btusb.c 29.6 KB
Newer Older
1
2
3
4
/*
 *
 *  Generic Bluetooth USB driver
 *
5
 *  Copyright (C) 2005-2008  Marcel Holtmann <marcel@holtmann.org>
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
 *
 *
 *  This program is free software; you can redistribute it and/or modify
 *  it under the terms of the GNU General Public License as published by
 *  the Free Software Foundation; either version 2 of the License, or
 *  (at your option) any later version.
 *
 *  This program is distributed in the hope that it will be useful,
 *  but WITHOUT ANY WARRANTY; without even the implied warranty of
 *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 *  GNU General Public License for more details.
 *
 *  You should have received a copy of the GNU General Public License
 *  along with this program; if not, write to the Free Software
 *  Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
 *
 */

#include <linux/module.h>
#include <linux/usb.h>

#include <net/bluetooth/bluetooth.h>
#include <net/bluetooth/hci_core.h>

30
#define VERSION "0.6"
31

32
33
34
35
36
static bool ignore_dga;
static bool ignore_csr;
static bool ignore_sniffer;
static bool disable_scofix;
static bool force_scofix;
37

38
static bool reset = 1;
39
40
41
42

static struct usb_driver btusb_driver;

#define BTUSB_IGNORE		0x01
43
44
45
46
47
48
#define BTUSB_DIGIANSWER	0x02
#define BTUSB_CSR		0x04
#define BTUSB_SNIFFER		0x08
#define BTUSB_BCM92035		0x10
#define BTUSB_BROKEN_ISOC	0x20
#define BTUSB_WRONG_SCO_MTU	0x40
49
#define BTUSB_ATH3012		0x80
50
51
52
53
54

static struct usb_device_id btusb_table[] = {
	/* Generic Bluetooth USB device */
	{ USB_DEVICE_INFO(0xe0, 0x01, 0x01) },

55
	/* Broadcom SoftSailing reporting vendor specific */
56
	{ USB_DEVICE(0x0a5c, 0x21e1) },
57

58
59
60
	/* Apple MacBookPro 7,1 */
	{ USB_DEVICE(0x05ac, 0x8213) },

61
62
63
	/* Apple iMac11,1 */
	{ USB_DEVICE(0x05ac, 0x8215) },

64
65
66
	/* Apple MacBookPro6,2 */
	{ USB_DEVICE(0x05ac, 0x8218) },

67
68
69
	/* Apple MacBookAir3,1, MacBookAir3,2 */
	{ USB_DEVICE(0x05ac, 0x821b) },

70
71
72
	/* Apple MacBookAir4,1 */
	{ USB_DEVICE(0x05ac, 0x821f) },

73
74
75
	/* Apple MacBookPro8,2 */
	{ USB_DEVICE(0x05ac, 0x821a) },

76
77
78
	/* Apple MacMini5,1 */
	{ USB_DEVICE(0x05ac, 0x8281) },

79
80
81
82
83
84
85
86
87
88
89
90
91
92
	/* AVM BlueFRITZ! USB v2.0 */
	{ USB_DEVICE(0x057c, 0x3800) },

	/* Bluetooth Ultraport Module from IBM */
	{ USB_DEVICE(0x04bf, 0x030a) },

	/* ALPS Modules with non-standard id */
	{ USB_DEVICE(0x044e, 0x3001) },
	{ USB_DEVICE(0x044e, 0x3002) },

	/* Ericsson with non-standard id */
	{ USB_DEVICE(0x0bdb, 0x1002) },

	/* Canyon CN-BTU1 with HID interfaces */
93
	{ USB_DEVICE(0x0c10, 0x0000) },
94

95
	/* Broadcom BCM20702A0 */
96
	{ USB_DEVICE(0x04ca, 0x2003) },
97
	{ USB_DEVICE(0x0489, 0xe042) },
98
	{ USB_DEVICE(0x0a5c, 0x21e3) },
99
	{ USB_DEVICE(0x0a5c, 0x21e6) },
100
	{ USB_DEVICE(0x0a5c, 0x21e8) },
101
	{ USB_DEVICE(0x0a5c, 0x21f3) },
102
103
	{ USB_DEVICE(0x413c, 0x8197) },

104
	/* Foxconn - Hon Hai */
105
	{ USB_VENDOR_AND_INTERFACE_INFO(0x0489, 0xff, 0x01, 0x01) },
106

107
108
109
110
111
112
	{ }	/* Terminating entry */
};

MODULE_DEVICE_TABLE(usb, btusb_table);

static struct usb_device_id blacklist_table[] = {
113
114
115
116
117
118
	/* CSR BlueCore devices */
	{ USB_DEVICE(0x0a12, 0x0001), .driver_info = BTUSB_CSR },

	/* Broadcom BCM2033 without firmware */
	{ USB_DEVICE(0x0a5c, 0x2033), .driver_info = BTUSB_IGNORE },

