]> git.proxmox.com Git - mirror_ubuntu-jammy-kernel.git/blob - drivers/bluetooth/btusb.c
projects / mirror_ubuntu-jammy-kernel.git / blob
? search:
summary | shortlog | log | commit | commitdiff | tree
blame | history | raw | HEAD
Bluetooth: btusb: Add Realtek RTL8852C support ID 0x04C5:0x1675
[mirror_ubuntu-jammy-kernel.git] / drivers / bluetooth / btusb.c
1 // SPDX-License-Identifier: GPL-2.0-or-later
2 /*
3 *
4 * Generic Bluetooth USB driver
5 *
6 * Copyright (C) 2005-2008 Marcel Holtmann <marcel@holtmann.org>
7 */
8
9 #include <linux/dmi.h>
10 #include <linux/module.h>
11 #include <linux/usb.h>
12 #include <linux/usb/quirks.h>
13 #include <linux/firmware.h>
14 #include <linux/iopoll.h>
15 #include <linux/of_device.h>
16 #include <linux/of_irq.h>
17 #include <linux/pci.h>
18 #include <linux/suspend.h>
19 #include <linux/gpio/consumer.h>
20 #include <asm/unaligned.h>
21
22 #include <net/bluetooth/bluetooth.h>
23 #include <net/bluetooth/hci_core.h>
24
25 #include "btintel.h"
26 #include "btbcm.h"
27 #include "btrtl.h"
28
29 #define VERSION "0.8"
30
31 static bool disable_scofix;
32 static bool force_scofix;
33 static bool enable_autosuspend = IS_ENABLED(CONFIG_BT_HCIBTUSB_AUTOSUSPEND);
34
35 static bool reset = true;
36
37 static struct usb_driver btusb_driver;
38
39 #define BTUSB_IGNORE 0x01
40 #define BTUSB_DIGIANSWER 0x02
41 #define BTUSB_CSR 0x04
42 #define BTUSB_SNIFFER 0x08
43 #define BTUSB_BCM92035 0x10
44 #define BTUSB_BROKEN_ISOC 0x20
45 #define BTUSB_WRONG_SCO_MTU 0x40
46 #define BTUSB_ATH3012 0x80
47 #define BTUSB_INTEL_COMBINED 0x100
48 #define BTUSB_INTEL_BOOT 0x200
49 #define BTUSB_BCM_PATCHRAM 0x400
50 #define BTUSB_MARVELL 0x800
51 #define BTUSB_SWAVE 0x1000
52 #define BTUSB_AMP 0x4000
53 #define BTUSB_QCA_ROME 0x8000
54 #define BTUSB_BCM_APPLE 0x10000
55 #define BTUSB_REALTEK 0x20000
56 #define BTUSB_BCM2045 0x40000
57 #define BTUSB_IFNUM_2 0x80000
58 #define BTUSB_CW6622 0x100000
59 #define BTUSB_MEDIATEK 0x200000
60 #define BTUSB_WIDEBAND_SPEECH 0x400000
61 #define BTUSB_VALID_LE_STATES 0x800000
62 #define BTUSB_QCA_WCN6855 0x1000000
63 #define BTUSB_INTEL_BROKEN_SHUTDOWN_LED 0x2000000
64 #define BTUSB_INTEL_BROKEN_INITIAL_NCMD 0x4000000
65 #define BTUSB_INTEL_NO_WBS_SUPPORT 0x8000000
66
67 static const struct usb_device_id btusb_table[] = {
68 /* Generic Bluetooth USB device */
69 { USB_DEVICE_INFO(0xe0, 0x01, 0x01) },
70
71 /* Generic Bluetooth AMP device */
72 { USB_DEVICE_INFO(0xe0, 0x01, 0x04), .driver_info = BTUSB_AMP },
73
74 /* Generic Bluetooth USB interface */
75 { USB_INTERFACE_INFO(0xe0, 0x01, 0x01) },
76
77 /* Apple-specific (Broadcom) devices */
78 { USB_VENDOR_AND_INTERFACE_INFO(0x05ac, 0xff, 0x01, 0x01),
79 .driver_info = BTUSB_BCM_APPLE | BTUSB_IFNUM_2 },
80
81 /* MediaTek MT76x0E */
82 { USB_DEVICE(0x0e8d, 0x763f) },
83
84 /* Broadcom SoftSailing reporting vendor specific */
85 { USB_DEVICE(0x0a5c, 0x21e1) },
86
87 /* Apple MacBookPro 7,1 */
88 { USB_DEVICE(0x05ac, 0x8213) },
89
90 /* Apple iMac11,1 */
91 { USB_DEVICE(0x05ac, 0x8215) },
92
93 /* Apple MacBookPro6,2 */
94 { USB_DEVICE(0x05ac, 0x8218) },
95
96 /* Apple MacBookAir3,1, MacBookAir3,2 */
97 { USB_DEVICE(0x05ac, 0x821b) },
98
99 /* Apple MacBookAir4,1 */
100 { USB_DEVICE(0x05ac, 0x821f) },
101
102 /* Apple MacBookPro8,2 */
103 { USB_DEVICE(0x05ac, 0x821a) },
104
105 /* Apple MacMini5,1 */
106 { USB_DEVICE(0x05ac, 0x8281) },
107
108 /* AVM BlueFRITZ! USB v2.0 */
109 { USB_DEVICE(0x057c, 0x3800), .driver_info = BTUSB_SWAVE },
110
111 /* Bluetooth Ultraport Module from IBM */
112 { USB_DEVICE(0x04bf, 0x030a) },
113
114 /* ALPS Modules with non-standard id */
115 { USB_DEVICE(0x044e, 0x3001) },
116 { USB_DEVICE(0x044e, 0x3002) },
117
118 /* Ericsson with non-standard id */
119 { USB_DEVICE(0x0bdb, 0x1002) },
120
121 /* Canyon CN-BTU1 with HID interfaces */
122 { USB_DEVICE(0x0c10, 0x0000) },
123
124 /* Broadcom BCM20702B0 (Dynex/Insignia) */
125 { USB_DEVICE(0x19ff, 0x0239), .driver_info = BTUSB_BCM_PATCHRAM },
126
127 /* Broadcom BCM43142A0 (Foxconn/Lenovo) */
128 { USB_VENDOR_AND_INTERFACE_INFO(0x105b, 0xff, 0x01, 0x01),
129 .driver_info = BTUSB_BCM_PATCHRAM },
130
131 /* Broadcom BCM920703 (HTC Vive) */
132 { USB_VENDOR_AND_INTERFACE_INFO(0x0bb4, 0xff, 0x01, 0x01),
133 .driver_info = BTUSB_BCM_PATCHRAM },
134
135 /* Foxconn - Hon Hai */
136 { USB_VENDOR_AND_INTERFACE_INFO(0x0489, 0xff, 0x01, 0x01),
137 .driver_info = BTUSB_BCM_PATCHRAM },
138
139 /* Lite-On Technology - Broadcom based */
140 { USB_VENDOR_AND_INTERFACE_INFO(0x04ca, 0xff, 0x01, 0x01),
141 .driver_info = BTUSB_BCM_PATCHRAM },
142
143 /* Broadcom devices with vendor specific id */
144 { USB_VENDOR_AND_INTERFACE_INFO(0x0a5c, 0xff, 0x01, 0x01),
145 .driver_info = BTUSB_BCM_PATCHRAM },
146
147 /* ASUSTek Computer - Broadcom based */
148 { USB_VENDOR_AND_INTERFACE_INFO(0x0b05, 0xff, 0x01, 0x01),
149 .driver_info = BTUSB_BCM_PATCHRAM },
150
151 /* Belkin F8065bf - Broadcom based */
152 { USB_VENDOR_AND_INTERFACE_INFO(0x050d, 0xff, 0x01, 0x01),
153 .driver_info = BTUSB_BCM_PATCHRAM },
154
155 /* IMC Networks - Broadcom based */
156 { USB_VENDOR_AND_INTERFACE_INFO(0x13d3, 0xff, 0x01, 0x01),
157 .driver_info = BTUSB_BCM_PATCHRAM },
158
159 /* Dell Computer - Broadcom based */
160 { USB_VENDOR_AND_INTERFACE_INFO(0x413c, 0xff, 0x01, 0x01),
161 .driver_info = BTUSB_BCM_PATCHRAM },
162
163 /* Toshiba Corp - Broadcom based */
164 { USB_VENDOR_AND_INTERFACE_INFO(0x0930, 0xff, 0x01, 0x01),
165 .driver_info = BTUSB_BCM_PATCHRAM },
166
167 /* Intel Bluetooth USB Bootloader (RAM module) */
168 { USB_DEVICE(0x8087, 0x0a5a),
169 .driver_info = BTUSB_INTEL_BOOT | BTUSB_BROKEN_ISOC },
170
171 { } /* Terminating entry */
172 };
173
174 MODULE_DEVICE_TABLE(usb, btusb_table);
175
176 static const struct usb_device_id blacklist_table[] = {
177 /* CSR BlueCore devices */
178 { USB_DEVICE(0x0a12, 0x0001), .driver_info = BTUSB_CSR },
179
180 /* Broadcom BCM2033 without firmware */
181 { USB_DEVICE(0x0a5c, 0x2033), .driver_info = BTUSB_IGNORE },
182
183 /* Broadcom BCM2045 devices */
184 { USB_DEVICE(0x0a5c, 0x2045), .driver_info = BTUSB_BCM2045 },
185
186 /* Atheros 3011 with sflash firmware */
187 { USB_DEVICE(0x0489, 0xe027), .driver_info = BTUSB_IGNORE },
188 { USB_DEVICE(0x0489, 0xe03d), .driver_info = BTUSB_IGNORE },
189 { USB_DEVICE(0x04f2, 0xaff1), .driver_info = BTUSB_IGNORE },
190 { USB_DEVICE(0x0930, 0x0215), .driver_info = BTUSB_IGNORE },
191 { USB_DEVICE(0x0cf3, 0x3002), .driver_info = BTUSB_IGNORE },
192 { USB_DEVICE(0x0cf3, 0xe019), .driver_info = BTUSB_IGNORE },
193 { USB_DEVICE(0x13d3, 0x3304), .driver_info = BTUSB_IGNORE },
194
195 /* Atheros AR9285 Malbec with sflash firmware */
196 { USB_DEVICE(0x03f0, 0x311d), .driver_info = BTUSB_IGNORE },
197
198 /* Atheros 3012 with sflash firmware */
199 { USB_DEVICE(0x0489, 0xe04d), .driver_info = BTUSB_ATH3012 },
200 { USB_DEVICE(0x0489, 0xe04e), .driver_info = BTUSB_ATH3012 },
201 { USB_DEVICE(0x0489, 0xe056), .driver_info = BTUSB_ATH3012 },
202 { USB_DEVICE(0x0489, 0xe057), .driver_info = BTUSB_ATH3012 },
203 { USB_DEVICE(0x0489, 0xe05f), .driver_info = BTUSB_ATH3012 },
204 { USB_DEVICE(0x0489, 0xe076), .driver_info = BTUSB_ATH3012 },
205 { USB_DEVICE(0x0489, 0xe078), .driver_info = BTUSB_ATH3012 },
206 { USB_DEVICE(0x0489, 0xe095), .driver_info = BTUSB_ATH3012 },
207 { USB_DEVICE(0x04c5, 0x1330), .driver_info = BTUSB_ATH3012 },
208 { USB_DEVICE(0x04ca, 0x3004), .driver_info = BTUSB_ATH3012 },
209 { USB_DEVICE(0x04ca, 0x3005), .driver_info = BTUSB_ATH3012 },
210 { USB_DEVICE(0x04ca, 0x3006), .driver_info = BTUSB_ATH3012 },
211 { USB_DEVICE(0x04ca, 0x3007), .driver_info = BTUSB_ATH3012 },
212 { USB_DEVICE(0x04ca, 0x3008), .driver_info = BTUSB_ATH3012 },
213 { USB_DEVICE(0x04ca, 0x300b), .driver_info = BTUSB_ATH3012 },
214 { USB_DEVICE(0x04ca, 0x300d), .driver_info = BTUSB_ATH3012 },
215 { USB_DEVICE(0x04ca, 0x300f), .driver_info = BTUSB_ATH3012 },
216 { USB_DEVICE(0x04ca, 0x3010), .driver_info = BTUSB_ATH3012 },
217 { USB_DEVICE(0x04ca, 0x3014), .driver_info = BTUSB_ATH3012 },
218 { USB_DEVICE(0x04ca, 0x3018), .driver_info = BTUSB_ATH3012 },
219 { USB_DEVICE(0x0930, 0x0219), .driver_info = BTUSB_ATH3012 },
220 { USB_DEVICE(0x0930, 0x021c), .driver_info = BTUSB_ATH3012 },
221 { USB_DEVICE(0x0930, 0x0220), .driver_info = BTUSB_ATH3012 },
222 { USB_DEVICE(0x0930, 0x0227), .driver_info = BTUSB_ATH3012 },
223 { USB_DEVICE(0x0b05, 0x17d0), .driver_info = BTUSB_ATH3012 },
224 { USB_DEVICE(0x0cf3, 0x0036), .driver_info = BTUSB_ATH3012 },
225 { USB_DEVICE(0x0cf3, 0x3004), .driver_info = BTUSB_ATH3012 },
226 { USB_DEVICE(0x0cf3, 0x3008), .driver_info = BTUSB_ATH3012 },
227 { USB_DEVICE(0x0cf3, 0x311d), .driver_info = BTUSB_ATH3012 },
228 { USB_DEVICE(0x0cf3, 0x311e), .driver_info = BTUSB_ATH3012 },
229 { USB_DEVICE(0x0cf3, 0x311f), .driver_info = BTUSB_ATH3012 },
230 { USB_DEVICE(0x0cf3, 0x3121), .driver_info = BTUSB_ATH3012 },
231 { USB_DEVICE(0x0cf3, 0x817a), .driver_info = BTUSB_ATH3012 },
232 { USB_DEVICE(0x0cf3, 0x817b), .driver_info = BTUSB_ATH3012 },
233 { USB_DEVICE(0x0cf3, 0xe003), .driver_info = BTUSB_ATH3012 },
234 { USB_DEVICE(0x0cf3, 0xe004), .driver_info = BTUSB_ATH3012 },
235 { USB_DEVICE(0x0cf3, 0xe005), .driver_info = BTUSB_ATH3012 },
236 { USB_DEVICE(0x0cf3, 0xe006), .driver_info = BTUSB_ATH3012 },
237 { USB_DEVICE(0x13d3, 0x3362), .driver_info = BTUSB_ATH3012 },
238 { USB_DEVICE(0x13d3, 0x3375), .driver_info = BTUSB_ATH3012 },
239 { USB_DEVICE(0x13d3, 0x3393), .driver_info = BTUSB_ATH3012 },
240 { USB_DEVICE(0x13d3, 0x3395), .driver_info = BTUSB_ATH3012 },
241 { USB_DEVICE(0x13d3, 0x3402), .driver_info = BTUSB_ATH3012 },
242 { USB_DEVICE(0x13d3, 0x3408), .driver_info = BTUSB_ATH3012 },
243 { USB_DEVICE(0x13d3, 0x3423), .driver_info = BTUSB_ATH3012 },
244 { USB_DEVICE(0x13d3, 0x3432), .driver_info = BTUSB_ATH3012 },
245 { USB_DEVICE(0x13d3, 0x3472), .driver_info = BTUSB_ATH3012 },
246 { USB_DEVICE(0x13d3, 0x3474), .driver_info = BTUSB_ATH3012 },
247 { USB_DEVICE(0x13d3, 0x3487), .driver_info = BTUSB_ATH3012 },
248 { USB_DEVICE(0x13d3, 0x3490), .driver_info = BTUSB_ATH3012 },
249
250 /* Atheros AR5BBU12 with sflash firmware */
251 { USB_DEVICE(0x0489, 0xe02c), .driver_info = BTUSB_IGNORE },
252
253 /* Atheros AR5BBU12 with sflash firmware */
254 { USB_DEVICE(0x0489, 0xe036), .driver_info = BTUSB_ATH3012 },
255 { USB_DEVICE(0x0489, 0xe03c), .driver_info = BTUSB_ATH3012 },
256
257 /* QCA ROME chipset */
258 { USB_DEVICE(0x0cf3, 0x535b), .driver_info = BTUSB_QCA_ROME |
259 BTUSB_WIDEBAND_SPEECH },
260 { USB_DEVICE(0x0cf3, 0xe007), .driver_info = BTUSB_QCA_ROME |
261 BTUSB_WIDEBAND_SPEECH },
262 { USB_DEVICE(0x0cf3, 0xe009), .driver_info = BTUSB_QCA_ROME |
263 BTUSB_WIDEBAND_SPEECH },
264 { USB_DEVICE(0x0cf3, 0xe010), .driver_info = BTUSB_QCA_ROME |
265 BTUSB_WIDEBAND_SPEECH },
266 { USB_DEVICE(0x0cf3, 0xe300), .driver_info = BTUSB_QCA_ROME |
267 BTUSB_WIDEBAND_SPEECH },
268 { USB_DEVICE(0x0cf3, 0xe301), .driver_info = BTUSB_QCA_ROME |
269 BTUSB_WIDEBAND_SPEECH },
270 { USB_DEVICE(0x0cf3, 0xe360), .driver_info = BTUSB_QCA_ROME |
271 BTUSB_WIDEBAND_SPEECH },
272 { USB_DEVICE(0x0cf3, 0xe500), .driver_info = BTUSB_QCA_ROME |
273 BTUSB_WIDEBAND_SPEECH },
274 { USB_DEVICE(0x0489, 0xe092), .driver_info = BTUSB_QCA_ROME |
275 BTUSB_WIDEBAND_SPEECH },
276 { USB_DEVICE(0x0489, 0xe09f), .driver_info = BTUSB_QCA_ROME |
277 BTUSB_WIDEBAND_SPEECH },
278 { USB_DEVICE(0x0489, 0xe0a2), .driver_info = BTUSB_QCA_ROME |
279 BTUSB_WIDEBAND_SPEECH },
280 { USB_DEVICE(0x04ca, 0x3011), .driver_info = BTUSB_QCA_ROME |
281 BTUSB_WIDEBAND_SPEECH },
282 { USB_DEVICE(0x04ca, 0x3015), .driver_info = BTUSB_QCA_ROME |
283 BTUSB_WIDEBAND_SPEECH },
284 { USB_DEVICE(0x04ca, 0x3016), .driver_info = BTUSB_QCA_ROME |
285 BTUSB_WIDEBAND_SPEECH },
286 { USB_DEVICE(0x04ca, 0x301a), .driver_info = BTUSB_QCA_ROME |
287 BTUSB_WIDEBAND_SPEECH },
288 { USB_DEVICE(0x04ca, 0x3021), .driver_info = BTUSB_QCA_ROME |
289 BTUSB_WIDEBAND_SPEECH },
290 { USB_DEVICE(0x13d3, 0x3491), .driver_info = BTUSB_QCA_ROME |
291 BTUSB_WIDEBAND_SPEECH },
292 { USB_DEVICE(0x13d3, 0x3496), .driver_info = BTUSB_QCA_ROME |
293 BTUSB_WIDEBAND_SPEECH },
294 { USB_DEVICE(0x13d3, 0x3501), .driver_info = BTUSB_QCA_ROME |
295 BTUSB_WIDEBAND_SPEECH },
296
297 /* QCA WCN6855 chipset */
298 { USB_DEVICE(0x0cf3, 0xe600), .driver_info = BTUSB_QCA_WCN6855 |
299 BTUSB_WIDEBAND_SPEECH |
300 BTUSB_VALID_LE_STATES },
301 { USB_DEVICE(0x0489, 0xe0cc), .driver_info = BTUSB_QCA_WCN6855 |
302 BTUSB_WIDEBAND_SPEECH |
303 BTUSB_VALID_LE_STATES },
304 { USB_DEVICE(0x0489, 0xe0d6), .driver_info = BTUSB_QCA_WCN6855 |
305 BTUSB_WIDEBAND_SPEECH |
306 BTUSB_VALID_LE_STATES },
307 { USB_DEVICE(0x0489, 0xe0e3), .driver_info = BTUSB_QCA_WCN6855 |
308 BTUSB_WIDEBAND_SPEECH |
309 BTUSB_VALID_LE_STATES },
310 { USB_DEVICE(0x10ab, 0x9309), .driver_info = BTUSB_QCA_WCN6855 |
311 BTUSB_WIDEBAND_SPEECH |
312 BTUSB_VALID_LE_STATES },
313 { USB_DEVICE(0x10ab, 0x9409), .driver_info = BTUSB_QCA_WCN6855 |
314 BTUSB_WIDEBAND_SPEECH |
315 BTUSB_VALID_LE_STATES },
316 { USB_DEVICE(0x0489, 0xe0d0), .driver_info = BTUSB_QCA_WCN6855 |
317 BTUSB_WIDEBAND_SPEECH |
318 BTUSB_VALID_LE_STATES },
319
320 /* Broadcom BCM2035 */
321 { USB_DEVICE(0x0a5c, 0x2009), .driver_info = BTUSB_BCM92035 },
322 { USB_DEVICE(0x0a5c, 0x200a), .driver_info = BTUSB_WRONG_SCO_MTU },
323 { USB_DEVICE(0x0a5c, 0x2035), .driver_info = BTUSB_WRONG_SCO_MTU },
324
325 /* Broadcom BCM2045 */
326 { USB_DEVICE(0x0a5c, 0x2039), .driver_info = BTUSB_WRONG_SCO_MTU },
327 { USB_DEVICE(0x0a5c, 0x2101), .driver_info = BTUSB_WRONG_SCO_MTU },
328
329 /* IBM/Lenovo ThinkPad with Broadcom chip */
330 { USB_DEVICE(0x0a5c, 0x201e), .driver_info = BTUSB_WRONG_SCO_MTU },
331 { USB_DEVICE(0x0a5c, 0x2110), .driver_info = BTUSB_WRONG_SCO_MTU },
332
333 /* HP laptop with Broadcom chip */
334 { USB_DEVICE(0x03f0, 0x171d), .driver_info = BTUSB_WRONG_SCO_MTU },
335
336 /* Dell laptop with Broadcom chip */
337 { USB_DEVICE(0x413c, 0x8126), .driver_info = BTUSB_WRONG_SCO_MTU },
338
339 /* Dell Wireless 370 and 410 devices */
