1 /*
2  *
3  *  AVM BlueFRITZ! USB driver
4  *
5  *  Copyright (C) 2003  Marcel Holtmann <marcel@holtmann.org>
6  *
7  *
8  *  This program is free software; you can redistribute it and/or modify
9  *  it under the terms of the GNU General Public License as published by
10  *  the Free Software Foundation; either version 2 of the License, or
11  *  (at your option) any later version.
12  *
13  *  This program is distributed in the hope that it will be useful,
14  *  but WITHOUT ANY WARRANTY; without even the implied warranty of
15  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
16  *  GNU General Public License for more details.
17  *
18  *  You should have received a copy of the GNU General Public License
19  *  along with this program; if not, write to the Free Software
20  *  Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
21  *
22  */
23 
24 #include <linux/config.h>
25 #include <linux/module.h>
26 
27 #include <linux/kernel.h>
28 #include <linux/init.h>
29 #include <linux/slab.h>
30 #include <linux/types.h>
31 #include <linux/sched.h>
32 #include <linux/errno.h>
33 #include <linux/skbuff.h>
34 
35 #include <linux/firmware.h>
36 #include <linux/usb.h>
37 
38 #include <net/bluetooth/bluetooth.h>
39 #include <net/bluetooth/hci_core.h>
40 
41 #ifndef CONFIG_BLUEZ_HCIBFUSB_DEBUG
42 #undef  BT_DBG
43 #define BT_DBG(D...)
44 #endif
45 
46 #define VERSION "1.1"
47 
48 static struct usb_device_id bfusb_table[] = {
49 	/* AVM BlueFRITZ! USB */
50 	{ USB_DEVICE(0x057c, 0x2200) },
51 
52 	{ }	/* Terminating entry */
53 };
54 
55 MODULE_DEVICE_TABLE(usb, bfusb_table);
56 
57 
58 #define BFUSB_MAX_BLOCK_SIZE	256
59 
60 #define BFUSB_BLOCK_TIMEOUT	(HZ * 3)
61 
62 #define BFUSB_TX_PROCESS	1
63 #define BFUSB_TX_WAKEUP		2
64 
65 #define BFUSB_MAX_BULK_TX	1
66 #define BFUSB_MAX_BULK_RX	1
67 
68 struct bfusb {
69 	struct hci_dev		hdev;
70 
71 	unsigned long		state;
72 
73 	struct usb_device	*udev;
74 
75 	unsigned int		bulk_in_ep;
76 	unsigned int		bulk_out_ep;
77 	unsigned int		bulk_pkt_size;
78 
79 	rwlock_t		lock;
80 
81 	struct sk_buff_head	transmit_q;
82 
83 	struct sk_buff		*reassembly;
84 
85 	atomic_t		pending_tx;
86 	struct sk_buff_head	pending_q;
87 	struct sk_buff_head	completed_q;
88 };
89 
90 struct bfusb_scb {
91 	struct urb *urb;
92 };
93 
94 static void bfusb_tx_complete(struct urb *urb);
95 static void bfusb_rx_complete(struct urb *urb);
96 
bfusb_get_completed(struct bfusb * bfusb)97 static struct urb *bfusb_get_completed(struct bfusb *bfusb)
98 {
99 	struct sk_buff *skb;
100 	struct urb *urb = NULL;
101 
102 	BT_DBG("bfusb %p", bfusb);
103 
104 	skb = skb_dequeue(&bfusb->completed_q);
105 	if (skb) {
106 		urb = ((struct bfusb_scb *) skb->cb)->urb;
107 		kfree_skb(skb);
108 	}
109 
110 	return urb;
111 }
112 
bfusb_unlink_urbs(struct bfusb * bfusb)113 static inline void bfusb_unlink_urbs(struct bfusb *bfusb)
114 {
115 	struct sk_buff *skb;
116 	struct urb *urb;
117 
