drivers/bluetooth/btusb.c

   1 /*
   2  *
   3  *  Generic Bluetooth USB driver
   4  *
   5  *  Copyright (C) 2005-2008  Marcel Holtmann <marcel@holtmann.org>
   6  *
   7  *
   8  *  This program is free software; you can redistribute it and/or modify
   9  *  it under the terms of the GNU General Public License as published by
  10  *  the Free Software Foundation; either version 2 of the License, or
  11  *  (at your option) any later version.
  12  *
  13  *  This program is distributed in the hope that it will be useful,
  14  *  but WITHOUT ANY WARRANTY; without even the implied warranty of
  15  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  16  *  GNU General Public License for more details.
  17  *
  18  *  You should have received a copy of the GNU General Public License
  19  *  along with this program; if not, write to the Free Software
  20  *  Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
  21  *
  22  */
  23
  24 #include <linux/kernel.h>
  25 #include <linux/module.h>
  26 #include <linux/init.h>
  27 #include <linux/slab.h>
  28 #include <linux/types.h>
  29 #include <linux/sched.h>
  30 #include <linux/errno.h>
  31 #include <linux/skbuff.h>
  32
  33 #include <linux/usb.h>
  34
  35 #include <net/bluetooth/bluetooth.h>
  36 #include <net/bluetooth/hci_core.h>
  37
  38 #define VERSION "0.6"
  39
  40 static int ignore_dga;
  41 static int ignore_csr;
  42 static int ignore_sniffer;
  43 static int disable_scofix;
  44 static int force_scofix;
  45
  46 static int reset = 1;
  47
  48 static struct usb_driver btusb_driver;
  49
  50 #define BTUSB_IGNORE            0x01
  51 #define BTUSB_DIGIANSWER        0x02
  52 #define BTUSB_CSR               0x04
  53 #define BTUSB_SNIFFER           0x08
  54 #define BTUSB_BCM92035          0x10
  55 #define BTUSB_BROKEN_ISOC       0x20
  56 #define BTUSB_WRONG_SCO_MTU     0x40
  57
  58 static struct usb_device_id btusb_table[] = {
  59         /* Generic Bluetooth USB device */
  60         { USB_DEVICE_INFO(0xe0, 0x01, 0x01) },
  61
  62         /* Apple MacBookPro 7,1 */
  63         { USB_DEVICE(0x05ac, 0x8213) },
  64
  65         /* Apple iMac11,1 */
  66         { USB_DEVICE(0x05ac, 0x8215) },
  67
  68         /* Apple MacBookPro6,2 */
  69         { USB_DEVICE(0x05ac, 0x8218) },
  70
  71         /* AVM BlueFRITZ! USB v2.0 */
  72         { USB_DEVICE(0x057c, 0x3800) },
  73
  74         /* Bluetooth Ultraport Module from IBM */
  75         { USB_DEVICE(0x04bf, 0x030a) },
  76
  77         /* ALPS Modules with non-standard id */
  78         { USB_DEVICE(0x044e, 0x3001) },
  79         { USB_DEVICE(0x044e, 0x3002) },
  80
  81         /* Ericsson with non-standard id */
  82         { USB_DEVICE(0x0bdb, 0x1002) },
  83
  84         /* Canyon CN-BTU1 with HID interfaces */
  85         { USB_DEVICE(0x0c10, 0x0000) },
  86
  87         { }     /* Terminating entry */
  88 };
  89
  90 MODULE_DEVICE_TABLE(usb, btusb_table);
  91
  92 static struct usb_device_id blacklist_table[] = {
  93         /* CSR BlueCore devices */
  94         { USB_DEVICE(0x0a12, 0x0001), .driver_info = BTUSB_CSR },
  95
  96         /* Broadcom BCM2033 without firmware */
  97         { USB_DEVICE(0x0a5c, 0x2033), .driver_info = BTUSB_IGNORE },
  98
  99         /* Broadcom BCM2035 */
 100         { USB_DEVICE(0x0a5c, 0x2035), .driver_info = BTUSB_WRONG_SCO_MTU },
 101         { USB_DEVICE(0x0a5c, 0x200a), .driver_info = BTUSB_WRONG_SCO_MTU },
 102         { USB_DEVICE(0x0a5c, 0x2009), .driver_info = BTUSB_BCM92035 },
 103
 104         /* Broadcom BCM2045 */
 105         { USB_DEVICE(0x0a5c, 0x2039), .driver_info = BTUSB_WRONG_SCO_MTU },
 106         { USB_DEVICE(0x0a5c, 0x2101), .driver_info = BTUSB_WRONG_SCO_MTU },
 107
 108         /* IBM/Lenovo ThinkPad with Broadcom chip */
 109         { USB_DEVICE(0x0a5c, 0x201e), .driver_info = BTUSB_WRONG_SCO_MTU },
 110         { USB_DEVICE(0x0a5c, 0x2110), .driver_info = BTUSB_WRONG_SCO_MTU },
 111
 112         /* HP laptop with Broadcom chip */
 113         { USB_DEVICE(0x03f0, 0x171d), .driver_info = BTUSB_WRONG_SCO_MTU },
 114
 115         /* Dell laptop with Broadcom chip */
 116         { USB_DEVICE(0x413c, 0x8126), .driver_info = BTUSB_WRONG_SCO_MTU },
 117
 118         /* Dell Wireless 370 and 410 devices */
 119         { USB_DEVICE(0x413c, 0x8152), .driver_info = BTUSB_WRONG_SCO_MTU },
 120         { USB_DEVICE(0x413c, 0x8156), .driver_info = BTUSB_WRONG_SCO_MTU },
 121
 122         /* Belkin F8T012 and F8T013 devices */
 123         { USB_DEVICE(0x050d, 0x0012), .driver_info = BTUSB_WRONG_SCO_MTU },
 124         { USB_DEVICE(0x050d, 0x0013), .driver_info = BTUSB_WRONG_SCO_MTU },
 125
 126         /* Asus WL-BTD202 device */
 127         { USB_DEVICE(0x0b05, 0x1715), .driver_info = BTUSB_WRONG_SCO_MTU },
 128
 129         /* Kensington Bluetooth USB adapter */
 130         { USB_DEVICE(0x047d, 0x105e), .driver_info = BTUSB_WRONG_SCO_MTU },
 131
 132         /* RTX Telecom based adapters with buggy SCO support */
 133         { USB_DEVICE(0x0400, 0x0807), .driver_info = BTUSB_BROKEN_ISOC },
 134         { USB_DEVICE(0x0400, 0x080a), .driver_info = BTUSB_BROKEN_ISOC },
 135
 136         /* CONWISE Technology based adapters with buggy SCO support */
 137         { USB_DEVICE(0x0e5e, 0x6622), .driver_info = BTUSB_BROKEN_ISOC },