340 { USB_DEVICE(0x413c, 0x8152), .driver_info = BTUSB_WRONG_SCO_MTU },
341 { USB_DEVICE(0x413c, 0x8156), .driver_info = BTUSB_WRONG_SCO_MTU },
342
343 /* Belkin F8T012 and F8T013 devices */
344 { USB_DEVICE(0x050d, 0x0012), .driver_info = BTUSB_WRONG_SCO_MTU },
345 { USB_DEVICE(0x050d, 0x0013), .driver_info = BTUSB_WRONG_SCO_MTU },
346
347 /* Asus WL-BTD202 device */
348 { USB_DEVICE(0x0b05, 0x1715), .driver_info = BTUSB_WRONG_SCO_MTU },
349
350 /* Kensington Bluetooth USB adapter */
351 { USB_DEVICE(0x047d, 0x105e), .driver_info = BTUSB_WRONG_SCO_MTU },
352
353 /* RTX Telecom based adapters with buggy SCO support */
354 { USB_DEVICE(0x0400, 0x0807), .driver_info = BTUSB_BROKEN_ISOC },
355 { USB_DEVICE(0x0400, 0x080a), .driver_info = BTUSB_BROKEN_ISOC },
356
357 /* CONWISE Technology based adapters with buggy SCO support */
358 { USB_DEVICE(0x0e5e, 0x6622),
359 .driver_info = BTUSB_BROKEN_ISOC | BTUSB_CW6622},
360
361 /* Roper Class 1 Bluetooth Dongle (Silicon Wave based) */
362 { USB_DEVICE(0x1310, 0x0001), .driver_info = BTUSB_SWAVE },
363
364 /* Digianswer devices */
365 { USB_DEVICE(0x08fd, 0x0001), .driver_info = BTUSB_DIGIANSWER },
366 { USB_DEVICE(0x08fd, 0x0002), .driver_info = BTUSB_IGNORE },
367
368 /* CSR BlueCore Bluetooth Sniffer */
369 { USB_DEVICE(0x0a12, 0x0002),
370 .driver_info = BTUSB_SNIFFER | BTUSB_BROKEN_ISOC },
371
372 /* Frontline ComProbe Bluetooth Sniffer */
373 { USB_DEVICE(0x16d3, 0x0002),
374 .driver_info = BTUSB_SNIFFER | BTUSB_BROKEN_ISOC },
375
376 /* Marvell Bluetooth devices */
377 { USB_DEVICE(0x1286, 0x2044), .driver_info = BTUSB_MARVELL },
378 { USB_DEVICE(0x1286, 0x2046), .driver_info = BTUSB_MARVELL },
379 { USB_DEVICE(0x1286, 0x204e), .driver_info = BTUSB_MARVELL },
380
381 /* Intel Bluetooth devices */
382 { USB_DEVICE(0x8087, 0x0025), .driver_info = BTUSB_INTEL_COMBINED },
383 { USB_DEVICE(0x8087, 0x0026), .driver_info = BTUSB_INTEL_COMBINED },
384 { USB_DEVICE(0x8087, 0x0029), .driver_info = BTUSB_INTEL_COMBINED },
385 { USB_DEVICE(0x8087, 0x0032), .driver_info = BTUSB_INTEL_COMBINED },
386 { USB_DEVICE(0x8087, 0x0033), .driver_info = BTUSB_INTEL_COMBINED },
387 { USB_DEVICE(0x8087, 0x07da), .driver_info = BTUSB_CSR },
388 { USB_DEVICE(0x8087, 0x07dc), .driver_info = BTUSB_INTEL_COMBINED |
389 BTUSB_INTEL_NO_WBS_SUPPORT |
390 BTUSB_INTEL_BROKEN_INITIAL_NCMD |
391 BTUSB_INTEL_BROKEN_SHUTDOWN_LED },
392 { USB_DEVICE(0x8087, 0x0a2a), .driver_info = BTUSB_INTEL_COMBINED |
393 BTUSB_INTEL_NO_WBS_SUPPORT |
394 BTUSB_INTEL_BROKEN_SHUTDOWN_LED },
395 { USB_DEVICE(0x8087, 0x0a2b), .driver_info = BTUSB_INTEL_COMBINED },
396 { USB_DEVICE(0x8087, 0x0aa7), .driver_info = BTUSB_INTEL_COMBINED |
397 BTUSB_INTEL_BROKEN_SHUTDOWN_LED },
398 { USB_DEVICE(0x8087, 0x0aaa), .driver_info = BTUSB_INTEL_COMBINED },
399
400 /* Other Intel Bluetooth devices */
401 { USB_VENDOR_AND_INTERFACE_INFO(0x8087, 0xe0, 0x01, 0x01),
402 .driver_info = BTUSB_IGNORE },
403
404 /* Realtek 8822CE Bluetooth devices */
405 { USB_DEVICE(0x0bda, 0xb00c), .driver_info = BTUSB_REALTEK |
406 BTUSB_WIDEBAND_SPEECH },
407 { USB_DEVICE(0x0bda, 0xc822), .driver_info = BTUSB_REALTEK |
408 BTUSB_WIDEBAND_SPEECH },
409
410 /* Realtek 8852AE Bluetooth devices */
411 { USB_DEVICE(0x0bda, 0x2852), .driver_info = BTUSB_REALTEK |
412 BTUSB_WIDEBAND_SPEECH },
413 { USB_DEVICE(0x0bda, 0xc852), .driver_info = BTUSB_REALTEK |
414 BTUSB_WIDEBAND_SPEECH },
415 { USB_DEVICE(0x0bda, 0x385a), .driver_info = BTUSB_REALTEK |
416 BTUSB_WIDEBAND_SPEECH },
417 { USB_DEVICE(0x0bda, 0x4852), .driver_info = BTUSB_REALTEK |
418 BTUSB_WIDEBAND_SPEECH },
419 { USB_DEVICE(0x04c5, 0x165c), .driver_info = BTUSB_REALTEK |
420 BTUSB_WIDEBAND_SPEECH },
421 { USB_DEVICE(0x04ca, 0x4006), .driver_info = BTUSB_REALTEK |
422 BTUSB_WIDEBAND_SPEECH },
423
424 /* Realtek 8852CE Bluetooth devices */
425 { USB_DEVICE(0x04ca, 0x4007), .driver_info = BTUSB_REALTEK |
426 BTUSB_WIDEBAND_SPEECH },
427 { USB_DEVICE(0x04c5, 0x1675), .driver_info = BTUSB_REALTEK |
428 BTUSB_WIDEBAND_SPEECH },
429
430 /* Realtek Bluetooth devices */
431 { USB_VENDOR_AND_INTERFACE_INFO(0x0bda, 0xe0, 0x01, 0x01),
432 .driver_info = BTUSB_REALTEK },
433
434 /* MediaTek Bluetooth devices */
435 { USB_VENDOR_AND_INTERFACE_INFO(0x0e8d, 0xe0, 0x01, 0x01),
436 .driver_info = BTUSB_MEDIATEK |
437 BTUSB_WIDEBAND_SPEECH |
438 BTUSB_VALID_LE_STATES },
439
440 /* Additional MediaTek MT7615E Bluetooth devices */
441 { USB_DEVICE(0x13d3, 0x3560), .driver_info = BTUSB_MEDIATEK},
442
443 /* Additional MediaTek MT7668 Bluetooth devices */
444 { USB_DEVICE(0x043e, 0x3109), .driver_info = BTUSB_MEDIATEK |
445 BTUSB_WIDEBAND_SPEECH |
446 BTUSB_VALID_LE_STATES },
447
448 /* Additional MediaTek MT7921 Bluetooth devices */
449 { USB_DEVICE(0x0489, 0xe0c8), .driver_info = BTUSB_MEDIATEK |
450 BTUSB_WIDEBAND_SPEECH |
451 BTUSB_VALID_LE_STATES },
452 { USB_DEVICE(0x0489, 0xe0cd), .driver_info = BTUSB_MEDIATEK |
453 BTUSB_WIDEBAND_SPEECH |
454 BTUSB_VALID_LE_STATES },
455 { USB_DEVICE(0x04ca, 0x3802), .driver_info = BTUSB_MEDIATEK |
456 BTUSB_WIDEBAND_SPEECH |
457 BTUSB_VALID_LE_STATES },
458 { USB_DEVICE(0x13d3, 0x3563), .driver_info = BTUSB_MEDIATEK |
459 BTUSB_WIDEBAND_SPEECH |
460 BTUSB_VALID_LE_STATES },
461 { USB_DEVICE(0x13d3, 0x3564), .driver_info = BTUSB_MEDIATEK |
462 BTUSB_WIDEBAND_SPEECH |
463 BTUSB_VALID_LE_STATES },
464 { USB_DEVICE(0x13d3, 0x3567), .driver_info = BTUSB_MEDIATEK |
465 BTUSB_WIDEBAND_SPEECH |
466 BTUSB_VALID_LE_STATES },
467 { USB_DEVICE(0x0489, 0xe0cd), .driver_info = BTUSB_MEDIATEK |
468 BTUSB_WIDEBAND_SPEECH |
469 BTUSB_VALID_LE_STATES },
470
471 /* MediaTek MT7922A Bluetooth devices */
472 { USB_DEVICE(0x0489, 0xe0d8), .driver_info = BTUSB_MEDIATEK |
473 BTUSB_WIDEBAND_SPEECH |
474 BTUSB_VALID_LE_STATES },
475 { USB_DEVICE(0x0489, 0xe0d9), .driver_info = BTUSB_MEDIATEK |
476 BTUSB_WIDEBAND_SPEECH |
477 BTUSB_VALID_LE_STATES },
478 { USB_DEVICE(0x13d3, 0x3568), .driver_info = BTUSB_MEDIATEK |
479 BTUSB_WIDEBAND_SPEECH |
480 BTUSB_VALID_LE_STATES },
481
482 /* Additional Realtek 8723AE Bluetooth devices */
483 { USB_DEVICE(0x0930, 0x021d), .driver_info = BTUSB_REALTEK },
484 { USB_DEVICE(0x13d3, 0x3394), .driver_info = BTUSB_REALTEK },
485
486 /* Additional Realtek 8723BE Bluetooth devices */
487 { USB_DEVICE(0x0489, 0xe085), .driver_info = BTUSB_REALTEK },
488 { USB_DEVICE(0x0489, 0xe08b), .driver_info = BTUSB_REALTEK },
489 { USB_DEVICE(0x13d3, 0x3410), .driver_info = BTUSB_REALTEK },
490 { USB_DEVICE(0x13d3, 0x3416), .driver_info = BTUSB_REALTEK },
491 { USB_DEVICE(0x13d3, 0x3459), .driver_info = BTUSB_REALTEK },
492 { USB_DEVICE(0x13d3, 0x3494), .driver_info = BTUSB_REALTEK },
493
494 /* Additional Realtek 8723BU Bluetooth devices */
495 { USB_DEVICE(0x7392, 0xa611), .driver_info = BTUSB_REALTEK },
496
497 /* Additional Realtek 8723DE Bluetooth devices */
498 { USB_DEVICE(0x0bda, 0xb009), .driver_info = BTUSB_REALTEK },
499 { USB_DEVICE(0x2ff8, 0xb011), .driver_info = BTUSB_REALTEK },
500
501 /* Additional Realtek 8761B Bluetooth devices */
502 { USB_DEVICE(0x2357, 0x0604), .driver_info = BTUSB_REALTEK |
503 BTUSB_WIDEBAND_SPEECH },
504
505 /* Additional Realtek 8761BU Bluetooth devices */
506 { USB_DEVICE(0x0b05, 0x190e), .driver_info = BTUSB_REALTEK |
507 BTUSB_WIDEBAND_SPEECH },
508 { USB_DEVICE(0x2550, 0x8761), .driver_info = BTUSB_REALTEK |
509 BTUSB_WIDEBAND_SPEECH },
510
511 /* Additional Realtek 8821AE Bluetooth devices */
512 { USB_DEVICE(0x0b05, 0x17dc), .driver_info = BTUSB_REALTEK },
513 { USB_DEVICE(0x13d3, 0x3414), .driver_info = BTUSB_REALTEK },
514 { USB_DEVICE(0x13d3, 0x3458), .driver_info = BTUSB_REALTEK },
515 { USB_DEVICE(0x13d3, 0x3461), .driver_info = BTUSB_REALTEK },
516 { USB_DEVICE(0x13d3, 0x3462), .driver_info = BTUSB_REALTEK },
517
518 /* Additional Realtek 8822BE Bluetooth devices */
519 { USB_DEVICE(0x13d3, 0x3526), .driver_info = BTUSB_REALTEK },
520 { USB_DEVICE(0x0b05, 0x185c), .driver_info = BTUSB_REALTEK },
521
522 /* Additional Realtek 8822CE Bluetooth devices */
523 { USB_DEVICE(0x04ca, 0x4005), .driver_info = BTUSB_REALTEK |
524 BTUSB_WIDEBAND_SPEECH },
525 { USB_DEVICE(0x04c5, 0x161f), .driver_info = BTUSB_REALTEK |
526 BTUSB_WIDEBAND_SPEECH },
527 { USB_DEVICE(0x0b05, 0x18ef), .driver_info = BTUSB_REALTEK |
528 BTUSB_WIDEBAND_SPEECH },
529 { USB_DEVICE(0x13d3, 0x3548), .driver_info = BTUSB_REALTEK |
530 BTUSB_WIDEBAND_SPEECH },
531 { USB_DEVICE(0x13d3, 0x3549), .driver_info = BTUSB_REALTEK |
532 BTUSB_WIDEBAND_SPEECH },
533 { USB_DEVICE(0x13d3, 0x3553), .driver_info = BTUSB_REALTEK |
534 BTUSB_WIDEBAND_SPEECH },
535 { USB_DEVICE(0x13d3, 0x3555), .driver_info = BTUSB_REALTEK |
536 BTUSB_WIDEBAND_SPEECH },
537 { USB_DEVICE(0x2ff8, 0x3051), .driver_info = BTUSB_REALTEK |
538 BTUSB_WIDEBAND_SPEECH },
539 { USB_DEVICE(0x1358, 0xc123), .driver_info = BTUSB_REALTEK |
540 BTUSB_WIDEBAND_SPEECH },
541 { USB_DEVICE(0x0bda, 0xc123), .driver_info = BTUSB_REALTEK |
542 BTUSB_WIDEBAND_SPEECH },
543 { USB_DEVICE(0x0cb5, 0xc547), .driver_info = BTUSB_REALTEK |
544 BTUSB_WIDEBAND_SPEECH },
545
546 /* Silicon Wave based devices */
547 { USB_DEVICE(0x0c10, 0x0000), .driver_info = BTUSB_SWAVE },
548
549 { } /* Terminating entry */
550 };
551
552 /* The Bluetooth USB module build into some devices needs to be reset on resume,
553 * this is a problem with the platform (likely shutting off all power) not with
554 * the module itself. So we use a DMI list to match known broken platforms.
555 */
556 static const struct dmi_system_id btusb_needs_reset_resume_table[] = {
557 {
558 /* Dell OptiPlex 3060 (QCA ROME device 0cf3:e007) */
559 .matches = {
560 DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."),
561 DMI_MATCH(DMI_PRODUCT_NAME, "OptiPlex 3060"),
562 },
563 },
564 {
565 /* Dell XPS 9360 (QCA ROME device 0cf3:e300) */
566 .matches = {
567 DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."),
568 DMI_MATCH(DMI_PRODUCT_NAME, "XPS 13 9360"),
569 },
570 },
571 {
572 /* Dell Inspiron 5565 (QCA ROME device 0cf3:e009) */
573 .matches = {
574 DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."),
575 DMI_MATCH(DMI_PRODUCT_NAME, "Inspiron 5565"),
576 },
577 },
578 {}
579 };
580
581 #define BTUSB_MAX_ISOC_FRAMES 10
582
583 #define BTUSB_INTR_RUNNING 0
584 #define BTUSB_BULK_RUNNING 1
585 #define BTUSB_ISOC_RUNNING 2
586 #define BTUSB_SUSPENDING 3
587 #define BTUSB_DID_ISO_RESUME 4
588 #define BTUSB_BOOTLOADER 5
589 #define BTUSB_DOWNLOADING 6
590 #define BTUSB_FIRMWARE_LOADED 7
591 #define BTUSB_FIRMWARE_FAILED 8
592 #define BTUSB_BOOTING 9
593 #define BTUSB_DIAG_RUNNING 10
594 #define BTUSB_OOB_WAKE_ENABLED 11
595 #define BTUSB_HW_RESET_ACTIVE 12
596 #define BTUSB_TX_WAIT_VND_EVT 13
597 #define BTUSB_WAKEUP_AUTOSUSPEND 14
598 #define BTUSB_USE_ALT3_FOR_WBS 15
599
600 struct btusb_data {
601 struct hci_dev *hdev;
602 struct usb_device *udev;
603 struct usb_interface *intf;
604 struct usb_interface *isoc;
605 struct usb_interface *diag;
606 unsigned isoc_ifnum;
607
608 unsigned long flags;
609
610 struct work_struct work;
611 struct work_struct waker;
612
613 struct usb_anchor deferred;
614 struct usb_anchor tx_anchor;
615 int tx_in_flight;
616 spinlock_t txlock;
617
618 struct usb_anchor intr_anchor;
619 struct usb_anchor bulk_anchor;
620 struct usb_anchor isoc_anchor;
621 struct usb_anchor diag_anchor;
622 struct usb_anchor ctrl_anchor;
623 spinlock_t rxlock;
624
625 struct sk_buff *evt_skb;
626 struct sk_buff *acl_skb;
627 struct sk_buff *sco_skb;
628
629 struct usb_endpoint_descriptor *intr_ep;
630 struct usb_endpoint_descriptor *bulk_tx_ep;
631 struct usb_endpoint_descriptor *bulk_rx_ep;
632 struct usb_endpoint_descriptor *isoc_tx_ep;
633 struct usb_endpoint_descriptor *isoc_rx_ep;
634 struct usb_endpoint_descriptor *diag_tx_ep;
635 struct usb_endpoint_descriptor *diag_rx_ep;
636
637 struct gpio_desc *reset_gpio;
638
639 __u8 cmdreq_type;
640 __u8 cmdreq;
641
642 unsigned int sco_num;
643 unsigned int air_mode;
644 bool usb_alt6_packet_flow;
645 int isoc_altsetting;
646 int suspend_count;
647
648 int (*recv_event)(struct hci_dev *hdev, struct sk_buff *skb);
649 int (*recv_acl)(struct hci_dev *hdev, struct sk_buff *skb);
650 int (*recv_bulk)(struct btusb_data *data, void *buffer, int count);
651
652 int (*setup_on_usb)(struct hci_dev *hdev);
653
654 int oob_wake_irq; /* irq for out-of-band wake-on-bt */
655 unsigned cmd_timeout_cnt;
656 };
657
658 static void btusb_intel_cmd_timeout(struct hci_dev *hdev)
659 {
660 struct btusb_data *data = hci_get_drvdata(hdev);
661 struct gpio_desc *reset_gpio = data->reset_gpio;
662
663 if (++data->cmd_timeout_cnt < 5)
664 return;
665
666 if (!reset_gpio) {
667 bt_dev_err(hdev, "No way to reset. Ignoring and continuing");
668 return;
669 }
670
671 /*
672 * Toggle the hard reset line if the platform provides one. The reset
673 * is going to yank the device off the USB and then replug. So doing
674 * once is enough. The cleanup is handled correctly on the way out
675 * (standard USB disconnect), and the new device is detected cleanly
676 * and bound to the driver again like it should be.
677 */
678 if (test_and_set_bit(BTUSB_HW_RESET_ACTIVE, &data->flags)) {
679 bt_dev_err(hdev, "last reset failed? Not resetting again");
680 return;
681 }
682
683 bt_dev_err(hdev, "Initiating HW reset via gpio");
684 gpiod_set_value_cansleep(reset_gpio, 1);
685 msleep(100);
686 gpiod_set_value_cansleep(reset_gpio, 0);
687 }
688
689 static void btusb_rtl_cmd_timeout(struct hci_dev *hdev)
690 {
691 struct btusb_data *data = hci_get_drvdata(hdev);
692 struct gpio_desc *reset_gpio = data->reset_gpio;
693
694 if (++data->cmd_timeout_cnt < 5)
695 return;
696
697 if (!reset_gpio) {
698 bt_dev_err(hdev, "No gpio to reset Realtek device, ignoring");
699 return;
700 }
701
702 /* Toggle the hard reset line. The Realtek device is going to
703 * yank itself off the USB and then replug. The cleanup is handled
704 * correctly on the way out (standard USB disconnect), and the new
705 * device is detected cleanly and bound to the driver again like
706 * it should be.