118 	BT_DBG("bfusb %p", bfusb);
119 
120 	while ((skb = skb_dequeue(&bfusb->pending_q))) {
121 		urb = ((struct bfusb_scb *) skb->cb)->urb;
122 		usb_unlink_urb(urb);
123 		skb_queue_tail(&bfusb->completed_q, skb);
124 	}
125 
126 	while ((urb = bfusb_get_completed(bfusb)))
127 		usb_free_urb(urb);
128 }
129 
130 
bfusb_send_bulk(struct bfusb * bfusb,struct sk_buff * skb)131 static int bfusb_send_bulk(struct bfusb *bfusb, struct sk_buff *skb)
132 {
133 	struct bfusb_scb *scb = (void *) skb->cb;
134 	struct urb *urb = bfusb_get_completed(bfusb);
135 	int err, pipe;
136 
137 	BT_DBG("bfusb %p skb %p len %d", bfusb, skb, skb->len);
138 
139 	if (!urb && !(urb = usb_alloc_urb(0)))
140 		return -ENOMEM;
141 
142 	pipe = usb_sndbulkpipe(bfusb->udev, bfusb->bulk_out_ep);
143 
144 	FILL_BULK_URB(urb, bfusb->udev, pipe, skb->data, skb->len,
145 			bfusb_tx_complete, skb);
146 
147 	urb->transfer_flags = USB_QUEUE_BULK;
148 
149 	scb->urb = urb;
150 
151 	skb_queue_tail(&bfusb->pending_q, skb);
152 
153 	err = usb_submit_urb(urb);
154 	if (err) {
155 		BT_ERR("%s bulk tx submit failed urb %p err %d",
156 					bfusb->hdev.name, urb, err);
157 		skb_unlink(skb);
158 		usb_free_urb(urb);
159 	} else
160 		atomic_inc(&bfusb->pending_tx);
161 
162 	return err;
163 }
164 
bfusb_tx_wakeup(struct bfusb * bfusb)165 static void bfusb_tx_wakeup(struct bfusb *bfusb)
166 {
167 	struct sk_buff *skb;
168 
169 	BT_DBG("bfusb %p", bfusb);
170 
171 	if (test_and_set_bit(BFUSB_TX_PROCESS, &bfusb->state)) {
172 		set_bit(BFUSB_TX_WAKEUP, &bfusb->state);
173 		return;
174 	}
175 
176 	do {
177 		clear_bit(BFUSB_TX_WAKEUP, &bfusb->state);
178 
179 		while ((atomic_read(&bfusb->pending_tx) < BFUSB_MAX_BULK_TX) &&
180 				(skb = skb_dequeue(&bfusb->transmit_q))) {
181 			if (bfusb_send_bulk(bfusb, skb) < 0) {
182 				skb_queue_head(&bfusb->transmit_q, skb);
183 				break;
184 			}
185 		}
186 
187 	} while (test_bit(BFUSB_TX_WAKEUP, &bfusb->state));
188 
189 	clear_bit(BFUSB_TX_PROCESS, &bfusb->state);
190 }
191 
bfusb_tx_complete(struct urb * urb)192 static void bfusb_tx_complete(struct urb *urb)
193 {
194 	struct sk_buff *skb = (struct sk_buff *) urb->context;
195 	struct bfusb *bfusb = (struct bfusb *) skb->dev;
196 
197 	BT_DBG("bfusb %p urb %p skb %p len %d", bfusb, urb, skb, skb->len);
198 
199 	atomic_dec(&bfusb->pending_tx);
200 
201 	if (!test_bit(HCI_RUNNING, &bfusb->hdev.flags))
202 		return;
203 
204 	if (!urb->status)
205 		bfusb->hdev.stat.byte_tx += skb->len;
206 	else
207 		bfusb->hdev.stat.err_tx++;
208 
209 	read_lock(&bfusb->lock);
210 
211 	skb_unlink(skb);
212 	skb_queue_tail(&bfusb->completed_q, skb);
213 
214 	bfusb_tx_wakeup(bfusb);
215 
216 	read_unlock(&bfusb->lock);
217 }
218 
219 
bfusb_rx_submit(struct bfusb * bfusb,struct urb * urb)220 static int bfusb_rx_submit(struct bfusb *bfusb, struct urb *urb)
221 {
222 	struct bfusb_scb *scb;
223 	struct sk_buff *skb;
224 	int err, pipe, size = HCI_MAX_FRAME_SIZE + 32;
