?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
fix a kmap leak in virtio_console
[linux/fpc-iii.git] / drivers / bluetooth / bpa10x.c
blob8a319913c9a96fd60c6d021c5edd055b83ef0aad
1 /*
2 *
3 * Digianswer Bluetooth USB driver
4 *
5 * Copyright (C) 2004-2007 Marcel Holtmann <marcel@holtmann.org>
6 *
7 *
8 * This program is free software; you can redistribute it and/or modify
9 * it under the terms of the GNU General Public License as published by
10 * the Free Software Foundation; either version 2 of the License, or
11 * (at your option) any later version.
12 *
13 * This program is distributed in the hope that it will be useful,
14 * but WITHOUT ANY WARRANTY; without even the implied warranty of
15 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
16 * GNU General Public License for more details.
17 *
18 * You should have received a copy of the GNU General Public License
19 * along with this program; if not, write to the Free Software
20 * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
21 *
22 */
23
24 #include <linux/kernel.h>
25 #include <linux/module.h>
26 #include <linux/init.h>
27 #include <linux/slab.h>
28 #include <linux/types.h>
29 #include <linux/sched.h>
30 #include <linux/errno.h>
31 #include <linux/skbuff.h>
32
33 #include <linux/usb.h>
34
35 #include <net/bluetooth/bluetooth.h>
36 #include <net/bluetooth/hci_core.h>
37
38 #define VERSION "0.10"
39
40 static const struct usb_device_id bpa10x_table[] = {
41 /* Tektronix BPA 100/105 (Digianswer) */
42 { USB_DEVICE(0x08fd, 0x0002) },
43
44 { } /* Terminating entry */
45 };
46
47 MODULE_DEVICE_TABLE(usb, bpa10x_table);
48
49 struct bpa10x_data {
50 struct hci_dev *hdev;
51 struct usb_device *udev;
52
53 struct usb_anchor tx_anchor;
54 struct usb_anchor rx_anchor;
55
56 struct sk_buff *rx_skb[2];
57 };
58
59 #define HCI_VENDOR_HDR_SIZE 5
60
61 struct hci_vendor_hdr {
62 __u8 type;
63 __le16 snum;
64 __le16 dlen;
65 } __packed;
66
67 static int bpa10x_recv(struct hci_dev *hdev, int queue, void *buf, int count)
68 {
69 struct bpa10x_data *data = hci_get_drvdata(hdev);
70
71 BT_DBG("%s queue %d buffer %p count %d", hdev->name,
72 queue, buf, count);
73
74 if (queue < 0 || queue > 1)
75 return -EILSEQ;
76
77 hdev->stat.byte_rx += count;
78
79 while (count) {
80 struct sk_buff *skb = data->rx_skb[queue];
81 struct { __u8 type; int expect; } *scb;
82 int type, len = 0;
83
84 if (!skb) {
85 /* Start of the frame */
86
87 type = *((__u8 *) buf);
88 count--; buf++;
89
90 switch (type) {
91 case HCI_EVENT_PKT:
92 if (count >= HCI_EVENT_HDR_SIZE) {
93 struct hci_event_hdr *h = buf;
94 len = HCI_EVENT_HDR_SIZE + h->plen;
95 } else
96 return -EILSEQ;
97 break;
98
99 case HCI_ACLDATA_PKT:
100 if (count >= HCI_ACL_HDR_SIZE) {
101 struct hci_acl_hdr *h = buf;
102 len = HCI_ACL_HDR_SIZE +
103 __le16_to_cpu(h->dlen);
104 } else
105 return -EILSEQ;
106 break;
107
108 case HCI_SCODATA_PKT:
109 if (count >= HCI_SCO_HDR_SIZE) {
110 struct hci_sco_hdr *h = buf;