119
120
	/* Atheros 3011 with sflash firmware */
	{ USB_DEVICE(0x0cf3, 0x3002), .driver_info = BTUSB_IGNORE },
121
	{ USB_DEVICE(0x0cf3, 0xe019), .driver_info = BTUSB_IGNORE },
122
	{ USB_DEVICE(0x13d3, 0x3304), .driver_info = BTUSB_IGNORE },
123
	{ USB_DEVICE(0x0930, 0x0215), .driver_info = BTUSB_IGNORE },
124
	{ USB_DEVICE(0x0489, 0xe03d), .driver_info = BTUSB_IGNORE },
125

126
127
128
	/* Atheros AR9285 Malbec with sflash firmware */
	{ USB_DEVICE(0x03f0, 0x311d), .driver_info = BTUSB_IGNORE },

129
	/* Atheros 3012 with sflash firmware */
130
	{ USB_DEVICE(0x0cf3, 0x3004), .driver_info = BTUSB_ATH3012 },
131
	{ USB_DEVICE(0x0cf3, 0x311d), .driver_info = BTUSB_ATH3012 },
132
	{ USB_DEVICE(0x13d3, 0x3375), .driver_info = BTUSB_ATH3012 },
133
	{ USB_DEVICE(0x04ca, 0x3005), .driver_info = BTUSB_ATH3012 },
134
	{ USB_DEVICE(0x13d3, 0x3362), .driver_info = BTUSB_ATH3012 },
135
	{ USB_DEVICE(0x0cf3, 0xe004), .driver_info = BTUSB_ATH3012 },
136
	{ USB_DEVICE(0x0930, 0x0219), .driver_info = BTUSB_ATH3012 },
137

138
139
140
	/* Atheros AR5BBU12 with sflash firmware */
	{ USB_DEVICE(0x0489, 0xe02c), .driver_info = BTUSB_IGNORE },

141
142
143
	/* Atheros AR5BBU12 with sflash firmware */
	{ USB_DEVICE(0x0489, 0xe03c), .driver_info = BTUSB_ATH3012 },

144
	/* Broadcom BCM2035 */
145
146
147
	{ USB_DEVICE(0x0a5c, 0x2035), .driver_info = BTUSB_WRONG_SCO_MTU },
	{ USB_DEVICE(0x0a5c, 0x200a), .driver_info = BTUSB_WRONG_SCO_MTU },
	{ USB_DEVICE(0x0a5c, 0x2009), .driver_info = BTUSB_BCM92035 },
148
149

	/* Broadcom BCM2045 */
150
151
	{ USB_DEVICE(0x0a5c, 0x2039), .driver_info = BTUSB_WRONG_SCO_MTU },
	{ USB_DEVICE(0x0a5c, 0x2101), .driver_info = BTUSB_WRONG_SCO_MTU },
152

153
	/* IBM/Lenovo ThinkPad with Broadcom chip */
154
155
	{ USB_DEVICE(0x0a5c, 0x201e), .driver_info = BTUSB_WRONG_SCO_MTU },
	{ USB_DEVICE(0x0a5c, 0x2110), .driver_info = BTUSB_WRONG_SCO_MTU },
156
157

	/* HP laptop with Broadcom chip */
158
	{ USB_DEVICE(0x03f0, 0x171d), .driver_info = BTUSB_WRONG_SCO_MTU },
159
160

	/* Dell laptop with Broadcom chip */
161
	{ USB_DEVICE(0x413c, 0x8126), .driver_info = BTUSB_WRONG_SCO_MTU },
162

163
	/* Dell Wireless 370 and 410 devices */
164
	{ USB_DEVICE(0x413c, 0x8152), .driver_info = BTUSB_WRONG_SCO_MTU },
165
	{ USB_DEVICE(0x413c, 0x8156), .driver_info = BTUSB_WRONG_SCO_MTU },
166

167
168
169
	/* Belkin F8T012 and F8T013 devices */
	{ USB_DEVICE(0x050d, 0x0012), .driver_info = BTUSB_WRONG_SCO_MTU },
	{ USB_DEVICE(0x050d, 0x0013), .driver_info = BTUSB_WRONG_SCO_MTU },
170

171
172
173
174
175
176
	/* Asus WL-BTD202 device */
	{ USB_DEVICE(0x0b05, 0x1715), .driver_info = BTUSB_WRONG_SCO_MTU },

	/* Kensington Bluetooth USB adapter */
	{ USB_DEVICE(0x047d, 0x105e), .driver_info = BTUSB_WRONG_SCO_MTU },

177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
	/* RTX Telecom based adapters with buggy SCO support */
	{ USB_DEVICE(0x0400, 0x0807), .driver_info = BTUSB_BROKEN_ISOC },
	{ USB_DEVICE(0x0400, 0x080a), .driver_info = BTUSB_BROKEN_ISOC },

	/* CONWISE Technology based adapters with buggy SCO support */
	{ USB_DEVICE(0x0e5e, 0x6622), .driver_info = BTUSB_BROKEN_ISOC },