225 
226 	BT_DBG("bfusb %p urb %p", bfusb, urb);
227 
228 	if (!urb && !(urb = usb_alloc_urb(0)))
229 		return -ENOMEM;
230 
231 	if (!(skb = bluez_skb_alloc(size, GFP_ATOMIC))) {
232 		usb_free_urb(urb);
233 		return -ENOMEM;
234 	}
235 
236 	skb->dev = (void *) bfusb;
237 
238 	scb = (struct bfusb_scb *) skb->cb;
239 	scb->urb = urb;
240 
241 	pipe = usb_rcvbulkpipe(bfusb->udev, bfusb->bulk_in_ep);
242 
243 	FILL_BULK_URB(urb, bfusb->udev, pipe, skb->data, size,
244 			bfusb_rx_complete, skb);
245 
246 	urb->transfer_flags = USB_QUEUE_BULK;
247 
248 	skb_queue_tail(&bfusb->pending_q, skb);
249 
250 	err = usb_submit_urb(urb);
251 	if (err) {
252 		BT_ERR("%s bulk rx submit failed urb %p err %d",
253 					bfusb->hdev.name, urb, err);
254 		skb_unlink(skb);
255 		kfree_skb(skb);
256 		usb_free_urb(urb);
257 	}
258 
259 	return err;
260 }
261 
bfusb_recv_block(struct bfusb * bfusb,int hdr,unsigned char * data,int len)262 static inline int bfusb_recv_block(struct bfusb *bfusb, int hdr, unsigned char *data, int len)
263 {
264 	BT_DBG("bfusb %p hdr 0x%02x data %p len %d", bfusb, hdr, data, len);
265 
266 	if (hdr & 0x10) {
267 		BT_ERR("%s error in block", bfusb->hdev.name);
268 		if (bfusb->reassembly)
269 			kfree_skb(bfusb->reassembly);
270 		bfusb->reassembly = NULL;
271 		return -EIO;
272 	}
273 
274 	if (hdr & 0x04) {
275 		struct sk_buff *skb;
276 		unsigned char pkt_type;
277 		int pkt_len = 0;
278 
279 		if (bfusb->reassembly) {
280 			BT_ERR("%s unexpected start block", bfusb->hdev.name);
281 			kfree_skb(bfusb->reassembly);
282 			bfusb->reassembly = NULL;
283 		}
284 
285 		if (len < 1) {
286 			BT_ERR("%s no packet type found", bfusb->hdev.name);
287 			return -EPROTO;
288 		}
289 
290 		pkt_type = *data++; len--;
291 
292 		switch (pkt_type) {
293 		case HCI_EVENT_PKT:
294 			if (len >= HCI_EVENT_HDR_SIZE) {
295 				hci_event_hdr *hdr = (hci_event_hdr *) data;
296 				pkt_len = HCI_EVENT_HDR_SIZE + hdr->plen;
297 			} else {
298 				BT_ERR("%s event block is too short", bfusb->hdev.name);
299 				return -EILSEQ;
300 			}
301 			break;
302 
303 		case HCI_ACLDATA_PKT:
304 			if (len >= HCI_ACL_HDR_SIZE) {
305 				hci_acl_hdr *hdr = (hci_acl_hdr *) data;
306 				pkt_len = HCI_ACL_HDR_SIZE + __le16_to_cpu(hdr->dlen);
307 			} else {
308 				BT_ERR("%s data block is too short", bfusb->hdev.name);
309 				return -EILSEQ;
310 			}
311 			break;
312 
313 		case HCI_SCODATA_PKT:
314 			if (len >= HCI_SCO_HDR_SIZE) {
315 				hci_sco_hdr *hdr = (hci_sco_hdr *) data;
316 				pkt_len = HCI_SCO_HDR_SIZE + hdr->dlen;
317 			} else {
318 				BT_ERR("%s audio block is too short", bfusb->hdev.name);
319 				return -EILSEQ;
320 			}
321 			break;
322 		}
323 
324 		skb = bluez_skb_alloc(pkt_len, GFP_ATOMIC);
325 		if (!skb) {
326 			BT_ERR("%s no memory for the packet", bfusb->hdev.name);
327 			return -ENOMEM;
328 		}
329 
330 		skb->dev = (void *) &bfusb->hdev;
331 		skb->pkt_type = pkt_type;