111 len = HCI_SCO_HDR_SIZE + h->dlen;
112 } else
113 return -EILSEQ;
114 break;
115
116 case HCI_VENDOR_PKT:
117 if (count >= HCI_VENDOR_HDR_SIZE) {
118 struct hci_vendor_hdr *h = buf;
119 len = HCI_VENDOR_HDR_SIZE +
120 __le16_to_cpu(h->dlen);
121 } else
122 return -EILSEQ;
123 break;
124 }
125
126 skb = bt_skb_alloc(len, GFP_ATOMIC);
127 if (!skb) {
128 BT_ERR("%s no memory for packet", hdev->name);
129 return -ENOMEM;
130 }
131
132 data->rx_skb[queue] = skb;
133
134 scb = (void *) skb->cb;
135 scb->type = type;
136 scb->expect = len;
137 } else {
138 /* Continuation */
139
140 scb = (void *) skb->cb;
141 len = scb->expect;
142 }
143
144 len = min(len, count);
145
146 memcpy(skb_put(skb, len), buf, len);
147
148 scb->expect -= len;
149
150 if (scb->expect == 0) {
151 /* Complete frame */
152
153 data->rx_skb[queue] = NULL;
154
155 bt_cb(skb)->pkt_type = scb->type;
156 hci_recv_frame(hdev, skb);
157 }
158
159 count -= len; buf += len;
160 }
161
162 return 0;
163 }
164
165 static void bpa10x_tx_complete(struct urb *urb)
166 {
167 struct sk_buff *skb = urb->context;
168 struct hci_dev *hdev = (struct hci_dev *) skb->dev;
169
170 BT_DBG("%s urb %p status %d count %d", hdev->name,
171 urb, urb->status, urb->actual_length);
172
173 if (!test_bit(HCI_RUNNING, &hdev->flags))
174 goto done;
175
176 if (!urb->status)
177 hdev->stat.byte_tx += urb->transfer_buffer_length;
178 else
179 hdev->stat.err_tx++;
180
181 done:
182 kfree(urb->setup_packet);
183
184 kfree_skb(skb);
185 }
186
187 static void bpa10x_rx_complete(struct urb *urb)
188 {
189 struct hci_dev *hdev = urb->context;
190 struct bpa10x_data *data = hci_get_drvdata(hdev);
191 int err;
192
193 BT_DBG("%s urb %p status %d count %d", hdev->name,
194 urb, urb->status, urb->actual_length);
195
196 if (!test_bit(HCI_RUNNING, &hdev->flags))
197 return;
198
199 if (urb->status == 0) {
200 if (bpa10x_recv(hdev, usb_pipebulk(urb->pipe),
201 urb->transfer_buffer,
202 urb->actual_length) < 0) {
203 BT_ERR("%s corrupted event packet", hdev->name);
204 hdev->stat.err_rx++;
205 }
206 }
207
208 usb_anchor_urb(urb, &data->rx_anchor);
209
210 err = usb_submit_urb(urb, GFP_ATOMIC);
211 if (err < 0) {
212 BT_ERR("%s urb %p failed to resubmit (%d)",
213 hdev->name, urb, -err);
214 usb_unanchor_urb(urb);
215 }
216 }
217
218 static inline int bpa10x_submit_intr_urb(struct hci_dev *hdev)
219 {
220 struct bpa10x_data *data = hci_get_drvdata(hdev);
221 struct urb *urb;
222 unsigned char *buf;
223 unsigned int pipe;
224 int err, size = 16;
225
226 BT_DBG("%s", hdev->name);
227
228 urb = usb_alloc_urb(0, GFP_KERNEL);
229 if (!urb)
230 return -ENOMEM;
231
232 buf = kmalloc(size, GFP_KERNEL);
233 if (!buf) {
234 usb_free_urb(urb);
235 return -ENOMEM;
236 }
237
238 pipe = usb_rcvintpipe(data->udev, 0x81);
239
240 usb_fill_int_urb(urb, data->udev, pipe, buf, size,
241 bpa10x_rx_complete, hdev, 1);
242
243 urb->transfer_flags |= URB_FREE_BUFFER;
244
245 usb_anchor_urb(urb, &data->rx_anchor);
246
