[PATCH] cyblafb: portability fixes, sanitized work with pointers
[linux-2.6] / drivers / bluetooth / bpa10x.c
1 /*
2  *
3  *  Digianswer Bluetooth USB driver
4  *
5  *  Copyright (C) 2004-2005  Marcel Holtmann <marcel@holtmann.org>
6  *
7  *
8  *  This program is free software; you can redistribute it and/or modify
9  *  it under the terms of the GNU General Public License as published by
10  *  the Free Software Foundation; either version 2 of the License, or
11  *  (at your option) any later version.
12  *
13  *  This program is distributed in the hope that it will be useful,
14  *  but WITHOUT ANY WARRANTY; without even the implied warranty of
15  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
16  *  GNU General Public License for more details.
17  *
18  *  You should have received a copy of the GNU General Public License
19  *  along with this program; if not, write to the Free Software
20  *  Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
21  *
22  */
23
24 #include <linux/config.h>
25 #include <linux/module.h>
26
27 #include <linux/kernel.h>
28 #include <linux/init.h>
29 #include <linux/slab.h>
30 #include <linux/types.h>
31 #include <linux/errno.h>
32
33 #include <linux/usb.h>
34
35 #include <net/bluetooth/bluetooth.h>
36 #include <net/bluetooth/hci_core.h>
37
38 #ifndef CONFIG_BT_HCIBPA10X_DEBUG
39 #undef  BT_DBG
40 #define BT_DBG(D...)
41 #endif
42
43 #define VERSION "0.8"
44
45 static int ignore = 0;
46
47 static struct usb_device_id bpa10x_table[] = {
48         /* Tektronix BPA 100/105 (Digianswer) */
49         { USB_DEVICE(0x08fd, 0x0002) },
50
51         { }     /* Terminating entry */
52 };
53
54 MODULE_DEVICE_TABLE(usb, bpa10x_table);
55
56 #define BPA10X_CMD_EP           0x00
57 #define BPA10X_EVT_EP           0x81
58 #define BPA10X_TX_EP            0x02
59 #define BPA10X_RX_EP            0x82
60
61 #define BPA10X_CMD_BUF_SIZE     252
62 #define BPA10X_EVT_BUF_SIZE     16
63 #define BPA10X_TX_BUF_SIZE      384
64 #define BPA10X_RX_BUF_SIZE      384
65
66 struct bpa10x_data {
67         struct hci_dev          *hdev;
68         struct usb_device       *udev;
69
70         rwlock_t                lock;
71
72         struct sk_buff_head     cmd_queue;
73         struct urb              *cmd_urb;
74         struct urb              *evt_urb;
75         struct sk_buff          *evt_skb;
76         unsigned int            evt_len;
77
78         struct sk_buff_head     tx_queue;
79         struct urb              *tx_urb;
80         struct urb              *rx_urb;
81 };
82
83 #define HCI_VENDOR_HDR_SIZE     5
84
85 struct hci_vendor_hdr {
86         __u8    type;
87         __u16   snum;
88         __u16   dlen;
89 } __attribute__ ((packed));
90
91 static void bpa10x_recv_bulk(struct bpa10x_data *data, unsigned char *buf, int count)
92 {
93         struct hci_acl_hdr *ah;
94         struct hci_sco_hdr *sh;
95         struct hci_vendor_hdr *vh;
96         struct sk_buff *skb;
97         int len;
98
99         while (count) {
100                 switch (*buf++) {
101                 case HCI_ACLDATA_PKT:
102                         ah = (struct hci_acl_hdr *) buf;
103                         len = HCI_ACL_HDR_SIZE + __le16_to_cpu(ah->dlen);
104                         skb = bt_skb_alloc(len, GFP_ATOMIC);
105                         if (skb) {
106                                 memcpy(skb_put(skb, len), buf, len);
107                                 skb->dev = (void *) data->hdev;
108                                 bt_cb(skb)->pkt_type = HCI_ACLDATA_PKT;
109                                 hci_recv_frame(skb);
110                         }
111                         break;
112
113                 case HCI_SCODATA_PKT:
114                         sh = (struct hci_sco_hdr *) buf;
115                         len = HCI_SCO_HDR_SIZE + sh->dlen;
116                         skb = bt_skb_alloc(len, GFP_ATOMIC);
117                         if (skb) {
118                                 memcpy(skb_put(skb, len), buf, len);
119                                 skb->dev = (void *) data->hdev;
120                                 bt_cb(skb)->pkt_type = HCI_SCODATA_PKT;
121                                 hci_recv_frame(skb);
122                         }
123                         break;
124
125                 case HCI_VENDOR_PKT:
126                         vh = (struct hci_vendor_hdr *) buf;