332 
333 		bfusb->reassembly = skb;
334 	} else {
335 		if (!bfusb->reassembly) {
336 			BT_ERR("%s unexpected continuation block", bfusb->hdev.name);
337 			return -EIO;
338 		}
339 	}
340 
341 	if (len > 0)
342 		memcpy(skb_put(bfusb->reassembly, len), data, len);
343 
344 	if (hdr & 0x08) {
345 		hci_recv_frame(bfusb->reassembly);
346 		bfusb->reassembly = NULL;
347 	}
348 
349 	return 0;
350 }
351 
bfusb_rx_complete(struct urb * urb)352 static void bfusb_rx_complete(struct urb *urb)
353 {
354 	struct sk_buff *skb = (struct sk_buff *) urb->context;
355 	struct bfusb *bfusb = (struct bfusb *) skb->dev;
356 	unsigned char *buf = urb->transfer_buffer;
357 	int count = urb->actual_length;
358 	int err, hdr, len;
359 
360 	BT_DBG("bfusb %p urb %p skb %p len %d", bfusb, urb, skb, skb->len);
361 
362 	read_lock(&bfusb->lock);
363 
364 	if (!test_bit(HCI_RUNNING, &bfusb->hdev.flags))
365 		goto unlock;
366 
367 	if (urb->status || !count)
368 		goto resubmit;
369 
370 	bfusb->hdev.stat.byte_rx += count;
371 
372 	skb_put(skb, count);
373 
374 	while (count) {
375 		hdr = buf[0] | (buf[1] << 8);
376 
377 		if (hdr & 0x4000) {
378 			len = 0;
379 			count -= 2;
380 			buf   += 2;
381 		} else {
382 			len = (buf[2] == 0) ? 256 : buf[2];
383 			count -= 3;
384 			buf   += 3;
385 		}
386 
387 		if (count < len) {
388 			BT_ERR("%s block extends over URB buffer ranges",
389 					bfusb->hdev.name);
390 		}
391 
392 		if ((hdr & 0xe1) == 0xc1)
393 			bfusb_recv_block(bfusb, hdr, buf, len);
394 
395 		count -= len;
396 		buf   += len;
397 	}
398 
399 	skb_unlink(skb);
400 	kfree_skb(skb);
401 
402 	bfusb_rx_submit(bfusb, urb);
403 
404 	read_unlock(&bfusb->lock);
405 
406 	return;
407 
408 resubmit:
409 	urb->dev = bfusb->udev;
410 
411 	err = usb_submit_urb(urb);
412 	if (err) {
413 		BT_ERR("%s bulk resubmit failed urb %p err %d",
414 					bfusb->hdev.name, urb, err);
415 	}
416 
417 unlock:
418 	read_unlock(&bfusb->lock);
419 }
420 
421 
bfusb_open(struct hci_dev * hdev)422 static int bfusb_open(struct hci_dev *hdev)
423 {
424 	struct bfusb *bfusb = (struct bfusb *) hdev->driver_data;
425 	unsigned long flags;
426 	int i, err;
427 
428 	BT_DBG("hdev %p bfusb %p", hdev, bfusb);
429 
430 	if (test_and_set_bit(HCI_RUNNING, &hdev->flags))
431 		return 0;
432 
433 	MOD_INC_USE_COUNT;
434 
435 	write_lock_irqsave(&bfusb->lock, flags);
436 
437 	err = bfusb_rx_submit(bfusb, NULL);
438 	if (!err) {
439 		for (i = 1; i < BFUSB_MAX_BULK_RX; i++)
440 			bfusb_rx_submit(bfusb, NULL);
441 	} else {
442 		clear_bit(HCI_RUNNING, &hdev->flags);
443 		MOD_DEC_USE_COUNT;
444 	}
445 
446 	write_unlock_irqrestore(&bfusb->lock, flags);
447 
448 	return err;
449 }
450 
bfusb_flush(struct hci_dev * hdev)451 static int bfusb_flush(struct hci_dev *hdev)
452 {
453 	struct bfusb *bfusb = (struct bfusb *) hdev->driver_data;
454 
455 	BT_DBG("hdev %p bfusb %p", hdev, bfusb);
456 
457 	skb_queue_purge(&bfusb->transmit_q);
