patch-2.4.19 linux-2.4.19/drivers/bluetooth/hci_usb.c

Next file: linux-2.4.19/drivers/bluetooth/hci_usb.h
Previous file: linux-2.4.19/drivers/bluetooth/hci_uart.h
Back to the patch index
Back to the overall index

diff -urN linux-2.4.18/drivers/bluetooth/hci_usb.c linux-2.4.19/drivers/bluetooth/hci_usb.c
@@ -28,570 +28,755 @@
  *    Copyright (c) 2000 Greg Kroah-Hartman        <greg@kroah.com>
  *    Copyright (c) 2000 Mark Douglas Corner       <mcorner@umich.edu>
  *
- * $Id: hci_usb.c,v 1.5 2001/07/05 18:42:44 maxk Exp $    
+ * $Id: hci_usb.c,v 1.6 2002/04/17 17:37:20 maxk Exp $    
  */
-#define VERSION "1.0"
+#define VERSION "2.0"
 
 #include <linux/config.h>
 #include <linux/module.h>
 
+#define __KERNEL_SYSCALLS__
+
 #include <linux/version.h>
-#include <linux/config.h>
 #include <linux/kernel.h>
 #include <linux/init.h>
 #include <linux/sched.h>
+#include <linux/unistd.h>
 #include <linux/types.h>
-#include <linux/fcntl.h>
 #include <linux/interrupt.h>
-#include <linux/ptrace.h>
-#include <linux/poll.h>
 
 #include <linux/slab.h>
-#include <linux/tty.h>
 #include <linux/errno.h>
 #include <linux/string.h>
-#include <linux/signal.h>
-#include <linux/ioctl.h>
 #include <linux/skbuff.h>
+#include <linux/kmod.h>
 
 #include <linux/usb.h>
 
 #include <net/bluetooth/bluetooth.h>
-#include <net/bluetooth/bluez.h>
 #include <net/bluetooth/hci_core.h>
-#include <net/bluetooth/hci_usb.h>
+#include "hci_usb.h"
+
+#define HCI_MAX_PENDING (HCI_MAX_BULK_RX + HCI_MAX_BULK_TX + 1)
 
 #ifndef HCI_USB_DEBUG
-#undef  DBG
-#define DBG( A... )
-#undef  DMP
-#define DMP( A... )
+#undef  BT_DBG
+#define BT_DBG( A... )
+#undef  BT_DMP
+#define BT_DMP( A... )
+#endif
+
+#ifndef CONFIG_BLUEZ_USB_ZERO_PACKET
+#undef  USB_ZERO_PACKET
+#define USB_ZERO_PACKET 0
 #endif
 
+static struct usb_driver hci_usb_driver; 
+
 static struct usb_device_id usb_bluetooth_ids [] = {
+	/* Generic Bluetooth USB device */
 	{ USB_DEVICE_INFO(HCI_DEV_CLASS, HCI_DEV_SUBCLASS, HCI_DEV_PROTOCOL) },
+
+	/* Ericsson with non-standard id */
+	{ USB_DEVICE(0x0bdb, 0x1002) },
+
 	{ }	/* Terminating entry */
 };
 
 MODULE_DEVICE_TABLE (usb, usb_bluetooth_ids);
 
-static int hci_usb_ctrl_msg(struct hci_usb *husb,  struct sk_buff *skb);
-static int hci_usb_write_msg(struct hci_usb *husb, struct sk_buff *skb);
+static void hci_usb_interrupt(struct urb *urb);
+static void hci_usb_rx_complete(struct urb *urb);
+static void hci_usb_tx_complete(struct urb *urb);
 
-static void hci_usb_unlink_urbs(struct hci_usb *husb)
+static purb_t hci_usb_get_completed(struct hci_usb *husb)
 {
-	usb_unlink_urb(husb->read_urb);
-	usb_unlink_urb(husb->intr_urb);
-	usb_unlink_urb(husb->ctrl_urb);
-	usb_unlink_urb(husb->write_urb);
+	struct sk_buff *skb;
+	purb_t urb = NULL;
+
+	skb = skb_dequeue(&husb->completed_q);
+	if (skb) {
+		urb = ((struct hci_usb_scb *) skb->cb)->urb;
+		kfree_skb(skb);
+	}
+
+	BT_DBG("%s urb %p", husb->hdev.name, urb);
+	return urb;
 }
 