127                         len = HCI_VENDOR_HDR_SIZE + __le16_to_cpu(vh->dlen);
128                         skb = bt_skb_alloc(len, GFP_ATOMIC);
129                         if (skb) {
130                                 memcpy(skb_put(skb, len), buf, len);
131                                 skb->dev = (void *) data->hdev;
132                                 bt_cb(skb)->pkt_type = HCI_VENDOR_PKT;
133                                 hci_recv_frame(skb);
134                         }
135                         break;
136
137                 default:
138                         len = count - 1;
139                         break;
140                 }
141
142                 buf   += len;
143                 count -= (len + 1);
144         }
145 }
146
147 static int bpa10x_recv_event(struct bpa10x_data *data, unsigned char *buf, int size)
148 {
149         BT_DBG("data %p buf %p size %d", data, buf, size);
150
151         if (data->evt_skb) {
152                 struct sk_buff *skb = data->evt_skb;
153
154                 memcpy(skb_put(skb, size), buf, size);
155
156                 if (skb->len == data->evt_len) {
157                         data->evt_skb = NULL;
158                         data->evt_len = 0;
159                         hci_recv_frame(skb);
160                 }
161         } else {
162                 struct sk_buff *skb;
163                 struct hci_event_hdr *hdr;
164                 unsigned char pkt_type;
165                 int pkt_len = 0;
166
167                 if (size < HCI_EVENT_HDR_SIZE + 1) {
168                         BT_ERR("%s event packet block with size %d is too short",
169                                                         data->hdev->name, size);
170                         return -EILSEQ;
171                 }
172
173                 pkt_type = *buf++;
174                 size--;
175
176                 if (pkt_type != HCI_EVENT_PKT) {
177                         BT_ERR("%s unexpected event packet start byte 0x%02x",
178                                                         data->hdev->name, pkt_type);
179                         return -EPROTO;
180                 }
181
182                 hdr = (struct hci_event_hdr *) buf;
183                 pkt_len = HCI_EVENT_HDR_SIZE + hdr->plen;
184
185                 skb = bt_skb_alloc(pkt_len, GFP_ATOMIC);
186                 if (!skb) {
187                         BT_ERR("%s no memory for new event packet",
188                                                         data->hdev->name);
189                         return -ENOMEM;
190                 }
191
192                 skb->dev = (void *) data->hdev;
193                 bt_cb(skb)->pkt_type = pkt_type;
194
195                 memcpy(skb_put(skb, size), buf, size);
196
197                 if (pkt_len == size) {
198                         hci_recv_frame(skb);
199                 } else {
200                         data->evt_skb = skb;
201                         data->evt_len = pkt_len;
202                 }
203         }
204
205         return 0;
206 }
207
208 static void bpa10x_wakeup(struct bpa10x_data *data)
209 {
210         struct urb *urb;
211         struct sk_buff *skb;
212         int err;
213
214         BT_DBG("data %p", data);
215
216         urb = data->cmd_urb;
217         if (urb->status == -EINPROGRESS)
218                 skb = NULL;
219         else
220                 skb = skb_dequeue(&data->cmd_queue);
221
222         if (skb) {
223                 struct usb_ctrlrequest *cr;
224
225                 if (skb->len > BPA10X_CMD_BUF_SIZE) {
226                         BT_ERR("%s command packet with size %d is too big",
227                                                         data->hdev->name, skb->len);
228                         kfree_skb(skb);
229                         return;
230                 }
231
232                 cr = (struct usb_ctrlrequest *) urb->setup_packet;
233                 cr->wLength = __cpu_to_le16(skb->len);
234
235                 memcpy(urb->transfer_buffer, skb->data, skb->len);
236                 urb->transfer_buffer_length = skb->len;
237
238                 err = usb_submit_urb(urb, GFP_ATOMIC);
239                 if (err < 0 && err != -ENODEV) {
240                         BT_ERR("%s submit failed for command urb %p with error %d",
241                                                         data->hdev->name, urb, err);
