linux/drivers/bluetooth/btusb.c
<<
>>
Prefs
   1/*
   2 *
   3 *  Generic Bluetooth USB driver
   4 *
   5 *  Copyright (C) 2005-2008  Marcel Holtmann <marcel@holtmann.org>
   6 *
   7 *
   8 *  This program is free software; you can redistribute it and/or modify
   9 *  it under the terms of the GNU General Public License as published by
  10 *  the Free Software Foundation; either version 2 of the License, or
  11 *  (at your option) any later version.
  12 *
  13 *  This program is distributed in the hope that it will be useful,
  14 *  but WITHOUT ANY WARRANTY; without even the implied warranty of
  15 *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  16 *  GNU General Public License for more details.
  17 *
  18 *  You should have received a copy of the GNU General Public License
  19 *  along with this program; if not, write to the Free Software
  20 *  Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
  21 *
  22 */
  23
  24#include <linux/module.h>
  25#include <linux/usb.h>
  26
  27#include <net/bluetooth/bluetooth.h>
  28#include <net/bluetooth/hci_core.h>
  29
  30#define VERSION "0.6"
  31
  32static bool ignore_dga;
  33static bool ignore_csr;
  34static bool ignore_sniffer;
  35static bool disable_scofix;
  36static bool force_scofix;
  37
  38static bool reset = 1;
  39
  40static struct usb_driver btusb_driver;
  41
  42#define BTUSB_IGNORE            0x01
  43#define BTUSB_DIGIANSWER        0x02
  44#define BTUSB_CSR               0x04
  45#define BTUSB_SNIFFER           0x08
  46#define BTUSB_BCM92035          0x10
  47#define BTUSB_BROKEN_ISOC       0x20
  48#define BTUSB_WRONG_SCO_MTU     0x40
  49#define BTUSB_ATH3012           0x80
  50
  51static struct usb_device_id btusb_table[] = {
  52        /* Generic Bluetooth USB device */
  53        { USB_DEVICE_INFO(0xe0, 0x01, 0x01) },
  54
  55        /* Apple-specific (Broadcom) devices */
  56        { USB_VENDOR_AND_INTERFACE_INFO(0x05ac, 0xff, 0x01, 0x01) },
  57
  58        /* Broadcom SoftSailing reporting vendor specific */
  59        { USB_DEVICE(0x0a5c, 0x21e1) },
  60
  61        /* Apple MacBookPro 7,1 */
  62        { USB_DEVICE(0x05ac, 0x8213) },
  63
  64        /* Apple iMac11,1 */
  65        { USB_DEVICE(0x05ac, 0x8215) },
  66
  67        /* Apple MacBookPro6,2 */
  68        { USB_DEVICE(0x05ac, 0x8218) },
  69
  70        /* Apple MacBookAir3,1, MacBookAir3,2 */
  71        { USB_DEVICE(0x05ac, 0x821b) },
  72
  73        /* Apple MacBookAir4,1 */
  74        { USB_DEVICE(0x05ac, 0x821f) },
  75
  76        /* Apple MacBookPro8,2 */
  77        { USB_DEVICE(0x05ac, 0x821a) },
  78
  79        /* Apple MacMini5,1 */
  80        { USB_DEVICE(0x05ac, 0x8281) },
  81
  82        /* AVM BlueFRITZ! USB v2.0 */
  83        { USB_DEVICE(0x057c, 0x3800) },
  84
  85        /* Bluetooth Ultraport Module from IBM */
  86        { USB_DEVICE(0x04bf, 0x030a) },
  87
  88        /* ALPS Modules with non-standard id */
  89        { USB_DEVICE(0x044e, 0x3001) },
  90        { USB_DEVICE(0x044e, 0x3002) },
  91
  92        /* Ericsson with non-standard id */
  93        { USB_DEVICE(0x0bdb, 0x1002) },
  94
  95        /* Canyon CN-BTU1 with HID interfaces */
  96        { USB_DEVICE(0x0c10, 0x0000) },
  97
  98        /* Broadcom BCM20702A0 */
  99        { USB_DEVICE(0x0b05, 0x17b5) },
 100        { USB_DEVICE(0x04ca, 0x2003) },
 101        { USB_DEVICE(0x0489, 0xe042) },
 102        { USB_DEVICE(0x413c, 0x8197) },
 103
 104        /* Foxconn - Hon Hai */
 105        { USB_VENDOR_AND_INTERFACE_INFO(0x0489, 0xff, 0x01, 0x01) },
 106
 107        /*Broadcom devices with vendor specific id */
 108        { USB_VENDOR_AND_INTERFACE_INFO(0x0a5c, 0xff, 0x01, 0x01) },
 109
 110        { }     /* Terminating entry */
 111};
 112
 113MODULE_DEVICE_TABLE(usb, btusb_table);
 114
 115static struct usb_device_id blacklist_table[] = {
 116        /* CSR BlueCore devices */
 117        { USB_DEVICE(0x0a12, 0x0001), .driver_info = BTUSB_CSR },
 118
 119        /* Broadcom BCM2033 without firmware */
 120        { USB_DEVICE(0x0a5c, 0x2033), .driver_info = BTUSB_IGNORE },
 121
 122        /* Atheros 3011 with sflash firmware */
 123        { USB_DEVICE(0x0cf3, 0x3002), .driver_info = BTUSB_IGNORE },
 124        { USB_DEVICE(0x0cf3, 0xe019), .driver_info = BTUSB_IGNORE },
 125        { USB_DEVICE(0x13d3, 0x3304), .driver_info = BTUSB_IGNORE },
 126        { USB_DEVICE(0x0930, 0x0215), .driver_info = BTUSB_IGNORE },
 127        { USB_DEVICE(0x0489, 0xe03d), .driver_info = BTUSB_IGNORE },
 128        { USB_DEVICE(0x0489, 0xe027), .driver_info = BTUSB_IGNORE },
 129
 130        /* Atheros AR9285 Malbec with sflash firmware */
 131        { USB_DEVICE(0x03f0, 0x311d), .driver_info = BTUSB_IGNORE },
 132
 133        /* Atheros 3012 with sflash firmware */
 134        { USB_DEVICE(0x0cf3, 0x3004), .driver_info = BTUSB_ATH3012 },
 135        { USB_DEVICE(0x0cf3, 0x311d), .driver_info = BTUSB_ATH3012 },
 136        { USB_DEVICE(0x13d3, 0x3375), .driver_info = BTUSB_ATH3012 },
 137        { USB_DEVICE(0x04ca, 0x3005), .driver_info = BTUSB_ATH3012 },
 138        { USB_DEVICE(0x13d3, 0x3362), .driver_info = BTUSB_ATH3012 },
 139        { USB_DEVICE(0x0cf3, 0xe004), .driver_info = BTUSB_ATH3012 },
 140        { USB_DEVICE(0x0930, 0x0219), .driver_info = BTUSB_ATH3012 },
 141        { USB_DEVICE(0x0489, 0xe057), .driver_info = BTUSB_ATH3012 },
 142
 143        /* Atheros AR5BBU12 with sflash firmware */
 144        { USB_DEVICE(0x0489, 0xe02c), .driver_info = BTUSB_IGNORE },
 145
 146        /* Atheros AR5BBU12 with sflash firmware */
