projects / GitHub / mt8127 / android_kernel_alcatel_ttab.git / blame
? search:
summary | shortlog | log | commit | commitdiff | tree
blob | blame (incremental) | history | HEAD
Fix memory corruption caused by nfsd readdir+
[GitHub/mt8127/android_kernel_alcatel_ttab.git] / drivers / bluetooth / btusb.c
CommitLineData
5e23b923
MH		 1/*
2 *
3 * Generic Bluetooth USB driver
4 *
9bfa35fe 5 * Copyright (C) 2005-2008 Marcel Holtmann <marcel@holtmann.org>
5e23b923
MH		 6 *
7 *
8 * This program is free software; you can redistribute it and/or modify
9 * it under the terms of the GNU General Public License as published by
10 * the Free Software Foundation; either version 2 of the License, or
11 * (at your option) any later version.
12 *
13 * This program is distributed in the hope that it will be useful,
14 * but WITHOUT ANY WARRANTY; without even the implied warranty of
15 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
16 * GNU General Public License for more details.
17 *
18 * You should have received a copy of the GNU General Public License
19 * along with this program; if not, write to the Free Software
20 * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
21 *
22 */
23
24#include <linux/kernel.h>
25#include <linux/module.h>
26#include <linux/init.h>
27#include <linux/slab.h>
28#include <linux/types.h>
29#include <linux/sched.h>
30#include <linux/errno.h>
31#include <linux/skbuff.h>
32
33#include <linux/usb.h>
34
35#include <net/bluetooth/bluetooth.h>
36#include <net/bluetooth/hci_core.h>
37
7bee549e 38#define VERSION "0.6"
cfeb4145
MH		 39
40static int ignore_dga;
41static int ignore_csr;
42static int ignore_sniffer;
43static int disable_scofix;
44static int force_scofix;
7a9d4020
MH		 45
46static int reset = 1;
cfeb4145
MH		 47
48static struct usb_driver btusb_driver;
49
50#define BTUSB_IGNORE 0x01
7a9d4020
MH		 51#define BTUSB_DIGIANSWER 0x02
52#define BTUSB_CSR 0x04
53#define BTUSB_SNIFFER 0x08
54#define BTUSB_BCM92035 0x10
55#define BTUSB_BROKEN_ISOC 0x20
56#define BTUSB_WRONG_SCO_MTU 0x40
5e23b923
MH		 57
58static struct usb_device_id btusb_table[] = {
59 /* Generic Bluetooth USB device */
60 { USB_DEVICE_INFO(0xe0, 0x01, 0x01) },
61
cfeb4145
MH		 62 /* AVM BlueFRITZ! USB v2.0 */
63 { USB_DEVICE(0x057c, 0x3800) },
64
65 /* Bluetooth Ultraport Module from IBM */
66 { USB_DEVICE(0x04bf, 0x030a) },
67
68 /* ALPS Modules with non-standard id */
69 { USB_DEVICE(0x044e, 0x3001) },
70 { USB_DEVICE(0x044e, 0x3002) },
71
72 /* Ericsson with non-standard id */
73 { USB_DEVICE(0x0bdb, 0x1002) },
74
75 /* Canyon CN-BTU1 with HID interfaces */
7a9d4020 76 { USB_DEVICE(0x0c10, 0x0000) },
cfeb4145 77
5e23b923
MH		 78 { } /* Terminating entry */
79};
80
81MODULE_DEVICE_TABLE(usb, btusb_table);
82
83static struct usb_device_id blacklist_table[] = {
cfeb4145
MH		 84 /* CSR BlueCore devices */
85 { USB_DEVICE(0x0a12, 0x0001), .driver_info = BTUSB_CSR },
86
87 /* Broadcom BCM2033 without firmware */
88 { USB_DEVICE(0x0a5c, 0x2033), .driver_info = BTUSB_IGNORE },
89
90 /* Broadcom BCM2035 */
7a9d4020
MH		 91 { USB_DEVICE(0x0a5c, 0x2035), .driver_info = BTUSB_WRONG_SCO_MTU },
92 { USB_DEVICE(0x0a5c, 0x200a), .driver_info = BTUSB_WRONG_SCO_MTU },
93 { USB_DEVICE(0x0a5c, 0x2009), .driver_info = BTUSB_BCM92035 },
cfeb4145
MH		 94
95 /* Broadcom BCM2045 */
7a9d4020
MH		 96 { USB_DEVICE(0x0a5c, 0x2039), .driver_info = BTUSB_WRONG_SCO_MTU },
97 { USB_DEVICE(0x0a5c, 0x2101), .driver_info = BTUSB_WRONG_SCO_MTU },
bdbef3d6 98
cfeb4145 99 /* IBM/Lenovo ThinkPad with Broadcom chip */
7a9d4020
MH		 100 { USB_DEVICE(0x0a5c, 0x201e), .driver_info = BTUSB_WRONG_SCO_MTU },
101 { USB_DEVICE(0x0a5c, 0x2110), .driver_info = BTUSB_WRONG_SCO_MTU },
cfeb4145
MH		 102
103 /* HP laptop with Broadcom chip */
7a9d4020 104 { USB_DEVICE(0x03f0, 0x171d), .driver_info = BTUSB_WRONG_SCO_MTU },
cfeb4145
MH		 105
106 /* Dell laptop with Broadcom chip */
7a9d4020 107 { USB_DEVICE(0x413c, 0x8126), .driver_info = BTUSB_WRONG_SCO_MTU },
cfeb4145 108
5ddd4a60 109 /* Dell Wireless 370 and 410 devices */
7a9d4020 110 { USB_DEVICE(0x413c, 0x8152), .driver_info = BTUSB_WRONG_SCO_MTU },
5ddd4a60 111 { USB_DEVICE(0x413c, 0x8156), .driver_info = BTUSB_WRONG_SCO_MTU },
cfeb4145 112
7a9d4020
MH		 113 /* Belkin F8T012 and F8T013 devices */