 138
 139         /* Digianswer devices */
 140         { USB_DEVICE(0x08fd, 0x0001), .driver_info = BTUSB_DIGIANSWER },
 141         { USB_DEVICE(0x08fd, 0x0002), .driver_info = BTUSB_IGNORE },
 142
 143         /* CSR BlueCore Bluetooth Sniffer */
 144         { USB_DEVICE(0x0a12, 0x0002), .driver_info = BTUSB_SNIFFER },
 145
 146         /* Frontline ComProbe Bluetooth Sniffer */
 147         { USB_DEVICE(0x16d3, 0x0002), .driver_info = BTUSB_SNIFFER },
 148
 149         { }     /* Terminating entry */
 150 };
 151
 152 #define BTUSB_MAX_ISOC_FRAMES   10
 153
 154 #define BTUSB_INTR_RUNNING      0
 155 #define BTUSB_BULK_RUNNING      1
 156 #define BTUSB_ISOC_RUNNING      2
 157 #define BTUSB_SUSPENDING        3
 158 #define BTUSB_DID_ISO_RESUME    4
 159
 160 struct btusb_data {
 161         struct hci_dev       *hdev;
 162         struct usb_device    *udev;
 163         struct usb_interface *intf;
 164         struct usb_interface *isoc;
 165
 166         spinlock_t lock;
 167
 168         unsigned long flags;
 169
 170         struct work_struct work;
 171         struct work_struct waker;
 172
 173         struct usb_anchor tx_anchor;
 174         struct usb_anchor intr_anchor;
 175         struct usb_anchor bulk_anchor;
 176         struct usb_anchor isoc_anchor;
 177         struct usb_anchor deferred;
 178         int tx_in_flight;
 179         spinlock_t txlock;
 180
 181         struct usb_endpoint_descriptor *intr_ep;
 182         struct usb_endpoint_descriptor *bulk_tx_ep;
 183         struct usb_endpoint_descriptor *bulk_rx_ep;
 184         struct usb_endpoint_descriptor *isoc_tx_ep;
 185         struct usb_endpoint_descriptor *isoc_rx_ep;
 186
 187         __u8 cmdreq_type;
 188
 189         unsigned int sco_num;
 190         int isoc_altsetting;
 191         int suspend_count;
 192 };
 193
 194 static int inc_tx(struct btusb_data *data)
 195 {
 196         unsigned long flags;
 197         int rv;
 198
 199         spin_lock_irqsave(&data->txlock, flags);
 200         rv = test_bit(BTUSB_SUSPENDING, &data->flags);
 201         if (!rv)
 202                 data->tx_in_flight++;
 203         spin_unlock_irqrestore(&data->txlock, flags);
 204
 205         return rv;
 206 }
 207
 208 static void btusb_intr_complete(struct urb *urb)
 209 {
 210         struct hci_dev *hdev = urb->context;
 211         struct btusb_data *data = hdev->driver_data;
 212         int err;
 213
 214         BT_DBG("%s urb %p status %d count %d", hdev->name,
 215                                         urb, urb->status, urb->actual_length);
 216
 217         if (!test_bit(HCI_RUNNING, &hdev->flags))
 218                 return;
 219
 220         if (urb->status == 0) {
 221                 hdev->stat.byte_rx += urb->actual_length;
 222
 223                 if (hci_recv_fragment(hdev, HCI_EVENT_PKT,
 224                                                 urb->transfer_buffer,
 225                                                 urb->actual_length) < 0) {
 226                         BT_ERR("%s corrupted event packet", hdev->name);
 227                         hdev->stat.err_rx++;
 228                 }
 229         }
 230
 231         if (!test_bit(BTUSB_INTR_RUNNING, &data->flags))
 232                 return;
 233
 234         usb_mark_last_busy(data->udev);
 235         usb_anchor_urb(urb, &data->intr_anchor);
 236
 237         err = usb_submit_urb(urb, GFP_ATOMIC);
 238         if (err < 0) {
 239                 BT_ERR("%s urb %p failed to resubmit (%d)",
 240                                                 hdev->name, urb, -err);
 241                 usb_unanchor_urb(urb);
 242         }
 243 }
 244
 245 static int btusb_submit_intr_urb(struct hci_dev *hdev, gfp_t mem_flags)
 246 {
 247         struct btusb_data *data = hdev->driver_data;
 248         struct urb *urb;
 249         unsigned char *buf;
 250         unsigned int pipe;
 251         int err, size;
 252
 253         BT_DBG("%s", hdev->name);
 254
 255         if (!data->intr_ep)
 256                 return -ENODEV;
 257
 258         urb = usb_alloc_urb(0, mem_flags);
 259         if (!urb)
 260                 return -ENOMEM;
 261
 262         size = le16_to_cpu(data->intr_ep->wMaxPacketSize);
 263
 264         buf = kmalloc(size, mem_flags);
 265         if (!buf) {
 266                 usb_free_urb(urb);
 267                 return -ENOMEM;
 268         }
 269
 270         pipe = usb_rcvintpipe(data->udev, data->intr_ep->bEndpointAddress);
 271
 272         usb_fill_int_urb(urb, data->udev, pipe, buf, size,
 273                                                 btusb_intr_complete, hdev,
 274                                                 data->intr_ep->bInterval);
 275
 276         urb->transfer_flags |= URB_FREE_BUFFER;
 277
 278         usb_anchor_urb(urb, &data->intr_anchor);
 279
 280         err = usb_submit_urb(urb, mem_flags);
 281         if (err < 0) {
 282                 BT_ERR("%s urb %p submission failed (%d)",
 283                                                 hdev->name, urb, -err);
 284                 usb_unanchor_urb(urb);
 285         }
 286
 287         usb_free_urb(urb);
 288
 289         return err;
 290 }
 291
 292 static void btusb_bulk_complete(struct urb *urb)
 293 {
 294         struct hci_dev *hdev = urb->context;