707 */
708 if (test_and_set_bit(BTUSB_HW_RESET_ACTIVE, &data->flags)) {
709 bt_dev_err(hdev, "last reset failed? Not resetting again");
710 return;
711 }
712
713 bt_dev_err(hdev, "Reset Realtek device via gpio");
714 gpiod_set_value_cansleep(reset_gpio, 1);
715 msleep(200);
716 gpiod_set_value_cansleep(reset_gpio, 0);
717 }
718
719 static void btusb_qca_cmd_timeout(struct hci_dev *hdev)
720 {
721 struct btusb_data *data = hci_get_drvdata(hdev);
722 int err;
723
724 if (++data->cmd_timeout_cnt < 5)
725 return;
726
727 bt_dev_err(hdev, "Multiple cmd timeouts seen. Resetting usb device.");
728 /* This is not an unbalanced PM reference since the device will reset */
729 err = usb_autopm_get_interface(data->intf);
730 if (!err)
731 usb_queue_reset_device(data->intf);
732 else
733 bt_dev_err(hdev, "Failed usb_autopm_get_interface with %d", err);
734 }
735
736 static inline void btusb_free_frags(struct btusb_data *data)
737 {
738 unsigned long flags;
739
740 spin_lock_irqsave(&data->rxlock, flags);
741
742 kfree_skb(data->evt_skb);
743 data->evt_skb = NULL;
744
745 kfree_skb(data->acl_skb);
746 data->acl_skb = NULL;
747
748 kfree_skb(data->sco_skb);
749 data->sco_skb = NULL;
750
751 spin_unlock_irqrestore(&data->rxlock, flags);
752 }
753
754 static int btusb_recv_intr(struct btusb_data *data, void *buffer, int count)
755 {
756 struct sk_buff *skb;
757 unsigned long flags;
758 int err = 0;
759
760 spin_lock_irqsave(&data->rxlock, flags);
761 skb = data->evt_skb;
762
763 while (count) {
764 int len;
765
766 if (!skb) {
767 skb = bt_skb_alloc(HCI_MAX_EVENT_SIZE, GFP_ATOMIC);
768 if (!skb) {
769 err = -ENOMEM;
770 break;
771 }
772
773 hci_skb_pkt_type(skb) = HCI_EVENT_PKT;
774 hci_skb_expect(skb) = HCI_EVENT_HDR_SIZE;
775 }
776
777 len = min_t(uint, hci_skb_expect(skb), count);
778 skb_put_data(skb, buffer, len);
779
780 count -= len;
781 buffer += len;
782 hci_skb_expect(skb) -= len;
783
784 if (skb->len == HCI_EVENT_HDR_SIZE) {
785 /* Complete event header */
786 hci_skb_expect(skb) = hci_event_hdr(skb)->plen;
787
788 if (skb_tailroom(skb) < hci_skb_expect(skb)) {
789 kfree_skb(skb);
790 skb = NULL;
791
792 err = -EILSEQ;
793 break;
794 }
795 }
796
797 if (!hci_skb_expect(skb)) {
798 /* Complete frame */
799 data->recv_event(data->hdev, skb);
800 skb = NULL;
801 }
802 }
803
804 data->evt_skb = skb;
805 spin_unlock_irqrestore(&data->rxlock, flags);
806
807 return err;
808 }
809
810 static int btusb_recv_bulk(struct btusb_data *data, void *buffer, int count)
811 {
812 struct sk_buff *skb;
813 unsigned long flags;
814 int err = 0;
815
816 spin_lock_irqsave(&data->rxlock, flags);
817 skb = data->acl_skb;
818
819 while (count) {
820 int len;
821
822 if (!skb) {
823 skb = bt_skb_alloc(HCI_MAX_FRAME_SIZE, GFP_ATOMIC);
824 if (!skb) {
825 err = -ENOMEM;
826 break;
827 }
828
829 hci_skb_pkt_type(skb) = HCI_ACLDATA_PKT;
830 hci_skb_expect(skb) = HCI_ACL_HDR_SIZE;
831 }
832
833 len = min_t(uint, hci_skb_expect(skb), count);
834 skb_put_data(skb, buffer, len);
835
836 count -= len;
837 buffer += len;
838 hci_skb_expect(skb) -= len;
839
840 if (skb->len == HCI_ACL_HDR_SIZE) {
841 __le16 dlen = hci_acl_hdr(skb)->dlen;
842
843 /* Complete ACL header */
844 hci_skb_expect(skb) = __le16_to_cpu(dlen);
845
846 if (skb_tailroom(skb) < hci_skb_expect(skb)) {
847 kfree_skb(skb);
848 skb = NULL;
849
850 err = -EILSEQ;
851 break;
852 }
853 }
854
855 if (!hci_skb_expect(skb)) {
856 /* Complete frame */
857 data->recv_acl(data->hdev, skb);
858 skb = NULL;
859 }
860 }
861
862 data->acl_skb = skb;
863 spin_unlock_irqrestore(&data->rxlock, flags);
864
865 return err;
866 }
867
868 static int btusb_recv_isoc(struct btusb_data *data, void *buffer, int count)
869 {
870 struct sk_buff *skb;
871 unsigned long flags;
872 int err = 0;
873
874 spin_lock_irqsave(&data->rxlock, flags);
875 skb = data->sco_skb;
876
877 while (count) {
878 int len;
879
880 if (!skb) {
881 skb = bt_skb_alloc(HCI_MAX_SCO_SIZE, GFP_ATOMIC);
882 if (!skb) {
883 err = -ENOMEM;
884 break;
885 }
886
887 hci_skb_pkt_type(skb) = HCI_SCODATA_PKT;
888 hci_skb_expect(skb) = HCI_SCO_HDR_SIZE;
889 }
890
891 len = min_t(uint, hci_skb_expect(skb), count);
892 skb_put_data(skb, buffer, len);
893
894 count -= len;
895 buffer += len;
896 hci_skb_expect(skb) -= len;
897
898 if (skb->len == HCI_SCO_HDR_SIZE) {
899 /* Complete SCO header */
900 hci_skb_expect(skb) = hci_sco_hdr(skb)->dlen;
901
902 if (skb_tailroom(skb) < hci_skb_expect(skb)) {
903 kfree_skb(skb);
904 skb = NULL;
905
906 err = -EILSEQ;
907 break;
908 }
909 }
910
911 if (!hci_skb_expect(skb)) {
912 /* Complete frame */
913 hci_recv_frame(data->hdev, skb);
914 skb = NULL;
915 }
916 }
917
918 data->sco_skb = skb;
919 spin_unlock_irqrestore(&data->rxlock, flags);
920
921 return err;
922 }
923
924 static void btusb_intr_complete(struct urb *urb)
925 {
926 struct hci_dev *hdev = urb->context;
927 struct btusb_data *data = hci_get_drvdata(hdev);
928 int err;
929
930 BT_DBG("%s urb %p status %d count %d", hdev->name, urb, urb->status,
931 urb->actual_length);
932
933 if (!test_bit(HCI_RUNNING, &hdev->flags))
934 return;
935
936 if (urb->status == 0) {
937 hdev->stat.byte_rx += urb->actual_length;
938
939 if (btusb_recv_intr(data, urb->transfer_buffer,
940 urb->actual_length) < 0) {
941 bt_dev_err(hdev, "corrupted event packet");
942 hdev->stat.err_rx++;
943 }
944 } else if (urb->status == -ENOENT) {
945 /* Avoid suspend failed when usb_kill_urb */
946 return;
947 }
948
949 if (!test_bit(BTUSB_INTR_RUNNING, &data->flags))
950 return;
951
952 usb_mark_last_busy(data->udev);
953 usb_anchor_urb(urb, &data->intr_anchor);
954
955 err = usb_submit_urb(urb, GFP_ATOMIC);
956 if (err < 0) {
957 /* -EPERM: urb is being killed;
958 * -ENODEV: device got disconnected
959 */
960 if (err != -EPERM && err != -ENODEV)
961 bt_dev_err(hdev, "urb %p failed to resubmit (%d)",
962 urb, -err);
963 usb_unanchor_urb(urb);
964 }
965 }
966
967 static int btusb_submit_intr_urb(struct hci_dev *hdev, gfp_t mem_flags)
968 {
969 struct btusb_data *data = hci_get_drvdata(hdev);
970 struct urb *urb;
971 unsigned char *buf;
972 unsigned int pipe;
973 int err, size;
974
975 BT_DBG("%s", hdev->name);
976
977 if (!data->intr_ep)
978 return -ENODEV;
979
980 urb = usb_alloc_urb(0, mem_flags);
981 if (!urb)
982 return -ENOMEM;
983
984 size = le16_to_cpu(data->intr_ep->wMaxPacketSize);
985
986 buf = kmalloc(size, mem_flags);
987 if (!buf) {
988 usb_free_urb(urb);
989 return -ENOMEM;
990 }
991
992 pipe = usb_rcvintpipe(data->udev, data->intr_ep->bEndpointAddress);
993
994 usb_fill_int_urb(urb, data->udev, pipe, buf, size,
995 btusb_intr_complete, hdev, data->intr_ep->bInterval);
996
997 urb->transfer_flags |= URB_FREE_BUFFER;
998
999 usb_anchor_urb(urb, &data->intr_anchor);
1000
1001 err = usb_submit_urb(urb, mem_flags);
1002 if (err < 0) {
1003 if (err != -EPERM && err != -ENODEV)
1004 bt_dev_err(hdev, "urb %p submission failed (%d)",
1005 urb, -err);
1006 usb_unanchor_urb(urb);
1007 }
1008
1009 usb_free_urb(urb);
1010
1011 return err;
1012 }
1013
1014 static void btusb_bulk_complete(struct urb *urb)
1015 {
1016 struct hci_dev *hdev = urb->context;
1017 struct btusb_data *data = hci_get_drvdata(hdev);
1018 int err;
1019
1020 BT_DBG("%s urb %p status %d count %d", hdev->name, urb, urb->status,
1021 urb->actual_length);
1022
1023 if (!test_bit(HCI_RUNNING, &hdev->flags))
1024 return;
1025
1026 if (urb->status == 0) {
1027 hdev->stat.byte_rx += urb->actual_length;
1028
1029 if (data->recv_bulk(data, urb->transfer_buffer,
1030 urb->actual_length) < 0) {
1031 bt_dev_err(hdev, "corrupted ACL packet");
1032 hdev->stat.err_rx++;
1033 }
1034 } else if (urb->status == -ENOENT) {
1035 /* Avoid suspend failed when usb_kill_urb */
1036 return;
1037 }
1038
1039 if (!test_bit(BTUSB_BULK_RUNNING, &data->flags))
1040 return;
1041
1042 usb_anchor_urb(urb, &data->bulk_anchor);
1043 usb_mark_last_busy(data->udev);
1044
1045 err = usb_submit_urb(urb, GFP_ATOMIC);
1046 if (err < 0) {
1047 /* -EPERM: urb is being killed;
1048 * -ENODEV: device got disconnected
1049 */
1050 if (err != -EPERM && err != -ENODEV)
1051 bt_dev_err(hdev, "urb %p failed to resubmit (%d)",
1052 urb, -err);
1053 usb_unanchor_urb(urb);
1054 }
1055 }
1056
1057 static int btusb_submit_bulk_urb(struct hci_dev *hdev, gfp_t mem_flags)
1058 {
1059 struct btusb_data *data = hci_get_drvdata(hdev);
1060 struct urb *urb;
1061 unsigned char *buf;
1062 unsigned int pipe;
1063 int err, size = HCI_MAX_FRAME_SIZE;
1064
1065 BT_DBG("%s", hdev->name);
1066
1067 if (!data->bulk_rx_ep)
1068 return -ENODEV;
1069
1070 urb = usb_alloc_urb(0, mem_flags);
1071 if (!urb)
1072 return -ENOMEM;
1073
1074 buf = kmalloc(size, mem_flags);
1075 if (!buf) {
1076 usb_free_urb(urb);
1077 return -ENOMEM;
1078 }
1079
1080 pipe = usb_rcvbulkpipe(data->udev, data->bulk_rx_ep->bEndpointAddress);
1081
1082 usb_fill_bulk_urb(urb, data->udev, pipe, buf, size,
1083 btusb_bulk_complete, hdev);
1084
1085 urb->transfer_flags |= URB_FREE_BUFFER;
1086
1087 usb_mark_last_busy(data->udev);
1088 usb_anchor_urb(urb, &data->bulk_anchor);
1089
1090 err = usb_submit_urb(urb, mem_flags);
1091 if (err < 0) {
1092 if (err != -EPERM && err != -ENODEV)
1093 bt_dev_err(hdev, "urb %p submission failed (%d)",
1094 urb, -err);
1095 usb_unanchor_urb(urb);
1096 }
1097
1098 usb_free_urb(urb);
1099
1100 return err;
1101 }
1102
1103 static void btusb_isoc_complete(struct urb *urb)
1104 {
1105 struct hci_dev *hdev = urb->context;
1106 struct btusb_data *data = hci_get_drvdata(hdev);
1107 int i, err;
1108
1109 BT_DBG("%s urb %p status %d count %d", hdev->name, urb, urb->status,
1110 urb->actual_length);
1111
1112 if (!test_bit(HCI_RUNNING, &hdev->flags))
1113 return;
1114
1115 if (urb->status == 0) {
1116 for (i = 0; i < urb->number_of_packets; i++) {
1117 unsigned int offset = urb->iso_frame_desc[i].offset;
1118 unsigned int length = urb->iso_frame_desc[i].actual_length;
1119
1120 if (urb->iso_frame_desc[i].status)
1121 continue;
1122
1123 hdev->stat.byte_rx += length;
1124
1125 if (btusb_recv_isoc(data, urb->transfer_buffer + offset,
1126 length) < 0) {
1127 bt_dev_err(hdev, "corrupted SCO packet");
1128 hdev->stat.err_rx++;
1129 }
1130 }
1131 } else if (urb->status == -ENOENT) {
1132 /* Avoid suspend failed when usb_kill_urb */
1133 return;
1134 }
1135
1136 if (!test_bit(BTUSB_ISOC_RUNNING, &data->flags))
1137 return;
1138
1139 usb_anchor_urb(urb, &data->isoc_anchor);
1140
1141 err = usb_submit_urb(urb, GFP_ATOMIC);
1142 if (err < 0) {
1143 /* -EPERM: urb is being killed;
1144 * -ENODEV: device got disconnected
1145 */
1146 if (err != -EPERM && err != -ENODEV)
1147 bt_dev_err(hdev, "urb %p failed to resubmit (%d)",
1148 urb, -err);
1149 usb_unanchor_urb(urb);
1150 }
1151 }
1152
1153 static inline void __fill_isoc_descriptor_msbc(struct urb *urb, int len,
1154 int mtu, struct btusb_data *data)
1155 {
1156 int i, offset = 0;
1157 unsigned int interval;
1158
1159 BT_DBG("len %d mtu %d", len, mtu);
1160
1161 /* For mSBC ALT 6 setting the host will send the packet at continuous
1162 * flow. As per core spec 5, vol 4, part B, table 2.1. For ALT setting
1163 * 6 the HCI PACKET INTERVAL should be 7.5ms for every usb packets.
1164 * To maintain the rate we send 63bytes of usb packets alternatively for
1165 * 7ms and 8ms to maintain the rate as 7.5ms.
1166 */
1167 if (data->usb_alt6_packet_flow) {
1168 interval = 7;
1169 data->usb_alt6_packet_flow = false;
1170 } else {
1171 interval = 6;
1172 data->usb_alt6_packet_flow = true;
1173 }
1174
1175 for (i = 0; i < interval; i++) {
1176 urb->iso_frame_desc[i].offset = offset;
1177 urb->iso_frame_desc[i].length = offset;
1178 }
1179
1180 if (len && i < BTUSB_MAX_ISOC_FRAMES) {
1181 urb->iso_frame_desc[i].offset = offset;
1182 urb->iso_frame_desc[i].length = len;
1183 i++;
1184 }
1185
1186 urb->number_of_packets = i;
1187 }
1188
1189 static inline void __fill_isoc_descriptor(struct urb *urb, int len, int mtu)
1190 {
1191 int i, offset = 0;
1192
1193 BT_DBG("len %d mtu %d", len, mtu);
1194
1195 for (i = 0; i < BTUSB_MAX_ISOC_FRAMES && len >= mtu;
1196 i++, offset += mtu, len -= mtu) {
1197 urb->iso_frame_desc[i].offset = offset;
1198 urb->iso_frame_desc[i].length = mtu;
1199 }
1200
1201 if (len && i < BTUSB_MAX_ISOC_FRAMES) {
1202 urb->iso_frame_desc[i].offset = offset;
1203 urb->iso_frame_desc[i].length = len;
1204 i++;
1205 }
1206
1207 urb->number_of_packets = i;
1208 }
1209
1210 static int btusb_submit_isoc_urb(struct hci_dev *hdev, gfp_t mem_flags)
1211 {
1212 struct btusb_data *data = hci_get_drvdata(hdev);
1213 struct urb *urb;
1214 unsigned char *buf;
1215 unsigned int pipe;
1216 int err, size;
1217
1218 BT_DBG("%s", hdev->name);
1219
1220 if (!data->isoc_rx_ep)
1221 return -ENODEV;
1222
1223 urb = usb_alloc_urb(BTUSB_MAX_ISOC_FRAMES, mem_flags);
1224 if (!urb)
1225 return -ENOMEM;
1226
1227 size = le16_to_cpu(data->isoc_rx_ep->wMaxPacketSize) *
1228 BTUSB_MAX_ISOC_FRAMES;
1229
1230 buf = kmalloc(size, mem_flags);
1231 if (!buf) {
1232 usb_free_urb(urb);
1233 return -ENOMEM;
1234 }
1235
1236 pipe = usb_rcvisocpipe(data->udev, data->isoc_rx_ep->bEndpointAddress);
1237
1238 usb_fill_int_urb(urb, data->udev, pipe, buf, size, btusb_isoc_complete,
1239 hdev, data->isoc_rx_ep->bInterval);
1240
1241 urb->transfer_flags = URB_FREE_BUFFER | URB_ISO_ASAP;
1242
1243 __fill_isoc_descriptor(urb, size,
1244 le16_to_cpu(data->isoc_rx_ep->wMaxPacketSize));
1245
1246 usb_anchor_urb(urb, &data->isoc_anchor);
1247
1248 err = usb_submit_urb(urb, mem_flags);
1249 if (err < 0) {
1250 if (err != -EPERM && err != -ENODEV)
1251 bt_dev_err(hdev, "urb %p submission failed (%d)",
1252 urb, -err);
1253 usb_unanchor_urb(urb);
1254 }
1255
1256 usb_free_urb(urb);
1257
1258 return err;
1259 }
1260
1261 static void btusb_diag_complete(struct urb *urb)
1262 {
1263 struct hci_dev *hdev = urb->context;
1264 struct btusb_data *data = hci_get_drvdata(hdev);
1265 int err;
1266
1267 BT_DBG("%s urb %p status %d count %d", hdev->name, urb, urb->status,
1268 urb->actual_length);
1269
1270 if (urb->status == 0) {
1271 struct sk_buff *skb;
1272
1273 skb = bt_skb_alloc(urb->actual_length, GFP_ATOMIC);
1274 if (skb) {
1275 skb_put_data(skb, urb->transfer_buffer,
1276 urb->actual_length);
1277 hci_recv_diag(hdev, skb);
1278 }
1279 } else if (urb->status == -ENOENT) {
1280 /* Avoid suspend failed when usb_kill_urb */
1281 return;
1282 }
1283
1284 if (!test_bit(BTUSB_DIAG_RUNNING, &data->flags))
1285 return;
1286
1287 usb_anchor_urb(urb, &data->diag_anchor);
1288 usb_mark_last_busy(data->udev);
1289
1290 err = usb_submit_urb(urb, GFP_ATOMIC);
1291 if (err < 0) {
1292 /* -EPERM: urb is being killed;
1293 * -ENODEV: device got disconnected
1294 */
1295 if (err != -EPERM && err != -ENODEV)
1296 bt_dev_err(hdev, "urb %p failed to resubmit (%d)",
1297 urb, -err);
1298 usb_unanchor_urb(urb);
1299 }
1300 }
1301
1302 static int btusb_submit_diag_urb(struct hci_dev *hdev, gfp_t mem_flags)
1303 {
1304 struct btusb_data *data = hci_get_drvdata(hdev);
1305 struct urb *urb;
1306 unsigned char *buf;
1307 unsigned int pipe;
1308 int err, size = HCI_MAX_FRAME_SIZE;
1309
1310 BT_DBG("%s", hdev->name);
1311
1312 if (!data->diag_rx_ep)
1313 return -ENODEV;
1314
1315 urb = usb_alloc_urb(0, mem_flags);
1316 if (!urb)
1317 return -ENOMEM;
1318
1319 buf = kmalloc(size, mem_flags);
1320 if (!buf) {
1321 usb_free_urb(urb);
1322 return -ENOMEM;
1323 }
1324
1325 pipe = usb_rcvbulkpipe(data->udev, data->diag_rx_ep->bEndpointAddress);
1326
1327 usb_fill_bulk_urb(urb, data->udev, pipe, buf, size,
1328 btusb_diag_complete, hdev);
1329
1330 urb->transfer_flags |= URB_FREE_BUFFER;
1331
1332 usb_mark_last_busy(data->udev);
1333 usb_anchor_urb(urb, &data->diag_anchor);
1334
1335 err = usb_submit_urb(urb, mem_flags);
1336 if (err < 0) {
1337 if (err != -EPERM && err != -ENODEV)
1338 bt_dev_err(hdev, "urb %p submission failed (%d)",
1339 urb, -err);
1340 usb_unanchor_urb(urb);
1341 }
1342
1343 usb_free_urb(urb);
1344
1345 return err;
1346 }
1347
1348 static void btusb_tx_complete(struct urb *urb)
1349 {
1350 struct sk_buff *skb = urb->context;
1351 struct hci_dev *hdev = (struct hci_dev *)skb->dev;
1352 struct btusb_data *data = hci_get_drvdata(hdev);
1353 unsigned long flags;
1354
1355 BT_DBG("%s urb %p status %d count %d", hdev->name, urb, urb->status,
1356 urb->actual_length);
1357
1358 if (!test_bit(HCI_RUNNING, &hdev->flags))
1359 goto done;
1360
1361 if (!urb->status)
1362 hdev->stat.byte_tx += urb->transfer_buffer_length;
1363 else
1364 hdev->stat.err_tx++;
1365
1366 done:
1367 spin_lock_irqsave(&data->txlock, flags);
1368 data->tx_in_flight--;
1369 spin_unlock_irqrestore(&data->txlock, flags);
1370
1371 kfree(urb->setup_packet);
1372
1373 kfree_skb(skb);
1374 }
1375
1376 static void btusb_isoc_tx_complete(struct urb *urb)
1377 {
1378 struct sk_buff *skb = urb->context;
1379 struct hci_dev *hdev = (struct hci_dev *)skb->dev;
1380
1381 BT_DBG("%s urb %p status %d count %d", hdev->name, urb, urb->status,
1382 urb->actual_length);
1383
1384 if (!test_bit(HCI_RUNNING, &hdev->flags))
1385 goto done;
1386
1387 if (!urb->status)
1388 hdev->stat.byte_tx += urb->transfer_buffer_length;
1389 else
1390 hdev->stat.err_tx++;
1391
1392 done:
1393 kfree(urb->setup_packet);
1394
1395 kfree_skb(skb);
1396 }
1397
1398 static int btusb_open(struct hci_dev *hdev)
1399 {
1400 struct btusb_data *data = hci_get_drvdata(hdev);
1401 int err;
1402
1403 BT_DBG("%s", hdev->name);
1404
1405 err = usb_autopm_get_interface(data->intf);
1406 if (err < 0)
1407 return err;
1408
1409 /* Patching USB firmware files prior to starting any URBs of HCI path
1410 * It is more safe to use USB bulk channel for downloading USB patch
1411 */
1412 if (data->setup_on_usb) {
1413 err = data->setup_on_usb(hdev);
1414 if (err < 0)
1415 goto setup_fail;
1416 }
1417
1418 data->intf->needs_remote_wakeup = 1;
1419
1420 if (test_and_set_bit(BTUSB_INTR_RUNNING, &data->flags))
1421 goto done;
1422
1423 err = btusb_submit_intr_urb(hdev, GFP_KERNEL);
1424 if (err < 0)
1425 goto failed;
1426
1427 err = btusb_submit_bulk_urb(hdev, GFP_KERNEL);
1428 if (err < 0) {
1429 usb_kill_anchored_urbs(&data->intr_anchor);
1430 goto failed;
1431 }
1432
1433 set_bit(BTUSB_BULK_RUNNING, &data->flags);
1434 btusb_submit_bulk_urb(hdev, GFP_KERNEL);
1435
1436 if (data->diag) {
1437 if (!btusb_submit_diag_urb(hdev, GFP_KERNEL))
1438 set_bit(BTUSB_DIAG_RUNNING, &data->flags);
1439 }
1440
1441 done:
1442 usb_autopm_put_interface(data->intf);