114 { USB_DEVICE(0x050d, 0x0012), .driver_info = BTUSB_WRONG_SCO_MTU },
115 { USB_DEVICE(0x050d, 0x0013), .driver_info = BTUSB_WRONG_SCO_MTU },
cfeb4145 116
5ddd4a60
MH		 117 /* Asus WL-BTD202 device */
118 { USB_DEVICE(0x0b05, 0x1715), .driver_info = BTUSB_WRONG_SCO_MTU },
119
120 /* Kensington Bluetooth USB adapter */
121 { USB_DEVICE(0x047d, 0x105e), .driver_info = BTUSB_WRONG_SCO_MTU },
122
cfeb4145
MH		 123 /* RTX Telecom based adapters with buggy SCO support */
124 { USB_DEVICE(0x0400, 0x0807), .driver_info = BTUSB_BROKEN_ISOC },
125 { USB_DEVICE(0x0400, 0x080a), .driver_info = BTUSB_BROKEN_ISOC },
126
127 /* CONWISE Technology based adapters with buggy SCO support */
128 { USB_DEVICE(0x0e5e, 0x6622), .driver_info = BTUSB_BROKEN_ISOC },
129
cfeb4145
MH		 130 /* Digianswer devices */
131 { USB_DEVICE(0x08fd, 0x0001), .driver_info = BTUSB_DIGIANSWER },
132 { USB_DEVICE(0x08fd, 0x0002), .driver_info = BTUSB_IGNORE },
133
134 /* CSR BlueCore Bluetooth Sniffer */
135 { USB_DEVICE(0x0a12, 0x0002), .driver_info = BTUSB_SNIFFER },
136
137 /* Frontline ComProbe Bluetooth Sniffer */
138 { USB_DEVICE(0x16d3, 0x0002), .driver_info = BTUSB_SNIFFER },
139
5e23b923
MH		 140 { } /* Terminating entry */
141};
142
9bfa35fe
MH		 143#define BTUSB_MAX_ISOC_FRAMES 10
144
5e23b923
MH		 145#define BTUSB_INTR_RUNNING 0
146#define BTUSB_BULK_RUNNING 1
9bfa35fe 147#define BTUSB_ISOC_RUNNING 2
7bee549e 148#define BTUSB_SUSPENDING 3
5e23b923
MH		 149
150struct btusb_data {
151 struct hci_dev *hdev;
152 struct usb_device *udev;
5fbcd260 153 struct usb_interface *intf;
9bfa35fe 154 struct usb_interface *isoc;
5e23b923
MH		 155
156 spinlock_t lock;
157
158 unsigned long flags;
159
160 struct work_struct work;
7bee549e 161 struct work_struct waker;
5e23b923
MH		 162
163 struct usb_anchor tx_anchor;
164 struct usb_anchor intr_anchor;
165 struct usb_anchor bulk_anchor;
9bfa35fe 166 struct usb_anchor isoc_anchor;
7bee549e
ON		 167 struct usb_anchor deferred;
168 int tx_in_flight;
169 spinlock_t txlock;
5e23b923
MH		 170
171 struct usb_endpoint_descriptor *intr_ep;
172 struct usb_endpoint_descriptor *bulk_tx_ep;
173 struct usb_endpoint_descriptor *bulk_rx_ep;
9bfa35fe
MH		 174 struct usb_endpoint_descriptor *isoc_tx_ep;
175 struct usb_endpoint_descriptor *isoc_rx_ep;
176
7a9d4020
MH		 177 __u8 cmdreq_type;
178
43c2e57f 179 unsigned int sco_num;
9bfa35fe 180 int isoc_altsetting;
6a88adf2 181 int suspend_count;
7bee549e 182 int did_iso_resume:1;
5e23b923
MH		 183};
184
7bee549e
ON		 185static int inc_tx(struct btusb_data *data)
186{
187 unsigned long flags;
188 int rv;
189
190 spin_lock_irqsave(&data->txlock, flags);
191 rv = test_bit(BTUSB_SUSPENDING, &data->flags);
192 if (!rv)
193 data->tx_in_flight++;
194 spin_unlock_irqrestore(&data->txlock, flags);
195
196 return rv;
197}
198
5e23b923
MH		 199static void btusb_intr_complete(struct urb *urb)
200{
201 struct hci_dev *hdev = urb->context;
202 struct btusb_data *data = hdev->driver_data;
203 int err;
204
205 BT_DBG("%s urb %p status %d count %d", hdev->name,
206 urb, urb->status, urb->actual_length);
207
208 if (!test_bit(HCI_RUNNING, &hdev->flags))
209 return;
210
211 if (urb->status == 0) {
9bfa35fe
MH		 212 hdev->stat.byte_rx += urb->actual_length;
213
5e23b923
MH		 214 if (hci_recv_fragment(hdev, HCI_EVENT_PKT,
215 urb->transfer_buffer,
216 urb->actual_length) < 0) {
217 BT_ERR("%s corrupted event packet", hdev->name);
218 hdev->stat.err_rx++;
219 }
220 }
221
222 if (!test_bit(BTUSB_INTR_RUNNING, &data->flags))
223 return;
224
7bee549e 225 usb_mark_last_busy(data->udev);
5e23b923
MH		 226 usb_anchor_urb(urb, &data->intr_anchor);
227
228 err = usb_submit_urb(urb, GFP_ATOMIC);
229 if (err < 0) {
230 BT_ERR("%s urb %p failed to resubmit (%d)",
231 hdev->name, urb, -err);
232 usb_unanchor_urb(urb);
233 }
234}
235
2eda66f4 236static int btusb_submit_intr_urb(struct hci_dev *hdev, gfp_t mem_flags)
5e23b923
MH		 237{
238 struct btusb_data *data = hdev->driver_data;
239 struct urb *urb;
240 unsigned char *buf;
241 unsigned int pipe;
242 int err, size;
243
244 BT_DBG("%s", hdev->name);
245
9bfa35fe
MH		 246 if (!data->intr_ep)
247 return -ENODEV;
248
2eda66f4 249 urb = usb_alloc_urb(0, mem_flags);
5e23b923
MH		 250 if (!urb)
251 return -ENOMEM;
252
253 size = le16_to_cpu(data->intr_ep->wMaxPacketSize);