 295         struct btusb_data *data = hdev->driver_data;
 296         int err;
 297
 298         BT_DBG("%s urb %p status %d count %d", hdev->name,
 299                                         urb, urb->status, urb->actual_length);
 300
 301         if (!test_bit(HCI_RUNNING, &hdev->flags))
 302                 return;
 303
 304         if (urb->status == 0) {
 305                 hdev->stat.byte_rx += urb->actual_length;
 306
 307                 if (hci_recv_fragment(hdev, HCI_ACLDATA_PKT,
 308                                                 urb->transfer_buffer,
 309                                                 urb->actual_length) < 0) {
 310                         BT_ERR("%s corrupted ACL packet", hdev->name);
 311                         hdev->stat.err_rx++;
 312                 }
 313         }
 314
 315         if (!test_bit(BTUSB_BULK_RUNNING, &data->flags))
 316                 return;
 317
 318         usb_anchor_urb(urb, &data->bulk_anchor);
 319         usb_mark_last_busy(data->udev);
 320
 321         err = usb_submit_urb(urb, GFP_ATOMIC);
 322         if (err < 0) {
 323                 BT_ERR("%s urb %p failed to resubmit (%d)",
 324                                                 hdev->name, urb, -err);
 325                 usb_unanchor_urb(urb);
 326         }
 327 }
 328
 329 static int btusb_submit_bulk_urb(struct hci_dev *hdev, gfp_t mem_flags)
 330 {
 331         struct btusb_data *data = hdev->driver_data;
 332         struct urb *urb;
 333         unsigned char *buf;
 334         unsigned int pipe;
 335         int err, size = HCI_MAX_FRAME_SIZE;
 336
 337         BT_DBG("%s", hdev->name);
 338
 339         if (!data->bulk_rx_ep)
 340                 return -ENODEV;
 341
 342         urb = usb_alloc_urb(0, mem_flags);
 343         if (!urb)
 344                 return -ENOMEM;
 345
 346         buf = kmalloc(size, mem_flags);
 347         if (!buf) {
 348                 usb_free_urb(urb);
 349                 return -ENOMEM;
 350         }
 351
 352         pipe = usb_rcvbulkpipe(data->udev, data->bulk_rx_ep->bEndpointAddress);
 353
 354         usb_fill_bulk_urb(urb, data->udev, pipe,
 355                                         buf, size, btusb_bulk_complete, hdev);
 356
 357         urb->transfer_flags |= URB_FREE_BUFFER;
 358
 359         usb_mark_last_busy(data->udev);
 360         usb_anchor_urb(urb, &data->bulk_anchor);
 361
 362         err = usb_submit_urb(urb, mem_flags);
 363         if (err < 0) {
 364                 BT_ERR("%s urb %p submission failed (%d)",
 365                                                 hdev->name, urb, -err);
 366                 usb_unanchor_urb(urb);
 367         }
 368
 369         usb_free_urb(urb);
 370
 371         return err;
 372 }
 373
 374 static void btusb_isoc_complete(struct urb *urb)
 375 {
 376         struct hci_dev *hdev = urb->context;
 377         struct btusb_data *data = hdev->driver_data;
 378         int i, err;
 379
 380         BT_DBG("%s urb %p status %d count %d", hdev->name,
 381                                         urb, urb->status, urb->actual_length);
 382
 383         if (!test_bit(HCI_RUNNING, &hdev->flags))
 384                 return;
 385
 386         if (urb->status == 0) {
 387                 for (i = 0; i < urb->number_of_packets; i++) {
 388                         unsigned int offset = urb->iso_frame_desc[i].offset;
 389                         unsigned int length = urb->iso_frame_desc[i].actual_length;
 390
 391                         if (urb->iso_frame_desc[i].status)
 392                                 continue;
 393
 394                         hdev->stat.byte_rx += length;
 395
 396                         if (hci_recv_fragment(hdev, HCI_SCODATA_PKT,
 397                                                 urb->transfer_buffer + offset,
 398                                                                 length) < 0) {
 399                                 BT_ERR("%s corrupted SCO packet", hdev->name);
 400                                 hdev->stat.err_rx++;
 401                         }
 402                 }
 403         }
 404
 405         if (!test_bit(BTUSB_ISOC_RUNNING, &data->flags))
 406                 return;
 407
 408         usb_anchor_urb(urb, &data->isoc_anchor);
 409
 410         err = usb_submit_urb(urb, GFP_ATOMIC);
 411         if (err < 0) {
 412                 BT_ERR("%s urb %p failed to resubmit (%d)",
 413                                                 hdev->name, urb, -err);
 414                 usb_unanchor_urb(urb);
 415         }
 416 }
 417
 418 static void inline __fill_isoc_descriptor(struct urb *urb, int len, int mtu)
 419 {
 420         int i, offset = 0;
 421
 422         BT_DBG("len %d mtu %d", len, mtu);
 423
 424         for (i = 0; i < BTUSB_MAX_ISOC_FRAMES && len >= mtu;
 425                                         i++, offset += mtu, len -= mtu) {
 426                 urb->iso_frame_desc[i].offset = offset;
 427                 urb->iso_frame_desc[i].length = mtu;
 428         }
 429
 430         if (len && i < BTUSB_MAX_ISOC_FRAMES) {
 431                 urb->iso_frame_desc[i].offset = offset;
 432                 urb->iso_frame_desc[i].length = len;
 433                 i++;
 434         }
 435
 436         urb->number_of_packets = i;
 437 }
 438