 147        { USB_DEVICE(0x0489, 0xe03c), .driver_info = BTUSB_ATH3012 },
 148        { USB_DEVICE(0x0489, 0xe036), .driver_info = BTUSB_ATH3012 },
 149
 150        /* Broadcom BCM2035 */
 151        { USB_DEVICE(0x0a5c, 0x2035), .driver_info = BTUSB_WRONG_SCO_MTU },
 152        { USB_DEVICE(0x0a5c, 0x200a), .driver_info = BTUSB_WRONG_SCO_MTU },
 153        { USB_DEVICE(0x0a5c, 0x2009), .driver_info = BTUSB_BCM92035 },
 154
 155        /* Broadcom BCM2045 */
 156        { USB_DEVICE(0x0a5c, 0x2039), .driver_info = BTUSB_WRONG_SCO_MTU },
 157        { USB_DEVICE(0x0a5c, 0x2101), .driver_info = BTUSB_WRONG_SCO_MTU },
 158
 159        /* IBM/Lenovo ThinkPad with Broadcom chip */
 160        { USB_DEVICE(0x0a5c, 0x201e), .driver_info = BTUSB_WRONG_SCO_MTU },
 161        { USB_DEVICE(0x0a5c, 0x2110), .driver_info = BTUSB_WRONG_SCO_MTU },
 162
 163        /* HP laptop with Broadcom chip */
 164        { USB_DEVICE(0x03f0, 0x171d), .driver_info = BTUSB_WRONG_SCO_MTU },
 165
 166        /* Dell laptop with Broadcom chip */
 167        { USB_DEVICE(0x413c, 0x8126), .driver_info = BTUSB_WRONG_SCO_MTU },
 168
 169        /* Dell Wireless 370 and 410 devices */
 170        { USB_DEVICE(0x413c, 0x8152), .driver_info = BTUSB_WRONG_SCO_MTU },
 171        { USB_DEVICE(0x413c, 0x8156), .driver_info = BTUSB_WRONG_SCO_MTU },
 172
 173        /* Belkin F8T012 and F8T013 devices */
 174        { USB_DEVICE(0x050d, 0x0012), .driver_info = BTUSB_WRONG_SCO_MTU },
 175        { USB_DEVICE(0x050d, 0x0013), .driver_info = BTUSB_WRONG_SCO_MTU },
 176
 177        /* Asus WL-BTD202 device */
 178        { USB_DEVICE(0x0b05, 0x1715), .driver_info = BTUSB_WRONG_SCO_MTU },
 179
 180        /* Kensington Bluetooth USB adapter */
 181        { USB_DEVICE(0x047d, 0x105e), .driver_info = BTUSB_WRONG_SCO_MTU },
 182
 183        /* RTX Telecom based adapters with buggy SCO support */
 184        { USB_DEVICE(0x0400, 0x0807), .driver_info = BTUSB_BROKEN_ISOC },
 185        { USB_DEVICE(0x0400, 0x080a), .driver_info = BTUSB_BROKEN_ISOC },
 186
 187        /* CONWISE Technology based adapters with buggy SCO support */
 188        { USB_DEVICE(0x0e5e, 0x6622), .driver_info = BTUSB_BROKEN_ISOC },
 189
 190        /* Digianswer devices */
 191        { USB_DEVICE(0x08fd, 0x0001), .driver_info = BTUSB_DIGIANSWER },
 192        { USB_DEVICE(0x08fd, 0x0002), .driver_info = BTUSB_IGNORE },
 193
 194        /* CSR BlueCore Bluetooth Sniffer */
 195        { USB_DEVICE(0x0a12, 0x0002), .driver_info = BTUSB_SNIFFER },
 196
 197        /* Frontline ComProbe Bluetooth Sniffer */
 198        { USB_DEVICE(0x16d3, 0x0002), .driver_info = BTUSB_SNIFFER },
 199
 200        { }     /* Terminating entry */
 201};
 202
 203#define BTUSB_MAX_ISOC_FRAMES   10
 204
 205#define BTUSB_INTR_RUNNING      0
 206#define BTUSB_BULK_RUNNING      1
 207#define BTUSB_ISOC_RUNNING      2
 208#define BTUSB_SUSPENDING        3
 209#define BTUSB_DID_ISO_RESUME    4
 210
 211struct btusb_data {
 212        struct hci_dev       *hdev;
 213        struct usb_device    *udev;
 214        struct usb_interface *intf;
 215        struct usb_interface *isoc;
 216
 217        spinlock_t lock;
 218
 219        unsigned long flags;
 220
 221        struct work_struct work;
 222        struct work_struct waker;
 223
 224        struct usb_anchor tx_anchor;
 225        struct usb_anchor intr_anchor;
 226        struct usb_anchor bulk_anchor;
 227        struct usb_anchor isoc_anchor;
 228        struct usb_anchor deferred;
 229        int tx_in_flight;
 230        spinlock_t txlock;
 231
 232        struct usb_endpoint_descriptor *intr_ep;
 233        struct usb_endpoint_descriptor *bulk_tx_ep;
 234        struct usb_endpoint_descriptor *bulk_rx_ep;
 235        struct usb_endpoint_descriptor *isoc_tx_ep;
 236        struct usb_endpoint_descriptor *isoc_rx_ep;
 237
 238        __u8 cmdreq_type;
 239
 240        unsigned int sco_num;
 241        int isoc_altsetting;
 242        int suspend_count;
 243};
 244
 245static int inc_tx(struct btusb_data *data)
 246{
 247        unsigned long flags;
 248        int rv;
 249
 250        spin_lock_irqsave(&data->txlock, flags);
 251        rv = test_bit(BTUSB_SUSPENDING, &data->flags);
 252        if (!rv)
 253                data->tx_in_flight++;
 254        spin_unlock_irqrestore(&data->txlock, flags);
 255
 256        return rv;
 257}
 258
 259static void btusb_intr_complete(struct urb *urb)
 260{
 261        struct hci_dev *hdev = urb->context;
 262        struct btusb_data *data = hci_get_drvdata(hdev);
 263        int err;
 264
 265        BT_DBG("%s urb %p status %d count %d", hdev->name,
 266                                        urb, urb->status, urb->actual_length);
 267
 268        if (!test_bit(HCI_RUNNING, &hdev->flags))
 269                return;
 270
 271        if (urb->status == 0) {
 272                hdev->stat.byte_rx += urb->actual_length;
 273
 274                if (hci_recv_fragment(hdev, HCI_EVENT_PKT,
 275                                                urb->transfer_buffer,
 276                                                urb->actual_length) < 0) {
 277                        BT_ERR("%s corrupted event packet", hdev->name);
 278                        hdev->stat.err_rx++;
 279                }
 280        }
 281
 282        if (!test_bit(BTUSB_INTR_RUNNING, &data->flags))
 283                return;
 284
 285        usb_mark_last_busy(data->udev);
 286        usb_anchor_urb(urb, &data->intr_anchor);
 287
 288        err = usb_submit_urb(urb, GFP_ATOMIC);
 289        if (err < 0) {
 290                /* -EPERM: urb is being killed;
