xref: /linux/drivers/bluetooth/btusb.c (revision b76960c0f6b25d447a1493c4388defb9e8e76c63)
1 /*
2  *
3  *  Generic Bluetooth USB driver
4  *
5  *  Copyright (C) 2005-2008  Marcel Holtmann <marcel@holtmann.org>
6  *
7  *
8  *  This program is free software; you can redistribute it and/or modify
9  *  it under the terms of the GNU General Public License as published by
10  *  the Free Software Foundation; either version 2 of the License, or
11  *  (at your option) any later version.
12  *
13  *  This program is distributed in the hope that it will be useful,
14  *  but WITHOUT ANY WARRANTY; without even the implied warranty of
15  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
16  *  GNU General Public License for more details.
17  *
18  *  You should have received a copy of the GNU General Public License
19  *  along with this program; if not, write to the Free Software
20  *  Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
21  *
22  */
23 
24 #include <linux/dmi.h>
25 #include <linux/module.h>
26 #include <linux/usb.h>
27 #include <linux/usb/quirks.h>
28 #include <linux/firmware.h>
29 #include <linux/of_device.h>
30 #include <linux/of_irq.h>
31 #include <linux/suspend.h>
32 #include <asm/unaligned.h>
33 
34 #include <net/bluetooth/bluetooth.h>
35 #include <net/bluetooth/hci_core.h>
36 
37 #include "btintel.h"
38 #include "btbcm.h"
39 #include "btrtl.h"
40 
41 #define VERSION "0.8"
42 
43 static bool disable_scofix;
44 static bool force_scofix;
45 static bool enable_autosuspend = IS_ENABLED(CONFIG_BT_HCIBTUSB_AUTOSUSPEND);
46 
47 static bool reset = true;
48 
49 static struct usb_driver btusb_driver;
50 
51 #define BTUSB_IGNORE		0x01
52 #define BTUSB_DIGIANSWER	0x02
53 #define BTUSB_CSR		0x04
54 #define BTUSB_SNIFFER		0x08
55 #define BTUSB_BCM92035		0x10
56 #define BTUSB_BROKEN_ISOC	0x20
57 #define BTUSB_WRONG_SCO_MTU	0x40
58 #define BTUSB_ATH3012		0x80
59 #define BTUSB_INTEL		0x100
60 #define BTUSB_INTEL_BOOT	0x200
61 #define BTUSB_BCM_PATCHRAM	0x400
62 #define BTUSB_MARVELL		0x800
63 #define BTUSB_SWAVE		0x1000
64 #define BTUSB_INTEL_NEW		0x2000
65 #define BTUSB_AMP		0x4000
66 #define BTUSB_QCA_ROME		0x8000
67 #define BTUSB_BCM_APPLE		0x10000
68 #define BTUSB_REALTEK		0x20000
69 #define BTUSB_BCM2045		0x40000
70 #define BTUSB_IFNUM_2		0x80000
71 #define BTUSB_CW6622		0x100000
72 
73 static const struct usb_device_id btusb_table[] = {
74 	/* Generic Bluetooth USB device */
75 	{ USB_DEVICE_INFO(0xe0, 0x01, 0x01) },
76 
77 	/* Generic Bluetooth AMP device */
78 	{ USB_DEVICE_INFO(0xe0, 0x01, 0x04), .driver_info = BTUSB_AMP },
79 
80 	/* Generic Bluetooth USB interface */
81 	{ USB_INTERFACE_INFO(0xe0, 0x01, 0x01) },
82 
83 	/* Apple-specific (Broadcom) devices */
84 	{ USB_VENDOR_AND_INTERFACE_INFO(0x05ac, 0xff, 0x01, 0x01),
85 	  .driver_info = BTUSB_BCM_APPLE | BTUSB_IFNUM_2 },
86 
87 	/* MediaTek MT76x0E */
88 	{ USB_DEVICE(0x0e8d, 0x763f) },
89 
90 	/* Broadcom SoftSailing reporting vendor specific */
91 	{ USB_DEVICE(0x0a5c, 0x21e1) },
92 
93 	/* Apple MacBookPro 7,1 */
94 	{ USB_DEVICE(0x05ac, 0x8213) },
95 
96 	/* Apple iMac11,1 */
97 	{ USB_DEVICE(0x05ac, 0x8215) },
98 
99 	/* Apple MacBookPro6,2 */
100 	{ USB_DEVICE(0x05ac, 0x8218) },
101 
102 	/* Apple MacBookAir3,1, MacBookAir3,2 */
103 	{ USB_DEVICE(0x05ac, 0x821b) },
104 
105 	/* Apple MacBookAir4,1 */
106 	{ USB_DEVICE(0x05ac, 0x821f) },
107 
108 	/* Apple MacBookPro8,2 */
109 	{ USB_DEVICE(0x05ac, 0x821a) },
110 
111 	/* Apple MacMini5,1 */
112 	{ USB_DEVICE(0x05ac, 0x8281) },
113 
114 	/* AVM BlueFRITZ! USB v2.0 */
115 	{ USB_DEVICE(0x057c, 0x3800), .driver_info = BTUSB_SWAVE },
116 
117 	/* Bluetooth Ultraport Module from IBM */
118 	{ USB_DEVICE(0x04bf, 0x030a) },
119 
120 	/* ALPS Modules with non-standard id */
121 	{ USB_DEVICE(0x044e, 0x3001) },
122 	{ USB_DEVICE(0x044e, 0x3002) },
123 
124 	/* Ericsson with non-standard id */
125 	{ USB_DEVICE(0x0bdb, 0x1002) },
126 
127 	/* Canyon CN-BTU1 with HID interfaces */
128 	{ USB_DEVICE(0x0c10, 0x0000) },
129 
130 	/* Broadcom BCM20702A0 */
131 	{ USB_DEVICE(0x413c, 0x8197) },
132 
133 	/* Broadcom BCM20702B0 (Dynex/Insignia) */
134 	{ USB_DEVICE(0x19ff, 0x0239), .driver_info = BTUSB_BCM_PATCHRAM },
135 
136 	/* Broadcom BCM43142A0 (Foxconn/Lenovo) */
137 	{ USB_VENDOR_AND_INTERFACE_INFO(0x105b, 0xff, 0x01, 0x01),
138 	  .driver_info = BTUSB_BCM_PATCHRAM },
139 
140 	/* Broadcom BCM920703 (HTC Vive) */
141 	{ USB_VENDOR_AND_INTERFACE_INFO(0x0bb4, 0xff, 0x01, 0x01),
142 	  .driver_info = BTUSB_BCM_PATCHRAM },
143 
144 	/* Foxconn - Hon Hai */
145 	{ USB_VENDOR_AND_INTERFACE_INFO(0x0489, 0xff, 0x01, 0x01),
146 	  .driver_info = BTUSB_BCM_PATCHRAM },
147 
148 	/* Lite-On Technology - Broadcom based */
149 	{ USB_VENDOR_AND_INTERFACE_INFO(0x04ca, 0xff, 0x01, 0x01),
150 	  .driver_info = BTUSB_BCM_PATCHRAM },
151 
152 	/* Broadcom devices with vendor specific id */
153 	{ USB_VENDOR_AND_INTERFACE_INFO(0x0a5c, 0xff, 0x01, 0x01),
154 	  .driver_info = BTUSB_BCM_PATCHRAM },
155 
156 	/* ASUSTek Computer - Broadcom based */
157 	{ USB_VENDOR_AND_INTERFACE_INFO(0x0b05, 0xff, 0x01, 0x01),
158 	  .driver_info = BTUSB_BCM_PATCHRAM },
159 
160 	/* Belkin F8065bf - Broadcom based */
161 	{ USB_VENDOR_AND_INTERFACE_INFO(0x050d, 0xff, 0x01, 0x01),
162 	  .driver_info = BTUSB_BCM_PATCHRAM },
163 
164 	/* IMC Networks - Broadcom based */
165 	{ USB_VENDOR_AND_INTERFACE_INFO(0x13d3, 0xff, 0x01, 0x01),
166 	  .driver_info = BTUSB_BCM_PATCHRAM },
167 
168 	/* Dell Computer - Broadcom based  */
169 	{ USB_VENDOR_AND_INTERFACE_INFO(0x413c, 0xff, 0x01, 0x01),
170 	  .driver_info = BTUSB_BCM_PATCHRAM },
171 
172 	/* Toshiba Corp - Broadcom based */
173 	{ USB_VENDOR_AND_INTERFACE_INFO(0x0930, 0xff, 0x01, 0x01),
174 	  .driver_info = BTUSB_BCM_PATCHRAM },
175 
176 	/* Intel Bluetooth USB Bootloader (RAM module) */
177 	{ USB_DEVICE(0x8087, 0x0a5a),
178 	  .driver_info = BTUSB_INTEL_BOOT | BTUSB_BROKEN_ISOC },
179 
180 	{ }	/* Terminating entry */
181 };
182 
183 MODULE_DEVICE_TABLE(usb, btusb_table);
184 
185 static const struct usb_device_id blacklist_table[] = {
186 	/* CSR BlueCore devices */
187 	{ USB_DEVICE(0x0a12, 0x0001), .driver_info = BTUSB_CSR },
188 
189 	/* Broadcom BCM2033 without firmware */
190 	{ USB_DEVICE(0x0a5c, 0x2033), .driver_info = BTUSB_IGNORE },
191 
192 	/* Broadcom BCM2045 devices */
193 	{ USB_DEVICE(0x0a5c, 0x2045), .driver_info = BTUSB_BCM2045 },
194 
195 	/* Atheros 3011 with sflash firmware */
196 	{ USB_DEVICE(0x0489, 0xe027), .driver_info = BTUSB_IGNORE },
197 	{ USB_DEVICE(0x0489, 0xe03d), .driver_info = BTUSB_IGNORE },
198 	{ USB_DEVICE(0x04f2, 0xaff1), .driver_info = BTUSB_IGNORE },
199 	{ USB_DEVICE(0x0930, 0x0215), .driver_info = BTUSB_IGNORE },
200 	{ USB_DEVICE(0x0cf3, 0x3002), .driver_info = BTUSB_IGNORE },
201 	{ USB_DEVICE(0x0cf3, 0xe019), .driver_info = BTUSB_IGNORE },
202 	{ USB_DEVICE(0x13d3, 0x3304), .driver_info = BTUSB_IGNORE },
203 
204 	/* Atheros AR9285 Malbec with sflash firmware */
205 	{ USB_DEVICE(0x03f0, 0x311d), .driver_info = BTUSB_IGNORE },
206 
207 	/* Atheros 3012 with sflash firmware */
208 	{ USB_DEVICE(0x0489, 0xe04d), .driver_info = BTUSB_ATH3012 },
209 	{ USB_DEVICE(0x0489, 0xe04e), .driver_info = BTUSB_ATH3012 },
210 	{ USB_DEVICE(0x0489, 0xe056), .driver_info = BTUSB_ATH3012 },
211 	{ USB_DEVICE(0x0489, 0xe057), .driver_info = BTUSB_ATH3012 },
212 	{ USB_DEVICE(0x0489, 0xe05f), .driver_info = BTUSB_ATH3012 },
213 	{ USB_DEVICE(0x0489, 0xe076), .driver_info = BTUSB_ATH3012 },
214 	{ USB_DEVICE(0x0489, 0xe078), .driver_info = BTUSB_ATH3012 },
215 	{ USB_DEVICE(0x0489, 0xe095), .driver_info = BTUSB_ATH3012 },
216 	{ USB_DEVICE(0x04c5, 0x1330), .driver_info = BTUSB_ATH3012 },
217 	{ USB_DEVICE(0x04ca, 0x3004), .driver_info = BTUSB_ATH3012 },
218 	{ USB_DEVICE(0x04ca, 0x3005), .driver_info = BTUSB_ATH3012 },
219 	{ USB_DEVICE(0x04ca, 0x3006), .driver_info = BTUSB_ATH3012 },
220 	{ USB_DEVICE(0x04ca, 0x3007), .driver_info = BTUSB_ATH3012 },
221 	{ USB_DEVICE(0x04ca, 0x3008), .driver_info = BTUSB_ATH3012 },
222 	{ USB_DEVICE(0x04ca, 0x300b), .driver_info = BTUSB_ATH3012 },
223 	{ USB_DEVICE(0x04ca, 0x300d), .driver_info = BTUSB_ATH3012 },
224 	{ USB_DEVICE(0x04ca, 0x300f), .driver_info = BTUSB_ATH3012 },
225 	{ USB_DEVICE(0x04ca, 0x3010), .driver_info = BTUSB_ATH3012 },
226 	{ USB_DEVICE(0x04ca, 0x3014), .driver_info = BTUSB_ATH3012 },
227 	{ USB_DEVICE(0x04ca, 0x3018), .driver_info = BTUSB_ATH3012 },
228 	{ USB_DEVICE(0x0930, 0x0219), .driver_info = BTUSB_ATH3012 },
229 	{ USB_DEVICE(0x0930, 0x021c), .driver_info = BTUSB_ATH3012 },
230 	{ USB_DEVICE(0x0930, 0x0220), .driver_info = BTUSB_ATH3012 },
231 	{ USB_DEVICE(0x0930, 0x0227), .driver_info = BTUSB_ATH3012 },
232 	{ USB_DEVICE(0x0b05, 0x17d0), .driver_info = BTUSB_ATH3012 },
233 	{ USB_DEVICE(0x0cf3, 0x0036), .driver_info = BTUSB_ATH3012 },
234 	{ USB_DEVICE(0x0cf3, 0x3004), .driver_info = BTUSB_ATH3012 },
235 	{ USB_DEVICE(0x0cf3, 0x3008), .driver_info = BTUSB_ATH3012 },
236 	{ USB_DEVICE(0x0cf3, 0x311d), .driver_info = BTUSB_ATH3012 },
237 	{ USB_DEVICE(0x0cf3, 0x311e), .driver_info = BTUSB_ATH3012 },
238 	{ USB_DEVICE(0x0cf3, 0x311f), .driver_info = BTUSB_ATH3012 },
239 	{ USB_DEVICE(0x0cf3, 0x3121), .driver_info = BTUSB_ATH3012 },
240 	{ USB_DEVICE(0x0cf3, 0x817a), .driver_info = BTUSB_ATH3012 },
241 	{ USB_DEVICE(0x0cf3, 0x817b), .driver_info = BTUSB_ATH3012 },
242 	{ USB_DEVICE(0x0cf3, 0xe003), .driver_info = BTUSB_ATH3012 },
243 	{ USB_DEVICE(0x0cf3, 0xe004), .driver_info = BTUSB_ATH3012 },
244 	{ USB_DEVICE(0x0cf3, 0xe005), .driver_info = BTUSB_ATH3012 },
245 	{ USB_DEVICE(0x0cf3, 0xe006), .driver_info = BTUSB_ATH3012 },
246 	{ USB_DEVICE(0x13d3, 0x3362), .driver_info = BTUSB_ATH3012 },
247 	{ USB_DEVICE(0x13d3, 0x3375), .driver_info = BTUSB_ATH3012 },
248 	{ USB_DEVICE(0x13d3, 0x3393), .driver_info = BTUSB_ATH3012 },
249 	{ USB_DEVICE(0x13d3, 0x3395), .driver_info = BTUSB_ATH3012 },
250 	{ USB_DEVICE(0x13d3, 0x3402), .driver_info = BTUSB_ATH3012 },
251 	{ USB_DEVICE(0x13d3, 0x3408), .driver_info = BTUSB_ATH3012 },
252 	{ USB_DEVICE(0x13d3, 0x3423), .driver_info = BTUSB_ATH3012 },
253 	{ USB_DEVICE(0x13d3, 0x3432), .driver_info = BTUSB_ATH3012 },
254 	{ USB_DEVICE(0x13d3, 0x3472), .driver_info = BTUSB_ATH3012 },
255 	{ USB_DEVICE(0x13d3, 0x3474), .driver_info = BTUSB_ATH3012 },
256 	{ USB_DEVICE(0x13d3, 0x3487), .driver_info = BTUSB_ATH3012 },
257 	{ USB_DEVICE(0x13d3, 0x3490), .driver_info = BTUSB_ATH3012 },
258 
259 	/* Atheros AR5BBU12 with sflash firmware */
260 	{ USB_DEVICE(0x0489, 0xe02c), .driver_info = BTUSB_IGNORE },
261 
262 	/* Atheros AR5BBU12 with sflash firmware */
263 	{ USB_DEVICE(0x0489, 0xe036), .driver_info = BTUSB_ATH3012 },
264 	{ USB_DEVICE(0x0489, 0xe03c), .driver_info = BTUSB_ATH3012 },
265 
266 	/* QCA ROME chipset */
267 	{ USB_DEVICE(0x0cf3, 0xe007), .driver_info = BTUSB_QCA_ROME },
268 	{ USB_DEVICE(0x0cf3, 0xe009), .driver_info = BTUSB_QCA_ROME },
269 	{ USB_DEVICE(0x0cf3, 0xe010), .driver_info = BTUSB_QCA_ROME },
270 	{ USB_DEVICE(0x0cf3, 0xe300), .driver_info = BTUSB_QCA_ROME },
271 	{ USB_DEVICE(0x0cf3, 0xe301), .driver_info = BTUSB_QCA_ROME },
272 	{ USB_DEVICE(0x0cf3, 0xe360), .driver_info = BTUSB_QCA_ROME },
273 	{ USB_DEVICE(0x0489, 0xe092), .driver_info = BTUSB_QCA_ROME },
274 	{ USB_DEVICE(0x0489, 0xe09f), .driver_info = BTUSB_QCA_ROME },
275 	{ USB_DEVICE(0x0489, 0xe0a2), .driver_info = BTUSB_QCA_ROME },
276 	{ USB_DEVICE(0x04ca, 0x3011), .driver_info = BTUSB_QCA_ROME },
277 	{ USB_DEVICE(0x04ca, 0x3015), .driver_info = BTUSB_QCA_ROME },
278 	{ USB_DEVICE(0x04ca, 0x3016), .driver_info = BTUSB_QCA_ROME },
279 
280 	/* Broadcom BCM2035 */
281 	{ USB_DEVICE(0x0a5c, 0x2009), .driver_info = BTUSB_BCM92035 },
282 	{ USB_DEVICE(0x0a5c, 0x200a), .driver_info = BTUSB_WRONG_SCO_MTU },
283 	{ USB_DEVICE(0x0a5c, 0x2035), .driver_info = BTUSB_WRONG_SCO_MTU },
284 
285 	/* Broadcom BCM2045 */
286 	{ USB_DEVICE(0x0a5c, 0x2039), .driver_info = BTUSB_WRONG_SCO_MTU },
287 	{ USB_DEVICE(0x0a5c, 0x2101), .driver_info = BTUSB_WRONG_SCO_MTU },
288 
289 	/* IBM/Lenovo ThinkPad with Broadcom chip */
290 	{ USB_DEVICE(0x0a5c, 0x201e), .driver_info = BTUSB_WRONG_SCO_MTU },
291 	{ USB_DEVICE(0x0a5c, 0x2110), .driver_info = BTUSB_WRONG_SCO_MTU },
292 
293 	/* HP laptop with Broadcom chip */
294 	{ USB_DEVICE(0x03f0, 0x171d), .driver_info = BTUSB_WRONG_SCO_MTU },
295 
296 	/* Dell laptop with Broadcom chip */
297 	{ USB_DEVICE(0x413c, 0x8126), .driver_info = BTUSB_WRONG_SCO_MTU },
298 
