
889 	size = le16_to_cpu(data->isoc_rx_ep->wMaxPacketSize) *
890 						BTUSB_MAX_ISOC_FRAMES;
891 
892 	buf = kmalloc(size, mem_flags);
893 	if (!buf) {
894 		usb_free_urb(urb);
895 		return -ENOMEM;
896 	}
897 
898 	pipe = usb_rcvisocpipe(data->udev, data->isoc_rx_ep->bEndpointAddress);
899 
900 	usb_fill_int_urb(urb, data->udev, pipe, buf, size, btusb_isoc_complete,
901 			 hdev, data->isoc_rx_ep->bInterval);
902 
903 	urb->transfer_flags = URB_FREE_BUFFER | URB_ISO_ASAP;
904 
905 	__fill_isoc_descriptor(urb, size,
906 			       le16_to_cpu(data->isoc_rx_ep->wMaxPacketSize));
907 
908 	usb_anchor_urb(urb, &data->isoc_anchor);
909 
910 	err = usb_submit_urb(urb, mem_flags);
911 	if (err < 0) {
912 		if (err != -EPERM && err != -ENODEV)
913 			BT_ERR("%s urb %p submission failed (%d)",
914 			       hdev->name, urb, -err);
915 		usb_unanchor_urb(urb);
916 	}
917 
918 	usb_free_urb(urb);
919 
920 	return err;
921 }
922 
923 static void btusb_diag_complete(struct urb *urb)
924 {
925 	struct hci_dev *hdev = urb->context;
926 	struct btusb_data *data = hci_get_drvdata(hdev);
927 	int err;
928 
929 	BT_DBG("%s urb %p status %d count %d", hdev->name, urb, urb->status,
930 	       urb->actual_length);
931 
932 	if (urb->status == 0) {
933 		struct sk_buff *skb;
934 
935 		skb = bt_skb_alloc(urb->actual_length, GFP_ATOMIC);
936 		if (skb) {
937 			skb_put_data(skb, urb->transfer_buffer,
938 				     urb->actual_length);
939 			hci_recv_diag(hdev, skb);
940 		}
941 	} else if (urb->status == -ENOENT) {
942 		/* Avoid suspend failed when usb_kill_urb */
943 		return;
944 	}
945 
946 	if (!test_bit(BTUSB_DIAG_RUNNING, &data->flags))
947 		return;
948 
949 	usb_anchor_urb(urb, &data->diag_anchor);
950 	usb_mark_last_busy(data->udev);
951 
952 	err = usb_submit_urb(urb, GFP_ATOMIC);
953 	if (err < 0) {
954 		/* -EPERM: urb is being killed;
955 		 * -ENODEV: device got disconnected */
956 		if (err != -EPERM && err != -ENODEV)
957 			BT_ERR("%s urb %p failed to resubmit (%d)",
958 			       hdev->name, urb, -err);
959 		usb_unanchor_urb(urb);
960 	}
961 }
962 
963 static int btusb_submit_diag_urb(struct hci_dev *hdev, gfp_t mem_flags)
964 {
965 	struct btusb_data *data = hci_get_drvdata(hdev);
966 	struct urb *urb;
967 	unsigned char *buf;
968 	unsigned int pipe;
969 	int err, size = HCI_MAX_FRAME_SIZE;
970 
971 	BT_DBG("%s", hdev->name);
972 
973 	if (!data->diag_rx_ep)
974 		return -ENODEV;
975 
976 	urb = usb_alloc_urb(0, mem_flags);
977 	if (!urb)
978 		return -ENOMEM;
979 
980 	buf = kmalloc(size, mem_flags);
981 	if (!buf) {
982 		usb_free_urb(urb);
983 		return -ENOMEM;
984 	}
985 
986 	pipe = usb_rcvbulkpipe(data->udev, data->diag_rx_ep->bEndpointAddress);
987 
988 	usb_fill_bulk_urb(urb, data->udev, pipe, buf, size,
989 			  btusb_diag_complete, hdev);
990 
991 	urb->transfer_flags |= URB_FREE_BUFFER;
992 
993 	usb_mark_last_busy(data->udev);
994 	usb_anchor_urb(urb, &data->diag_anchor);
995 
996 	err = usb_submit_urb(urb, mem_flags);
997 	if (err < 0) {
998 		if (err != -EPERM && err != -ENODEV)
999 			BT_ERR("%s urb %p submission failed (%d)",
1000 			       hdev->name, urb, -err);
1001 		usb_unanchor_urb(urb);
1002 	}
1003 
1004 	usb_free_urb(urb);
1005 
1006 	return err;
1007 }
1008 
1009 static void btusb_tx_complete(struct urb *urb)
1010 {
1011 	struct sk_buff *skb = urb->context;
1012 	struct hci_dev *hdev = (struct hci_dev *)skb->dev;
1013 	struct btusb_data *data = hci_get_drvdata(hdev);
1014 
1015 	BT_DBG("%s urb %p status %d count %d", hdev->name, urb, urb->status,
1016 	       urb->actual_length);
1017 
1018 	if (!test_bit(HCI_RUNNING, &hdev->flags))
1019 		goto done;
1020 
1021 	if (!urb->status)
1022 		hdev->stat.byte_tx += urb->transfer_buffer_length;
1023 	else
1024 		hdev->stat.err_tx++;
1025 
1026 done:
1027 	spin_lock(&data->txlock);
1028 	data->tx_in_flight--;
1029 	spin_unlock(&data->txlock);
1030 
1031 	kfree(urb->setup_packet);
1032 
1033 	kfree_skb(skb);
1034 }
1035 
1036 static void btusb_isoc_tx_complete(struct urb *urb)
1037 {
1038 	struct sk_buff *skb = urb->context;
1039 	struct hci_dev *hdev = (struct hci_dev *)skb->dev;
1040 
1041 	BT_DBG("%s urb %p status %d count %d", hdev->name, urb, urb->status,
1042 	       urb->actual_length);
1043 
1044 	if (!test_bit(HCI_RUNNING, &hdev->flags))
1045 		goto done;
1046 
1047 	if (!urb->status)
1048 		hdev->stat.byte_tx += urb->transfer_buffer_length;
1049 	else
1050 		hdev->stat.err_tx++;
1051 
1052 done:
1053 	kfree(urb->setup_packet);
1054 
1055 	kfree_skb(skb);
1056 }
1057 
1058 static int btusb_open(struct hci_dev *hdev)
1059 {
1060 	struct btusb_data *data = hci_get_drvdata(hdev);
1061 	int err;
1062 
1063 	BT_DBG("%s", hdev->name);
1064 
1065 	err = usb_autopm_get_interface(data->intf);
1066 	if (err < 0)
1067 		return err;
1068 
1069 	/* Patching USB firmware files prior to starting any URBs of HCI path
1070 	 * It is more safe to use USB bulk channel for downloading USB patch
1071 	 */
1072 	if (data->setup_on_usb) {
1073 		err = data->setup_on_usb(hdev);
1074 		if (err < 0)
1075 			return err;
1076 	}
1077 
1078 	data->intf->needs_remote_wakeup = 1;
1079 
1080 	if (test_and_set_bit(BTUSB_INTR_RUNNING, &data->flags))
1081 		goto done;
1082 
1083 	err = btusb_submit_intr_urb(hdev, GFP_KERNEL);
1084 	if (err < 0)
1085 		goto failed;
1086 
1087 	err = btusb_submit_bulk_urb(hdev, GFP_KERNEL);
1088 	if (err < 0) {
1089 		usb_kill_anchored_urbs(&data->intr_anchor);
1090 		goto failed;
1091 	}
1092 
1093 	set_bit(BTUSB_BULK_RUNNING, &data->flags);
1094 	btusb_submit_bulk_urb(hdev, GFP_KERNEL);
1095 
1096 	if (data->diag) {
1097 		if (!btusb_submit_diag_urb(hdev, GFP_KERNEL))
1098 			set_bit(BTUSB_DIAG_RUNNING, &data->flags);
1099 	}
1100 
1101 done:
1102 	usb_autopm_put_interface(data->intf);
1103 	return 0;
1104 
1105 failed:
1106 	clear_bit(BTUSB_INTR_RUNNING, &data->flags);
1107 	usb_autopm_put_interface(data->intf);
1108 	return err;
1109 }
1110 
1111 static void btusb_stop_traffic(struct btusb_data *data)
1112 {
1113 	usb_kill_anchored_urbs(&data->intr_anchor);
1114 	usb_kill_anchored_urbs(&data->bulk_anchor);
1115 	usb_kill_anchored_urbs(&data->isoc_anchor);
1116 	usb_kill_anchored_urbs(&data->diag_anchor);
1117 }
1118 
1119 static int btusb_close(struct hci_dev *hdev)
1120 {
1121 	struct btusb_data *data = hci_get_drvdata(hdev);
1122 	int err;
1123 
1124 	BT_DBG("%s", hdev->name);
1125 
1126 	cancel_work_sync(&data->work);
1127 	cancel_work_sync(&data->waker);
1128 
1129 	clear_bit(BTUSB_ISOC_RUNNING, &data->flags);
1130 	clear_bit(BTUSB_BULK_RUNNING, &data->flags);
1131 	clear_bit(BTUSB_INTR_RUNNING, &data->flags);
1132 	clear_bit(BTUSB_DIAG_RUNNING, &data->flags);
1133 
1134 	btusb_stop_traffic(data);
1135 	btusb_free_frags(data);
1136 
1137 	err = usb_autopm_get_interface(data->intf);
1138 	if (err < 0)
1139 		goto failed;
1140 
1141 	data->intf->needs_remote_wakeup = 0;
1142 	usb_autopm_put_interface(data->intf);
1143 
1144 failed:
1145 	usb_scuttle_anchored_urbs(&data->deferred);
1146 	return 0;
1147 }
1148 
1149 static int btusb_flush(struct hci_dev *hdev)
1150 {
1151 	struct btusb_data *data = hci_get_drvdata(hdev);
1152 
1153 	BT_DBG("%s", hdev->name);
1154 
1155 	usb_kill_anchored_urbs(&data->tx_anchor);
1156 	btusb_free_frags(data);
1157 
1158 	return 0;
1159 }
1160 
1161 static struct urb *alloc_ctrl_urb(struct hci_dev *hdev, struct sk_buff *skb)
1162 {
1163 	struct btusb_data *data = hci_get_drvdata(hdev);
1164 	struct usb_ctrlrequest *dr;
1165 	struct urb *urb;
1166 	unsigned int pipe;
1167 
1168 	urb = usb_alloc_urb(0, GFP_KERNEL);
1169 	if (!urb)
1170 		return ERR_PTR(-ENOMEM);
1171 
1172 	dr = kmalloc(sizeof(*dr), GFP_KERNEL);
1173 	if (!dr) {
1174 		usb_free_urb(urb);
1175 		return ERR_PTR(-ENOMEM);
1176 	}
1177 
1178 	dr->bRequestType = data->cmdreq_type;
1179 	dr->bRequest     = data->cmdreq;
1180 	dr->wIndex       = 0;
1181 	dr->wValue       = 0;
1182 	dr->wLength      = __cpu_to_le16(skb->len);
1183 
1184 	pipe = usb_sndctrlpipe(data->udev, 0x00);
1185 
1186 	usb_fill_control_urb(urb, data->udev, pipe, (void *)dr,
1187 			     skb->data, skb->len, btusb_tx_complete, skb);
1188 
1189 	skb->dev = (void *)hdev;
1190 
1191 	return urb;
1192 }
1193 
1194 static struct urb *alloc_bulk_urb(struct hci_dev *hdev, struct sk_buff *skb)
1195 {
1196 	struct btusb_data *data = hci_get_drvdata(hdev);
1197 	struct urb *urb;
1198 	unsigned int pipe;
1199 
1200 	if (!data->bulk_tx_ep)
1201 		return ERR_PTR(-ENODEV);
1202 
1203 	urb = usb_alloc_urb(0, GFP_KERNEL);
1204 	if (!urb)
1205 		return ERR_PTR(-ENOMEM);
1206 
1207 	pipe = usb_sndbulkpipe(data->udev, data->bulk_tx_ep->bEndpointAddress);
1208 
1209 	usb_fill_bulk_urb(urb, data->udev, pipe,