254
2eda66f4 255 buf = kmalloc(size, mem_flags);
5e23b923
MH		 256 if (!buf) {
257 usb_free_urb(urb);
258 return -ENOMEM;
259 }
260
261 pipe = usb_rcvintpipe(data->udev, data->intr_ep->bEndpointAddress);
262
263 usb_fill_int_urb(urb, data->udev, pipe, buf, size,
264 btusb_intr_complete, hdev,
265 data->intr_ep->bInterval);
266
267 urb->transfer_flags |= URB_FREE_BUFFER;
268
269 usb_anchor_urb(urb, &data->intr_anchor);
270
2eda66f4 271 err = usb_submit_urb(urb, mem_flags);
5e23b923
MH		 272 if (err < 0) {
273 BT_ERR("%s urb %p submission failed (%d)",
274 hdev->name, urb, -err);
275 usb_unanchor_urb(urb);
5e23b923
MH		 276 }
277
278 usb_free_urb(urb);
279
280 return err;
281}
282
283static void btusb_bulk_complete(struct urb *urb)
284{
285 struct hci_dev *hdev = urb->context;
286 struct btusb_data *data = hdev->driver_data;
287 int err;
288
289 BT_DBG("%s urb %p status %d count %d", hdev->name,
290 urb, urb->status, urb->actual_length);
291
292 if (!test_bit(HCI_RUNNING, &hdev->flags))
293 return;
294
295 if (urb->status == 0) {
9bfa35fe
MH		 296 hdev->stat.byte_rx += urb->actual_length;
297
5e23b923
MH		 298 if (hci_recv_fragment(hdev, HCI_ACLDATA_PKT,
299 urb->transfer_buffer,
300 urb->actual_length) < 0) {
301 BT_ERR("%s corrupted ACL packet", hdev->name);
302 hdev->stat.err_rx++;
303 }
304 }
305
306 if (!test_bit(BTUSB_BULK_RUNNING, &data->flags))
307 return;
308
309 usb_anchor_urb(urb, &data->bulk_anchor);
310
311 err = usb_submit_urb(urb, GFP_ATOMIC);
312 if (err < 0) {
313 BT_ERR("%s urb %p failed to resubmit (%d)",
314 hdev->name, urb, -err);
315 usb_unanchor_urb(urb);
316 }
317}
318
2eda66f4 319static int btusb_submit_bulk_urb(struct hci_dev *hdev, gfp_t mem_flags)
5e23b923
MH		 320{
321 struct btusb_data *data = hdev->driver_data;
322 struct urb *urb;
323 unsigned char *buf;
324 unsigned int pipe;
290ba200 325 int err, size = HCI_MAX_FRAME_SIZE;
5e23b923
MH		 326
327 BT_DBG("%s", hdev->name);
328
9bfa35fe
MH		 329 if (!data->bulk_rx_ep)
330 return -ENODEV;
331
2eda66f4 332 urb = usb_alloc_urb(0, mem_flags);
5e23b923
MH		 333 if (!urb)
334 return -ENOMEM;
335
2eda66f4 336 buf = kmalloc(size, mem_flags);
5e23b923
MH		 337 if (!buf) {
338 usb_free_urb(urb);
339 return -ENOMEM;
340 }
341
342 pipe = usb_rcvbulkpipe(data->udev, data->bulk_rx_ep->bEndpointAddress);
343
344 usb_fill_bulk_urb(urb, data->udev, pipe,
345 buf, size, btusb_bulk_complete, hdev);
346
347 urb->transfer_flags |= URB_FREE_BUFFER;
348
7bee549e 349 usb_mark_last_busy(data->udev);
5e23b923
MH		 350 usb_anchor_urb(urb, &data->bulk_anchor);
351
2eda66f4 352 err = usb_submit_urb(urb, mem_flags);
5e23b923
MH		 353 if (err < 0) {
354 BT_ERR("%s urb %p submission failed (%d)",
355 hdev->name, urb, -err);
356 usb_unanchor_urb(urb);
5e23b923
MH		 357 }
358
359 usb_free_urb(urb);
360
361 return err;
362}
363
9bfa35fe
MH		 364static void btusb_isoc_complete(struct urb *urb)
365{
366 struct hci_dev *hdev = urb->context;
367 struct btusb_data *data = hdev->driver_data;
368 int i, err;
369
370 BT_DBG("%s urb %p status %d count %d", hdev->name,
371 urb, urb->status, urb->actual_length);
372
373 if (!test_bit(HCI_RUNNING, &hdev->flags))
374 return;
375
376 if (urb->status == 0) {
377 for (i = 0; i < urb->number_of_packets; i++) {
378 unsigned int offset = urb->iso_frame_desc[i].offset;
379 unsigned int length = urb->iso_frame_desc[i].actual_length;
380
381 if (urb->iso_frame_desc[i].status)
382 continue;
383
384 hdev->stat.byte_rx += length;
385
386 if (hci_recv_fragment(hdev, HCI_SCODATA_PKT,
387 urb->transfer_buffer + offset,
388 length) < 0) {
389 BT_ERR("%s corrupted SCO packet", hdev->name);
390 hdev->stat.err_rx++;
391 }
392 }
393 }
394
395 if (!test_bit(BTUSB_ISOC_RUNNING, &data->flags))
396 return;
397
398 usb_anchor_urb(urb, &data->isoc_anchor);
399
400 err = usb_submit_urb(urb, GFP_ATOMIC);
401 if (err < 0) {
402 BT_ERR("%s urb %p failed to resubmit (%d)",
403 hdev->name, urb, -err);
404 usb_unanchor_urb(urb);
405 }
406}
407
408static void inline __fill_isoc_descriptor(struct urb *urb, int len, int mtu)
409{
410 int i, offset = 0;
411
412 BT_DBG("len %d mtu %d", len, mtu);
413
414 for (i = 0; i < BTUSB_MAX_ISOC_FRAMES && len >= mtu;
415 i++, offset += mtu, len -= mtu) {
416 urb->iso_frame_desc[i].offset = offset;