458 
459 	return 0;
460 }
461 
bfusb_close(struct hci_dev * hdev)462 static int bfusb_close(struct hci_dev *hdev)
463 {
464 	struct bfusb *bfusb = (struct bfusb *) hdev->driver_data;
465 	unsigned long flags;
466 
467 	BT_DBG("hdev %p bfusb %p", hdev, bfusb);
468 
469 	if (!test_and_clear_bit(HCI_RUNNING, &hdev->flags))
470 		return 0;
471 
472 	write_lock_irqsave(&bfusb->lock, flags);
473 	write_unlock_irqrestore(&bfusb->lock, flags);
474 
475 	bfusb_unlink_urbs(bfusb);
476 	bfusb_flush(hdev);
477 
478 	MOD_DEC_USE_COUNT;
479 
480 	return 0;
481 }
482 
bfusb_send_frame(struct sk_buff * skb)483 static int bfusb_send_frame(struct sk_buff *skb)
484 {
485 	struct hci_dev *hdev = (struct hci_dev *) skb->dev;
486 	struct bfusb *bfusb;
487 	struct sk_buff *nskb;
488 	unsigned char buf[3];
489 	int sent = 0, size, count;
490 
491 	BT_DBG("hdev %p skb %p type %d len %d", hdev, skb, skb->pkt_type, skb->len);
492 
493 	if (!hdev) {
494 		BT_ERR("Frame for unknown HCI device (hdev=NULL)");
495 		return -ENODEV;
496 	}
497 
498 	if (!test_bit(HCI_RUNNING, &hdev->flags))
499 		return -EBUSY;
500 
501 	bfusb = (struct bfusb *) hdev->driver_data;
502 
503 	switch (skb->pkt_type) {
504 	case HCI_COMMAND_PKT:
505 		hdev->stat.cmd_tx++;
506 		break;
507 	case HCI_ACLDATA_PKT:
508 		hdev->stat.acl_tx++;
509 		break;
510 	case HCI_SCODATA_PKT:
511 		hdev->stat.sco_tx++;
512 		break;
513 	};
514 
515 	/* Prepend skb with frame type */
516 	memcpy(skb_push(skb, 1), &(skb->pkt_type), 1);
517 
518 	count = skb->len;
519 
520 	/* Max HCI frame size seems to be 1511 + 1 */
521 	if (!(nskb = bluez_skb_alloc(count + 32, GFP_ATOMIC))) {
522 		BT_ERR("Can't allocate memory for new packet");
523 		return -ENOMEM;
524 	}
525 
526 	nskb->dev = (void *) bfusb;
527 
528 	while (count) {
529 		size = min_t(uint, count, BFUSB_MAX_BLOCK_SIZE);
530 
531 		buf[0] = 0xc1 | ((sent == 0) ? 0x04 : 0) | ((count == size) ? 0x08 : 0);
532 		buf[1] = 0x00;
533 		buf[2] = (size == BFUSB_MAX_BLOCK_SIZE) ? 0 : size;
534 
535 		memcpy(skb_put(nskb, 3), buf, 3);
536 		memcpy(skb_put(nskb, size), skb->data + sent, size);
537 
538 		sent  += size;
539 		count -= size;
540 	}
541 
542 	/* Don't send frame with multiple size of bulk max packet */
543 	if ((nskb->len % bfusb->bulk_pkt_size) == 0) {
544 		buf[0] = 0xdd;
545 		buf[1] = 0x00;
546 		memcpy(skb_put(nskb, 2), buf, 2);
547 	}
548 
549 	read_lock(&bfusb->lock);
550 
551 	skb_queue_tail(&bfusb->transmit_q, nskb);
552 	bfusb_tx_wakeup(bfusb);
553 
554 	read_unlock(&bfusb->lock);
555 
556 	kfree_skb(skb);
557 
558 	return 0;
559 }
560 
bfusb_destruct(struct hci_dev * hdev)561 static void bfusb_destruct(struct hci_dev *hdev)
562 {
563 	struct bfusb *bfusb = (struct bfusb *) hdev->driver_data;
564 
565 	BT_DBG("hdev %p bfusb %p", hdev, bfusb);
566 
567 	kfree(bfusb);
568 }
569 
bfusb_ioctl(struct hci_dev * hdev,unsigned int cmd,unsigned long arg)570 static int bfusb_ioctl(struct hci_dev *hdev, unsigned int cmd, unsigned long arg)