1210 			  skb->data, skb->len, btusb_tx_complete, skb);
1211 
1212 	skb->dev = (void *)hdev;
1213 
1214 	return urb;
1215 }
1216 
1217 static struct urb *alloc_isoc_urb(struct hci_dev *hdev, struct sk_buff *skb)
1218 {
1219 	struct btusb_data *data = hci_get_drvdata(hdev);
1220 	struct urb *urb;
1221 	unsigned int pipe;
1222 
1223 	if (!data->isoc_tx_ep)
1224 		return ERR_PTR(-ENODEV);
1225 
1226 	urb = usb_alloc_urb(BTUSB_MAX_ISOC_FRAMES, GFP_KERNEL);
1227 	if (!urb)
1228 		return ERR_PTR(-ENOMEM);
1229 
1230 	pipe = usb_sndisocpipe(data->udev, data->isoc_tx_ep->bEndpointAddress);
1231 
1232 	usb_fill_int_urb(urb, data->udev, pipe,
1233 			 skb->data, skb->len, btusb_isoc_tx_complete,
1234 			 skb, data->isoc_tx_ep->bInterval);
1235 
1236 	urb->transfer_flags  = URB_ISO_ASAP;
1237 
1238 	__fill_isoc_descriptor(urb, skb->len,
1239 			       le16_to_cpu(data->isoc_tx_ep->wMaxPacketSize));
1240 
1241 	skb->dev = (void *)hdev;
1242 
1243 	return urb;
1244 }
1245 
1246 static int submit_tx_urb(struct hci_dev *hdev, struct urb *urb)
1247 {
1248 	struct btusb_data *data = hci_get_drvdata(hdev);
1249 	int err;
1250 
1251 	usb_anchor_urb(urb, &data->tx_anchor);
1252 
1253 	err = usb_submit_urb(urb, GFP_KERNEL);
1254 	if (err < 0) {
1255 		if (err != -EPERM && err != -ENODEV)
1256 			BT_ERR("%s urb %p submission failed (%d)",
1257 			       hdev->name, urb, -err);
1258 		kfree(urb->setup_packet);
1259 		usb_unanchor_urb(urb);
1260 	} else {
1261 		usb_mark_last_busy(data->udev);
1262 	}
1263 
1264 	usb_free_urb(urb);
1265 	return err;
1266 }
1267 
1268 static int submit_or_queue_tx_urb(struct hci_dev *hdev, struct urb *urb)
1269 {
1270 	struct btusb_data *data = hci_get_drvdata(hdev);
1271 	unsigned long flags;
1272 	bool suspending;
1273 
1274 	spin_lock_irqsave(&data->txlock, flags);
1275 	suspending = test_bit(BTUSB_SUSPENDING, &data->flags);
1276 	if (!suspending)
1277 		data->tx_in_flight++;
1278 	spin_unlock_irqrestore(&data->txlock, flags);
1279 
1280 	if (!suspending)
1281 		return submit_tx_urb(hdev, urb);
1282 
1283 	usb_anchor_urb(urb, &data->deferred);
1284 	schedule_work(&data->waker);
1285 
1286 	usb_free_urb(urb);
1287 	return 0;
1288 }
1289 
1290 static int btusb_send_frame(struct hci_dev *hdev, struct sk_buff *skb)
1291 {
1292 	struct urb *urb;
1293 
1294 	BT_DBG("%s", hdev->name);
1295 
1296 	switch (hci_skb_pkt_type(skb)) {
1297 	case HCI_COMMAND_PKT:
1298 		urb = alloc_ctrl_urb(hdev, skb);
1299 		if (IS_ERR(urb))
1300 			return PTR_ERR(urb);
1301 
1302 		hdev->stat.cmd_tx++;
1303 		return submit_or_queue_tx_urb(hdev, urb);
1304 
1305 	case HCI_ACLDATA_PKT:
1306 		urb = alloc_bulk_urb(hdev, skb);
1307 		if (IS_ERR(urb))
1308 			return PTR_ERR(urb);
1309 
1310 		hdev->stat.acl_tx++;
1311 		return submit_or_queue_tx_urb(hdev, urb);
1312 
1313 	case HCI_SCODATA_PKT:
1314 		if (hci_conn_num(hdev, SCO_LINK) < 1)
1315 			return -ENODEV;
1316 
1317 		urb = alloc_isoc_urb(hdev, skb);
1318 		if (IS_ERR(urb))
1319 			return PTR_ERR(urb);
1320 
1321 		hdev->stat.sco_tx++;
1322 		return submit_tx_urb(hdev, urb);
1323 	}
1324 
1325 	return -EILSEQ;
1326 }
1327 
1328 static void btusb_notify(struct hci_dev *hdev, unsigned int evt)
1329 {
1330 	struct btusb_data *data = hci_get_drvdata(hdev);
1331 
1332 	BT_DBG("%s evt %d", hdev->name, evt);
1333 
1334 	if (hci_conn_num(hdev, SCO_LINK) != data->sco_num) {
1335 		data->sco_num = hci_conn_num(hdev, SCO_LINK);
1336 		schedule_work(&data->work);
1337 	}
1338 }
1339 
1340 static inline int __set_isoc_interface(struct hci_dev *hdev, int altsetting)
1341 {
1342 	struct btusb_data *data = hci_get_drvdata(hdev);
1343 	struct usb_interface *intf = data->isoc;
1344 	struct usb_endpoint_descriptor *ep_desc;
1345 	int i, err;
1346 
1347 	if (!data->isoc)
1348 		return -ENODEV;
1349 
1350 	err = usb_set_interface(data->udev, 1, altsetting);
1351 	if (err < 0) {
1352 		BT_ERR("%s setting interface failed (%d)", hdev->name, -err);
1353 		return err;
1354 	}
1355 
1356 	data->isoc_altsetting = altsetting;
1357 
1358 	data->isoc_tx_ep = NULL;
1359 	data->isoc_rx_ep = NULL;
1360 
1361 	for (i = 0; i < intf->cur_altsetting->desc.bNumEndpoints; i++) {
1362 		ep_desc = &intf->cur_altsetting->endpoint[i].desc;
1363 
1364 		if (!data->isoc_tx_ep && usb_endpoint_is_isoc_out(ep_desc)) {
1365 			data->isoc_tx_ep = ep_desc;
1366 			continue;
1367 		}
1368 
1369 		if (!data->isoc_rx_ep && usb_endpoint_is_isoc_in(ep_desc)) {
1370 			data->isoc_rx_ep = ep_desc;
1371 			continue;
1372 		}
1373 	}
1374 
1375 	if (!data->isoc_tx_ep || !data->isoc_rx_ep) {
1376 		BT_ERR("%s invalid SCO descriptors", hdev->name);
1377 		return -ENODEV;
1378 	}
1379 
1380 	return 0;
1381 }
1382 
1383 static void btusb_work(struct work_struct *work)
1384 {
1385 	struct btusb_data *data = container_of(work, struct btusb_data, work);
1386 	struct hci_dev *hdev = data->hdev;
1387 	int new_alts;
1388 	int err;
1389 
1390 	if (data->sco_num > 0) {
1391 		if (!test_bit(BTUSB_DID_ISO_RESUME, &data->flags)) {
1392 			err = usb_autopm_get_interface(data->isoc ? data->isoc : data->intf);
1393 			if (err < 0) {
1394 				clear_bit(BTUSB_ISOC_RUNNING, &data->flags);
1395 				usb_kill_anchored_urbs(&data->isoc_anchor);
1396 				return;
1397 			}
1398 
1399 			set_bit(BTUSB_DID_ISO_RESUME, &data->flags);
1400 		}
1401 
1402 		if (hdev->voice_setting & 0x0020) {
1403 			static const int alts[3] = { 2, 4, 5 };
1404 
1405 			new_alts = alts[data->sco_num - 1];
1406 		} else {
1407 			new_alts = data->sco_num;
1408 		}
1409 
1410 		if (data->isoc_altsetting != new_alts) {
1411 			unsigned long flags;
1412 
1413 			clear_bit(BTUSB_ISOC_RUNNING, &data->flags);
1414 			usb_kill_anchored_urbs(&data->isoc_anchor);
1415 
1416 			/* When isochronous alternate setting needs to be
1417 			 * changed, because SCO connection has been added
1418 			 * or removed, a packet fragment may be left in the
1419 			 * reassembling state. This could lead to wrongly
1420 			 * assembled fragments.
1421 			 *
1422 			 * Clear outstanding fragment when selecting a new
1423 			 * alternate setting.
1424 			 */
1425 			spin_lock_irqsave(&data->rxlock, flags);
1426 			kfree_skb(data->sco_skb);
1427 			data->sco_skb = NULL;
1428 			spin_unlock_irqrestore(&data->rxlock, flags);
1429 
1430 			if (__set_isoc_interface(hdev, new_alts) < 0)
1431 				return;
1432 		}
1433 
1434 		if (!test_and_set_bit(BTUSB_ISOC_RUNNING, &data->flags)) {
1435 			if (btusb_submit_isoc_urb(hdev, GFP_KERNEL) < 0)
1436 				clear_bit(BTUSB_ISOC_RUNNING, &data->flags);
1437 			else
1438 				btusb_submit_isoc_urb(hdev, GFP_KERNEL);
1439 		}
1440 	} else {
1441 		clear_bit(BTUSB_ISOC_RUNNING, &data->flags);
1442 		usb_kill_anchored_urbs(&data->isoc_anchor);
1443 
1444 		__set_isoc_interface(hdev, 0);
1445 		if (test_and_clear_bit(BTUSB_DID_ISO_RESUME, &data->flags))
1446 			usb_autopm_put_interface(data->isoc ? data->isoc : data->intf);
1447 	}
1448 }
1449 
1450 static void btusb_waker(struct work_struct *work)
1451 {
1452 	struct btusb_data *data = container_of(work, struct btusb_data, waker);
1453 	int err;
1454 
1455 	err = usb_autopm_get_interface(data->intf);
1456 	if (err < 0)
1457 		return;
1458 
1459 	usb_autopm_put_interface(data->intf);
1460 }
1461 
1462 static int btusb_setup_bcm92035(struct hci_dev *hdev)
1463 {
1464 	struct sk_buff *skb;
1465 	u8 val = 0x00;
1466 
1467 	BT_DBG("%s", hdev->name);
1468 
1469 	skb = __hci_cmd_sync(hdev, 0xfc3b, 1, &val, HCI_INIT_TIMEOUT);
1470 	if (IS_ERR(skb))
1471 		BT_ERR("BCM92035 command failed (%ld)", -PTR_ERR(skb));
1472 	else
1473 		kfree_skb(skb);
1474 
1475 	return 0;
1476 }
1477 
1478 static int btusb_setup_csr(struct hci_dev *hdev)
1479 {
1480 	struct hci_rp_read_local_version *rp;
1481 	struct sk_buff *skb;
1482 
1483 	BT_DBG("%s", hdev->name);
1484 
1485 	skb = __hci_cmd_sync(hdev, HCI_OP_READ_LOCAL_VERSION, 0, NULL,
1486 			     HCI_INIT_TIMEOUT);
1487 	if (IS_ERR(skb)) {
1488 		int err = PTR_ERR(skb);
1489 		BT_ERR("%s: CSR: Local version failed (%d)", hdev->name, err);
1490 		return err;
1491 	}
1492 
1493 	if (skb->len != sizeof(struct hci_rp_read_local_version)) {
1494 		BT_ERR("%s: CSR: Local version length mismatch", hdev->name);
1495 		kfree_skb(skb);
1496 		return -EIO;
1497 	}
1498 
1499 	rp = (struct hci_rp_read_local_version *)skb->data;
1500 
1501 	/* Detect controllers which aren't real CSR ones. */
1502 	if (le16_to_cpu(rp->manufacturer) != 10 ||
1503 	    le16_to_cpu(rp->lmp_subver) == 0x0c5c) {
1504 		/* Clear the reset quirk since this is not an actual
1505 		 * early Bluetooth 1.1 device from CSR.
1506 		 */
1507 		clear_bit(HCI_QUIRK_RESET_ON_CLOSE, &hdev->quirks);
1508 
1509 		/* These fake CSR controllers have all a broken
1510 		 * stored link key handling and so just disable it.