417 urb->iso_frame_desc[i].length = mtu;
418 }
419
420 if (len && i < BTUSB_MAX_ISOC_FRAMES) {
421 urb->iso_frame_desc[i].offset = offset;
422 urb->iso_frame_desc[i].length = len;
423 i++;
424 }
425
426 urb->number_of_packets = i;
427}
428
2eda66f4 429static int btusb_submit_isoc_urb(struct hci_dev *hdev, gfp_t mem_flags)
9bfa35fe
MH		 430{
431 struct btusb_data *data = hdev->driver_data;
432 struct urb *urb;
433 unsigned char *buf;
434 unsigned int pipe;
435 int err, size;
436
437 BT_DBG("%s", hdev->name);
438
439 if (!data->isoc_rx_ep)
440 return -ENODEV;
441
2eda66f4 442 urb = usb_alloc_urb(BTUSB_MAX_ISOC_FRAMES, mem_flags);
9bfa35fe
MH		 443 if (!urb)
444 return -ENOMEM;
445
446 size = le16_to_cpu(data->isoc_rx_ep->wMaxPacketSize) *
447 BTUSB_MAX_ISOC_FRAMES;
448
2eda66f4 449 buf = kmalloc(size, mem_flags);
9bfa35fe
MH		 450 if (!buf) {
451 usb_free_urb(urb);
452 return -ENOMEM;
453 }
454
455 pipe = usb_rcvisocpipe(data->udev, data->isoc_rx_ep->bEndpointAddress);
456
457 urb->dev = data->udev;
458 urb->pipe = pipe;
459 urb->context = hdev;
460 urb->complete = btusb_isoc_complete;
461 urb->interval = data->isoc_rx_ep->bInterval;
462
463 urb->transfer_flags = URB_FREE_BUFFER | URB_ISO_ASAP;
464 urb->transfer_buffer = buf;
465 urb->transfer_buffer_length = size;
466
467 __fill_isoc_descriptor(urb, size,
468 le16_to_cpu(data->isoc_rx_ep->wMaxPacketSize));
469
470 usb_anchor_urb(urb, &data->isoc_anchor);
471
2eda66f4 472 err = usb_submit_urb(urb, mem_flags);
9bfa35fe
MH		 473 if (err < 0) {
474 BT_ERR("%s urb %p submission failed (%d)",
475 hdev->name, urb, -err);
476 usb_unanchor_urb(urb);
9bfa35fe
MH		 477 }
478
479 usb_free_urb(urb);
480
481 return err;
482}
483
5e23b923 484static void btusb_tx_complete(struct urb *urb)
7bee549e
ON		 485{
486 struct sk_buff *skb = urb->context;
487 struct hci_dev *hdev = (struct hci_dev *) skb->dev;
488 struct btusb_data *data = hdev->driver_data;
489
490 BT_DBG("%s urb %p status %d count %d", hdev->name,
491 urb, urb->status, urb->actual_length);
492
493 if (!test_bit(HCI_RUNNING, &hdev->flags))
494 goto done;
495
496 if (!urb->status)
497 hdev->stat.byte_tx += urb->transfer_buffer_length;
498 else
499 hdev->stat.err_tx++;
500
501done:
502 spin_lock(&data->txlock);
503 data->tx_in_flight--;
504 spin_unlock(&data->txlock);
505
506 kfree(urb->setup_packet);
507
508 kfree_skb(skb);
509}
510
511static void btusb_isoc_tx_complete(struct urb *urb)
5e23b923
MH		 512{
513 struct sk_buff *skb = urb->context;
514 struct hci_dev *hdev = (struct hci_dev *) skb->dev;
515
516 BT_DBG("%s urb %p status %d count %d", hdev->name,
517 urb, urb->status, urb->actual_length);
518
519 if (!test_bit(HCI_RUNNING, &hdev->flags))
520 goto done;
521
522 if (!urb->status)
523 hdev->stat.byte_tx += urb->transfer_buffer_length;
524 else
525 hdev->stat.err_tx++;
526
527done:
528 kfree(urb->setup_packet);
529
530 kfree_skb(skb);
531}
532
533static int btusb_open(struct hci_dev *hdev)
534{
535 struct btusb_data *data = hdev->driver_data;
536 int err;
537
538 BT_DBG("%s", hdev->name);
539
7bee549e
ON		 540 err = usb_autopm_get_interface(data->intf);
541 if (err < 0)
542 return err;
543
544 data->intf->needs_remote_wakeup = 1;
545
5e23b923 546 if (test_and_set_bit(HCI_RUNNING, &hdev->flags))
7bee549e 547 goto done;
5e23b923
MH		 548
549 if (test_and_set_bit(BTUSB_INTR_RUNNING, &data->flags))
7bee549e 550 goto done;
5e23b923 551
2eda66f4 552 err = btusb_submit_intr_urb(hdev, GFP_KERNEL);
43c2e57f
MH		 553 if (err < 0)
554 goto failed;
555
556 err = btusb_submit_bulk_urb(hdev, GFP_KERNEL);
5e23b923 557 if (err < 0) {
43c2e57f
MH		 558 usb_kill_anchored_urbs(&data->intr_anchor);
559 goto failed;
5e23b923
MH		 560 }
561
43c2e57f
MH		 562 set_bit(BTUSB_BULK_RUNNING, &data->flags);
563 btusb_submit_bulk_urb(hdev, GFP_KERNEL);
564
7bee549e
ON		 565done:
566 usb_autopm_put_interface(data->intf);
43c2e57f
MH		 567 return 0;
568
569failed:
570 clear_bit(BTUSB_INTR_RUNNING, &data->flags);
571 clear_bit(HCI_RUNNING, &hdev->flags);
7bee549e 572 usb_autopm_put_interface(data->intf);
5e23b923
MH		 573 return err;
574}
575
7bee549e
ON		 576static void btusb_stop_traffic(struct btusb_data *data)
577{
578 usb_kill_anchored_urbs(&data->intr_anchor);
579 usb_kill_anchored_urbs(&data->bulk_anchor);