	/* Digianswer devices */
	{ USB_DEVICE(0x08fd, 0x0001), .driver_info = BTUSB_DIGIANSWER },
	{ USB_DEVICE(0x08fd, 0x0002), .driver_info = BTUSB_IGNORE },

	/* CSR BlueCore Bluetooth Sniffer */
	{ USB_DEVICE(0x0a12, 0x0002), .driver_info = BTUSB_SNIFFER },

	/* Frontline ComProbe Bluetooth Sniffer */
	{ USB_DEVICE(0x16d3, 0x0002), .driver_info = BTUSB_SNIFFER },

194
195
196
	{ }	/* Terminating entry */
};

197
198
#define BTUSB_MAX_ISOC_FRAMES	10

199
200
#define BTUSB_INTR_RUNNING	0
#define BTUSB_BULK_RUNNING	1
201
#define BTUSB_ISOC_RUNNING	2
202
#define BTUSB_SUSPENDING	3
203
#define BTUSB_DID_ISO_RESUME	4
204
205
206
207

struct btusb_data {
	struct hci_dev       *hdev;
	struct usb_device    *udev;
208
	struct usb_interface *intf;
209
	struct usb_interface *isoc;
210
211
212
213
214
215

	spinlock_t lock;

	unsigned long flags;

	struct work_struct work;
216
	struct work_struct waker;
217
218
219
220

	struct usb_anchor tx_anchor;
	struct usb_anchor intr_anchor;
	struct usb_anchor bulk_anchor;
221
	struct usb_anchor isoc_anchor;
222
223
224
	struct usb_anchor deferred;
	int tx_in_flight;
	spinlock_t txlock;
225
226
227
228

	struct usb_endpoint_descriptor *intr_ep;
	struct usb_endpoint_descriptor *bulk_tx_ep;
	struct usb_endpoint_descriptor *bulk_rx_ep;
229
230
231
	struct usb_endpoint_descriptor *isoc_tx_ep;
	struct usb_endpoint_descriptor *isoc_rx_ep;

232
233
	__u8 cmdreq_type;

234
	unsigned int sco_num;
235
	int isoc_altsetting;
236
	int suspend_count;
237
238
};

239
240
241
242
243
244
245
246
247
248
249
250
251
252
static int inc_tx(struct btusb_data *data)
{
	unsigned long flags;
	int rv;

	spin_lock_irqsave(&data->txlock, flags);
	rv = test_bit(BTUSB_SUSPENDING, &data->flags);
	if (!rv)
		data->tx_in_flight++;
	spin_unlock_irqrestore(&data->txlock, flags);

	return rv;
}

253
254
255
static void btusb_intr_complete(struct urb *urb)
{
	struct hci_dev *hdev = urb->context;
256
	struct btusb_data *data = hci_get_drvdata(hdev);
257
258
259
260
261
262
263
264
265
	int err;

	BT_DBG("%s urb %p status %d count %d", hdev->name,
					urb, urb->status, urb->actual_length);

	if (!test_bit(HCI_RUNNING, &hdev->flags))
		return;

	if (urb->status == 0) {
266
267
		hdev->stat.byte_rx += urb->actual_length;

268
269
270
271
272
273
274
275
276
277
278
		if (hci_recv_fragment(hdev, HCI_EVENT_PKT,
						urb->transfer_buffer,
						urb->actual_length) < 0) {
			BT_ERR("%s corrupted event packet", hdev->name);
			hdev->stat.err_rx++;
		}
	}

	if (!test_bit(BTUSB_INTR_RUNNING, &data->flags))
		return;

279
	usb_mark_last_busy(data->udev);
280
281
282
283
	usb_anchor_urb(urb, &data->intr_anchor);

	err = usb_submit_urb(urb, GFP_ATOMIC);
	if (err < 0) {
284
285
286
		/* -EPERM: urb is being killed;
		 * -ENODEV: device got disconnected */
		if (err != -EPERM && err != -ENODEV)
287
			BT_ERR("%s urb %p failed to resubmit (%d)",
288
289
290
291
292
						hdev->name, urb, -err);
		usb_unanchor_urb(urb);
	}
}

293
static int btusb_submit_intr_urb(struct hci_dev *hdev, gfp_t mem_flags)
294
{
295
	struct btusb_data *data = hci_get_drvdata(hdev);
296
297
298
299
300
301
302
	struct urb *urb;
	unsigned char *buf;
	unsigned int pipe;
	int err, size;

	BT_DBG("%s", hdev->name);

303
304
305
	if (!data->intr_ep)
		return -ENODEV;

306
	urb = usb_alloc_urb(0, mem_flags);
307
308
309
310
311
	if (!urb)
		return -ENOMEM;

	size = le16_to_cpu(data->intr_ep->wMaxPacketSize);