1511 		 */
1512 		set_bit(HCI_QUIRK_BROKEN_STORED_LINK_KEY, &hdev->quirks);
1513 	}
1514 
1515 	kfree_skb(skb);
1516 
1517 	return 0;
1518 }
1519 
1520 static const struct firmware *btusb_setup_intel_get_fw(struct hci_dev *hdev,
1521 						       struct intel_version *ver)
1522 {
1523 	const struct firmware *fw;
1524 	char fwname[64];
1525 	int ret;
1526 
1527 	snprintf(fwname, sizeof(fwname),
1528 		 "intel/ibt-hw-%x.%x.%x-fw-%x.%x.%x.%x.%x.bseq",
1529 		 ver->hw_platform, ver->hw_variant, ver->hw_revision,
1530 		 ver->fw_variant,  ver->fw_revision, ver->fw_build_num,
1531 		 ver->fw_build_ww, ver->fw_build_yy);
1532 
1533 	ret = request_firmware(&fw, fwname, &hdev->dev);
1534 	if (ret < 0) {
1535 		if (ret == -EINVAL) {
1536 			BT_ERR("%s Intel firmware file request failed (%d)",
1537 			       hdev->name, ret);
1538 			return NULL;
1539 		}
1540 
1541 		BT_ERR("%s failed to open Intel firmware file: %s(%d)",
1542 		       hdev->name, fwname, ret);
1543 
1544 		/* If the correct firmware patch file is not found, use the
1545 		 * default firmware patch file instead
1546 		 */
1547 		snprintf(fwname, sizeof(fwname), "intel/ibt-hw-%x.%x.bseq",
1548 			 ver->hw_platform, ver->hw_variant);
1549 		if (request_firmware(&fw, fwname, &hdev->dev) < 0) {
1550 			BT_ERR("%s failed to open default Intel fw file: %s",
1551 			       hdev->name, fwname);
1552 			return NULL;
1553 		}
1554 	}
1555 
1556 	BT_INFO("%s: Intel Bluetooth firmware file: %s", hdev->name, fwname);
1557 
1558 	return fw;
1559 }
1560 
1561 static int btusb_setup_intel_patching(struct hci_dev *hdev,
1562 				      const struct firmware *fw,
1563 				      const u8 **fw_ptr, int *disable_patch)
1564 {
1565 	struct sk_buff *skb;
1566 	struct hci_command_hdr *cmd;
1567 	const u8 *cmd_param;
1568 	struct hci_event_hdr *evt = NULL;
1569 	const u8 *evt_param = NULL;
1570 	int remain = fw->size - (*fw_ptr - fw->data);
1571 
1572 	/* The first byte indicates the types of the patch command or event.
1573 	 * 0x01 means HCI command and 0x02 is HCI event. If the first bytes
1574 	 * in the current firmware buffer doesn't start with 0x01 or
1575 	 * the size of remain buffer is smaller than HCI command header,
1576 	 * the firmware file is corrupted and it should stop the patching
1577 	 * process.
1578 	 */
1579 	if (remain > HCI_COMMAND_HDR_SIZE && *fw_ptr[0] != 0x01) {
1580 		BT_ERR("%s Intel fw corrupted: invalid cmd read", hdev->name);
1581 		return -EINVAL;
1582 	}
1583 	(*fw_ptr)++;
1584 	remain--;
1585 
1586 	cmd = (struct hci_command_hdr *)(*fw_ptr);
1587 	*fw_ptr += sizeof(*cmd);
1588 	remain -= sizeof(*cmd);
1589 
1590 	/* Ensure that the remain firmware data is long enough than the length
1591 	 * of command parameter. If not, the firmware file is corrupted.
1592 	 */
1593 	if (remain < cmd->plen) {
1594 		BT_ERR("%s Intel fw corrupted: invalid cmd len", hdev->name);
1595 		return -EFAULT;
1596 	}
1597 
1598 	/* If there is a command that loads a patch in the firmware
1599 	 * file, then enable the patch upon success, otherwise just
1600 	 * disable the manufacturer mode, for example patch activation
1601 	 * is not required when the default firmware patch file is used
1602 	 * because there are no patch data to load.
1603 	 */
1604 	if (*disable_patch && le16_to_cpu(cmd->opcode) == 0xfc8e)
1605 		*disable_patch = 0;
1606 
1607 	cmd_param = *fw_ptr;
1608 	*fw_ptr += cmd->plen;
1609 	remain -= cmd->plen;
1610 
1611 	/* This reads the expected events when the above command is sent to the
1612 	 * device. Some vendor commands expects more than one events, for
1613 	 * example command status event followed by vendor specific event.
1614 	 * For this case, it only keeps the last expected event. so the command
1615 	 * can be sent with __hci_cmd_sync_ev() which returns the sk_buff of
1616 	 * last expected event.
1617 	 */
1618 	while (remain > HCI_EVENT_HDR_SIZE && *fw_ptr[0] == 0x02) {
1619 		(*fw_ptr)++;
1620 		remain--;
1621 
1622 		evt = (struct hci_event_hdr *)(*fw_ptr);
1623 		*fw_ptr += sizeof(*evt);
1624 		remain -= sizeof(*evt);
1625 
1626 		if (remain < evt->plen) {
1627 			BT_ERR("%s Intel fw corrupted: invalid evt len",
1628 			       hdev->name);
1629 			return -EFAULT;
1630 		}
1631 
1632 		evt_param = *fw_ptr;
1633 		*fw_ptr += evt->plen;
1634 		remain -= evt->plen;
1635 	}
1636 
1637 	/* Every HCI commands in the firmware file has its correspond event.
1638 	 * If event is not found or remain is smaller than zero, the firmware
1639 	 * file is corrupted.
1640 	 */
1641 	if (!evt || !evt_param || remain < 0) {
1642 		BT_ERR("%s Intel fw corrupted: invalid evt read", hdev->name);
1643 		return -EFAULT;
1644 	}
1645 
1646 	skb = __hci_cmd_sync_ev(hdev, le16_to_cpu(cmd->opcode), cmd->plen,
1647 				cmd_param, evt->evt, HCI_INIT_TIMEOUT);
1648 	if (IS_ERR(skb)) {
1649 		BT_ERR("%s sending Intel patch command (0x%4.4x) failed (%ld)",
1650 		       hdev->name, cmd->opcode, PTR_ERR(skb));
1651 		return PTR_ERR(skb);
1652 	}
1653 
1654 	/* It ensures that the returned event matches the event data read from
1655 	 * the firmware file. At fist, it checks the length and then
1656 	 * the contents of the event.
1657 	 */
1658 	if (skb->len != evt->plen) {
1659 		BT_ERR("%s mismatch event length (opcode 0x%4.4x)", hdev->name,
1660 		       le16_to_cpu(cmd->opcode));
1661 		kfree_skb(skb);
1662 		return -EFAULT;
1663 	}
1664 
1665 	if (memcmp(skb->data, evt_param, evt->plen)) {
1666 		BT_ERR("%s mismatch event parameter (opcode 0x%4.4x)",
1667 		       hdev->name, le16_to_cpu(cmd->opcode));
1668 		kfree_skb(skb);
1669 		return -EFAULT;
1670 	}
1671 	kfree_skb(skb);
1672 
1673 	return 0;
1674 }
1675 
1676 static int btusb_setup_intel(struct hci_dev *hdev)
1677 {
1678 	struct sk_buff *skb;
1679 	const struct firmware *fw;
1680 	const u8 *fw_ptr;
1681 	int disable_patch, err;
1682 	struct intel_version ver;
1683 
1684 	BT_DBG("%s", hdev->name);
1685 
1686 	/* The controller has a bug with the first HCI command sent to it
1687 	 * returning number of completed commands as zero. This would stall the
1688 	 * command processing in the Bluetooth core.
1689 	 *
1690 	 * As a workaround, send HCI Reset command first which will reset the
1691 	 * number of completed commands and allow normal command processing
1692 	 * from now on.
1693 	 */
1694 	skb = __hci_cmd_sync(hdev, HCI_OP_RESET, 0, NULL, HCI_INIT_TIMEOUT);
1695 	if (IS_ERR(skb)) {
1696 		BT_ERR("%s sending initial HCI reset command failed (%ld)",
1697 		       hdev->name, PTR_ERR(skb));
1698 		return PTR_ERR(skb);
1699 	}
1700 	kfree_skb(skb);
1701 
1702 	/* Read Intel specific controller version first to allow selection of
1703 	 * which firmware file to load.
1704 	 *
1705 	 * The returned information are hardware variant and revision plus
1706 	 * firmware variant, revision and build number.
1707 	 */
1708 	err = btintel_read_version(hdev, &ver);
1709 	if (err)
1710 		return err;
1711 
1712 	BT_INFO("%s: read Intel version: %02x%02x%02x%02x%02x%02x%02x%02x%02x",
1713 		hdev->name, ver.hw_platform, ver.hw_variant, ver.hw_revision,
1714 		ver.fw_variant,  ver.fw_revision, ver.fw_build_num,
1715 		ver.fw_build_ww, ver.fw_build_yy, ver.fw_patch_num);
1716 
1717 	/* fw_patch_num indicates the version of patch the device currently
1718 	 * have. If there is no patch data in the device, it is always 0x00.
1719 	 * So, if it is other than 0x00, no need to patch the device again.
1720 	 */
1721 	if (ver.fw_patch_num) {
1722 		BT_INFO("%s: Intel device is already patched. patch num: %02x",
1723 			hdev->name, ver.fw_patch_num);
1724 		goto complete;
1725 	}
1726 
1727 	/* Opens the firmware patch file based on the firmware version read
1728 	 * from the controller. If it fails to open the matching firmware
1729 	 * patch file, it tries to open the default firmware patch file.
1730 	 * If no patch file is found, allow the device to operate without
1731 	 * a patch.
1732 	 */
1733 	fw = btusb_setup_intel_get_fw(hdev, &ver);
1734 	if (!fw)
1735 		goto complete;
1736 	fw_ptr = fw->data;
1737 
1738 	/* Enable the manufacturer mode of the controller.
1739 	 * Only while this mode is enabled, the driver can download the
1740 	 * firmware patch data and configuration parameters.
1741 	 */
1742 	err = btintel_enter_mfg(hdev);
1743 	if (err) {
1744 		release_firmware(fw);
1745 		return err;
1746 	}
1747 
1748 	disable_patch = 1;
1749 
1750 	/* The firmware data file consists of list of Intel specific HCI
1751 	 * commands and its expected events. The first byte indicates the
1752 	 * type of the message, either HCI command or HCI event.
1753 	 *
1754 	 * It reads the command and its expected event from the firmware file,
1755 	 * and send to the controller. Once __hci_cmd_sync_ev() returns,
1756 	 * the returned event is compared with the event read from the firmware
1757 	 * file and it will continue until all the messages are downloaded to
1758 	 * the controller.
1759 	 *
1760 	 * Once the firmware patching is completed successfully,
1761 	 * the manufacturer mode is disabled with reset and activating the
1762 	 * downloaded patch.
1763 	 *
1764 	 * If the firmware patching fails, the manufacturer mode is
1765 	 * disabled with reset and deactivating the patch.
1766 	 *
1767 	 * If the default patch file is used, no reset is done when disabling
1768 	 * the manufacturer.
1769 	 */
1770 	while (fw->size > fw_ptr - fw->data) {
1771 		int ret;
1772 
1773 		ret = btusb_setup_intel_patching(hdev, fw, &fw_ptr,
1774 						 &disable_patch);
1775 		if (ret < 0)
1776 			goto exit_mfg_deactivate;
1777 	}
1778 
1779 	release_firmware(fw);
1780 
1781 	if (disable_patch)
1782 		goto exit_mfg_disable;
1783 
1784 	/* Patching completed successfully and disable the manufacturer mode
1785 	 * with reset and activate the downloaded firmware patches.
1786 	 */
1787 	err = btintel_exit_mfg(hdev, true, true);
1788 	if (err)
1789 		return err;
1790 
1791 	BT_INFO("%s: Intel Bluetooth firmware patch completed and activated",
1792 		hdev->name);
1793 
1794 	goto complete;
1795 
1796 exit_mfg_disable:
1797 	/* Disable the manufacturer mode without reset */
1798 	err = btintel_exit_mfg(hdev, false, false);
1799 	if (err)
1800 		return err;
1801 
1802 	BT_INFO("%s: Intel Bluetooth firmware patch completed", hdev->name);
1803 
1804 	goto complete;
1805 
1806 exit_mfg_deactivate:
1807 	release_firmware(fw);
1808 
1809 	/* Patching failed. Disable the manufacturer mode with reset and
1810 	 * deactivate the downloaded firmware patches.
1811 	 */
1812 	err = btintel_exit_mfg(hdev, true, false);
1813 	if (err)
1814 		return err;
1815 
1816 	BT_INFO("%s: Intel Bluetooth firmware patch completed and deactivated",
1817 		hdev->name);
1818 
1819 complete:
1820 	/* Set the event mask for Intel specific vendor events. This enables
1821 	 * a few extra events that are useful during general operation.