-static void hci_usb_free_bufs(struct hci_usb *husb)
+static int hci_usb_enable_intr(struct hci_usb *husb)
 {
-	if (husb->read_urb) {
-		if (husb->read_urb->transfer_buffer)
-			kfree(husb->read_urb->transfer_buffer);
-		usb_free_urb(husb->read_urb);
-	}
+	struct urb *urb;
+	int pipe, size;
+	void *buf;
 
-	if (husb->intr_urb) {
-		if (husb->intr_urb->transfer_buffer)
-			kfree(husb->intr_urb->transfer_buffer);
-		usb_free_urb(husb->intr_urb);
-	}
+	BT_DBG("%s", husb->hdev.name);
 
-	if (husb->ctrl_urb)
-		usb_free_urb(husb->ctrl_urb);
+ 	if (!(urb = usb_alloc_urb(0)))
+		return -ENOMEM;
 
-	if (husb->write_urb)
-		usb_free_urb(husb->write_urb);
+	if (!(buf = kmalloc(HCI_MAX_EVENT_SIZE, GFP_KERNEL))) {
+		usb_free_urb(urb);
+		return -ENOMEM;
+	}
 
-	if (husb->intr_skb)
-		kfree_skb(husb->intr_skb);
+	husb->intr_urb = urb;
+	
+        pipe = usb_rcvintpipe(husb->udev, husb->intr_ep);
+        size = usb_maxpacket(husb->udev, pipe, usb_pipeout(pipe));
+	FILL_INT_URB(urb, husb->udev, pipe, buf, size, 
+			hci_usb_interrupt, husb, husb->intr_interval);
+	
+	return usb_submit_urb(urb);
 }
 
-/* ------- Interface to HCI layer ------ */
-/* Initialize device */
-int hci_usb_open(struct hci_dev *hdev)
+static int hci_usb_disable_intr(struct hci_usb *husb)
 {
-	struct hci_usb *husb = (struct hci_usb *) hdev->driver_data;
-	int status;
-
-	DBG("%s", hdev->name);
+	struct urb *urb = husb->intr_urb;
+	struct sk_buff *skb;
 
-	husb->read_urb->dev = husb->udev;
-	if ((status = usb_submit_urb(husb->read_urb)))
-		DBG("read submit failed. %d", status);
+	BT_DBG("%s", husb->hdev.name);
 
-	husb->intr_urb->dev = husb->udev;
-	if ((status = usb_submit_urb(husb->intr_urb)))
-		DBG("interrupt submit failed. %d", status);
+	usb_unlink_urb(urb); usb_free_urb(urb);
+	husb->intr_urb = NULL;
 
-	hdev->flags |= HCI_RUNNING;
+	skb = husb->intr_skb;
+	if (skb) {
+		husb->intr_skb = NULL;
+		kfree_skb(skb);
+	}
 
 	return 0;
 }
 
-/* Reset device */
-int hci_usb_flush(struct hci_dev *hdev)
+static int hci_usb_rx_submit(struct hci_usb *husb, struct urb *urb)
 {
-	struct hci_usb *husb = (struct hci_usb *) hdev->driver_data;
+	struct hci_usb_scb *scb;
+	struct sk_buff *skb;
+	int    pipe, size, err;
 
-	DBG("%s", hdev->name);
+	if (!urb && !(urb = usb_alloc_urb(0)))
+		return -ENOMEM;
 
-	/* Drop TX queues */
-	skb_queue_purge(&husb->tx_ctrl_q);
-	skb_queue_purge(&husb->tx_write_q);
+        size = HCI_MAX_FRAME_SIZE;
 
