From 8fc5387cb837f9e44a0be2d7e297bbbcab36a292 Mon Sep 17 00:00:00 2001 From: "David S. Miller" Date: Sun, 21 Sep 2008 22:44:08 -0700 Subject: bluetooth: hci_bcsp: Use SKB list interfaces instead of home-grown stuff. Signed-off-by: David S. Miller --- drivers/bluetooth/hci_bcsp.c | 18 +++++++++--------- 1 file changed, 9 insertions(+), 9 deletions(-) (limited to 'drivers/bluetooth') diff --git a/drivers/bluetooth/hci_bcsp.c b/drivers/bluetooth/hci_bcsp.c index 4d37bb312ee..7938062c1cc 100644 --- a/drivers/bluetooth/hci_bcsp.c +++ b/drivers/bluetooth/hci_bcsp.c @@ -352,14 +352,14 @@ static int bcsp_flush(struct hci_uart *hu) /* Remove ack'ed packets */ static void bcsp_pkt_cull(struct bcsp_struct *bcsp) { + struct sk_buff *skb, *tmp; unsigned long flags; - struct sk_buff *skb; int i, pkts_to_be_removed; u8 seqno; spin_lock_irqsave(&bcsp->unack.lock, flags); - pkts_to_be_removed = bcsp->unack.qlen; + pkts_to_be_removed = skb_queue_len(&bcsp->unack); seqno = bcsp->msgq_txseq; while (pkts_to_be_removed) { @@ -373,19 +373,19 @@ static void bcsp_pkt_cull(struct bcsp_struct *bcsp) BT_ERR("Peer acked invalid packet"); BT_DBG("Removing %u pkts out of %u, up to seqno %u", - pkts_to_be_removed, bcsp->unack.qlen, (seqno - 1) & 0x07); + pkts_to_be_removed, skb_queue_len(&bcsp->unack), + (seqno - 1) & 0x07); - for (i = 0, skb = ((struct sk_buff *) &bcsp->unack)->next; i < pkts_to_be_removed - && skb != (struct sk_buff *) &bcsp->unack; i++) { - struct sk_buff *nskb; + i = 0; + skb_queue_walk_safe(&bcsp->unack, skb, tmp) { + if (i++ >= pkts_to_be_removed) + break; - nskb = skb->next; __skb_unlink(skb, &bcsp->unack); kfree_skb(skb); - skb = nskb; } - if (bcsp->unack.qlen == 0) + if (skb_queue_empty(&bcsp->unack)) del_timer(&bcsp->tbcsp); spin_unlock_irqrestore(&bcsp->unack.lock, flags); -- cgit v1.2.3-70-g09d2 From bdbef3d696ca83489eb653459b5a7a62ecf5596a Mon Sep 17 00:00:00 2001 From: Marcel Holtmann Date: Tue, 23 Sep 2008 00:16:35 +0200 Subject: [Bluetooth] Fix I/O errors on MacBooks with Broadcom chips The newer MacBooks contain a Broadcom based Bluetooth chip and to make this work properly, HCI_Reset must be send first. If HCI_Reset is not used then a lot of I/O errors show up and its triggers packets from non-existent ACL links. Signed-off-by: Marcel Holtmann --- drivers/bluetooth/btusb.c | 3 +++ 1 file changed, 3 insertions(+) (limited to 'drivers/bluetooth') diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c index 6a010681ecf..7665347238c 100644 --- a/drivers/bluetooth/btusb.c +++ b/drivers/bluetooth/btusb.c @@ -104,6 +104,9 @@ static struct usb_device_id blacklist_table[] = { /* Broadcom BCM2046 */ { USB_DEVICE(0x0a5c, 0x2151), .driver_info = BTUSB_RESET }, + /* Apple MacBook Pro with Broadcom chip */ + { USB_DEVICE(0x05ac, 0x820f), .driver_info = BTUSB_RESET }, + /* IBM/Lenovo ThinkPad with Broadcom chip */ { USB_DEVICE(0x0a5c, 0x201e), .driver_info = BTUSB_RESET | BTUSB_WRONG_SCO_MTU }, { USB_DEVICE(0x0a5c, 0x2110), .driver_info = BTUSB_RESET | BTUSB_WRONG_SCO_MTU }, -- cgit v1.2.3-70-g09d2 From e8c3c3d22b340a406a9aab1b7a9f436636c3de9d Mon Sep 17 00:00:00 2001 From: Marcel Holtmann Date: Tue, 23 Sep 2008 00:16:36 +0200 Subject: [Bluetooth] Fix wrong URB handling of btusb driver The btusb driver contains two typos that result in some buggy behavior, but the impact is not immediately visible. During initialization the submitting of interrupt URBs might fail and then make sure to remove the correct flag and not one of the hci_dev flags. When closing down the interface make sure to kill the anchor for the ISOC URBs and not kill the interrupt URBs twice. Also cancel any scheduled work when closing down the interface. Signed-off-by: Marcel Holtmann --- drivers/bluetooth/btusb.