247 err = usb_submit_urb(urb, GFP_KERNEL);
248 if (err < 0) {
249 BT_ERR("%s urb %p submission failed (%d)",
250 hdev->name, urb, -err);
251 usb_unanchor_urb(urb);
252 }
253
254 usb_free_urb(urb);
255
256 return err;
257 }
258
259 static inline int bpa10x_submit_bulk_urb(struct hci_dev *hdev)
260 {
261 struct bpa10x_data *data = hci_get_drvdata(hdev);
262 struct urb *urb;
263 unsigned char *buf;
264 unsigned int pipe;
265 int err, size = 64;
266
267 BT_DBG("%s", hdev->name);
268
269 urb = usb_alloc_urb(0, GFP_KERNEL);
270 if (!urb)
271 return -ENOMEM;
272
273 buf = kmalloc(size, GFP_KERNEL);
274 if (!buf) {
275 usb_free_urb(urb);
276 return -ENOMEM;
277 }
278
279 pipe = usb_rcvbulkpipe(data->udev, 0x82);
280
281 usb_fill_bulk_urb(urb, data->udev, pipe,
282 buf, size, bpa10x_rx_complete, hdev);
283
284 urb->transfer_flags |= URB_FREE_BUFFER;
285
286 usb_anchor_urb(urb, &data->rx_anchor);
287
288 err = usb_submit_urb(urb, GFP_KERNEL);
289 if (err < 0) {
290 BT_ERR("%s urb %p submission failed (%d)",
291 hdev->name, urb, -err);
292 usb_unanchor_urb(urb);
293 }
294
295 usb_free_urb(urb);
296
297 return err;
298 }
299
300 static int bpa10x_open(struct hci_dev *hdev)
301 {
302 struct bpa10x_data *data = hci_get_drvdata(hdev);
303 int err;
304
305 BT_DBG("%s", hdev->name);
306
307 if (test_and_set_bit(HCI_RUNNING, &hdev->flags))
308 return 0;
309
310 err = bpa10x_submit_intr_urb(hdev);
311 if (err < 0)
312 goto error;
313
314 err = bpa10x_submit_bulk_urb(hdev);
315 if (err < 0)
316 goto error;
317
318 return 0;
319
320 error:
321 usb_kill_anchored_urbs(&data->rx_anchor);
322
323 clear_bit(HCI_RUNNING, &hdev->flags);
324
325 return err;
326 }
327
328 static int bpa10x_close(struct hci_dev *hdev)
329 {
330 struct bpa10x_data *data = hci_get_drvdata(hdev);
331
332 BT_DBG("%s", hdev->name);
333
334 if (!test_and_clear_bit(HCI_RUNNING, &hdev->flags))
335 return 0;
336
337 usb_kill_anchored_urbs(&data->rx_anchor);
338
339 return 0;
340 }
341
342 static int bpa10x_flush(struct hci_dev *hdev)
343 {
344 struct bpa10x_data *data = hci_get_drvdata(hdev);
345
346 BT_DBG("%s", hdev->name);
347
348 usb_kill_anchored_urbs(&data->tx_anchor);
349
350 return 0;
351 }
352
353 static int bpa10x_send_frame(struct hci_dev *hdev, struct sk_buff *skb)
354 {
355 struct bpa10x_data *data = hci_get_drvdata(hdev);
356 struct usb_ctrlrequest *dr;
357 struct urb *urb;
358 unsigned int pipe;
359 int err;
360
361 BT_DBG("%s", hdev->name);
362
363 if (!test_bit(HCI_RUNNING, &hdev->flags))
364 return -EBUSY;
365
366 skb->dev = (void *) hdev;
367
368 urb = usb_alloc_urb(0, GFP_ATOMIC);
369 if (!urb)
370 return -ENOMEM;
371
372 /* Prepend skb with frame type */
373 *skb_push(skb, 1) = bt_cb(skb)->pkt_type;
374
375 switch (bt_cb(skb)->pkt_type) {
376 case HCI_COMMAND_PKT:
377 dr = kmalloc(sizeof(*dr), GFP_ATOMIC);
378 if (!dr) {
379 usb_free_urb(urb);
380 return -ENOMEM;
381 }
382
383 dr->bRequestType = USB_TYPE_VENDOR;
384 dr->bRequest = 0;
385 dr->wIndex = 0;
386 dr->wValue = 0;