299 	/* Dell Wireless 370 and 410 devices */
300 	{ USB_DEVICE(0x413c, 0x8152), .driver_info = BTUSB_WRONG_SCO_MTU },
301 	{ USB_DEVICE(0x413c, 0x8156), .driver_info = BTUSB_WRONG_SCO_MTU },
302 
303 	/* Belkin F8T012 and F8T013 devices */
304 	{ USB_DEVICE(0x050d, 0x0012), .driver_info = BTUSB_WRONG_SCO_MTU },
305 	{ USB_DEVICE(0x050d, 0x0013), .driver_info = BTUSB_WRONG_SCO_MTU },
306 
307 	/* Asus WL-BTD202 device */
308 	{ USB_DEVICE(0x0b05, 0x1715), .driver_info = BTUSB_WRONG_SCO_MTU },
309 
310 	/* Kensington Bluetooth USB adapter */
311 	{ USB_DEVICE(0x047d, 0x105e), .driver_info = BTUSB_WRONG_SCO_MTU },
312 
313 	/* RTX Telecom based adapters with buggy SCO support */
314 	{ USB_DEVICE(0x0400, 0x0807), .driver_info = BTUSB_BROKEN_ISOC },
315 	{ USB_DEVICE(0x0400, 0x080a), .driver_info = BTUSB_BROKEN_ISOC },
316 
317 	/* CONWISE Technology based adapters with buggy SCO support */
318 	{ USB_DEVICE(0x0e5e, 0x6622),
319 	  .driver_info = BTUSB_BROKEN_ISOC | BTUSB_CW6622},
320 
321 	/* Roper Class 1 Bluetooth Dongle (Silicon Wave based) */
322 	{ USB_DEVICE(0x1310, 0x0001), .driver_info = BTUSB_SWAVE },
323 
324 	/* Digianswer devices */
325 	{ USB_DEVICE(0x08fd, 0x0001), .driver_info = BTUSB_DIGIANSWER },
326 	{ USB_DEVICE(0x08fd, 0x0002), .driver_info = BTUSB_IGNORE },
327 
328 	/* CSR BlueCore Bluetooth Sniffer */
329 	{ USB_DEVICE(0x0a12, 0x0002),
330 	  .driver_info = BTUSB_SNIFFER | BTUSB_BROKEN_ISOC },
331 
332 	/* Frontline ComProbe Bluetooth Sniffer */
333 	{ USB_DEVICE(0x16d3, 0x0002),
334 	  .driver_info = BTUSB_SNIFFER | BTUSB_BROKEN_ISOC },
335 
336 	/* Marvell Bluetooth devices */
337 	{ USB_DEVICE(0x1286, 0x2044), .driver_info = BTUSB_MARVELL },
338 	{ USB_DEVICE(0x1286, 0x2046), .driver_info = BTUSB_MARVELL },
339 	{ USB_DEVICE(0x1286, 0x204e), .driver_info = BTUSB_MARVELL },
340 
341 	/* Intel Bluetooth devices */
342 	{ USB_DEVICE(0x8087, 0x0025), .driver_info = BTUSB_INTEL_NEW },
343 	{ USB_DEVICE(0x8087, 0x07da), .driver_info = BTUSB_CSR },
344 	{ USB_DEVICE(0x8087, 0x07dc), .driver_info = BTUSB_INTEL },
345 	{ USB_DEVICE(0x8087, 0x0a2a), .driver_info = BTUSB_INTEL },
346 	{ USB_DEVICE(0x8087, 0x0a2b), .driver_info = BTUSB_INTEL_NEW },
347 	{ USB_DEVICE(0x8087, 0x0aa7), .driver_info = BTUSB_INTEL },
348 	{ USB_DEVICE(0x8087, 0x0aaa), .driver_info = BTUSB_INTEL_NEW },
349 
350 	/* Other Intel Bluetooth devices */
351 	{ USB_VENDOR_AND_INTERFACE_INFO(0x8087, 0xe0, 0x01, 0x01),
352 	  .driver_info = BTUSB_IGNORE },
353 
354 	/* Realtek Bluetooth devices */
355 	{ USB_VENDOR_AND_INTERFACE_INFO(0x0bda, 0xe0, 0x01, 0x01),
356 	  .driver_info = BTUSB_REALTEK },
357 
358 	/* Additional Realtek 8723AE Bluetooth devices */
359 	{ USB_DEVICE(0x0930, 0x021d), .driver_info = BTUSB_REALTEK },
360 	{ USB_DEVICE(0x13d3, 0x3394), .driver_info = BTUSB_REALTEK },
361 
362 	/* Additional Realtek 8723BE Bluetooth devices */
363 	{ USB_DEVICE(0x0489, 0xe085), .driver_info = BTUSB_REALTEK },
364 	{ USB_DEVICE(0x0489, 0xe08b), .driver_info = BTUSB_REALTEK },
365 	{ USB_DEVICE(0x13d3, 0x3410), .driver_info = BTUSB_REALTEK },
366 	{ USB_DEVICE(0x13d3, 0x3416), .driver_info = BTUSB_REALTEK },
367 	{ USB_DEVICE(0x13d3, 0x3459), .driver_info = BTUSB_REALTEK },
368 	{ USB_DEVICE(0x13d3, 0x3494), .driver_info = BTUSB_REALTEK },
369 
370 	/* Additional Realtek 8821AE Bluetooth devices */
371 	{ USB_DEVICE(0x0b05, 0x17dc), .driver_info = BTUSB_REALTEK },
372 	{ USB_DEVICE(0x13d3, 0x3414), .driver_info = BTUSB_REALTEK },
373 	{ USB_DEVICE(0x13d3, 0x3458), .driver_info = BTUSB_REALTEK },
374 	{ USB_DEVICE(0x13d3, 0x3461), .driver_info = BTUSB_REALTEK },
375 	{ USB_DEVICE(0x13d3, 0x3462), .driver_info = BTUSB_REALTEK },
376 
377 	/* Silicon Wave based devices */
378 	{ USB_DEVICE(0x0c10, 0x0000), .driver_info = BTUSB_SWAVE },
379 
380 	{ }	/* Terminating entry */
381 };
382 
383 /* The Bluetooth USB module build into some devices needs to be reset on resume,
384  * this is a problem with the platform (likely shutting off all power) not with
385  * the module itself. So we use a DMI list to match known broken platforms.
386  */
387 static const struct dmi_system_id btusb_needs_reset_resume_table[] = {
388 	{
389 		/* Lenovo Yoga 920 (QCA Rome device 0cf3:e300) */
390 		.matches = {
391 			DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
392 			DMI_MATCH(DMI_PRODUCT_VERSION, "Lenovo YOGA 920"),
393 		},
394 	},
395 	{}
396 };
397 
398 #define BTUSB_MAX_ISOC_FRAMES	10
399 
400 #define BTUSB_INTR_RUNNING	0
401 #define BTUSB_BULK_RUNNING	1
402 #define BTUSB_ISOC_RUNNING	2
403 #define BTUSB_SUSPENDING	3
404 #define BTUSB_DID_ISO_RESUME	4
405 #define BTUSB_BOOTLOADER	5
406 #define BTUSB_DOWNLOADING	6
407 #define BTUSB_FIRMWARE_LOADED	7
408 #define BTUSB_FIRMWARE_FAILED	8
409 #define BTUSB_BOOTING		9
410 #define BTUSB_DIAG_RUNNING	10
411 #define BTUSB_OOB_WAKE_ENABLED	11
412 
413 struct btusb_data {
414 	struct hci_dev       *hdev;
415 	struct usb_device    *udev;
416 	struct usb_interface *intf;
417 	struct usb_interface *isoc;
418 	struct usb_interface *diag;
419 	unsigned isoc_ifnum;
420 
421 	unsigned long flags;
422 
423 	struct work_struct work;
424 	struct work_struct waker;
425 
426 	struct usb_anchor deferred;
427 	struct usb_anchor tx_anchor;
428 	int tx_in_flight;
429 	spinlock_t txlock;
430 
431 	struct usb_anchor intr_anchor;
432 	struct usb_anchor bulk_anchor;
433 	struct usb_anchor isoc_anchor;
434 	struct usb_anchor diag_anchor;
435 	spinlock_t rxlock;
436 
437 	struct sk_buff *evt_skb;
438 	struct sk_buff *acl_skb;
439 	struct sk_buff *sco_skb;
440 
441 	struct usb_endpoint_descriptor *intr_ep;
442 	struct usb_endpoint_descriptor *bulk_tx_ep;
443 	struct usb_endpoint_descriptor *bulk_rx_ep;
444 	struct usb_endpoint_descriptor *isoc_tx_ep;
445 	struct usb_endpoint_descriptor *isoc_rx_ep;
446 	struct usb_endpoint_descriptor *diag_tx_ep;
447 	struct usb_endpoint_descriptor *diag_rx_ep;
448 
449 	__u8 cmdreq_type;
450 	__u8 cmdreq;
451 
452 	unsigned int sco_num;
453 	int isoc_altsetting;
454 	int suspend_count;
455 
456 	int (*recv_event)(struct hci_dev *hdev, struct sk_buff *skb);
457 	int (*recv_bulk)(struct btusb_data *data, void *buffer, int count);
458 
459 	int (*setup_on_usb)(struct hci_dev *hdev);
460 
461 	int oob_wake_irq;   /* irq for out-of-band wake-on-bt */
462 };
463 
464 static inline void btusb_free_frags(struct btusb_data *data)
465 {
466 	unsigned long flags;
467 
468 	spin_lock_irqsave(&data->rxlock, flags);
469 
470 	kfree_skb(data->evt_skb);
471 	data->evt_skb = NULL;
472 
473 	kfree_skb(data->acl_skb);
474 	data->acl_skb = NULL;
475 
476 	kfree_skb(data->sco_skb);
477 	data->sco_skb = NULL;
478 
479 	spin_unlock_irqrestore(&data->rxlock, flags);
480 }
481 
482 static int btusb_recv_intr(struct btusb_data *data, void *buffer, int count)
483 {
484 	struct sk_buff *skb;
485 	int err = 0;
486 
487 	spin_lock(&data->rxlock);
488 	skb = data->evt_skb;
489 
490 	while (count) {
491 		int len;
492 
493 		if (!skb) {
494 			skb = bt_skb_alloc(HCI_MAX_EVENT_SIZE, GFP_ATOMIC);
495 			if (!skb) {
496 				err = -ENOMEM;
497 				break;
498 			}
499 
500 			hci_skb_pkt_type(skb) = HCI_EVENT_PKT;
501 			hci_skb_expect(skb) = HCI_EVENT_HDR_SIZE;
502 		}
503 
504 		len = min_t(uint, hci_skb_expect(skb), count);
505 		skb_put_data(skb, buffer, len);
506 
507 		count -= len;
508 		buffer += len;
509 		hci_skb_expect(skb) -= len;
510 
511 		if (skb->len == HCI_EVENT_HDR_SIZE) {
512 			/* Complete event header */
513 			hci_skb_expect(skb) = hci_event_hdr(skb)->plen;
514 
515 			if (skb_tailroom(skb) < hci_skb_expect(skb)) {
516 				kfree_skb(skb);
517 				skb = NULL;
518 
519 				err = -EILSEQ;
520 				break;
521 			}
522 		}
523 
524 		if (!hci_skb_expect(skb)) {
525 			/* Complete frame */
526 			data->recv_event(data->hdev, skb);
527 			skb = NULL;
528 		}
529 	}
530 
531 	data->evt_skb = skb;
532 	spin_unlock(&data->rxlock);
533 
534 	return err;
535 }
536 
537 static int btusb_recv_bulk(struct btusb_data *data, void *buffer, int count)
538 {
539 	struct sk_buff *skb;
540 	int err = 0;
541 
542 	spin_lock(&data->rxlock);
543 	skb = data->acl_skb;
544 
545 	while (count) {
546 		int len;
547 
548 		if (!skb) {
549 			skb = bt_skb_alloc(HCI_MAX_FRAME_SIZE, GFP_ATOMIC);
550 			if (!skb) {
551 				err = -ENOMEM;
552 				break;
553 			}
554 
555 			hci_skb_pkt_type(skb) = HCI_ACLDATA_PKT;
556 			hci_skb_expect(skb) = HCI_ACL_HDR_SIZE;
557 		}
558 
559 		len = min_t(uint, hci_skb_expect(skb), count);
560 		skb_put_data(skb, buffer, len);
561 
562 		count -= len;
563 		buffer += len;
564 		hci_skb_expect(skb) -= len;
565 
566 		if (skb->len == HCI_ACL_HDR_SIZE) {
567 			__le16 dlen = hci_acl_hdr(skb)->dlen;
568 
569 			/* Complete ACL header */
570 			hci_skb_expect(skb) = __le16_to_cpu(dlen);
571 
572 			if (skb_tailroom(skb) < hci_skb_expect(skb)) {
573 				kfree_skb(skb);
574 				skb = NULL;
575 
576 				err = -EILSEQ;
577 				break;
578 			}
579 		}
580 
581 		if (!hci_skb_expect(skb)) {
582 			/* Complete frame */
583 			hci_recv_frame(data->hdev, skb);
584 			skb = NULL;
585 		}
586 	}
587 
588 	data->acl_skb = skb;
589 	spin_unlock(&data->rxlock);
590 
591 	return err;
592 }
593 
594 static int btusb_recv_isoc(struct btusb_data *data, void *buffer, int count)
595 {
596 	struct sk_buff *skb;
597 	int err = 0;
598 
599 	spin_lock(&data->rxlock);
600 	skb = data->sco_skb;
601 
602 	while (count) {
603 		int len;
604 
605 		if (!skb) {
606 			skb = bt_skb_alloc(HCI_MAX_SCO_SIZE, GFP_ATOMIC);
607 			if (!skb) {
608 				err = -ENOMEM;
609 				break;
610 			}
611 
612 			hci_skb_pkt_type(skb) = HCI_SCODATA_PKT;
613 			hci_skb_expect(skb) = HCI_SCO_HDR_SIZE;
614 		}
615 
616 		len = min_t(uint, hci_skb_expect(skb), count);
617 		skb_put_data(skb, buffer, len);
618 
619 		count -= len;
620 		buffer += len;
621 		hci_skb_expect(skb) -= len;
622 
623 		if (skb->len == HCI_SCO_HDR_SIZE) {
624 			/* Complete SCO header */
625 			hci_skb_expect(skb) = hci_sco_hdr(skb)->dlen;
626 
627 			if (skb_tailroom(skb) < hci_skb_expect(skb)) {
628 				kfree_skb(skb);
629 				skb = NULL;
630 
631 				err = -EILSEQ;
632 				break;
633 			}
634 		}
635 
636 		if (!hci_skb_expect(skb)) {
637 			/* Complete frame */
638 			hci_recv_frame(data->hdev, skb);
639 			skb = NULL;
640 		}
641 	}
642 
643 	data->sco_skb = skb;
644 	spin_unlock(&data->rxlock);
645 
646 	return err;
647 }
648 
649 static void btusb_intr_complete(struct urb *urb)
650 {
651 	struct hci_dev *hdev = urb->context;
652 	struct btusb_data *data = hci_get_drvdata(hdev);
653 	int err;
654 
655 	BT_DBG("%s urb %p status %d count %d", hdev->name, urb, urb->status,
656 	       urb->actual_length);
657 
658 	if (!test_bit(HCI_RUNNING, &hdev->flags))
659 		return;
660 
661 	if (urb->status == 0) {
662 		hdev->stat.byte_rx += urb->actual_length;
663 
664 		if (btusb_recv_intr(data, urb->transfer_buffer,
665 				    urb->actual_length) < 0) {
666 			bt_dev_err(hdev, "corrupted event packet");
667 			hdev->stat.err_rx++;
668 		}
669 	} else if (urb->status == -ENOENT) {
670 		/* Avoid suspend failed when usb_kill_urb */
671 		return;
672 	}
673 
674 	if (!test_bit(BTUSB_INTR_RUNNING, &data->flags))
675 		return;
676 
677 	usb_mark_last_busy(data->udev);
678 	usb_anchor_urb(urb, &data->intr_anchor);
679 
680 	err = usb_submit_urb(urb, GFP_ATOMIC);
681 	if (err < 0) {
682 		/* -EPERM: urb is being killed;
683 		 * -ENODEV: device got disconnected
684 		 */
685 		if (err != -EPERM && err != -ENODEV)
686 			bt_dev_err(hdev, "urb %p failed to resubmit (%d)",
687 				   urb, -err);
688 		usb_unanchor_urb(urb);
689 	}
690 }
691 
692 static int btusb_submit_intr_urb(struct hci_dev *hdev, gfp_t mem_flags)
693 {
694 	struct btusb_data *data = hci_get_drvdata(hdev);
695 	struct urb *urb;
696 	unsigned char *buf;
697 	unsigned int pipe;
698 	int err, size;
699 
700 	BT_DBG("%s", hdev->name);
701 
702 	if (!data->intr_ep)
703 		return -ENODEV;
704 
705 	urb = usb_alloc_urb(0, mem_flags);
706 	if (!urb)
707 		return -ENOMEM;
708 
709 	size = le16_to_cpu(data->intr_ep->wMaxPacketSize);
710 
711 	buf = kmalloc(size, mem_flags);
712 	if (!buf) {
713 		usb_free_urb(urb);
714 		return -ENOMEM;
715 	}
716 
717 	pipe = usb_rcvintpipe(data->udev, data->intr_ep->bEndpointAddress);
718 
719 	usb_fill_int_urb(urb, data->udev, pipe, buf, size,
720 			 btusb_intr_complete, hdev, data->intr_ep->bInterval);
721 
722 	urb->transfer_flags |= URB_FREE_BUFFER;
723 
724 	usb_anchor_urb(urb, &data->intr_anchor);
725 
726 	err = usb_submit_urb(urb, mem_flags);