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) (limited to 'drivers/bluetooth') diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c index 7665347238c..b4756a6a3a6 100644 --- a/drivers/bluetooth/btusb.c +++ b/drivers/bluetooth/btusb.c @@ -519,7 +519,7 @@ static int btusb_open(struct hci_dev *hdev) err = btusb_submit_intr_urb(hdev); if (err < 0) { - clear_bit(BTUSB_INTR_RUNNING, &hdev->flags); + clear_bit(BTUSB_INTR_RUNNING, &data->flags); clear_bit(HCI_RUNNING, &hdev->flags); } @@ -535,8 +535,10 @@ static int btusb_close(struct hci_dev *hdev) if (!test_and_clear_bit(HCI_RUNNING, &hdev->flags)) return 0; + cancel_work_sync(&data->work); + clear_bit(BTUSB_ISOC_RUNNING, &data->flags); - usb_kill_anchored_urbs(&data->intr_anchor); + usb_kill_anchored_urbs(&data->isoc_anchor); clear_bit(BTUSB_BULK_RUNNING, &data->flags); usb_kill_anchored_urbs(&data->bulk_anchor); -- cgit v1.2.3-70-g09d2 From 5fbcd260c2c52f78cd699f65e9c7af2e60b5380c Mon Sep 17 00:00:00 2001 From: Marcel Holtmann Date: Tue, 23 Sep 2008 00:16:36 +0200 Subject: [Bluetooth] Fix USB disconnect handling of btusb driver The USB transport specification for Bluetooth splits the ACL and SCO handling into two separate interfaces. In Linux it possible to probe and disconnect these interfaces independently. So make sure that both interfaces are tightly bound together. This fixes the suspend regression that some people have expierenced. Signed-off-by: Oliver Neukum Signed-off-by: Marcel Holtmann --- drivers/bluetooth/btusb.c | 19 +++++++++++++++---- 1 file changed, 15 insertions(+), 4 deletions(-) (limited to 'drivers/bluetooth') diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c index b4756a6a3a6..29ae99817c6 100644 --- a/drivers/bluetooth/btusb.c +++ b/drivers/bluetooth/btusb.c @@ -172,6 +172,7 @@ static struct usb_device_id blacklist_table[] = { struct btusb_data { struct hci_dev *hdev; struct usb_device *udev; + struct usb_interface *intf; struct usb_interface *isoc; spinlock_t lock; @@ -826,6 +827,7 @@ static int btusb_probe(struct usb_interface *intf, } data->udev = interface_to_usbdev(intf); + data->intf = intf; spin_lock_init(&data->lock); @@ -894,7 +896,7 @@ static int btusb_probe(struct usb_interface *intf, if (data->isoc) { err = usb_driver_claim_interface(&btusb_driver, - data->isoc, NULL); + data->isoc, data); if (err < 0) { hci_free_dev(hdev); kfree(data); @@ -926,13 +928,22 @@ static void btusb_disconnect(struct usb_interface *intf) hdev = data->hdev; - if (data->isoc) - usb_driver_release_interface(&btusb_driver, data->isoc); + __hci_dev_hold(hdev); - usb_set_intfdata(intf, NULL); + usb_set_intfdata(data->intf, NULL); + + if (data->isoc) + usb_set_intfdata(data->isoc, NULL); hci_unregister_dev(hdev); + if (intf == data->isoc) + usb_driver_release_interface(&btusb_driver, data->intf); + else if (data->isoc) + usb_driver_release_interface(&btusb_driver, data->isoc); + + __hci_dev_put(hdev); + hci_free_dev(hdev); } -- cgit v1.2.3-70-g09d2 From ca330c5a913a9b1690c709f4cfcd6be0c8696b14 Mon Sep 17 00:00:00 2001 From: Ming Lei Date: Mon, 22 Sep 2008 19:21:51 -0700 Subject: hci_usb: replace mb with smp_mb smp_mb is enough for ordering memory operations among processors,and mb is more expensive than smp_mb for UP machine, so replace it with smp_mb(). Signed-off-by: Ming Lei Acked-by: Marcel Holtmann Signed-off-by: Andrew Morton Signed-off-by: David S. Miller --- drivers/bluetooth/hci_usb.h | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) (limited to 'drivers/bluetooth') diff --git a/drivers/bluetooth/hci_usb.h b/drivers/bluetooth/hci_usb.h index 1790cc8e431..8e659914523 100644 --- a/drivers/bluetooth/hci_usb.h +++ b/drivers/bluetooth/hci_usb.h @@ -70,8 +70,8 @@ static inline void _urb_queue_head(struct _urb_queue *q, struct _urb *_urb) { unsigned long flags; spin_lock_irqsave(&q->lock, flags); - /* _urb_unlink needs to know which spinlock to use, thus mb(). */ - _urb->queue = q; mb(); list_add(&_urb->list, &q->head); + /* _urb_unlink needs to know which spinlock to use, thus smp_mb(). */ + _urb->queue = q; smp_mb(); list_add(&_urb->list, &q->head); spin_unlock_irqrestore(&q->lock, flags); } @@ -79,8 +79,8 @@ static inline void _urb_queue_tail(struct _urb_queue *q, struct _urb *_urb) { unsigned long flags; spin_lock_irqsave(&q->lock, flags); - /* _urb_unlink needs to know which spinlock to use, thus mb(). */ - _urb->queue = q; mb(); list_add_tail(&_urb->list, &q->head); + /* _urb_unlink needs to know which spinlock to use, thus smp_mb(). */ + _urb->queue = q; smp_mb(); list_add_tail(&_urb->list, &q->head); spin_unlock_irqrestore(&q->lock, flags); } @@ -89,7 +89,7 @@ static inline void _urb_unlink(struct _urb *_urb) struct _urb_queue *q; unsigned long flags; - mb(); + smp_mb(); q = _urb->queue; /* If q is NULL, it will die at easy-to-debug NULL pointer dereference. No need to BUG(). */ -- cgit v1.2.3-70-g09d2 From 36010ff6788a058147ae15a1aebf97fd30fa51a9 Mon Sep 17 00:00:00 2001 From: Marcel Holtmann Date: Mon, 6 Oct 2008 12:22:51 +0200 Subject: [Bluetooth] Fix double frees on error paths of btusb and bpa10x drivers The transfer buffer of an URB will be automatically freed when using the URB_FREE_BUFFER transfer_flag. So the extra calls to kfree() will cause a double free. Reported-by: Justin Mattock Signed-off-by: Rabin Vincent Signed-off-by: Marcel Holtmann --- drivers/bluetooth/bpa10x.c | 2 -- drivers/bluetooth/btusb.c | 3 --- 2 files changed, 5 deletions(-) (limited to 'drivers/bluetooth') diff --git a/drivers/bluetooth/bpa10x.c b/drivers/bluetooth/bpa10x.c index 1e55a658e6c..32f3a8ed8d3 100644 --- a/drivers/bluetooth/bpa10x.c +++ b/drivers/bluetooth/bpa10x.c @@ -256,7 +256,6 @@ static inline int bpa10x_submit_intr_urb(struct hci_dev *hdev) BT_ERR("%s urb %p submission failed (%d)", hdev->name, urb, -err); usb_unanchor_urb(urb); - kfree(buf); } usb_free_urb(urb); @@ -298,7 +297,6 @@ static inline int bpa10x_submit_bulk_urb(struct hci_dev *hdev) BT_ERR("%s urb %p submission failed (%d)", hdev->name, urb, -err); usb_unanchor_urb(urb); - kfree(buf); } usb_free_urb(urb); diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c index 29ae99817c6..262e9bebebc 