580 usb_kill_anchored_urbs(&data->isoc_anchor);
581}
582
5e23b923
MH		 583static int btusb_close(struct hci_dev *hdev)
584{
585 struct btusb_data *data = hdev->driver_data;
7bee549e 586 int err;
5e23b923
MH		 587
588 BT_DBG("%s", hdev->name);
589
590 if (!test_and_clear_bit(HCI_RUNNING, &hdev->flags))
591 return 0;
592
e8c3c3d2 593 cancel_work_sync(&data->work);
404291ac 594 cancel_work_sync(&data->waker);
e8c3c3d2 595
9bfa35fe 596 clear_bit(BTUSB_ISOC_RUNNING, &data->flags);
5e23b923 597 clear_bit(BTUSB_BULK_RUNNING, &data->flags);
5e23b923 598 clear_bit(BTUSB_INTR_RUNNING, &data->flags);
7bee549e
ON		 599
600 btusb_stop_traffic(data);
601 err = usb_autopm_get_interface(data->intf);
602 if (err < 0)
603 return 0;
604
605 data->intf->needs_remote_wakeup = 0;
606 usb_autopm_put_interface(data->intf);
5e23b923
MH		 607
608 return 0;
609}
610
611static int btusb_flush(struct hci_dev *hdev)
612{
613 struct btusb_data *data = hdev->driver_data;
614
615 BT_DBG("%s", hdev->name);
616
617 usb_kill_anchored_urbs(&data->tx_anchor);
618
619 return 0;
620}
621
622static int btusb_send_frame(struct sk_buff *skb)
623{
624 struct hci_dev *hdev = (struct hci_dev *) skb->dev;
625 struct btusb_data *data = hdev->driver_data;
626 struct usb_ctrlrequest *dr;
627 struct urb *urb;
628 unsigned int pipe;
629 int err;
630
631 BT_DBG("%s", hdev->name);
632
633 if (!test_bit(HCI_RUNNING, &hdev->flags))
634 return -EBUSY;
635
636 switch (bt_cb(skb)->pkt_type) {
637 case HCI_COMMAND_PKT:
638 urb = usb_alloc_urb(0, GFP_ATOMIC);
639 if (!urb)
640 return -ENOMEM;
641
642 dr = kmalloc(sizeof(*dr), GFP_ATOMIC);
643 if (!dr) {
644 usb_free_urb(urb);
645 return -ENOMEM;
646 }
647
7a9d4020 648 dr->bRequestType = data->cmdreq_type;
5e23b923
MH		 649 dr->bRequest = 0;
650 dr->wIndex = 0;
651 dr->wValue = 0;
652 dr->wLength = __cpu_to_le16(skb->len);
653
654 pipe = usb_sndctrlpipe(data->udev, 0x00);
655
656 usb_fill_control_urb(urb, data->udev, pipe, (void *) dr,
657 skb->data, skb->len, btusb_tx_complete, skb);
658
659 hdev->stat.cmd_tx++;
660 break;
661
662 case HCI_ACLDATA_PKT:
9bfa35fe
MH		 663 if (!data->bulk_tx_ep || hdev->conn_hash.acl_num < 1)
664 return -ENODEV;
665
5e23b923
MH		 666 urb = usb_alloc_urb(0, GFP_ATOMIC);
667 if (!urb)
668 return -ENOMEM;
669
670 pipe = usb_sndbulkpipe(data->udev,
671 data->bulk_tx_ep->bEndpointAddress);
672
673 usb_fill_bulk_urb(urb, data->udev, pipe,
674 skb->data, skb->len, btusb_tx_complete, skb);
675
676 hdev->stat.acl_tx++;
677 break;
678
679 case HCI_SCODATA_PKT:
9bfa35fe
MH		 680 if (!data->isoc_tx_ep || hdev->conn_hash.sco_num < 1)
681 return -ENODEV;
682
683 urb = usb_alloc_urb(BTUSB_MAX_ISOC_FRAMES, GFP_ATOMIC);
684 if (!urb)
685 return -ENOMEM;
686
687 pipe = usb_sndisocpipe(data->udev,
688 data->isoc_tx_ep->bEndpointAddress);
689
690 urb->dev = data->udev;
691 urb->pipe = pipe;
692 urb->context = skb;
7bee549e 693 urb->complete = btusb_isoc_tx_complete;
9bfa35fe
MH		 694 urb->interval = data->isoc_tx_ep->bInterval;
695
696 urb->transfer_flags = URB_ISO_ASAP;
697 urb->transfer_buffer = skb->data;
698 urb->transfer_buffer_length = skb->len;
699
700 __fill_isoc_descriptor(urb, skb->len,
701 le16_to_cpu(data->isoc_tx_ep->wMaxPacketSize));
702
5e23b923 703 hdev->stat.sco_tx++;
7bee549e 704 goto skip_waking;
5e23b923
MH		 705
706 default:
707 return -EILSEQ;
708 }
709
7bee549e
ON		 710 err = inc_tx(data);
711 if (err) {
712 usb_anchor_urb(urb, &data->deferred);
713 schedule_work(&data->waker);
714 err = 0;
715 goto done;
716 }
717
718skip_waking:
5e23b923
MH		 719 usb_anchor_urb(urb, &data->tx_anchor);
720
721 err = usb_submit_urb(urb, GFP_ATOMIC);
722 if (err < 0) {
723 BT_ERR("%s urb %p submission failed", hdev->name, urb);
724 kfree(urb->setup_packet);
725 usb_unanchor_urb(urb);
7bee549e
ON		 726 } else {
727 usb_mark_last_busy(data->udev);
5e23b923
MH		 728 }
729
730 usb_free_urb(urb);
731
7bee549e 732done:
5e23b923
MH		 733 return err;
734}
735
736static void btusb_destruct(struct hci_dev *hdev)
737{
738 struct btusb_data *data = hdev->driver_data;
739
740 BT_DBG("%s", hdev->name);
741
742 kfree(data);
743}
744
745static void btusb_notify(struct hci_dev *hdev, unsigned int evt)
746{
747 struct btusb_data *data = hdev->driver_data;
748
749 BT_DBG("%s evt %d", hdev->name, evt);
750
43c2e57f