727 	if (err < 0) {
728 		if (err != -EPERM && err != -ENODEV)
729 			bt_dev_err(hdev, "urb %p submission failed (%d)",
730 				   urb, -err);
731 		usb_unanchor_urb(urb);
732 	}
733 
734 	usb_free_urb(urb);
735 
736 	return err;
737 }
738 
739 static void btusb_bulk_complete(struct urb *urb)
740 {
741 	struct hci_dev *hdev = urb->context;
742 	struct btusb_data *data = hci_get_drvdata(hdev);
743 	int err;
744 
745 	BT_DBG("%s urb %p status %d count %d", hdev->name, urb, urb->status,
746 	       urb->actual_length);
747 
748 	if (!test_bit(HCI_RUNNING, &hdev->flags))
749 		return;
750 
751 	if (urb->status == 0) {
752 		hdev->stat.byte_rx += urb->actual_length;
753 
754 		if (data->recv_bulk(data, urb->transfer_buffer,
755 				    urb->actual_length) < 0) {
756 			bt_dev_err(hdev, "corrupted ACL packet");
757 			hdev->stat.err_rx++;
758 		}
759 	} else if (urb->status == -ENOENT) {
760 		/* Avoid suspend failed when usb_kill_urb */
761 		return;
762 	}
763 
764 	if (!test_bit(BTUSB_BULK_RUNNING, &data->flags))
765 		return;
766 
767 	usb_anchor_urb(urb, &data->bulk_anchor);
768 	usb_mark_last_busy(data->udev);
769 
770 	err = usb_submit_urb(urb, GFP_ATOMIC);
771 	if (err < 0) {
772 		/* -EPERM: urb is being killed;
773 		 * -ENODEV: device got disconnected
774 		 */
775 		if (err != -EPERM && err != -ENODEV)
776 			bt_dev_err(hdev, "urb %p failed to resubmit (%d)",
777 				   urb, -err);
778 		usb_unanchor_urb(urb);
779 	}
780 }
781 
782 static int btusb_submit_bulk_urb(struct hci_dev *hdev, gfp_t mem_flags)
783 {
784 	struct btusb_data *data = hci_get_drvdata(hdev);
785 	struct urb *urb;
786 	unsigned char *buf;
787 	unsigned int pipe;
788 	int err, size = HCI_MAX_FRAME_SIZE;
789 
790 	BT_DBG("%s", hdev->name);
791 
792 	if (!data->bulk_rx_ep)
793 		return -ENODEV;
794 
795 	urb = usb_alloc_urb(0, mem_flags);
796 	if (!urb)
797 		return -ENOMEM;
798 
799 	buf = kmalloc(size, mem_flags);
800 	if (!buf) {
801 		usb_free_urb(urb);
802 		return -ENOMEM;
803 	}
804 
805 	pipe = usb_rcvbulkpipe(data->udev, data->bulk_rx_ep->bEndpointAddress);
806 
807 	usb_fill_bulk_urb(urb, data->udev, pipe, buf, size,
808 			  btusb_bulk_complete, hdev);
809 
810 	urb->transfer_flags |= URB_FREE_BUFFER;
811 
812 	usb_mark_last_busy(data->udev);
813 	usb_anchor_urb(urb, &data->bulk_anchor);
814 
815 	err = usb_submit_urb(urb, mem_flags);
816 	if (err < 0) {
817 		if (err != -EPERM && err != -ENODEV)
818 			bt_dev_err(hdev, "urb %p submission failed (%d)",
819 				   urb, -err);
820 		usb_unanchor_urb(urb);
821 	}
822 
823 	usb_free_urb(urb);
824 
825 	return err;
826 }
827 
828 static void btusb_isoc_complete(struct urb *urb)
829 {
830 	struct hci_dev *hdev = urb->context;
831 	struct btusb_data *data = hci_get_drvdata(hdev);
832 	int i, err;
833 
834 	BT_DBG("%s urb %p status %d count %d", hdev->name, urb, urb->status,
835 	       urb->actual_length);
836 
837 	if (!test_bit(HCI_RUNNING, &hdev->flags))
838 		return;
839 
840 	if (urb->status == 0) {
841 		for (i = 0; i < urb->number_of_packets; i++) {
842 			unsigned int offset = urb->iso_frame_desc[i].offset;
843 			unsigned int length = urb->iso_frame_desc[i].actual_length;
844 
845 			if (urb->iso_frame_desc[i].status)
846 				continue;
847 
848 			hdev->stat.byte_rx += length;
849 
850 			if (btusb_recv_isoc(data, urb->transfer_buffer + offset,
851 					    length) < 0) {
852 				bt_dev_err(hdev, "corrupted SCO packet");
853 				hdev->stat.err_rx++;
854 			}
855 		}
856 	} else if (urb->status == -ENOENT) {
857 		/* Avoid suspend failed when usb_kill_urb */
858 		return;
859 	}
860 
861 	if (!test_bit(BTUSB_ISOC_RUNNING, &data->flags))
862 		return;
863 
864 	usb_anchor_urb(urb, &data->isoc_anchor);
865 
866 	err = usb_submit_urb(urb, GFP_ATOMIC);
867 	if (err < 0) {
868 		/* -EPERM: urb is being killed;
869 		 * -ENODEV: device got disconnected
870 		 */
871 		if (err != -EPERM && err != -ENODEV)
872 			bt_dev_err(hdev, "urb %p failed to resubmit (%d)",
873 				   urb, -err);
874 		usb_unanchor_urb(urb);
875 	}
876 }
877 
878 static inline void __fill_isoc_descriptor(struct urb *urb, int len, int mtu)
879 {
880 	int i, offset = 0;
881 
882 	BT_DBG("len %d mtu %d", len, mtu);
883 
884 	for (i = 0; i < BTUSB_MAX_ISOC_FRAMES && len >= mtu;
885 					i++, offset += mtu, len -= mtu) {
886 		urb->iso_frame_desc[i].offset = offset;
887 		urb->iso_frame_desc[i].length = mtu;
888 	}
889 
890 	if (len && i < BTUSB_MAX_ISOC_FRAMES) {
891 		urb->iso_frame_desc[i].offset = offset;
892 		urb->iso_frame_desc[i].length = len;
893 		i++;
894 	}
895 
896 	urb->number_of_packets = i;
897 }
898 
899 static int btusb_submit_isoc_urb(struct hci_dev *hdev, gfp_t mem_flags)
900 {
901 	struct btusb_data *data = hci_get_drvdata(hdev);
902 	struct urb *urb;
903 	unsigned char *buf;
904 	unsigned int pipe;
905 	int err, size;
906 
907 	BT_DBG("%s", hdev->name);
908 
909 	if (!data->isoc_rx_ep)
910 		return -ENODEV;
911 
912 	urb = usb_alloc_urb(BTUSB_MAX_ISOC_FRAMES, mem_flags);
913 	if (!urb)
914 		return -ENOMEM;
915 
916 	size = le16_to_cpu(data->isoc_rx_ep->wMaxPacketSize) *
917 						BTUSB_MAX_ISOC_FRAMES;
918 
919 	buf = kmalloc(size, mem_flags);
920 	if (!buf) {
921 		usb_free_urb(urb);
922 		return -ENOMEM;
923 	}
924 
925 	pipe = usb_rcvisocpipe(data->udev, data->isoc_rx_ep->bEndpointAddress);
926 
927 	usb_fill_int_urb(urb, data->udev, pipe, buf, size, btusb_isoc_complete,
928 			 hdev, data->isoc_rx_ep->bInterval);
929 
930 	urb->transfer_flags = URB_FREE_BUFFER | URB_ISO_ASAP;
931 
932 	__fill_isoc_descriptor(urb, size,
933 			       le16_to_cpu(data->isoc_rx_ep->wMaxPacketSize));
934 
935 	usb_anchor_urb(urb, &data->isoc_anchor);
936 
937 	err = usb_submit_urb(urb, mem_flags);
938 	if (err < 0) {
939 		if (err != -EPERM && err != -ENODEV)
940 			bt_dev_err(hdev, "urb %p submission failed (%d)",
941 				   urb, -err);
942 		usb_unanchor_urb(urb);
943 	}
944 
945 	usb_free_urb(urb);
946 
947 	return err;
948 }
949 
950 static void btusb_diag_complete(struct urb *urb)
951 {
952 	struct hci_dev *hdev = urb->context;
953 	struct btusb_data *data = hci_get_drvdata(hdev);
954 	int err;
955 
956 	BT_DBG("%s urb %p status %d count %d", hdev->name, urb, urb->status,
957 	       urb->actual_length);
958 
959 	if (urb->status == 0) {
960 		struct sk_buff *skb;
961 
962 		skb = bt_skb_alloc(urb->actual_length, GFP_ATOMIC);
963 		if (skb) {
964 			skb_put_data(skb, urb->transfer_buffer,
965 				     urb->actual_length);
966 			hci_recv_diag(hdev, skb);
967 		}
968 	} else if (urb->status == -ENOENT) {
969 		/* Avoid suspend failed when usb_kill_urb */
970 		return;
971 	}
972 
973 	if (!test_bit(BTUSB_DIAG_RUNNING, &data->flags))
974 		return;
975 
976 	usb_anchor_urb(urb, &data->diag_anchor);
977 	usb_mark_last_busy(data->udev);
978 
979 	err = usb_submit_urb(urb, GFP_ATOMIC);
980 	if (err < 0) {
981 		/* -EPERM: urb is being killed;
982 		 * -ENODEV: device got disconnected
983 		 */
984 		if (err != -EPERM && err != -ENODEV)
985 			bt_dev_err(hdev, "urb %p failed to resubmit (%d)",
986 				   urb, -err);
987 		usb_unanchor_urb(urb);
988 	}
989 }
990 
991 static int btusb_submit_diag_urb(struct hci_dev *hdev, gfp_t mem_flags)
992 {
993 	struct btusb_data *data = hci_get_drvdata(hdev);
994 	struct urb *urb;
995 	unsigned char *buf;
996 	unsigned int pipe;
997 	int err, size = HCI_MAX_FRAME_SIZE;
998 
999 	BT_DBG("%s", hdev->name);
1000 
1001 	if (!data->diag_rx_ep)
1002 		return -ENODEV;
1003 
1004 	urb = usb_alloc_urb(0, mem_flags);
1005 	if (!urb)
1006 		return -ENOMEM;
1007 
1008 	buf = kmalloc(size, mem_flags);
1009 	if (!buf) {
1010 		usb_free_urb(urb);
1011 		return -ENOMEM;
1012 	}
1013 
1014 	pipe = usb_rcvbulkpipe(data->udev, data->diag_rx_ep->bEndpointAddress);
1015 
1016 	usb_fill_bulk_urb(urb, data->udev, pipe, buf, size,
1017 			  btusb_diag_complete, hdev);
1018 
1019 	urb->transfer_flags |= URB_FREE_BUFFER;
1020 
1021 	usb_mark_last_busy(data->udev);
1022 	usb_anchor_urb(urb, &data->diag_anchor);
1023 
1024 	err = usb_submit_urb(urb, mem_flags);
1025 	if (err < 0) {
1026 		if (err != -EPERM && err != -ENODEV)
1027 			bt_dev_err(hdev, "urb %p submission failed (%d)",
1028 				   urb, -err);
1029 		usb_unanchor_urb(urb);
1030 	}
1031 
1032 	usb_free_urb(urb);
1033 
1034 	return err;
1035 }
1036 
1037 static void btusb_tx_complete(struct urb *urb)
1038 {
1039 	struct sk_buff *skb = urb->context;
1040 	struct hci_dev *hdev = (struct hci_dev *)skb->dev;
1041 	struct btusb_data *data = hci_get_drvdata(hdev);
1042 
1043 	BT_DBG("%s urb %p status %d count %d", hdev->name, urb, urb->status,
1044 	       urb->actual_length);
1045 
1046 	if (!test_bit(HCI_RUNNING, &hdev->flags))
1047 		goto done;
1048 
1049 	if (!urb->status)
1050 		hdev->stat.byte_tx += urb->transfer_buffer_length;
1051 	else
1052 		hdev->stat.err_tx++;
1053 
1054 done:
1055 	spin_lock(&data->txlock);
1056 	data->tx_in_flight--;
1057 	spin_unlock(&data->txlock);
1058 
1059 	kfree(urb->setup_packet);
1060 
1061 	kfree_skb(skb);
1062 }
1063 
1064 static void btusb_isoc_tx_complete(struct urb *urb)
1065 {
1066 	struct sk_buff *skb = urb->context;
1067 	struct hci_dev *hdev = (struct hci_dev *)skb->dev;
1068 
1069 	BT_DBG("%s urb %p status %d count %d", hdev->name, urb, urb->status,
1070 	       urb->actual_length);
1071 
1072 	if (!test_bit(HCI_RUNNING, &hdev->flags))
1073 		goto done;
1074 
1075 	if (!urb->status)
1076 		hdev->stat.byte_tx += urb->transfer_buffer_length;
1077 	else
1078 		hdev->stat.err_tx++;
1079 
1080 done:
1081 	kfree(urb->setup_packet);
1082 
1083 	kfree_skb(skb);
1084 }
1085 
1086 static int btusb_open(struct hci_dev *hdev)
1087 {
1088 	struct btusb_data *data = hci_get_drvdata(hdev);
1089 	int err;
1090 
1091 	BT_DBG("%s", hdev->name);
1092 
1093 	err = usb_autopm_get_interface(data->intf);
1094 	if (err < 0)
1095 		return err;
1096 
1097 	/* Patching USB firmware files prior to starting any URBs of HCI path
1098 	 * It is more safe to use USB bulk channel for downloading USB patch
1099 	 */
1100 	if (data->setup_on_usb) {
1101 		err = data->setup_on_usb(hdev);
1102 		if (err < 0)
1103 			return err;
1104 	}
1105 
1106 	data->intf->needs_remote_wakeup = 1;
1107 	/* device specific wakeup source enabled and required for USB
1108 	 * remote wakeup while host is suspended
1109 	 */
1110 	device_wakeup_enable(&data->udev->dev);
1111 
1112 	if (test_and_set_bit(BTUSB_INTR_RUNNING, &data->flags))
1113 		goto done;
1114 
1115 	err = btusb_submit_intr_urb(hdev, GFP_KERNEL);
1116 	if (err < 0)
1117 		goto failed;
1118 
1119 	err = btusb_submit_bulk_urb(hdev, GFP_KERNEL);
1120 	if (err < 0) {
1121 		usb_kill_anchored_urbs(&data->intr_anchor);
1122 		goto failed;
1123 	}
1124 
1125 	set_bit(BTUSB_BULK_RUNNING, &data->flags);
1126 	btusb_submit_bulk_urb(hdev, GFP_KERNEL);
1127 
1128 	if (data->diag) {
1129 		if (!btusb_submit_diag_urb(hdev, GFP_KERNEL))
1130 			set_bit(BTUSB_DIAG_RUNNING, &data->flags);
1131 	}
1132 
1133 done:
1134 	usb_autopm_put_interface(data->intf);
1135 	return 0;
1136 
1137 failed:
1138 	clear_bit(BTUSB_INTR_RUNNING, &data->flags);
1139 	usb_autopm_put_interface(data->intf);
1140 	return err;
1141 }
1142 
1143 static void btusb_stop_traffic(struct btusb_data *data)
1144 {
1145 	usb_kill_anchored_urbs(&data->intr_anchor);
1146 	usb_kill_anchored_urbs(&data->bulk_anchor);
1147 	usb_kill_anchored_urbs(&data->isoc_anchor);
1148 	usb_kill_anchored_urbs(&data->diag_anchor);
1149 }
1150 
1151 static int btusb_close(struct hci_dev *hdev)
1152 {
1153 	struct btusb_data *data = hci_get_drvdata(hdev);
1154 	int err;
1155 
1156 	BT_DBG("%s", hdev->name);
1157 
1158 	cancel_work_sync(&data->work);
1159 	cancel_work_sync(&data->waker);
1160 
1161 	clear_bit(BTUSB_ISOC_RUNNING, &data->flags);
1162 	clear_bit(BTUSB_BULK_RUNNING, &data->flags);
1163 	clear_bit(BTUSB_INTR_RUNNING, &data->flags);
1164 	clear_bit(BTUSB_DIAG_RUNNING, &data->flags);
1165 
1166 	btusb_stop_traffic(data);
1167 	btusb_free_frags(data);
1168 
1169 	err = usb_autopm_get_interface(data->intf);
1170 	if (err < 0)
1171 		goto failed;
1172 
1173 	data->intf->needs_remote_wakeup = 0;
1174 	device_wakeup_disable(&data->udev->dev);
1175 	usb_autopm_put_interface(data->intf);
1176 
1177 failed:
1178 	usb_scuttle_anchored_urbs(&data->deferred);
1179 	return 0;
1180 }
1181 
1182 static int btusb_flush(struct hci_dev *hdev)
1183 {
1184 	struct btusb_data *data = hci_get_drvdata(hdev);
1185 
1186 	BT_DBG("%s", hdev->name);
1187 
1188 	usb_kill_anchored_urbs(&data->tx_anchor);