 291                 * -ENODEV: device got disconnected */
 292                if (err != -EPERM && err != -ENODEV)
 293                        BT_ERR("%s urb %p failed to resubmit (%d)",
 294                                                hdev->name, urb, -err);
 295                usb_unanchor_urb(urb);
 296        }
 297}
 298
 299static int btusb_submit_intr_urb(struct hci_dev *hdev, gfp_t mem_flags)
 300{
 301        struct btusb_data *data = hci_get_drvdata(hdev);
 302        struct urb *urb;
 303        unsigned char *buf;
 304        unsigned int pipe;
 305        int err, size;
 306
 307        BT_DBG("%s", hdev->name);
 308
 309        if (!data->intr_ep)
 310                return -ENODEV;
 311
 312        urb = usb_alloc_urb(0, mem_flags);
 313        if (!urb)
 314                return -ENOMEM;
 315
 316        size = le16_to_cpu(data->intr_ep->wMaxPacketSize);
 317
 318        buf = kmalloc(size, mem_flags);
 319        if (!buf) {
 320                usb_free_urb(urb);
 321                return -ENOMEM;
 322        }
 323
 324        pipe = usb_rcvintpipe(data->udev, data->intr_ep->bEndpointAddress);
 325
 326        usb_fill_int_urb(urb, data->udev, pipe, buf, size,
 327                                                btusb_intr_complete, hdev,
 328                                                data->intr_ep->bInterval);
 329
 330        urb->transfer_flags |= URB_FREE_BUFFER;
 331
 332        usb_anchor_urb(urb, &data->intr_anchor);
 333
 334        err = usb_submit_urb(urb, mem_flags);
 335        if (err < 0) {
 336                if (err != -EPERM && err != -ENODEV)
 337                        BT_ERR("%s urb %p submission failed (%d)",
 338                                                hdev->name, urb, -err);
 339                usb_unanchor_urb(urb);
 340        }
 341
 342        usb_free_urb(urb);
 343
 344        return err;
 345}
 346
 347static void btusb_bulk_complete(struct urb *urb)
 348{
 349        struct hci_dev *hdev = urb->context;
 350        struct btusb_data *data = hci_get_drvdata(hdev);
 351        int err;
 352
 353        BT_DBG("%s urb %p status %d count %d", hdev->name,
 354                                        urb, urb->status, urb->actual_length);
 355
 356        if (!test_bit(HCI_RUNNING, &hdev->flags))
 357                return;
 358
 359        if (urb->status == 0) {
 360                hdev->stat.byte_rx += urb->actual_length;
 361
 362                if (hci_recv_fragment(hdev, HCI_ACLDATA_PKT,
 363                                                urb->transfer_buffer,
 364                                                urb->actual_length) < 0) {
 365                        BT_ERR("%s corrupted ACL packet", hdev->name);
 366                        hdev->stat.err_rx++;
 367                }
 368        }
 369
 370        if (!test_bit(BTUSB_BULK_RUNNING, &data->flags))
 371                return;
 372
 373        usb_anchor_urb(urb, &data->bulk_anchor);
 374        usb_mark_last_busy(data->udev);
 375
 376        err = usb_submit_urb(urb, GFP_ATOMIC);
 377        if (err < 0) {
 378                /* -EPERM: urb is being killed;
 379                 * -ENODEV: device got disconnected */
 380                if (err != -EPERM && err != -ENODEV)
 381                        BT_ERR("%s urb %p failed to resubmit (%d)",
 382                                                hdev->name, urb, -err);
 383                usb_unanchor_urb(urb);
 384        }
 385}
 386
 387static int btusb_submit_bulk_urb(struct hci_dev *hdev, gfp_t mem_flags)
 388{
 389        struct btusb_data *data = hci_get_drvdata(hdev);
 390        struct urb *urb;
 391        unsigned char *buf;
 392        unsigned int pipe;
 393        int err, size = HCI_MAX_FRAME_SIZE;
 394
 395        BT_DBG("%s", hdev->name);
 396
 397        if (!data->bulk_rx_ep)
 398                return -ENODEV;
 399
 400        urb = usb_alloc_urb(0, mem_flags);
 401        if (!urb)
 402                return -ENOMEM;
 403
 404        buf = kmalloc(size, mem_flags);
 405        if (!buf) {
 406                usb_free_urb(urb);
 407                return -ENOMEM;
 408        }
 409
 410        pipe = usb_rcvbulkpipe(data->udev, data->bulk_rx_ep->bEndpointAddress);
 411
 412        usb_fill_bulk_urb(urb, data->udev, pipe,
 413                                        buf, size, btusb_bulk_complete, hdev);
 414
 415        urb->transfer_flags |= URB_FREE_BUFFER;
 416
 417        usb_mark_last_busy(data->udev);
 418        usb_anchor_urb(urb, &data->bulk_anchor);
 419
 420        err = usb_submit_urb(urb, mem_flags);
 421        if (err < 0) {
 422                if (err != -EPERM && err != -ENODEV)
 423                        BT_ERR("%s urb %p submission failed (%d)",
 424                                                hdev->name, urb, -err);
 425                usb_unanchor_urb(urb);
 426        }
 427
 428        usb_free_urb(urb);
 429
 430        return err;
 431}
 432
 433static void btusb_isoc_complete(struct urb *urb)
 434{
 435        struct hci_dev *hdev = urb->context;
 436        struct btusb_data *data = hci_get_drvdata(hdev);
 437        int i, err;
 438
 439        BT_DBG("%s urb %p status %d count %d", hdev->name,
 440                                        urb, urb->status, urb->actual_length);
 441
 442        if (!test_bit(HCI_RUNNING, &hdev->flags))
 443                return;
 444
 445        if (urb->status == 0) {
 446                for (i = 0; i < urb->number_of_packets; i++) {
 447                        unsigned int offset = urb->iso_frame_desc[i].offset;
 448                        unsigned int length = urb->iso_frame_desc[i].actual_length;