242                         skb_queue_head(&data->cmd_queue, skb);
243                 } else
244                         kfree_skb(skb);
245         }
246
247         urb = data->tx_urb;
248         if (urb->status == -EINPROGRESS)
249                 skb = NULL;
250         else
251                 skb = skb_dequeue(&data->tx_queue);
252
253         if (skb) {
254                 memcpy(urb->transfer_buffer, skb->data, skb->len);
255                 urb->transfer_buffer_length = skb->len;
256
257                 err = usb_submit_urb(urb, GFP_ATOMIC);
258                 if (err < 0 && err != -ENODEV) {
259                         BT_ERR("%s submit failed for command urb %p with error %d",
260                                                         data->hdev->name, urb, err);
261                         skb_queue_head(&data->tx_queue, skb);
262                 } else
263                         kfree_skb(skb);
264         }
265 }
266
267 static void bpa10x_complete(struct urb *urb, struct pt_regs *regs)
268 {
269         struct bpa10x_data *data = urb->context;
270         unsigned char *buf = urb->transfer_buffer;
271         int err, count = urb->actual_length;
272
273         BT_DBG("data %p urb %p buf %p count %d", data, urb, buf, count);
274
275         read_lock(&data->lock);
276
277         if (!test_bit(HCI_RUNNING, &data->hdev->flags))
278                 goto unlock;
279
280         if (urb->status < 0 || !count)
281                 goto resubmit;
282
283         if (usb_pipein(urb->pipe)) {
284                 data->hdev->stat.byte_rx += count;
285
286                 if (usb_pipetype(urb->pipe) == PIPE_INTERRUPT)
287                         bpa10x_recv_event(data, buf, count);
288
289                 if (usb_pipetype(urb->pipe) == PIPE_BULK)
290                         bpa10x_recv_bulk(data, buf, count);
291         } else {
292                 data->hdev->stat.byte_tx += count;
293
294                 bpa10x_wakeup(data);
295         }
296
297 resubmit:
298         if (usb_pipein(urb->pipe)) {
299                 err = usb_submit_urb(urb, GFP_ATOMIC);
300                 if (err < 0 && err != -ENODEV) {
301                         BT_ERR("%s urb %p type %d resubmit status %d",
302                                 data->hdev->name, urb, usb_pipetype(urb->pipe), err);
303                 }
304         }
305
306 unlock:
307         read_unlock(&data->lock);
308 }
309
310 static inline struct urb *bpa10x_alloc_urb(struct usb_device *udev, unsigned int pipe,
311                                         size_t size, unsigned int __nocast flags, void *data)
312 {
313         struct urb *urb;
314         struct usb_ctrlrequest *cr;
315         unsigned char *buf;
316
317         BT_DBG("udev %p data %p", udev, data);
318
319         urb = usb_alloc_urb(0, flags);
320         if (!urb)
321                 return NULL;
322
323         buf = kmalloc(size, flags);
324         if (!buf) {
325                 usb_free_urb(urb);
326                 return NULL;
327         }
328
329         switch (usb_pipetype(pipe)) {
330         case PIPE_CONTROL:
331                 cr = kmalloc(sizeof(*cr), flags);
332                 if (!cr) {
333                         kfree(buf);
334                         usb_free_urb(urb);
335                         return NULL;
336                 }
337
338                 cr->bRequestType = USB_TYPE_VENDOR;
339                 cr->bRequest     = 0;
340                 cr->wIndex       = 0;
341                 cr->wValue       = 0;
342                 cr->wLength      = __cpu_to_le16(0);
343
344                 usb_fill_control_urb(urb, udev, pipe, (void *) cr, buf, 0, bpa10x_complete, data);
345                 break;
346
347         case PIPE_INTERRUPT:
348                 usb_fill_int_urb(urb, udev, pipe, buf, size, bpa10x_complete, data, 1);
349                 break;
350
351         case PIPE_BULK:
352                 usb_fill_bulk_urb(urb, udev, pipe, buf, size, bpa10x_complete, data);
353                 break;
354
355         default:
356                 kfree(buf);
357                 usb_free_urb(urb);
358                 return NULL;
359         }
360
361         return urb;
362 }
363
364 static inline void bpa10x_free_urb(struct urb *urb)
365 {
366         BT_DBG("urb %p", urb);
367
368         if (!urb)
369                 return;
370
371         kfree(urb->setup_packet);