-	return 0;
+	if (!(skb = bluez_skb_alloc(size, GFP_ATOMIC))) {
+		usb_free_urb(urb);
+		return -ENOMEM;
+	}
+	
+	BT_DBG("%s urb %p", husb->hdev.name, urb);
+
+	skb->dev = (void *) &husb->hdev;
+	skb->pkt_type = HCI_ACLDATA_PKT;
+
+	scb = (struct hci_usb_scb *) skb->cb;
+	scb->urb = urb;
+
+        pipe = usb_rcvbulkpipe(husb->udev, husb->bulk_in_ep);
+
+        FILL_BULK_URB(urb, husb->udev, pipe, skb->data, size, hci_usb_rx_complete, skb);
+        urb->transfer_flags = USB_QUEUE_BULK;
+
+	skb_queue_tail(&husb->pending_q, skb);
+	err = usb_submit_urb(urb);
+	if (err) {
+		BT_ERR("%s bulk rx submit failed urb %p err %d",
+				husb->hdev.name, urb, err);
+		skb_unlink(skb);
+		usb_free_urb(urb);
+	}
+	return err;
 }
 
-/* Close device */
-int hci_usb_close(struct hci_dev *hdev)
+/* Initialize device */
+static int hci_usb_open(struct hci_dev *hdev)
 {
 	struct hci_usb *husb = (struct hci_usb *) hdev->driver_data;
+	int i, err;
+	long flags;
 
-	DBG("%s", hdev->name);
+	BT_DBG("%s", hdev->name);
 
-	hdev->flags &= ~HCI_RUNNING;
-	hci_usb_unlink_urbs(husb);
+	if (test_and_set_bit(HCI_RUNNING, &hdev->flags))
+		return 0;
 
-	hci_usb_flush(hdev);
+	write_lock_irqsave(&husb->completion_lock, flags);
 
-	return 0;
+	err = hci_usb_enable_intr(husb);
+	if (!err) {
+		for (i = 0; i < HCI_MAX_BULK_TX; i++)
+			hci_usb_rx_submit(husb, NULL);
+	} else 
+		clear_bit(HCI_RUNNING, &hdev->flags);
+		
+	write_unlock_irqrestore(&husb->completion_lock, flags);
+	return err;
 }
 
-void hci_usb_ctrl_wakeup(struct hci_usb *husb)
+/* Reset device */
+static int hci_usb_flush(struct hci_dev *hdev)
 {
-	struct sk_buff *skb;
+	struct hci_usb *husb = (struct hci_usb *) hdev->driver_data;
 
-	if (test_and_set_bit(HCI_TX_CTRL, &husb->tx_state))
-		return;
+	BT_DBG("%s", hdev->name);
 
-	DBG("%s", husb->hdev.name);
+	skb_queue_purge(&husb->cmd_q);
+	skb_queue_purge(&husb->acl_q);
+	return 0;
+}
 
-	if (!(skb = skb_dequeue(&husb->tx_ctrl_q)))
-		goto done;
+static inline void hci_usb_unlink_urbs(struct hci_usb *husb)
+{
+	struct sk_buff *skb;
+	purb_t urb;
 
-	if (hci_usb_ctrl_msg(husb, skb)){
+	BT_DBG("%s", husb->hdev.name);
+
+	while ((skb = skb_dequeue(&husb->pending_q))) {
+		urb = ((struct hci_usb_scb *) skb->cb)->urb;
+		usb_unlink_urb(urb);
 		kfree_skb(skb);
-		goto done;
 	}
 
-	DMP(skb->data, skb->len);
+	while ((urb = hci_usb_get_completed(husb)))
+		usb_free_urb(urb);
+}
 
-	husb->hdev.stat.byte_tx += skb->len;
-	return;
+/* Close device */
+static int hci_usb_close(struct hci_dev *hdev)
+{
+	struct hci_usb *husb = (struct hci_usb *) hdev->driver_data;
+	long flags;
+	
+	if (!test_and_clear_bit(HCI_RUNNING, &hdev->flags))
+		return 0;
 
-done:
-	clear_bit(HCI_TX_CTRL, &husb->tx_state);
-	return;
+	BT_DBG("%s", hdev->name);
+
+	write_lock_irqsave(&husb->completion_lock, flags);
+	
+	hci_usb_disable_intr(husb);
+	hci_usb_unlink_urbs(husb);
+	hci_usb_flush(hdev);
+
+	write_unlock_irqrestore(&husb->completion_lock, flags);
+	return 0;
 }
 
-void hci_usb_write_wakeup(struct hci_usb *husb)
+static inline int hci_usb_send_ctrl(struct hci_usb *husb, struct sk_buff *skb)
 {
-	struct sk_buff *skb;
+	struct hci_usb_scb *scb = (void *) skb->cb;
+	purb_t urb = hci_usb_get_completed(husb);
+	devrequest *dr;
+	int pipe, err;
 