 439 static int btusb_submit_isoc_urb(struct hci_dev *hdev, gfp_t mem_flags)
 440 {
 441         struct btusb_data *data = hdev->driver_data;
 442         struct urb *urb;
 443         unsigned char *buf;
 444         unsigned int pipe;
 445         int err, size;
 446
 447         BT_DBG("%s", hdev->name);
 448
 449         if (!data->isoc_rx_ep)
 450                 return -ENODEV;
 451
 452         urb = usb_alloc_urb(BTUSB_MAX_ISOC_FRAMES, mem_flags);
 453         if (!urb)
 454                 return -ENOMEM;
 455
 456         size = le16_to_cpu(data->isoc_rx_ep->wMaxPacketSize) *
 457                                                 BTUSB_MAX_ISOC_FRAMES;
 458
 459         buf = kmalloc(size, mem_flags);
 460         if (!buf) {
 461                 usb_free_urb(urb);
 462                 return -ENOMEM;
 463         }
 464
 465         pipe = usb_rcvisocpipe(data->udev, data->isoc_rx_ep->bEndpointAddress);
 466
 467         urb->dev      = data->udev;
 468         urb->pipe     = pipe;
 469         urb->context  = hdev;
 470         urb->complete = btusb_isoc_complete;
 471         urb->interval = data->isoc_rx_ep->bInterval;
 472
 473         urb->transfer_flags  = URB_FREE_BUFFER | URB_ISO_ASAP;
 474         urb->transfer_buffer = buf;
 475         urb->transfer_buffer_length = size;
 476
 477         __fill_isoc_descriptor(urb, size,
 478                         le16_to_cpu(data->isoc_rx_ep->wMaxPacketSize));
 479
 480         usb_anchor_urb(urb, &data->isoc_anchor);
 481
 482         err = usb_submit_urb(urb, mem_flags);
 483         if (err < 0) {
 484                 BT_ERR("%s urb %p submission failed (%d)",
 485                                                 hdev->name, urb, -err);
 486                 usb_unanchor_urb(urb);
 487         }
 488
 489         usb_free_urb(urb);
 490
 491         return err;
 492 }
 493
 494 static void btusb_tx_complete(struct urb *urb)
 495 {
 496         struct sk_buff *skb = urb->context;
 497         struct hci_dev *hdev = (struct hci_dev *) skb->dev;
 498         struct btusb_data *data = hdev->driver_data;
 499
 500         BT_DBG("%s urb %p status %d count %d", hdev->name,
 501                                         urb, urb->status, urb->actual_length);
 502
 503         if (!test_bit(HCI_RUNNING, &hdev->flags))
 504                 goto done;
 505
 506         if (!urb->status)
 507                 hdev->stat.byte_tx += urb->transfer_buffer_length;
 508         else
 509                 hdev->stat.err_tx++;
 510
 511 done:
 512         spin_lock(&data->txlock);
 513         data->tx_in_flight--;
 514         spin_unlock(&data->txlock);
 515
 516         kfree(urb->setup_packet);
 517
 518         kfree_skb(skb);
 519 }
 520
 521 static void btusb_isoc_tx_complete(struct urb *urb)
 522 {
 523         struct sk_buff *skb = urb->context;
 524         struct hci_dev *hdev = (struct hci_dev *) skb->dev;
 525
 526         BT_DBG("%s urb %p status %d count %d", hdev->name,
 527                                         urb, urb->status, urb->actual_length);
 528
 529         if (!test_bit(HCI_RUNNING, &hdev->flags))
 530                 goto done;
 531
 532         if (!urb->status)
 533                 hdev->stat.byte_tx += urb->transfer_buffer_length;
 534         else
 535                 hdev->stat.err_tx++;
 536
 537 done:
 538         kfree(urb->setup_packet);
 539
 540         kfree_skb(skb);
 541 }
 542
 543 static int btusb_open(struct hci_dev *hdev)
 544 {
 545         struct btusb_data *data = hdev->driver_data;
 546         int err;
 547
 548         BT_DBG("%s", hdev->name);
 549
 550         err = usb_autopm_get_interface(data->intf);
 551         if (err < 0)
 552                 return err;
 553
 554         data->intf->needs_remote_wakeup = 1;
 555
 556         if (test_and_set_bit(HCI_RUNNING, &hdev->flags))
 557                 goto done;
 558
 559         if (test_and_set_bit(BTUSB_INTR_RUNNING, &data->flags))
 560                 goto done;
 561
 562         err = btusb_submit_intr_urb(hdev, GFP_KERNEL);
 563         if (err < 0)
 564                 goto failed;
 565
 566         err = btusb_submit_bulk_urb(hdev, GFP_KERNEL);
 567         if (err < 0) {
 568                 usb_kill_anchored_urbs(&data->intr_anchor);
 569                 goto failed;
 570         }
 571
 572         set_bit(BTUSB_BULK_RUNNING, &data->flags);
 573         btusb_submit_bulk_urb(hdev, GFP_KERNEL);
 574
 575 done:
 576         usb_autopm_put_interface(data->intf);
 577         return 0;
 578
 579 failed:
 580         clear_bit(BTUSB_INTR_RUNNING, &data->flags);
 581         clear_bit(HCI_RUNNING, &hdev->flags);
 582         usb_autopm_put_interface(data->intf);
 583         return err;
 584 }
 585
 586 static void btusb_stop_traffic(struct btusb_data *data)
 587 {
 588         usb_kill_anchored_urbs(&data->intr_anchor);
 589         usb_kill_anchored_urbs(&data->bulk_anchor);
 590         usb_kill_anchored_urbs(&data->isoc_anchor);
 591 }
 592
 593 static int btusb_close(struct hci_dev *hdev)
 594 {
 595         struct btusb_data *data = hdev->driver_data;
 596         int err;
 597
 598         BT_DBG("%s", hdev->name);
 599
 600         if (!test_and_clear_bit(HCI_RUNNING, &hdev->flags))
 601                 return 0;
 602
 603         cancel_work_sync(&data->work);
 604         cancel_work_sync(&data->waker);