372         kfree(urb->transfer_buffer);
373
374         usb_free_urb(urb);
375 }
376
377 static int bpa10x_open(struct hci_dev *hdev)
378 {
379         struct bpa10x_data *data = hdev->driver_data;
380         struct usb_device *udev = data->udev;
381         unsigned long flags;
382         int err;
383
384         BT_DBG("hdev %p data %p", hdev, data);
385
386         if (test_and_set_bit(HCI_RUNNING, &hdev->flags))
387                 return 0;
388
389         data->cmd_urb = bpa10x_alloc_urb(udev, usb_sndctrlpipe(udev, BPA10X_CMD_EP),
390                                         BPA10X_CMD_BUF_SIZE, GFP_KERNEL, data);
391         if (!data->cmd_urb) {
392                 err = -ENOMEM;
393                 goto done;
394         }
395
396         data->evt_urb = bpa10x_alloc_urb(udev, usb_rcvintpipe(udev, BPA10X_EVT_EP),
397                                         BPA10X_EVT_BUF_SIZE, GFP_KERNEL, data);
398         if (!data->evt_urb) {
399                 bpa10x_free_urb(data->cmd_urb);
400                 err = -ENOMEM;
401                 goto done;
402         }
403
404         data->rx_urb = bpa10x_alloc_urb(udev, usb_rcvbulkpipe(udev, BPA10X_RX_EP),
405                                         BPA10X_RX_BUF_SIZE, GFP_KERNEL, data);
406         if (!data->rx_urb) {
407                 bpa10x_free_urb(data->evt_urb);
408                 bpa10x_free_urb(data->cmd_urb);
409                 err = -ENOMEM;
410                 goto done;
411         }
412
413         data->tx_urb = bpa10x_alloc_urb(udev, usb_sndbulkpipe(udev, BPA10X_TX_EP),
414                                         BPA10X_TX_BUF_SIZE, GFP_KERNEL, data);
415         if (!data->rx_urb) {
416                 bpa10x_free_urb(data->rx_urb);
417                 bpa10x_free_urb(data->evt_urb);
418                 bpa10x_free_urb(data->cmd_urb);
419                 err = -ENOMEM;
420                 goto done;
421         }
422
423         write_lock_irqsave(&data->lock, flags);
424
425         err = usb_submit_urb(data->evt_urb, GFP_ATOMIC);
426         if (err < 0) {
427                 BT_ERR("%s submit failed for event urb %p with error %d",
428                                         data->hdev->name, data->evt_urb, err);
429         } else {
430                 err = usb_submit_urb(data->rx_urb, GFP_ATOMIC);
431                 if (err < 0) {
432                         BT_ERR("%s submit failed for rx urb %p with error %d",
433                                         data->hdev->name, data->evt_urb, err);
434                         usb_kill_urb(data->evt_urb);
435                 }
436         }
437
438         write_unlock_irqrestore(&data->lock, flags);
439
440 done:
441         if (err < 0)
442                 clear_bit(HCI_RUNNING, &hdev->flags);
443
444         return err;
445 }
446
447 static int bpa10x_close(struct hci_dev *hdev)
448 {
449         struct bpa10x_data *data = hdev->driver_data;
450         unsigned long flags;
451
452         BT_DBG("hdev %p data %p", hdev, data);
453
454         if (!test_and_clear_bit(HCI_RUNNING, &hdev->flags))
455                 return 0;
456
457         write_lock_irqsave(&data->lock, flags);
458
459         skb_queue_purge(&data->cmd_queue);
460         usb_kill_urb(data->cmd_urb);
461         usb_kill_urb(data->evt_urb);
462         usb_kill_urb(data->rx_urb);
463         usb_kill_urb(data->tx_urb);
464
465         write_unlock_irqrestore(&data->lock, flags);
466
467         bpa10x_free_urb(data->cmd_urb);
468         bpa10x_free_urb(data->evt_urb);
469         bpa10x_free_urb(data->rx_urb);
470         bpa10x_free_urb(data->tx_urb);
471
472         return 0;
473 }
474
475 static int bpa10x_flush(struct hci_dev *hdev)
476 {
477         struct bpa10x_data *data = hdev->driver_data;
478
479         BT_DBG("hdev %p data %p", hdev, data);
480
481         skb_queue_purge(&data->cmd_queue);
482
483         return 0;
484 }
485
486 static int bpa10x_send_frame(struct sk_buff *skb)
487 {
488         struct hci_dev *hdev = (struct hci_dev *) skb->dev;
489         struct bpa10x_data *data;
490
491         BT_DBG("hdev %p skb %p type %d len %d", hdev, skb, bt_cb(skb)->pkt_type, skb->len);
492
493         if (!hdev) {
494                 BT_ERR("Frame for unknown HCI device");
495                 return -ENODEV;
496         }
497
498         if (!test_bit(HCI_RUNNING, &hdev->flags))
499                 return -EBUSY;