100644 --- a/drivers/bluetooth/btusb.c +++ b/drivers/bluetooth/btusb.c @@ -271,7 +271,6 @@ static int btusb_submit_intr_urb(struct hci_dev *hdev) BT_ERR("%s urb %p submission failed (%d)", hdev->name, urb, -err); usb_unanchor_urb(urb); - kfree(buf); } usb_free_urb(urb); @@ -354,7 +353,6 @@ static int btusb_submit_bulk_urb(struct hci_dev *hdev) BT_ERR("%s urb %p submission failed (%d)", hdev->name, urb, -err); usb_unanchor_urb(urb); - kfree(buf); } usb_free_urb(urb); @@ -475,7 +473,6 @@ static int btusb_submit_isoc_urb(struct hci_dev *hdev) BT_ERR("%s urb %p submission failed (%d)", hdev->name, urb, -err); usb_unanchor_urb(urb); - kfree(buf); } usb_free_urb(urb); -- cgit v1.2.3-70-g09d2 From 4f62f6cb93a58f77056daed73a7700fe467f7eb3 Mon Sep 17 00:00:00 2001 From: Marcel Holtmann Date: Mon, 6 Oct 2008 12:22:51 +0200 Subject: [Bluetooth] Add reset quirk for new Targus and Belkin dongles Targus and Belkin have come out with new Bluetooth 2.1 capable dongles using the latest BCM2046 chip from Broadcom. Both of them are so called HID proxy dongles and they need to send HCI_Reset before they become fully operational. Signed-off-by: Marcel Holtmann --- drivers/bluetooth/btusb.c | 4 ++++ 1 file changed, 4 insertions(+) (limited to 'drivers/bluetooth') diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c index 262e9bebebc..3f94af7b846 100644 --- a/drivers/bluetooth/btusb.c +++ b/drivers/bluetooth/btusb.c @@ -113,6 +113,7 @@ static struct usb_device_id blacklist_table[] = { /* Targus ACB10US */ { USB_DEVICE(0x0a5c, 0x2100), .driver_info = BTUSB_RESET }, + { USB_DEVICE(0x0a5c, 0x2154), .driver_info = BTUSB_RESET }, /* ANYCOM Bluetooth USB-200 and USB-250 */ { USB_DEVICE(0x0a5c, 0x2111), .driver_info = BTUSB_RESET }, @@ -150,6 +151,9 @@ static struct usb_device_id blacklist_table[] = { { USB_DEVICE(0x050d, 0x0012), .driver_info = BTUSB_RESET | BTUSB_WRONG_SCO_MTU }, { USB_DEVICE(0x050d, 0x0013), .driver_info = BTUSB_RESET | BTUSB_WRONG_SCO_MTU }, + /* Belkin F8T016 device */ + { USB_DEVICE(0x050d, 0x016a), .driver_info = BTUSB_RESET }, + /* Digianswer devices */ { USB_DEVICE(0x08fd, 0x0001), .driver_info = BTUSB_DIGIANSWER }, { USB_DEVICE(0x08fd, 0x0002), .driver_info = BTUSB_IGNORE }, -- cgit v1.2.3-70-g09d2 From 1305e9e7991d6c6b6aaa6e45f3f87363e6a66604 Mon Sep 17 00:00:00 2001 From: Marcel Holtmann Date: Mon, 6 Oct 2008 12:22:52 +0200 Subject: [Bluetooth] Add reset quirk for A-Link BlueUSB21 dongle The new A-Link Bluetooth dongle is another one based on the BCM2046 chip from Broadcom and it also needs to send HCI_Reset before it becomes fully operational. Without the quirk it will show a lot of I/O errors. Signed-off-by: Marcel Holtmann --- drivers/bluetooth/btusb.c | 1 + 1 file changed, 1 insertion(+) (limited to 'drivers/bluetooth') diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c index 3f94af7b846..af472e05273 100644 --- a/drivers/bluetooth/btusb.c +++ b/drivers/bluetooth/btusb.c @@ -102,6 +102,7 @@ static struct usb_device_id blacklist_table[] = { { USB_DEVICE(0x0a5c, 0x2101), .driver_info = BTUSB_RESET | BTUSB_WRONG_SCO_MTU }, /* Broadcom BCM2046 */ + { USB_DEVICE(0x0a5c, 0x2146), .driver_info = BTUSB_RESET }, { USB_DEVICE(0x0a5c, 0x2151), .driver_info = BTUSB_RESET }, /* Apple MacBook Pro with Broadcom chip */ -- cgit v1.2.3-70-g09d2