1189 	btusb_free_frags(data);
1190 
1191 	return 0;
1192 }
1193 
1194 static struct urb *alloc_ctrl_urb(struct hci_dev *hdev, struct sk_buff *skb)
1195 {
1196 	struct btusb_data *data = hci_get_drvdata(hdev);
1197 	struct usb_ctrlrequest *dr;
1198 	struct urb *urb;
1199 	unsigned int pipe;
1200 
1201 	urb = usb_alloc_urb(0, GFP_KERNEL);
1202 	if (!urb)
1203 		return ERR_PTR(-ENOMEM);
1204 
1205 	dr = kmalloc(sizeof(*dr), GFP_KERNEL);
1206 	if (!dr) {
1207 		usb_free_urb(urb);
1208 		return ERR_PTR(-ENOMEM);
1209 	}
1210 
1211 	dr->bRequestType = data->cmdreq_type;
1212 	dr->bRequest     = data->cmdreq;
1213 	dr->wIndex       = 0;
1214 	dr->wValue       = 0;
1215 	dr->wLength      = __cpu_to_le16(skb->len);
1216 
1217 	pipe = usb_sndctrlpipe(data->udev, 0x00);
1218 
1219 	usb_fill_control_urb(urb, data->udev, pipe, (void *)dr,
1220 			     skb->data, skb->len, btusb_tx_complete, skb);
1221 
1222 	skb->dev = (void *)hdev;
1223 
1224 	return urb;
1225 }
1226 
1227 static struct urb *alloc_bulk_urb(struct hci_dev *hdev, struct sk_buff *skb)
1228 {
1229 	struct btusb_data *data = hci_get_drvdata(hdev);
1230 	struct urb *urb;
1231 	unsigned int pipe;
1232 
1233 	if (!data->bulk_tx_ep)
1234 		return ERR_PTR(-ENODEV);
1235 
1236 	urb = usb_alloc_urb(0, GFP_KERNEL);
1237 	if (!urb)
1238 		return ERR_PTR(-ENOMEM);
1239 
1240 	pipe = usb_sndbulkpipe(data->udev, data->bulk_tx_ep->bEndpointAddress);
1241 
1242 	usb_fill_bulk_urb(urb, data->udev, pipe,
1243 			  skb->data, skb->len, btusb_tx_complete, skb);
1244 
1245 	skb->dev = (void *)hdev;
1246 
1247 	return urb;
1248 }
1249 
1250 static struct urb *alloc_isoc_urb(struct hci_dev *hdev, struct sk_buff *skb)
1251 {
1252 	struct btusb_data *data = hci_get_drvdata(hdev);
1253 	struct urb *urb;
1254 	unsigned int pipe;
1255 
1256 	if (!data->isoc_tx_ep)
1257 		return ERR_PTR(-ENODEV);
1258 
1259 	urb = usb_alloc_urb(BTUSB_MAX_ISOC_FRAMES, GFP_KERNEL);
1260 	if (!urb)
1261 		return ERR_PTR(-ENOMEM);
1262 
1263 	pipe = usb_sndisocpipe(data->udev, data->isoc_tx_ep->bEndpointAddress);
1264 
1265 	usb_fill_int_urb(urb, data->udev, pipe,
1266 			 skb->data, skb->len, btusb_isoc_tx_complete,
1267 			 skb, data->isoc_tx_ep->bInterval);
1268 
1269 	urb->transfer_flags  = URB_ISO_ASAP;
1270 
1271 	__fill_isoc_descriptor(urb, skb->len,
1272 			       le16_to_cpu(data->isoc_tx_ep->wMaxPacketSize));
1273 
1274 	skb->dev = (void *)hdev;
1275 
1276 	return urb;
1277 }
1278 
1279 static int submit_tx_urb(struct hci_dev *hdev, struct urb *urb)
1280 {
1281 	struct btusb_data *data = hci_get_drvdata(hdev);
1282 	int err;
1283 
1284 	usb_anchor_urb(urb, &data->tx_anchor);
1285 
1286 	err = usb_submit_urb(urb, GFP_KERNEL);
1287 	if (err < 0) {
1288 		if (err != -EPERM && err != -ENODEV)
1289 			bt_dev_err(hdev, "urb %p submission failed (%d)",
1290 				   urb, -err);
1291 		kfree(urb->setup_packet);
1292 		usb_unanchor_urb(urb);
1293 	} else {
1294 		usb_mark_last_busy(data->udev);
1295 	}
1296 
1297 	usb_free_urb(urb);
1298 	return err;
1299 }
1300 
1301 static int submit_or_queue_tx_urb(struct hci_dev *hdev, struct urb *urb)
1302 {
1303 	struct btusb_data *data = hci_get_drvdata(hdev);
1304 	unsigned long flags;
1305 	bool suspending;
1306 
1307 	spin_lock_irqsave(&data->txlock, flags);
1308 	suspending = test_bit(BTUSB_SUSPENDING, &data->flags);
1309 	if (!suspending)
1310 		data->tx_in_flight++;
1311 	spin_unlock_irqrestore(&data->txlock, flags);
1312 
1313 	if (!suspending)
1314 		return submit_tx_urb(hdev, urb);
1315 
1316 	usb_anchor_urb(urb, &data->deferred);
1317 	schedule_work(&data->waker);
1318 
1319 	usb_free_urb(urb);
1320 	return 0;
1321 }
1322 
1323 static int btusb_send_frame(struct hci_dev *hdev, struct sk_buff *skb)
1324 {
1325 	struct urb *urb;
1326 
1327 	BT_DBG("%s", hdev->name);
1328 
1329 	switch (hci_skb_pkt_type(skb)) {
1330 	case HCI_COMMAND_PKT:
1331 		urb = alloc_ctrl_urb(hdev, skb);
1332 		if (IS_ERR(urb))
1333 			return PTR_ERR(urb);
1334 
1335 		hdev->stat.cmd_tx++;
1336 		return submit_or_queue_tx_urb(hdev, urb);
1337 
1338 	case HCI_ACLDATA_PKT:
1339 		urb = alloc_bulk_urb(hdev, skb);
1340 		if (IS_ERR(urb))
1341 			return PTR_ERR(urb);
1342 
1343 		hdev->stat.acl_tx++;
1344 		return submit_or_queue_tx_urb(hdev, urb);
1345 
1346 	case HCI_SCODATA_PKT:
1347 		if (hci_conn_num(hdev, SCO_LINK) < 1)
1348 			return -ENODEV;
1349 
1350 		urb = alloc_isoc_urb(hdev, skb);
1351 		if (IS_ERR(urb))
1352 			return PTR_ERR(urb);
1353 
1354 		hdev->stat.sco_tx++;
1355 		return submit_tx_urb(hdev, urb);
1356 	}
1357 
1358 	return -EILSEQ;
1359 }
1360 
1361 static void btusb_notify(struct hci_dev *hdev, unsigned int evt)
1362 {
1363 	struct btusb_data *data = hci_get_drvdata(hdev);
1364 
1365 	BT_DBG("%s evt %d", hdev->name, evt);
1366 
1367 	if (hci_conn_num(hdev, SCO_LINK) != data->sco_num) {
1368 		data->sco_num = hci_conn_num(hdev, SCO_LINK);
1369 		schedule_work(&data->work);
1370 	}
1371 }
1372 
1373 static inline int __set_isoc_interface(struct hci_dev *hdev, int altsetting)
1374 {
1375 	struct btusb_data *data = hci_get_drvdata(hdev);
1376 	struct usb_interface *intf = data->isoc;
1377 	struct usb_endpoint_descriptor *ep_desc;
1378 	int i, err;
1379 
1380 	if (!data->isoc)
1381 		return -ENODEV;
1382 
1383 	err = usb_set_interface(data->udev, data->isoc_ifnum, altsetting);
1384 	if (err < 0) {
1385 		bt_dev_err(hdev, "setting interface failed (%d)", -err);
1386 		return err;
1387 	}
1388 
1389 	data->isoc_altsetting = altsetting;
1390 
1391 	data->isoc_tx_ep = NULL;
1392 	data->isoc_rx_ep = NULL;
1393 
1394 	for (i = 0; i < intf->cur_altsetting->desc.bNumEndpoints; i++) {
1395 		ep_desc = &intf->cur_altsetting->endpoint[i].desc;
1396 
1397 		if (!data->isoc_tx_ep && usb_endpoint_is_isoc_out(ep_desc)) {
1398 			data->isoc_tx_ep = ep_desc;
1399 			continue;
1400 		}
1401 
1402 		if (!data->isoc_rx_ep && usb_endpoint_is_isoc_in(ep_desc)) {
1403 			data->isoc_rx_ep = ep_desc;
1404 			continue;
1405 		}
1406 	}
1407 
1408 	if (!data->isoc_tx_ep || !data->isoc_rx_ep) {
1409 		bt_dev_err(hdev, "invalid SCO descriptors");
1410 		return -ENODEV;
1411 	}
1412 
1413 	return 0;
1414 }
1415 
1416 static void btusb_work(struct work_struct *work)
1417 {
1418 	struct btusb_data *data = container_of(work, struct btusb_data, work);
1419 	struct hci_dev *hdev = data->hdev;
1420 	int new_alts;
1421 	int err;
1422 
1423 	if (data->sco_num > 0) {
1424 		if (!test_bit(BTUSB_DID_ISO_RESUME, &data->flags)) {
1425 			err = usb_autopm_get_interface(data->isoc ? data->isoc : data->intf);
1426 			if (err < 0) {
1427 				clear_bit(BTUSB_ISOC_RUNNING, &data->flags);
1428 				usb_kill_anchored_urbs(&data->isoc_anchor);
1429 				return;
1430 			}
1431 
1432 			set_bit(BTUSB_DID_ISO_RESUME, &data->flags);
1433 		}
1434 
1435 		if (hdev->voice_setting & 0x0020) {
1436 			static const int alts[3] = { 2, 4, 5 };
1437 
1438 			new_alts = alts[data->sco_num - 1];
1439 		} else {
1440 			new_alts = data->sco_num;
1441 		}
1442 
1443 		if (data->isoc_altsetting != new_alts) {
1444 			unsigned long flags;
1445 
1446 			clear_bit(BTUSB_ISOC_RUNNING, &data->flags);
1447 			usb_kill_anchored_urbs(&data->isoc_anchor);
1448 
1449 			/* When isochronous alternate setting needs to be
1450 			 * changed, because SCO connection has been added
1451 			 * or removed, a packet fragment may be left in the
1452 			 * reassembling state. This could lead to wrongly
1453 			 * assembled fragments.
1454 			 *
1455 			 * Clear outstanding fragment when selecting a new
1456 			 * alternate setting.
1457 			 */
1458 			spin_lock_irqsave(&data->rxlock, flags);
1459 			kfree_skb(data->sco_skb);
1460 			data->sco_skb = NULL;
1461 			spin_unlock_irqrestore(&data->rxlock, flags);
1462 
1463 			if (__set_isoc_interface(hdev, new_alts) < 0)
1464 				return;
1465 		}
1466 
1467 		if (!test_and_set_bit(BTUSB_ISOC_RUNNING, &data->flags)) {
1468 			if (btusb_submit_isoc_urb(hdev, GFP_KERNEL) < 0)
1469 				clear_bit(BTUSB_ISOC_RUNNING, &data->flags);
1470 			else
1471 				btusb_submit_isoc_urb(hdev, GFP_KERNEL);
1472 		}
1473 	} else {
1474 		clear_bit(BTUSB_ISOC_RUNNING, &data->flags);
1475 		usb_kill_anchored_urbs(&data->isoc_anchor);
1476 
1477 		__set_isoc_interface(hdev, 0);
1478 		if (test_and_clear_bit(BTUSB_DID_ISO_RESUME, &data->flags))
1479 			usb_autopm_put_interface(data->isoc ? data->isoc : data->intf);
1480 	}
1481 }
1482 
1483 static void btusb_waker(struct work_struct *work)
1484 {
1485 	struct btusb_data *data = container_of(work, struct btusb_data, waker);
1486 	int err;
1487 
1488 	err = usb_autopm_get_interface(data->intf);
1489 	if (err < 0)
1490 		return;
1491 
1492 	usb_autopm_put_interface(data->intf);
1493 }
1494 
1495 static int btusb_setup_bcm92035(struct hci_dev *hdev)
1496 {
1497 	struct sk_buff *skb;
1498 	u8 val = 0x00;
1499 
1500 	BT_DBG("%s", hdev->name);
1501 
1502 	skb = __hci_cmd_sync(hdev, 0xfc3b, 1, &val, HCI_INIT_TIMEOUT);
1503 	if (IS_ERR(skb))
1504 		bt_dev_err(hdev, "BCM92035 command failed (%ld)", PTR_ERR(skb));
1505 	else
1506 		kfree_skb(skb);
1507 
1508 	return 0;
1509 }
1510 
1511 static int btusb_setup_csr(struct hci_dev *hdev)
1512 {
1513 	struct hci_rp_read_local_version *rp;
1514 	struct sk_buff *skb;
1515 
1516 	BT_DBG("%s", hdev->name);
1517 
1518 	skb = __hci_cmd_sync(hdev, HCI_OP_READ_LOCAL_VERSION, 0, NULL,
1519 			     HCI_INIT_TIMEOUT);
1520 	if (IS_ERR(skb)) {
1521 		int err = PTR_ERR(skb);
1522 		bt_dev_err(hdev, "CSR: Local version failed (%d)", err);
1523 		return err;
1524 	}
1525 
1526 	if (skb->len != sizeof(struct hci_rp_read_local_version)) {
1527 		bt_dev_err(hdev, "CSR: Local version length mismatch");
1528 		kfree_skb(skb);
1529 		return -EIO;
1530 	}
1531 
1532 	rp = (struct hci_rp_read_local_version *)skb->data;
1533 
1534 	/* Detect controllers which aren't real CSR ones. */
1535 	if (le16_to_cpu(rp->manufacturer) != 10 ||
1536 	    le16_to_cpu(rp->lmp_subver) == 0x0c5c) {
1537 		/* Clear the reset quirk since this is not an actual
1538 		 * early Bluetooth 1.1 device from CSR.
1539 		 */
1540 		clear_bit(HCI_QUIRK_RESET_ON_CLOSE, &hdev->quirks);
1541 
1542 		/* These fake CSR controllers have all a broken
1543 		 * stored link key handling and so just disable it.
1544 		 */
1545 		set_bit(HCI_QUIRK_BROKEN_STORED_LINK_KEY, &hdev->quirks);
1546 	}
1547 
1548 	kfree_skb(skb);
1549 
1550 	return 0;
1551 }
1552 
1553 static const struct firmware *btusb_setup_intel_get_fw(struct hci_dev *hdev,
1554 						       struct intel_version *ver)
1555 {
1556 	const struct firmware *fw;
1557 	char fwname[64];
1558 	int ret;
1559 
1560 	snprintf(fwname, sizeof(fwname),
1561 		 "intel/ibt-hw-%x.%x.%x-fw-%x.%x.%x.%x.%x.bseq",
1562 		 ver->hw_platform, ver->hw_variant, ver->hw_revision,
1563 		 ver->fw_variant,  ver->fw_revision, ver->fw_build_num,
1564 		 ver->fw_build_ww, ver->fw_build_yy);
1565 
1566 	ret = request_firmware(&fw, fwname, &hdev->dev);
1567 	if (ret < 0) {
1568 		if (ret == -EINVAL) {
1569 			BT_ERR("%s Intel firmware file request failed (%d)",
1570 			       hdev->name, ret);
1571 			return NULL;
1572 		}
1573 
1574 		BT_ERR("%s failed to open Intel firmware file: %s(%d)",
1575 		       hdev->name, fwname, ret);
1576 
1577 		/* If the correct firmware patch file is not found, use the
1578 		 * default firmware patch file instead
1579 		 */
1580 		snprintf(fwname, sizeof(fwname), "intel/ibt-hw-%x.%x.bseq",
1581 			 ver->hw_platform, ver->hw_variant);
1582 		if (request_firmware(&fw, fwname, &hdev->dev) < 0) {
1583 			BT_ERR("%s failed to open default Intel fw file: %s",
1584 			       hdev->name, fwname);
1585 			return NULL;
1586 		}
1587 	}
1588 
1589 	bt_dev_info(hdev, "Intel Bluetooth firmware file: %s", fwname);
1590 
1591 	return fw;
1592 }
1593 
1594 static int btusb_setup_intel_patching(struct hci_dev *hdev,
1595 				      const struct firmware *fw,
1596 				      const u8 **fw_ptr, int *disable_patch)
1597 {
1598 	struct sk_buff *skb;
1599 	struct hci_command_hdr *cmd;
1600 	const u8 *cmd_param;
1601 	struct hci_event_hdr *evt = NULL;
1602 	const u8 *evt_param = NULL;
1603 	int remain = fw->size - (*fw_ptr - fw->data);
1604 
1605 	/* The first byte indicates the types of the patch command or event.
1606 	 * 0x01 means HCI command and 0x02 is HCI event. If the first bytes
1607 	 * in the current firmware buffer doesn't start with 0x01 or
1608 	 * the size of remain buffer is smaller than HCI command header,
1609 	 * the firmware file is corrupted and it should stop the patching
1610 	 * process.