500
501         data = hdev->driver_data;
502
503         /* Prepend skb with frame type */
504         memcpy(skb_push(skb, 1), &bt_cb(skb)->pkt_type, 1);
505
506         switch (bt_cb(skb)->pkt_type) {
507         case HCI_COMMAND_PKT:
508                 hdev->stat.cmd_tx++;
509                 skb_queue_tail(&data->cmd_queue, skb);
510                 break;
511
512         case HCI_ACLDATA_PKT:
513                 hdev->stat.acl_tx++;
514                 skb_queue_tail(&data->tx_queue, skb);
515                 break;
516
517         case HCI_SCODATA_PKT:
518                 hdev->stat.sco_tx++;
519                 skb_queue_tail(&data->tx_queue, skb);
520                 break;
521         };
522
523         read_lock(&data->lock);
524
525         bpa10x_wakeup(data);
526
527         read_unlock(&data->lock);
528
529         return 0;
530 }
531
532 static void bpa10x_destruct(struct hci_dev *hdev)
533 {
534         struct bpa10x_data *data = hdev->driver_data;
535
536         BT_DBG("hdev %p data %p", hdev, data);
537
538         kfree(data);
539 }
540
541 static int bpa10x_probe(struct usb_interface *intf, const struct usb_device_id *id)
542 {
543         struct usb_device *udev = interface_to_usbdev(intf);
544         struct hci_dev *hdev;
545         struct bpa10x_data *data;
546         int err;
547
548         BT_DBG("intf %p id %p", intf, id);
549
550         if (ignore)
551                 return -ENODEV;
552
553         data = kmalloc(sizeof(*data), GFP_KERNEL);
554         if (!data) {
555                 BT_ERR("Can't allocate data structure");
556                 return -ENOMEM;
557         }
558
559         memset(data, 0, sizeof(*data));
560
561         data->udev = udev;
562
563         rwlock_init(&data->lock);
564
565         skb_queue_head_init(&data->cmd_queue);
566         skb_queue_head_init(&data->tx_queue);
567
568         hdev = hci_alloc_dev();
569         if (!hdev) {
570                 BT_ERR("Can't allocate HCI device");
571                 kfree(data);
572                 return -ENOMEM;
573         }
574
575         data->hdev = hdev;
576
577         hdev->type = HCI_USB;
578         hdev->driver_data = data;
579         SET_HCIDEV_DEV(hdev, &intf->dev);
580
581         hdev->open      = bpa10x_open;
582         hdev->close     = bpa10x_close;
583         hdev->flush     = bpa10x_flush;
584         hdev->send      = bpa10x_send_frame;
585         hdev->destruct  = bpa10x_destruct;
586
587         hdev->owner = THIS_MODULE;
588
589         err = hci_register_dev(hdev);
590         if (err < 0) {
591                 BT_ERR("Can't register HCI device");
592                 kfree(data);
593                 hci_free_dev(hdev);
594                 return err;
595         }
596
597         usb_set_intfdata(intf, data);
598
599         return 0;
600 }
601
602 static void bpa10x_disconnect(struct usb_interface *intf)
603 {
604         struct bpa10x_data *data = usb_get_intfdata(intf);
605         struct hci_dev *hdev = data->hdev;
606
607         BT_DBG("intf %p", intf);
608
609         if (!hdev)
610                 return;
611
612         usb_set_intfdata(intf, NULL);
613
614         if (hci_unregister_dev(hdev) < 0)
615                 BT_ERR("Can't unregister HCI device %s", hdev->name);
616
617         hci_free_dev(hdev);
618 }
619
620 static struct usb_driver bpa10x_driver = {
621         .owner          = THIS_MODULE,
622         .name           = "bpa10x",
623         .probe          = bpa10x_probe,
624         .disconnect     = bpa10x_disconnect,
625         .id_table       = bpa10x_table,
626 };
627
628 static int __init bpa10x_init(void)
629 {
630         int err;
631
632         BT_INFO("Digianswer Bluetooth USB driver ver %s", VERSION);
633
634         err = usb_register(&bpa10x_driver);
635         if (err < 0)
636                 BT_ERR("Failed to register USB driver");
637
638         return err;
639 }
640
641 static void __exit bpa10x_exit(void)
642 {
643         usb_deregister(&bpa10x_driver);
644 }
645
646 module_init(bpa10x_init);
647 module_exit(bpa10x_exit);
648
649 module_param(ignore, bool, 0644);
650 MODULE_PARM_DESC(ignore, "Ignore devices from the matching table");
651
652 MODULE_AUTHOR("Marcel Holtmann <marcel@holtmann.org>");
653 MODULE_DESCRIPTION("Digianswer Bluetooth USB driver ver " VERSION);
654 MODULE_VERSION(VERSION);
655 MODULE_LICENSE("GPL");