 449
 450                        if (urb->iso_frame_desc[i].status)
 451                                continue;
 452
 453                        hdev->stat.byte_rx += length;
 454
 455                        if (hci_recv_fragment(hdev, HCI_SCODATA_PKT,
 456                                                urb->transfer_buffer + offset,
 457                                                                length) < 0) {
 458                                BT_ERR("%s corrupted SCO packet", hdev->name);
 459                                hdev->stat.err_rx++;
 460                        }
 461                }
 462        }
 463
 464        if (!test_bit(BTUSB_ISOC_RUNNING, &data->flags))
 465                return;
 466
 467        usb_anchor_urb(urb, &data->isoc_anchor);
 468
 469        err = usb_submit_urb(urb, GFP_ATOMIC);
 470        if (err < 0) {
 471                /* -EPERM: urb is being killed;
 472                 * -ENODEV: device got disconnected */
 473                if (err != -EPERM && err != -ENODEV)
 474                        BT_ERR("%s urb %p failed to resubmit (%d)",
 475                                                hdev->name, urb, -err);
 476                usb_unanchor_urb(urb);
 477        }
 478}
 479
 480static inline void __fill_isoc_descriptor(struct urb *urb, int len, int mtu)
 481{
 482        int i, offset = 0;
 483
 484        BT_DBG("len %d mtu %d", len, mtu);
 485
 486        for (i = 0; i < BTUSB_MAX_ISOC_FRAMES && len >= mtu;
 487                                        i++, offset += mtu, len -= mtu) {
 488                urb->iso_frame_desc[i].offset = offset;
 489                urb->iso_frame_desc[i].length = mtu;
 490        }
 491
 492        if (len && i < BTUSB_MAX_ISOC_FRAMES) {
 493                urb->iso_frame_desc[i].offset = offset;
 494                urb->iso_frame_desc[i].length = len;
 495                i++;
 496        }
 497
 498        urb->number_of_packets = i;
 499}
 500
 501static int btusb_submit_isoc_urb(struct hci_dev *hdev, gfp_t mem_flags)
 502{
 503        struct btusb_data *data = hci_get_drvdata(hdev);
 504        struct urb *urb;
 505        unsigned char *buf;
 506        unsigned int pipe;
 507        int err, size;
 508
 509        BT_DBG("%s", hdev->name);
 510
 511        if (!data->isoc_rx_ep)
 512                return -ENODEV;
 513
 514        urb = usb_alloc_urb(BTUSB_MAX_ISOC_FRAMES, mem_flags);
 515        if (!urb)
 516                return -ENOMEM;
 517
 518        size = le16_to_cpu(data->isoc_rx_ep->wMaxPacketSize) *
 519                                                BTUSB_MAX_ISOC_FRAMES;
 520
 521        buf = kmalloc(size, mem_flags);
 522        if (!buf) {
 523                usb_free_urb(urb);
 524                return -ENOMEM;
 525        }
 526
 527        pipe = usb_rcvisocpipe(data->udev, data->isoc_rx_ep->bEndpointAddress);
 528
 529        usb_fill_int_urb(urb, data->udev, pipe, buf, size, btusb_isoc_complete,
 530                                hdev, data->isoc_rx_ep->bInterval);
 531
 532        urb->transfer_flags  = URB_FREE_BUFFER | URB_ISO_ASAP;
 533
 534        __fill_isoc_descriptor(urb, size,
 535                        le16_to_cpu(data->isoc_rx_ep->wMaxPacketSize));
 536
 537        usb_anchor_urb(urb, &data->isoc_anchor);
 538
 539        err = usb_submit_urb(urb, mem_flags);
 540        if (err < 0) {
 541                if (err != -EPERM && err != -ENODEV)
 542                        BT_ERR("%s urb %p submission failed (%d)",
 543                                                hdev->name, urb, -err);
 544                usb_unanchor_urb(urb);
 545        }
 546
 547        usb_free_urb(urb);
 548
 549        return err;
 550}
 551
 552static void btusb_tx_complete(struct urb *urb)
 553{
 554        struct sk_buff *skb = urb->context;
 555        struct hci_dev *hdev = (struct hci_dev *) skb->dev;
 556        struct btusb_data *data = hci_get_drvdata(hdev);
 557
 558        BT_DBG("%s urb %p status %d count %d", hdev->name,
 559                                        urb, urb->status, urb->actual_length);
 560
 561        if (!test_bit(HCI_RUNNING, &hdev->flags))
 562                goto done;
 563
 564        if (!urb->status)
 565                hdev->stat.byte_tx += urb->transfer_buffer_length;
 566        else
 567                hdev->stat.err_tx++;
 568
 569done:
 570        spin_lock(&data->txlock);
 571        data->tx_in_flight--;
 572        spin_unlock(&data->txlock);
 573
 574        kfree(urb->setup_packet);
 575
 576        kfree_skb(skb);
 577}
 578
 579static void btusb_isoc_tx_complete(struct urb *urb)
 580{
 581        struct sk_buff *skb = urb->context;
 582        struct hci_dev *hdev = (struct hci_dev *) skb->dev;
 583
 584        BT_DBG("%s urb %p status %d count %d", hdev->name,
 585                                        urb, urb->status, urb->actual_length);
 586
 587        if (!test_bit(HCI_RUNNING, &hdev->flags))
 588                goto done;
 589
 590        if (!urb->status)
 591                hdev->stat.byte_tx += urb->transfer_buffer_length;
 592        else
 593                hdev->stat.err_tx++;
 594
 595done:
 596        kfree(urb->setup_packet);
 597
 598        kfree_skb(skb);
 599}
 600
 601static int btusb_open(struct hci_dev *hdev)
 602{
 603        struct btusb_data *data = hci_get_drvdata(hdev);
 604        int err;
 605
 606        BT_DBG("%s", hdev->name);
 607
 608        err = usb_autopm_get_interface(data->intf);
 609        if (err < 0)
 610                return err;
 611
 612        data->intf->needs_remote_wakeup = 1;