1611 	 */
1612 	if (remain > HCI_COMMAND_HDR_SIZE && *fw_ptr[0] != 0x01) {
1613 		BT_ERR("%s Intel fw corrupted: invalid cmd read", hdev->name);
1614 		return -EINVAL;
1615 	}
1616 	(*fw_ptr)++;
1617 	remain--;
1618 
1619 	cmd = (struct hci_command_hdr *)(*fw_ptr);
1620 	*fw_ptr += sizeof(*cmd);
1621 	remain -= sizeof(*cmd);
1622 
1623 	/* Ensure that the remain firmware data is long enough than the length
1624 	 * of command parameter. If not, the firmware file is corrupted.
1625 	 */
1626 	if (remain < cmd->plen) {
1627 		BT_ERR("%s Intel fw corrupted: invalid cmd len", hdev->name);
1628 		return -EFAULT;
1629 	}
1630 
1631 	/* If there is a command that loads a patch in the firmware
1632 	 * file, then enable the patch upon success, otherwise just
1633 	 * disable the manufacturer mode, for example patch activation
1634 	 * is not required when the default firmware patch file is used
1635 	 * because there are no patch data to load.
1636 	 */
1637 	if (*disable_patch && le16_to_cpu(cmd->opcode) == 0xfc8e)
1638 		*disable_patch = 0;
1639 
1640 	cmd_param = *fw_ptr;
1641 	*fw_ptr += cmd->plen;
1642 	remain -= cmd->plen;
1643 
1644 	/* This reads the expected events when the above command is sent to the
1645 	 * device. Some vendor commands expects more than one events, for
1646 	 * example command status event followed by vendor specific event.
1647 	 * For this case, it only keeps the last expected event. so the command
1648 	 * can be sent with __hci_cmd_sync_ev() which returns the sk_buff of
1649 	 * last expected event.
1650 	 */
1651 	while (remain > HCI_EVENT_HDR_SIZE && *fw_ptr[0] == 0x02) {
1652 		(*fw_ptr)++;
1653 		remain--;
1654 
1655 		evt = (struct hci_event_hdr *)(*fw_ptr);
1656 		*fw_ptr += sizeof(*evt);
1657 		remain -= sizeof(*evt);
1658 
1659 		if (remain < evt->plen) {
1660 			BT_ERR("%s Intel fw corrupted: invalid evt len",
1661 			       hdev->name);
1662 			return -EFAULT;
1663 		}
1664 
1665 		evt_param = *fw_ptr;
1666 		*fw_ptr += evt->plen;
1667 		remain -= evt->plen;
1668 	}
1669 
1670 	/* Every HCI commands in the firmware file has its correspond event.
1671 	 * If event is not found or remain is smaller than zero, the firmware
1672 	 * file is corrupted.
1673 	 */
1674 	if (!evt || !evt_param || remain < 0) {
1675 		BT_ERR("%s Intel fw corrupted: invalid evt read", hdev->name);
1676 		return -EFAULT;
1677 	}
1678 
1679 	skb = __hci_cmd_sync_ev(hdev, le16_to_cpu(cmd->opcode), cmd->plen,
1680 				cmd_param, evt->evt, HCI_INIT_TIMEOUT);
1681 	if (IS_ERR(skb)) {
1682 		BT_ERR("%s sending Intel patch command (0x%4.4x) failed (%ld)",
1683 		       hdev->name, cmd->opcode, PTR_ERR(skb));
1684 		return PTR_ERR(skb);
1685 	}
1686 
1687 	/* It ensures that the returned event matches the event data read from
1688 	 * the firmware file. At fist, it checks the length and then
1689 	 * the contents of the event.
1690 	 */
1691 	if (skb->len != evt->plen) {
1692 		BT_ERR("%s mismatch event length (opcode 0x%4.4x)", hdev->name,
1693 		       le16_to_cpu(cmd->opcode));
1694 		kfree_skb(skb);
1695 		return -EFAULT;
1696 	}
1697 
1698 	if (memcmp(skb->data, evt_param, evt->plen)) {
1699 		BT_ERR("%s mismatch event parameter (opcode 0x%4.4x)",
1700 		       hdev->name, le16_to_cpu(cmd->opcode));
1701 		kfree_skb(skb);
1702 		return -EFAULT;
1703 	}
1704 	kfree_skb(skb);
1705 
1706 	return 0;
1707 }
1708 
1709 static int btusb_setup_intel(struct hci_dev *hdev)
1710 {
1711 	struct sk_buff *skb;
1712 	const struct firmware *fw;
1713 	const u8 *fw_ptr;
1714 	int disable_patch, err;
1715 	struct intel_version ver;
1716 
1717 	BT_DBG("%s", hdev->name);
1718 
1719 	/* The controller has a bug with the first HCI command sent to it
1720 	 * returning number of completed commands as zero. This would stall the
1721 	 * command processing in the Bluetooth core.
1722 	 *
1723 	 * As a workaround, send HCI Reset command first which will reset the
1724 	 * number of completed commands and allow normal command processing
1725 	 * from now on.
1726 	 */
1727 	skb = __hci_cmd_sync(hdev, HCI_OP_RESET, 0, NULL, HCI_INIT_TIMEOUT);
1728 	if (IS_ERR(skb)) {
1729 		BT_ERR("%s sending initial HCI reset command failed (%ld)",
1730 		       hdev->name, PTR_ERR(skb));
1731 		return PTR_ERR(skb);
1732 	}
1733 	kfree_skb(skb);
1734 
1735 	/* Read Intel specific controller version first to allow selection of
1736 	 * which firmware file to load.
1737 	 *
1738 	 * The returned information are hardware variant and revision plus
1739 	 * firmware variant, revision and build number.
1740 	 */
1741 	err = btintel_read_version(hdev, &ver);
1742 	if (err)
1743 		return err;
1744 
1745 	bt_dev_info(hdev, "read Intel version: %02x%02x%02x%02x%02x%02x%02x%02x%02x",
1746 		    ver.hw_platform, ver.hw_variant, ver.hw_revision,
1747 		    ver.fw_variant,  ver.fw_revision, ver.fw_build_num,
1748 		    ver.fw_build_ww, ver.fw_build_yy, ver.fw_patch_num);
1749 
1750 	/* fw_patch_num indicates the version of patch the device currently
1751 	 * have. If there is no patch data in the device, it is always 0x00.
1752 	 * So, if it is other than 0x00, no need to patch the device again.
1753 	 */
1754 	if (ver.fw_patch_num) {
1755 		bt_dev_info(hdev, "Intel device is already patched. "
1756 			    "patch num: %02x", ver.fw_patch_num);
1757 		goto complete;
1758 	}
1759 
1760 	/* Opens the firmware patch file based on the firmware version read
1761 	 * from the controller. If it fails to open the matching firmware
1762 	 * patch file, it tries to open the default firmware patch file.
1763 	 * If no patch file is found, allow the device to operate without
1764 	 * a patch.
1765 	 */
1766 	fw = btusb_setup_intel_get_fw(hdev, &ver);
1767 	if (!fw)
1768 		goto complete;
1769 	fw_ptr = fw->data;
1770 
1771 	/* Enable the manufacturer mode of the controller.
1772 	 * Only while this mode is enabled, the driver can download the
1773 	 * firmware patch data and configuration parameters.
1774 	 */
1775 	err = btintel_enter_mfg(hdev);
1776 	if (err) {
1777 		release_firmware(fw);
1778 		return err;
1779 	}
1780 
1781 	disable_patch = 1;
1782 
1783 	/* The firmware data file consists of list of Intel specific HCI
1784 	 * commands and its expected events. The first byte indicates the
1785 	 * type of the message, either HCI command or HCI event.
1786 	 *
1787 	 * It reads the command and its expected event from the firmware file,
1788 	 * and send to the controller. Once __hci_cmd_sync_ev() returns,
1789 	 * the returned event is compared with the event read from the firmware
1790 	 * file and it will continue until all the messages are downloaded to
1791 	 * the controller.
1792 	 *
1793 	 * Once the firmware patching is completed successfully,
1794 	 * the manufacturer mode is disabled with reset and activating the
1795 	 * downloaded patch.
1796 	 *
1797 	 * If the firmware patching fails, the manufacturer mode is
1798 	 * disabled with reset and deactivating the patch.
1799 	 *
1800 	 * If the default patch file is used, no reset is done when disabling
1801 	 * the manufacturer.
1802 	 */
1803 	while (fw->size > fw_ptr - fw->data) {
1804 		int ret;
1805 
1806 		ret = btusb_setup_intel_patching(hdev, fw, &fw_ptr,
1807 						 &disable_patch);
1808 		if (ret < 0)
1809 			goto exit_mfg_deactivate;
1810 	}
1811 
1812 	release_firmware(fw);
1813 
1814 	if (disable_patch)
1815 		goto exit_mfg_disable;
1816 
1817 	/* Patching completed successfully and disable the manufacturer mode
1818 	 * with reset and activate the downloaded firmware patches.
1819 	 */
1820 	err = btintel_exit_mfg(hdev, true, true);
1821 	if (err)
1822 		return err;
1823 
1824 	bt_dev_info(hdev, "Intel firmware patch completed and activated");
1825 
1826 	goto complete;
1827 
1828 exit_mfg_disable:
1829 	/* Disable the manufacturer mode without reset */
1830 	err = btintel_exit_mfg(hdev, false, false);
1831 	if (err)
1832 		return err;
1833 
1834 	bt_dev_info(hdev, "Intel firmware patch completed");
1835 
1836 	goto complete;
1837 
1838 exit_mfg_deactivate:
1839 	release_firmware(fw);
1840 
1841 	/* Patching failed. Disable the manufacturer mode with reset and
1842 	 * deactivate the downloaded firmware patches.
1843 	 */
1844 	err = btintel_exit_mfg(hdev, true, false);
1845 	if (err)
1846 		return err;
1847 
1848 	bt_dev_info(hdev, "Intel firmware patch completed and deactivated");
1849 
1850 complete:
1851 	/* Set the event mask for Intel specific vendor events. This enables
1852 	 * a few extra events that are useful during general operation.
1853 	 */
1854 	btintel_set_event_mask_mfg(hdev, false);
1855 
1856 	btintel_check_bdaddr(hdev);
1857 	return 0;
1858 }
1859 
1860 static int inject_cmd_complete(struct hci_dev *hdev, __u16 opcode)
1861 {
1862 	struct sk_buff *skb;
1863 	struct hci_event_hdr *hdr;
1864 	struct hci_ev_cmd_complete *evt;
1865 
1866 	skb = bt_skb_alloc(sizeof(*hdr) + sizeof(*evt) + 1, GFP_ATOMIC);
1867 	if (!skb)
1868 		return -ENOMEM;
1869 
1870 	hdr = skb_put(skb, sizeof(*hdr));
1871 	hdr->evt = HCI_EV_CMD_COMPLETE;
1872 	hdr->plen = sizeof(*evt) + 1;
1873 
1874 	evt = skb_put(skb, sizeof(*evt));
1875 	evt->ncmd = 0x01;
1876 	evt->opcode = cpu_to_le16(opcode);
1877 
1878 	skb_put_u8(skb, 0x00);
1879 
1880 	hci_skb_pkt_type(skb) = HCI_EVENT_PKT;
1881 
1882 	return hci_recv_frame(hdev, skb);
1883 }
1884 
1885 static int btusb_recv_bulk_intel(struct btusb_data *data, void *buffer,
1886 				 int count)
1887 {
1888 	/* When the device is in bootloader mode, then it can send
1889 	 * events via the bulk endpoint. These events are treated the
1890 	 * same way as the ones received from the interrupt endpoint.
1891 	 */
1892 	if (test_bit(BTUSB_BOOTLOADER, &data->flags))
1893 		return btusb_recv_intr(data, buffer, count);
1894 
1895 	return btusb_recv_bulk(data, buffer, count);
1896 }
1897 
1898 static void btusb_intel_bootup(struct btusb_data *data, const void *ptr,
1899 			       unsigned int len)
1900 {
1901 	const struct intel_bootup *evt = ptr;
1902 
1903 	if (len != sizeof(*evt))
1904 		return;
1905 
1906 	if (test_and_clear_bit(BTUSB_BOOTING, &data->flags)) {
1907 		smp_mb__after_atomic();
1908 		wake_up_bit(&data->flags, BTUSB_BOOTING);
1909 	}
1910 }
1911 
1912 static void btusb_intel_secure_send_result(struct btusb_data *data,
1913 					   const void *ptr, unsigned int len)
1914 {
1915 	const struct intel_secure_send_result *evt = ptr;
1916 
1917 	if (len != sizeof(*evt))
1918 		return;
1919 
1920 	if (evt->result)
1921 		set_bit(BTUSB_FIRMWARE_FAILED, &data->flags);
1922 
1923 	if (test_and_clear_bit(BTUSB_DOWNLOADING, &data->flags) &&
1924 	    test_bit(BTUSB_FIRMWARE_LOADED, &data->flags)) {
1925 		smp_mb__after_atomic();
1926 		wake_up_bit(&data->flags, BTUSB_DOWNLOADING);
1927 	}
1928 }
1929 
1930 static int btusb_recv_event_intel(struct hci_dev *hdev, struct sk_buff *skb)
1931 {
1932 	struct btusb_data *data = hci_get_drvdata(hdev);
1933 
1934 	if (test_bit(BTUSB_BOOTLOADER, &data->flags)) {
1935 		struct hci_event_hdr *hdr = (void *)skb->data;
1936 
1937 		if (skb->len > HCI_EVENT_HDR_SIZE && hdr->evt == 0xff &&
1938 		    hdr->plen > 0) {
1939 			const void *ptr = skb->data + HCI_EVENT_HDR_SIZE + 1;
1940 			unsigned int len = skb->len - HCI_EVENT_HDR_SIZE - 1;
1941 
1942 			switch (skb->data[2]) {
1943 			case 0x02:
1944 				/* When switching to the operational firmware
1945 				 * the device sends a vendor specific event
1946 				 * indicating that the bootup completed.
1947 				 */
1948 				btusb_intel_bootup(data, ptr, len);
1949 				break;
1950 			case 0x06:
1951 				/* When the firmware loading completes the
1952 				 * device sends out a vendor specific event
1953 				 * indicating the result of the firmware
1954 				 * loading.
1955 				 */
1956 				btusb_intel_secure_send_result(data, ptr, len);
1957 				break;
1958 			}
1959 		}
1960 	}
1961 
1962 	return hci_recv_frame(hdev, skb);
1963 }
1964 
1965 static int btusb_send_frame_intel(struct hci_dev *hdev, struct sk_buff *skb)
1966 {
1967 	struct btusb_data *data = hci_get_drvdata(hdev);
1968 	struct urb *urb;
1969 
1970 	BT_DBG("%s", hdev->name);
1971 
1972 	switch (hci_skb_pkt_type(skb)) {
1973 	case HCI_COMMAND_PKT:
1974 		if (test_bit(BTUSB_BOOTLOADER, &data->flags)) {
1975 			struct hci_command_hdr *cmd = (void *)skb->data;
1976 			__u16 opcode = le16_to_cpu(cmd->opcode);
1977 
1978 			/* When in bootloader mode and the command 0xfc09
1979 			 * is received, it needs to be send down the
1980 			 * bulk endpoint. So allocate a bulk URB instead.
1981 			 */
1982 			if (opcode == 0xfc09)
1983 				urb = alloc_bulk_urb(hdev, skb);
1984 			else
1985 				urb = alloc_ctrl_urb(hdev, skb);
1986 
1987 			/* When the 0xfc01 command is issued to boot into
1988 			 * the operational firmware, it will actually not
1989 			 * send a command complete event. To keep the flow
1990 			 * control working inject that event here.
1991 			 */
1992 			if (opcode == 0xfc01)
1993 				inject_cmd_complete(hdev, opcode);
1994 		} else {
1995 			urb = alloc_ctrl_urb(hdev, skb);
1996 		}
1997 		if (IS_ERR(urb))
1998 			return PTR_ERR(urb);
1999 
2000 		hdev->stat.cmd_tx++;
2001 		return submit_or_queue_tx_urb(hdev, urb);
2002 
2003 	case HCI_ACLDATA_PKT:
2004 		urb = alloc_bulk_urb(hdev, skb);
2005 		if (IS_ERR(urb))
2006 			return PTR_ERR(urb);
2007 
2008 		hdev->stat.acl_tx++;
2009 		return submit_or_queue_tx_urb(hdev, urb);
2010 
2011 	case HCI_SCODATA_PKT:
2012 		if (hci_conn_num(hdev, SCO_LINK) < 1)
2013 			return -ENODEV;
2014 
2015 		urb = alloc_isoc_urb(hdev, skb);
2016 		if (IS_ERR(urb))
2017 			return PTR_ERR(urb);
2018 
2019 		hdev->stat.sco_tx++;
2020 		return submit_tx_urb(hdev, urb);
2021 	}
2022 
2023 	return -EILSEQ;
2024 }
2025 
2026 static int btusb_setup_intel_new(struct hci_dev *hdev)
2027 {
2028 	struct btusb_data *data = hci_get_drvdata(hdev);
2029 	struct intel_version ver;
2030 	struct intel_boot_params params;
2031 	const struct firmware *fw;
2032 	u32 boot_param;
2033 	char fwname[64];
2034 	ktime_t calltime, delta, rettime;
2035 	unsigned long long duration;
2036 	int err;
2037 
2038 	BT_DBG("%s", hdev->name);
2039 
2040 	/* Set the default boot parameter to 0x0 and it is updated to
2041 	 * SKU specific boot parameter after reading Intel_Write_Boot_Params
2042 	 * command while downloading the firmware.
2043 	 */
2044 	boot_param = 0x00000000;
2045 
2046 	calltime = ktime_get();
2047 
2048 	/* Read the Intel version information to determine if the device
2049 	 * is in bootloader mode or if it already has operational firmware
2050 	 * loaded.
2051 	 */
2052 	err = btintel_read_version(hdev, &ver);
2053 	if (err)
2054 		return err;
2055 
2056 	/* The hardware platform number has a fixed value of 0x37 and
2057 	 * for now only accept this single value.