MH		 751 if (hdev->conn_hash.sco_num != data->sco_num) {
752 data->sco_num = hdev->conn_hash.sco_num;
753 schedule_work(&data->work);
a780efa8 754 }
5e23b923
MH		 755}
756
9bfa35fe
MH		 757static int inline __set_isoc_interface(struct hci_dev *hdev, int altsetting)
758{
759 struct btusb_data *data = hdev->driver_data;
760 struct usb_interface *intf = data->isoc;
761 struct usb_endpoint_descriptor *ep_desc;
762 int i, err;
763
764 if (!data->isoc)
765 return -ENODEV;
766
767 err = usb_set_interface(data->udev, 1, altsetting);
768 if (err < 0) {
769 BT_ERR("%s setting interface failed (%d)", hdev->name, -err);
770 return err;
771 }
772
773 data->isoc_altsetting = altsetting;
774
775 data->isoc_tx_ep = NULL;
776 data->isoc_rx_ep = NULL;
777
778 for (i = 0; i < intf->cur_altsetting->desc.bNumEndpoints; i++) {
779 ep_desc = &intf->cur_altsetting->endpoint[i].desc;
780
781 if (!data->isoc_tx_ep && usb_endpoint_is_isoc_out(ep_desc)) {
782 data->isoc_tx_ep = ep_desc;
783 continue;
784 }
785
786 if (!data->isoc_rx_ep && usb_endpoint_is_isoc_in(ep_desc)) {
787 data->isoc_rx_ep = ep_desc;
788 continue;
789 }
790 }
791
792 if (!data->isoc_tx_ep || !data->isoc_rx_ep) {
793 BT_ERR("%s invalid SCO descriptors", hdev->name);
794 return -ENODEV;
795 }
796
797 return 0;
798}
799
5e23b923
MH		 800static void btusb_work(struct work_struct *work)
801{
802 struct btusb_data *data = container_of(work, struct btusb_data, work);
803 struct hci_dev *hdev = data->hdev;
7bee549e 804 int err;
5e23b923 805
9bfa35fe 806 if (hdev->conn_hash.sco_num > 0) {
7bee549e
ON		 807 if (!data->did_iso_resume) {
808 err = usb_autopm_get_interface(data->isoc);
809 if (err < 0) {
810 clear_bit(BTUSB_ISOC_RUNNING, &data->flags);
811 usb_kill_anchored_urbs(&data->isoc_anchor);
812 return;
813 }
814
815 data->did_iso_resume = 1;
816 }
9bfa35fe
MH		 817 if (data->isoc_altsetting != 2) {
818 clear_bit(BTUSB_ISOC_RUNNING, &data->flags);
819 usb_kill_anchored_urbs(&data->isoc_anchor);
820
821 if (__set_isoc_interface(hdev, 2) < 0)
822 return;
823 }
824
825 if (!test_and_set_bit(BTUSB_ISOC_RUNNING, &data->flags)) {
2eda66f4 826 if (btusb_submit_isoc_urb(hdev, GFP_KERNEL) < 0)
9bfa35fe
MH		 827 clear_bit(BTUSB_ISOC_RUNNING, &data->flags);
828 else
2eda66f4 829 btusb_submit_isoc_urb(hdev, GFP_KERNEL);
9bfa35fe
MH		 830 }
831 } else {
832 clear_bit(BTUSB_ISOC_RUNNING, &data->flags);
833 usb_kill_anchored_urbs(&data->isoc_anchor);
834
835 __set_isoc_interface(hdev, 0);
7bee549e
ON		 836 if (data->did_iso_resume) {
837 data->did_iso_resume = 0;
838 usb_autopm_put_interface(data->isoc);
839 }
5e23b923
MH		 840 }
841}
842
7bee549e
ON		 843static void btusb_waker(struct work_struct *work)
844{
845 struct btusb_data *data = container_of(work, struct btusb_data, waker);
846 int err;
847
848 err = usb_autopm_get_interface(data->intf);
849 if (err < 0)
850 return;
851
852 usb_autopm_put_interface(data->intf);
853}
854
5e23b923
MH		 855static int btusb_probe(struct usb_interface *intf,
856 const struct usb_device_id *id)
857{
858 struct usb_endpoint_descriptor *ep_desc;
859 struct btusb_data *data;
860 struct hci_dev *hdev;
861 int i, err;
862
863 BT_DBG("intf %p id %p", intf, id);
864
cfeb4145 865 /* interface numbers are hardcoded in the spec */
5e23b923
MH		 866 if (intf->cur_altsetting->desc.bInterfaceNumber != 0)
867 return -ENODEV;
868
869 if (!id->driver_info) {
870 const struct usb_device_id *match;
871 match = usb_match_id(intf, blacklist_table);
872 if (match)
873 id = match;
874 }
875
cfeb4145
MH		 876 if (id->driver_info == BTUSB_IGNORE)
877 return -ENODEV;
878
879 if (ignore_dga && id->driver_info & BTUSB_DIGIANSWER)
880 return -ENODEV;
881
882 if (ignore_csr && id->driver_info & BTUSB_CSR)
883 return -ENODEV;
884
885 if (ignore_sniffer && id->driver_info & BTUSB_SNIFFER)
886 return -ENODEV;
887
5e23b923
MH		 888 data = kzalloc(sizeof(*data), GFP_KERNEL);
889 if (!data)
890 return -ENOMEM;
891
892 for (i = 0; i < intf->cur_altsetting->desc.bNumEndpoints; i++) {
893 ep_desc = &intf->cur_altsetting->endpoint[i].desc;
894
895 if (!data->intr_ep && usb_endpoint_is_int_in(ep_desc)) {
896 data->intr_ep = ep_desc;
897 continue;
898 }
899
900 if (!data->bulk_tx_ep && usb_endpoint_is_bulk_out(ep_desc)) {
901 data->bulk_tx_ep = ep_desc;
902 continue;
903 }
904