 613
 614        if (test_and_set_bit(HCI_RUNNING, &hdev->flags))
 615                goto done;
 616
 617        if (test_and_set_bit(BTUSB_INTR_RUNNING, &data->flags))
 618                goto done;
 619
 620        err = btusb_submit_intr_urb(hdev, GFP_KERNEL);
 621        if (err < 0)
 622                goto failed;
 623
 624        err = btusb_submit_bulk_urb(hdev, GFP_KERNEL);
 625        if (err < 0) {
 626                usb_kill_anchored_urbs(&data->intr_anchor);
 627                goto failed;
 628        }
 629
 630        set_bit(BTUSB_BULK_RUNNING, &data->flags);
 631        btusb_submit_bulk_urb(hdev, GFP_KERNEL);
 632
 633done:
 634        usb_autopm_put_interface(data->intf);
 635        return 0;
 636
 637failed:
 638        clear_bit(BTUSB_INTR_RUNNING, &data->flags);
 639        clear_bit(HCI_RUNNING, &hdev->flags);
 640        usb_autopm_put_interface(data->intf);
 641        return err;
 642}
 643
 644static void btusb_stop_traffic(struct btusb_data *data)
 645{
 646        usb_kill_anchored_urbs(&data->intr_anchor);
 647        usb_kill_anchored_urbs(&data->bulk_anchor);
 648        usb_kill_anchored_urbs(&data->isoc_anchor);
 649}
 650
 651static int btusb_close(struct hci_dev *hdev)
 652{
 653        struct btusb_data *data = hci_get_drvdata(hdev);
 654        int err;
 655
 656        BT_DBG("%s", hdev->name);
 657
 658        if (!test_and_clear_bit(HCI_RUNNING, &hdev->flags))
 659                return 0;
 660
 661        cancel_work_sync(&data->work);
 662        cancel_work_sync(&data->waker);
 663
 664        clear_bit(BTUSB_ISOC_RUNNING, &data->flags);
 665        clear_bit(BTUSB_BULK_RUNNING, &data->flags);
 666        clear_bit(BTUSB_INTR_RUNNING, &data->flags);
 667
 668        btusb_stop_traffic(data);
 669        err = usb_autopm_get_interface(data->intf);
 670        if (err < 0)
 671                goto failed;
 672
 673        data->intf->needs_remote_wakeup = 0;
 674        usb_autopm_put_interface(data->intf);
 675
 676failed:
 677        usb_scuttle_anchored_urbs(&data->deferred);
 678        return 0;
 679}
 680
 681static int btusb_flush(struct hci_dev *hdev)
 682{
 683        struct btusb_data *data = hci_get_drvdata(hdev);
 684
 685        BT_DBG("%s", hdev->name);
 686
 687        usb_kill_anchored_urbs(&data->tx_anchor);
 688
 689        return 0;
 690}
 691
 692static int btusb_send_frame(struct sk_buff *skb)
 693{
 694        struct hci_dev *hdev = (struct hci_dev *) skb->dev;
 695        struct btusb_data *data = hci_get_drvdata(hdev);
 696        struct usb_ctrlrequest *dr;
 697        struct urb *urb;
 698        unsigned int pipe;
 699        int err;
 700
 701        BT_DBG("%s", hdev->name);
 702
 703        if (!test_bit(HCI_RUNNING, &hdev->flags))
 704                return -EBUSY;
 705
 706        switch (bt_cb(skb)->pkt_type) {
 707        case HCI_COMMAND_PKT:
 708                urb = usb_alloc_urb(0, GFP_ATOMIC);
 709                if (!urb)
 710                        return -ENOMEM;
 711
 712                dr = kmalloc(sizeof(*dr), GFP_ATOMIC);
 713                if (!dr) {
 714                        usb_free_urb(urb);
 715                        return -ENOMEM;
 716                }
 717
 718                dr->bRequestType = data->cmdreq_type;
 719                dr->bRequest     = 0;
 720                dr->wIndex       = 0;
 721                dr->wValue       = 0;
 722                dr->wLength      = __cpu_to_le16(skb->len);
 723
 724                pipe = usb_sndctrlpipe(data->udev, 0x00);
 725
 726                usb_fill_control_urb(urb, data->udev, pipe, (void *) dr,
 727                                skb->data, skb->len, btusb_tx_complete, skb);
 728
 729                hdev->stat.cmd_tx++;
 730                break;
 731
 732        case HCI_ACLDATA_PKT:
 733                if (!data->bulk_tx_ep)
 734                        return -ENODEV;
 735
 736                urb = usb_alloc_urb(0, GFP_ATOMIC);
 737                if (!urb)
 738                        return -ENOMEM;
 739
 740                pipe = usb_sndbulkpipe(data->udev,
 741                                        data->bulk_tx_ep->bEndpointAddress);
 742
 743                usb_fill_bulk_urb(urb, data->udev, pipe,
 744                                skb->data, skb->len, btusb_tx_complete, skb);
 745
 746                hdev->stat.acl_tx++;
 747                break;
 748
 749        case HCI_SCODATA_PKT:
 750                if (!data->isoc_tx_ep || hdev->conn_hash.sco_num < 1)
 751                        return -ENODEV;
 752
 753                urb = usb_alloc_urb(BTUSB_MAX_ISOC_FRAMES, GFP_ATOMIC);
 754                if (!urb)
 755                        return -ENOMEM;
 756
 757                pipe = usb_sndisocpipe(data->udev,
 758                                        data->isoc_tx_ep->bEndpointAddress);
 759
 760                usb_fill_int_urb(urb, data->udev, pipe,
 761                                skb->data, skb->len, btusb_isoc_tx_complete,
 762                                skb, data->isoc_tx_ep->bInterval);
 763
 764                urb->transfer_flags  = URB_ISO_ASAP;
 765
 766                __fill_isoc_descriptor(urb, skb->len,
 767                                le16_to_cpu(data->isoc_tx_ep->wMaxPacketSize));
 768
 769                hdev->stat.sco_tx++;
 770                goto skip_waking;
 771
 772        default:
 773                return -EILSEQ;
 774        }
 775
 776        err = inc_tx(data);
 777        if (err) {
 778                usb_anchor_urb(urb, &data->deferred);
 779                schedule_work(&data->waker);
 780                err = 0;