 605
 606         clear_bit(BTUSB_ISOC_RUNNING, &data->flags);
 607         clear_bit(BTUSB_BULK_RUNNING, &data->flags);
 608         clear_bit(BTUSB_INTR_RUNNING, &data->flags);
 609
 610         btusb_stop_traffic(data);
 611         err = usb_autopm_get_interface(data->intf);
 612         if (err < 0)
 613                 goto failed;
 614
 615         data->intf->needs_remote_wakeup = 0;
 616         usb_autopm_put_interface(data->intf);
 617
 618 failed:
 619         usb_scuttle_anchored_urbs(&data->deferred);
 620         return 0;
 621 }
 622
 623 static int btusb_flush(struct hci_dev *hdev)
 624 {
 625         struct btusb_data *data = hdev->driver_data;
 626
 627         BT_DBG("%s", hdev->name);
 628
 629         usb_kill_anchored_urbs(&data->tx_anchor);
 630
 631         return 0;
 632 }
 633
 634 static int btusb_send_frame(struct sk_buff *skb)
 635 {
 636         struct hci_dev *hdev = (struct hci_dev *) skb->dev;
 637         struct btusb_data *data = hdev->driver_data;
 638         struct usb_ctrlrequest *dr;
 639         struct urb *urb;
 640         unsigned int pipe;
 641         int err;
 642
 643         BT_DBG("%s", hdev->name);
 644
 645         if (!test_bit(HCI_RUNNING, &hdev->flags))
 646                 return -EBUSY;
 647
 648         switch (bt_cb(skb)->pkt_type) {
 649         case HCI_COMMAND_PKT:
 650                 urb = usb_alloc_urb(0, GFP_ATOMIC);
 651                 if (!urb)
 652                         return -ENOMEM;
 653
 654                 dr = kmalloc(sizeof(*dr), GFP_ATOMIC);
 655                 if (!dr) {
 656                         usb_free_urb(urb);
 657                         return -ENOMEM;
 658                 }
 659
 660                 dr->bRequestType = data->cmdreq_type;
 661                 dr->bRequest     = 0;
 662                 dr->wIndex       = 0;
 663                 dr->wValue       = 0;
 664                 dr->wLength      = __cpu_to_le16(skb->len);
 665
 666                 pipe = usb_sndctrlpipe(data->udev, 0x00);
 667
 668                 usb_fill_control_urb(urb, data->udev, pipe, (void *) dr,
 669                                 skb->data, skb->len, btusb_tx_complete, skb);
 670
 671                 hdev->stat.cmd_tx++;
 672                 break;
 673
 674         case HCI_ACLDATA_PKT:
 675                 if (!data->bulk_tx_ep || hdev->conn_hash.acl_num < 1)
 676                         return -ENODEV;
 677
 678                 urb = usb_alloc_urb(0, GFP_ATOMIC);
 679                 if (!urb)
 680                         return -ENOMEM;
 681
 682                 pipe = usb_sndbulkpipe(data->udev,
 683                                         data->bulk_tx_ep->bEndpointAddress);
 684
 685                 usb_fill_bulk_urb(urb, data->udev, pipe,
 686                                 skb->data, skb->len, btusb_tx_complete, skb);
 687
 688                 hdev->stat.acl_tx++;
 689                 break;
 690
 691         case HCI_SCODATA_PKT:
 692                 if (!data->isoc_tx_ep || hdev->conn_hash.sco_num < 1)
 693                         return -ENODEV;
 694
 695                 urb = usb_alloc_urb(BTUSB_MAX_ISOC_FRAMES, GFP_ATOMIC);
 696                 if (!urb)
 697                         return -ENOMEM;
 698
 699                 pipe = usb_sndisocpipe(data->udev,
 700                                         data->isoc_tx_ep->bEndpointAddress);
 701
 702                 urb->dev      = data->udev;
 703                 urb->pipe     = pipe;
 704                 urb->context  = skb;
 705                 urb->complete = btusb_isoc_tx_complete;
 706                 urb->interval = data->isoc_tx_ep->bInterval;
 707
 708                 urb->transfer_flags  = URB_ISO_ASAP;
 709                 urb->transfer_buffer = skb->data;
 710                 urb->transfer_buffer_length = skb->len;
 711
 712                 __fill_isoc_descriptor(urb, skb->len,
 713                                 le16_to_cpu(data->isoc_tx_ep->wMaxPacketSize));
 714
 715                 hdev->stat.sco_tx++;
 716                 goto skip_waking;
 717
 718         default:
 719                 return -EILSEQ;
 720         }
 721
 722         err = inc_tx(data);
 723         if (err) {
 724                 usb_anchor_urb(urb, &data->deferred);
 725                 schedule_work(&data->waker);
 726                 err = 0;
 727                 goto done;
 728         }
 729
 730 skip_waking:
 731         usb_anchor_urb(urb, &data->tx_anchor);
 732
 733         err = usb_submit_urb(urb, GFP_ATOMIC);
 734         if (err < 0) {
 735                 BT_ERR("%s urb %p submission failed", hdev->name, urb);
 736                 kfree(urb->setup_packet);
 737                 usb_unanchor_urb(urb);
 738         } else {
 739                 usb_mark_last_busy(data->udev);
 740         }
 741
 742         usb_free_urb(urb);
 743
 744 done:
 745         return err;
 746 }
 747
 748 static void btusb_destruct(struct hci_dev *hdev)
 749 {
 750         struct btusb_data *data = hdev->driver_data;
 751
 752         BT_DBG("%s", hdev->name);
 753
 754         kfree(data);
 755 }
 756
 757 static void btusb_notify(struct hci_dev *hdev, unsigned int evt)
 758 {
 759         struct btusb_data *data = hdev->driver_data;
 760
 761         BT_DBG("%s evt %d", hdev->name, evt);
 762