-	if (test_and_set_bit(HCI_TX_WRITE, &husb->tx_state))
-		return;
+	if (!urb && !(urb = usb_alloc_urb(0)))
+		return -ENOMEM;
 
-	DBG("%s", husb->hdev.name);
+	if (!(dr = kmalloc(sizeof(*dr), GFP_ATOMIC))) {
+		usb_free_urb(urb);
+		return -ENOMEM;
+	}
+	
+	pipe = usb_sndctrlpipe(husb->udev, 0);
 
-	if (!(skb = skb_dequeue(&husb->tx_write_q)))
-		goto done;
+	dr->requesttype = HCI_CTRL_REQ;
+	dr->request = 0;
+	dr->index   = 0;
+	dr->value   = 0;
+	dr->length  = __cpu_to_le16(skb->len);
 
-	if (hci_usb_write_msg(husb, skb)) {
-		skb_queue_head(&husb->tx_write_q, skb);
-		goto done;
-	}
+	FILL_CONTROL_URB(urb, husb->udev, pipe, (void *) dr,
+			skb->data, skb->len, hci_usb_tx_complete, skb);
 
-	DMP(skb->data, skb->len);
+	BT_DBG("%s urb %p len %d", husb->hdev.name, urb, skb->len);
 
-	husb->hdev.stat.byte_tx += skb->len;
-	return;
+	scb->urb = urb;
 
-done:
-	clear_bit(HCI_TX_WRITE, &husb->tx_state);
-	return;
+	skb_queue_tail(&husb->pending_q, skb);
+	err = usb_submit_urb(urb);
+	if (err) {
+		BT_ERR("%s ctrl tx submit failed urb %p err %d", 
+				husb->hdev.name, urb, err);
+		skb_unlink(skb);
+		usb_free_urb(urb); kfree(dr);
+	}
+	return err;
 }
 
-/* Send frames from HCI layer */
-int hci_usb_send_frame(struct sk_buff *skb)
+static inline int hci_usb_send_bulk(struct hci_usb *husb, struct sk_buff *skb)
 {
-	struct hci_dev *hdev = (struct hci_dev *) skb->dev;
-	struct hci_usb *husb;
+	struct hci_usb_scb *scb = (void *) skb->cb;
+	purb_t urb = hci_usb_get_completed(husb);
+	int pipe, err;
 
-	if (!hdev) {
-		ERR("frame for uknown device (hdev=NULL)");
-		return -ENODEV;
-	}
-
-	if (!(hdev->flags & HCI_RUNNING))
-		return 0;
+	if (!urb && !(urb = usb_alloc_urb(0)))
+		return -ENOMEM;
 
-	husb = (struct hci_usb *) hdev->driver_data;
+	pipe = usb_sndbulkpipe(husb->udev, husb->bulk_out_ep);
+        
+	FILL_BULK_URB(urb, husb->udev, pipe, skb->data, skb->len,
+	              hci_usb_tx_complete, skb);
+	urb->transfer_flags = USB_QUEUE_BULK | USB_ZERO_PACKET;
 
-	DBG("%s type %d len %d", hdev->name, skb->pkt_type, skb->len);
+	BT_DBG("%s urb %p len %d", husb->hdev.name, urb, skb->len);
 
-	switch (skb->pkt_type) {
-		case HCI_COMMAND_PKT:
-			skb_queue_tail(&husb->tx_ctrl_q, skb);
-			hci_usb_ctrl_wakeup(husb);
-			hdev->stat.cmd_tx++;
-			return 0;
-
-		case HCI_ACLDATA_PKT:
-			skb_queue_tail(&husb->tx_write_q, skb);
-			hci_usb_write_wakeup(husb);
-			hdev->stat.acl_tx++;
-			return 0;
-
-		case HCI_SCODATA_PKT:
-			return -EOPNOTSUPP;
-	};
+	scb->urb = urb;
 
-	return 0;
+	skb_queue_tail(&husb->pending_q, skb);
+	err = usb_submit_urb(urb);
+	if (err) {
+		BT_ERR("%s bulk tx submit failed urb %p err %d", 
+				husb->hdev.name, urb, err);
+		skb_unlink(skb);
+		usb_free_urb(urb);
+	}
+	return err;
 }
 