 781                goto done;
 782        }
 783
 784skip_waking:
 785        usb_anchor_urb(urb, &data->tx_anchor);
 786
 787        err = usb_submit_urb(urb, GFP_ATOMIC);
 788        if (err < 0) {
 789                if (err != -EPERM && err != -ENODEV)
 790                        BT_ERR("%s urb %p submission failed (%d)",
 791                                                hdev->name, urb, -err);
 792                kfree(urb->setup_packet);
 793                usb_unanchor_urb(urb);
 794        } else {
 795                usb_mark_last_busy(data->udev);
 796        }
 797
 798done:
 799        usb_free_urb(urb);
 800        return err;
 801}
 802
 803static void btusb_notify(struct hci_dev *hdev, unsigned int evt)
 804{
 805        struct btusb_data *data = hci_get_drvdata(hdev);
 806
 807        BT_DBG("%s evt %d", hdev->name, evt);
 808
 809        if (hdev->conn_hash.sco_num != data->sco_num) {
 810                data->sco_num = hdev->conn_hash.sco_num;
 811                schedule_work(&data->work);
 812        }
 813}
 814
 815static inline int __set_isoc_interface(struct hci_dev *hdev, int altsetting)
 816{
 817        struct btusb_data *data = hci_get_drvdata(hdev);
 818        struct usb_interface *intf = data->isoc;
 819        struct usb_endpoint_descriptor *ep_desc;
 820        int i, err;
 821
 822        if (!data->isoc)
 823                return -ENODEV;
 824
 825        err = usb_set_interface(data->udev, 1, altsetting);
 826        if (err < 0) {
 827                BT_ERR("%s setting interface failed (%d)", hdev->name, -err);
 828                return err;
 829        }
 830
 831        data->isoc_altsetting = altsetting;
 832
 833        data->isoc_tx_ep = NULL;
 834        data->isoc_rx_ep = NULL;
 835
 836        for (i = 0; i < intf->cur_altsetting->desc.bNumEndpoints; i++) {
 837                ep_desc = &intf->cur_altsetting->endpoint[i].desc;
 838
 839                if (!data->isoc_tx_ep && usb_endpoint_is_isoc_out(ep_desc)) {
 840                        data->isoc_tx_ep = ep_desc;
 841                        continue;
 842                }
 843
 844                if (!data->isoc_rx_ep && usb_endpoint_is_isoc_in(ep_desc)) {
 845                        data->isoc_rx_ep = ep_desc;
 846                        continue;
 847                }
 848        }
 849
 850        if (!data->isoc_tx_ep || !data->isoc_rx_ep) {
 851                BT_ERR("%s invalid SCO descriptors", hdev->name);
 852                return -ENODEV;
 853        }
 854
 855        return 0;
 856}
 857
 858static void btusb_work(struct work_struct *work)
 859{
 860        struct btusb_data *data = container_of(work, struct btusb_data, work);
 861        struct hci_dev *hdev = data->hdev;
 862        int new_alts;
 863        int err;
 864
 865        if (hdev->conn_hash.sco_num > 0) {
 866                if (!test_bit(BTUSB_DID_ISO_RESUME, &data->flags)) {
 867                        err = usb_autopm_get_interface(data->isoc ? data->isoc : data->intf);
 868                        if (err < 0) {
 869                                clear_bit(BTUSB_ISOC_RUNNING, &data->flags);
 870                                usb_kill_anchored_urbs(&data->isoc_anchor);
 871                                return;
 872                        }
 873
 874                        set_bit(BTUSB_DID_ISO_RESUME, &data->flags);
 875                }
 876
 877                if (hdev->voice_setting & 0x0020) {
 878                        static const int alts[3] = { 2, 4, 5 };
 879                        new_alts = alts[hdev->conn_hash.sco_num - 1];
 880                } else {
 881                        new_alts = hdev->conn_hash.sco_num;
 882                }
 883
 884                if (data->isoc_altsetting != new_alts) {
 885                        clear_bit(BTUSB_ISOC_RUNNING, &data->flags);
 886                        usb_kill_anchored_urbs(&data->isoc_anchor);
 887
 888                        if (__set_isoc_interface(hdev, new_alts) < 0)
 889                                return;
 890                }
 891
 892                if (!test_and_set_bit(BTUSB_ISOC_RUNNING, &data->flags)) {
 893                        if (btusb_submit_isoc_urb(hdev, GFP_KERNEL) < 0)
 894                                clear_bit(BTUSB_ISOC_RUNNING, &data->flags);
 895                        else
 896                                btusb_submit_isoc_urb(hdev, GFP_KERNEL);
 897                }
 898        } else {
 899                clear_bit(BTUSB_ISOC_RUNNING, &data->flags);
 900                usb_kill_anchored_urbs(&data->isoc_anchor);
 901
 902                __set_isoc_interface(hdev, 0);
 903                if (test_and_clear_bit(BTUSB_DID_ISO_RESUME, &data->flags))
 904                        usb_autopm_put_interface(data->isoc ? data->isoc : data->intf);
 905        }
 906}
 907
 908static void btusb_waker(struct work_struct *work)
 909{
 910        struct btusb_data *data = container_of(work, struct btusb_data, waker);
 911        int err;
 912
 913        err = usb_autopm_get_interface(data->intf);
 914        if (err < 0)
 915                return;
 916
 917        usb_autopm_put_interface(data->intf);
 918}
 919
 920static int btusb_probe(struct usb_interface *intf,
 921                                const struct usb_device_id *id)
 922{
 923        struct usb_endpoint_descriptor *ep_desc;
 924        struct btusb_data *data;
 925        struct hci_dev *hdev;
 926        int i, err;
 927
 928        BT_DBG("intf %p id %p", intf, id);
 929
 930        /* interface numbers are hardcoded in the spec */