 763         if (hdev->conn_hash.sco_num != data->sco_num) {
 764                 data->sco_num = hdev->conn_hash.sco_num;
 765                 schedule_work(&data->work);
 766         }
 767 }
 768
 769 static int inline __set_isoc_interface(struct hci_dev *hdev, int altsetting)
 770 {
 771         struct btusb_data *data = hdev->driver_data;
 772         struct usb_interface *intf = data->isoc;
 773         struct usb_endpoint_descriptor *ep_desc;
 774         int i, err;
 775
 776         if (!data->isoc)
 777                 return -ENODEV;
 778
 779         err = usb_set_interface(data->udev, 1, altsetting);
 780         if (err < 0) {
 781                 BT_ERR("%s setting interface failed (%d)", hdev->name, -err);
 782                 return err;
 783         }
 784
 785         data->isoc_altsetting = altsetting;
 786
 787         data->isoc_tx_ep = NULL;
 788         data->isoc_rx_ep = NULL;
 789
 790         for (i = 0; i < intf->cur_altsetting->desc.bNumEndpoints; i++) {
 791                 ep_desc = &intf->cur_altsetting->endpoint[i].desc;
 792
 793                 if (!data->isoc_tx_ep && usb_endpoint_is_isoc_out(ep_desc)) {
 794                         data->isoc_tx_ep = ep_desc;
 795                         continue;
 796                 }
 797
 798                 if (!data->isoc_rx_ep && usb_endpoint_is_isoc_in(ep_desc)) {
 799                         data->isoc_rx_ep = ep_desc;
 800                         continue;
 801                 }
 802         }
 803
 804         if (!data->isoc_tx_ep || !data->isoc_rx_ep) {
 805                 BT_ERR("%s invalid SCO descriptors", hdev->name);
 806                 return -ENODEV;
 807         }
 808
 809         return 0;
 810 }
 811
 812 static void btusb_work(struct work_struct *work)
 813 {
 814         struct btusb_data *data = container_of(work, struct btusb_data, work);
 815         struct hci_dev *hdev = data->hdev;
 816         int err;
 817
 818         if (hdev->conn_hash.sco_num > 0) {
 819                 if (!test_bit(BTUSB_DID_ISO_RESUME, &data->flags)) {
 820                         err = usb_autopm_get_interface(data->isoc);
 821                         if (err < 0) {
 822                                 clear_bit(BTUSB_ISOC_RUNNING, &data->flags);
 823                                 usb_kill_anchored_urbs(&data->isoc_anchor);
 824                                 return;
 825                         }
 826
 827                         set_bit(BTUSB_DID_ISO_RESUME, &data->flags);
 828                 }
 829                 if (data->isoc_altsetting != 2) {
 830                         clear_bit(BTUSB_ISOC_RUNNING, &data->flags);
 831                         usb_kill_anchored_urbs(&data->isoc_anchor);
 832
 833                         if (__set_isoc_interface(hdev, 2) < 0)
 834                                 return;
 835                 }
 836
 837                 if (!test_and_set_bit(BTUSB_ISOC_RUNNING, &data->flags)) {
 838                         if (btusb_submit_isoc_urb(hdev, GFP_KERNEL) < 0)
 839                                 clear_bit(BTUSB_ISOC_RUNNING, &data->flags);
 840                         else
 841                                 btusb_submit_isoc_urb(hdev, GFP_KERNEL);
 842                 }
 843         } else {
 844                 clear_bit(BTUSB_ISOC_RUNNING, &data->flags);
 845                 usb_kill_anchored_urbs(&data->isoc_anchor);
 846
 847                 __set_isoc_interface(hdev, 0);
 848                 if (test_and_clear_bit(BTUSB_DID_ISO_RESUME, &data->flags))
 849                         usb_autopm_put_interface(data->isoc);
 850         }
 851 }
 852
 853 static void btusb_waker(struct work_struct *work)
 854 {
 855         struct btusb_data *data = container_of(work, struct btusb_data, waker);
 856         int err;
 857
 858         err = usb_autopm_get_interface(data->intf);
 859         if (err < 0)
 860                 return;
 861
 862         usb_autopm_put_interface(data->intf);
 863 }
 864
 865 static int btusb_probe(struct usb_interface *intf,
 866                                 const struct usb_device_id *id)
 867 {
 868         struct usb_endpoint_descriptor *ep_desc;
 869         struct btusb_data *data;
 870         struct hci_dev *hdev;
 871         int i, err;
 872
 873         BT_DBG("intf %p id %p", intf, id);
 874
 875         /* interface numbers are hardcoded in the spec */
 876         if (intf->cur_altsetting->desc.bInterfaceNumber != 0)
 877                 return -ENODEV;
 878
 879         if (!id->driver_info) {
 880                 const struct usb_device_id *match;
 881                 match = usb_match_id(intf, blacklist_table);
 882                 if (match)
 883                         id = match;
 884         }
 885
 886         if (id->driver_info == BTUSB_IGNORE)
 887                 return -ENODEV;
 888
 889         if (ignore_dga && id->driver_info & BTUSB_DIGIANSWER)
 890                 return -ENODEV;
 891
 892         if (ignore_csr && id->driver_info & BTUSB_CSR)
 893                 return -ENODEV;
 894
 895         if (ignore_sniffer && id->driver_info & BTUSB_SNIFFER)
 896                 return -ENODEV;
 897
 898         data = kzalloc(sizeof(*data), GFP_KERNEL);
 899         if (!data)
 900                 return -ENOMEM;
 901