1822 	 */
1823 	btintel_set_event_mask_mfg(hdev, false);
1824 
1825 	btintel_check_bdaddr(hdev);
1826 	return 0;
1827 }
1828 
1829 static int inject_cmd_complete(struct hci_dev *hdev, __u16 opcode)
1830 {
1831 	struct sk_buff *skb;
1832 	struct hci_event_hdr *hdr;
1833 	struct hci_ev_cmd_complete *evt;
1834 
1835 	skb = bt_skb_alloc(sizeof(*hdr) + sizeof(*evt) + 1, GFP_ATOMIC);
1836 	if (!skb)
1837 		return -ENOMEM;
1838 
1839 	hdr = skb_put(skb, sizeof(*hdr));
1840 	hdr->evt = HCI_EV_CMD_COMPLETE;
1841 	hdr->plen = sizeof(*evt) + 1;
1842 
1843 	evt = skb_put(skb, sizeof(*evt));
1844 	evt->ncmd = 0x01;
1845 	evt->opcode = cpu_to_le16(opcode);
1846 
1847 	skb_put_u8(skb, 0x00);
1848 
1849 	hci_skb_pkt_type(skb) = HCI_EVENT_PKT;
1850 
1851 	return hci_recv_frame(hdev, skb);
1852 }
1853 
1854 static int btusb_recv_bulk_intel(struct btusb_data *data, void *buffer,
1855 				 int count)
1856 {
1857 	/* When the device is in bootloader mode, then it can send
1858 	 * events via the bulk endpoint. These events are treated the
1859 	 * same way as the ones received from the interrupt endpoint.
1860 	 */
1861 	if (test_bit(BTUSB_BOOTLOADER, &data->flags))
1862 		return btusb_recv_intr(data, buffer, count);
1863 
1864 	return btusb_recv_bulk(data, buffer, count);
1865 }
1866 
1867 static void btusb_intel_bootup(struct btusb_data *data, const void *ptr,
1868 			       unsigned int len)
1869 {
1870 	const struct intel_bootup *evt = ptr;
1871 
1872 	if (len != sizeof(*evt))
1873 		return;
1874 
1875 	if (test_and_clear_bit(BTUSB_BOOTING, &data->flags)) {
1876 		smp_mb__after_atomic();
1877 		wake_up_bit(&data->flags, BTUSB_BOOTING);
1878 	}
1879 }
1880 
1881 static void btusb_intel_secure_send_result(struct btusb_data *data,
1882 					   const void *ptr, unsigned int len)
1883 {
1884 	const struct intel_secure_send_result *evt = ptr;
1885 
1886 	if (len != sizeof(*evt))
1887 		return;
1888 
1889 	if (evt->result)
1890 		set_bit(BTUSB_FIRMWARE_FAILED, &data->flags);
1891 
1892 	if (test_and_clear_bit(BTUSB_DOWNLOADING, &data->flags) &&
1893 	    test_bit(BTUSB_FIRMWARE_LOADED, &data->flags)) {
1894 		smp_mb__after_atomic();
1895 		wake_up_bit(&data->flags, BTUSB_DOWNLOADING);
1896 	}
1897 }
1898 
1899 static int btusb_recv_event_intel(struct hci_dev *hdev, struct sk_buff *skb)
1900 {
1901 	struct btusb_data *data = hci_get_drvdata(hdev);
1902 
1903 	if (test_bit(BTUSB_BOOTLOADER, &data->flags)) {
1904 		struct hci_event_hdr *hdr = (void *)skb->data;
1905 
1906 		if (skb->len > HCI_EVENT_HDR_SIZE && hdr->evt == 0xff &&
1907 		    hdr->plen > 0) {
1908 			const void *ptr = skb->data + HCI_EVENT_HDR_SIZE + 1;
1909 			unsigned int len = skb->len - HCI_EVENT_HDR_SIZE - 1;
1910 
1911 			switch (skb->data[2]) {
1912 			case 0x02:
1913 				/* When switching to the operational firmware
1914 				 * the device sends a vendor specific event
1915 				 * indicating that the bootup completed.
1916 				 */
1917 				btusb_intel_bootup(data, ptr, len);
1918 				break;
1919 			case 0x06:
1920 				/* When the firmware loading completes the
1921 				 * device sends out a vendor specific event
1922 				 * indicating the result of the firmware
1923 				 * loading.
1924 				 */
1925 				btusb_intel_secure_send_result(data, ptr, len);
1926 				break;
1927 			}
1928 		}
1929 	}
1930 
1931 	return hci_recv_frame(hdev, skb);
1932 }
1933 
1934 static int btusb_send_frame_intel(struct hci_dev *hdev, struct sk_buff *skb)
1935 {
1936 	struct btusb_data *data = hci_get_drvdata(hdev);
1937 	struct urb *urb;
1938 
1939 	BT_DBG("%s", hdev->name);
1940 
1941 	switch (hci_skb_pkt_type(skb)) {
1942 	case HCI_COMMAND_PKT:
1943 		if (test_bit(BTUSB_BOOTLOADER, &data->flags)) {
1944 			struct hci_command_hdr *cmd = (void *)skb->data;
1945 			__u16 opcode = le16_to_cpu(cmd->opcode);
1946 
1947 			/* When in bootloader mode and the command 0xfc09
1948 			 * is received, it needs to be send down the
1949 			 * bulk endpoint. So allocate a bulk URB instead.
1950 			 */
1951 			if (opcode == 0xfc09)
1952 				urb = alloc_bulk_urb(hdev, skb);
1953 			else
1954 				urb = alloc_ctrl_urb(hdev, skb);
1955 
1956 			/* When the 0xfc01 command is issued to boot into
1957 			 * the operational firmware, it will actually not
1958 			 * send a command complete event. To keep the flow
1959 			 * control working inject that event here.
1960 			 */
1961 			if (opcode == 0xfc01)
1962 				inject_cmd_complete(hdev, opcode);
1963 		} else {
1964 			urb = alloc_ctrl_urb(hdev, skb);
1965 		}
1966 		if (IS_ERR(urb))
1967 			return PTR_ERR(urb);
1968 
1969 		hdev->stat.cmd_tx++;
1970 		return submit_or_queue_tx_urb(hdev, urb);
1971 
1972 	case HCI_ACLDATA_PKT:
1973 		urb = alloc_bulk_urb(hdev, skb);
1974 		if (IS_ERR(urb))
1975 			return PTR_ERR(urb);
1976 
1977 		hdev->stat.acl_tx++;
1978 		return submit_or_queue_tx_urb(hdev, urb);
1979 
1980 	case HCI_SCODATA_PKT:
1981 		if (hci_conn_num(hdev, SCO_LINK) < 1)
1982 			return -ENODEV;
1983 
1984 		urb = alloc_isoc_urb(hdev, skb);
1985 		if (IS_ERR(urb))
1986 			return PTR_ERR(urb);
1987 
1988 		hdev->stat.sco_tx++;
1989 		return submit_tx_urb(hdev, urb);
1990 	}
1991 
1992 	return -EILSEQ;
1993 }
1994 
1995 static int btusb_setup_intel_new(struct hci_dev *hdev)
1996 {
1997 	static const u8 reset_param[] = { 0x00, 0x01, 0x00, 0x01,
1998 					  0x00, 0x08, 0x04, 0x00 };
1999 	struct btusb_data *data = hci_get_drvdata(hdev);
2000 	struct sk_buff *skb;
2001 	struct intel_version ver;
2002 	struct intel_boot_params *params;
2003 	const struct firmware *fw;
2004 	const u8 *fw_ptr;
2005 	u32 frag_len;
2006 	char fwname[64];
2007 	ktime_t calltime, delta, rettime;
2008 	unsigned long long duration;
2009 	int err;
2010 
2011 	BT_DBG("%s", hdev->name);
2012 
2013 	calltime = ktime_get();
2014 
2015 	/* Read the Intel version information to determine if the device
2016 	 * is in bootloader mode or if it already has operational firmware
2017 	 * loaded.
2018 	 */
2019 	err = btintel_read_version(hdev, &ver);
2020 	if (err)
2021 		return err;
2022 
2023 	/* The hardware platform number has a fixed value of 0x37 and
2024 	 * for now only accept this single value.
2025 	 */
2026 	if (ver.hw_platform != 0x37) {
2027 		BT_ERR("%s: Unsupported Intel hardware platform (%u)",
2028 		       hdev->name, ver.hw_platform);
2029 		return -EINVAL;
2030 	}
2031 
2032 	/* Check for supported iBT hardware variants of this firmware
2033 	 * loading method.
2034 	 *
2035 	 * This check has been put in place to ensure correct forward
2036 	 * compatibility options when newer hardware variants come along.
2037 	 */
2038 	switch (ver.hw_variant) {
2039 	case 0x0b:	/* SfP */
2040 	case 0x0c:	/* WsP */
2041 	case 0x11:	/* JfP */
2042 	case 0x12:	/* ThP */
2043 		break;
2044 	default:
2045 		BT_ERR("%s: Unsupported Intel hardware variant (%u)",
2046 		       hdev->name, ver.hw_variant);
2047 		return -EINVAL;
2048 	}
2049 
2050 	btintel_version_info(hdev, &ver);
2051 
2052 	/* The firmware variant determines if the device is in bootloader
2053 	 * mode or is running operational firmware. The value 0x06 identifies
2054 	 * the bootloader and the value 0x23 identifies the operational
2055 	 * firmware.
2056 	 *
2057 	 * When the operational firmware is already present, then only
2058 	 * the check for valid Bluetooth device address is needed. This
2059 	 * determines if the device will be added as configured or
2060 	 * unconfigured controller.
2061 	 *
2062 	 * It is not possible to use the Secure Boot Parameters in this
2063 	 * case since that command is only available in bootloader mode.
2064 	 */
2065 	if (ver.fw_variant == 0x23) {
2066 		clear_bit(BTUSB_BOOTLOADER, &data->flags);
2067 		btintel_check_bdaddr(hdev);
2068 		return 0;
2069 	}
2070 
2071 	/* If the device is not in bootloader mode, then the only possible
2072 	 * choice is to return an error and abort the device initialization.
2073 	 */
2074 	if (ver.fw_variant != 0x06) {
2075 		BT_ERR("%s: Unsupported Intel firmware variant (%u)",
2076 		       hdev->name, ver.fw_variant);
2077 		return -ENODEV;
2078 	}
2079 
2080 	/* Read the secure boot parameters to identify the operating
2081 	 * details of the bootloader.
2082 	 */
2083 	skb = __hci_cmd_sync(hdev, 0xfc0d, 0, NULL, HCI_INIT_TIMEOUT);
2084 	if (IS_ERR(skb)) {
2085 		BT_ERR("%s: Reading Intel boot parameters failed (%ld)",
2086 		       hdev->name, PTR_ERR(skb));
2087 		return PTR_ERR(skb);
2088 	}
2089 
2090 	if (skb->len != sizeof(*params)) {
2091 		BT_ERR("%s: Intel boot parameters size mismatch", hdev->name);
2092 		kfree_skb(skb);
2093 		return -EILSEQ;
2094 	}
2095 
2096 	params = (struct intel_boot_params *)skb->data;
2097 
2098 	BT_INFO("%s: Device revision is %u", hdev->name,
2099 		le16_to_cpu(params->dev_revid));
2100 
2101 	BT_INFO("%s: Secure boot is %s", hdev->name,
2102 		params->secure_boot ? "enabled" : "disabled");
2103 
2104 	BT_INFO("%s: OTP lock is %s", hdev->name,
2105 		params->otp_lock ? "enabled" : "disabled");
2106 
2107 	BT_INFO("%s: API lock is %s", hdev->name,
2108 		params->api_lock ? "enabled" : "disabled");
2109 
2110 	BT_INFO("%s: Debug lock is %s", hdev->name,
2111 		params->debug_lock ? "enabled" : "disabled");
2112 
2113 	BT_INFO("%s: Minimum firmware build %u week %u %u", hdev->name,
2114 		params->min_fw_build_nn, params->min_fw_build_cw,
2115 		2000 + params->min_fw_build_yy);
2116 
2117 	/* It is required that every single firmware fragment is acknowledged
2118 	 * with a command complete event. If the boot parameters indicate
2119 	 * that this bootloader does not send them, then abort the setup.
2120 	 */
2121 	if (params->limited_cce != 0x00) {
2122 		BT_ERR("%s: Unsupported Intel firmware loading method (%u)",
2123 		       hdev->name, params->limited_cce);
2124 		kfree_skb(skb);
2125 		return -EINVAL;
2126 	}
2127 
2128 	/* If the OTP has no valid Bluetooth device address, then there will
2129 	 * also be no valid address for the operational firmware.
2130 	 */
2131 	if (!bacmp(&params->otp_bdaddr, BDADDR_ANY)) {
2132 		BT_INFO("%s: No device address configured", hdev->name);
2133 		set_bit(HCI_QUIRK_INVALID_BDADDR, &hdev->quirks);
2134 	}
2135 
2136 	/* With this Intel bootloader only the hardware variant and device
2137 	 * revision information are used to select the right firmware.
2138 	 *
2139 	 * The firmware filename is ibt-<hw_variant>-<dev_revid>.sfi.