2058 	 */
2059 	if (ver.hw_platform != 0x37) {
2060 		BT_ERR("%s: Unsupported Intel hardware platform (%u)",
2061 		       hdev->name, ver.hw_platform);
2062 		return -EINVAL;
2063 	}
2064 
2065 	/* Check for supported iBT hardware variants of this firmware
2066 	 * loading method.
2067 	 *
2068 	 * This check has been put in place to ensure correct forward
2069 	 * compatibility options when newer hardware variants come along.
2070 	 */
2071 	switch (ver.hw_variant) {
2072 	case 0x0b:	/* SfP */
2073 	case 0x0c:	/* WsP */
2074 	case 0x11:	/* JfP */
2075 	case 0x12:	/* ThP */
2076 		break;
2077 	default:
2078 		BT_ERR("%s: Unsupported Intel hardware variant (%u)",
2079 		       hdev->name, ver.hw_variant);
2080 		return -EINVAL;
2081 	}
2082 
2083 	btintel_version_info(hdev, &ver);
2084 
2085 	/* The firmware variant determines if the device is in bootloader
2086 	 * mode or is running operational firmware. The value 0x06 identifies
2087 	 * the bootloader and the value 0x23 identifies the operational
2088 	 * firmware.
2089 	 *
2090 	 * When the operational firmware is already present, then only
2091 	 * the check for valid Bluetooth device address is needed. This
2092 	 * determines if the device will be added as configured or
2093 	 * unconfigured controller.
2094 	 *
2095 	 * It is not possible to use the Secure Boot Parameters in this
2096 	 * case since that command is only available in bootloader mode.
2097 	 */
2098 	if (ver.fw_variant == 0x23) {
2099 		clear_bit(BTUSB_BOOTLOADER, &data->flags);
2100 		btintel_check_bdaddr(hdev);
2101 		return 0;
2102 	}
2103 
2104 	/* If the device is not in bootloader mode, then the only possible
2105 	 * choice is to return an error and abort the device initialization.
2106 	 */
2107 	if (ver.fw_variant != 0x06) {
2108 		BT_ERR("%s: Unsupported Intel firmware variant (%u)",
2109 		       hdev->name, ver.fw_variant);
2110 		return -ENODEV;
2111 	}
2112 
2113 	/* Read the secure boot parameters to identify the operating
2114 	 * details of the bootloader.
2115 	 */
2116 	err = btintel_read_boot_params(hdev, &params);
2117 	if (err)
2118 		return err;
2119 
2120 	/* It is required that every single firmware fragment is acknowledged
2121 	 * with a command complete event. If the boot parameters indicate
2122 	 * that this bootloader does not send them, then abort the setup.
2123 	 */
2124 	if (params.limited_cce != 0x00) {
2125 		BT_ERR("%s: Unsupported Intel firmware loading method (%u)",
2126 		       hdev->name, params.limited_cce);
2127 		return -EINVAL;
2128 	}
2129 
2130 	/* If the OTP has no valid Bluetooth device address, then there will
2131 	 * also be no valid address for the operational firmware.
2132 	 */
2133 	if (!bacmp(&params.otp_bdaddr, BDADDR_ANY)) {
2134 		bt_dev_info(hdev, "No device address configured");
2135 		set_bit(HCI_QUIRK_INVALID_BDADDR, &hdev->quirks);
2136 	}
2137 
2138 	/* With this Intel bootloader only the hardware variant and device
2139 	 * revision information are used to select the right firmware for SfP
2140 	 * and WsP.
2141 	 *
2142 	 * The firmware filename is ibt-<hw_variant>-<dev_revid>.sfi.
2143 	 *
2144 	 * Currently the supported hardware variants are:
2145 	 *   11 (0x0b) for iBT3.0 (LnP/SfP)
2146 	 *   12 (0x0c) for iBT3.5 (WsP)
2147 	 *
2148 	 * For ThP/JfP and for future SKU's, the FW name varies based on HW
2149 	 * variant, HW revision and FW revision, as these are dependent on CNVi
2150 	 * and RF Combination.
2151 	 *
2152 	 *   17 (0x11) for iBT3.5 (JfP)
2153 	 *   18 (0x12) for iBT3.5 (ThP)
2154 	 *
2155 	 * The firmware file name for these will be
2156 	 * ibt-<hw_variant>-<hw_revision>-<fw_revision>.sfi.
2157 	 *
2158 	 */
2159 	switch (ver.hw_variant) {
2160 	case 0x0b:	/* SfP */
2161 	case 0x0c:	/* WsP */
2162 		snprintf(fwname, sizeof(fwname), "intel/ibt-%u-%u.sfi",
2163 			 le16_to_cpu(ver.hw_variant),
2164 			 le16_to_cpu(params.dev_revid));
2165 		break;
2166 	case 0x11:	/* JfP */
2167 	case 0x12:	/* ThP */
2168 		snprintf(fwname, sizeof(fwname), "intel/ibt-%u-%u-%u.sfi",
2169 			 le16_to_cpu(ver.hw_variant),
2170 			 le16_to_cpu(ver.hw_revision),
2171 			 le16_to_cpu(ver.fw_revision));
2172 		break;
2173 	default:
2174 		BT_ERR("%s: Unsupported Intel firmware naming", hdev->name);
2175 		return -EINVAL;
2176 	}
2177 
2178 	err = request_firmware(&fw, fwname, &hdev->dev);
2179 	if (err < 0) {
2180 		BT_ERR("%s: Failed to load Intel firmware file (%d)",
2181 		       hdev->name, err);
2182 		return err;
2183 	}
2184 
2185 	bt_dev_info(hdev, "Found device firmware: %s", fwname);
2186 
2187 	/* Save the DDC file name for later use to apply once the firmware
2188 	 * downloading is done.
2189 	 */
2190 	switch (ver.hw_variant) {
2191 	case 0x0b:	/* SfP */
2192 	case 0x0c:	/* WsP */
2193 		snprintf(fwname, sizeof(fwname), "intel/ibt-%u-%u.ddc",
2194 			 le16_to_cpu(ver.hw_variant),
2195 			 le16_to_cpu(params.dev_revid));
2196 		break;
2197 	case 0x11:	/* JfP */
2198 	case 0x12:	/* ThP */
2199 		snprintf(fwname, sizeof(fwname), "intel/ibt-%u-%u-%u.ddc",
2200 			 le16_to_cpu(ver.hw_variant),
2201 			 le16_to_cpu(ver.hw_revision),
2202 			 le16_to_cpu(ver.fw_revision));
2203 		break;
2204 	default:
2205 		BT_ERR("%s: Unsupported Intel firmware naming", hdev->name);
2206 		return -EINVAL;
2207 	}
2208 
2209 	if (fw->size < 644) {
2210 		BT_ERR("%s: Invalid size of firmware file (%zu)",
2211 		       hdev->name, fw->size);
2212 		err = -EBADF;
2213 		goto done;
2214 	}
2215 
2216 	set_bit(BTUSB_DOWNLOADING, &data->flags);
2217 
2218 	/* Start firmware downloading and get boot parameter */
2219 	err = btintel_download_firmware(hdev, fw, &boot_param);
2220 	if (err < 0)
2221 		goto done;
2222 
2223 	set_bit(BTUSB_FIRMWARE_LOADED, &data->flags);
2224 
2225 	bt_dev_info(hdev, "Waiting for firmware download to complete");
2226 
2227 	/* Before switching the device into operational mode and with that
2228 	 * booting the loaded firmware, wait for the bootloader notification
2229 	 * that all fragments have been successfully received.
2230 	 *
2231 	 * When the event processing receives the notification, then the
2232 	 * BTUSB_DOWNLOADING flag will be cleared.
2233 	 *
2234 	 * The firmware loading should not take longer than 5 seconds
2235 	 * and thus just timeout if that happens and fail the setup
2236 	 * of this device.
2237 	 */
2238 	err = wait_on_bit_timeout(&data->flags, BTUSB_DOWNLOADING,
2239 				  TASK_INTERRUPTIBLE,
2240 				  msecs_to_jiffies(5000));
2241 	if (err == -EINTR) {
2242 		BT_ERR("%s: Firmware loading interrupted", hdev->name);
2243 		goto done;
2244 	}
2245 
2246 	if (err) {
2247 		BT_ERR("%s: Firmware loading timeout", hdev->name);
2248 		err = -ETIMEDOUT;
2249 		goto done;
2250 	}
2251 
2252 	if (test_bit(BTUSB_FIRMWARE_FAILED, &data->flags)) {
2253 		BT_ERR("%s: Firmware loading failed", hdev->name);
2254 		err = -ENOEXEC;
2255 		goto done;
2256 	}
2257 
2258 	rettime = ktime_get();
2259 	delta = ktime_sub(rettime, calltime);
2260 	duration = (unsigned long long) ktime_to_ns(delta) >> 10;
2261 
2262 	bt_dev_info(hdev, "Firmware loaded in %llu usecs", duration);
2263 
2264 done:
2265 	release_firmware(fw);
2266 
2267 	if (err < 0)
2268 		return err;
2269 
2270 	calltime = ktime_get();
2271 
2272 	set_bit(BTUSB_BOOTING, &data->flags);
2273 
2274 	err = btintel_send_intel_reset(hdev, boot_param);
2275 	if (err)
2276 		return err;
2277 
2278 	/* The bootloader will not indicate when the device is ready. This
2279 	 * is done by the operational firmware sending bootup notification.
2280 	 *
2281 	 * Booting into operational firmware should not take longer than
2282 	 * 1 second. However if that happens, then just fail the setup
2283 	 * since something went wrong.
2284 	 */
2285 	bt_dev_info(hdev, "Waiting for device to boot");
2286 
2287 	err = wait_on_bit_timeout(&data->flags, BTUSB_BOOTING,
2288 				  TASK_INTERRUPTIBLE,
2289 				  msecs_to_jiffies(1000));
2290 
2291 	if (err == -EINTR) {
2292 		BT_ERR("%s: Device boot interrupted", hdev->name);
2293 		return -EINTR;
2294 	}
2295 
2296 	if (err) {
2297 		BT_ERR("%s: Device boot timeout", hdev->name);
2298 		return -ETIMEDOUT;
2299 	}
2300 
2301 	rettime = ktime_get();
2302 	delta = ktime_sub(rettime, calltime);
2303 	duration = (unsigned long long) ktime_to_ns(delta) >> 10;
2304 
2305 	bt_dev_info(hdev, "Device booted in %llu usecs", duration);
2306 
2307 	clear_bit(BTUSB_BOOTLOADER, &data->flags);
2308 
2309 	/* Once the device is running in operational mode, it needs to apply
2310 	 * the device configuration (DDC) parameters.
2311 	 *
2312 	 * The device can work without DDC parameters, so even if it fails
2313 	 * to load the file, no need to fail the setup.
2314 	 */
2315 	btintel_load_ddc_config(hdev, fwname);
2316 
2317 	/* Set the event mask for Intel specific vendor events. This enables
2318 	 * a few extra events that are useful during general operation. It
2319 	 * does not enable any debugging related events.
2320 	 *
2321 	 * The device will function correctly without these events enabled
2322 	 * and thus no need to fail the setup.
2323 	 */
2324 	btintel_set_event_mask(hdev, false);
2325 
2326 	return 0;
2327 }
2328 
2329 static int btusb_shutdown_intel(struct hci_dev *hdev)
2330 {
2331 	struct sk_buff *skb;
2332 	long ret;
2333 
2334 	/* Some platforms have an issue with BT LED when the interface is
2335 	 * down or BT radio is turned off, which takes 5 seconds to BT LED
2336 	 * goes off. This command turns off the BT LED immediately.
2337 	 */
2338 	skb = __hci_cmd_sync(hdev, 0xfc3f, 0, NULL, HCI_INIT_TIMEOUT);
2339 	if (IS_ERR(skb)) {
2340 		ret = PTR_ERR(skb);
2341 		BT_ERR("%s: turning off Intel device LED failed (%ld)",
2342 		       hdev->name, ret);
2343 		return ret;
2344 	}
2345 	kfree_skb(skb);
2346 
2347 	return 0;
2348 }
2349 
2350 #ifdef CONFIG_PM
2351 /* Configure an out-of-band gpio as wake-up pin, if specified in device tree */
2352 static int marvell_config_oob_wake(struct hci_dev *hdev)
2353 {
2354 	struct sk_buff *skb;
2355 	struct btusb_data *data = hci_get_drvdata(hdev);
2356 	struct device *dev = &data->udev->dev;
2357 	u16 pin, gap, opcode;
2358 	int ret;
2359 	u8 cmd[5];
2360 
2361 	/* Move on if no wakeup pin specified */
2362 	if (of_property_read_u16(dev->of_node, "marvell,wakeup-pin", &pin) ||
2363 	    of_property_read_u16(dev->of_node, "marvell,wakeup-gap-ms", &gap))
2364 		return 0;
2365 
2366 	/* Vendor specific command to configure a GPIO as wake-up pin */
2367 	opcode = hci_opcode_pack(0x3F, 0x59);
2368 	cmd[0] = opcode & 0xFF;
2369 	cmd[1] = opcode >> 8;
2370 	cmd[2] = 2; /* length of parameters that follow */
2371 	cmd[3] = pin;
2372 	cmd[4] = gap; /* time in ms, for which wakeup pin should be asserted */
2373 
2374 	skb = bt_skb_alloc(sizeof(cmd), GFP_KERNEL);
2375 	if (!skb) {
2376 		bt_dev_err(hdev, "%s: No memory\n", __func__);
2377 		return -ENOMEM;
2378 	}
2379 
2380 	skb_put_data(skb, cmd, sizeof(cmd));
2381 	hci_skb_pkt_type(skb) = HCI_COMMAND_PKT;
2382 
2383 	ret = btusb_send_frame(hdev, skb);
2384 	if (ret) {
2385 		bt_dev_err(hdev, "%s: configuration failed\n", __func__);
2386 		kfree_skb(skb);
2387 		return ret;
2388 	}
2389 
2390 	return 0;
2391 }
2392 #endif
2393 
2394 static int btusb_set_bdaddr_marvell(struct hci_dev *hdev,
2395 				    const bdaddr_t *bdaddr)
2396 {
2397 	struct sk_buff *skb;
2398 	u8 buf[8];
2399 	long ret;
2400 
2401 	buf[0] = 0xfe;
2402 	buf[1] = sizeof(bdaddr_t);
2403 	memcpy(buf + 2, bdaddr, sizeof(bdaddr_t));
2404 
2405 	skb = __hci_cmd_sync(hdev, 0xfc22, sizeof(buf), buf, HCI_INIT_TIMEOUT);
2406 	if (IS_ERR(skb)) {
2407 		ret = PTR_ERR(skb);
2408 		bt_dev_err(hdev, "changing Marvell device address failed (%ld)",
2409 			   ret);
2410 		return ret;
2411 	}
2412 	kfree_skb(skb);
2413 
2414 	return 0;
2415 }
2416 
2417 static int btusb_set_bdaddr_ath3012(struct hci_dev *hdev,
2418 				    const bdaddr_t *bdaddr)
2419 {
2420 	struct sk_buff *skb;
2421 	u8 buf[10];
2422 	long ret;
2423 
2424 	buf[0] = 0x01;
2425 	buf[1] = 0x01;
2426 	buf[2] = 0x00;
2427 	buf[3] = sizeof(bdaddr_t);
2428 	memcpy(buf + 4, bdaddr, sizeof(bdaddr_t));
2429 
2430 	skb = __hci_cmd_sync(hdev, 0xfc0b, sizeof(buf), buf, HCI_INIT_TIMEOUT);
2431 	if (IS_ERR(skb)) {
2432 		ret = PTR_ERR(skb);
2433 		bt_dev_err(hdev, "Change address command failed (%ld)", ret);
2434 		return ret;
2435 	}
2436 	kfree_skb(skb);
2437 
2438 	return 0;
2439 }
2440 
2441 #define QCA_DFU_PACKET_LEN	4096
2442 
2443 #define QCA_GET_TARGET_VERSION	0x09
2444 #define QCA_CHECK_STATUS	0x05
2445 #define QCA_DFU_DOWNLOAD	0x01
2446 
2447 #define QCA_SYSCFG_UPDATED	0x40
2448 #define QCA_PATCH_UPDATED	0x80
2449 #define QCA_DFU_TIMEOUT		3000
2450 
2451 struct qca_version {
2452 	__le32	rom_version;
2453 	__le32	patch_version;
2454 	__le32	ram_version;
2455 	__le32	ref_clock;
2456 	__u8	reserved[4];
2457 } __packed;
2458 
2459 struct qca_rampatch_version {
2460 	__le16	rom_version;
2461 	__le16	patch_version;
2462 } __packed;
2463 
2464 struct qca_device_info {
2465 	u32	rom_version;
2466 	u8	rampatch_hdr;	/* length of header in rampatch */
2467 	u8	nvm_hdr;	/* length of header in NVM */
2468 	u8	ver_offset;	/* offset of version structure in rampatch */
2469 };
2470 
2471 static const struct qca_device_info qca_devices_table[] = {
2472 	{ 0x00000100, 20, 4, 10 }, /* Rome 1.0 */
2473 	{ 0x00000101, 20, 4, 10 }, /* Rome 1.1 */
2474 	{ 0x00000200, 28, 4, 18 }, /* Rome 2.0 */
2475 	{ 0x00000201, 28, 4, 18 }, /* Rome 2.1 */
2476 	{ 0x00000300, 28, 4, 18 }, /* Rome 3.0 */
2477 	{ 0x00000302, 28, 4, 18 }, /* Rome 3.2 */
2478 };
2479 
2480 static int btusb_qca_send_vendor_req(struct hci_dev *hdev, u8 request,
2481 				     void *data, u16 size)
2482 {
2483 	struct btusb_data *btdata = hci_get_drvdata(hdev);
2484 	struct usb_device *udev = btdata->udev;
2485 	int pipe, err;
2486 	u8 *buf;
2487 
2488 	buf = kmalloc(size, GFP_KERNEL);
2489 	if (!buf)
2490 		return -ENOMEM;
2491 
2492 	/* Found some of USB hosts have IOT issues with ours so that we should
2493 	 * not wait until HCI layer is ready.