312
	buf = kmalloc(size, mem_flags);
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
	if (!buf) {
		usb_free_urb(urb);
		return -ENOMEM;
	}

	pipe = usb_rcvintpipe(data->udev, data->intr_ep->bEndpointAddress);

	usb_fill_int_urb(urb, data->udev, pipe, buf, size,
						btusb_intr_complete, hdev,
						data->intr_ep->bInterval);

	urb->transfer_flags |= URB_FREE_BUFFER;

	usb_anchor_urb(urb, &data->intr_anchor);

328
	err = usb_submit_urb(urb, mem_flags);
329
	if (err < 0) {
330
331
		if (err != -EPERM && err != -ENODEV)
			BT_ERR("%s urb %p submission failed (%d)",
332
333
334
335
336
337
338
339
340
341
342
343
						hdev->name, urb, -err);
		usb_unanchor_urb(urb);
	}

	usb_free_urb(urb);

	return err;
}

static void btusb_bulk_complete(struct urb *urb)
{
	struct hci_dev *hdev = urb->context;
344
	struct btusb_data *data = hci_get_drvdata(hdev);
345
346
347
348
349
350
351
352
353
	int err;

	BT_DBG("%s urb %p status %d count %d", hdev->name,
					urb, urb->status, urb->actual_length);

	if (!test_bit(HCI_RUNNING, &hdev->flags))
		return;

	if (urb->status == 0) {
354
355
		hdev->stat.byte_rx += urb->actual_length;

356
357
358
359
360
361
362
363
364
365
366
367
		if (hci_recv_fragment(hdev, HCI_ACLDATA_PKT,
						urb->transfer_buffer,
						urb->actual_length) < 0) {
			BT_ERR("%s corrupted ACL packet", hdev->name);
			hdev->stat.err_rx++;
		}
	}

	if (!test_bit(BTUSB_BULK_RUNNING, &data->flags))
		return;

	usb_anchor_urb(urb, &data->bulk_anchor);
368
	usb_mark_last_busy(data->udev);
369
370
371

	err = usb_submit_urb(urb, GFP_ATOMIC);
	if (err < 0) {
372
373
374
		/* -EPERM: urb is being killed;
		 * -ENODEV: device got disconnected */
		if (err != -EPERM && err != -ENODEV)
375
			BT_ERR("%s urb %p failed to resubmit (%d)",
376
377
378
379
380
						hdev->name, urb, -err);
		usb_unanchor_urb(urb);
	}
}

381
static int btusb_submit_bulk_urb(struct hci_dev *hdev, gfp_t mem_flags)
382
{
383
	struct btusb_data *data = hci_get_drvdata(hdev);
384
385
386
	struct urb *urb;
	unsigned char *buf;
	unsigned int pipe;
387
	int err, size = HCI_MAX_FRAME_SIZE;
388
389
390

	BT_DBG("%s", hdev->name);

391
392
393
	if (!data->bulk_rx_ep)
		return -ENODEV;

394
	urb = usb_alloc_urb(0, mem_flags);
395
396
397
	if (!urb)
		return -ENOMEM;

398
	buf = kmalloc(size, mem_flags);
399
400
401
402
403
404
405
406
407
408
409
410
	if (!buf) {
		usb_free_urb(urb);
		return -ENOMEM;
	}

	pipe = usb_rcvbulkpipe(data->udev, data->bulk_rx_ep->bEndpointAddress);

	usb_fill_bulk_urb(urb, data->udev, pipe,
					buf, size, btusb_bulk_complete, hdev);

	urb->transfer_flags |= URB_FREE_BUFFER;

411
	usb_mark_last_busy(data->udev);
412
413
	usb_anchor_urb(urb, &data->bulk_anchor);

414
	err = usb_submit_urb(urb, mem_flags);
415
	if (err < 0) {
416
417
		if (err != -EPERM && err != -ENODEV)
			BT_ERR("%s urb %p submission failed (%d)",
418
419
420
421
422
423
424
425
426
						hdev->name, urb, -err);
		usb_unanchor_urb(urb);
	}

	usb_free_urb(urb);

	return err;
}

427
428
429
static void btusb_isoc_complete(struct urb *urb)
{
	struct hci_dev *hdev = urb->context;
430
	struct btusb_data *data = hci_get_drvdata(hdev);
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
	int i, err;