2140 	 *
2141 	 * Currently the supported hardware variants are:
2142 	 *   11 (0x0b) for iBT3.0 (LnP/SfP)
2143 	 *   12 (0x0c) for iBT3.5 (WsP)
2144 	 *   17 (0x11) for iBT3.5 (JfP)
2145 	 *   18 (0x12) for iBT3.5 (ThP)
2146 	 */
2147 	snprintf(fwname, sizeof(fwname), "intel/ibt-%u-%u.sfi",
2148 		 le16_to_cpu(ver.hw_variant),
2149 		 le16_to_cpu(params->dev_revid));
2150 
2151 	err = request_firmware(&fw, fwname, &hdev->dev);
2152 	if (err < 0) {
2153 		BT_ERR("%s: Failed to load Intel firmware file (%d)",
2154 		       hdev->name, err);
2155 		kfree_skb(skb);
2156 		return err;
2157 	}
2158 
2159 	BT_INFO("%s: Found device firmware: %s", hdev->name, fwname);
2160 
2161 	/* Save the DDC file name for later use to apply once the firmware
2162 	 * downloading is done.
2163 	 */
2164 	snprintf(fwname, sizeof(fwname), "intel/ibt-%u-%u.ddc",
2165 		 le16_to_cpu(ver.hw_variant),
2166 		 le16_to_cpu(params->dev_revid));
2167 
2168 	kfree_skb(skb);
2169 
2170 	if (fw->size < 644) {
2171 		BT_ERR("%s: Invalid size of firmware file (%zu)",
2172 		       hdev->name, fw->size);
2173 		err = -EBADF;
2174 		goto done;
2175 	}
2176 
2177 	set_bit(BTUSB_DOWNLOADING, &data->flags);
2178 
2179 	/* Start the firmware download transaction with the Init fragment
2180 	 * represented by the 128 bytes of CSS header.
2181 	 */
2182 	err = btintel_secure_send(hdev, 0x00, 128, fw->data);
2183 	if (err < 0) {
2184 		BT_ERR("%s: Failed to send firmware header (%d)",
2185 		       hdev->name, err);
2186 		goto done;
2187 	}
2188 
2189 	/* Send the 256 bytes of public key information from the firmware
2190 	 * as the PKey fragment.
2191 	 */
2192 	err = btintel_secure_send(hdev, 0x03, 256, fw->data + 128);
2193 	if (err < 0) {
2194 		BT_ERR("%s: Failed to send firmware public key (%d)",
2195 		       hdev->name, err);
2196 		goto done;
2197 	}
2198 
2199 	/* Send the 256 bytes of signature information from the firmware
2200 	 * as the Sign fragment.
2201 	 */
2202 	err = btintel_secure_send(hdev, 0x02, 256, fw->data + 388);
2203 	if (err < 0) {
2204 		BT_ERR("%s: Failed to send firmware signature (%d)",
2205 		       hdev->name, err);
2206 		goto done;
2207 	}
2208 
2209 	fw_ptr = fw->data + 644;
2210 	frag_len = 0;
2211 
2212 	while (fw_ptr - fw->data < fw->size) {
2213 		struct hci_command_hdr *cmd = (void *)(fw_ptr + frag_len);
2214 
2215 		frag_len += sizeof(*cmd) + cmd->plen;
2216 
2217 		/* The parameter length of the secure send command requires
2218 		 * a 4 byte alignment. It happens so that the firmware file
2219 		 * contains proper Intel_NOP commands to align the fragments
2220 		 * as needed.
2221 		 *
2222 		 * Send set of commands with 4 byte alignment from the
2223 		 * firmware data buffer as a single Data fragement.
2224 		 */
2225 		if (!(frag_len % 4)) {
2226 			err = btintel_secure_send(hdev, 0x01, frag_len, fw_ptr);
2227 			if (err < 0) {
2228 				BT_ERR("%s: Failed to send firmware data (%d)",
2229 				       hdev->name, err);
2230 				goto done;
2231 			}
2232 
2233 			fw_ptr += frag_len;
2234 			frag_len = 0;
2235 		}
2236 	}
2237 
2238 	set_bit(BTUSB_FIRMWARE_LOADED, &data->flags);
2239 
2240 	BT_INFO("%s: Waiting for firmware download to complete", hdev->name);
2241 
2242 	/* Before switching the device into operational mode and with that
2243 	 * booting the loaded firmware, wait for the bootloader notification
2244 	 * that all fragments have been successfully received.
2245 	 *
2246 	 * When the event processing receives the notification, then the
2247 	 * BTUSB_DOWNLOADING flag will be cleared.
2248 	 *
2249 	 * The firmware loading should not take longer than 5 seconds
2250 	 * and thus just timeout if that happens and fail the setup
2251 	 * of this device.
2252 	 */
2253 	err = wait_on_bit_timeout(&data->flags, BTUSB_DOWNLOADING,
2254 				  TASK_INTERRUPTIBLE,
2255 				  msecs_to_jiffies(5000));
2256 	if (err == -EINTR) {
2257 		BT_ERR("%s: Firmware loading interrupted", hdev->name);
2258 		goto done;
2259 	}
2260 
2261 	if (err) {
2262 		BT_ERR("%s: Firmware loading timeout", hdev->name);
2263 		err = -ETIMEDOUT;
2264 		goto done;
2265 	}
2266 
2267 	if (test_bit(BTUSB_FIRMWARE_FAILED, &data->flags)) {
2268 		BT_ERR("%s: Firmware loading failed", hdev->name);
2269 		err = -ENOEXEC;
2270 		goto done;
2271 	}
2272 
2273 	rettime = ktime_get();
2274 	delta = ktime_sub(rettime, calltime);
2275 	duration = (unsigned long long) ktime_to_ns(delta) >> 10;
2276 
2277 	BT_INFO("%s: Firmware loaded in %llu usecs", hdev->name, duration);
2278 
2279 done:
2280 	release_firmware(fw);
2281 
2282 	if (err < 0)
2283 		return err;
2284 
2285 	calltime = ktime_get();
2286 
2287 	set_bit(BTUSB_BOOTING, &data->flags);
2288 
2289 	skb = __hci_cmd_sync(hdev, 0xfc01, sizeof(reset_param), reset_param,
2290 			     HCI_INIT_TIMEOUT);
2291 	if (IS_ERR(skb))
2292 		return PTR_ERR(skb);
2293 
2294 	kfree_skb(skb);
2295 
2296 	/* The bootloader will not indicate when the device is ready. This
2297 	 * is done by the operational firmware sending bootup notification.
2298 	 *
2299 	 * Booting into operational firmware should not take longer than
2300 	 * 1 second. However if that happens, then just fail the setup
2301 	 * since something went wrong.
2302 	 */
2303 	BT_INFO("%s: Waiting for device to boot", hdev->name);
2304 
2305 	err = wait_on_bit_timeout(&data->flags, BTUSB_BOOTING,
2306 				  TASK_INTERRUPTIBLE,
2307 				  msecs_to_jiffies(1000));
2308 
2309 	if (err == -EINTR) {
2310 		BT_ERR("%s: Device boot interrupted", hdev->name);
2311 		return -EINTR;
2312 	}
2313 
2314 	if (err) {
2315 		BT_ERR("%s: Device boot timeout", hdev->name);
2316 		return -ETIMEDOUT;
2317 	}
2318 
2319 	rettime = ktime_get();
2320 	delta = ktime_sub(rettime, calltime);
2321 	duration = (unsigned long long) ktime_to_ns(delta) >> 10;
2322 
2323 	BT_INFO("%s: Device booted in %llu usecs", hdev->name, duration);
2324 
2325 	clear_bit(BTUSB_BOOTLOADER, &data->flags);
2326 
2327 	/* Once the device is running in operational mode, it needs to apply
2328 	 * the device configuration (DDC) parameters.
2329 	 *
2330 	 * The device can work without DDC parameters, so even if it fails
2331 	 * to load the file, no need to fail the setup.
2332 	 */
2333 	btintel_load_ddc_config(hdev, fwname);
2334 
2335 	/* Set the event mask for Intel specific vendor events. This enables
2336 	 * a few extra events that are useful during general operation. It
2337 	 * does not enable any debugging related events.
2338 	 *
2339 	 * The device will function correctly without these events enabled
2340 	 * and thus no need to fail the setup.
2341 	 */
2342 	btintel_set_event_mask(hdev, false);
2343 
2344 	return 0;
2345 }
2346 
2347 static int btusb_shutdown_intel(struct hci_dev *hdev)
2348 {
2349 	struct sk_buff *skb;
2350 	long ret;
2351 
2352 	/* Some platforms have an issue with BT LED when the interface is
2353 	 * down or BT radio is turned off, which takes 5 seconds to BT LED
2354 	 * goes off. This command turns off the BT LED immediately.
2355 	 */
2356 	skb = __hci_cmd_sync(hdev, 0xfc3f, 0, NULL, HCI_INIT_TIMEOUT);
2357 	if (IS_ERR(skb)) {
2358 		ret = PTR_ERR(skb);
2359 		BT_ERR("%s: turning off Intel device LED failed (%ld)",
2360 		       hdev->name, ret);
2361 		return ret;
2362 	}
2363 	kfree_skb(skb);
2364 
2365 	return 0;
2366 }
2367 
2368 #ifdef CONFIG_PM
2369 /* Configure an out-of-band gpio as wake-up pin, if specified in device tree */
2370 static int marvell_config_oob_wake(struct hci_dev *hdev)
2371 {
2372 	struct sk_buff *skb;
2373 	struct btusb_data *data = hci_get_drvdata(hdev);
2374 	struct device *dev = &data->udev->dev;
2375 	u16 pin, gap, opcode;
2376 	int ret;
2377 	u8 cmd[5];
2378 
2379 	/* Move on if no wakeup pin specified */
2380 	if (of_property_read_u16(dev->of_node, "marvell,wakeup-pin", &pin) ||
2381 	    of_property_read_u16(dev->of_node, "marvell,wakeup-gap-ms", &gap))
2382 		return 0;
2383 
2384 	/* Vendor specific command to configure a GPIO as wake-up pin */
2385 	opcode = hci_opcode_pack(0x3F, 0x59);
2386 	cmd[0] = opcode & 0xFF;
2387 	cmd[1] = opcode >> 8;
2388 	cmd[2] = 2; /* length of parameters that follow */
2389 	cmd[3] = pin;
2390 	cmd[4] = gap; /* time in ms, for which wakeup pin should be asserted */
2391 
2392 	skb = bt_skb_alloc(sizeof(cmd), GFP_KERNEL);
2393 	if (!skb) {
2394 		bt_dev_err(hdev, "%s: No memory\n", __func__);
2395 		return -ENOMEM;
2396 	}
2397 
2398 	skb_put_data(skb, cmd, sizeof(cmd));
2399 	hci_skb_pkt_type(skb) = HCI_COMMAND_PKT;
2400 
2401 	ret = btusb_send_frame(hdev, skb);
2402 	if (ret) {
2403 		bt_dev_err(hdev, "%s: configuration failed\n", __func__);
2404 		kfree_skb(skb);
2405 		return ret;
2406 	}
2407 
2408 	return 0;
2409 }
2410 #endif
2411 
2412 static int btusb_set_bdaddr_marvell(struct hci_dev *hdev,
2413 				    const bdaddr_t *bdaddr)
2414 {
2415 	struct sk_buff *skb;
2416 	u8 buf[8];
2417 	long ret;
2418 
2419 	buf[0] = 0xfe;
2420 	buf[1] = sizeof(bdaddr_t);
2421 	memcpy(buf + 2, bdaddr, sizeof(bdaddr_t));
2422 
2423 	skb = __hci_cmd_sync(hdev, 0xfc22, sizeof(buf), buf, HCI_INIT_TIMEOUT);
2424 	if (IS_ERR(skb)) {
2425 		ret = PTR_ERR(skb);
2426 		BT_ERR("%s: changing Marvell device address failed (%ld)",
2427 		       hdev->name, ret);
2428 		return ret;
2429 	}
2430 	kfree_skb(skb);
2431 
2432 	return 0;
2433 }
2434 
2435 static int btusb_set_bdaddr_ath3012(struct hci_dev *hdev,
2436 				    const bdaddr_t *bdaddr)
2437 {
2438 	struct sk_buff *skb;
2439 	u8 buf[10];
2440 	long ret;
2441 
2442 	buf[0] = 0x01;
2443 	buf[1] = 0x01;
2444 	buf[2] = 0x00;
2445 	buf[3] = sizeof(bdaddr_t);
2446 	memcpy(buf + 4, bdaddr, sizeof(bdaddr_t));
2447 
2448 	skb = __hci_cmd_sync(hdev, 0xfc0b, sizeof(buf), buf, HCI_INIT_TIMEOUT);
2449 	if (IS_ERR(skb)) {
2450 		ret = PTR_ERR(skb);
2451 		BT_ERR("%s: Change address command failed (%ld)",
2452 		       hdev->name, ret);
2453 		return ret;
2454 	}
2455 	kfree_skb(skb);
2456 
2457 	return 0;
2458 }
2459 
2460 #define QCA_DFU_PACKET_LEN	4096
2461 
2462 #define QCA_GET_TARGET_VERSION	0x09
2463 #define QCA_CHECK_STATUS	0x05
2464 #define QCA_DFU_DOWNLOAD	0x01
2465 
2466 #define QCA_SYSCFG_UPDATED	0x40
2467 #define QCA_PATCH_UPDATED	0x80
2468 #define QCA_DFU_TIMEOUT		3000
2469 
2470 struct qca_version {
2471 	__le32	rom_version;
2472 	__le32	patch_version;
2473 	__le32	ram_version;
2474 	__le32	ref_clock;
2475 	__u8	reserved[4];
2476 } __packed;
2477 
2478 struct qca_rampatch_version {
2479 	__le16	rom_version;
2480 	__le16	patch_version;
2481 } __packed;
2482 
2483 struct qca_device_info {
2484 	u32	rom_version;
2485 	u8	rampatch_hdr;	/* length of header in rampatch */
2486 	u8	nvm_hdr;	/* length of header in NVM */
2487 	u8	ver_offset;	/* offset of version structure in rampatch */
2488 };
2489 
2490 static const struct qca_device_info qca_devices_table[] = {
2491 	{ 0x00000100, 20, 4, 10 }, /* Rome 1.0 */
2492 	{ 0x00000101, 20, 4, 10 }, /* Rome 1.1 */
2493 	{ 0x00000200, 28, 4, 18 }, /* Rome 2.0 */
2494 	{ 0x00000201, 28, 4, 18 }, /* Rome 2.1 */
2495 	{ 0x00000300, 28, 4, 18 }, /* Rome 3.0 */
2496 	{ 0x00000302, 28, 4, 18 }, /* Rome 3.2 */
2497 };
2498 
2499 static int btusb_qca_send_vendor_req(struct hci_dev *hdev, u8 request,
2500 				     void *data, u16 size)
2501 {
2502 	struct btusb_data *btdata = hci_get_drvdata(hdev);
2503 	struct usb_device *udev = btdata->udev;
2504 	int pipe, err;
2505 	u8 *buf;
2506 
2507 	buf = kmalloc(size, GFP_KERNEL);
2508 	if (!buf)
2509 		return -ENOMEM;
2510 
2511 	/* Found some of USB hosts have IOT issues with ours so that we should
2512 	 * not wait until HCI layer is ready.