2494 	 */
2495 	pipe = usb_rcvctrlpipe(udev, 0);
2496 	err = usb_control_msg(udev, pipe, request, USB_TYPE_VENDOR | USB_DIR_IN,
2497 			      0, 0, buf, size, USB_CTRL_SET_TIMEOUT);
2498 	if (err < 0) {
2499 		bt_dev_err(hdev, "Failed to access otp area (%d)", err);
2500 		goto done;
2501 	}
2502 
2503 	memcpy(data, buf, size);
2504 
2505 done:
2506 	kfree(buf);
2507 
2508 	return err;
2509 }
2510 
2511 static int btusb_setup_qca_download_fw(struct hci_dev *hdev,
2512 				       const struct firmware *firmware,
2513 				       size_t hdr_size)
2514 {
2515 	struct btusb_data *btdata = hci_get_drvdata(hdev);
2516 	struct usb_device *udev = btdata->udev;
2517 	size_t count, size, sent = 0;
2518 	int pipe, len, err;
2519 	u8 *buf;
2520 
2521 	buf = kmalloc(QCA_DFU_PACKET_LEN, GFP_KERNEL);
2522 	if (!buf)
2523 		return -ENOMEM;
2524 
2525 	count = firmware->size;
2526 
2527 	size = min_t(size_t, count, hdr_size);
2528 	memcpy(buf, firmware->data, size);
2529 
2530 	/* USB patches should go down to controller through USB path
2531 	 * because binary format fits to go down through USB channel.
2532 	 * USB control path is for patching headers and USB bulk is for
2533 	 * patch body.
2534 	 */
2535 	pipe = usb_sndctrlpipe(udev, 0);
2536 	err = usb_control_msg(udev, pipe, QCA_DFU_DOWNLOAD, USB_TYPE_VENDOR,
2537 			      0, 0, buf, size, USB_CTRL_SET_TIMEOUT);
2538 	if (err < 0) {
2539 		bt_dev_err(hdev, "Failed to send headers (%d)", err);
2540 		goto done;
2541 	}
2542 
2543 	sent += size;
2544 	count -= size;
2545 
2546 	while (count) {
2547 		size = min_t(size_t, count, QCA_DFU_PACKET_LEN);
2548 
2549 		memcpy(buf, firmware->data + sent, size);
2550 
2551 		pipe = usb_sndbulkpipe(udev, 0x02);
2552 		err = usb_bulk_msg(udev, pipe, buf, size, &len,
2553 				   QCA_DFU_TIMEOUT);
2554 		if (err < 0) {
2555 			bt_dev_err(hdev, "Failed to send body at %zd of %zd (%d)",
2556 				   sent, firmware->size, err);
2557 			break;
2558 		}
2559 
2560 		if (size != len) {
2561 			bt_dev_err(hdev, "Failed to get bulk buffer");
2562 			err = -EILSEQ;
2563 			break;
2564 		}
2565 
2566 		sent  += size;
2567 		count -= size;
2568 	}
2569 
2570 done:
2571 	kfree(buf);
2572 	return err;
2573 }
2574 
2575 static int btusb_setup_qca_load_rampatch(struct hci_dev *hdev,
2576 					 struct qca_version *ver,
2577 					 const struct qca_device_info *info)
2578 {
2579 	struct qca_rampatch_version *rver;
2580 	const struct firmware *fw;
2581 	u32 ver_rom, ver_patch;
2582 	u16 rver_rom, rver_patch;
2583 	char fwname[64];
2584 	int err;
2585 
2586 	ver_rom = le32_to_cpu(ver->rom_version);
2587 	ver_patch = le32_to_cpu(ver->patch_version);
2588 
2589 	snprintf(fwname, sizeof(fwname), "qca/rampatch_usb_%08x.bin", ver_rom);
2590 
2591 	err = request_firmware(&fw, fwname, &hdev->dev);
2592 	if (err) {
2593 		bt_dev_err(hdev, "failed to request rampatch file: %s (%d)",
2594 			   fwname, err);
2595 		return err;
2596 	}
2597 
2598 	bt_dev_info(hdev, "using rampatch file: %s", fwname);
2599 
2600 	rver = (struct qca_rampatch_version *)(fw->data + info->ver_offset);
2601 	rver_rom = le16_to_cpu(rver->rom_version);
2602 	rver_patch = le16_to_cpu(rver->patch_version);
2603 
2604 	bt_dev_info(hdev, "QCA: patch rome 0x%x build 0x%x, "
2605 		    "firmware rome 0x%x build 0x%x",
2606 		    rver_rom, rver_patch, ver_rom, ver_patch);
2607 
2608 	if (rver_rom != ver_rom || rver_patch <= ver_patch) {
2609 		bt_dev_err(hdev, "rampatch file version did not match with firmware");
2610 		err = -EINVAL;
2611 		goto done;
2612 	}
2613 
2614 	err = btusb_setup_qca_download_fw(hdev, fw, info->rampatch_hdr);
2615 
2616 done:
2617 	release_firmware(fw);
2618 
2619 	return err;
2620 }
2621 
2622 static int btusb_setup_qca_load_nvm(struct hci_dev *hdev,
2623 				    struct qca_version *ver,
2624 				    const struct qca_device_info *info)
2625 {
2626 	const struct firmware *fw;
2627 	char fwname[64];
2628 	int err;
2629 
2630 	snprintf(fwname, sizeof(fwname), "qca/nvm_usb_%08x.bin",
2631 		 le32_to_cpu(ver->rom_version));
2632 
2633 	err = request_firmware(&fw, fwname, &hdev->dev);
2634 	if (err) {
2635 		bt_dev_err(hdev, "failed to request NVM file: %s (%d)",
2636 			   fwname, err);
2637 		return err;
2638 	}
2639 
2640 	bt_dev_info(hdev, "using NVM file: %s", fwname);
2641 
2642 	err = btusb_setup_qca_download_fw(hdev, fw, info->nvm_hdr);
2643 
2644 	release_firmware(fw);
2645 
2646 	return err;
2647 }
2648 
2649 static int btusb_setup_qca(struct hci_dev *hdev)
2650 {
2651 	const struct qca_device_info *info = NULL;
2652 	struct qca_version ver;
2653 	u32 ver_rom;
2654 	u8 status;
2655 	int i, err;
2656 
2657 	err = btusb_qca_send_vendor_req(hdev, QCA_GET_TARGET_VERSION, &ver,
2658 					sizeof(ver));
2659 	if (err < 0)
2660 		return err;
2661 
2662 	ver_rom = le32_to_cpu(ver.rom_version);
2663 	for (i = 0; i < ARRAY_SIZE(qca_devices_table); i++) {
2664 		if (ver_rom == qca_devices_table[i].rom_version)
2665 			info = &qca_devices_table[i];
2666 	}
2667 	if (!info) {
2668 		bt_dev_err(hdev, "don't support firmware rome 0x%x", ver_rom);
2669 		return -ENODEV;
2670 	}
2671 
2672 	err = btusb_qca_send_vendor_req(hdev, QCA_CHECK_STATUS, &status,
2673 					sizeof(status));
2674 	if (err < 0)
2675 		return err;
2676 
2677 	if (!(status & QCA_PATCH_UPDATED)) {
2678 		err = btusb_setup_qca_load_rampatch(hdev, &ver, info);
2679 		if (err < 0)
2680 			return err;
2681 	}
2682 
2683 	if (!(status & QCA_SYSCFG_UPDATED)) {
2684 		err = btusb_setup_qca_load_nvm(hdev, &ver, info);
2685 		if (err < 0)
2686 			return err;
2687 	}
2688 
2689 	return 0;
2690 }
2691 
2692 #ifdef CONFIG_BT_HCIBTUSB_BCM
2693 static inline int __set_diag_interface(struct hci_dev *hdev)
2694 {
2695 	struct btusb_data *data = hci_get_drvdata(hdev);
2696 	struct usb_interface *intf = data->diag;
2697 	int i;
2698 
2699 	if (!data->diag)
2700 		return -ENODEV;
2701 
2702 	data->diag_tx_ep = NULL;
2703 	data->diag_rx_ep = NULL;
2704 
2705 	for (i = 0; i < intf->cur_altsetting->desc.bNumEndpoints; i++) {
2706 		struct usb_endpoint_descriptor *ep_desc;
2707 
2708 		ep_desc = &intf->cur_altsetting->endpoint[i].desc;
2709 
2710 		if (!data->diag_tx_ep && usb_endpoint_is_bulk_out(ep_desc)) {
2711 			data->diag_tx_ep = ep_desc;
2712 			continue;
2713 		}
2714 
2715 		if (!data->diag_rx_ep && usb_endpoint_is_bulk_in(ep_desc)) {
2716 			data->diag_rx_ep = ep_desc;
2717 			continue;
2718 		}
2719 	}
2720 
2721 	if (!data->diag_tx_ep || !data->diag_rx_ep) {
2722 		bt_dev_err(hdev, "invalid diagnostic descriptors");
2723 		return -ENODEV;
2724 	}
2725 
2726 	return 0;
2727 }
2728 
2729 static struct urb *alloc_diag_urb(struct hci_dev *hdev, bool enable)
2730 {
2731 	struct btusb_data *data = hci_get_drvdata(hdev);
2732 	struct sk_buff *skb;
2733 	struct urb *urb;
2734 	unsigned int pipe;
2735 
2736 	if (!data->diag_tx_ep)
2737 		return ERR_PTR(-ENODEV);
2738 
2739 	urb = usb_alloc_urb(0, GFP_KERNEL);
2740 	if (!urb)
2741 		return ERR_PTR(-ENOMEM);
2742 
2743 	skb = bt_skb_alloc(2, GFP_KERNEL);
2744 	if (!skb) {
2745 		usb_free_urb(urb);
2746 		return ERR_PTR(-ENOMEM);
2747 	}
2748 
2749 	skb_put_u8(skb, 0xf0);
2750 	skb_put_u8(skb, enable);
2751 
2752 	pipe = usb_sndbulkpipe(data->udev, data->diag_tx_ep->bEndpointAddress);
2753 
2754 	usb_fill_bulk_urb(urb, data->udev, pipe,
2755 			  skb->data, skb->len, btusb_tx_complete, skb);
2756 
2757 	skb->dev = (void *)hdev;
2758 
2759 	return urb;
2760 }
2761 
2762 static int btusb_bcm_set_diag(struct hci_dev *hdev, bool enable)
2763 {
2764 	struct btusb_data *data = hci_get_drvdata(hdev);
2765 	struct urb *urb;
2766 
2767 	if (!data->diag)
2768 		return -ENODEV;
2769 
2770 	if (!test_bit(HCI_RUNNING, &hdev->flags))
2771 		return -ENETDOWN;
2772 
2773 	urb = alloc_diag_urb(hdev, enable);
2774 	if (IS_ERR(urb))
2775 		return PTR_ERR(urb);
2776 
2777 	return submit_or_queue_tx_urb(hdev, urb);
2778 }
2779 #endif
2780 
2781 #ifdef CONFIG_PM
2782 static irqreturn_t btusb_oob_wake_handler(int irq, void *priv)
2783 {
2784 	struct btusb_data *data = priv;
2785 
2786 	pm_wakeup_event(&data->udev->dev, 0);
2787 	pm_system_wakeup();
2788 
2789 	/* Disable only if not already disabled (keep it balanced) */
2790 	if (test_and_clear_bit(BTUSB_OOB_WAKE_ENABLED, &data->flags)) {
2791 		disable_irq_nosync(irq);
2792 		disable_irq_wake(irq);
2793 	}
2794 	return IRQ_HANDLED;
2795 }
2796 
2797 static const struct of_device_id btusb_match_table[] = {
2798 	{ .compatible = "usb1286,204e" },
2799 	{ }
2800 };
2801 MODULE_DEVICE_TABLE(of, btusb_match_table);
2802 
2803 /* Use an oob wakeup pin? */
2804 static int btusb_config_oob_wake(struct hci_dev *hdev)
2805 {
2806 	struct btusb_data *data = hci_get_drvdata(hdev);
2807 	struct device *dev = &data->udev->dev;
2808 	int irq, ret;
2809 
2810 	clear_bit(BTUSB_OOB_WAKE_ENABLED, &data->flags);
2811 
2812 	if (!of_match_device(btusb_match_table, dev))
2813 		return 0;
2814 
2815 	/* Move on if no IRQ specified */
2816 	irq = of_irq_get_byname(dev->of_node, "wakeup");
2817 	if (irq <= 0) {
2818 		bt_dev_dbg(hdev, "%s: no OOB Wakeup IRQ in DT", __func__);
2819 		return 0;
2820 	}
2821 
2822 	ret = devm_request_irq(&hdev->dev, irq, btusb_oob_wake_handler,
2823 			       0, "OOB Wake-on-BT", data);
2824 	if (ret) {
2825 		bt_dev_err(hdev, "%s: IRQ request failed", __func__);
2826 		return ret;
2827 	}
2828 
2829 	ret = device_init_wakeup(dev, true);
2830 	if (ret) {
2831 		bt_dev_err(hdev, "%s: failed to init_wakeup", __func__);
2832 		return ret;
2833 	}
2834 
2835 	data->oob_wake_irq = irq;
2836 	disable_irq(irq);
2837 	bt_dev_info(hdev, "OOB Wake-on-BT configured at IRQ %u", irq);
2838 	return 0;
2839 }
2840 #endif
2841 
2842 static int btusb_probe(struct usb_interface *intf,
2843 		       const struct usb_device_id *id)
2844 {
2845 	struct usb_endpoint_descriptor *ep_desc;
2846 	struct btusb_data *data;
2847 	struct hci_dev *hdev;
2848 	unsigned ifnum_base;
2849 	int i, err;
2850 
2851 	BT_DBG("intf %p id %p", intf, id);
2852 
2853 	/* interface numbers are hardcoded in the spec */
2854 	if (intf->cur_altsetting->desc.bInterfaceNumber != 0) {
2855 		if (!(id->driver_info & BTUSB_IFNUM_2))
2856 			return -ENODEV;
2857 		if (intf->cur_altsetting->desc.bInterfaceNumber != 2)
2858 			return -ENODEV;
2859 	}
2860 
2861 	ifnum_base = intf->cur_altsetting->desc.bInterfaceNumber;
2862 
2863 	if (!id->driver_info) {
2864 		const struct usb_device_id *match;
2865 
2866 		match = usb_match_id(intf, blacklist_table);
2867 		if (match)
2868 			id = match;
2869 	}
2870 
2871 	if (id->driver_info == BTUSB_IGNORE)
2872 		return -ENODEV;
2873 
2874 	if (id->driver_info & BTUSB_ATH3012) {
2875 		struct usb_device *udev = interface_to_usbdev(intf);
2876 
2877 		/* Old firmware would otherwise let ath3k driver load
2878 		 * patch and sysconfig files
2879 		 */
2880 		if (le16_to_cpu(udev->descriptor.bcdDevice) <= 0x0001)
2881 			return -ENODEV;
2882 	}
2883 
2884 	data = devm_kzalloc(&intf->dev, sizeof(*data), GFP_KERNEL);
2885 	if (!data)
2886 		return -ENOMEM;
2887 
2888 	for (i = 0; i < intf->cur_altsetting->desc.bNumEndpoints; i++) {
2889 		ep_desc = &intf->cur_altsetting->endpoint[i].desc;
2890 
2891 		if (!data->intr_ep && usb_endpoint_is_int_in(ep_desc)) {
2892 			data->intr_ep = ep_desc;
2893 			continue;
2894 		}
2895 
2896 		if (!data->bulk_tx_ep && usb_endpoint_is_bulk_out(ep_desc)) {
2897 			data->bulk_tx_ep = ep_desc;
2898 			continue;
2899 		}
2900 
2901 		if (!data->bulk_rx_ep && usb_endpoint_is_bulk_in(ep_desc)) {
2902 			data->bulk_rx_ep = ep_desc;
2903 			continue;
2904 		}
2905 	}
2906 
2907 	if (!data->intr_ep || !data->bulk_tx_ep || !data->bulk_rx_ep)
2908 		return -ENODEV;
2909 
2910 	if (id->driver_info & BTUSB_AMP) {
2911 		data->cmdreq_type = USB_TYPE_CLASS | 0x01;
2912 		data->cmdreq = 0x2b;
2913 	} else {
2914 		data->cmdreq_type = USB_TYPE_CLASS;
2915 		data->cmdreq = 0x00;
2916 	}
2917 
2918 	data->udev = interface_to_usbdev(intf);
2919 	data->intf = intf;
2920 
2921 	INIT_WORK(&data->work, btusb_work);
2922 	INIT_WORK(&data->waker, btusb_waker);
2923 	init_usb_anchor(&data->deferred);
2924 	init_usb_anchor(&data->tx_anchor);
2925 	spin_lock_init(&data->txlock);
2926 
2927 	init_usb_anchor(&data->intr_anchor);
2928 	init_usb_anchor(&data->bulk_anchor);
2929 	init_usb_anchor(&data->isoc_anchor);
2930 	init_usb_anchor(&data->diag_anchor);
2931 	spin_lock_init(&data->rxlock);
2932 
2933 	if (id->driver_info & BTUSB_INTEL_NEW) {
2934 		data->recv_event = btusb_recv_event_intel;
2935 		data->recv_bulk = btusb_recv_bulk_intel;
2936 		set_bit(BTUSB_BOOTLOADER, &data->flags);
2937 	} else {
2938 		data->recv_event = hci_recv_frame;
2939 		data->recv_bulk = btusb_recv_bulk;
2940 	}
2941 
2942 	hdev = hci_alloc_dev();
2943 	if (!hdev)
2944 		return -ENOMEM;