1443 return 0;
1444
1445 failed:
1446 clear_bit(BTUSB_INTR_RUNNING, &data->flags);
1447 setup_fail:
1448 usb_autopm_put_interface(data->intf);
1449 return err;
1450 }
1451
1452 static void btusb_stop_traffic(struct btusb_data *data)
1453 {
1454 usb_kill_anchored_urbs(&data->intr_anchor);
1455 usb_kill_anchored_urbs(&data->bulk_anchor);
1456 usb_kill_anchored_urbs(&data->isoc_anchor);
1457 usb_kill_anchored_urbs(&data->diag_anchor);
1458 usb_kill_anchored_urbs(&data->ctrl_anchor);
1459 }
1460
1461 static int btusb_close(struct hci_dev *hdev)
1462 {
1463 struct btusb_data *data = hci_get_drvdata(hdev);
1464 int err;
1465
1466 BT_DBG("%s", hdev->name);
1467
1468 cancel_work_sync(&data->work);
1469 cancel_work_sync(&data->waker);
1470
1471 clear_bit(BTUSB_ISOC_RUNNING, &data->flags);
1472 clear_bit(BTUSB_BULK_RUNNING, &data->flags);
1473 clear_bit(BTUSB_INTR_RUNNING, &data->flags);
1474 clear_bit(BTUSB_DIAG_RUNNING, &data->flags);
1475
1476 btusb_stop_traffic(data);
1477 btusb_free_frags(data);
1478
1479 err = usb_autopm_get_interface(data->intf);
1480 if (err < 0)
1481 goto failed;
1482
1483 data->intf->needs_remote_wakeup = 0;
1484
1485 /* Enable remote wake up for auto-suspend */
1486 if (test_bit(BTUSB_WAKEUP_AUTOSUSPEND, &data->flags))
1487 data->intf->needs_remote_wakeup = 1;
1488
1489 usb_autopm_put_interface(data->intf);
1490
1491 failed:
1492 usb_scuttle_anchored_urbs(&data->deferred);
1493 return 0;
1494 }
1495
1496 static int btusb_flush(struct hci_dev *hdev)
1497 {
1498 struct btusb_data *data = hci_get_drvdata(hdev);
1499
1500 BT_DBG("%s", hdev->name);
1501
1502 usb_kill_anchored_urbs(&data->tx_anchor);
1503 btusb_free_frags(data);
1504
1505 return 0;
1506 }
1507
1508 static struct urb *alloc_ctrl_urb(struct hci_dev *hdev, struct sk_buff *skb)
1509 {
1510 struct btusb_data *data = hci_get_drvdata(hdev);
1511 struct usb_ctrlrequest *dr;
1512 struct urb *urb;
1513 unsigned int pipe;
1514
1515 urb = usb_alloc_urb(0, GFP_KERNEL);
1516 if (!urb)
1517 return ERR_PTR(-ENOMEM);
1518
1519 dr = kmalloc(sizeof(*dr), GFP_KERNEL);
1520 if (!dr) {
1521 usb_free_urb(urb);
1522 return ERR_PTR(-ENOMEM);
1523 }
1524
1525 dr->bRequestType = data->cmdreq_type;
1526 dr->bRequest = data->cmdreq;
1527 dr->wIndex = 0;
1528 dr->wValue = 0;
1529 dr->wLength = __cpu_to_le16(skb->len);
1530
1531 pipe = usb_sndctrlpipe(data->udev, 0x00);
1532
1533 usb_fill_control_urb(urb, data->udev, pipe, (void *)dr,
1534 skb->data, skb->len, btusb_tx_complete, skb);
1535
1536 skb->dev = (void *)hdev;
1537
1538 return urb;
1539 }
1540
1541 static struct urb *alloc_bulk_urb(struct hci_dev *hdev, struct sk_buff *skb)
1542 {
1543 struct btusb_data *data = hci_get_drvdata(hdev);
1544 struct urb *urb;
1545 unsigned int pipe;
1546
1547 if (!data->bulk_tx_ep)
1548 return ERR_PTR(-ENODEV);
1549
1550 urb = usb_alloc_urb(0, GFP_KERNEL);
1551 if (!urb)
1552 return ERR_PTR(-ENOMEM);
1553
1554 pipe = usb_sndbulkpipe(data->udev, data->bulk_tx_ep->bEndpointAddress);
1555
1556 usb_fill_bulk_urb(urb, data->udev, pipe,
1557 skb->data, skb->len, btusb_tx_complete, skb);
1558
1559 skb->dev = (void *)hdev;
1560
1561 return urb;
1562 }
1563
1564 static struct urb *alloc_isoc_urb(struct hci_dev *hdev, struct sk_buff *skb)
1565 {
1566 struct btusb_data *data = hci_get_drvdata(hdev);
1567 struct urb *urb;
1568 unsigned int pipe;
1569
1570 if (!data->isoc_tx_ep)
1571 return ERR_PTR(-ENODEV);
1572
1573 urb = usb_alloc_urb(BTUSB_MAX_ISOC_FRAMES, GFP_KERNEL);
1574 if (!urb)
1575 return ERR_PTR(-ENOMEM);
1576
1577 pipe = usb_sndisocpipe(data->udev, data->isoc_tx_ep->bEndpointAddress);
1578
1579 usb_fill_int_urb(urb, data->udev, pipe,
1580 skb->data, skb->len, btusb_isoc_tx_complete,
1581 skb, data->isoc_tx_ep->bInterval);
1582
1583 urb->transfer_flags = URB_ISO_ASAP;
1584
1585 if (data->isoc_altsetting == 6)
1586 __fill_isoc_descriptor_msbc(urb, skb->len,
1587 le16_to_cpu(data->isoc_tx_ep->wMaxPacketSize),
1588 data);
1589 else
1590 __fill_isoc_descriptor(urb, skb->len,
1591 le16_to_cpu(data->isoc_tx_ep->wMaxPacketSize));
1592 skb->dev = (void *)hdev;
1593
1594 return urb;
1595 }
1596
1597 static int submit_tx_urb(struct hci_dev *hdev, struct urb *urb)
1598 {
1599 struct btusb_data *data = hci_get_drvdata(hdev);
1600 int err;
1601
1602 usb_anchor_urb(urb, &data->tx_anchor);
1603
1604 err = usb_submit_urb(urb, GFP_KERNEL);
1605 if (err < 0) {
1606 if (err != -EPERM && err != -ENODEV)
1607 bt_dev_err(hdev, "urb %p submission failed (%d)",
1608 urb, -err);
1609 kfree(urb->setup_packet);
1610 usb_unanchor_urb(urb);
1611 } else {
1612 usb_mark_last_busy(data->udev);
1613 }
1614
1615 usb_free_urb(urb);
1616 return err;
1617 }
1618
1619 static int submit_or_queue_tx_urb(struct hci_dev *hdev, struct urb *urb)
1620 {
1621 struct btusb_data *data = hci_get_drvdata(hdev);
1622 unsigned long flags;
1623 bool suspending;
1624
1625 spin_lock_irqsave(&data->txlock, flags);
1626 suspending = test_bit(BTUSB_SUSPENDING, &data->flags);
1627 if (!suspending)
1628 data->tx_in_flight++;
1629 spin_unlock_irqrestore(&data->txlock, flags);
1630
1631 if (!suspending)
1632 return submit_tx_urb(hdev, urb);
1633
1634 usb_anchor_urb(urb, &data->deferred);
1635 schedule_work(&data->waker);
1636
1637 usb_free_urb(urb);
1638 return 0;
1639 }
1640
1641 static int btusb_send_frame(struct hci_dev *hdev, struct sk_buff *skb)
1642 {
1643 struct urb *urb;
1644
1645 BT_DBG("%s", hdev->name);
1646
1647 switch (hci_skb_pkt_type(skb)) {
1648 case HCI_COMMAND_PKT:
1649 urb = alloc_ctrl_urb(hdev, skb);
1650 if (IS_ERR(urb))
1651 return PTR_ERR(urb);
1652
1653 hdev->stat.cmd_tx++;
1654 return submit_or_queue_tx_urb(hdev, urb);
1655
1656 case HCI_ACLDATA_PKT:
1657 urb = alloc_bulk_urb(hdev, skb);
1658 if (IS_ERR(urb))
1659 return PTR_ERR(urb);
1660
1661 hdev->stat.acl_tx++;
1662 return submit_or_queue_tx_urb(hdev, urb);
1663
1664 case HCI_SCODATA_PKT:
1665 if (hci_conn_num(hdev, SCO_LINK) < 1)
1666 return -ENODEV;
1667
1668 urb = alloc_isoc_urb(hdev, skb);
1669 if (IS_ERR(urb))
1670 return PTR_ERR(urb);
1671
1672 hdev->stat.sco_tx++;
1673 return submit_tx_urb(hdev, urb);
1674 }
1675
1676 return -EILSEQ;
1677 }
1678
1679 static void btusb_notify(struct hci_dev *hdev, unsigned int evt)
1680 {
1681 struct btusb_data *data = hci_get_drvdata(hdev);
1682
1683 BT_DBG("%s evt %d", hdev->name, evt);
1684
1685 if (hci_conn_num(hdev, SCO_LINK) != data->sco_num) {
1686 data->sco_num = hci_conn_num(hdev, SCO_LINK);
1687 data->air_mode = evt;
1688 schedule_work(&data->work);
1689 }
1690 }
1691
1692 static inline int __set_isoc_interface(struct hci_dev *hdev, int altsetting)
1693 {
1694 struct btusb_data *data = hci_get_drvdata(hdev);
1695 struct usb_interface *intf = data->isoc;
1696 struct usb_endpoint_descriptor *ep_desc;
1697 int i, err;
1698
1699 if (!data->isoc)
1700 return -ENODEV;
1701
1702 err = usb_set_interface(data->udev, data->isoc_ifnum, altsetting);
1703 if (err < 0) {
1704 bt_dev_err(hdev, "setting interface failed (%d)", -err);
1705 return err;
1706 }
1707
1708 data->isoc_altsetting = altsetting;
1709
1710 data->isoc_tx_ep = NULL;
1711 data->isoc_rx_ep = NULL;
1712
1713 for (i = 0; i < intf->cur_altsetting->desc.bNumEndpoints; i++) {
1714 ep_desc = &intf->cur_altsetting->endpoint[i].desc;
1715
1716 if (!data->isoc_tx_ep && usb_endpoint_is_isoc_out(ep_desc)) {
1717 data->isoc_tx_ep = ep_desc;
1718 continue;
1719 }
1720
1721 if (!data->isoc_rx_ep && usb_endpoint_is_isoc_in(ep_desc)) {
1722 data->isoc_rx_ep = ep_desc;
1723 continue;
1724 }
1725 }
1726
1727 if (!data->isoc_tx_ep || !data->isoc_rx_ep) {
1728 bt_dev_err(hdev, "invalid SCO descriptors");
1729 return -ENODEV;
1730 }
1731
1732 return 0;
1733 }
1734
1735 static int btusb_switch_alt_setting(struct hci_dev *hdev, int new_alts)
1736 {
1737 struct btusb_data *data = hci_get_drvdata(hdev);
1738 int err;
1739
1740 if (data->isoc_altsetting != new_alts) {
1741 unsigned long flags;
1742
1743 clear_bit(BTUSB_ISOC_RUNNING, &data->flags);
1744 usb_kill_anchored_urbs(&data->isoc_anchor);
1745
1746 /* When isochronous alternate setting needs to be
1747 * changed, because SCO connection has been added
1748 * or removed, a packet fragment may be left in the
1749 * reassembling state. This could lead to wrongly
1750 * assembled fragments.
1751 *
1752 * Clear outstanding fragment when selecting a new
1753 * alternate setting.
1754 */
1755 spin_lock_irqsave(&data->rxlock, flags);
1756 kfree_skb(data->sco_skb);
1757 data->sco_skb = NULL;
1758 spin_unlock_irqrestore(&data->rxlock, flags);
1759
1760 err = __set_isoc_interface(hdev, new_alts);
1761 if (err < 0)
1762 return err;
1763 }
1764
1765 if (!test_and_set_bit(BTUSB_ISOC_RUNNING, &data->flags)) {
1766 if (btusb_submit_isoc_urb(hdev, GFP_KERNEL) < 0)
1767 clear_bit(BTUSB_ISOC_RUNNING, &data->flags);
1768 else
1769 btusb_submit_isoc_urb(hdev, GFP_KERNEL);
1770 }
1771
1772 return 0;
1773 }
1774
1775 static struct usb_host_interface *btusb_find_altsetting(struct btusb_data *data,
1776 int alt)
1777 {
1778 struct usb_interface *intf = data->isoc;
1779 int i;
1780
1781 BT_DBG("Looking for Alt no :%d", alt);
1782
1783 if (!intf)
1784 return NULL;
1785
1786 for (i = 0; i < intf->num_altsetting; i++) {
1787 if (intf->altsetting[i].desc.bAlternateSetting == alt)
1788 return &intf->altsetting[i];
1789 }
1790
1791 return NULL;
1792 }
1793
1794 static void btusb_work(struct work_struct *work)
1795 {
1796 struct btusb_data *data = container_of(work, struct btusb_data, work);
1797 struct hci_dev *hdev = data->hdev;
1798 int new_alts = 0;
1799 int err;
1800
1801 if (data->sco_num > 0) {
1802 if (!test_bit(BTUSB_DID_ISO_RESUME, &data->flags)) {
1803 err = usb_autopm_get_interface(data->isoc ? data->isoc : data->intf);
1804 if (err < 0) {
1805 clear_bit(BTUSB_ISOC_RUNNING, &data->flags);
1806 usb_kill_anchored_urbs(&data->isoc_anchor);
1807 return;
1808 }
1809
1810 set_bit(BTUSB_DID_ISO_RESUME, &data->flags);
1811 }
1812
1813 if (data->air_mode == HCI_NOTIFY_ENABLE_SCO_CVSD) {
1814 if (hdev->voice_setting & 0x0020) {
1815 static const int alts[3] = { 2, 4, 5 };
1816
1817 new_alts = alts[data->sco_num - 1];
1818 } else {
1819 new_alts = data->sco_num;
1820 }
1821 } else if (data->air_mode == HCI_NOTIFY_ENABLE_SCO_TRANSP) {
1822 /* Bluetooth USB spec recommends alt 6 (63 bytes), but
1823 * many adapters do not support it. Alt 1 appears to
1824 * work for all adapters that do not have alt 6, and
1825 * which work with WBS at all. Some devices prefer
1826 * alt 3 (HCI payload >= 60 Bytes let air packet
1827 * data satisfy 60 bytes), requiring
1828 * MTU >= 3 (packets) * 25 (size) - 3 (headers) = 72
1829 * see also Core spec 5, vol 4, B 2.1.1 & Table 2.1.
1830 */
1831 if (btusb_find_altsetting(data, 6))
1832 new_alts = 6;
1833 else if (btusb_find_altsetting(data, 3) &&
1834 hdev->sco_mtu >= 72 &&
1835 test_bit(BTUSB_USE_ALT3_FOR_WBS, &data->flags))
1836 new_alts = 3;
1837 else
1838 new_alts = 1;
1839 }
1840
1841 if (btusb_switch_alt_setting(hdev, new_alts) < 0)
1842 bt_dev_err(hdev, "set USB alt:(%d) failed!", new_alts);
1843 } else {
1844 clear_bit(BTUSB_ISOC_RUNNING, &data->flags);
1845 usb_kill_anchored_urbs(&data->isoc_anchor);
1846
1847 __set_isoc_interface(hdev, 0);
1848 if (test_and_clear_bit(BTUSB_DID_ISO_RESUME, &data->flags))
1849 usb_autopm_put_interface(data->isoc ? data->isoc : data->intf);
1850 }
1851 }
1852
1853 static void btusb_waker(struct work_struct *work)
1854 {
1855 struct btusb_data *data = container_of(work, struct btusb_data, waker);
1856 int err;
1857
1858 err = usb_autopm_get_interface(data->intf);
1859 if (err < 0)
1860 return;
1861
1862 usb_autopm_put_interface(data->intf);
1863 }
1864
1865 static int btusb_setup_bcm92035(struct hci_dev *hdev)
1866 {
1867 struct sk_buff *skb;
1868 u8 val = 0x00;
1869
1870 BT_DBG("%s", hdev->name);
1871
1872 skb = __hci_cmd_sync(hdev, 0xfc3b, 1, &val, HCI_INIT_TIMEOUT);
1873 if (IS_ERR(skb))
1874 bt_dev_err(hdev, "BCM92035 command failed (%ld)", PTR_ERR(skb));
1875 else
1876 kfree_skb(skb);
1877
1878 return 0;
1879 }
1880
1881 static int btusb_setup_csr(struct hci_dev *hdev)
1882 {
1883 struct btusb_data *data = hci_get_drvdata(hdev);
1884 u16 bcdDevice = le16_to_cpu(data->udev->descriptor.bcdDevice);
1885 struct hci_rp_read_local_version *rp;
1886 struct sk_buff *skb;
1887 bool is_fake = false;
1888 int ret;
1889
1890 BT_DBG("%s", hdev->name);
1891
1892 skb = __hci_cmd_sync(hdev, HCI_OP_READ_LOCAL_VERSION, 0, NULL,
1893 HCI_INIT_TIMEOUT);
1894 if (IS_ERR(skb)) {
1895 int err = PTR_ERR(skb);
1896 bt_dev_err(hdev, "CSR: Local version failed (%d)", err);
1897 return err;
1898 }
1899
1900 if (skb->len != sizeof(struct hci_rp_read_local_version)) {
1901 bt_dev_err(hdev, "CSR: Local version length mismatch");
1902 kfree_skb(skb);
1903 return -EIO;
1904 }
1905
1906 rp = (struct hci_rp_read_local_version *)skb->data;
1907
1908 /* Detect a wide host of Chinese controllers that aren't CSR.
1909 *
1910 * Known fake bcdDevices: 0x0100, 0x0134, 0x1915, 0x2520, 0x7558, 0x8891
1911 *
1912 * The main thing they have in common is that these are really popular low-cost
1913 * options that support newer Bluetooth versions but rely on heavy VID/PID
1914 * squatting of this poor old Bluetooth 1.1 device. Even sold as such.
1915 *
1916 * We detect actual CSR devices by checking that the HCI manufacturer code
1917 * is Cambridge Silicon Radio (10) and ensuring that LMP sub-version and
1918 * HCI rev values always match. As they both store the firmware number.
1919 */
1920 if (le16_to_cpu(rp->manufacturer) != 10 ||
1921 le16_to_cpu(rp->hci_rev) != le16_to_cpu(rp->lmp_subver))
1922 is_fake = true;
1923
1924 /* Known legit CSR firmware build numbers and their supported BT versions:
1925 * - 1.1 (0x1) -> 0x0073, 0x020d, 0x033c, 0x034e
1926 * - 1.2 (0x2) -> 0x04d9, 0x0529
1927 * - 2.0 (0x3) -> 0x07a6, 0x07ad, 0x0c5c
1928 * - 2.1 (0x4) -> 0x149c, 0x1735, 0x1899 (0x1899 is a BlueCore4-External)
1929 * - 4.0 (0x6) -> 0x1d86, 0x2031, 0x22bb
1930 *
1931 * e.g. Real CSR dongles with LMP subversion 0x73 are old enough that
1932 * support BT 1.1 only; so it's a dead giveaway when some
1933 * third-party BT 4.0 dongle reuses it.
1934 */
1935 else if (le16_to_cpu(rp->lmp_subver) <= 0x034e &&
1936 le16_to_cpu(rp->hci_ver) > BLUETOOTH_VER_1_1)
1937 is_fake = true;
1938
1939 else if (le16_to_cpu(rp->lmp_subver) <= 0x0529 &&
1940 le16_to_cpu(rp->hci_ver) > BLUETOOTH_VER_1_2)
1941 is_fake = true;
1942
1943 else if (le16_to_cpu(rp->lmp_subver) <= 0x0c5c &&
1944 le16_to_cpu(rp->hci_ver) > BLUETOOTH_VER_2_0)
1945 is_fake = true;
1946
1947 else if (le16_to_cpu(rp->lmp_subver) <= 0x1899 &&
1948 le16_to_cpu(rp->hci_ver) > BLUETOOTH_VER_2_1)
1949 is_fake = true;
1950
1951 else if (le16_to_cpu(rp->lmp_subver) <= 0x22bb &&
1952 le16_to_cpu(rp->hci_ver) > BLUETOOTH_VER_4_0)
1953 is_fake = true;
1954
1955 /* Other clones which beat all the above checks */
1956 else if (bcdDevice == 0x0134 &&
1957 le16_to_cpu(rp->lmp_subver) == 0x0c5c &&
1958 le16_to_cpu(rp->hci_ver) == BLUETOOTH_VER_2_0)
1959 is_fake = true;
1960
1961 if (is_fake) {
1962 bt_dev_warn(hdev, "CSR: Unbranded CSR clone detected; adding workarounds and force-suspending once...");
1963
1964 /* Generally these clones have big discrepancies between
1965 * advertised features and what's actually supported.
1966 * Probably will need to be expanded in the future;
1967 * without these the controller will lock up.
1968 */
1969 set_bit(HCI_QUIRK_BROKEN_STORED_LINK_KEY, &hdev->quirks);
1970 set_bit(HCI_QUIRK_BROKEN_ERR_DATA_REPORTING, &hdev->quirks);
1971
1972 /* Clear the reset quirk since this is not an actual
1973 * early Bluetooth 1.1 device from CSR.
1974 */
1975 clear_bit(HCI_QUIRK_RESET_ON_CLOSE, &hdev->quirks);
1976 clear_bit(HCI_QUIRK_SIMULTANEOUS_DISCOVERY, &hdev->quirks);
1977
1978 /*
1979 * Special workaround for these BT 4.0 chip clones, and potentially more:
1980 *
1981 * - 0x0134: a Barrot 8041a02 (HCI rev: 0x1012 sub: 0x0810)
1982 * - 0x7558: IC markings FR3191AHAL 749H15143 (HCI rev/sub-version: 0x0709)
1983 *
1984 * These controllers are really messed-up.
1985 *
1986 * 1. Their bulk RX endpoint will never report any data unless
1987 * the device was suspended at least once (yes, really).
1988 * 2. They will not wakeup when autosuspended and receiving data
1989 * on their bulk RX endpoint from e.g. a keyboard or mouse
1990 * (IOW remote-wakeup support is broken for the bulk endpoint).
1991 *
1992 * To fix 1. enable runtime-suspend, force-suspend the
1993 * HCI and then wake-it up by disabling runtime-suspend.
1994 *
1995 * To fix 2. clear the HCI's can_wake flag, this way the HCI
1996 * will still be autosuspended when it is not open.
1997 *
1998 * --
1999 *
2000 * Because these are widespread problems we prefer generic solutions; so
2001 * apply this initialization quirk to every controller that gets here,
2002 * it should be harmless. The alternative is to not work at all.
2003 */
2004 pm_runtime_allow(&data->udev->dev);
2005
2006 ret = pm_runtime_suspend(&data->udev->dev);
2007 if (ret >= 0)
2008 msleep(200);
2009 else
2010 bt_dev_err(hdev, "CSR: Failed to suspend the device for our Barrot 8041a02 receive-issue workaround");
2011
2012 pm_runtime_forbid(&data->udev->dev);
2013
2014 device_set_wakeup_capable(&data->udev->dev, false);
2015
2016 /* Re-enable autosuspend if this was requested */
2017 if (enable_autosuspend)
2018 usb_enable_autosuspend(data->udev);
2019 }
2020
2021 kfree_skb(skb);
2022
2023 return 0;
2024 }
2025
2026 static int inject_cmd_complete(struct hci_dev *hdev, __u16 opcode)
2027 {
2028 struct sk_buff *skb;
2029 struct hci_event_hdr *hdr;
2030 struct hci_ev_cmd_complete *evt;
2031
2032 skb = bt_skb_alloc(sizeof(*hdr) + sizeof(*evt) + 1, GFP_KERNEL);
2033 if (!skb)
2034 return -ENOMEM;
2035
2036 hdr = skb_put(skb, sizeof(*hdr));
2037 hdr->evt = HCI_EV_CMD_COMPLETE;
2038 hdr->plen = sizeof(*evt) + 1;
2039
2040 evt = skb_put(skb, sizeof(*evt));
2041 evt->ncmd = 0x01;
2042 evt->opcode = cpu_to_le16(opcode);
2043
2044 skb_put_u8(skb, 0x00);
2045
2046 hci_skb_pkt_type(skb) = HCI_EVENT_PKT;
2047
2048 return hci_recv_frame(hdev, skb);
2049 }
2050
2051 static int btusb_recv_bulk_intel(struct btusb_data *data, void *buffer,
2052 int count)
2053 {
2054 struct hci_dev *hdev = data->hdev;
2055
2056 /* When the device is in bootloader mode, then it can send
2057 * events via the bulk endpoint. These events are treated the
2058 * same way as the ones received from the interrupt endpoint.