	BT_DBG("%s urb %p status %d count %d", hdev->name,
					urb, urb->status, urb->actual_length);

	if (!test_bit(HCI_RUNNING, &hdev->flags))
		return;

	if (urb->status == 0) {
		for (i = 0; i < urb->number_of_packets; i++) {
			unsigned int offset = urb->iso_frame_desc[i].offset;
			unsigned int length = urb->iso_frame_desc[i].actual_length;

			if (urb->iso_frame_desc[i].status)
				continue;

			hdev->stat.byte_rx += length;

			if (hci_recv_fragment(hdev, HCI_SCODATA_PKT,
						urb->transfer_buffer + offset,
								length) < 0) {
				BT_ERR("%s corrupted SCO packet", hdev->name);
				hdev->stat.err_rx++;
			}
		}
	}

	if (!test_bit(BTUSB_ISOC_RUNNING, &data->flags))
		return;

	usb_anchor_urb(urb, &data->isoc_anchor);

	err = usb_submit_urb(urb, GFP_ATOMIC);
	if (err < 0) {
465
466
467
		/* -EPERM: urb is being killed;
		 * -ENODEV: device got disconnected */
		if (err != -EPERM && err != -ENODEV)
468
			BT_ERR("%s urb %p failed to resubmit (%d)",
469
470
471
472
473
						hdev->name, urb, -err);
		usb_unanchor_urb(urb);
	}
}

474
static inline void __fill_isoc_descriptor(struct urb *urb, int len, int mtu)
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
{
	int i, offset = 0;

	BT_DBG("len %d mtu %d", len, mtu);

	for (i = 0; i < BTUSB_MAX_ISOC_FRAMES && len >= mtu;
					i++, offset += mtu, len -= mtu) {
		urb->iso_frame_desc[i].offset = offset;
		urb->iso_frame_desc[i].length = mtu;
	}

	if (len && i < BTUSB_MAX_ISOC_FRAMES) {
		urb->iso_frame_desc[i].offset = offset;
		urb->iso_frame_desc[i].length = len;
		i++;
	}

	urb->number_of_packets = i;
}

495
static int btusb_submit_isoc_urb(struct hci_dev *hdev, gfp_t mem_flags)
496
{
497
	struct btusb_data *data = hci_get_drvdata(hdev);
498
499
500
501
502
503
504
505
506
507
	struct urb *urb;
	unsigned char *buf;
	unsigned int pipe;
	int err, size;

	BT_DBG("%s", hdev->name);

	if (!data->isoc_rx_ep)
		return -ENODEV;

508
	urb = usb_alloc_urb(BTUSB_MAX_ISOC_FRAMES, mem_flags);
509
510
511
512
513
514
	if (!urb)
		return -ENOMEM;

	size = le16_to_cpu(data->isoc_rx_ep->wMaxPacketSize) *
						BTUSB_MAX_ISOC_FRAMES;

515
	buf = kmalloc(size, mem_flags);
516
517
518
519
520
521
522
	if (!buf) {
		usb_free_urb(urb);
		return -ENOMEM;
	}

	pipe = usb_rcvisocpipe(data->udev, data->isoc_rx_ep->bEndpointAddress);

523
524
	usb_fill_int_urb(urb, data->udev, pipe, buf, size, btusb_isoc_complete,
				hdev, data->isoc_rx_ep->bInterval);
525
526
527
528
529
530
531
532

	urb->transfer_flags  = URB_FREE_BUFFER | URB_ISO_ASAP;

	__fill_isoc_descriptor(urb, size,
			le16_to_cpu(data->isoc_rx_ep->wMaxPacketSize));

	usb_anchor_urb(urb, &data->isoc_anchor);

533
	err = usb_submit_urb(urb, mem_flags);
534
	if (err < 0) {
535
536
		if (err != -EPERM && err != -ENODEV)
			BT_ERR("%s urb %p submission failed (%d)",
537
538
539
540
541
542
543
544
545
						hdev->name, urb, -err);
		usb_unanchor_urb(urb);
	}

	usb_free_urb(urb);

	return err;
}

546
static void btusb_tx_complete(struct urb *urb)
547
548
549
{
	struct sk_buff *skb = urb->context;
	struct hci_dev *hdev = (struct hci_dev *) skb->dev;
550
	struct btusb_data *data = hci_get_drvdata(hdev);
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573

	BT_DBG("%s urb %p status %d count %d", hdev->name,
					urb, urb->status, urb->actual_length);

	if (!test_bit(HCI_RUNNING, &hdev->flags))
		goto done;

	if (!urb->status)
		hdev->stat.byte_tx += urb->transfer_buffer_length;
	else
		hdev->stat.err_tx++;

done:
	spin_lock(&data->txlock);
	data->tx_in_flight--;
	spin_unlock(&data->txlock);

	kfree(urb->setup_packet);

	kfree_skb(skb);
}

static void btusb_isoc_tx_complete(struct urb *urb)
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
{
	struct sk_buff *skb = urb->context;
	struct hci_dev *hdev = (struct hci_dev *) skb->dev;

	BT_DBG("%s urb %p status %d count %d", hdev->name,
					urb, urb->status, urb->actual_length);

	if (!test_bit(HCI_RUNNING, &hdev->flags))
		goto done;

	if (!urb->status)
		hdev->stat.byte_tx += urb->transfer_buffer_length;
	else
		hdev->stat.err_tx++;

done:
	kfree(urb->setup_packet);

	kfree_skb(skb);
}

static int btusb_open(struct hci_dev *hdev)
{
597
	struct btusb_data *data = hci_get_drvdata(hdev);
598
599
600
601
	int err;