 902         for (i = 0; i < intf->cur_altsetting->desc.bNumEndpoints; i++) {
 903                 ep_desc = &intf->cur_altsetting->endpoint[i].desc;
 904
 905                 if (!data->intr_ep && usb_endpoint_is_int_in(ep_desc)) {
 906                         data->intr_ep = ep_desc;
 907                         continue;
 908                 }
 909
 910                 if (!data->bulk_tx_ep && usb_endpoint_is_bulk_out(ep_desc)) {
 911                         data->bulk_tx_ep = ep_desc;
 912                         continue;
 913                 }
 914
 915                 if (!data->bulk_rx_ep && usb_endpoint_is_bulk_in(ep_desc)) {
 916                         data->bulk_rx_ep = ep_desc;
 917                         continue;
 918                 }
 919         }
 920
 921         if (!data->intr_ep || !data->bulk_tx_ep || !data->bulk_rx_ep) {
 922                 kfree(data);
 923                 return -ENODEV;
 924         }
 925
 926         data->cmdreq_type = USB_TYPE_CLASS;
 927
 928         data->udev = interface_to_usbdev(intf);
 929         data->intf = intf;
 930
 931         spin_lock_init(&data->lock);
 932
 933         INIT_WORK(&data->work, btusb_work);
 934         INIT_WORK(&data->waker, btusb_waker);
 935         spin_lock_init(&data->txlock);
 936
 937         init_usb_anchor(&data->tx_anchor);
 938         init_usb_anchor(&data->intr_anchor);
 939         init_usb_anchor(&data->bulk_anchor);
 940         init_usb_anchor(&data->isoc_anchor);
 941         init_usb_anchor(&data->deferred);
 942
 943         hdev = hci_alloc_dev();
 944         if (!hdev) {
 945                 kfree(data);
 946                 return -ENOMEM;
 947         }
 948
 949         hdev->bus = HCI_USB;
 950         hdev->driver_data = data;
 951
 952         data->hdev = hdev;
 953
 954         SET_HCIDEV_DEV(hdev, &intf->dev);
 955
 956         hdev->open     = btusb_open;
 957         hdev->close    = btusb_close;
 958         hdev->flush    = btusb_flush;
 959         hdev->send     = btusb_send_frame;
 960         hdev->destruct = btusb_destruct;
 961         hdev->notify   = btusb_notify;
 962
 963         hdev->owner = THIS_MODULE;
 964
 965         /* Interface numbers are hardcoded in the specification */
 966         data->isoc = usb_ifnum_to_if(data->udev, 1);
 967
 968         if (!reset)
 969                 set_bit(HCI_QUIRK_NO_RESET, &hdev->quirks);
 970
 971         if (force_scofix || id->driver_info & BTUSB_WRONG_SCO_MTU) {
 972                 if (!disable_scofix)
 973                         set_bit(HCI_QUIRK_FIXUP_BUFFER_SIZE, &hdev->quirks);
 974         }
 975
 976         if (id->driver_info & BTUSB_BROKEN_ISOC)
 977                 data->isoc = NULL;
 978
 979         if (id->driver_info & BTUSB_DIGIANSWER) {
 980                 data->cmdreq_type = USB_TYPE_VENDOR;
 981                 set_bit(HCI_QUIRK_NO_RESET, &hdev->quirks);
 982         }
 983
 984         if (id->driver_info & BTUSB_CSR) {
 985                 struct usb_device *udev = data->udev;
 986
 987                 /* Old firmware would otherwise execute USB reset */
 988                 if (le16_to_cpu(udev->descriptor.bcdDevice) < 0x117)
 989                         set_bit(HCI_QUIRK_NO_RESET, &hdev->quirks);
 990         }
 991
 992         if (id->driver_info & BTUSB_SNIFFER) {
 993                 struct usb_device *udev = data->udev;
 994
 995                 /* New sniffer firmware has crippled HCI interface */
 996                 if (le16_to_cpu(udev->descriptor.bcdDevice) > 0x997)
 997                         set_bit(HCI_QUIRK_RAW_DEVICE, &hdev->quirks);
 998
 999                 data->isoc = NULL;
1000         }
1001
1002         if (id->driver_info & BTUSB_BCM92035) {
1003                 unsigned char cmd[] = { 0x3b, 0xfc, 0x01, 0x00 };
1004                 struct sk_buff *skb;
1005
1006                 skb = bt_skb_alloc(sizeof(cmd), GFP_KERNEL);
1007                 if (skb) {
1008                         memcpy(skb_put(skb, sizeof(cmd)), cmd, sizeof(cmd));
1009                         skb_queue_tail(&hdev->driver_init, skb);
1010                 }
1011         }
1012
1013         if (data->isoc) {
1014                 err = usb_driver_claim_interface(&btusb_driver,
1015                                                         data->isoc, data);
1016                 if (err < 0) {
1017                         hci_free_dev(hdev);
1018                         kfree(data);
1019                         return err;
1020                 }
1021         }
1022
1023         err = hci_register_dev(hdev);
1024         if (err < 0) {
1025                 hci_free_dev(hdev);
1026                 kfree(data);
1027                 return err;
1028         }
1029
1030         usb_set_intfdata(intf, data);
1031
1032         return 0;
1033 }
1034
1035 static void btusb_disconnect(struct usb_interface *intf)
1036 {
1037         struct btusb_data *data = usb_get_intfdata(intf);
1038         struct hci_dev *hdev;
1039
1040         BT_DBG("intf %p", intf);
1041
1042         if (!data)
1043                 return;
1044
1045         hdev = data->hdev;
1046
1047         __hci_dev_hold(hdev);
1048
1049         usb_set_intfdata(data->intf, NULL);
1050
1051         if (data->isoc)
1052                 usb_set_intfdata(data->isoc, NULL);
1053
1054         hci_unregister_dev(hdev);
1055