 931        if (intf->cur_altsetting->desc.bInterfaceNumber != 0)
 932                return -ENODEV;
 933
 934        if (!id->driver_info) {
 935                const struct usb_device_id *match;
 936                match = usb_match_id(intf, blacklist_table);
 937                if (match)
 938                        id = match;
 939        }
 940
 941        if (id->driver_info == BTUSB_IGNORE)
 942                return -ENODEV;
 943
 944        if (ignore_dga && id->driver_info & BTUSB_DIGIANSWER)
 945                return -ENODEV;
 946
 947        if (ignore_csr && id->driver_info & BTUSB_CSR)
 948                return -ENODEV;
 949
 950        if (ignore_sniffer && id->driver_info & BTUSB_SNIFFER)
 951                return -ENODEV;
 952
 953        if (id->driver_info & BTUSB_ATH3012) {
 954                struct usb_device *udev = interface_to_usbdev(intf);
 955
 956                /* Old firmware would otherwise let ath3k driver load
 957                 * patch and sysconfig files */
 958                if (le16_to_cpu(udev->descriptor.bcdDevice) <= 0x0001)
 959                        return -ENODEV;
 960        }
 961
 962        data = devm_kzalloc(&intf->dev, sizeof(*data), GFP_KERNEL);
 963        if (!data)
 964                return -ENOMEM;
 965
 966        for (i = 0; i < intf->cur_altsetting->desc.bNumEndpoints; i++) {
 967                ep_desc = &intf->cur_altsetting->endpoint[i].desc;
 968
 969                if (!data->intr_ep && usb_endpoint_is_int_in(ep_desc)) {
 970                        data->intr_ep = ep_desc;
 971                        continue;
 972                }
 973
 974                if (!data->bulk_tx_ep && usb_endpoint_is_bulk_out(ep_desc)) {
 975                        data->bulk_tx_ep = ep_desc;
 976                        continue;
 977                }
 978
 979                if (!data->bulk_rx_ep && usb_endpoint_is_bulk_in(ep_desc)) {
 980                        data->bulk_rx_ep = ep_desc;
 981                        continue;
 982                }
 983        }
 984
 985        if (!data->intr_ep || !data->bulk_tx_ep || !data->bulk_rx_ep)
 986                return -ENODEV;
 987
 988        data->cmdreq_type = USB_TYPE_CLASS;
 989
 990        data->udev = interface_to_usbdev(intf);
 991        data->intf = intf;
 992
 993        spin_lock_init(&data->lock);
 994
 995        INIT_WORK(&data->work, btusb_work);
 996        INIT_WORK(&data->waker, btusb_waker);
 997        spin_lock_init(&data->txlock);
 998
 999        init_usb_anchor(&data->tx_anchor);
1000        init_usb_anchor(&data->intr_anchor);
1001        init_usb_anchor(&data->bulk_anchor);
1002        init_usb_anchor(&data->isoc_anchor);
1003        init_usb_anchor(&data->deferred);
1004
1005        hdev = hci_alloc_dev();
1006        if (!hdev)
1007                return -ENOMEM;
1008
1009        hdev->bus = HCI_USB;
1010        hci_set_drvdata(hdev, data);
1011
1012        data->hdev = hdev;
1013
1014        SET_HCIDEV_DEV(hdev, &intf->dev);
1015
1016        hdev->open     = btusb_open;
1017        hdev->close    = btusb_close;
1018        hdev->flush    = btusb_flush;
1019        hdev->send     = btusb_send_frame;
1020        hdev->notify   = btusb_notify;
1021
1022        /* Interface numbers are hardcoded in the specification */
1023        data->isoc = usb_ifnum_to_if(data->udev, 1);
1024
1025        if (!reset)
1026                set_bit(HCI_QUIRK_RESET_ON_CLOSE, &hdev->quirks);
1027
1028        if (force_scofix || id->driver_info & BTUSB_WRONG_SCO_MTU) {
1029                if (!disable_scofix)
1030                        set_bit(HCI_QUIRK_FIXUP_BUFFER_SIZE, &hdev->quirks);
1031        }
1032
1033        if (id->driver_info & BTUSB_BROKEN_ISOC)
1034                data->isoc = NULL;
1035
1036        if (id->driver_info & BTUSB_DIGIANSWER) {
1037                data->cmdreq_type = USB_TYPE_VENDOR;
1038                set_bit(HCI_QUIRK_RESET_ON_CLOSE, &hdev->quirks);
1039        }
1040
1041        if (id->driver_info & BTUSB_CSR) {
1042                struct usb_device *udev = data->udev;
1043
1044                /* Old firmware would otherwise execute USB reset */
1045                if (le16_to_cpu(udev->descriptor.bcdDevice) < 0x117)
1046                        set_bit(HCI_QUIRK_RESET_ON_CLOSE, &hdev->quirks);
1047        }
1048
1049        if (id->driver_info & BTUSB_SNIFFER) {
1050                struct usb_device *udev = data->udev;
1051
1052                /* New sniffer firmware has crippled HCI interface */
1053                if (le16_to_cpu(udev->descriptor.bcdDevice) > 0x997)
1054                        set_bit(HCI_QUIRK_RAW_DEVICE, &hdev->quirks);
1055
1056                data->isoc = NULL;
1057        }
1058
1059        if (id->driver_info & BTUSB_BCM92035) {
1060                unsigned char cmd[] = { 0x3b, 0xfc, 0x01, 0x00 };
1061                struct sk_buff *skb;
1062
1063                skb = bt_skb_alloc(sizeof(cmd), GFP_KERNEL);
1064                if (skb) {
1065                        memcpy(skb_put(skb, sizeof(cmd)), cmd, sizeof(cmd));
1066                        skb_queue_tail(&hdev->driver_init, skb);
1067                }
1068        }
1069
1070        if (data->isoc) {
1071                err = usb_driver_claim_interface(&btusb_driver,
1072                                                        data->isoc, data);
1073                if (err < 0) {
1074                        hci_free_dev(hdev);
1075                        return err;
1076                }
1077        }
1078
1079        err = hci_register_dev(hdev);
1080        if (err < 0) {
1081                hci_free_dev(hdev);