-/* ---------- USB ------------- */
-
-static void hci_usb_ctrl(struct urb *urb)
+static void hci_usb_tx_process(struct hci_usb *husb)
 {
-	struct sk_buff *skb = (struct sk_buff *) urb->context;
-	struct hci_dev *hdev;
-	struct hci_usb *husb;
-
-	if (!skb)
-		return;
-	hdev = (struct hci_dev *) skb->dev;
-	husb = (struct hci_usb *) hdev->driver_data;
+	struct sk_buff *skb;
 
-	DBG("%s", hdev->name);
+	BT_DBG("%s", husb->hdev.name);
 
-	if (urb->status)
-		DBG("%s ctrl status: %d", hdev->name, urb->status);
+	do {
+		clear_bit(HCI_USB_TX_WAKEUP, &husb->state);
+		
+		/* Process ACL queue */
+		while (skb_queue_len(&husb->pending_q) < HCI_MAX_PENDING &&
+				(skb = skb_dequeue(&husb->acl_q))) {
+			if (hci_usb_send_bulk(husb, skb) < 0) {
+				skb_queue_head(&husb->acl_q, skb);
+				break;
+			}
+		}
 
-	clear_bit(HCI_TX_CTRL, &husb->tx_state);
-	kfree_skb(skb);
+		/* Process command queue */
+		if (!test_bit(HCI_USB_CTRL_TX, &husb->state) &&
+			(skb = skb_dequeue(&husb->cmd_q)) != NULL) {
+			set_bit(HCI_USB_CTRL_TX, &husb->state);
+			if (hci_usb_send_ctrl(husb, skb) < 0) {
+				skb_queue_head(&husb->cmd_q, skb);
+				clear_bit(HCI_USB_CTRL_TX, &husb->state);
+			}
+		}
+	} while(test_bit(HCI_USB_TX_WAKEUP, &husb->state));
+}
 
-	/* Wake up device */
-	hci_usb_ctrl_wakeup(husb);
+static inline void hci_usb_tx_wakeup(struct hci_usb *husb)
+{
+	/* Serialize TX queue processing to avoid data reordering */
+	if (!test_and_set_bit(HCI_USB_TX_PROCESS, &husb->state)) {
+		hci_usb_tx_process(husb);
+		clear_bit(HCI_USB_TX_PROCESS, &husb->state);
+	} else
+		set_bit(HCI_USB_TX_WAKEUP, &husb->state);
 }
 
-static void hci_usb_bulk_write(struct urb *urb)
+/* Send frames from HCI layer */
+int hci_usb_send_frame(struct sk_buff *skb)
 {
-	struct sk_buff *skb = (struct sk_buff *) urb->context;
-	struct hci_dev *hdev;
+	struct hci_dev *hdev = (struct hci_dev *) skb->dev;
 	struct hci_usb *husb;
 
-	if (!skb)
-		return;
-	hdev = (struct hci_dev *) skb->dev;
+	if (!hdev) {
+		BT_ERR("frame for uknown device (hdev=NULL)");
+		return -ENODEV;
+	}
+
+	if (!test_bit(HCI_RUNNING, &hdev->flags))
+		return -EBUSY;
+
 	husb = (struct hci_usb *) hdev->driver_data;
 
-	DBG("%s", hdev->name);
+	BT_DBG("%s type %d len %d", hdev->name, skb->pkt_type, skb->len);
 
-	if (urb->status)
-		DBG("%s bulk write status: %d", hdev->name, urb->status);
+	read_lock(&husb->completion_lock);
 
-	clear_bit(HCI_TX_WRITE, &husb->tx_state);
-	kfree_skb(skb);
+	switch (skb->pkt_type) {
+	case HCI_COMMAND_PKT:
+		skb_queue_tail(&husb->cmd_q, skb);
+		hdev->stat.cmd_tx++;
+		break;
+
+	case HCI_ACLDATA_PKT:
+		skb_queue_tail(&husb->acl_q, skb);
+		hdev->stat.acl_tx++;
+		break;
 