2059 */
2060 if (btintel_test_flag(hdev, INTEL_BOOTLOADER))
2061 return btusb_recv_intr(data, buffer, count);
2062
2063 return btusb_recv_bulk(data, buffer, count);
2064 }
2065
2066 static int btusb_recv_event_intel(struct hci_dev *hdev, struct sk_buff *skb)
2067 {
2068 if (btintel_test_flag(hdev, INTEL_BOOTLOADER)) {
2069 struct hci_event_hdr *hdr = (void *)skb->data;
2070
2071 if (skb->len > HCI_EVENT_HDR_SIZE && hdr->evt == 0xff &&
2072 hdr->plen > 0) {
2073 const void *ptr = skb->data + HCI_EVENT_HDR_SIZE + 1;
2074 unsigned int len = skb->len - HCI_EVENT_HDR_SIZE - 1;
2075
2076 switch (skb->data[2]) {
2077 case 0x02:
2078 /* When switching to the operational firmware
2079 * the device sends a vendor specific event
2080 * indicating that the bootup completed.
2081 */
2082 btintel_bootup(hdev, ptr, len);
2083 break;
2084 case 0x06:
2085 /* When the firmware loading completes the
2086 * device sends out a vendor specific event
2087 * indicating the result of the firmware
2088 * loading.
2089 */
2090 btintel_secure_send_result(hdev, ptr, len);
2091 break;
2092 }
2093 }
2094 }
2095
2096 return hci_recv_frame(hdev, skb);
2097 }
2098
2099 static int btusb_send_frame_intel(struct hci_dev *hdev, struct sk_buff *skb)
2100 {
2101 struct urb *urb;
2102
2103 BT_DBG("%s", hdev->name);
2104
2105 switch (hci_skb_pkt_type(skb)) {
2106 case HCI_COMMAND_PKT:
2107 if (btintel_test_flag(hdev, INTEL_BOOTLOADER)) {
2108 struct hci_command_hdr *cmd = (void *)skb->data;
2109 __u16 opcode = le16_to_cpu(cmd->opcode);
2110
2111 /* When in bootloader mode and the command 0xfc09
2112 * is received, it needs to be send down the
2113 * bulk endpoint. So allocate a bulk URB instead.
2114 */
2115 if (opcode == 0xfc09)
2116 urb = alloc_bulk_urb(hdev, skb);
2117 else
2118 urb = alloc_ctrl_urb(hdev, skb);
2119
2120 /* When the 0xfc01 command is issued to boot into
2121 * the operational firmware, it will actually not
2122 * send a command complete event. To keep the flow
2123 * control working inject that event here.
2124 */
2125 if (opcode == 0xfc01)
2126 inject_cmd_complete(hdev, opcode);
2127 } else {
2128 urb = alloc_ctrl_urb(hdev, skb);
2129 }
2130 if (IS_ERR(urb))
2131 return PTR_ERR(urb);
2132
2133 hdev->stat.cmd_tx++;
2134 return submit_or_queue_tx_urb(hdev, urb);
2135
2136 case HCI_ACLDATA_PKT:
2137 urb = alloc_bulk_urb(hdev, skb);
2138 if (IS_ERR(urb))
2139 return PTR_ERR(urb);
2140
2141 hdev->stat.acl_tx++;
2142 return submit_or_queue_tx_urb(hdev, urb);
2143
2144 case HCI_SCODATA_PKT:
2145 if (hci_conn_num(hdev, SCO_LINK) < 1)
2146 return -ENODEV;
2147
2148 urb = alloc_isoc_urb(hdev, skb);
2149 if (IS_ERR(urb))
2150 return PTR_ERR(urb);
2151
2152 hdev->stat.sco_tx++;
2153 return submit_tx_urb(hdev, urb);
2154 }
2155
2156 return -EILSEQ;
2157 }
2158
2159 /* UHW CR mapping */
2160 #define MTK_BT_MISC 0x70002510
2161 #define MTK_BT_SUBSYS_RST 0x70002610
2162 #define MTK_UDMA_INT_STA_BT 0x74000024
2163 #define MTK_UDMA_INT_STA_BT1 0x74000308
2164 #define MTK_BT_WDT_STATUS 0x740003A0
2165 #define MTK_EP_RST_OPT 0x74011890
2166 #define MTK_EP_RST_IN_OUT_OPT 0x00010001
2167 #define MTK_BT_RST_DONE 0x00000100
2168 #define MTK_BT_RESET_WAIT_MS 100
2169 #define MTK_BT_RESET_NUM_TRIES 10
2170 #define FIRMWARE_MT7663 "mediatek/mt7663pr2h.bin"
2171 #define FIRMWARE_MT7668 "mediatek/mt7668pr2h.bin"
2172
2173 #define HCI_WMT_MAX_EVENT_SIZE 64
2174 /* It is for mt79xx download rom patch*/
2175 #define MTK_FW_ROM_PATCH_HEADER_SIZE 32
2176 #define MTK_FW_ROM_PATCH_GD_SIZE 64
2177 #define MTK_FW_ROM_PATCH_SEC_MAP_SIZE 64
2178 #define MTK_SEC_MAP_COMMON_SIZE 12
2179 #define MTK_SEC_MAP_NEED_SEND_SIZE 52
2180
2181 enum {
2182 BTMTK_WMT_PATCH_DWNLD = 0x1,
2183 BTMTK_WMT_FUNC_CTRL = 0x6,
2184 BTMTK_WMT_RST = 0x7,
2185 BTMTK_WMT_SEMAPHORE = 0x17,
2186 };
2187
2188 enum {
2189 BTMTK_WMT_INVALID,
2190 BTMTK_WMT_PATCH_UNDONE,
2191 BTMTK_WMT_PATCH_PROGRESS,
2192 BTMTK_WMT_PATCH_DONE,
2193 BTMTK_WMT_ON_UNDONE,
2194 BTMTK_WMT_ON_DONE,
2195 BTMTK_WMT_ON_PROGRESS,
2196 };
2197
2198 struct btmtk_wmt_hdr {
2199 u8 dir;
2200 u8 op;
2201 __le16 dlen;
2202 u8 flag;
2203 } __packed;
2204
2205 struct btmtk_hci_wmt_cmd {
2206 struct btmtk_wmt_hdr hdr;
2207 u8 data[];
2208 } __packed;
2209
2210 struct btmtk_hci_wmt_evt {
2211 struct hci_event_hdr hhdr;
2212 struct btmtk_wmt_hdr whdr;
2213 } __packed;
2214
2215 struct btmtk_hci_wmt_evt_funcc {
2216 struct btmtk_hci_wmt_evt hwhdr;
2217 __be16 status;
2218 } __packed;
2219
2220 struct btmtk_tci_sleep {
2221 u8 mode;
2222 __le16 duration;
2223 __le16 host_duration;
2224 u8 host_wakeup_pin;
2225 u8 time_compensation;
2226 } __packed;
2227
2228 struct btmtk_hci_wmt_params {
2229 u8 op;
2230 u8 flag;
2231 u16 dlen;
2232 const void *data;
2233 u32 *status;
2234 };
2235
2236 struct btmtk_patch_header {
2237 u8 datetime[16];
2238 u8 platform[4];
2239 __le16 hwver;
2240 __le16 swver;
2241 __le32 magicnum;
2242 } __packed;
2243
2244 struct btmtk_global_desc {
2245 __le32 patch_ver;
2246 __le32 sub_sys;
2247 __le32 feature_opt;
2248 __le32 section_num;
2249 } __packed;
2250
2251 struct btmtk_section_map {
2252 __le32 sectype;
2253 __le32 secoffset;
2254 __le32 secsize;
2255 union {
2256 __le32 u4SecSpec[13];
2257 struct {
2258 __le32 dlAddr;
2259 __le32 dlsize;
2260 __le32 seckeyidx;
2261 __le32 alignlen;
2262 __le32 sectype;
2263 __le32 dlmodecrctype;
2264 __le32 crc;
2265 __le32 reserved[6];
2266 } bin_info_spec;
2267 };
2268 } __packed;
2269
2270 static void btusb_mtk_wmt_recv(struct urb *urb)
2271 {
2272 struct hci_dev *hdev = urb->context;
2273 struct btusb_data *data = hci_get_drvdata(hdev);
2274 struct hci_event_hdr *hdr;
2275 struct sk_buff *skb;
2276 int err;
2277
2278 if (urb->status == 0 && urb->actual_length > 0) {
2279 hdev->stat.byte_rx += urb->actual_length;
2280
2281 /* WMT event shouldn't be fragmented and the size should be
2282 * less than HCI_WMT_MAX_EVENT_SIZE.
2283 */
2284 skb = bt_skb_alloc(HCI_WMT_MAX_EVENT_SIZE, GFP_ATOMIC);
2285 if (!skb) {
2286 hdev->stat.err_rx++;
2287 kfree(urb->setup_packet);
2288 return;
2289 }
2290
2291 hci_skb_pkt_type(skb) = HCI_EVENT_PKT;
2292 skb_put_data(skb, urb->transfer_buffer, urb->actual_length);
2293
2294 hdr = (void *)skb->data;
2295 /* Fix up the vendor event id with 0xff for vendor specific
2296 * instead of 0xe4 so that event send via monitoring socket can
2297 * be parsed properly.
2298 */
2299 hdr->evt = 0xff;
2300
2301 /* When someone waits for the WMT event, the skb is being cloned
2302 * and being processed the events from there then.
2303 */
2304 if (test_bit(BTUSB_TX_WAIT_VND_EVT, &data->flags)) {
2305 data->evt_skb = skb_clone(skb, GFP_ATOMIC);
2306 if (!data->evt_skb) {
2307 kfree_skb(skb);
2308 kfree(urb->setup_packet);
2309 return;
2310 }
2311 }
2312
2313 err = hci_recv_frame(hdev, skb);
2314 if (err < 0) {
2315 kfree_skb(data->evt_skb);
2316 data->evt_skb = NULL;
2317 kfree(urb->setup_packet);
2318 return;
2319 }
2320
2321 if (test_and_clear_bit(BTUSB_TX_WAIT_VND_EVT,
2322 &data->flags)) {
2323 /* Barrier to sync with other CPUs */
2324 smp_mb__after_atomic();
2325 wake_up_bit(&data->flags,
2326 BTUSB_TX_WAIT_VND_EVT);
2327 }
2328 kfree(urb->setup_packet);
2329 return;
2330 } else if (urb->status == -ENOENT) {
2331 /* Avoid suspend failed when usb_kill_urb */
2332 return;
2333 }
2334
2335 usb_mark_last_busy(data->udev);
2336
2337 /* The URB complete handler is still called with urb->actual_length = 0
2338 * when the event is not available, so we should keep re-submitting
2339 * URB until WMT event returns, Also, It's necessary to wait some time
2340 * between the two consecutive control URBs to relax the target device
2341 * to generate the event. Otherwise, the WMT event cannot return from
2342 * the device successfully.
2343 */
2344 udelay(500);
2345
2346 usb_anchor_urb(urb, &data->ctrl_anchor);
2347 err = usb_submit_urb(urb, GFP_ATOMIC);
2348 if (err < 0) {
2349 kfree(urb->setup_packet);
2350 /* -EPERM: urb is being killed;
2351 * -ENODEV: device got disconnected
2352 */
2353 if (err != -EPERM && err != -ENODEV)
2354 bt_dev_err(hdev, "urb %p failed to resubmit (%d)",
2355 urb, -err);
2356 usb_unanchor_urb(urb);
2357 }
2358 }
2359
2360 static int btusb_mtk_submit_wmt_recv_urb(struct hci_dev *hdev)
2361 {
2362 struct btusb_data *data = hci_get_drvdata(hdev);
2363 struct usb_ctrlrequest *dr;
2364 unsigned char *buf;
2365 int err, size = 64;
2366 unsigned int pipe;
2367 struct urb *urb;
2368
2369 urb = usb_alloc_urb(0, GFP_KERNEL);
2370 if (!urb)
2371 return -ENOMEM;
2372
2373 dr = kmalloc(sizeof(*dr), GFP_KERNEL);
2374 if (!dr) {
2375 usb_free_urb(urb);
2376 return -ENOMEM;
2377 }
2378
2379 dr->bRequestType = USB_TYPE_VENDOR | USB_DIR_IN;
2380 dr->bRequest = 1;
2381 dr->wIndex = cpu_to_le16(0);
2382 dr->wValue = cpu_to_le16(48);
2383 dr->wLength = cpu_to_le16(size);
2384
2385 buf = kmalloc(size, GFP_KERNEL);
2386 if (!buf) {
2387 kfree(dr);
2388 usb_free_urb(urb);
2389 return -ENOMEM;
2390 }
2391
2392 pipe = usb_rcvctrlpipe(data->udev, 0);
2393
2394 usb_fill_control_urb(urb, data->udev, pipe, (void *)dr,
2395 buf, size, btusb_mtk_wmt_recv, hdev);
2396
2397 urb->transfer_flags |= URB_FREE_BUFFER;
2398
2399 usb_anchor_urb(urb, &data->ctrl_anchor);
2400 err = usb_submit_urb(urb, GFP_KERNEL);
2401 if (err < 0) {
2402 if (err != -EPERM && err != -ENODEV)
2403 bt_dev_err(hdev, "urb %p submission failed (%d)",
2404 urb, -err);
2405 usb_unanchor_urb(urb);
2406 }
2407
2408 usb_free_urb(urb);
2409
2410 return err;
2411 }
2412
2413 static int btusb_mtk_hci_wmt_sync(struct hci_dev *hdev,
2414 struct btmtk_hci_wmt_params *wmt_params)
2415 {
2416 struct btusb_data *data = hci_get_drvdata(hdev);
2417 struct btmtk_hci_wmt_evt_funcc *wmt_evt_funcc;
2418 u32 hlen, status = BTMTK_WMT_INVALID;
2419 struct btmtk_hci_wmt_evt *wmt_evt;
2420 struct btmtk_hci_wmt_cmd *wc;
2421 struct btmtk_wmt_hdr *hdr;
2422 int err;
2423
2424 /* Send the WMT command and wait until the WMT event returns */
2425 hlen = sizeof(*hdr) + wmt_params->dlen;
2426 if (hlen > 255)
2427 return -EINVAL;
2428
2429 wc = kzalloc(hlen, GFP_KERNEL);
2430 if (!wc)
2431 return -ENOMEM;
2432
2433 hdr = &wc->hdr;
2434 hdr->dir = 1;
2435 hdr->op = wmt_params->op;
2436 hdr->dlen = cpu_to_le16(wmt_params->dlen + 1);
2437 hdr->flag = wmt_params->flag;
2438 memcpy(wc->data, wmt_params->data, wmt_params->dlen);
2439
2440 set_bit(BTUSB_TX_WAIT_VND_EVT, &data->flags);
2441
2442 err = __hci_cmd_send(hdev, 0xfc6f, hlen, wc);
2443
2444 if (err < 0) {
2445 clear_bit(BTUSB_TX_WAIT_VND_EVT, &data->flags);
2446 goto err_free_wc;
2447 }
2448
2449 /* Submit control IN URB on demand to process the WMT event */
2450 err = btusb_mtk_submit_wmt_recv_urb(hdev);
2451 if (err < 0)
2452 goto err_free_wc;
2453
2454 /* The vendor specific WMT commands are all answered by a vendor
2455 * specific event and will have the Command Status or Command
2456 * Complete as with usual HCI command flow control.
2457 *
2458 * After sending the command, wait for BTUSB_TX_WAIT_VND_EVT
2459 * state to be cleared. The driver specific event receive routine
2460 * will clear that state and with that indicate completion of the
2461 * WMT command.