	BT_DBG("%s", hdev->name);

602
603
604
605
606
607
	err = usb_autopm_get_interface(data->intf);
	if (err < 0)
		return err;

	data->intf->needs_remote_wakeup = 1;

608
	if (test_and_set_bit(HCI_RUNNING, &hdev->flags))
609
		goto done;
610
611

	if (test_and_set_bit(BTUSB_INTR_RUNNING, &data->flags))
612
		goto done;
613

614
	err = btusb_submit_intr_urb(hdev, GFP_KERNEL);
615
616
617
618
	if (err < 0)
		goto failed;

	err = btusb_submit_bulk_urb(hdev, GFP_KERNEL);
619
	if (err < 0) {
620
621
		usb_kill_anchored_urbs(&data->intr_anchor);
		goto failed;
622
623
	}

624
625
626
	set_bit(BTUSB_BULK_RUNNING, &data->flags);
	btusb_submit_bulk_urb(hdev, GFP_KERNEL);

627
628
done:
	usb_autopm_put_interface(data->intf);
629
630
631
632
633
	return 0;

failed:
	clear_bit(BTUSB_INTR_RUNNING, &data->flags);
	clear_bit(HCI_RUNNING, &hdev->flags);
634
	usb_autopm_put_interface(data->intf);
635
636
637
	return err;
}

638
639
640
641
642
643
644
static void btusb_stop_traffic(struct btusb_data *data)
{
	usb_kill_anchored_urbs(&data->intr_anchor);
	usb_kill_anchored_urbs(&data->bulk_anchor);
	usb_kill_anchored_urbs(&data->isoc_anchor);
}

645
646
static int btusb_close(struct hci_dev *hdev)
{
647
	struct btusb_data *data = hci_get_drvdata(hdev);
648
	int err;
649
650
651
652
653
654

	BT_DBG("%s", hdev->name);

	if (!test_and_clear_bit(HCI_RUNNING, &hdev->flags))
		return 0;

655
	cancel_work_sync(&data->work);
656
	cancel_work_sync(&data->waker);
657

658
	clear_bit(BTUSB_ISOC_RUNNING, &data->flags);
659
660
	clear_bit(BTUSB_BULK_RUNNING, &data->flags);
	clear_bit(BTUSB_INTR_RUNNING, &data->flags);
661
662
663
664

	btusb_stop_traffic(data);
	err = usb_autopm_get_interface(data->intf);
	if (err < 0)
665
		goto failed;
666
667
668

	data->intf->needs_remote_wakeup = 0;
	usb_autopm_put_interface(data->intf);
669

670
671
failed:
	usb_scuttle_anchored_urbs(&data->deferred);
672
673
674
675
676
	return 0;
}

static int btusb_flush(struct hci_dev *hdev)
{
677
	struct btusb_data *data = hci_get_drvdata(hdev);
678
679
680
681
682
683
684
685
686
687
688

	BT_DBG("%s", hdev->name);

	usb_kill_anchored_urbs(&data->tx_anchor);

	return 0;
}

static int btusb_send_frame(struct sk_buff *skb)
{
	struct hci_dev *hdev = (struct hci_dev *) skb->dev;
689
	struct btusb_data *data = hci_get_drvdata(hdev);
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
	struct usb_ctrlrequest *dr;
	struct urb *urb;
	unsigned int pipe;
	int err;

	BT_DBG("%s", hdev->name);

	if (!test_bit(HCI_RUNNING, &hdev->flags))
		return -EBUSY;

	switch (bt_cb(skb)->pkt_type) {
	case HCI_COMMAND_PKT:
		urb = usb_alloc_urb(0, GFP_ATOMIC);
		if (!urb)
			return -ENOMEM;

		dr = kmalloc(sizeof(*dr), GFP_ATOMIC);
		if (!dr) {
			usb_free_urb(urb);
			return -ENOMEM;
		}

712
		dr->bRequestType = data->cmdreq_type;
713
714
715
716
717
718
719
720
721
722
723
724
725
726
		dr->bRequest     = 0;
		dr->wIndex       = 0;
		dr->wValue       = 0;
		dr->wLength      = __cpu_to_le16(skb->len);

		pipe = usb_sndctrlpipe(data->udev, 0x00);

		usb_fill_control_urb(urb, data->udev, pipe, (void *) dr,
				skb->data, skb->len, btusb_tx_complete, skb);

		hdev->stat.cmd_tx++;
		break;

	case HCI_ACLDATA_PKT:
727
		if (!data->bulk_tx_ep)
728
729
			return -ENODEV;