-	/* Wake up device */
-	hci_usb_write_wakeup(husb);
+	case HCI_SCODATA_PKT:
+	default:
+		kfree_skb(skb);
+		break;
+	}
+	hci_usb_tx_wakeup(husb);
 
-	return;
+	read_unlock(&husb->completion_lock);
+	return 0;
 }
 
-static void hci_usb_intr(struct urb *urb)
+static void hci_usb_interrupt(struct urb *urb)
 {
-	struct hci_usb *husb = (struct hci_usb *) urb->context;
-	unsigned char *data = urb->transfer_buffer;
-	register int count  = urb->actual_length;
-	register struct sk_buff *skb = husb->intr_skb;
+	struct hci_usb *husb = (void *) urb->context;
+	struct hci_usb_scb *scb;
+	struct sk_buff *skb;
 	hci_event_hdr *eh;
-	register int len;
+	__u8 *data = urb->transfer_buffer;
+	int count = urb->actual_length;
+	int len = HCI_EVENT_HDR_SIZE;
 
-	if (!husb)
-		return;
+	BT_DBG("%s urb %p count %d", husb->hdev.name, urb, count);
 
-	DBG("%s count %d", husb->hdev.name, count);
+	if (!test_bit(HCI_RUNNING, &husb->hdev.flags))
+		return;
 
 	if (urb->status || !count) {
-		DBG("%s intr status %d, count %d", husb->hdev.name, urb->status, count);
+		BT_DBG("%s intr status %d, count %d", 
+				husb->hdev.name, urb->status, count);
 		return;
 	}
 
-	/* Do we really have to handle continuations here ? */
-	if (!skb) {
-		/* New frame */
-		if (count < HCI_EVENT_HDR_SIZE) {
-			DBG("%s bad frame len %d", husb->hdev.name, count);
-			return;
-		}
+	read_lock(&husb->completion_lock);
+	
+	husb->hdev.stat.byte_rx += count;
+
+	if (!(skb = husb->intr_skb)) {
+		/* Start of the frame */
+		if (count < HCI_EVENT_HDR_SIZE)
+			goto bad_len;
 
-		eh = (hci_event_hdr *) data;
+		eh  = (hci_event_hdr *) data;
 		len = eh->plen + HCI_EVENT_HDR_SIZE;
 
-		if (count > len) {
-			DBG("%s corrupted frame, len %d", husb->hdev.name, count);
-			return;
-		}
+		if (count > len)
+			goto bad_len;
 
-		/* Allocate skb */
-		if (!(skb = bluez_skb_alloc(len, GFP_ATOMIC))) {
-			ERR("Can't allocate mem for new packet");
-			return;
+		skb = bluez_skb_alloc(len, GFP_ATOMIC);
+		if (!skb) {
+			BT_ERR("%s no memory for event packet", husb->hdev.name);
+			goto done;
 		}
+		scb = (void *) skb->cb;
+
 		skb->dev = (void *) &husb->hdev;
 		skb->pkt_type = HCI_EVENT_PKT;
 
 		husb->intr_skb = skb;
-		husb->intr_count = len;
+		scb->intr_len  = len;
 	} else {
 		/* Continuation */
-		if (count > husb->intr_count) {
-			ERR("%s bad frame len %d (expected %d)", husb->hdev.name, count, husb->intr_count);
-
-			kfree_skb(skb);
+		scb = (void *) skb->cb;
+		len = scb->intr_len;
+		if (count > len) {
 			husb->intr_skb = NULL;
-			husb->intr_count = 0;
-			return;
+			kfree_skb(skb);
+			goto bad_len;
 		}
 	}
 
 	memcpy(skb_put(skb, count), data, count);
-	husb->intr_count -= count;
+	scb->intr_len -= count;
 
-	DMP(data, count);
+	if (!scb->intr_len) {
+		/* Complete frame */
+		husb->intr_skb = NULL;
+		hci_recv_frame(skb);
+	}
 
-	if (!husb->intr_count) {
-		/* Got complete frame */
+done:
+	read_unlock(&husb->completion_lock);
+	return;
 
-		husb->hdev.stat.byte_rx += skb->len;
-		hci_recv_frame(skb);
+bad_len:
+	BT_ERR("%s bad frame len %d expected %d", husb->hdev.name, count, len);
+	husb->hdev.stat.err_rx++;
+	read_unlock(&husb->completion_lock);
+}
 