1082                return err;
1083        }
1084
1085        usb_set_intfdata(intf, data);
1086
1087        return 0;
1088}
1089
1090static void btusb_disconnect(struct usb_interface *intf)
1091{
1092        struct btusb_data *data = usb_get_intfdata(intf);
1093        struct hci_dev *hdev;
1094
1095        BT_DBG("intf %p", intf);
1096
1097        if (!data)
1098                return;
1099
1100        hdev = data->hdev;
1101        usb_set_intfdata(data->intf, NULL);
1102
1103        if (data->isoc)
1104                usb_set_intfdata(data->isoc, NULL);
1105
1106        hci_unregister_dev(hdev);
1107
1108        if (intf == data->isoc)
1109                usb_driver_release_interface(&btusb_driver, data->intf);
1110        else if (data->isoc)
1111                usb_driver_release_interface(&btusb_driver, data->isoc);
1112
1113        hci_free_dev(hdev);
1114}
1115
1116#ifdef CONFIG_PM
1117static int btusb_suspend(struct usb_interface *intf, pm_message_t message)
1118{
1119        struct btusb_data *data = usb_get_intfdata(intf);
1120
1121        BT_DBG("intf %p", intf);
1122
1123        if (data->suspend_count++)
1124                return 0;
1125
1126        spin_lock_irq(&data->txlock);
1127        if (!(PMSG_IS_AUTO(message) && data->tx_in_flight)) {
1128                set_bit(BTUSB_SUSPENDING, &data->flags);
1129                spin_unlock_irq(&data->txlock);
1130        } else {
1131                spin_unlock_irq(&data->txlock);
1132                data->suspend_count--;
1133                return -EBUSY;
1134        }
1135
1136        cancel_work_sync(&data->work);
1137
1138        btusb_stop_traffic(data);
1139        usb_kill_anchored_urbs(&data->tx_anchor);
1140
1141        return 0;
1142}
1143
1144static void play_deferred(struct btusb_data *data)
1145{
1146        struct urb *urb;
1147        int err;
1148
1149        while ((urb = usb_get_from_anchor(&data->deferred))) {
1150                err = usb_submit_urb(urb, GFP_ATOMIC);
1151                if (err < 0)
1152                        break;
1153
1154                data->tx_in_flight++;
1155        }
1156        usb_scuttle_anchored_urbs(&data->deferred);
1157}
1158
1159static int btusb_resume(struct usb_interface *intf)
1160{
1161        struct btusb_data *data = usb_get_intfdata(intf);
1162        struct hci_dev *hdev = data->hdev;
1163        int err = 0;
1164
1165        BT_DBG("intf %p", intf);
1166
1167        if (--data->suspend_count)
1168                return 0;
1169
1170        if (!test_bit(HCI_RUNNING, &hdev->flags))
1171                goto done;
1172
1173        if (test_bit(BTUSB_INTR_RUNNING, &data->flags)) {
1174                err = btusb_submit_intr_urb(hdev, GFP_NOIO);
1175                if (err < 0) {
1176                        clear_bit(BTUSB_INTR_RUNNING, &data->flags);
1177                        goto failed;
1178                }
1179        }
1180
1181        if (test_bit(BTUSB_BULK_RUNNING, &data->flags)) {
1182                err = btusb_submit_bulk_urb(hdev, GFP_NOIO);
1183                if (err < 0) {
1184                        clear_bit(BTUSB_BULK_RUNNING, &data->flags);
1185                        goto failed;
1186                }
1187
1188                btusb_submit_bulk_urb(hdev, GFP_NOIO);
1189        }
1190
1191        if (test_bit(BTUSB_ISOC_RUNNING, &data->flags)) {
1192                if (btusb_submit_isoc_urb(hdev, GFP_NOIO) < 0)
1193                        clear_bit(BTUSB_ISOC_RUNNING, &data->flags);
1194                else
1195                        btusb_submit_isoc_urb(hdev, GFP_NOIO);
1196        }
1197
1198        spin_lock_irq(&data->txlock);
1199        play_deferred(data);
1200        clear_bit(BTUSB_SUSPENDING, &data->flags);
1201        spin_unlock_irq(&data->txlock);
1202        schedule_work(&data->work);
1203
1204        return 0;
1205
1206failed:
1207        usb_scuttle_anchored_urbs(&data->deferred);
1208done:
1209        spin_lock_irq(&data->txlock);
1210        clear_bit(BTUSB_SUSPENDING, &data->flags);
1211        spin_unlock_irq(&data->txlock);
1212
1213        return err;
1214}
1215#endif
1216
1217static struct usb_driver btusb_driver = {
1218        .name           = "btusb",
1219        .probe          = btusb_probe,
1220        .disconnect     = btusb_disconnect,
1221#ifdef CONFIG_PM
1222        .suspend        = btusb_suspend,
1223        .resume         = btusb_resume,
1224#endif
1225        .id_table       = btusb_table,
1226        .supports_autosuspend = 1,
1227        .disable_hub_initiated_lpm = 1,
1228};
1229
1230module_usb_driver(btusb_driver);
1231
1232module_param(ignore_dga, bool, 0644);
1233MODULE_PARM_DESC(ignore_dga, "Ignore devices with id 08fd:0001");
1234
1235module_param(ignore_csr, bool, 0644);
1236MODULE_PARM_DESC(ignore_csr, "Ignore devices with id 0a12:0001");
1237
1238module_param(ignore_sniffer, bool, 0644);
1239MODULE_PARM_DESC(ignore_sniffer, "Ignore devices with id 0a12:0002");
1240
1241module_param(disable_scofix, bool, 0644);
1242MODULE_PARM_DESC(disable_scofix, "Disable fixup of wrong SCO buffer size");
1243
1244module_param(force_scofix, bool, 0644);
1245MODULE_PARM_DESC(force_scofix, "Force fixup of wrong SCO buffers size");
1246
1247module_param(reset, bool, 0644);
1248MODULE_PARM_DESC(reset, "Send HCI reset command on initialization");
1249
1250MODULE_AUTHOR("Marcel Holtmann <marcel@holtmann.org>");
1251MODULE_DESCRIPTION("Generic Bluetooth USB driver ver " VERSION);
1252MODULE_VERSION(VERSION);
1253MODULE_LICENSE("GPL");
1254
lxr.linux.no kindly hosted by Redpill Linpro AS, provider of Linux consulting and operations services since 1995.