905 if (!data->bulk_rx_ep && usb_endpoint_is_bulk_in(ep_desc)) {
906 data->bulk_rx_ep = ep_desc;
907 continue;
908 }
909 }
910
911 if (!data->intr_ep || !data->bulk_tx_ep || !data->bulk_rx_ep) {
912 kfree(data);
913 return -ENODEV;
914 }
915
7a9d4020
MH		 916 data->cmdreq_type = USB_TYPE_CLASS;
917
5e23b923 918 data->udev = interface_to_usbdev(intf);
5fbcd260 919 data->intf = intf;
5e23b923
MH		 920
921 spin_lock_init(&data->lock);
922
923 INIT_WORK(&data->work, btusb_work);
7bee549e
ON		 924 INIT_WORK(&data->waker, btusb_waker);
925 spin_lock_init(&data->txlock);
5e23b923
MH		 926
927 init_usb_anchor(&data->tx_anchor);
928 init_usb_anchor(&data->intr_anchor);
929 init_usb_anchor(&data->bulk_anchor);
9bfa35fe 930 init_usb_anchor(&data->isoc_anchor);
7bee549e 931 init_usb_anchor(&data->deferred);
5e23b923
MH		 932
933 hdev = hci_alloc_dev();
934 if (!hdev) {
935 kfree(data);
936 return -ENOMEM;
937 }
938
939 hdev->type = HCI_USB;
940 hdev->driver_data = data;
941
942 data->hdev = hdev;
943
944 SET_HCIDEV_DEV(hdev, &intf->dev);
945
946 hdev->open = btusb_open;
947 hdev->close = btusb_close;
948 hdev->flush = btusb_flush;
949 hdev->send = btusb_send_frame;
950 hdev->destruct = btusb_destruct;
951 hdev->notify = btusb_notify;
952
953 hdev->owner = THIS_MODULE;
954
7a9d4020 955 /* Interface numbers are hardcoded in the specification */
9bfa35fe
MH		 956 data->isoc = usb_ifnum_to_if(data->udev, 1);
957
7a9d4020
MH		 958 if (!reset)
959 set_bit(HCI_QUIRK_NO_RESET, &hdev->quirks);
cfeb4145
MH		 960
961 if (force_scofix || id->driver_info & BTUSB_WRONG_SCO_MTU) {
962 if (!disable_scofix)
963 set_bit(HCI_QUIRK_FIXUP_BUFFER_SIZE, &hdev->quirks);
964 }
965
9bfa35fe
MH		 966 if (id->driver_info & BTUSB_BROKEN_ISOC)
967 data->isoc = NULL;
968
7a9d4020
MH		 969 if (id->driver_info & BTUSB_DIGIANSWER) {
970 data->cmdreq_type = USB_TYPE_VENDOR;
971 set_bit(HCI_QUIRK_NO_RESET, &hdev->quirks);
972 }
973
974 if (id->driver_info & BTUSB_CSR) {
975 struct usb_device *udev = data->udev;
976
977 /* Old firmware would otherwise execute USB reset */
978 if (le16_to_cpu(udev->descriptor.bcdDevice) < 0x117)
979 set_bit(HCI_QUIRK_NO_RESET, &hdev->quirks);
980 }
981
cfeb4145 982 if (id->driver_info & BTUSB_SNIFFER) {
9bfa35fe 983 struct usb_device *udev = data->udev;
cfeb4145 984
7a9d4020 985 /* New sniffer firmware has crippled HCI interface */
cfeb4145
MH		 986 if (le16_to_cpu(udev->descriptor.bcdDevice) > 0x997)
987 set_bit(HCI_QUIRK_RAW_DEVICE, &hdev->quirks);
9bfa35fe
MH		 988
989 data->isoc = NULL;
cfeb4145
MH		 990 }
991
992 if (id->driver_info & BTUSB_BCM92035) {
993 unsigned char cmd[] = { 0x3b, 0xfc, 0x01, 0x00 };
994 struct sk_buff *skb;
995
996 skb = bt_skb_alloc(sizeof(cmd), GFP_KERNEL);
997 if (skb) {
998 memcpy(skb_put(skb, sizeof(cmd)), cmd, sizeof(cmd));
999 skb_queue_tail(&hdev->driver_init, skb);
1000 }
1001 }
5e23b923 1002
9bfa35fe
MH		 1003 if (data->isoc) {
1004 err = usb_driver_claim_interface(&btusb_driver,
5fbcd260 1005 data->isoc, data);
9bfa35fe
MH		 1006 if (err < 0) {
1007 hci_free_dev(hdev);
1008 kfree(data);
1009 return err;
1010 }
1011 }
1012
5e23b923
MH		 1013 err = hci_register_dev(hdev);
1014 if (err < 0) {
1015 hci_free_dev(hdev);
1016 kfree(data);
1017 return err;
1018 }
1019
1020 usb_set_intfdata(intf, data);
1021
1022 return 0;
1023}
1024
1025static void btusb_disconnect(struct usb_interface *intf)
1026{
1027 struct btusb_data *data = usb_get_intfdata(intf);
1028 struct hci_dev *hdev;
1029
1030 BT_DBG("intf %p", intf);
1031
1032 if (!data)
1033 return;
1034
1035 hdev = data->hdev;
1036
5fbcd260 1037 __hci_dev_hold(hdev);
9bfa35fe 1038
5fbcd260
MH		 1039 usb_set_intfdata(data->intf, NULL);
1040
1041 if (data->isoc)
1042 usb_set_intfdata(data->isoc, NULL);
5e23b923
MH		 1043
1044 hci_unregister_dev(hdev);
1045
5fbcd260
MH		 1046 if (intf == data->isoc)
1047 usb_driver_release_interface(&btusb_driver, data->intf);
1048 else if (data->isoc)
1049 usb_driver_release_interface(&btusb_driver, data->isoc);
1050
1051 __hci_dev_put(hdev);
1052
5e23b923
MH		 1053 hci_free_dev(hdev);
1054}
1055
7bee549e 1056#ifdef CONFIG_PM
6a88adf2
MH		 1057static int btusb_suspend(struct usb_interface *intf, pm_message_t message)
1058{
1059 struct btusb_data *data = usb_get_intfdata(intf);
1060
1061 BT_DBG("intf %p", intf);
1062