2945 
2946 	hdev->bus = HCI_USB;
2947 	hci_set_drvdata(hdev, data);
2948 
2949 	if (id->driver_info & BTUSB_AMP)
2950 		hdev->dev_type = HCI_AMP;
2951 	else
2952 		hdev->dev_type = HCI_PRIMARY;
2953 
2954 	data->hdev = hdev;
2955 
2956 	SET_HCIDEV_DEV(hdev, &intf->dev);
2957 
2958 	hdev->open   = btusb_open;
2959 	hdev->close  = btusb_close;
2960 	hdev->flush  = btusb_flush;
2961 	hdev->send   = btusb_send_frame;
2962 	hdev->notify = btusb_notify;
2963 
2964 	if (dmi_check_system(btusb_needs_reset_resume_table))
2965 		interface_to_usbdev(intf)->quirks |= USB_QUIRK_RESET_RESUME;
2966 
2967 #ifdef CONFIG_PM
2968 	err = btusb_config_oob_wake(hdev);
2969 	if (err)
2970 		goto out_free_dev;
2971 
2972 	/* Marvell devices may need a specific chip configuration */
2973 	if (id->driver_info & BTUSB_MARVELL && data->oob_wake_irq) {
2974 		err = marvell_config_oob_wake(hdev);
2975 		if (err)
2976 			goto out_free_dev;
2977 	}
2978 #endif
2979 	if (id->driver_info & BTUSB_CW6622)
2980 		set_bit(HCI_QUIRK_BROKEN_STORED_LINK_KEY, &hdev->quirks);
2981 
2982 	if (id->driver_info & BTUSB_BCM2045)
2983 		set_bit(HCI_QUIRK_BROKEN_STORED_LINK_KEY, &hdev->quirks);
2984 
2985 	if (id->driver_info & BTUSB_BCM92035)
2986 		hdev->setup = btusb_setup_bcm92035;
2987 
2988 #ifdef CONFIG_BT_HCIBTUSB_BCM
2989 	if (id->driver_info & BTUSB_BCM_PATCHRAM) {
2990 		hdev->manufacturer = 15;
2991 		hdev->setup = btbcm_setup_patchram;
2992 		hdev->set_diag = btusb_bcm_set_diag;
2993 		hdev->set_bdaddr = btbcm_set_bdaddr;
2994 
2995 		/* Broadcom LM_DIAG Interface numbers are hardcoded */
2996 		data->diag = usb_ifnum_to_if(data->udev, ifnum_base + 2);
2997 	}
2998 
2999 	if (id->driver_info & BTUSB_BCM_APPLE) {
3000 		hdev->manufacturer = 15;
3001 		hdev->setup = btbcm_setup_apple;
3002 		hdev->set_diag = btusb_bcm_set_diag;
3003 
3004 		/* Broadcom LM_DIAG Interface numbers are hardcoded */
3005 		data->diag = usb_ifnum_to_if(data->udev, ifnum_base + 2);
3006 	}
3007 #endif
3008 
3009 	if (id->driver_info & BTUSB_INTEL) {
3010 		hdev->manufacturer = 2;
3011 		hdev->setup = btusb_setup_intel;
3012 		hdev->shutdown = btusb_shutdown_intel;
3013 		hdev->set_diag = btintel_set_diag_mfg;
3014 		hdev->set_bdaddr = btintel_set_bdaddr;
3015 		set_bit(HCI_QUIRK_STRICT_DUPLICATE_FILTER, &hdev->quirks);
3016 		set_bit(HCI_QUIRK_SIMULTANEOUS_DISCOVERY, &hdev->quirks);
3017 		set_bit(HCI_QUIRK_NON_PERSISTENT_DIAG, &hdev->quirks);
3018 	}
3019 
3020 	if (id->driver_info & BTUSB_INTEL_NEW) {
3021 		hdev->manufacturer = 2;
3022 		hdev->send = btusb_send_frame_intel;
3023 		hdev->setup = btusb_setup_intel_new;
3024 		hdev->hw_error = btintel_hw_error;
3025 		hdev->set_diag = btintel_set_diag;
3026 		hdev->set_bdaddr = btintel_set_bdaddr;
3027 		set_bit(HCI_QUIRK_STRICT_DUPLICATE_FILTER, &hdev->quirks);
3028 		set_bit(HCI_QUIRK_NON_PERSISTENT_DIAG, &hdev->quirks);
3029 	}
3030 
3031 	if (id->driver_info & BTUSB_MARVELL)
3032 		hdev->set_bdaddr = btusb_set_bdaddr_marvell;
3033 
3034 	if (id->driver_info & BTUSB_SWAVE) {
3035 		set_bit(HCI_QUIRK_FIXUP_INQUIRY_MODE, &hdev->quirks);
3036 		set_bit(HCI_QUIRK_BROKEN_LOCAL_COMMANDS, &hdev->quirks);
3037 	}
3038 
3039 	if (id->driver_info & BTUSB_INTEL_BOOT) {
3040 		hdev->manufacturer = 2;
3041 		set_bit(HCI_QUIRK_RAW_DEVICE, &hdev->quirks);
3042 	}
3043 
3044 	if (id->driver_info & BTUSB_ATH3012) {
3045 		hdev->set_bdaddr = btusb_set_bdaddr_ath3012;
3046 		set_bit(HCI_QUIRK_SIMULTANEOUS_DISCOVERY, &hdev->quirks);
3047 		set_bit(HCI_QUIRK_STRICT_DUPLICATE_FILTER, &hdev->quirks);
3048 	}
3049 
3050 	if (id->driver_info & BTUSB_QCA_ROME) {
3051 		data->setup_on_usb = btusb_setup_qca;
3052 		hdev->set_bdaddr = btusb_set_bdaddr_ath3012;
3053 	}
3054 
3055 #ifdef CONFIG_BT_HCIBTUSB_RTL
3056 	if (id->driver_info & BTUSB_REALTEK) {
3057 		hdev->setup = btrtl_setup_realtek;
3058 
3059 		/* Realtek devices lose their updated firmware over suspend,
3060 		 * but the USB hub doesn't notice any status change.
3061 		 * Explicitly request a device reset on resume.
3062 		 */
3063 		interface_to_usbdev(intf)->quirks |= USB_QUIRK_RESET_RESUME;
3064 	}
3065 #endif
3066 
3067 	if (id->driver_info & BTUSB_AMP) {
3068 		/* AMP controllers do not support SCO packets */
3069 		data->isoc = NULL;
3070 	} else {
3071 		/* Interface orders are hardcoded in the specification */
3072 		data->isoc = usb_ifnum_to_if(data->udev, ifnum_base + 1);
3073 		data->isoc_ifnum = ifnum_base + 1;
3074 	}
3075 
3076 	if (!reset)
3077 		set_bit(HCI_QUIRK_RESET_ON_CLOSE, &hdev->quirks);
3078 
3079 	if (force_scofix || id->driver_info & BTUSB_WRONG_SCO_MTU) {
3080 		if (!disable_scofix)
3081 			set_bit(HCI_QUIRK_FIXUP_BUFFER_SIZE, &hdev->quirks);
3082 	}
3083 
3084 	if (id->driver_info & BTUSB_BROKEN_ISOC)
3085 		data->isoc = NULL;
3086 
3087 	if (id->driver_info & BTUSB_DIGIANSWER) {
3088 		data->cmdreq_type = USB_TYPE_VENDOR;
3089 		set_bit(HCI_QUIRK_RESET_ON_CLOSE, &hdev->quirks);
3090 	}
3091 
3092 	if (id->driver_info & BTUSB_CSR) {
3093 		struct usb_device *udev = data->udev;
3094 		u16 bcdDevice = le16_to_cpu(udev->descriptor.bcdDevice);
3095 
3096 		/* Old firmware would otherwise execute USB reset */
3097 		if (bcdDevice < 0x117)
3098 			set_bit(HCI_QUIRK_RESET_ON_CLOSE, &hdev->quirks);
3099 
3100 		/* Fake CSR devices with broken commands */
3101 		if (bcdDevice <= 0x100 || bcdDevice == 0x134)
3102 			hdev->setup = btusb_setup_csr;
3103 
3104 		set_bit(HCI_QUIRK_SIMULTANEOUS_DISCOVERY, &hdev->quirks);
3105 	}
3106 
3107 	if (id->driver_info & BTUSB_SNIFFER) {
3108 		struct usb_device *udev = data->udev;
3109 
3110 		/* New sniffer firmware has crippled HCI interface */
3111 		if (le16_to_cpu(udev->descriptor.bcdDevice) > 0x997)
3112 			set_bit(HCI_QUIRK_RAW_DEVICE, &hdev->quirks);
3113 	}
3114 
3115 	if (id->driver_info & BTUSB_INTEL_BOOT) {
3116 		/* A bug in the bootloader causes that interrupt interface is
3117 		 * only enabled after receiving SetInterface(0, AltSetting=0).
3118 		 */
3119 		err = usb_set_interface(data->udev, 0, 0);
3120 		if (err < 0) {
3121 			BT_ERR("failed to set interface 0, alt 0 %d", err);
3122 			goto out_free_dev;
3123 		}
3124 	}
3125 
3126 	if (data->isoc) {
3127 		err = usb_driver_claim_interface(&btusb_driver,
3128 						 data->isoc, data);
3129 		if (err < 0)
3130 			goto out_free_dev;
3131 	}
3132 
3133 #ifdef CONFIG_BT_HCIBTUSB_BCM
3134 	if (data->diag) {
3135 		if (!usb_driver_claim_interface(&btusb_driver,
3136 						data->diag, data))
3137 			__set_diag_interface(hdev);
3138 		else
3139 			data->diag = NULL;
3140 	}
3141 #endif
3142 
3143 	if (enable_autosuspend)
3144 		usb_enable_autosuspend(data->udev);
3145 
3146 	err = hci_register_dev(hdev);
3147 	if (err < 0)
3148 		goto out_free_dev;
3149 
3150 	usb_set_intfdata(intf, data);
3151 
3152 	return 0;
3153 
3154 out_free_dev:
3155 	hci_free_dev(hdev);
3156 	return err;
3157 }
3158 
3159 static void btusb_disconnect(struct usb_interface *intf)
3160 {
3161 	struct btusb_data *data = usb_get_intfdata(intf);
3162 	struct hci_dev *hdev;
3163 
3164 	BT_DBG("intf %p", intf);
3165 
3166 	if (!data)
3167 		return;
3168 
3169 	hdev = data->hdev;
3170 	usb_set_intfdata(data->intf, NULL);
3171 
3172 	if (data->isoc)
3173 		usb_set_intfdata(data->isoc, NULL);
3174 
3175 	if (data->diag)
3176 		usb_set_intfdata(data->diag, NULL);
3177 
3178 	hci_unregister_dev(hdev);
3179 
3180 	if (intf == data->intf) {
3181 		if (data->isoc)
3182 			usb_driver_release_interface(&btusb_driver, data->isoc);
3183 		if (data->diag)
3184 			usb_driver_release_interface(&btusb_driver, data->diag);
3185 	} else if (intf == data->isoc) {
3186 		if (data->diag)
3187 			usb_driver_release_interface(&btusb_driver, data->diag);
3188 		usb_driver_release_interface(&btusb_driver, data->intf);
3189 	} else if (intf == data->diag) {
3190 		usb_driver_release_interface(&btusb_driver, data->intf);
3191 		if (data->isoc)
3192 			usb_driver_release_interface(&btusb_driver, data->isoc);
3193 	}
3194 
3195 	if (data->oob_wake_irq)
3196 		device_init_wakeup(&data->udev->dev, false);
3197 
3198 	hci_free_dev(hdev);
3199 }
3200 
3201 #ifdef CONFIG_PM
3202 static int btusb_suspend(struct usb_interface *intf, pm_message_t message)
3203 {
3204 	struct btusb_data *data = usb_get_intfdata(intf);
3205 
3206 	BT_DBG("intf %p", intf);
3207 
3208 	if (data->suspend_count++)
3209 		return 0;
3210 
3211 	spin_lock_irq(&data->txlock);
3212 	if (!(PMSG_IS_AUTO(message) && data->tx_in_flight)) {
3213 		set_bit(BTUSB_SUSPENDING, &data->flags);
3214 		spin_unlock_irq(&data->txlock);
3215 	} else {
3216 		spin_unlock_irq(&data->txlock);
3217 		data->suspend_count--;
3218 		return -EBUSY;
3219 	}
3220 
3221 	cancel_work_sync(&data->work);
3222 
3223 	btusb_stop_traffic(data);
3224 	usb_kill_anchored_urbs(&data->tx_anchor);
3225 
3226 	if (data->oob_wake_irq && device_may_wakeup(&data->udev->dev)) {
3227 		set_bit(BTUSB_OOB_WAKE_ENABLED, &data->flags);
3228 		enable_irq_wake(data->oob_wake_irq);
3229 		enable_irq(data->oob_wake_irq);
3230 	}
3231 
3232 	return 0;
3233 }
3234 
3235 static void play_deferred(struct btusb_data *data)
3236 {
3237 	struct urb *urb;
3238 	int err;
3239 
3240 	while ((urb = usb_get_from_anchor(&data->deferred))) {
3241 		usb_anchor_urb(urb, &data->tx_anchor);
3242 
3243 		err = usb_submit_urb(urb, GFP_ATOMIC);
3244 		if (err < 0) {
3245 			if (err != -EPERM && err != -ENODEV)
3246 				BT_ERR("%s urb %p submission failed (%d)",
3247 				       data->hdev->name, urb, -err);
3248 			kfree(urb->setup_packet);
3249 			usb_unanchor_urb(urb);
3250 			usb_free_urb(urb);
3251 			break;
3252 		}
3253 
3254 		data->tx_in_flight++;
3255 		usb_free_urb(urb);
3256 	}
3257 
3258 	/* Cleanup the rest deferred urbs. */
3259 	while ((urb = usb_get_from_anchor(&data->deferred))) {
3260 		kfree(urb->setup_packet);
3261 		usb_free_urb(urb);
3262 	}
3263 }
3264 
3265 static int btusb_resume(struct usb_interface *intf)
3266 {
3267 	struct btusb_data *data = usb_get_intfdata(intf);
3268 	struct hci_dev *hdev = data->hdev;
3269 	int err = 0;
3270 
3271 	BT_DBG("intf %p", intf);
3272 
3273 	if (--data->suspend_count)
3274 		return 0;
3275 
3276 	/* Disable only if not already disabled (keep it balanced) */
3277 	if (test_and_clear_bit(BTUSB_OOB_WAKE_ENABLED, &data->flags)) {
3278 		disable_irq(data->oob_wake_irq);
3279 		disable_irq_wake(data->oob_wake_irq);
3280 	}
3281 
3282 	if (!test_bit(HCI_RUNNING, &hdev->flags))
3283 		goto done;
3284 
3285 	if (test_bit(BTUSB_INTR_RUNNING, &data->flags)) {
3286 		err = btusb_submit_intr_urb(hdev, GFP_NOIO);
3287 		if (err < 0) {
3288 			clear_bit(BTUSB_INTR_RUNNING, &data->flags);
3289 			goto failed;
3290 		}
3291 	}
3292 
3293 	if (test_bit(BTUSB_BULK_RUNNING, &data->flags)) {
3294 		err = btusb_submit_bulk_urb(hdev, GFP_NOIO);
3295 		if (err < 0) {
3296 			clear_bit(BTUSB_BULK_RUNNING, &data->flags);
3297 			goto failed;
3298 		}
3299 
3300 		btusb_submit_bulk_urb(hdev, GFP_NOIO);
3301 	}
3302 
3303 	if (test_bit(BTUSB_ISOC_RUNNING, &data->flags)) {
3304 		if (btusb_submit_isoc_urb(hdev, GFP_NOIO) < 0)
3305 			clear_bit(BTUSB_ISOC_RUNNING, &data->flags);
3306 		else
3307 			btusb_submit_isoc_urb(hdev, GFP_NOIO);
3308 	}
3309 
3310 	spin_lock_irq(&data->txlock);
3311 	play_deferred(data);
3312 	clear_bit(BTUSB_SUSPENDING, &data->flags);
3313 	spin_unlock_irq(&data->txlock);
3314 	schedule_work(&data->work);
3315 
3316 	return 0;
3317 
3318 failed:
3319 	usb_scuttle_anchored_urbs(&data->deferred);
3320 done:
3321 	spin_lock_irq(&data->txlock);
3322 	clear_bit(BTUSB_SUSPENDING, &data->flags);
3323 	spin_unlock_irq(&data->txlock);
3324 
3325 	return err;
3326 }
3327 #endif
3328 
3329 static struct usb_driver btusb_driver = {
3330 	.name		= "btusb",
3331 	.probe		= btusb_probe,
3332 	.disconnect	= btusb_disconnect,
3333 #ifdef CONFIG_PM
3334 	.suspend	= btusb_suspend,
3335 	.resume		= btusb_resume,
3336 #endif
3337 	.id_table	= btusb_table,
3338 	.supports_autosuspend = 1,
3339 	.disable_hub_initiated_lpm = 1,
3340 };
3341 
3342 module_usb_driver(btusb_driver);
3343 
3344 module_param(disable_scofix, bool, 0644);
3345 MODULE_PARM_DESC(disable_scofix, "Disable fixup of wrong SCO buffer size");
3346 
3347 module_param(force_scofix, bool, 0644);
3348 MODULE_PARM_DESC(force_scofix, "Force fixup of wrong SCO buffers size");
3349 
3350 module_param(enable_autosuspend, bool, 0644);
3351 MODULE_PARM_DESC(enable_autosuspend, "Enable USB autosuspend by default");
3352 
3353 module_param(reset, bool, 0644);
3354 MODULE_PARM_DESC(reset, "Send HCI reset command on initialization");
3355 
3356 MODULE_AUTHOR("Marcel Holtmann <marcel@holtmann.org>");
3357 MODULE_DESCRIPTION("Generic Bluetooth USB driver ver " VERSION);
3358 MODULE_VERSION(VERSION);
3359 MODULE_LICENSE("GPL");
3360