571 {
572 	return -ENOIOCTLCMD;
573 }
574 
575 
bfusb_load_firmware(struct bfusb * bfusb,unsigned char * firmware,int count)576 static int bfusb_load_firmware(struct bfusb *bfusb, unsigned char *firmware, int count)
577 {
578 	unsigned char *buf;
579 	int err, pipe, len, size, sent = 0;
580 
581 	BT_DBG("bfusb %p udev %p firmware %p count %d", bfusb, bfusb->udev, firmware, count);
582 
583 	BT_INFO("BlueFRITZ! USB loading firmware");
584 
585 	if (usb_set_configuration(bfusb->udev, 1) < 0) {
586 		BT_ERR("Can't change to loading configuration");
587 		return -EBUSY;
588 	}
589 
590 	buf = kmalloc(BFUSB_MAX_BLOCK_SIZE + 3, GFP_ATOMIC);
591 	if (!buf) {
592 		BT_ERR("Can't allocate memory chunk for firmware");
593 		return -ENOMEM;
594 	}
595 
596 	pipe = usb_sndbulkpipe(bfusb->udev, bfusb->bulk_out_ep);
597 
598 	while (count) {
599 		size = min_t(uint, count, BFUSB_MAX_BLOCK_SIZE + 3);
600 
601 		memcpy(buf, firmware + sent, size);
602 
603 		err = usb_bulk_msg(bfusb->udev, pipe, buf, size,
604 					&len, BFUSB_BLOCK_TIMEOUT);
605 
606 		if (err || (len != size)) {
607 			BT_ERR("Error in firmware loading");
608 			goto error;
609 		}
610 
611 		sent  += size;
612 		count -= size;
613 	}
614 
615 	if ((err = usb_bulk_msg(bfusb->udev, pipe, NULL, 0,
616 				&len, BFUSB_BLOCK_TIMEOUT)) < 0) {
617 		BT_ERR("Error in null packet request");
618 		goto error;
619 	}
620 
621 	if ((err = usb_set_configuration(bfusb->udev, 2)) < 0) {
622 		BT_ERR("Can't change to running configuration");
623 		goto error;
624 	}
625 
626 	BT_INFO("BlueFRITZ! USB device ready");
627 
628 	kfree(buf);
629 	return 0;
630 
631 error:
632 	kfree(buf);
633 
634 	pipe = usb_sndctrlpipe(bfusb->udev, 0);
635 
636 	usb_control_msg(bfusb->udev, pipe, USB_REQ_SET_CONFIGURATION,
637 				0, 0, 0, NULL, 0, BFUSB_BLOCK_TIMEOUT);
638 
639 	return err;
640 }
641 
bfusb_probe(struct usb_device * udev,unsigned int ifnum,const struct usb_device_id * id)642 static void *bfusb_probe(struct usb_device *udev, unsigned int ifnum, const struct usb_device_id *id)
643 {
644 	const struct firmware *firmware;
645 	char device[16];
646 	struct usb_interface *iface;
647 	struct usb_interface_descriptor *iface_desc;
648 	struct usb_endpoint_descriptor *bulk_out_ep;
649 	struct usb_endpoint_descriptor *bulk_in_ep;
650 	struct hci_dev *hdev;
651 	struct bfusb *bfusb;
652 
653 	BT_DBG("udev %p ifnum %d id %p", udev, ifnum, id);
654 
655 	/* Check number of endpoints */
656 	iface = &udev->actconfig->interface[0];
657 	iface_desc = &iface->altsetting[0];
658 
659 	if (iface_desc->bNumEndpoints < 2)
660 		return NULL;
661 
662 	bulk_out_ep = &iface_desc->endpoint[0];
663 	bulk_in_ep  = &iface_desc->endpoint[1];
664 
665 	if (!bulk_out_ep || !bulk_in_ep) {
666 		BT_ERR("Bulk endpoints not found");
667 		goto done;
668 	}
669 
670 	/* Initialize control structure and load firmware */