2513 	 */
2514 	pipe = usb_rcvctrlpipe(udev, 0);
2515 	err = usb_control_msg(udev, pipe, request, USB_TYPE_VENDOR | USB_DIR_IN,
2516 			      0, 0, buf, size, USB_CTRL_SET_TIMEOUT);
2517 	if (err < 0) {
2518 		BT_ERR("%s: Failed to access otp area (%d)", hdev->name, err);
2519 		goto done;
2520 	}
2521 
2522 	memcpy(data, buf, size);
2523 
2524 done:
2525 	kfree(buf);
2526 
2527 	return err;
2528 }
2529 
2530 static int btusb_setup_qca_download_fw(struct hci_dev *hdev,
2531 				       const struct firmware *firmware,
2532 				       size_t hdr_size)
2533 {
2534 	struct btusb_data *btdata = hci_get_drvdata(hdev);
2535 	struct usb_device *udev = btdata->udev;
2536 	size_t count, size, sent = 0;
2537 	int pipe, len, err;
2538 	u8 *buf;
2539 
2540 	buf = kmalloc(QCA_DFU_PACKET_LEN, GFP_KERNEL);
2541 	if (!buf)
2542 		return -ENOMEM;
2543 
2544 	count = firmware->size;
2545 
2546 	size = min_t(size_t, count, hdr_size);
2547 	memcpy(buf, firmware->data, size);
2548 
2549 	/* USB patches should go down to controller through USB path
2550 	 * because binary format fits to go down through USB channel.
2551 	 * USB control path is for patching headers and USB bulk is for
2552 	 * patch body.
2553 	 */
2554 	pipe = usb_sndctrlpipe(udev, 0);
2555 	err = usb_control_msg(udev, pipe, QCA_DFU_DOWNLOAD, USB_TYPE_VENDOR,
2556 			      0, 0, buf, size, USB_CTRL_SET_TIMEOUT);
2557 	if (err < 0) {
2558 		BT_ERR("%s: Failed to send headers (%d)", hdev->name, err);
2559 		goto done;
2560 	}
2561 
2562 	sent += size;
2563 	count -= size;
2564 
2565 	while (count) {
2566 		size = min_t(size_t, count, QCA_DFU_PACKET_LEN);
2567 
2568 		memcpy(buf, firmware->data + sent, size);
2569 
2570 		pipe = usb_sndbulkpipe(udev, 0x02);
2571 		err = usb_bulk_msg(udev, pipe, buf, size, &len,
2572 				   QCA_DFU_TIMEOUT);
2573 		if (err < 0) {
2574 			BT_ERR("%s: Failed to send body at %zd of %zd (%d)",
2575 			       hdev->name, sent, firmware->size, err);
2576 			break;
2577 		}
2578 
2579 		if (size != len) {
2580 			BT_ERR("%s: Failed to get bulk buffer", hdev->name);
2581 			err = -EILSEQ;
2582 			break;
2583 		}
2584 
2585 		sent  += size;
2586 		count -= size;
2587 	}
2588 
2589 done:
2590 	kfree(buf);
2591 	return err;
2592 }
2593 
2594 static int btusb_setup_qca_load_rampatch(struct hci_dev *hdev,
2595 					 struct qca_version *ver,
2596 					 const struct qca_device_info *info)
2597 {
2598 	struct qca_rampatch_version *rver;
2599 	const struct firmware *fw;
2600 	u32 ver_rom, ver_patch;
2601 	u16 rver_rom, rver_patch;
2602 	char fwname[64];
2603 	int err;
2604 
2605 	ver_rom = le32_to_cpu(ver->rom_version);
2606 	ver_patch = le32_to_cpu(ver->patch_version);
2607 
2608 	snprintf(fwname, sizeof(fwname), "qca/rampatch_usb_%08x.bin", ver_rom);
2609 
2610 	err = request_firmware(&fw, fwname, &hdev->dev);
2611 	if (err) {
2612 		BT_ERR("%s: failed to request rampatch file: %s (%d)",
2613 		       hdev->name, fwname, err);
2614 		return err;
2615 	}
2616 
2617 	BT_INFO("%s: using rampatch file: %s", hdev->name, fwname);
2618 
2619 	rver = (struct qca_rampatch_version *)(fw->data + info->ver_offset);
2620 	rver_rom = le16_to_cpu(rver->rom_version);
2621 	rver_patch = le16_to_cpu(rver->patch_version);
2622 
2623 	BT_INFO("%s: QCA: patch rome 0x%x build 0x%x, firmware rome 0x%x "
2624 		"build 0x%x", hdev->name, rver_rom, rver_patch, ver_rom,
2625 		ver_patch);
2626 
2627 	if (rver_rom != ver_rom || rver_patch <= ver_patch) {
2628 		BT_ERR("%s: rampatch file version did not match with firmware",
2629 		       hdev->name);
2630 		err = -EINVAL;
2631 		goto done;
2632 	}
2633 
2634 	err = btusb_setup_qca_download_fw(hdev, fw, info->rampatch_hdr);
2635 
2636 done:
2637 	release_firmware(fw);
2638 
2639 	return err;
2640 }
2641 
2642 static int btusb_setup_qca_load_nvm(struct hci_dev *hdev,
2643 				    struct qca_version *ver,
2644 				    const struct qca_device_info *info)
2645 {
2646 	const struct firmware *fw;
2647 	char fwname[64];
2648 	int err;
2649 
2650 	snprintf(fwname, sizeof(fwname), "qca/nvm_usb_%08x.bin",
2651 		 le32_to_cpu(ver->rom_version));
2652 
2653 	err = request_firmware(&fw, fwname, &hdev->dev);
2654 	if (err) {
2655 		BT_ERR("%s: failed to request NVM file: %s (%d)",
2656 		       hdev->name, fwname, err);
2657 		return err;
2658 	}
2659 
2660 	BT_INFO("%s: using NVM file: %s", hdev->name, fwname);
2661 
2662 	err = btusb_setup_qca_download_fw(hdev, fw, info->nvm_hdr);
2663 
2664 	release_firmware(fw);
2665 
2666 	return err;
2667 }
2668 
2669 static int btusb_setup_qca(struct hci_dev *hdev)
2670 {
2671 	const struct qca_device_info *info = NULL;
2672 	struct qca_version ver;
2673 	u32 ver_rom;
2674 	u8 status;
2675 	int i, err;
2676 
2677 	err = btusb_qca_send_vendor_req(hdev, QCA_GET_TARGET_VERSION, &ver,
2678 					sizeof(ver));
2679 	if (err < 0)
2680 		return err;
2681 
2682 	ver_rom = le32_to_cpu(ver.rom_version);
2683 	for (i = 0; i < ARRAY_SIZE(qca_devices_table); i++) {
2684 		if (ver_rom == qca_devices_table[i].rom_version)
2685 			info = &qca_devices_table[i];
2686 	}
2687 	if (!info) {
2688 		BT_ERR("%s: don't support firmware rome 0x%x", hdev->name,
2689 		       ver_rom);
2690 		return -ENODEV;
2691 	}
2692 
2693 	err = btusb_qca_send_vendor_req(hdev, QCA_CHECK_STATUS, &status,
2694 					sizeof(status));
2695 	if (err < 0)
2696 		return err;
2697 
2698 	if (!(status & QCA_PATCH_UPDATED)) {
2699 		err = btusb_setup_qca_load_rampatch(hdev, &ver, info);
2700 		if (err < 0)
2701 			return err;
2702 	}
2703 
2704 	if (!(status & QCA_SYSCFG_UPDATED)) {
2705 		err = btusb_setup_qca_load_nvm(hdev, &ver, info);
2706 		if (err < 0)
2707 			return err;
2708 	}
2709 
2710 	return 0;
2711 }
2712 
2713 #ifdef CONFIG_BT_HCIBTUSB_BCM
2714 static inline int __set_diag_interface(struct hci_dev *hdev)
2715 {
2716 	struct btusb_data *data = hci_get_drvdata(hdev);
2717 	struct usb_interface *intf = data->diag;
2718 	int i;
2719 
2720 	if (!data->diag)
2721 		return -ENODEV;
2722 
2723 	data->diag_tx_ep = NULL;
2724 	data->diag_rx_ep = NULL;
2725 
2726 	for (i = 0; i < intf->cur_altsetting->desc.bNumEndpoints; i++) {
2727 		struct usb_endpoint_descriptor *ep_desc;
2728 
2729 		ep_desc = &intf->cur_altsetting->endpoint[i].desc;
2730 
2731 		if (!data->diag_tx_ep && usb_endpoint_is_bulk_out(ep_desc)) {
2732 			data->diag_tx_ep = ep_desc;
2733 			continue;
2734 		}
2735 
2736 		if (!data->diag_rx_ep && usb_endpoint_is_bulk_in(ep_desc)) {
2737 			data->diag_rx_ep = ep_desc;
2738 			continue;
2739 		}
2740 	}
2741 
2742 	if (!data->diag_tx_ep || !data->diag_rx_ep) {
2743 		BT_ERR("%s invalid diagnostic descriptors", hdev->name);
2744 		return -ENODEV;
2745 	}
2746 
2747 	return 0;
2748 }
2749 
2750 static struct urb *alloc_diag_urb(struct hci_dev *hdev, bool enable)
2751 {
2752 	struct btusb_data *data = hci_get_drvdata(hdev);
2753 	struct sk_buff *skb;
2754 	struct urb *urb;
2755 	unsigned int pipe;
2756 
2757 	if (!data->diag_tx_ep)
2758 		return ERR_PTR(-ENODEV);
2759 
2760 	urb = usb_alloc_urb(0, GFP_KERNEL);
2761 	if (!urb)
2762 		return ERR_PTR(-ENOMEM);
2763 
2764 	skb = bt_skb_alloc(2, GFP_KERNEL);
2765 	if (!skb) {
2766 		usb_free_urb(urb);
2767 		return ERR_PTR(-ENOMEM);
2768 	}
2769 
2770 	skb_put_u8(skb, 0xf0);
2771 	skb_put_u8(skb, enable);
2772 
2773 	pipe = usb_sndbulkpipe(data->udev, data->diag_tx_ep->bEndpointAddress);
2774 
2775 	usb_fill_bulk_urb(urb, data->udev, pipe,
2776 			  skb->data, skb->len, btusb_tx_complete, skb);
2777 
2778 	skb->dev = (void *)hdev;
2779 
2780 	return urb;
2781 }
2782 
2783 static int btusb_bcm_set_diag(struct hci_dev *hdev, bool enable)
2784 {
2785 	struct btusb_data *data = hci_get_drvdata(hdev);
2786 	struct urb *urb;
2787 
2788 	if (!data->diag)
2789 		return -ENODEV;
2790 
2791 	if (!test_bit(HCI_RUNNING, &hdev->flags))
2792 		return -ENETDOWN;
2793 
2794 	urb = alloc_diag_urb(hdev, enable);
2795 	if (IS_ERR(urb))
2796 		return PTR_ERR(urb);
2797 
2798 	return submit_or_queue_tx_urb(hdev, urb);
2799 }
2800 #endif
2801 
2802 #ifdef CONFIG_PM
2803 static irqreturn_t btusb_oob_wake_handler(int irq, void *priv)
2804 {
2805 	struct btusb_data *data = priv;
2806 
2807 	pm_wakeup_event(&data->udev->dev, 0);
2808 	pm_system_wakeup();
2809 
2810 	/* Disable only if not already disabled (keep it balanced) */
2811 	if (test_and_clear_bit(BTUSB_OOB_WAKE_ENABLED, &data->flags)) {