1063 if (data->suspend_count++)
1064 return 0;
1065
7bee549e
ON		 1066 spin_lock_irq(&data->txlock);
1067 if (!(interface_to_usbdev(intf)->auto_pm && data->tx_in_flight)) {
1068 set_bit(BTUSB_SUSPENDING, &data->flags);
1069 spin_unlock_irq(&data->txlock);
1070 } else {
1071 spin_unlock_irq(&data->txlock);
1072 data->suspend_count--;
1073 return -EBUSY;
1074 }
1075
6a88adf2
MH		 1076 cancel_work_sync(&data->work);
1077
7bee549e 1078 btusb_stop_traffic(data);
6a88adf2
MH		 1079 usb_kill_anchored_urbs(&data->tx_anchor);
1080
6a88adf2
MH		 1081 return 0;
1082}
1083
7bee549e
ON		 1084static void play_deferred(struct btusb_data *data)
1085{
1086 struct urb *urb;
1087 int err;
1088
1089 while ((urb = usb_get_from_anchor(&data->deferred))) {
1090 err = usb_submit_urb(urb, GFP_ATOMIC);
1091 if (err < 0)
1092 break;
1093
1094 data->tx_in_flight++;
1095 }
1096 usb_scuttle_anchored_urbs(&data->deferred);
1097}
1098
6a88adf2
MH		 1099static int btusb_resume(struct usb_interface *intf)
1100{
1101 struct btusb_data *data = usb_get_intfdata(intf);
1102 struct hci_dev *hdev = data->hdev;
7bee549e 1103 int err = 0;
6a88adf2
MH		 1104
1105 BT_DBG("intf %p", intf);
1106
1107 if (--data->suspend_count)
1108 return 0;
1109
1110 if (!test_bit(HCI_RUNNING, &hdev->flags))
7bee549e 1111 goto done;
6a88adf2
MH		 1112
1113 if (test_bit(BTUSB_INTR_RUNNING, &data->flags)) {
1114 err = btusb_submit_intr_urb(hdev, GFP_NOIO);
1115 if (err < 0) {
1116 clear_bit(BTUSB_INTR_RUNNING, &data->flags);
7bee549e 1117 goto failed;
6a88adf2
MH		 1118 }
1119 }
1120
1121 if (test_bit(BTUSB_BULK_RUNNING, &data->flags)) {
43c2e57f
MH		 1122 err = btusb_submit_bulk_urb(hdev, GFP_NOIO);
1123 if (err < 0) {
6a88adf2 1124 clear_bit(BTUSB_BULK_RUNNING, &data->flags);
7bee549e
ON		 1125 goto failed;
1126 }
1127
1128 btusb_submit_bulk_urb(hdev, GFP_NOIO);
6a88adf2
MH		 1129 }
1130
1131 if (test_bit(BTUSB_ISOC_RUNNING, &data->flags)) {
1132 if (btusb_submit_isoc_urb(hdev, GFP_NOIO) < 0)
1133 clear_bit(BTUSB_ISOC_RUNNING, &data->flags);
1134 else
1135 btusb_submit_isoc_urb(hdev, GFP_NOIO);
1136 }
1137
7bee549e
ON		 1138 spin_lock_irq(&data->txlock);
1139 play_deferred(data);
1140 clear_bit(BTUSB_SUSPENDING, &data->flags);
1141 spin_unlock_irq(&data->txlock);
1142 schedule_work(&data->work);
1143
6a88adf2 1144 return 0;
7bee549e
ON		 1145
1146failed:
1147 usb_scuttle_anchored_urbs(&data->deferred);
1148done:
1149 spin_lock_irq(&data->txlock);
1150 clear_bit(BTUSB_SUSPENDING, &data->flags);
1151 spin_unlock_irq(&data->txlock);
1152
1153 return err;
6a88adf2 1154}
7bee549e 1155#endif
6a88adf2 1156
5e23b923
MH		 1157static struct usb_driver btusb_driver = {
1158 .name = "btusb",
1159 .probe = btusb_probe,
1160 .disconnect = btusb_disconnect,
7bee549e 1161#ifdef CONFIG_PM
6a88adf2
MH		 1162 .suspend = btusb_suspend,
1163 .resume = btusb_resume,
7bee549e 1164#endif
5e23b923 1165 .id_table = btusb_table,
7bee549e 1166 .supports_autosuspend = 1,
5e23b923
MH		 1167};
1168
1169static int __init btusb_init(void)
1170{
1171 BT_INFO("Generic Bluetooth USB driver ver %s", VERSION);
1172
1173 return usb_register(&btusb_driver);
1174}
1175
1176static void __exit btusb_exit(void)
1177{
1178 usb_deregister(&btusb_driver);
1179}
1180
1181module_init(btusb_init);
1182module_exit(btusb_exit);
1183
cfeb4145
MH		 1184module_param(ignore_dga, bool, 0644);
1185MODULE_PARM_DESC(ignore_dga, "Ignore devices with id 08fd:0001");
1186
1187module_param(ignore_csr, bool, 0644);
1188MODULE_PARM_DESC(ignore_csr, "Ignore devices with id 0a12:0001");
1189
1190module_param(ignore_sniffer, bool, 0644);
1191MODULE_PARM_DESC(ignore_sniffer, "Ignore devices with id 0a12:0002");
1192
1193module_param(disable_scofix, bool, 0644);
1194MODULE_PARM_DESC(disable_scofix, "Disable fixup of wrong SCO buffer size");
1195
1196module_param(force_scofix, bool, 0644);
1197MODULE_PARM_DESC(force_scofix, "Force fixup of wrong SCO buffers size");
1198
1199module_param(reset, bool, 0644);
1200MODULE_PARM_DESC(reset, "Send HCI reset command on initialization");
1201
5e23b923
MH		 1202MODULE_AUTHOR("Marcel Holtmann <marcel@holtmann.org>");
1203MODULE_DESCRIPTION("Generic Bluetooth USB driver ver " VERSION);
1204MODULE_VERSION(VERSION);
1205MODULE_LICENSE("GPL");
kernel source for telekom puls (alcatel/mediatek)