671 	if (!(bfusb = kmalloc(sizeof(struct bfusb), GFP_KERNEL))) {
672 		BT_ERR("Can't allocate memory for control structure");
673 		goto done;
674 	}
675 
676 	memset(bfusb, 0, sizeof(struct bfusb));
677 
678 	bfusb->udev = udev;
679 	bfusb->bulk_in_ep    = bulk_in_ep->bEndpointAddress;
680 	bfusb->bulk_out_ep   = bulk_out_ep->bEndpointAddress;
681 	bfusb->bulk_pkt_size = bulk_out_ep->wMaxPacketSize;
682 
683 	bfusb->lock = RW_LOCK_UNLOCKED;
684 
685 	bfusb->reassembly = NULL;
686 
687 	skb_queue_head_init(&bfusb->transmit_q);
688 	skb_queue_head_init(&bfusb->pending_q);
689 	skb_queue_head_init(&bfusb->completed_q);
690 
691 	snprintf(device, sizeof(device), "bfusb%3.3d%3.3d", udev->bus->busnum, udev->devnum);
692 
693 	if (request_firmware(&firmware, "bfubase.frm", device) < 0) {
694 		BT_ERR("Firmware request failed");
695 		goto error;
696 	}
697 
698 	if (bfusb_load_firmware(bfusb, firmware->data, firmware->size) < 0) {
699 		BT_ERR("Firmware loading failed");
700 		goto release;
701 	}
702 
703 	release_firmware(firmware);
704 
705 	/* Initialize and register HCI device */
706 	hdev = &bfusb->hdev;
707 
708 	hdev->type = HCI_USB;
709 	hdev->driver_data = bfusb;
710 
711 	hdev->open     = bfusb_open;
712 	hdev->close    = bfusb_close;
713 	hdev->flush    = bfusb_flush;
714 	hdev->send     = bfusb_send_frame;
715 	hdev->destruct = bfusb_destruct;
716 	hdev->ioctl    = bfusb_ioctl;
717 
718 	if (hci_register_dev(hdev) < 0) {
719 		BT_ERR("Can't register HCI device");
720 		goto error;
721 	}
722 
723 	return bfusb;
724 
725 release:
726 	release_firmware(firmware);
727 
728 error:
729 	kfree(bfusb);
730 
731 done:
732 	return NULL;
733 }
734 
bfusb_disconnect(struct usb_device * udev,void * ptr)735 static void bfusb_disconnect(struct usb_device *udev, void *ptr)
736 {
737 	struct bfusb *bfusb = (struct bfusb *) ptr;
738 	struct hci_dev *hdev = &bfusb->hdev;
739 
740 	BT_DBG("udev %p ptr %p", udev, ptr);
741 
742 	if (!hdev)
743 		return;
744 
745 	bfusb_close(hdev);
746 
747 	if (hci_unregister_dev(hdev) < 0)
748 		BT_ERR("Can't unregister HCI device %s", hdev->name);
749 }
750 
751 static struct usb_driver bfusb_driver = {
752 	name:		"bfusb",
753 	probe:		bfusb_probe,
754 	disconnect:	bfusb_disconnect,
755 	id_table:	bfusb_table,
756 };
757 
bfusb_init(void)758 static int __init bfusb_init(void)
759 {
760 	int err;
761 
762 	BT_INFO("BlueFRITZ! USB driver ver %s", VERSION);
763 	BT_INFO("Copyright (C) 2003 Marcel Holtmann <marcel@holtmann.org>");
764 
765 	if ((err = usb_register(&bfusb_driver)) < 0)
766 		BT_ERR("Failed to register BlueFRITZ! USB driver");
767 
768 	return err;
769 }
770 
bfusb_cleanup(void)771 static void __exit bfusb_cleanup(void)
772 {
773 	usb_deregister(&bfusb_driver);
774 }
775 
776 module_init(bfusb_init);
777 module_exit(bfusb_cleanup);
778 
779 MODULE_AUTHOR("Marcel Holtmann <marcel@holtmann.org>");
780 MODULE_DESCRIPTION("BlueFRITZ! USB driver ver " VERSION);
781 MODULE_LICENSE("GPL");
782