2812 		disable_irq_nosync(irq);
2813 		disable_irq_wake(irq);
2814 	}
2815 	return IRQ_HANDLED;
2816 }
2817 
2818 static const struct of_device_id btusb_match_table[] = {
2819 	{ .compatible = "usb1286,204e" },
2820 	{ }
2821 };
2822 MODULE_DEVICE_TABLE(of, btusb_match_table);
2823 
2824 /* Use an oob wakeup pin? */
2825 static int btusb_config_oob_wake(struct hci_dev *hdev)
2826 {
2827 	struct btusb_data *data = hci_get_drvdata(hdev);
2828 	struct device *dev = &data->udev->dev;
2829 	int irq, ret;
2830 
2831 	clear_bit(BTUSB_OOB_WAKE_ENABLED, &data->flags);
2832 
2833 	if (!of_match_device(btusb_match_table, dev))
2834 		return 0;
2835 
2836 	/* Move on if no IRQ specified */
2837 	irq = of_irq_get_byname(dev->of_node, "wakeup");
2838 	if (irq <= 0) {
2839 		bt_dev_dbg(hdev, "%s: no OOB Wakeup IRQ in DT", __func__);
2840 		return 0;
2841 	}
2842 
2843 	ret = devm_request_irq(&hdev->dev, irq, btusb_oob_wake_handler,
2844 			       0, "OOB Wake-on-BT", data);
2845 	if (ret) {
2846 		bt_dev_err(hdev, "%s: IRQ request failed", __func__);
2847 		return ret;
2848 	}
2849 
2850 	ret = device_init_wakeup(dev, true);
2851 	if (ret) {
2852 		bt_dev_err(hdev, "%s: failed to init_wakeup", __func__);
2853 		return ret;
2854 	}
2855 
2856 	data->oob_wake_irq = irq;
2857 	disable_irq(irq);
2858 	bt_dev_info(hdev, "OOB Wake-on-BT configured at IRQ %u", irq);
2859 	return 0;
2860 }
2861 #endif
2862 
2863 static int btusb_probe(struct usb_interface *intf,
2864 		       const struct usb_device_id *id)
2865 {
2866 	struct usb_endpoint_descriptor *ep_desc;
2867 	struct btusb_data *data;
2868 	struct hci_dev *hdev;
2869 	unsigned ifnum_base;
2870 	int i, err;
2871 
2872 	BT_DBG("intf %p id %p", intf, id);
2873 
2874 	/* interface numbers are hardcoded in the spec */
2875 	if (intf->cur_altsetting->desc.bInterfaceNumber != 0) {
2876 		if (!(id->driver_info & BTUSB_IFNUM_2))
2877 			return -ENODEV;
2878 		if (intf->cur_altsetting->desc.bInterfaceNumber != 2)
2879 			return -ENODEV;
2880 	}
2881 
2882 	ifnum_base = intf->cur_altsetting->desc.bInterfaceNumber;
2883 
2884 	if (!id->driver_info) {
2885 		const struct usb_device_id *match;
2886 
2887 		match = usb_match_id(intf, blacklist_table);
2888 		if (match)
2889 			id = match;
2890 	}
2891 
2892 	if (id->driver_info == BTUSB_IGNORE)
2893 		return -ENODEV;
2894 
2895 	if (id->driver_info & BTUSB_ATH3012) {
2896 		struct usb_device *udev = interface_to_usbdev(intf);
2897 
2898 		/* Old firmware would otherwise let ath3k driver load
2899 		 * patch and sysconfig files */
2900 		if (le16_to_cpu(udev->descriptor.bcdDevice) <= 0x0001)
2901 			return -ENODEV;
2902 	}
2903 
2904 	data = devm_kzalloc(&intf->dev, sizeof(*data), GFP_KERNEL);
2905 	if (!data)
2906 		return -ENOMEM;
2907 
2908 	for (i = 0; i < intf->cur_altsetting->desc.bNumEndpoints; i++) {
2909 		ep_desc = &intf->cur_altsetting->endpoint[i].desc;
2910 
2911 		if (!data->intr_ep && usb_endpoint_is_int_in(ep_desc)) {
2912 			data->intr_ep = ep_desc;
2913 			continue;
2914 		}
2915 
2916 		if (!data->bulk_tx_ep && usb_endpoint_is_bulk_out(ep_desc)) {
2917 			data->bulk_tx_ep = ep_desc;
2918 			continue;
2919 		}
2920 
2921 		if (!data->bulk_rx_ep && usb_endpoint_is_bulk_in(ep_desc)) {
2922 			data->bulk_rx_ep = ep_desc;
2923 			continue;
2924 		}
2925 	}
2926 
2927 	if (!data->intr_ep || !data->bulk_tx_ep || !data->bulk_rx_ep)
2928 		return -ENODEV;
2929 
2930 	if (id->driver_info & BTUSB_AMP) {
2931 		data->cmdreq_type = USB_TYPE_CLASS | 0x01;
2932 		data->cmdreq = 0x2b;
2933 	} else {
2934 		data->cmdreq_type = USB_TYPE_CLASS;
2935 		data->cmdreq = 0x00;
2936 	}
2937 
2938 	data->udev = interface_to_usbdev(intf);
2939 	data->intf = intf;
2940 
2941 	INIT_WORK(&data->work, btusb_work);
2942 	INIT_WORK(&data->waker, btusb_waker);
2943 	init_usb_anchor(&data->deferred);
2944 	init_usb_anchor(&data->tx_anchor);
2945 	spin_lock_init(&data->txlock);
2946 
2947 	init_usb_anchor(&data->intr_anchor);
2948 	init_usb_anchor(&data->bulk_anchor);
2949 	init_usb_anchor(&data->isoc_anchor);
2950 	init_usb_anchor(&data->diag_anchor);
2951 	spin_lock_init(&data->rxlock);
2952 
2953 	if (id->driver_info & BTUSB_INTEL_NEW) {
2954 		data->recv_event = btusb_recv_event_intel;
2955 		data->recv_bulk = btusb_recv_bulk_intel;
2956 		set_bit(BTUSB_BOOTLOADER, &data->flags);
2957 	} else {
2958 		data->recv_event = hci_recv_frame;
2959 		data->recv_bulk = btusb_recv_bulk;
2960 	}
2961 
2962 	hdev = hci_alloc_dev();
2963 	if (!hdev)
2964 		return -ENOMEM;
2965 
2966 	hdev->bus = HCI_USB;
2967 	hci_set_drvdata(hdev, data);
2968 
2969 	if (id->driver_info & BTUSB_AMP)
2970 		hdev->dev_type = HCI_AMP;
2971 	else
2972 		hdev->dev_type = HCI_PRIMARY;
2973 
2974 	data->hdev = hdev;
2975 
2976 	SET_HCIDEV_DEV(hdev, &intf->dev);
2977 
2978 	hdev->open   = btusb_open;
2979 	hdev->close  = btusb_close;
2980 	hdev->flush  = btusb_flush;
2981 	hdev->send   = btusb_send_frame;
2982 	hdev->notify = btusb_notify;
2983 
2984 #ifdef CONFIG_PM
2985 	err = btusb_config_oob_wake(hdev);
2986 	if (err)
2987 		goto out_free_dev;
2988 
2989 	/* Marvell devices may need a specific chip configuration */
2990 	if (id->driver_info & BTUSB_MARVELL && data->oob_wake_irq) {
2991 		err = marvell_config_oob_wake(hdev);
2992 		if (err)
2993 			goto out_free_dev;
2994 	}
2995 #endif
2996 	if (id->driver_info & BTUSB_CW6622)
2997 		set_bit(HCI_QUIRK_BROKEN_STORED_LINK_KEY, &hdev->quirks);
2998 
2999 	if (id->driver_info & BTUSB_BCM2045)
3000 		set_bit(HCI_QUIRK_BROKEN_STORED_LINK_KEY, &hdev->quirks);
3001 
3002 	if (id->driver_info & BTUSB_BCM92035)
3003 		hdev->setup = btusb_setup_bcm92035;
3004 
3005 #ifdef CONFIG_BT_HCIBTUSB_BCM
3006 	if (id->driver_info & BTUSB_BCM_PATCHRAM) {
3007 		hdev->manufacturer = 15;
3008 		hdev->setup = btbcm_setup_patchram;
3009 		hdev->set_diag = btusb_bcm_set_diag;
3010 		hdev->set_bdaddr = btbcm_set_bdaddr;
3011 
3012 		/* Broadcom LM_DIAG Interface numbers are hardcoded */
3013 		data->diag = usb_ifnum_to_if(data->udev, ifnum_base + 2);
3014 	}
3015 
3016 	if (id->driver_info & BTUSB_BCM_APPLE) {
3017 		hdev->manufacturer = 15;
3018 		hdev->setup = btbcm_setup_apple;
3019 		hdev->set_diag = btusb_bcm_set_diag;
3020 
3021 		/* Broadcom LM_DIAG Interface numbers are hardcoded */
3022 		data->diag = usb_ifnum_to_if(data->udev, ifnum_base + 2);
3023 	}
3024 #endif
3025 
3026 	if (id->driver_info & BTUSB_INTEL) {
3027 		hdev->manufacturer = 2;
3028 		hdev->setup = btusb_setup_intel;
3029 		hdev->shutdown = btusb_shutdown_intel;
3030 		hdev->set_diag = btintel_set_diag_mfg;
3031 		hdev->set_bdaddr = btintel_set_bdaddr;
3032 		set_bit(HCI_QUIRK_STRICT_DUPLICATE_FILTER, &hdev->quirks);
3033 		set_bit(HCI_QUIRK_SIMULTANEOUS_DISCOVERY, &hdev->quirks);
3034 		set_bit(HCI_QUIRK_NON_PERSISTENT_DIAG, &hdev->quirks);
3035 	}
3036 
3037 	if (id->driver_info & BTUSB_INTEL_NEW) {
3038 		hdev->manufacturer = 2;
3039 		hdev->send = btusb_send_frame_intel;
3040 		hdev->setup = btusb_setup_intel_new;
3041 		hdev->hw_error = btintel_hw_error;
3042 		hdev->set_diag = btintel_set_diag;
3043 		hdev->set_bdaddr = btintel_set_bdaddr;
3044 		set_bit(HCI_QUIRK_STRICT_DUPLICATE_FILTER, &hdev->quirks);
3045 		set_bit(HCI_QUIRK_NON_PERSISTENT_DIAG, &hdev->quirks);
3046 	}
3047 
3048 	if (id->driver_info & BTUSB_MARVELL)
3049 		hdev->set_bdaddr = btusb_set_bdaddr_marvell;
3050 
3051 	if (id->driver_info & BTUSB_SWAVE) {
3052 		set_bit(HCI_QUIRK_FIXUP_INQUIRY_MODE, &hdev->quirks);
3053 		set_bit(HCI_QUIRK_BROKEN_LOCAL_COMMANDS, &hdev->quirks);
3054 	}
3055 
3056 	if (id->driver_info & BTUSB_INTEL_BOOT) {
3057 		hdev->manufacturer = 2;
3058 		set_bit(HCI_QUIRK_RAW_DEVICE, &hdev->quirks);
3059 	}
3060 
3061 	if (id->driver_info & BTUSB_ATH3012) {
3062 		hdev->set_bdaddr = btusb_set_bdaddr_ath3012;
3063 		set_bit(HCI_QUIRK_SIMULTANEOUS_DISCOVERY, &hdev->quirks);
3064 		set_bit(HCI_QUIRK_STRICT_DUPLICATE_FILTER, &hdev->quirks);
3065 	}
3066 
3067 	if (id->driver_info & BTUSB_QCA_ROME) {
3068 		data->setup_on_usb = btusb_setup_qca;
3069 		hdev->set_bdaddr = btusb_set_bdaddr_ath3012;
3070 	}
3071 
3072 #ifdef CONFIG_BT_HCIBTUSB_RTL
3073 	if (id->driver_info & BTUSB_REALTEK) {
3074 		hdev->setup = btrtl_setup_realtek;
3075 
3076 		/* Realtek devices lose their updated firmware over suspend,
3077 		 * but the USB hub doesn't notice any status change.