387 dr->wLength = __cpu_to_le16(skb->len);
388
389 pipe = usb_sndctrlpipe(data->udev, 0x00);
390
391 usb_fill_control_urb(urb, data->udev, pipe, (void *) dr,
392 skb->data, skb->len, bpa10x_tx_complete, skb);
393
394 hdev->stat.cmd_tx++;
395 break;
396
397 case HCI_ACLDATA_PKT:
398 pipe = usb_sndbulkpipe(data->udev, 0x02);
399
400 usb_fill_bulk_urb(urb, data->udev, pipe,
401 skb->data, skb->len, bpa10x_tx_complete, skb);
402
403 hdev->stat.acl_tx++;
404 break;
405
406 case HCI_SCODATA_PKT:
407 pipe = usb_sndbulkpipe(data->udev, 0x02);
408
409 usb_fill_bulk_urb(urb, data->udev, pipe,
410 skb->data, skb->len, bpa10x_tx_complete, skb);
411
412 hdev->stat.sco_tx++;
413 break;
414
415 default:
416 usb_free_urb(urb);
417 return -EILSEQ;
418 }
419
420 usb_anchor_urb(urb, &data->tx_anchor);
421
422 err = usb_submit_urb(urb, GFP_ATOMIC);
423 if (err < 0) {
424 BT_ERR("%s urb %p submission failed", hdev->name, urb);
425 kfree(urb->setup_packet);
426 usb_unanchor_urb(urb);
427 }
428
429 usb_free_urb(urb);
430
431 return 0;
432 }
433
434 static int bpa10x_probe(struct usb_interface *intf, const struct usb_device_id *id)
435 {
436 struct bpa10x_data *data;
437 struct hci_dev *hdev;
438 int err;
439
440 BT_DBG("intf %p id %p", intf, id);
441
442 if (intf->cur_altsetting->desc.bInterfaceNumber != 0)
443 return -ENODEV;
444
445 data = devm_kzalloc(&intf->dev, sizeof(*data), GFP_KERNEL);
446 if (!data)
447 return -ENOMEM;
448
449 data->udev = interface_to_usbdev(intf);
450
451 init_usb_anchor(&data->tx_anchor);
452 init_usb_anchor(&data->rx_anchor);
453
454 hdev = hci_alloc_dev();
455 if (!hdev)
456 return -ENOMEM;
457
458 hdev->bus = HCI_USB;
459 hci_set_drvdata(hdev, data);
460
461 data->hdev = hdev;
462
463 SET_HCIDEV_DEV(hdev, &intf->dev);
464
465 hdev->open = bpa10x_open;
466 hdev->close = bpa10x_close;
467 hdev->flush = bpa10x_flush;
468 hdev->send = bpa10x_send_frame;
469
470 set_bit(HCI_QUIRK_RESET_ON_CLOSE, &hdev->quirks);
471
472 err = hci_register_dev(hdev);
473 if (err < 0) {
474 hci_free_dev(hdev);
475 return err;
476 }
477
478 usb_set_intfdata(intf, data);
479
480 return 0;
481 }
482
483 static void bpa10x_disconnect(struct usb_interface *intf)
484 {
485 struct bpa10x_data *data = usb_get_intfdata(intf);
486
487 BT_DBG("intf %p", intf);
488
489 if (!data)
490 return;
491
492 usb_set_intfdata(intf, NULL);
493
494 hci_unregister_dev(data->hdev);
495
496 hci_free_dev(data->hdev);
497 kfree_skb(data->rx_skb[0]);
498 kfree_skb(data->rx_skb[1]);
499 }
500
501 static struct usb_driver bpa10x_driver = {
502 .name = "bpa10x",
503 .probe = bpa10x_probe,
504 .disconnect = bpa10x_disconnect,
505 .id_table = bpa10x_table,
506 .disable_hub_initiated_lpm = 1,
507 };
508
509 module_usb_driver(bpa10x_driver);
510
511 MODULE_AUTHOR("Marcel Holtmann <marcel@holtmann.org>");
512 MODULE_DESCRIPTION("Digianswer Bluetooth USB driver ver " VERSION);
513 MODULE_VERSION(VERSION);
514 MODULE_LICENSE("GPL");
Linux with added FPC-III support