730
731
732
733
734
735
736
737
738
739
740
741
742
743
		urb = usb_alloc_urb(0, GFP_ATOMIC);
		if (!urb)
			return -ENOMEM;

		pipe = usb_sndbulkpipe(data->udev,
					data->bulk_tx_ep->bEndpointAddress);

		usb_fill_bulk_urb(urb, data->udev, pipe,
				skb->data, skb->len, btusb_tx_complete, skb);

		hdev->stat.acl_tx++;
		break;

	case HCI_SCODATA_PKT:
744
745
746
747
748
749
750
751
752
753
		if (!data->isoc_tx_ep || hdev->conn_hash.sco_num < 1)
			return -ENODEV;

		urb = usb_alloc_urb(BTUSB_MAX_ISOC_FRAMES, GFP_ATOMIC);
		if (!urb)
			return -ENOMEM;

		pipe = usb_sndisocpipe(data->udev,
					data->isoc_tx_ep->bEndpointAddress);

754
755
756
		usb_fill_int_urb(urb, data->udev, pipe,
				skb->data, skb->len, btusb_isoc_tx_complete,
				skb, data->isoc_tx_ep->bInterval);
757
758
759
760
761
762

		urb->transfer_flags  = URB_ISO_ASAP;

		__fill_isoc_descriptor(urb, skb->len,
				le16_to_cpu(data->isoc_tx_ep->wMaxPacketSize));

763
		hdev->stat.sco_tx++;
764
		goto skip_waking;
765
766
767
768
769

	default:
		return -EILSEQ;
	}

770
771
772
773
774
775
776
777
778
	err = inc_tx(data);
	if (err) {
		usb_anchor_urb(urb, &data->deferred);
		schedule_work(&data->waker);
		err = 0;
		goto done;
	}

skip_waking:
779
780
781
782
	usb_anchor_urb(urb, &data->tx_anchor);

	err = usb_submit_urb(urb, GFP_ATOMIC);
	if (err < 0) {
783
784
785
		if (err != -EPERM && err != -ENODEV)
			BT_ERR("%s urb %p submission failed (%d)",
						hdev->name, urb, -err);
786
787
		kfree(urb->setup_packet);
		usb_unanchor_urb(urb);
788
789
	} else {
		usb_mark_last_busy(data->udev);
790
791
	}

792
done:
793
	usb_free_urb(urb);
794
795
796
797
798
	return err;
}

static void btusb_notify(struct hci_dev *hdev, unsigned int evt)
{
799
	struct btusb_data *data = hci_get_drvdata(hdev);
800
801
802

	BT_DBG("%s evt %d", hdev->name, evt);

803
804
805
	if (hdev->conn_hash.sco_num != data->sco_num) {
		data->sco_num = hdev->conn_hash.sco_num;
		schedule_work(&data->work);
806
	}
807
808
}

809
static inline int __set_isoc_interface(struct hci_dev *hdev, int altsetting)
810
{
811
	struct btusb_data *data = hci_get_drvdata(hdev);
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
	struct usb_interface *intf = data->isoc;
	struct usb_endpoint_descriptor *ep_desc;
	int i, err;

	if (!data->isoc)
		return -ENODEV;

	err = usb_set_interface(data->udev, 1, altsetting);
	if (err < 0) {
		BT_ERR("%s setting interface failed (%d)", hdev->name, -err);
		return err;
	}

	data->isoc_altsetting = altsetting;

	data->isoc_tx_ep = NULL;
	data->isoc_rx_ep = NULL;

	for (i = 0; i < intf->cur_altsetting->desc.bNumEndpoints; i++) {
		ep_desc = &intf->cur_altsetting->endpoint[i].desc;

		if (!data->isoc_tx_ep && usb_endpoint_is_isoc_out(ep_desc)) {
			data->isoc_tx_ep = ep_desc;
			continue;
		}

		if (!data->isoc_rx_ep && usb_endpoint_is_isoc_in(ep_desc)) {
			data->isoc_rx_ep = ep_desc;
			continue;
		}
	}

	if (!data->isoc_tx_ep || !data->isoc_rx_ep) {
		BT_ERR("%s invalid SCO descriptors", hdev->name);
		return -ENODEV;
	}

	return 0;
}

852
853
854
855
static void btusb_work(struct work_struct *work)
{
	struct btusb_data *data = container_of(work, struct btusb_data, work);
	struct hci_dev *hdev = data->hdev;
856
	int new_alts;
857
	int err;
858

859
	if (hdev->conn_hash.sco_num > 0) {
860
		if (!test_bit(BTUSB_DID_ISO_RESUME, &data->flags)) {
861
			err = usb_autopm_get_interface(data->isoc ? data->isoc : data->intf);
862
863
864
865
866
867
			if (err < 0) {
				clear_bit(BTUSB_ISOC_RUNNING, &data->flags);
				usb_kill_anchored_urbs(&data->isoc_anchor);
				return;
			}