2462 */
2463 err = wait_on_bit_timeout(&data->flags, BTUSB_TX_WAIT_VND_EVT,
2464 TASK_INTERRUPTIBLE, HCI_INIT_TIMEOUT);
2465 if (err == -EINTR) {
2466 bt_dev_err(hdev, "Execution of wmt command interrupted");
2467 clear_bit(BTUSB_TX_WAIT_VND_EVT, &data->flags);
2468 goto err_free_wc;
2469 }
2470
2471 if (err) {
2472 bt_dev_err(hdev, "Execution of wmt command timed out");
2473 clear_bit(BTUSB_TX_WAIT_VND_EVT, &data->flags);
2474 err = -ETIMEDOUT;
2475 goto err_free_wc;
2476 }
2477
2478 /* Parse and handle the return WMT event */
2479 wmt_evt = (struct btmtk_hci_wmt_evt *)data->evt_skb->data;
2480 if (wmt_evt->whdr.op != hdr->op) {
2481 bt_dev_err(hdev, "Wrong op received %d expected %d",
2482 wmt_evt->whdr.op, hdr->op);
2483 err = -EIO;
2484 goto err_free_skb;
2485 }
2486
2487 switch (wmt_evt->whdr.op) {
2488 case BTMTK_WMT_SEMAPHORE:
2489 if (wmt_evt->whdr.flag == 2)
2490 status = BTMTK_WMT_PATCH_UNDONE;
2491 else
2492 status = BTMTK_WMT_PATCH_DONE;
2493 break;
2494 case BTMTK_WMT_FUNC_CTRL:
2495 wmt_evt_funcc = (struct btmtk_hci_wmt_evt_funcc *)wmt_evt;
2496 if (be16_to_cpu(wmt_evt_funcc->status) == 0x404)
2497 status = BTMTK_WMT_ON_DONE;
2498 else if (be16_to_cpu(wmt_evt_funcc->status) == 0x420)
2499 status = BTMTK_WMT_ON_PROGRESS;
2500 else
2501 status = BTMTK_WMT_ON_UNDONE;
2502 break;
2503 case BTMTK_WMT_PATCH_DWNLD:
2504 if (wmt_evt->whdr.flag == 2)
2505 status = BTMTK_WMT_PATCH_DONE;
2506 else if (wmt_evt->whdr.flag == 1)
2507 status = BTMTK_WMT_PATCH_PROGRESS;
2508 else
2509 status = BTMTK_WMT_PATCH_UNDONE;
2510 break;
2511 }
2512
2513 if (wmt_params->status)
2514 *wmt_params->status = status;
2515
2516 err_free_skb:
2517 kfree_skb(data->evt_skb);
2518 data->evt_skb = NULL;
2519 err_free_wc:
2520 kfree(wc);
2521 return err;
2522 }
2523
2524 static int btusb_mtk_setup_firmware_79xx(struct hci_dev *hdev, const char *fwname)
2525 {
2526 struct btmtk_hci_wmt_params wmt_params;
2527 struct btmtk_global_desc *globaldesc = NULL;
2528 struct btmtk_section_map *sectionmap;
2529 const struct firmware *fw;
2530 const u8 *fw_ptr;
2531 const u8 *fw_bin_ptr;
2532 int err, dlen, i, status;
2533 u8 flag, first_block, retry;
2534 u32 section_num, dl_size, section_offset;
2535 u8 cmd[64];
2536
2537 err = request_firmware(&fw, fwname, &hdev->dev);
2538 if (err < 0) {
2539 bt_dev_err(hdev, "Failed to load firmware file (%d)", err);
2540 return err;
2541 }
2542
2543 fw_ptr = fw->data;
2544 fw_bin_ptr = fw_ptr;
2545 globaldesc = (struct btmtk_global_desc *)(fw_ptr + MTK_FW_ROM_PATCH_HEADER_SIZE);
2546 section_num = le32_to_cpu(globaldesc->section_num);
2547
2548 for (i = 0; i < section_num; i++) {
2549 first_block = 1;
2550 fw_ptr = fw_bin_ptr;
2551 sectionmap = (struct btmtk_section_map *)(fw_ptr + MTK_FW_ROM_PATCH_HEADER_SIZE +
2552 MTK_FW_ROM_PATCH_GD_SIZE + MTK_FW_ROM_PATCH_SEC_MAP_SIZE * i);
2553
2554 section_offset = le32_to_cpu(sectionmap->secoffset);
2555 dl_size = le32_to_cpu(sectionmap->bin_info_spec.dlsize);
2556
2557 if (dl_size > 0) {
2558 retry = 20;
2559 while (retry > 0) {
2560 cmd[0] = 0; /* 0 means legacy dl mode. */
2561 memcpy(cmd + 1,
2562 fw_ptr + MTK_FW_ROM_PATCH_HEADER_SIZE +
2563 MTK_FW_ROM_PATCH_GD_SIZE + MTK_FW_ROM_PATCH_SEC_MAP_SIZE * i +
2564 MTK_SEC_MAP_COMMON_SIZE,
2565 MTK_SEC_MAP_NEED_SEND_SIZE + 1);
2566
2567 wmt_params.op = BTMTK_WMT_PATCH_DWNLD;
2568 wmt_params.status = &status;
2569 wmt_params.flag = 0;
2570 wmt_params.dlen = MTK_SEC_MAP_NEED_SEND_SIZE + 1;
2571 wmt_params.data = &cmd;
2572
2573 err = btusb_mtk_hci_wmt_sync(hdev, &wmt_params);
2574 if (err < 0) {
2575 bt_dev_err(hdev, "Failed to send wmt patch dwnld (%d)",
2576 err);
2577 goto err_release_fw;
2578 }
2579
2580 if (status == BTMTK_WMT_PATCH_UNDONE) {
2581 break;
2582 } else if (status == BTMTK_WMT_PATCH_PROGRESS) {
2583 msleep(100);
2584 retry--;
2585 } else if (status == BTMTK_WMT_PATCH_DONE) {
2586 goto next_section;
2587 } else {
2588 bt_dev_err(hdev, "Failed wmt patch dwnld status (%d)",
2589 status);
2590 err = -EIO;
2591 goto err_release_fw;
2592 }
2593 }
2594
2595 fw_ptr += section_offset;
2596 wmt_params.op = BTMTK_WMT_PATCH_DWNLD;
2597 wmt_params.status = NULL;
2598
2599 while (dl_size > 0) {
2600 dlen = min_t(int, 250, dl_size);
2601 if (first_block == 1) {
2602 flag = 1;
2603 first_block = 0;
2604 } else if (dl_size - dlen <= 0) {
2605 flag = 3;
2606 } else {
2607 flag = 2;
2608 }
2609
2610 wmt_params.flag = flag;
2611 wmt_params.dlen = dlen;
2612 wmt_params.data = fw_ptr;
2613
2614 err = btusb_mtk_hci_wmt_sync(hdev, &wmt_params);
2615 if (err < 0) {
2616 bt_dev_err(hdev, "Failed to send wmt patch dwnld (%d)",
2617 err);
2618 goto err_release_fw;
2619 }
2620
2621 dl_size -= dlen;
2622 fw_ptr += dlen;
2623 }
2624 }
2625 next_section:
2626 continue;
2627 }
2628 /* Wait a few moments for firmware activation done */
2629 usleep_range(100000, 120000);
2630
2631 err_release_fw:
2632 release_firmware(fw);
2633
2634 return err;
2635 }
2636
2637 static int btusb_mtk_setup_firmware(struct hci_dev *hdev, const char *fwname)
2638 {
2639 struct btmtk_hci_wmt_params wmt_params;
2640 const struct firmware *fw;
2641 const u8 *fw_ptr;
2642 size_t fw_size;
2643 int err, dlen;
2644 u8 flag, param;
2645
2646 err = request_firmware(&fw, fwname, &hdev->dev);
2647 if (err < 0) {
2648 bt_dev_err(hdev, "Failed to load firmware file (%d)", err);
2649 return err;
2650 }
2651
2652 /* Power on data RAM the firmware relies on. */
2653 param = 1;
2654 wmt_params.op = BTMTK_WMT_FUNC_CTRL;
2655 wmt_params.flag = 3;
2656 wmt_params.dlen = sizeof(param);
2657 wmt_params.data = &param;
2658 wmt_params.status = NULL;
2659
2660 err = btusb_mtk_hci_wmt_sync(hdev, &wmt_params);
2661 if (err < 0) {
2662 bt_dev_err(hdev, "Failed to power on data RAM (%d)", err);
2663 goto err_release_fw;
2664 }
2665
2666 fw_ptr = fw->data;
2667 fw_size = fw->size;
2668
2669 /* The size of patch header is 30 bytes, should be skip */
2670 if (fw_size < 30) {
2671 err = -EINVAL;
2672 goto err_release_fw;
2673 }
2674
2675 fw_size -= 30;
2676 fw_ptr += 30;
2677 flag = 1;
2678
2679 wmt_params.op = BTMTK_WMT_PATCH_DWNLD;
2680 wmt_params.status = NULL;
2681
2682 while (fw_size > 0) {
2683 dlen = min_t(int, 250, fw_size);
2684
2685 /* Tell device the position in sequence */
2686 if (fw_size - dlen <= 0)
2687 flag = 3;
2688 else if (fw_size < fw->size - 30)
2689 flag = 2;
2690
2691 wmt_params.flag = flag;
2692 wmt_params.dlen = dlen;
2693 wmt_params.data = fw_ptr;
2694
2695 err = btusb_mtk_hci_wmt_sync(hdev, &wmt_params);
2696 if (err < 0) {
2697 bt_dev_err(hdev, "Failed to send wmt patch dwnld (%d)",
2698 err);
2699 goto err_release_fw;
2700 }
2701
2702 fw_size -= dlen;
2703 fw_ptr += dlen;
2704 }
2705
2706 wmt_params.op = BTMTK_WMT_RST;
2707 wmt_params.flag = 4;
2708 wmt_params.dlen = 0;
2709 wmt_params.data = NULL;
2710 wmt_params.status = NULL;
2711
2712 /* Activate funciton the firmware providing to */
2713 err = btusb_mtk_hci_wmt_sync(hdev, &wmt_params);
2714 if (err < 0) {
2715 bt_dev_err(hdev, "Failed to send wmt rst (%d)", err);
2716 goto err_release_fw;
2717 }
2718
2719 /* Wait a few moments for firmware activation done */
2720 usleep_range(10000, 12000);
2721
2722 err_release_fw:
2723 release_firmware(fw);
2724
2725 return err;
2726 }
2727
2728 static int btusb_mtk_func_query(struct hci_dev *hdev)
2729 {
2730 struct btmtk_hci_wmt_params wmt_params;
2731 int status, err;
2732 u8 param = 0;
2733
2734 /* Query whether the function is enabled */
2735 wmt_params.op = BTMTK_WMT_FUNC_CTRL;
2736 wmt_params.flag = 4;
2737 wmt_params.dlen = sizeof(param);
2738 wmt_params.data = &param;
2739 wmt_params.status = &status;
2740
2741 err = btusb_mtk_hci_wmt_sync(hdev, &wmt_params);
2742 if (err < 0) {
2743 bt_dev_err(hdev, "Failed to query function status (%d)", err);
2744 return err;
2745 }
2746
2747 return status;
2748 }
2749
2750 static int btusb_mtk_uhw_reg_write(struct btusb_data *data, u32 reg, u32 val)
2751 {
2752 struct hci_dev *hdev = data->hdev;
2753 int pipe, err;
2754 void *buf;
2755
2756 buf = kzalloc(4, GFP_KERNEL);
2757 if (!buf)
2758 return -ENOMEM;
2759
2760 put_unaligned_le32(val, buf);
2761
2762 pipe = usb_sndctrlpipe(data->udev, 0);
2763 err = usb_control_msg(data->udev, pipe, 0x02,
2764 0x5E,
2765 reg >> 16, reg & 0xffff,
2766 buf, 4, USB_CTRL_SET_TIMEOUT);
2767 if (err < 0) {
2768 bt_dev_err(hdev, "Failed to write uhw reg(%d)", err);
2769 goto err_free_buf;
2770 }
2771
2772 err_free_buf:
2773 kfree(buf);
2774
2775 return err;
2776 }
2777
2778 static int btusb_mtk_uhw_reg_read(struct btusb_data *data, u32 reg, u32 *val)
2779 {
2780 struct hci_dev *hdev = data->hdev;
2781 int pipe, err;
2782 void *buf;
2783
2784 buf = kzalloc(4, GFP_KERNEL);
2785 if (!buf)
2786 return -ENOMEM;
2787
2788 pipe = usb_rcvctrlpipe(data->udev, 0);
2789 err = usb_control_msg(data->udev, pipe, 0x01,
2790 0xDE,
2791 reg >> 16, reg & 0xffff,
2792 buf, 4, USB_CTRL_SET_TIMEOUT);
2793 if (err < 0) {
2794 bt_dev_err(hdev, "Failed to read uhw reg(%d)", err);
2795 goto err_free_buf;
2796 }
2797
2798 *val = get_unaligned_le32(buf);
2799 bt_dev_dbg(hdev, "reg=%x, value=0x%08x", reg, *val);
2800
2801 err_free_buf:
2802 kfree(buf);
2803
2804 return err;
2805 }
2806
2807 static int btusb_mtk_reg_read(struct btusb_data *data, u32 reg, u32 *val)
2808 {
2809 int pipe, err, size = sizeof(u32);
2810 void *buf;
2811
2812 buf = kzalloc(size, GFP_KERNEL);
2813 if (!buf)
2814 return -ENOMEM;
2815
2816 pipe = usb_rcvctrlpipe(data->udev, 0);
2817 err = usb_control_msg(data->udev, pipe, 0x63,
2818 USB_TYPE_VENDOR | USB_DIR_IN,
2819 reg >> 16, reg & 0xffff,
2820 buf, size, USB_CTRL_SET_TIMEOUT);
2821 if (err < 0)
2822 goto err_free_buf;
2823
2824 *val = get_unaligned_le32(buf);
2825
2826 err_free_buf:
2827 kfree(buf);
2828
2829 return err;
2830 }
2831
2832 static int btusb_mtk_id_get(struct btusb_data *data, u32 reg, u32 *id)
2833 {
2834 return btusb_mtk_reg_read(data, reg, id);
2835 }
2836
2837 static int btusb_mtk_setup(struct hci_dev *hdev)
2838 {
2839 struct btusb_data *data = hci_get_drvdata(hdev);
2840 struct btmtk_hci_wmt_params wmt_params;
2841 ktime_t calltime, delta, rettime;
2842 struct btmtk_tci_sleep tci_sleep;
2843 unsigned long long duration;
2844 struct sk_buff *skb;
2845 const char *fwname;
2846 int err, status;
2847 u32 dev_id;
2848 char fw_bin_name[64];
2849 u32 fw_version = 0;
2850 u8 param;
2851
2852 calltime = ktime_get();
2853
2854 err = btusb_mtk_id_get(data, 0x80000008, &dev_id);
2855 if (err < 0) {
2856 bt_dev_err(hdev, "Failed to get device id (%d)", err);
2857 return err;
2858 }
2859
2860 if (!dev_id) {
2861 err = btusb_mtk_id_get(data, 0x70010200, &dev_id);
2862 if (err < 0) {
2863 bt_dev_err(hdev, "Failed to get device id (%d)", err);
2864 return err;
2865 }
2866 err = btusb_mtk_id_get(data, 0x80021004, &fw_version);
2867 if (err < 0) {
2868 bt_dev_err(hdev, "Failed to get fw version (%d)", err);
2869 return err;
2870 }
2871 }
2872
2873 switch (dev_id) {
2874 case 0x7663:
2875 fwname = FIRMWARE_MT7663;
2876 break;
2877 case 0x7668:
2878 fwname = FIRMWARE_MT7668;
2879 break;
2880 case 0x7922:
2881 case 0x7961:
2882 snprintf(fw_bin_name, sizeof(fw_bin_name),
2883 "mediatek/BT_RAM_CODE_MT%04x_1_%x_hdr.bin",
2884 dev_id & 0xffff, (fw_version & 0xff) + 1);
2885 err = btusb_mtk_setup_firmware_79xx(hdev, fw_bin_name);
2886 if (err < 0) {
2887 bt_dev_err(hdev, "Failed to set up firmware (%d)", err);
2888 return err;
2889 }
2890
2891 /* It's Device EndPoint Reset Option Register */
2892 btusb_mtk_uhw_reg_write(data, MTK_EP_RST_OPT, MTK_EP_RST_IN_OUT_OPT);
2893
2894 /* Enable Bluetooth protocol */
2895 param = 1;
2896 wmt_params.op = BTMTK_WMT_FUNC_CTRL;
2897 wmt_params.flag = 0;
2898 wmt_params.dlen = sizeof(param);
2899 wmt_params.data = &param;
2900 wmt_params.status = NULL;
2901
2902 err = btusb_mtk_hci_wmt_sync(hdev, &wmt_params);
2903 if (err < 0) {
2904 bt_dev_err(hdev, "Failed to send wmt func ctrl (%d)", err);
2905 return err;
2906 }
2907
2908 hci_set_msft_opcode(hdev, 0xFD30);
2909 hci_set_aosp_capable(hdev);
2910 goto done;
2911 default:
2912 bt_dev_err(hdev, "Unsupported hardware variant (%08x)",
2913 dev_id);
2914 return -ENODEV;
2915 }
2916
2917 /* Query whether the firmware is already download */
2918 wmt_params.op = BTMTK_WMT_SEMAPHORE;
2919 wmt_params.flag = 1;
2920 wmt_params.dlen = 0;
2921 wmt_params.data = NULL;
2922 wmt_params.status = &status;
2923
2924 err = btusb_mtk_hci_wmt_sync(hdev, &wmt_params);
2925 if (err < 0) {
2926 bt_dev_err(hdev, "Failed to query firmware status (%d)", err);
2927 return err;
2928 }
2929
2930 if (status == BTMTK_WMT_PATCH_DONE) {
2931 bt_dev_info(hdev, "firmware already downloaded");
2932 goto ignore_setup_fw;
2933 }
2934
2935 /* Setup a firmware which the device definitely requires */
2936 err = btusb_mtk_setup_firmware(hdev, fwname);
2937 if (err < 0)
2938 return err;
2939
2940 ignore_setup_fw:
2941 err = readx_poll_timeout(btusb_mtk_func_query, hdev, status,
2942 status < 0 || status != BTMTK_WMT_ON_PROGRESS,
2943 2000, 5000000);
2944 /* -ETIMEDOUT happens */
2945 if (err < 0)
2946 return err;
2947
2948 /* The other errors happen in btusb_mtk_func_query */
2949 if (status < 0)
2950 return status;
2951
2952 if (status == BTMTK_WMT_ON_DONE) {
2953 bt_dev_info(hdev, "function already on");
2954 goto ignore_func_on;
2955 }
2956
2957 /* Enable Bluetooth protocol */
2958 param = 1;
2959 wmt_params.op = BTMTK_WMT_FUNC_CTRL;
2960 wmt_params.flag = 0;
2961 wmt_params.dlen = sizeof(param);
2962 wmt_params.data = &param;
2963 wmt_params.status = NULL;
2964
2965 err = btusb_mtk_hci_wmt_sync(hdev, &wmt_params);
2966 if (err < 0) {
2967 bt_dev_err(hdev, "Failed to send wmt func ctrl (%d)", err);
2968 return err;
2969 }
2970
2971 ignore_func_on:
2972 /* Apply the low power environment setup */
2973 tci_sleep.mode = 0x5;
2974 tci_sleep.duration = cpu_to_le16(0x640);
2975 tci_sleep.host_duration = cpu_to_le16(0x640);
2976 tci_sleep.host_wakeup_pin = 0;
2977 tci_sleep.time_compensation = 0;
2978
2979 skb = __hci_cmd_sync(hdev, 0xfc7a, sizeof(tci_sleep), &tci_sleep,
2980 HCI_INIT_TIMEOUT);
2981 if (IS_ERR(skb)) {
2982 err = PTR_ERR(skb);
2983 bt_dev_err(hdev, "Failed to apply low power setting (%d)", err);
2984 return err;
2985 }
2986 kfree_skb(skb);
2987
2988 done:
2989 rettime = ktime_get();
2990 delta = ktime_sub(rettime, calltime);
2991 duration = (unsigned long long)ktime_to_ns(delta) >> 10;
2992
2993 bt_dev_info(hdev, "Device setup in %llu usecs", duration);
2994
2995 return 0;
2996 }
2997
2998 static int btusb_mtk_shutdown(struct hci_dev *hdev)
2999 {
3000 struct btmtk_hci_wmt_params wmt_params;
3001 u8 param = 0;
3002 int err;
3003
3004 /* Disable the device */
3005 wmt_params.op = BTMTK_WMT_FUNC_CTRL;
3006 wmt_params.flag = 0;
3007 wmt_params.dlen = sizeof(param);
3008 wmt_params.data = &param;
3009 wmt_params.status = NULL;
3010
3011 err = btusb_mtk_hci_wmt_sync(hdev, &wmt_params);
3012 if (err < 0) {
3013 bt_dev_err(hdev, "Failed to send wmt func ctrl (%d)", err);
3014 return err;
3015 }
3016
3017 return 0;
3018 }
3019
3020 static void btusb_mtk_cmd_timeout(struct hci_dev *hdev)
3021 {
3022 struct btusb_data *data = hci_get_drvdata(hdev);
3023 u32 val;
3024 int err, retry = 0;
3025
3026 /* It's MediaTek specific bluetooth reset mechanism via USB */
3027 if (test_and_set_bit(BTUSB_HW_RESET_ACTIVE, &data->flags)) {
3028 bt_dev_err(hdev, "last reset failed? Not resetting again");
3029 return;
3030 }
3031
3032 err = usb_autopm_get_interface(data->intf);
3033 if (err < 0)
3034 return;
3035
3036 btusb_stop_traffic(data);
3037 usb_kill_anchored_urbs(&data->tx_anchor);
3038
3039 /* It's Device EndPoint Reset Option Register */
3040 bt_dev_dbg(hdev, "Initiating reset mechanism via uhw");
3041 btusb_mtk_uhw_reg_write(data, MTK_EP_RST_OPT, MTK_EP_RST_IN_OUT_OPT);
3042 btusb_mtk_uhw_reg_read(data, MTK_BT_WDT_STATUS, &val);
3043
3044 /* Reset the bluetooth chip via USB interface. */
3045 btusb_mtk_uhw_reg_write(data, MTK_BT_SUBSYS_RST, 1);
3046 btusb_mtk_uhw_reg_write(data, MTK_UDMA_INT_STA_BT, 0x000000FF);
3047 btusb_mtk_uhw_reg_read(data, MTK_UDMA_INT_STA_BT, &val);
3048 btusb_mtk_uhw_reg_write(data, MTK_UDMA_INT_STA_BT1, 0x000000FF);
3049 btusb_mtk_uhw_reg_read(data, MTK_UDMA_INT_STA_BT1, &val);
3050 /* MT7921 need to delay 20ms between toggle reset bit */
3051 msleep(20);
3052 btusb_mtk_uhw_reg_write(data, MTK_BT_SUBSYS_RST, 0);
3053 btusb_mtk_uhw_reg_read(data, MTK_BT_SUBSYS_RST, &val);
3054
3055 /* Poll the register until reset is completed */
3056 do {
3057 btusb_mtk_uhw_reg_read(data, MTK_BT_MISC, &val);
3058 if (val & MTK_BT_RST_DONE) {
3059 bt_dev_dbg(hdev, "Bluetooth Reset Successfully");
3060 break;
3061 }
3062
3063 bt_dev_dbg(hdev, "Polling Bluetooth Reset CR");
3064 retry++;
3065 msleep(MTK_BT_RESET_WAIT_MS);
3066 } while (retry < MTK_BT_RESET_NUM_TRIES);
3067
3068 btusb_mtk_id_get(data, 0x70010200, &val);
3069 if (!val)
3070 bt_dev_err(hdev, "Can't get device id, subsys reset fail.");
3071
3072 usb_queue_reset_device(data->intf);
3073
3074 clear_bit(BTUSB_HW_RESET_ACTIVE, &data->flags);
3075 }
3076
3077 static int btusb_recv_acl_mtk(struct hci_dev *hdev, struct sk_buff *skb)
3078 {
3079 struct btusb_data *data = hci_get_drvdata(hdev);
3080 u16 handle = le16_to_cpu(hci_acl_hdr(skb)->handle);
3081
3082 switch (handle) {
3083 case 0xfc6f: /* Firmware dump from device */
3084 /* When the firmware hangs, the device can no longer
3085 * suspend and thus disable auto-suspend.
3086 */
3087 usb_disable_autosuspend(data->udev);
3088 fallthrough;
3089 case 0x05ff: /* Firmware debug logging 1 */
3090 case 0x05fe: /* Firmware debug logging 2 */
3091 return hci_recv_diag(hdev, skb);
3092 }
3093
3094 return hci_recv_frame(hdev, skb);
3095 }
3096
3097 MODULE_FIRMWARE(FIRMWARE_MT7663);
3098 MODULE_FIRMWARE(FIRMWARE_MT7668);
3099
3100 #ifdef CONFIG_PM
3101 /* Configure an out-of-band gpio as wake-up pin, if specified in device tree */
3102 static int marvell_config_oob_wake(struct hci_dev *hdev)
3103 {
3104 struct sk_buff *skb;
3105 struct btusb_data *data = hci_get_drvdata(hdev);
3106 struct device *dev = &data->udev->dev;
3107 u16 pin, gap, opcode;
3108 int ret;
3109 u8 cmd[5];
3110
3111 /* Move on if no wakeup pin specified */
3112 if (of_property_read_u16(dev->of_node, "marvell,wakeup-pin", &pin) ||
3113 of_property_read_u16(dev->of_node, "marvell,wakeup-gap-ms", &gap))
3114 return 0;
3115
3116 /* Vendor specific command to configure a GPIO as wake-up pin */
3117 opcode = hci_opcode_pack(0x3F, 0x59);
3118 cmd[0] = opcode & 0xFF;
3119 cmd[1] = opcode >> 8;
3120 cmd[2] = 2; /* length of parameters that follow */
3121 cmd[3] = pin;
3122 cmd[4] = gap; /* time in ms, for which wakeup pin should be asserted */
3123
3124 skb = bt_skb_alloc(sizeof(cmd), GFP_KERNEL);
3125 if (!skb) {
3126 bt_dev_err(hdev, "%s: No memory", __func__);
3127 return -ENOMEM;
3128 }
3129
3130 skb_put_data(skb, cmd, sizeof(cmd));
3131 hci_skb_pkt_type(skb) = HCI_COMMAND_PKT;
3132
3133 ret = btusb_send_frame(hdev, skb);
3134 if (ret) {
3135 bt_dev_err(hdev, "%s: configuration failed", __func__);
3136 kfree_skb(skb);
3137 return ret;
3138 }
3139
3140 return 0;
3141 }
3142 #endif
3143
3144 static int btusb_set_bdaddr_marvell(struct hci_dev *hdev,
3145 const bdaddr_t *bdaddr)
3146 {
3147 struct sk_buff *skb;
3148 u8 buf[8];
3149 long ret;
3150
3151 buf[0] = 0xfe;
3152 buf[1] = sizeof(bdaddr_t);
3153 memcpy(buf + 2, bdaddr, sizeof(bdaddr_t));
3154
3155 skb = __hci_cmd_sync(hdev, 0xfc22, sizeof(buf), buf, HCI_INIT_TIMEOUT);
3156 if (IS_ERR(skb)) {
3157 ret = PTR_ERR(skb);
3158 bt_dev_err(hdev, "changing Marvell device address failed (%ld)",
3159 ret);
3160 return ret;
3161 }
3162 kfree_skb(skb);
3163
3164 return 0;
3165 }
3166
3167 #define BTUSB_EDGE_LED_COMMAND 0xfc77
3168
3169 static void btusb_edge_set_led(struct hci_dev *hdev, bool state)
3170 {
3171 struct sk_buff *skb;
3172 u8 config_led[] = { 0x09, 0x00, 0x01, 0x01 };
3173
3174 if (state)
3175 config_led[1] = 0x01;
3176
3177 skb = __hci_cmd_sync(hdev, BTUSB_EDGE_LED_COMMAND, sizeof(config_led), config_led, HCI_INIT_TIMEOUT);
3178 if (IS_ERR(skb))
3179 BT_ERR("%s fail to set LED (%ld)", hdev->name, PTR_ERR(skb));
3180 else
3181 kfree_skb(skb);
3182 }
3183
3184 static int btusb_edge_post_init(struct hci_dev *hdev)
3185 {
3186 btusb_edge_set_led(hdev, true);
3187 return 0;
3188 }
3189
3190 static int btusb_edge_shutdown(struct hci_dev *hdev)
3191 {
3192 btusb_edge_set_led(hdev, false);
3193 return 0;
3194 }
3195
3196 static int btusb_set_bdaddr_ath3012(struct hci_dev *hdev,
3197 const bdaddr_t *bdaddr)
3198 {
3199 struct sk_buff *skb;
3200 u8 buf[10];
3201 long ret;
3202
3203 buf[0] = 0x01;
3204 buf[1] = 0x01;
3205 buf[2] = 0x00;
3206 buf[3] = sizeof(bdaddr_t);
3207 memcpy(buf + 4, bdaddr, sizeof(bdaddr_t));
3208
3209 skb = __hci_cmd_sync(hdev, 0xfc0b, sizeof(buf), buf, HCI_INIT_TIMEOUT);
3210 if (IS_ERR(skb)) {
3211 ret = PTR_ERR(skb);
3212 bt_dev_err(hdev, "Change address command failed (%ld)", ret);
3213 return ret;
3214 }
3215 kfree_skb(skb);
3216
3217 return 0;
3218 }
3219
3220 static int btusb_set_bdaddr_wcn6855(struct hci_dev *hdev,
3221 const bdaddr_t *bdaddr)
3222 {
3223 struct sk_buff *skb;
3224 u8 buf[6];
3225 long ret;
3226
3227 memcpy(buf, bdaddr, sizeof(bdaddr_t));
3228
3229 skb = __hci_cmd_sync_ev(hdev, 0xfc14, sizeof(buf), buf,
3230 HCI_EV_CMD_COMPLETE, HCI_INIT_TIMEOUT);
3231 if (IS_ERR(skb)) {
3232 ret = PTR_ERR(skb);
3233 bt_dev_err(hdev, "Change address command failed (%ld)", ret);
3234 return ret;
3235 }
3236 kfree_skb(skb);
3237
3238 return 0;
3239 }
3240
3241 #define QCA_DFU_PACKET_LEN 4096
3242
3243 #define QCA_GET_TARGET_VERSION 0x09
3244 #define QCA_CHECK_STATUS 0x05
3245 #define QCA_DFU_DOWNLOAD 0x01
3246
3247 #define QCA_SYSCFG_UPDATED 0x40
3248 #define QCA_PATCH_UPDATED 0x80
3249 #define QCA_DFU_TIMEOUT 3000
3250 #define QCA_FLAG_MULTI_NVM 0x80
3251 #define QCA_BT_RESET_WAIT_MS 100
3252
3253 #define WCN6855_2_0_RAM_VERSION_GF 0x400c1200
3254 #define WCN6855_2_1_RAM_VERSION_GF 0x400c1211
3255
3256 struct qca_version {
3257 __le32 rom_version;
3258 __le32 patch_version;
3259 __le32 ram_version;
3260 __u8 chip_id;
3261 __u8 platform_id;
3262 __le16 flag;
3263 __u8 reserved[4];
3264 } __packed;
3265
3266 struct qca_rampatch_version {
3267 __le16 rom_version_high;
3268 __le16 rom_version_low;
3269 __le16 patch_version;
3270 } __packed;
3271
3272 struct qca_device_info {
3273 u32 rom_version;
3274 u8 rampatch_hdr; /* length of header in rampatch */
3275 u8 nvm_hdr; /* length of header in NVM */
3276 u8 ver_offset; /* offset of version structure in rampatch */
3277 };
3278
3279 static const struct qca_device_info qca_devices_table[] = {
3280 { 0x00000100, 20, 4, 8 }, /* Rome 1.0 */
3281 { 0x00000101, 20, 4, 8 }, /* Rome 1.1 */
3282 { 0x00000200, 28, 4, 16 }, /* Rome 2.0 */
3283 { 0x00000201, 28, 4, 16 }, /* Rome 2.1 */
3284 { 0x00000300, 28, 4, 16 }, /* Rome 3.0 */
3285 { 0x00000302, 28, 4, 16 }, /* Rome 3.2 */
3286 { 0x00130100, 40, 4, 16 }, /* WCN6855 1.0 */
3287 { 0x00130200, 40, 4, 16 }, /* WCN6855 2.0 */
3288 { 0x00130201, 40, 4, 16 }, /* WCN6855 2.1 */
3289 };
3290
3291 static int btusb_qca_send_vendor_req(struct usb_device *udev, u8 request,
3292 void *data, u16 size)
3293 {
3294 int pipe, err;
3295 u8 *buf;
3296
3297 buf = kmalloc(size, GFP_KERNEL);
3298 if (!buf)
3299 return -ENOMEM;
3300
3301 /* Found some of USB hosts have IOT issues with ours so that we should
3302 * not wait until HCI layer is ready.
