1 files changed, 301 insertions, 32 deletions

diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c
index 8c1bf6190533..6fa9338745cf 100644
--- a/drivers/bluetooth/btusb.c
+++ b/drivers/bluetooth/btusb.c
@@ -52,6 +52,7 @@ static struct usb_driver btusb_driver;
 #define BTUSB_SWAVE             0x1000
 #define BTUSB_INTEL_NEW         0x2000
 #define BTUSB_AMP               0x4000
+#define BTUSB_QCA_ROME          0x8000
 
 static const struct usb_device_id btusb_table[] = {
         /* Generic Bluetooth USB device */
@@ -213,6 +214,10 @@ static const struct usb_device_id blacklist_table[] = {
         { USB_DEVICE(0x0489, 0xe036), .driver_info = BTUSB_ATH3012 },
         { USB_DEVICE(0x0489, 0xe03c), .driver_info = BTUSB_ATH3012 },
 
+        /* QCA ROME chipset */
+        { USB_DEVICE(0x0cf3, 0xe300), .driver_info = BTUSB_QCA_ROME},
+        { USB_DEVICE(0x0cf3, 0xe360), .driver_info = BTUSB_QCA_ROME},
+
         /* Broadcom BCM2035 */
         { USB_DEVICE(0x0a5c, 0x2009), .driver_info = BTUSB_BCM92035 },
         { USB_DEVICE(0x0a5c, 0x200a), .driver_info = BTUSB_WRONG_SCO_MTU },
@@ -338,6 +343,8 @@ struct btusb_data {
 
         int (*recv_event)(struct hci_dev *hdev, struct sk_buff *skb);
         int (*recv_bulk)(struct btusb_data *data, void *buffer, int count);
+
+        int (*setup_on_usb)(struct hci_dev *hdev);
 };
 
 static inline void btusb_free_frags(struct btusb_data *data)
@@ -879,6 +886,15 @@ static int btusb_open(struct hci_dev *hdev)
 
         BT_DBG("%s", hdev->name);
 
+        /* Patching USB firmware files prior to starting any URBs of HCI path
+         * It is more safe to use USB bulk channel for downloading USB patch
+         */
+        if (data->setup_on_usb) {
+                err = data->setup_on_usb(hdev);
+                if (err <0)
+                        return err;
+        }
+
         err = usb_autopm_get_interface(data->intf);
         if (err < 0)
                 return err;
@@ -1254,6 +1270,28 @@ static void btusb_waker(struct work_struct *work)
         usb_autopm_put_interface(data->intf);
 }
 
+static struct sk_buff *btusb_read_local_version(struct hci_dev *hdev)
+{
+        struct sk_buff *skb;
+
+        skb = __hci_cmd_sync(hdev, HCI_OP_READ_LOCAL_VERSION, 0, NULL,
+                             HCI_INIT_TIMEOUT);
+        if (IS_ERR(skb)) {
+                BT_ERR("%s: HCI_OP_READ_LOCAL_VERSION failed (%ld)",
+                       hdev->name, PTR_ERR(skb));
+                return skb;
+        }
+
+        if (skb->len != sizeof(struct hci_rp_read_local_version)) {
+                BT_ERR("%s: HCI_OP_READ_LOCAL_VERSION event length mismatch",
+                       hdev->name);
+                kfree_skb(skb);
+                return ERR_PTR(-EIO);
+        }
+
+        return skb;
+}
+
 static int btusb_setup_bcm92035(struct hci_dev *hdev)
 {
         struct sk_buff *skb;
@@ -1278,12 +1316,9 @@ static int btusb_setup_csr(struct hci_dev *hdev)
 
         BT_DBG("%s", hdev->name);
 
-        skb = __hci_cmd_sync(hdev, HCI_OP_READ_LOCAL_VERSION, 0, NULL,
-                             HCI_INIT_TIMEOUT);
-        if (IS_ERR(skb)) {
-                BT_ERR("Reading local version failed (%ld)", -PTR_ERR(skb));
+        skb = btusb_read_local_version(hdev);
+        if (IS_ERR(skb))
                 return -PTR_ERR(skb);
-        }
 
         rp = (struct hci_rp_read_local_version *)skb->data;
 