868
			set_bit(BTUSB_DID_ISO_RESUME, &data->flags);
869
		}
870
871
872
873
874
875
876
877
878

		if (hdev->voice_setting & 0x0020) {
			static const int alts[3] = { 2, 4, 5 };
			new_alts = alts[hdev->conn_hash.sco_num - 1];
		} else {
			new_alts = hdev->conn_hash.sco_num;
		}

		if (data->isoc_altsetting != new_alts) {
879
880
881
			clear_bit(BTUSB_ISOC_RUNNING, &data->flags);
			usb_kill_anchored_urbs(&data->isoc_anchor);

882
			if (__set_isoc_interface(hdev, new_alts) < 0)
883
884
885
886
				return;
		}

		if (!test_and_set_bit(BTUSB_ISOC_RUNNING, &data->flags)) {
887
			if (btusb_submit_isoc_urb(hdev, GFP_KERNEL) < 0)
888
889
				clear_bit(BTUSB_ISOC_RUNNING, &data->flags);
			else
890
				btusb_submit_isoc_urb(hdev, GFP_KERNEL);
891
892
893
894
895
896
		}
	} else {
		clear_bit(BTUSB_ISOC_RUNNING, &data->flags);
		usb_kill_anchored_urbs(&data->isoc_anchor);

		__set_isoc_interface(hdev, 0);
897
		if (test_and_clear_bit(BTUSB_DID_ISO_RESUME, &data->flags))
898
			usb_autopm_put_interface(data->isoc ? data->isoc : data->intf);
899
900
901
	}
}

902
903
904
905
906
907
908
909
910
911
912
913
static void btusb_waker(struct work_struct *work)
{
	struct btusb_data *data = container_of(work, struct btusb_data, waker);
	int err;

	err = usb_autopm_get_interface(data->intf);
	if (err < 0)
		return;

	usb_autopm_put_interface(data->intf);
}

914
915
916
917
918
919
920
921
922
923
static int btusb_probe(struct usb_interface *intf,
				const struct usb_device_id *id)
{
	struct usb_endpoint_descriptor *ep_desc;
	struct btusb_data *data;
	struct hci_dev *hdev;
	int i, err;

	BT_DBG("intf %p id %p", intf, id);

924
	/* interface numbers are hardcoded in the spec */
925
926
927
928
929
930
931
932
933
934
	if (intf->cur_altsetting->desc.bInterfaceNumber != 0)
		return -ENODEV;

	if (!id->driver_info) {
		const struct usb_device_id *match;
		match = usb_match_id(intf, blacklist_table);
		if (match)
			id = match;
	}

935
936
937
938
939
940
941
942
943
944
945
946
	if (id->driver_info == BTUSB_IGNORE)
		return -ENODEV;

	if (ignore_dga && id->driver_info & BTUSB_DIGIANSWER)
		return -ENODEV;

	if (ignore_csr && id->driver_info & BTUSB_CSR)
		return -ENODEV;

	if (ignore_sniffer && id->driver_info & BTUSB_SNIFFER)
		return -ENODEV;

947
948
949
950
951
952
953
954
955
	if (id->driver_info & BTUSB_ATH3012) {
		struct usb_device *udev = interface_to_usbdev(intf);

		/* Old firmware would otherwise let ath3k driver load
		 * patch and sysconfig files */
		if (le16_to_cpu(udev->descriptor.bcdDevice) <= 0x0001)
			return -ENODEV;
	}

956
	data = devm_kzalloc(&intf->dev, sizeof(*data), GFP_KERNEL);
957
958
959
960
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975
976
977
978
	if (!data)
		return -ENOMEM;

	for (i = 0; i < intf->cur_altsetting->desc.bNumEndpoints; i++) {
		ep_desc = &intf->cur_altsetting->endpoint[i].desc;

		if (!data->intr_ep && usb_endpoint_is_int_in(ep_desc)) {
			data->intr_ep = ep_desc;
			continue;
		}

		if (!data->bulk_tx_ep && usb_endpoint_is_bulk_out(ep_desc)) {
			data->bulk_tx_ep = ep_desc;
			continue;
		}

		if (!data->bulk_rx_ep && usb_endpoint_is_bulk_in(ep_desc)) {
			data->bulk_rx_ep = ep_desc;
			continue;
		}
	}

979
	if (!data->intr_ep || !data->bulk_tx_ep || !data->bulk_rx_ep)
980
981
		return -ENODEV;

982
983
	data->cmdreq_type = USB_TYPE_CLASS;

984
	data->udev = interface_to_usbdev(intf);
985
	data->intf = intf;
986
987
988
989

	spin_lock_init(&data->lock);

	INIT_WORK(&data->work, btusb_work);
990
991
	INIT_WORK(&data->waker, btusb_waker);
	spin_lock_init(&data->txlock);
992
993
994
995

	init_usb_anchor(&data->tx_anchor);
	init_usb_anchor(&data->intr_anchor);
	init_usb_anchor(&data->bulk_anchor);
996
	init_usb_anchor(&data->isoc_anchor);
997
	init_usb_anchor(&data->deferred);
998
999

	hdev = hci_alloc_dev();
1000
	if (!hdev)