1056         if (intf == data->isoc)
1057                 usb_driver_release_interface(&btusb_driver, data->intf);
1058         else if (data->isoc)
1059                 usb_driver_release_interface(&btusb_driver, data->isoc);
1060
1061         __hci_dev_put(hdev);
1062
1063         hci_free_dev(hdev);
1064 }
1065
1066 #ifdef CONFIG_PM
1067 static int btusb_suspend(struct usb_interface *intf, pm_message_t message)
1068 {
1069         struct btusb_data *data = usb_get_intfdata(intf);
1070
1071         BT_DBG("intf %p", intf);
1072
1073         if (data->suspend_count++)
1074                 return 0;
1075
1076         spin_lock_irq(&data->txlock);
1077         if (!((message.event & PM_EVENT_AUTO) && data->tx_in_flight)) {
1078                 set_bit(BTUSB_SUSPENDING, &data->flags);
1079                 spin_unlock_irq(&data->txlock);
1080         } else {
1081                 spin_unlock_irq(&data->txlock);
1082                 data->suspend_count--;
1083                 return -EBUSY;
1084         }
1085
1086         cancel_work_sync(&data->work);
1087
1088         btusb_stop_traffic(data);
1089         usb_kill_anchored_urbs(&data->tx_anchor);
1090
1091         return 0;
1092 }
1093
1094 static void play_deferred(struct btusb_data *data)
1095 {
1096         struct urb *urb;
1097         int err;
1098
1099         while ((urb = usb_get_from_anchor(&data->deferred))) {
1100                 err = usb_submit_urb(urb, GFP_ATOMIC);
1101                 if (err < 0)
1102                         break;
1103
1104                 data->tx_in_flight++;
1105         }
1106         usb_scuttle_anchored_urbs(&data->deferred);
1107 }
1108
1109 static int btusb_resume(struct usb_interface *intf)
1110 {
1111         struct btusb_data *data = usb_get_intfdata(intf);
1112         struct hci_dev *hdev = data->hdev;
1113         int err = 0;
1114
1115         BT_DBG("intf %p", intf);
1116
1117         if (--data->suspend_count)
1118                 return 0;
1119
1120         if (!test_bit(HCI_RUNNING, &hdev->flags))
1121                 goto done;
1122
1123         if (test_bit(BTUSB_INTR_RUNNING, &data->flags)) {
1124                 err = btusb_submit_intr_urb(hdev, GFP_NOIO);
1125                 if (err < 0) {
1126                         clear_bit(BTUSB_INTR_RUNNING, &data->flags);
1127                         goto failed;
1128                 }
1129         }
1130
1131         if (test_bit(BTUSB_BULK_RUNNING, &data->flags)) {
1132                 err = btusb_submit_bulk_urb(hdev, GFP_NOIO);
1133                 if (err < 0) {
1134                         clear_bit(BTUSB_BULK_RUNNING, &data->flags);
1135                         goto failed;
1136                 }
1137
1138                 btusb_submit_bulk_urb(hdev, GFP_NOIO);
1139         }
1140
1141         if (test_bit(BTUSB_ISOC_RUNNING, &data->flags)) {
1142                 if (btusb_submit_isoc_urb(hdev, GFP_NOIO) < 0)
1143                         clear_bit(BTUSB_ISOC_RUNNING, &data->flags);
1144                 else
1145                         btusb_submit_isoc_urb(hdev, GFP_NOIO);
1146         }
1147
1148         spin_lock_irq(&data->txlock);
1149         play_deferred(data);
1150         clear_bit(BTUSB_SUSPENDING, &data->flags);
1151         spin_unlock_irq(&data->txlock);
1152         schedule_work(&data->work);
1153
1154         return 0;
1155
1156 failed:
1157         usb_scuttle_anchored_urbs(&data->deferred);
1158 done:
1159         spin_lock_irq(&data->txlock);
1160         clear_bit(BTUSB_SUSPENDING, &data->flags);
1161         spin_unlock_irq(&data->txlock);
1162
1163         return err;
1164 }
1165 #endif
1166
1167 static struct usb_driver btusb_driver = {
1168         .name           = "btusb",
1169         .probe          = btusb_probe,
1170         .disconnect     = btusb_disconnect,
1171 #ifdef CONFIG_PM
1172         .suspend        = btusb_suspend,
1173         .resume         = btusb_resume,
1174 #endif
1175         .id_table       = btusb_table,
1176         .supports_autosuspend = 1,
1177 };
1178
1179 static int __init btusb_init(void)
1180 {
1181         BT_INFO("Generic Bluetooth USB driver ver %s", VERSION);
1182
1183         return usb_register(&btusb_driver);
1184 }
1185
1186 static void __exit btusb_exit(void)
1187 {
1188         usb_deregister(&btusb_driver);
1189 }
1190
1191 module_init(btusb_init);
1192 module_exit(btusb_exit);
1193
1194 module_param(ignore_dga, bool, 0644);
1195 MODULE_PARM_DESC(ignore_dga, "Ignore devices with id 08fd:0001");
1196
1197 module_param(ignore_csr, bool, 0644);
1198 MODULE_PARM_DESC(ignore_csr, "Ignore devices with id 0a12:0001");
1199
1200 module_param(ignore_sniffer, bool, 0644);
1201 MODULE_PARM_DESC(ignore_sniffer, "Ignore devices with id 0a12:0002");
1202
1203 module_param(disable_scofix, bool, 0644);
1204 MODULE_PARM_DESC(disable_scofix, "Disable fixup of wrong SCO buffer size");
1205
1206 module_param(force_scofix, bool, 0644);
1207 MODULE_PARM_DESC(force_scofix, "Force fixup of wrong SCO buffers size");
1208
1209 module_param(reset, bool, 0644);
1210 MODULE_PARM_DESC(reset, "Send HCI reset command on initialization");
1211
1212 MODULE_AUTHOR("Marcel Holtmann <marcel@holtmann.org>");
1213 MODULE_DESCRIPTION("Generic Bluetooth USB driver ver " VERSION);
1214 MODULE_VERSION(VERSION);
1215 MODULE_LICENSE("GPL");