@@ -2414,21 +2449,9 @@ static int btusb_setup_bcm_patchram(struct hci_dev *hdev)
         kfree_skb(skb);
 
         /* Read Local Version Info */
-        skb = __hci_cmd_sync(hdev, HCI_OP_READ_LOCAL_VERSION, 0, NULL,
-                             HCI_INIT_TIMEOUT);
-        if (IS_ERR(skb)) {
-                ret = PTR_ERR(skb);
-                BT_ERR("%s: HCI_OP_READ_LOCAL_VERSION failed (%ld)",
-                       hdev->name, ret);
-                return ret;
-        }
-
-        if (skb->len != sizeof(*ver)) {
-                BT_ERR("%s: HCI_OP_READ_LOCAL_VERSION event length mismatch",
-                       hdev->name);
-                kfree_skb(skb);
-                return -EIO;
-        }
+        skb = btusb_read_local_version(hdev);
+        if (IS_ERR(skb))
+                return PTR_ERR(skb);
 
         ver = (struct hci_rp_read_local_version *)skb->data;
         rev = le16_to_cpu(ver->hci_rev);
@@ -2516,20 +2539,9 @@ reset_fw:
         kfree_skb(skb);
 
         /* Read Local Version Info */
-        skb = __hci_cmd_sync(hdev, HCI_OP_READ_LOCAL_VERSION, 0, NULL,
-                             HCI_INIT_TIMEOUT);
+        skb = btusb_read_local_version(hdev);
         if (IS_ERR(skb)) {
                 ret = PTR_ERR(skb);
-                BT_ERR("%s: HCI_OP_READ_LOCAL_VERSION failed (%ld)",
-                       hdev->name, ret);
-                goto done;
-        }
-
-        if (skb->len != sizeof(*ver)) {
-                BT_ERR("%s: HCI_OP_READ_LOCAL_VERSION event length mismatch",
-                       hdev->name);
-                kfree_skb(skb);
-                ret = -EIO;
                 goto done;
         }
 
@@ -2628,6 +2640,258 @@ static int btusb_set_bdaddr_ath3012(struct hci_dev *hdev,
         return 0;
 }
 
+#define QCA_DFU_PACKET_LEN      4096
+
+#define QCA_GET_TARGET_VERSION  0x09
+#define QCA_CHECK_STATUS        0x05
+#define QCA_DFU_DOWNLOAD        0x01
+
+#define QCA_SYSCFG_UPDATED      0x40
+#define QCA_PATCH_UPDATED       0x80
+#define QCA_DFU_TIMEOUT         3000
+
+struct qca_version {
+        __le32  rom_version;
+        __le32  patch_version;
+        __le32  ram_version;
+        __le32  ref_clock;
+        __u8    reserved[4];
+} __packed;
+
+struct qca_rampatch_version {
+        __le16  rom_version;
+        __le16  patch_version;
+} __packed;
+
+struct qca_device_info {
+        u32     rom_version;
+        u8      rampatch_hdr;   /* length of header in rampatch */
+        u8      nvm_hdr;        /* length of header in NVM */
+        u8      ver_offset;     /* offset of version structure in rampatch */
+};
+
+static const struct qca_device_info qca_devices_table[] = {
+        { 0x00000100, 20, 4, 10 }, /* Rome 1.0 */
+        { 0x00000101, 20, 4, 10 }, /* Rome 1.1 */
+        { 0x00000201, 28, 4, 18 }, /* Rome 2.1 */
+        { 0x00000300, 28, 4, 18 }, /* Rome 3.0 */
+        { 0x00000302, 28, 4, 18 }, /* Rome 3.2 */
+};
+
+static int btusb_qca_send_vendor_req(struct hci_dev *hdev, u8 request,