3303 */
3304 pipe = usb_rcvctrlpipe(udev, 0);
3305 err = usb_control_msg(udev, pipe, request, USB_TYPE_VENDOR | USB_DIR_IN,
3306 0, 0, buf, size, USB_CTRL_SET_TIMEOUT);
3307 if (err < 0) {
3308 dev_err(&udev->dev, "Failed to access otp area (%d)", err);
3309 goto done;
3310 }
3311
3312 memcpy(data, buf, size);
3313
3314 done:
3315 kfree(buf);
3316
3317 return err;
3318 }
3319
3320 static int btusb_setup_qca_download_fw(struct hci_dev *hdev,
3321 const struct firmware *firmware,
3322 size_t hdr_size)
3323 {
3324 struct btusb_data *btdata = hci_get_drvdata(hdev);
3325 struct usb_device *udev = btdata->udev;
3326 size_t count, size, sent = 0;
3327 int pipe, len, err;
3328 u8 *buf;
3329
3330 buf = kmalloc(QCA_DFU_PACKET_LEN, GFP_KERNEL);
3331 if (!buf)
3332 return -ENOMEM;
3333
3334 count = firmware->size;
3335
3336 size = min_t(size_t, count, hdr_size);
3337 memcpy(buf, firmware->data, size);
3338
3339 /* USB patches should go down to controller through USB path
3340 * because binary format fits to go down through USB channel.
3341 * USB control path is for patching headers and USB bulk is for
3342 * patch body.
3343 */
3344 pipe = usb_sndctrlpipe(udev, 0);
3345 err = usb_control_msg(udev, pipe, QCA_DFU_DOWNLOAD, USB_TYPE_VENDOR,
3346 0, 0, buf, size, USB_CTRL_SET_TIMEOUT);
3347 if (err < 0) {
3348 bt_dev_err(hdev, "Failed to send headers (%d)", err);
3349 goto done;
3350 }
3351
3352 sent += size;
3353 count -= size;
3354
3355 /* ep2 need time to switch from function acl to function dfu,
3356 * so we add 20ms delay here.
3357 */
3358 msleep(20);
3359
3360 while (count) {
3361 size = min_t(size_t, count, QCA_DFU_PACKET_LEN);
3362
3363 memcpy(buf, firmware->data + sent, size);
3364
3365 pipe = usb_sndbulkpipe(udev, 0x02);
3366 err = usb_bulk_msg(udev, pipe, buf, size, &len,
3367 QCA_DFU_TIMEOUT);
3368 if (err < 0) {
3369 bt_dev_err(hdev, "Failed to send body at %zd of %zd (%d)",
3370 sent, firmware->size, err);
3371 break;
3372 }
3373
3374 if (size != len) {
3375 bt_dev_err(hdev, "Failed to get bulk buffer");
3376 err = -EILSEQ;
3377 break;
3378 }
3379
3380 sent += size;
3381 count -= size;
3382 }
3383
3384 done:
3385 kfree(buf);
3386 return err;
3387 }
3388
3389 static int btusb_setup_qca_load_rampatch(struct hci_dev *hdev,
3390 struct qca_version *ver,
3391 const struct qca_device_info *info)
3392 {
3393 struct qca_rampatch_version *rver;
3394 const struct firmware *fw;
3395 u32 ver_rom, ver_patch, rver_rom;
3396 u16 rver_rom_low, rver_rom_high, rver_patch;
3397 char fwname[64];
3398 int err;
3399
3400 ver_rom = le32_to_cpu(ver->rom_version);
3401 ver_patch = le32_to_cpu(ver->patch_version);
3402
3403 snprintf(fwname, sizeof(fwname), "qca/rampatch_usb_%08x.bin", ver_rom);
3404
3405 err = request_firmware(&fw, fwname, &hdev->dev);
3406 if (err) {
3407 bt_dev_err(hdev, "failed to request rampatch file: %s (%d)",
3408 fwname, err);
3409 return err;
3410 }
3411
3412 bt_dev_info(hdev, "using rampatch file: %s", fwname);
3413
3414 rver = (struct qca_rampatch_version *)(fw->data + info->ver_offset);
3415 rver_rom_low = le16_to_cpu(rver->rom_version_low);
3416 rver_patch = le16_to_cpu(rver->patch_version);
3417
3418 if (ver_rom & ~0xffffU) {
3419 rver_rom_high = le16_to_cpu(rver->rom_version_high);
3420 rver_rom = le32_to_cpu(rver_rom_high << 16 | rver_rom_low);
3421 } else {
3422 rver_rom = rver_rom_low;
3423 }
3424
3425 bt_dev_info(hdev, "QCA: patch rome 0x%x build 0x%x, "
3426 "firmware rome 0x%x build 0x%x",
3427 rver_rom, rver_patch, ver_rom, ver_patch);
3428
3429 if (rver_rom != ver_rom || rver_patch <= ver_patch) {
3430 bt_dev_err(hdev, "rampatch file version did not match with firmware");
3431 err = -EINVAL;
3432 goto done;
3433 }
3434
3435 err = btusb_setup_qca_download_fw(hdev, fw, info->rampatch_hdr);
3436
3437 done:
3438 release_firmware(fw);
3439
3440 return err;
3441 }
3442
3443 static void btusb_generate_qca_nvm_name(char *fwname, size_t max_size,
3444 const struct qca_version *ver)
3445 {
3446 u32 rom_version = le32_to_cpu(ver->rom_version);
3447 u16 flag = le16_to_cpu(ver->flag);
3448
3449 if (((flag >> 8) & 0xff) == QCA_FLAG_MULTI_NVM) {
3450 /* The board_id should be split into two bytes
3451 * The 1st byte is chip ID, and the 2nd byte is platform ID
3452 * For example, board ID 0x010A, 0x01 is platform ID. 0x0A is chip ID
3453 * we have several platforms, and platform IDs are continuously added
3454 * Platform ID:
3455 * 0x00 is for Mobile
3456 * 0x01 is for X86
3457 * 0x02 is for Automotive
3458 * 0x03 is for Consumer electronic
3459 */
3460 u16 board_id = (ver->chip_id << 8) + ver->platform_id;
3461 const char *variant;
3462
3463 switch (le32_to_cpu(ver->ram_version)) {
3464 case WCN6855_2_0_RAM_VERSION_GF:
3465 case WCN6855_2_1_RAM_VERSION_GF:
3466 variant = "_gf";
3467 break;
3468 default:
3469 variant = "";
3470 break;
3471 }
3472
3473 if (board_id == 0) {
3474 snprintf(fwname, max_size, "qca/nvm_usb_%08x%s.bin",
3475 rom_version, variant);
3476 } else {
3477 snprintf(fwname, max_size, "qca/nvm_usb_%08x%s_%04x.bin",
3478 rom_version, variant, board_id);
3479 }
3480 } else {
3481 snprintf(fwname, max_size, "qca/nvm_usb_%08x.bin",
3482 rom_version);
3483 }
3484
3485 }
3486
3487 static int btusb_setup_qca_load_nvm(struct hci_dev *hdev,
3488 struct qca_version *ver,
3489 const struct qca_device_info *info)
3490 {
3491 const struct firmware *fw;
3492 char fwname[64];
3493 int err;
3494
3495 btusb_generate_qca_nvm_name(fwname, sizeof(fwname), ver);
3496
3497 err = request_firmware(&fw, fwname, &hdev->dev);
3498 if (err) {
3499 bt_dev_err(hdev, "failed to request NVM file: %s (%d)",
3500 fwname, err);
3501 return err;
3502 }
3503
3504 bt_dev_info(hdev, "using NVM file: %s", fwname);
3505
3506 err = btusb_setup_qca_download_fw(hdev, fw, info->nvm_hdr);
3507
3508 release_firmware(fw);
3509
3510 return err;
3511 }
3512
3513 /* identify the ROM version and check whether patches are needed */
3514 static bool btusb_qca_need_patch(struct usb_device *udev)
3515 {
3516 struct qca_version ver;
3517
3518 if (btusb_qca_send_vendor_req(udev, QCA_GET_TARGET_VERSION, &ver,
3519 sizeof(ver)) < 0)
3520 return false;
3521 /* only low ROM versions need patches */
3522 return !(le32_to_cpu(ver.rom_version) & ~0xffffU);
3523 }
3524
3525 static int btusb_setup_qca(struct hci_dev *hdev)
3526 {
3527 struct btusb_data *btdata = hci_get_drvdata(hdev);
3528 struct usb_device *udev = btdata->udev;
3529 const struct qca_device_info *info = NULL;
3530 struct qca_version ver;
3531 u32 ver_rom;
3532 u8 status;
3533 int i, err;
3534
3535 err = btusb_qca_send_vendor_req(udev, QCA_GET_TARGET_VERSION, &ver,
3536 sizeof(ver));
3537 if (err < 0)
3538 return err;
3539
3540 ver_rom = le32_to_cpu(ver.rom_version);
3541
3542 for (i = 0; i < ARRAY_SIZE(qca_devices_table); i++) {
3543 if (ver_rom == qca_devices_table[i].rom_version)
3544 info = &qca_devices_table[i];
3545 }
3546 if (!info) {
3547 /* If the rom_version is not matched in the qca_devices_table
3548 * and the high ROM version is not zero, we assume this chip no
3549 * need to load the rampatch and nvm.
3550 */
3551 if (ver_rom & ~0xffffU)
3552 return 0;
3553
3554 bt_dev_err(hdev, "don't support firmware rome 0x%x", ver_rom);
3555 return -ENODEV;
3556 }
3557
3558 err = btusb_qca_send_vendor_req(udev, QCA_CHECK_STATUS, &status,
3559 sizeof(status));
3560 if (err < 0)
3561 return err;
3562
3563 if (!(status & QCA_PATCH_UPDATED)) {
3564 err = btusb_setup_qca_load_rampatch(hdev, &ver, info);
3565 if (err < 0)
3566 return err;
3567 }
3568
3569 err = btusb_qca_send_vendor_req(udev, QCA_GET_TARGET_VERSION, &ver,
3570 sizeof(ver));
3571 if (err < 0)
3572 return err;
3573
3574 if (!(status & QCA_SYSCFG_UPDATED)) {
3575 err = btusb_setup_qca_load_nvm(hdev, &ver, info);
3576 if (err < 0)
3577 return err;
3578
3579 /* WCN6855 2.1 will reset to apply firmware downloaded here, so
3580 * wait ~100ms for reset Done then go ahead, otherwise, it maybe
3581 * cause potential enable failure.
3582 */
3583 if (info->rom_version == 0x00130201)
3584 msleep(QCA_BT_RESET_WAIT_MS);
3585 }
3586
3587 return 0;
3588 }
3589
3590 static inline int __set_diag_interface(struct hci_dev *hdev)
3591 {
3592 struct btusb_data *data = hci_get_drvdata(hdev);
3593 struct usb_interface *intf = data->diag;
3594 int i;
3595
3596 if (!data->diag)
3597 return -ENODEV;
3598
3599 data->diag_tx_ep = NULL;
3600 data->diag_rx_ep = NULL;
3601
3602 for (i = 0; i < intf->cur_altsetting->desc.bNumEndpoints; i++) {
3603 struct usb_endpoint_descriptor *ep_desc;
3604
3605 ep_desc = &intf->cur_altsetting->endpoint[i].desc;
3606
3607 if (!data->diag_tx_ep && usb_endpoint_is_bulk_out(ep_desc)) {
3608 data->diag_tx_ep = ep_desc;
3609 continue;
3610 }
3611
3612 if (!data->diag_rx_ep && usb_endpoint_is_bulk_in(ep_desc)) {
3613 data->diag_rx_ep = ep_desc;
3614 continue;
3615 }
3616 }
3617
3618 if (!data->diag_tx_ep || !data->diag_rx_ep) {
3619 bt_dev_err(hdev, "invalid diagnostic descriptors");
3620 return -ENODEV;
3621 }
3622
3623 return 0;
3624 }
3625
3626 static struct urb *alloc_diag_urb(struct hci_dev *hdev, bool enable)
3627 {
3628 struct btusb_data *data = hci_get_drvdata(hdev);
3629 struct sk_buff *skb;
3630 struct urb *urb;
3631 unsigned int pipe;
3632
3633 if (!data->diag_tx_ep)
3634 return ERR_PTR(-ENODEV);
3635
3636 urb = usb_alloc_urb(0, GFP_KERNEL);
3637 if (!urb)
3638 return ERR_PTR(-ENOMEM);
3639
3640 skb = bt_skb_alloc(2, GFP_KERNEL);
3641 if (!skb) {
3642 usb_free_urb(urb);
3643 return ERR_PTR(-ENOMEM);
3644 }
3645
3646 skb_put_u8(skb, 0xf0);
3647 skb_put_u8(skb, enable);
3648
3649 pipe = usb_sndbulkpipe(data->udev, data->diag_tx_ep->bEndpointAddress);
3650
3651 usb_fill_bulk_urb(urb, data->udev, pipe,
3652 skb->data, skb->len, btusb_tx_complete, skb);
3653
3654 skb->dev = (void *)hdev;
3655
3656 return urb;
3657 }
3658
3659 static int btusb_bcm_set_diag(struct hci_dev *hdev, bool enable)
3660 {
3661 struct btusb_data *data = hci_get_drvdata(hdev);
3662 struct urb *urb;
3663
3664 if (!data->diag)
3665 return -ENODEV;
3666
3667 if (!test_bit(HCI_RUNNING, &hdev->flags))
3668 return -ENETDOWN;
3669
3670 urb = alloc_diag_urb(hdev, enable);
3671 if (IS_ERR(urb))
3672 return PTR_ERR(urb);
3673
3674 return submit_or_queue_tx_urb(hdev, urb);
3675 }
3676
3677 #ifdef CONFIG_PM
3678 static irqreturn_t btusb_oob_wake_handler(int irq, void *priv)
3679 {
3680 struct btusb_data *data = priv;
3681
3682 pm_wakeup_event(&data->udev->dev, 0);
3683 pm_system_wakeup();
3684
3685 /* Disable only if not already disabled (keep it balanced) */
3686 if (test_and_clear_bit(BTUSB_OOB_WAKE_ENABLED, &data->flags)) {
3687 disable_irq_nosync(irq);
3688 disable_irq_wake(irq);
3689 }
3690 return IRQ_HANDLED;
3691 }
3692
3693 static const struct of_device_id btusb_match_table[] = {
3694 { .compatible = "usb1286,204e" },
3695 { .compatible = "usbcf3,e300" }, /* QCA6174A */
3696 { .compatible = "usb4ca,301a" }, /* QCA6174A (Lite-On) */
3697 { }
3698 };
3699 MODULE_DEVICE_TABLE(of, btusb_match_table);
3700
3701 /* Use an oob wakeup pin? */
3702 static int btusb_config_oob_wake(struct hci_dev *hdev)
3703 {
3704 struct btusb_data *data = hci_get_drvdata(hdev);
3705 struct device *dev = &data->udev->dev;
3706 int irq, ret;
3707
3708 clear_bit(BTUSB_OOB_WAKE_ENABLED, &data->flags);
3709
3710 if (!of_match_device(btusb_match_table, dev))
3711 return 0;
3712
3713 /* Move on if no IRQ specified */
3714 irq = of_irq_get_byname(dev->of_node, "wakeup");
3715 if (irq <= 0) {
3716 bt_dev_dbg(hdev, "%s: no OOB Wakeup IRQ in DT", __func__);
3717 return 0;
3718 }
3719
3720 irq_set_status_flags(irq, IRQ_NOAUTOEN);
3721 ret = devm_request_irq(&hdev->dev, irq, btusb_oob_wake_handler,
3722 0, "OOB Wake-on-BT", data);
3723 if (ret) {
3724 bt_dev_err(hdev, "%s: IRQ request failed", __func__);
3725 return ret;
3726 }
3727
3728 ret = device_init_wakeup(dev, true);
3729 if (ret) {
3730 bt_dev_err(hdev, "%s: failed to init_wakeup", __func__);
3731 return ret;
3732 }
3733
3734 data->oob_wake_irq = irq;
3735 bt_dev_info(hdev, "OOB Wake-on-BT configured at IRQ %u", irq);
3736 return 0;
3737 }
3738 #endif
3739
3740 static void btusb_check_needs_reset_resume(struct usb_interface *intf)
3741 {
3742 if (dmi_check_system(btusb_needs_reset_resume_table))
3743 interface_to_usbdev(intf)->quirks |= USB_QUIRK_RESET_RESUME;
3744 }
3745
3746 static bool btusb_prevent_wake(struct hci_dev *hdev)
3747 {
3748 struct btusb_data *data = hci_get_drvdata(hdev);
3749
3750 return !device_may_wakeup(&data->udev->dev);
3751 }
3752
3753 static int btusb_shutdown_qca(struct hci_dev *hdev)
3754 {
3755 struct sk_buff *skb;
3756
3757 skb = __hci_cmd_sync(hdev, HCI_OP_RESET, 0, NULL, HCI_INIT_TIMEOUT);
3758 if (IS_ERR(skb)) {
3759 bt_dev_err(hdev, "HCI reset during shutdown failed");
3760 return PTR_ERR(skb);
3761 }
3762 kfree_skb(skb);
3763
3764 return 0;
3765 }
3766
3767 static int btusb_probe(struct usb_interface *intf,
3768 const struct usb_device_id *id)
3769 {
3770 struct usb_endpoint_descriptor *ep_desc;
3771 struct gpio_desc *reset_gpio;
3772 struct btusb_data *data;
3773 struct hci_dev *hdev;
3774 unsigned ifnum_base;
3775 int i, err, priv_size;
3776
3777 BT_DBG("intf %p id %p", intf, id);
3778
3779 /* interface numbers are hardcoded in the spec */
3780 if (intf->cur_altsetting->desc.bInterfaceNumber != 0) {
3781 if (!(id->driver_info & BTUSB_IFNUM_2))
3782 return -ENODEV;
3783 if (intf->cur_altsetting->desc.bInterfaceNumber != 2)
3784 return -ENODEV;
3785 }
3786
3787 ifnum_base = intf->cur_altsetting->desc.bInterfaceNumber;
3788
3789 if (!id->driver_info) {
3790 const struct usb_device_id *match;
3791
3792 match = usb_match_id(intf, blacklist_table);
3793 if (match)
3794 id = match;
3795 }
3796
3797 if (id->driver_info == BTUSB_IGNORE)
3798 return -ENODEV;
3799
3800 if (id->driver_info & BTUSB_ATH3012) {
3801 struct usb_device *udev = interface_to_usbdev(intf);
3802
3803 /* Old firmware would otherwise let ath3k driver load
3804 * patch and sysconfig files
3805 */
3806 if (le16_to_cpu(udev->descriptor.bcdDevice) <= 0x0001 &&
3807 !btusb_qca_need_patch(udev))
3808 return -ENODEV;
3809 }
3810
3811 data = devm_kzalloc(&intf->dev, sizeof(*data), GFP_KERNEL);
3812 if (!data)
3813 return -ENOMEM;
3814
3815 for (i = 0; i < intf->cur_altsetting->desc.bNumEndpoints; i++) {
3816 ep_desc = &intf->cur_altsetting->endpoint[i].desc;
3817
3818 if (!data->intr_ep && usb_endpoint_is_int_in(ep_desc)) {
3819 data->intr_ep = ep_desc;
3820 continue;
3821 }
3822
3823 if (!data->bulk_tx_ep && usb_endpoint_is_bulk_out(ep_desc)) {
3824 data->bulk_tx_ep = ep_desc;
3825 continue;
3826 }
3827
3828 if (!data->bulk_rx_ep && usb_endpoint_is_bulk_in(ep_desc)) {
3829 data->bulk_rx_ep = ep_desc;
3830 continue;
3831 }
3832 }
3833
3834 if (!data->intr_ep || !data->bulk_tx_ep || !data->bulk_rx_ep)
3835 return -ENODEV;
3836
3837 if (id->driver_info & BTUSB_AMP) {
3838 data->cmdreq_type = USB_TYPE_CLASS | 0x01;
3839 data->cmdreq = 0x2b;
3840 } else {
3841 data->cmdreq_type = USB_TYPE_CLASS;
3842 data->cmdreq = 0x00;
3843 }
3844
3845 data->udev = interface_to_usbdev(intf);
3846 data->intf = intf;
3847
3848 INIT_WORK(&data->work, btusb_work);
3849 INIT_WORK(&data->waker, btusb_waker);
3850 init_usb_anchor(&data->deferred);
3851 init_usb_anchor(&data->tx_anchor);
3852 spin_lock_init(&data->txlock);
3853
3854 init_usb_anchor(&data->intr_anchor);