3078 		 * Explicitly request a device reset on resume.
3079 		 */
3080 		set_bit(BTUSB_RESET_RESUME, &data->flags);
3081 	}
3082 #endif
3083 
3084 	if (id->driver_info & BTUSB_AMP) {
3085 		/* AMP controllers do not support SCO packets */
3086 		data->isoc = NULL;
3087 	} else {
3088 		/* Interface orders are hardcoded in the specification */
3089 		data->isoc = usb_ifnum_to_if(data->udev, ifnum_base + 1);
3090 	}
3091 
3092 	if (!reset)
3093 		set_bit(HCI_QUIRK_RESET_ON_CLOSE, &hdev->quirks);
3094 
3095 	if (force_scofix || id->driver_info & BTUSB_WRONG_SCO_MTU) {
3096 		if (!disable_scofix)
3097 			set_bit(HCI_QUIRK_FIXUP_BUFFER_SIZE, &hdev->quirks);
3098 	}
3099 
3100 	if (id->driver_info & BTUSB_BROKEN_ISOC)
3101 		data->isoc = NULL;
3102 
3103 	if (id->driver_info & BTUSB_DIGIANSWER) {
3104 		data->cmdreq_type = USB_TYPE_VENDOR;
3105 		set_bit(HCI_QUIRK_RESET_ON_CLOSE, &hdev->quirks);
3106 	}
3107 
3108 	if (id->driver_info & BTUSB_CSR) {
3109 		struct usb_device *udev = data->udev;
3110 		u16 bcdDevice = le16_to_cpu(udev->descriptor.bcdDevice);
3111 
3112 		/* Old firmware would otherwise execute USB reset */
3113 		if (bcdDevice < 0x117)
3114 			set_bit(HCI_QUIRK_RESET_ON_CLOSE, &hdev->quirks);
3115 
3116 		/* Fake CSR devices with broken commands */
3117 		if (bcdDevice <= 0x100 || bcdDevice == 0x134)
3118 			hdev->setup = btusb_setup_csr;
3119 
3120 		set_bit(HCI_QUIRK_SIMULTANEOUS_DISCOVERY, &hdev->quirks);
3121 	}
3122 
3123 	if (id->driver_info & BTUSB_SNIFFER) {
3124 		struct usb_device *udev = data->udev;
3125 
3126 		/* New sniffer firmware has crippled HCI interface */
3127 		if (le16_to_cpu(udev->descriptor.bcdDevice) > 0x997)
3128 			set_bit(HCI_QUIRK_RAW_DEVICE, &hdev->quirks);
3129 	}
3130 
3131 	if (id->driver_info & BTUSB_INTEL_BOOT) {
3132 		/* A bug in the bootloader causes that interrupt interface is
3133 		 * only enabled after receiving SetInterface(0, AltSetting=0).
3134 		 */
3135 		err = usb_set_interface(data->udev, 0, 0);
3136 		if (err < 0) {
3137 			BT_ERR("failed to set interface 0, alt 0 %d", err);
3138 			goto out_free_dev;
3139 		}
3140 	}
3141 
3142 	if (data->isoc) {
3143 		err = usb_driver_claim_interface(&btusb_driver,
3144 						 data->isoc, data);
3145 		if (err < 0)
3146 			goto out_free_dev;
3147 	}
3148 
3149 #ifdef CONFIG_BT_HCIBTUSB_BCM
3150 	if (data->diag) {
3151 		if (!usb_driver_claim_interface(&btusb_driver,
3152 						data->diag, data))
3153 			__set_diag_interface(hdev);
3154 		else
3155 			data->diag = NULL;
3156 	}
3157 #endif
3158 
3159 	err = hci_register_dev(hdev);
3160 	if (err < 0)
3161 		goto out_free_dev;
3162 
3163 	usb_set_intfdata(intf, data);
3164 
3165 	return 0;
3166 
3167 out_free_dev:
3168 	hci_free_dev(hdev);
3169 	return err;
3170 }
3171 
3172 static void btusb_disconnect(struct usb_interface *intf)
3173 {
3174 	struct btusb_data *data = usb_get_intfdata(intf);
3175 	struct hci_dev *hdev;
3176 
3177 	BT_DBG("intf %p", intf);
3178 
3179 	if (!data)
3180 		return;
3181 
3182 	hdev = data->hdev;
3183 	usb_set_intfdata(data->intf, NULL);
3184 
3185 	if (data->isoc)
3186 		usb_set_intfdata(data->isoc, NULL);
3187 
3188 	if (data->diag)
3189 		usb_set_intfdata(data->diag, NULL);
3190 
3191 	hci_unregister_dev(hdev);
3192 
3193 	if (intf == data->intf) {
3194 		if (data->isoc)
3195 			usb_driver_release_interface(&btusb_driver, data->isoc);
3196 		if (data->diag)
3197 			usb_driver_release_interface(&btusb_driver, data->diag);
3198 	} else if (intf == data->isoc) {
3199 		if (data->diag)
3200 			usb_driver_release_interface(&btusb_driver, data->diag);
3201 		usb_driver_release_interface(&btusb_driver, data->intf);
3202 	} else if (intf == data->diag) {
3203 		usb_driver_release_interface(&btusb_driver, data->intf);
3204 		if (data->isoc)
3205 			usb_driver_release_interface(&btusb_driver, data->isoc);
3206 	}
3207 
3208 	if (data->oob_wake_irq)
3209 		device_init_wakeup(&data->udev->dev, false);
3210 
3211 	hci_free_dev(hdev);
3212 }
3213 
3214 #ifdef CONFIG_PM
3215 static int btusb_suspend(struct usb_interface *intf, pm_message_t message)
3216 {
3217 	struct btusb_data *data = usb_get_intfdata(intf);
3218 
3219 	BT_DBG("intf %p", intf);
3220 
3221 	if (data->suspend_count++)
3222 		return 0;
3223 
3224 	spin_lock_irq(&data->txlock);
3225 	if (!(PMSG_IS_AUTO(message) && data->tx_in_flight)) {
3226 		set_bit(BTUSB_SUSPENDING, &data->flags);
3227 		spin_unlock_irq(&data->txlock);
3228 	} else {
3229 		spin_unlock_irq(&data->txlock);
3230 		data->suspend_count--;
3231 		return -EBUSY;
3232 	}
3233 
3234 	cancel_work_sync(&data->work);
3235 
3236 	btusb_stop_traffic(data);
3237 	usb_kill_anchored_urbs(&data->tx_anchor);
3238 
3239 	if (data->oob_wake_irq && device_may_wakeup(&data->udev->dev)) {
3240 		set_bit(BTUSB_OOB_WAKE_ENABLED, &data->flags);
3241 		enable_irq_wake(data->oob_wake_irq);
3242 		enable_irq(data->oob_wake_irq);
3243 	}
3244 
3245 	/* Optionally request a device reset on resume, but only when
3246 	 * wakeups are disabled. If wakeups are enabled we assume the
3247 	 * device will stay powered up throughout suspend.
3248 	 */
3249 	if (test_bit(BTUSB_RESET_RESUME, &data->flags) &&
3250 	    !device_may_wakeup(&data->udev->dev))
3251 		data->udev->reset_resume = 1;
3252 
3253 	return 0;
3254 }
3255 
3256 static void play_deferred(struct btusb_data *data)
3257 {
3258 	struct urb *urb;
3259 	int err;
3260 
3261 	while ((urb = usb_get_from_anchor(&data->deferred))) {
3262 		err = usb_submit_urb(urb, GFP_ATOMIC);
3263 		if (err < 0)
3264 			break;
3265 
3266 		data->tx_in_flight++;
3267 	}
3268 	usb_scuttle_anchored_urbs(&data->deferred);
3269 }
3270 
3271 static int btusb_resume(struct usb_interface *intf)
3272 {
3273 	struct btusb_data *data = usb_get_intfdata(intf);
3274 	struct hci_dev *hdev = data->hdev;
3275 	int err = 0;
3276 
3277 	BT_DBG("intf %p", intf);
3278 
3279 	if (--data->suspend_count)
3280 		return 0;
3281 
3282 	/* Disable only if not already disabled (keep it balanced) */
3283 	if (test_and_clear_bit(BTUSB_OOB_WAKE_ENABLED, &data->flags)) {
3284 		disable_irq(data->oob_wake_irq);
3285 		disable_irq_wake(data->oob_wake_irq);
3286 	}
3287 
3288 	if (!test_bit(HCI_RUNNING, &hdev->flags))
3289 		goto done;
3290 
3291 	if (test_bit(BTUSB_INTR_RUNNING, &data->flags)) {
3292 		err = btusb_submit_intr_urb(hdev, GFP_NOIO);
3293 		if (err < 0) {
3294 			clear_bit(BTUSB_INTR_RUNNING, &data->flags);
3295 			goto failed;
3296 		}
3297 	}
3298 
3299 	if (test_bit(BTUSB_BULK_RUNNING, &data->flags)) {
3300 		err = btusb_submit_bulk_urb(hdev, GFP_NOIO);
3301 		if (err < 0) {
3302 			clear_bit(BTUSB_BULK_RUNNING, &data->flags);
3303 			goto failed;
3304 		}
3305 
3306 		btusb_submit_bulk_urb(hdev, GFP_NOIO);
3307 	}
3308 
3309 	if (test_bit(BTUSB_ISOC_RUNNING, &data->flags)) {
3310 		if (btusb_submit_isoc_urb(hdev, GFP_NOIO) < 0)
3311 			clear_bit(BTUSB_ISOC_RUNNING, &data->flags);
3312 		else
3313 			btusb_submit_isoc_urb(hdev, GFP_NOIO);
3314 	}
3315 
3316 	spin_lock_irq(&data->txlock);
3317 	play_deferred(data);
3318 	clear_bit(BTUSB_SUSPENDING, &data->flags);
3319 	spin_unlock_irq(&data->txlock);
3320 	schedule_work(&data->work);
3321 
3322 	return 0;
3323 
3324 failed:
3325 	usb_scuttle_anchored_urbs(&data->deferred);
3326 done:
3327 	spin_lock_irq(&data->txlock);
3328 	clear_bit(BTUSB_SUSPENDING, &data->flags);
3329 	spin_unlock_irq(&data->txlock);
3330 
3331 	return err;
3332 }
3333 #endif
3334 
3335 static struct usb_driver btusb_driver = {
3336 	.name		= "btusb",
3337 	.probe		= btusb_probe,
3338 	.disconnect	= btusb_disconnect,
3339 #ifdef CONFIG_PM
3340 	.suspend	= btusb_suspend,
3341 	.resume		= btusb_resume,
3342 #endif
3343 	.id_table	= btusb_table,
3344 	.supports_autosuspend = 1,
3345 	.disable_hub_initiated_lpm = 1,
3346 };
3347 
3348 module_usb_driver(btusb_driver);
3349 
3350 module_param(disable_scofix, bool, 0644);
3351 MODULE_PARM_DESC(disable_scofix, "Disable fixup of wrong SCO buffer size");
3352 
3353 module_param(force_scofix, bool, 0644);
3354 MODULE_PARM_DESC(force_scofix, "Force fixup of wrong SCO buffers size");
3355 
3356 module_param(reset, bool, 0644);
3357 MODULE_PARM_DESC(reset, "Send HCI reset command on initialization");
3358 
3359 MODULE_AUTHOR("Marcel Holtmann <marcel@holtmann.org>");
3360 MODULE_DESCRIPTION("Generic Bluetooth USB driver ver " VERSION);
3361 MODULE_VERSION(VERSION);
3362 MODULE_LICENSE("GPL");
3363