3855 init_usb_anchor(&data->bulk_anchor);
3856 init_usb_anchor(&data->isoc_anchor);
3857 init_usb_anchor(&data->diag_anchor);
3858 init_usb_anchor(&data->ctrl_anchor);
3859 spin_lock_init(&data->rxlock);
3860
3861 priv_size = 0;
3862
3863 data->recv_event = hci_recv_frame;
3864 data->recv_bulk = btusb_recv_bulk;
3865
3866 if (id->driver_info & BTUSB_INTEL_COMBINED) {
3867 /* Allocate extra space for Intel device */
3868 priv_size += sizeof(struct btintel_data);
3869
3870 /* Override the rx handlers */
3871 data->recv_event = btusb_recv_event_intel;
3872 data->recv_bulk = btusb_recv_bulk_intel;
3873 }
3874
3875 data->recv_acl = hci_recv_frame;
3876
3877 hdev = hci_alloc_dev_priv(priv_size);
3878 if (!hdev)
3879 return -ENOMEM;
3880
3881 hdev->bus = HCI_USB;
3882 hci_set_drvdata(hdev, data);
3883
3884 if (id->driver_info & BTUSB_AMP)
3885 hdev->dev_type = HCI_AMP;
3886 else
3887 hdev->dev_type = HCI_PRIMARY;
3888
3889 data->hdev = hdev;
3890
3891 SET_HCIDEV_DEV(hdev, &intf->dev);
3892
3893 reset_gpio = gpiod_get_optional(&data->udev->dev, "reset",
3894 GPIOD_OUT_LOW);
3895 if (IS_ERR(reset_gpio)) {
3896 err = PTR_ERR(reset_gpio);
3897 goto out_free_dev;
3898 } else if (reset_gpio) {
3899 data->reset_gpio = reset_gpio;
3900 }
3901
3902 hdev->open = btusb_open;
3903 hdev->close = btusb_close;
3904 hdev->flush = btusb_flush;
3905 hdev->send = btusb_send_frame;
3906 hdev->notify = btusb_notify;
3907 hdev->prevent_wake = btusb_prevent_wake;
3908
3909 #ifdef CONFIG_PM
3910 err = btusb_config_oob_wake(hdev);
3911 if (err)
3912 goto out_free_dev;
3913
3914 /* Marvell devices may need a specific chip configuration */
3915 if (id->driver_info & BTUSB_MARVELL && data->oob_wake_irq) {
3916 err = marvell_config_oob_wake(hdev);
3917 if (err)
3918 goto out_free_dev;
3919 }
3920 #endif
3921 if (id->driver_info & BTUSB_CW6622)
3922 set_bit(HCI_QUIRK_BROKEN_STORED_LINK_KEY, &hdev->quirks);
3923
3924 if (id->driver_info & BTUSB_BCM2045)
3925 set_bit(HCI_QUIRK_BROKEN_STORED_LINK_KEY, &hdev->quirks);
3926
3927 if (id->driver_info & BTUSB_BCM92035)
3928 hdev->setup = btusb_setup_bcm92035;
3929
3930 if (IS_ENABLED(CONFIG_BT_HCIBTUSB_BCM) &&
3931 (id->driver_info & BTUSB_BCM_PATCHRAM)) {
3932 hdev->manufacturer = 15;
3933 hdev->setup = btbcm_setup_patchram;
3934 hdev->set_diag = btusb_bcm_set_diag;
3935 hdev->set_bdaddr = btbcm_set_bdaddr;
3936
3937 /* Broadcom LM_DIAG Interface numbers are hardcoded */
3938 data->diag = usb_ifnum_to_if(data->udev, ifnum_base + 2);
3939 }
3940
3941 if (IS_ENABLED(CONFIG_BT_HCIBTUSB_BCM) &&
3942 (id->driver_info & BTUSB_BCM_APPLE)) {
3943 hdev->manufacturer = 15;
3944 hdev->setup = btbcm_setup_apple;
3945 hdev->set_diag = btusb_bcm_set_diag;
3946
3947 /* Broadcom LM_DIAG Interface numbers are hardcoded */
3948 data->diag = usb_ifnum_to_if(data->udev, ifnum_base + 2);
3949 }
3950
3951 /* Combined Intel Device setup to support multiple setup routine */
3952 if (id->driver_info & BTUSB_INTEL_COMBINED) {
3953 err = btintel_configure_setup(hdev);
3954 if (err)
3955 goto out_free_dev;
3956
3957 /* Transport specific configuration */
3958 hdev->send = btusb_send_frame_intel;
3959 hdev->cmd_timeout = btusb_intel_cmd_timeout;
3960
3961 if (id->driver_info & BTUSB_INTEL_NO_WBS_SUPPORT)
3962 btintel_set_flag(hdev, INTEL_ROM_LEGACY_NO_WBS_SUPPORT);
3963
3964 if (id->driver_info & BTUSB_INTEL_BROKEN_INITIAL_NCMD)
3965 btintel_set_flag(hdev, INTEL_BROKEN_INITIAL_NCMD);
3966
3967 if (id->driver_info & BTUSB_INTEL_BROKEN_SHUTDOWN_LED)
3968 btintel_set_flag(hdev, INTEL_BROKEN_SHUTDOWN_LED);
3969 }
3970
3971 if (id->driver_info & BTUSB_MARVELL) {
3972 struct pci_dev *pdev;
3973 hdev->set_bdaddr = btusb_set_bdaddr_marvell;
3974 pdev = pci_get_subsys(PCI_ANY_ID, PCI_ANY_ID, 0x1028, 0x0720, NULL);
3975 if (!pdev)
3976 pdev = pci_get_subsys(PCI_ANY_ID, PCI_ANY_ID, 0x1028, 0x0733, NULL);
3977 if (pdev) {
3978 pci_dev_put(pdev);
3979 hdev->post_init = btusb_edge_post_init;
3980 hdev->shutdown = btusb_edge_shutdown;
3981 }
3982 }
3983
3984 if (IS_ENABLED(CONFIG_BT_HCIBTUSB_MTK) &&
3985 (id->driver_info & BTUSB_MEDIATEK)) {
3986 hdev->setup = btusb_mtk_setup;
3987 hdev->shutdown = btusb_mtk_shutdown;
3988 hdev->manufacturer = 70;
3989 hdev->cmd_timeout = btusb_mtk_cmd_timeout;
3990 set_bit(HCI_QUIRK_NON_PERSISTENT_SETUP, &hdev->quirks);
3991 data->recv_acl = btusb_recv_acl_mtk;
3992 }
3993
3994 if (id->driver_info & BTUSB_SWAVE) {
3995 set_bit(HCI_QUIRK_FIXUP_INQUIRY_MODE, &hdev->quirks);
3996 set_bit(HCI_QUIRK_BROKEN_LOCAL_COMMANDS, &hdev->quirks);
3997 }
3998
3999 if (id->driver_info & BTUSB_INTEL_BOOT) {
4000 hdev->manufacturer = 2;
4001 set_bit(HCI_QUIRK_RAW_DEVICE, &hdev->quirks);
4002 }
4003
4004 if (id->driver_info & BTUSB_ATH3012) {
4005 data->setup_on_usb = btusb_setup_qca;
4006 hdev->set_bdaddr = btusb_set_bdaddr_ath3012;
4007 set_bit(HCI_QUIRK_SIMULTANEOUS_DISCOVERY, &hdev->quirks);
4008 set_bit(HCI_QUIRK_STRICT_DUPLICATE_FILTER, &hdev->quirks);
4009 }
4010
4011 if (id->driver_info & BTUSB_QCA_ROME) {
4012 data->setup_on_usb = btusb_setup_qca;
4013 hdev->set_bdaddr = btusb_set_bdaddr_ath3012;
4014 hdev->cmd_timeout = btusb_qca_cmd_timeout;
4015 set_bit(HCI_QUIRK_SIMULTANEOUS_DISCOVERY, &hdev->quirks);
4016 btusb_check_needs_reset_resume(intf);
4017 }
4018
4019 if (id->driver_info & BTUSB_QCA_WCN6855) {
4020 data->setup_on_usb = btusb_setup_qca;
4021 hdev->shutdown = btusb_shutdown_qca;
4022 hdev->set_bdaddr = btusb_set_bdaddr_wcn6855;
4023 hdev->cmd_timeout = btusb_qca_cmd_timeout;
4024 set_bit(HCI_QUIRK_SIMULTANEOUS_DISCOVERY, &hdev->quirks);
4025 hci_set_msft_opcode(hdev, 0xFD70);
4026 }
4027
4028 if (id->driver_info & BTUSB_AMP) {
4029 /* AMP controllers do not support SCO packets */
4030 data->isoc = NULL;
4031 } else {
4032 /* Interface orders are hardcoded in the specification */
4033 data->isoc = usb_ifnum_to_if(data->udev, ifnum_base + 1);
4034 data->isoc_ifnum = ifnum_base + 1;
4035 }
4036
4037 if (IS_ENABLED(CONFIG_BT_HCIBTUSB_RTL) &&
4038 (id->driver_info & BTUSB_REALTEK)) {
4039 hdev->setup = btrtl_setup_realtek;
4040 hdev->shutdown = btrtl_shutdown_realtek;
4041 hdev->cmd_timeout = btusb_rtl_cmd_timeout;
4042
4043 /* Realtek devices need to set remote wakeup on auto-suspend */
4044 set_bit(BTUSB_WAKEUP_AUTOSUSPEND, &data->flags);
4045 set_bit(BTUSB_USE_ALT3_FOR_WBS, &data->flags);
4046 }
4047
4048 if (!reset)
4049 set_bit(HCI_QUIRK_RESET_ON_CLOSE, &hdev->quirks);
4050
4051 if (force_scofix || id->driver_info & BTUSB_WRONG_SCO_MTU) {
4052 if (!disable_scofix)
4053 set_bit(HCI_QUIRK_FIXUP_BUFFER_SIZE, &hdev->quirks);
4054 }
4055
4056 if (id->driver_info & BTUSB_BROKEN_ISOC)
4057 data->isoc = NULL;
4058
4059 if (id->driver_info & BTUSB_WIDEBAND_SPEECH)
4060 set_bit(HCI_QUIRK_WIDEBAND_SPEECH_SUPPORTED, &hdev->quirks);
4061
4062 if (id->driver_info & BTUSB_VALID_LE_STATES)
4063 set_bit(HCI_QUIRK_VALID_LE_STATES, &hdev->quirks);
4064
4065 if (id->driver_info & BTUSB_DIGIANSWER) {
4066 data->cmdreq_type = USB_TYPE_VENDOR;
4067 set_bit(HCI_QUIRK_RESET_ON_CLOSE, &hdev->quirks);
4068 }
4069
4070 if (id->driver_info & BTUSB_CSR) {
4071 struct usb_device *udev = data->udev;
4072 u16 bcdDevice = le16_to_cpu(udev->descriptor.bcdDevice);
4073
4074 /* Old firmware would otherwise execute USB reset */
4075 if (bcdDevice < 0x117)
4076 set_bit(HCI_QUIRK_RESET_ON_CLOSE, &hdev->quirks);
4077
4078 /* This must be set first in case we disable it for fakes */
4079 set_bit(HCI_QUIRK_SIMULTANEOUS_DISCOVERY, &hdev->quirks);
4080
4081 /* Fake CSR devices with broken commands */
4082 if (le16_to_cpu(udev->descriptor.idVendor) == 0x0a12 &&
4083 le16_to_cpu(udev->descriptor.idProduct) == 0x0001)
4084 hdev->setup = btusb_setup_csr;
4085 }
4086
4087 if (id->driver_info & BTUSB_SNIFFER) {
4088 struct usb_device *udev = data->udev;
4089
4090 /* New sniffer firmware has crippled HCI interface */
4091 if (le16_to_cpu(udev->descriptor.bcdDevice) > 0x997)
4092 set_bit(HCI_QUIRK_RAW_DEVICE, &hdev->quirks);
4093 }
4094
4095 if (id->driver_info & BTUSB_INTEL_BOOT) {
4096 /* A bug in the bootloader causes that interrupt interface is
4097 * only enabled after receiving SetInterface(0, AltSetting=0).
4098 */
4099 err = usb_set_interface(data->udev, 0, 0);
4100 if (err < 0) {
4101 BT_ERR("failed to set interface 0, alt 0 %d", err);
4102 goto out_free_dev;
4103 }
4104 }
4105
4106 if (data->isoc) {
4107 err = usb_driver_claim_interface(&btusb_driver,
4108 data->isoc, data);
4109 if (err < 0)
4110 goto out_free_dev;
4111 }
4112
4113 if (IS_ENABLED(CONFIG_BT_HCIBTUSB_BCM) && data->diag) {
4114 if (!usb_driver_claim_interface(&btusb_driver,
4115 data->diag, data))
4116 __set_diag_interface(hdev);
4117 else
4118 data->diag = NULL;
4119 }
4120
4121 if (enable_autosuspend)
4122 usb_enable_autosuspend(data->udev);
4123
4124 err = hci_register_dev(hdev);
4125 if (err < 0)
4126 goto out_free_dev;
4127
4128 usb_set_intfdata(intf, data);
4129
4130 return 0;
4131
4132 out_free_dev:
4133 if (data->reset_gpio)
4134 gpiod_put(data->reset_gpio);
4135 hci_free_dev(hdev);
4136 return err;
4137 }
4138
4139 static void btusb_disconnect(struct usb_interface *intf)
4140 {
4141 struct btusb_data *data = usb_get_intfdata(intf);
4142 struct hci_dev *hdev;
4143
4144 BT_DBG("intf %p", intf);
4145
4146 if (!data)
4147 return;
4148
4149 hdev = data->hdev;
4150 usb_set_intfdata(data->intf, NULL);
4151
4152 if (data->isoc)
4153 usb_set_intfdata(data->isoc, NULL);
4154
4155 if (data->diag)
4156 usb_set_intfdata(data->diag, NULL);
4157
4158 hci_unregister_dev(hdev);
4159
4160 if (intf == data->intf) {
4161 if (data->isoc)
4162 usb_driver_release_interface(&btusb_driver, data->isoc);
4163 if (data->diag)
4164 usb_driver_release_interface(&btusb_driver, data->diag);
4165 } else if (intf == data->isoc) {
4166 if (data->diag)
4167 usb_driver_release_interface(&btusb_driver, data->diag);
4168 usb_driver_release_interface(&btusb_driver, data->intf);
4169 } else if (intf == data->diag) {
4170 usb_driver_release_interface(&btusb_driver, data->intf);
4171 if (data->isoc)
4172 usb_driver_release_interface(&btusb_driver, data->isoc);
4173 }
4174
4175 if (data->oob_wake_irq)
4176 device_init_wakeup(&data->udev->dev, false);
4177
4178 if (data->reset_gpio)
4179 gpiod_put(data->reset_gpio);
4180
4181 hci_free_dev(hdev);
4182 }
4183
4184 #ifdef CONFIG_PM
4185 static int btusb_suspend(struct usb_interface *intf, pm_message_t message)
4186 {
4187 struct btusb_data *data = usb_get_intfdata(intf);
4188
4189 BT_DBG("intf %p", intf);
4190
4191 if (data->suspend_count++)
4192 return 0;
4193
4194 spin_lock_irq(&data->txlock);
4195 if (!(PMSG_IS_AUTO(message) && data->tx_in_flight)) {
4196 set_bit(BTUSB_SUSPENDING, &data->flags);
4197 spin_unlock_irq(&data->txlock);
4198 } else {
4199 spin_unlock_irq(&data->txlock);
4200 data->suspend_count--;
4201 return -EBUSY;
4202 }
4203
4204 cancel_work_sync(&data->work);
4205
4206 btusb_stop_traffic(data);
4207 usb_kill_anchored_urbs(&data->tx_anchor);
4208
4209 if (data->oob_wake_irq && device_may_wakeup(&data->udev->dev)) {
4210 set_bit(BTUSB_OOB_WAKE_ENABLED, &data->flags);
4211 enable_irq_wake(data->oob_wake_irq);
4212 enable_irq(data->oob_wake_irq);
4213 }
4214
4215 /* For global suspend, Realtek devices lose the loaded fw
4216 * in them. But for autosuspend, firmware should remain.
4217 * Actually, it depends on whether the usb host sends
4218 * set feature (enable wakeup) or not.
4219 */
4220 if (test_bit(BTUSB_WAKEUP_AUTOSUSPEND, &data->flags)) {
4221 if (PMSG_IS_AUTO(message) &&
4222 device_can_wakeup(&data->udev->dev))
4223 data->udev->do_remote_wakeup = 1;
4224 else if (!PMSG_IS_AUTO(message) &&
4225 !device_may_wakeup(&data->udev->dev)) {
4226 data->udev->do_remote_wakeup = 0;
4227 data->udev->reset_resume = 1;
4228 }
4229 }
4230
4231 return 0;
4232 }
4233
4234 static void play_deferred(struct btusb_data *data)
4235 {
4236 struct urb *urb;
4237 int err;
4238
4239 while ((urb = usb_get_from_anchor(&data->deferred))) {
4240 usb_anchor_urb(urb, &data->tx_anchor);
4241
4242 err = usb_submit_urb(urb, GFP_ATOMIC);
4243 if (err < 0) {
4244 if (err != -EPERM && err != -ENODEV)
4245 BT_ERR("%s urb %p submission failed (%d)",
4246 data->hdev->name, urb, -err);
4247 kfree(urb->setup_packet);
4248 usb_unanchor_urb(urb);
4249 usb_free_urb(urb);
4250 break;
4251 }
4252
4253 data->tx_in_flight++;
4254 usb_free_urb(urb);
4255 }
4256
4257 /* Cleanup the rest deferred urbs. */
4258 while ((urb = usb_get_from_anchor(&data->deferred))) {
4259 kfree(urb->setup_packet);
4260 usb_free_urb(urb);
4261 }
4262 }
4263
4264 static int btusb_resume(struct usb_interface *intf)
4265 {
4266 struct btusb_data *data = usb_get_intfdata(intf);
4267 struct hci_dev *hdev = data->hdev;
4268 int err = 0;
4269
4270 BT_DBG("intf %p", intf);
4271
4272 if (--data->suspend_count)
4273 return 0;
4274
4275 /* Disable only if not already disabled (keep it balanced) */
4276 if (test_and_clear_bit(BTUSB_OOB_WAKE_ENABLED, &data->flags)) {
4277 disable_irq(data->oob_wake_irq);
4278 disable_irq_wake(data->oob_wake_irq);
4279 }
4280
4281 if (!test_bit(HCI_RUNNING, &hdev->flags))
4282 goto done;
4283
4284 if (test_bit(BTUSB_INTR_RUNNING, &data->flags)) {
4285 err = btusb_submit_intr_urb(hdev, GFP_NOIO);
4286 if (err < 0) {
4287 clear_bit(BTUSB_INTR_RUNNING, &data->flags);
4288 goto failed;
4289 }
4290 }
4291
4292 if (test_bit(BTUSB_BULK_RUNNING, &data->flags)) {
4293 err = btusb_submit_bulk_urb(hdev, GFP_NOIO);
4294 if (err < 0) {
4295 clear_bit(BTUSB_BULK_RUNNING, &data->flags);
4296 goto failed;
4297 }
4298
4299 btusb_submit_bulk_urb(hdev, GFP_NOIO);
4300 }
4301
4302 if (test_bit(BTUSB_ISOC_RUNNING, &data->flags)) {
4303 if (btusb_submit_isoc_urb(hdev, GFP_NOIO) < 0)
4304 clear_bit(BTUSB_ISOC_RUNNING, &data->flags);
4305 else
4306 btusb_submit_isoc_urb(hdev, GFP_NOIO);
4307 }
4308
4309 spin_lock_irq(&data->txlock);
4310 play_deferred(data);
4311 clear_bit(BTUSB_SUSPENDING, &data->flags);
4312 spin_unlock_irq(&data->txlock);
4313 schedule_work(&data->work);
4314
4315 return 0;
4316
4317 failed:
4318 usb_scuttle_anchored_urbs(&data->deferred);
4319 done:
4320 spin_lock_irq(&data->txlock);
4321 clear_bit(BTUSB_SUSPENDING, &data->flags);
4322 spin_unlock_irq(&data->txlock);
4323
4324 return err;
4325 }
4326 #endif
4327
4328 static struct usb_driver btusb_driver = {
4329 .name = "btusb",
4330 .probe = btusb_probe,
4331 .disconnect = btusb_disconnect,
4332 #ifdef CONFIG_PM
4333 .suspend = btusb_suspend,
4334 .resume = btusb_resume,
4335 #endif
4336 .id_table = btusb_table,
4337 .supports_autosuspend = 1,
4338 .disable_hub_initiated_lpm = 1,
4339 };
4340
4341 module_usb_driver(btusb_driver);
4342
4343 module_param(disable_scofix, bool, 0644);
4344 MODULE_PARM_DESC(disable_scofix, "Disable fixup of wrong SCO buffer size");
4345
4346 module_param(force_scofix, bool, 0644);
4347 MODULE_PARM_DESC(force_scofix, "Force fixup of wrong SCO buffers size");
4348
4349 module_param(enable_autosuspend, bool, 0644);
4350 MODULE_PARM_DESC(enable_autosuspend, "Enable USB autosuspend by default");
4351
4352 module_param(reset, bool, 0644);
4353 MODULE_PARM_DESC(reset, "Send HCI reset command on initialization");
4354
4355 MODULE_AUTHOR("Marcel Holtmann <marcel@holtmann.org>");
4356 MODULE_DESCRIPTION("Generic Bluetooth USB driver ver " VERSION);
4357 MODULE_VERSION(VERSION);
4358 MODULE_LICENSE("GPL");
Ubuntu Jammy Linux kernel mirror