-		husb->intr_skb = NULL;
+static void hci_usb_tx_complete(struct urb *urb)
+{
+	struct sk_buff *skb  = (struct sk_buff *) urb->context;
+	struct hci_dev *hdev = (struct hci_dev *) skb->dev;
+	struct hci_usb *husb = (struct hci_usb *) hdev->driver_data;
+
+	BT_DBG("%s urb %p status %d flags %x", husb->hdev.name, urb,
+			urb->status, urb->transfer_flags);
+
+	if (urb->pipe == usb_sndctrlpipe(husb->udev, 0)) {
+		kfree(urb->setup_packet);
+		clear_bit(HCI_USB_CTRL_TX, &husb->state);
 	}
+
+	if (!test_bit(HCI_RUNNING, &hdev->flags))
+		return;
+
+	read_lock(&husb->completion_lock);
+	
+	if (!urb->status)
+		husb->hdev.stat.byte_tx += skb->len;
+	else
+		husb->hdev.stat.err_tx++;
+
+	skb_unlink(skb);
+	skb_queue_tail(&husb->completed_q, skb);
+	hci_usb_tx_wakeup(husb);
+	
+	read_unlock(&husb->completion_lock);
+	return;
 }
 
-static void hci_usb_bulk_read(struct urb *urb)
+static void hci_usb_rx_complete(struct urb *urb)
 {
-	struct hci_usb *husb = (struct hci_usb *) urb->context;
-	unsigned char *data = urb->transfer_buffer;
-	int count = urb->actual_length, status;
-	struct sk_buff *skb;
+	struct sk_buff *skb  = (struct sk_buff *) urb->context;
+	struct hci_dev *hdev = (struct hci_dev *) skb->dev;
+	struct hci_usb *husb = (struct hci_usb *) hdev->driver_data;
+	int status, count = urb->actual_length;
 	hci_acl_hdr *ah;
-	register __u16 dlen;
+	int dlen, size;
 
-	if (!husb)
+	BT_DBG("%s urb %p status %d count %d flags %x", husb->hdev.name, urb,
+			urb->status, count, urb->transfer_flags);
+
+	if (!test_bit(HCI_RUNNING, &hdev->flags))
 		return;
 
-	DBG("%s status %d, count %d, flags %x", husb->hdev.name, urb->status, count, urb->transfer_flags);
+	read_lock(&husb->completion_lock);
 
-	if (urb->status) {
-		/* Do not re-submit URB on critical errors */
-		switch (urb->status) {
-			case -ENOENT:
-				return;
-			default:
-				goto resubmit;
-		};
-	}
-	if (!count)
+	if (urb->status || !count)
 		goto resubmit;
 
-	DMP(data, count);
+	husb->hdev.stat.byte_rx += count;
 
-	ah = (hci_acl_hdr *) data;
-	dlen = le16_to_cpu(ah->dlen);
+	ah   = (hci_acl_hdr *) skb->data;
+	dlen = __le16_to_cpu(ah->dlen);
+	size = HCI_ACL_HDR_SIZE + dlen;
 
 	/* Verify frame len and completeness */
-	if ((count - HCI_ACL_HDR_SIZE) != dlen) {
-		ERR("%s corrupted ACL packet: count %d, plen %d", husb->hdev.name, count, dlen);
-		goto resubmit;
-	}
-
-	/* Allocate packet */
-	if (!(skb = bluez_skb_alloc(count, GFP_ATOMIC))) {
-		ERR("Can't allocate mem for new packet");
+	if (count != size) {
+		BT_ERR("%s corrupted ACL packet: count %d, dlen %d",
+				husb->hdev.name, count, dlen);
+		bluez_dump("hci_usb", skb->data, count);
+		husb->hdev.stat.err_rx++;
 		goto resubmit;
 	}
 
-	memcpy(skb_put(skb, count), data, count);
-	skb->dev = (void *) &husb->hdev;
-	skb->pkt_type = HCI_ACLDATA_PKT;
-
-	husb->hdev.stat.byte_rx += skb->len;
-
+	skb_unlink(skb);
+	skb_put(skb, count);
 	hci_recv_frame(skb);
 
-resubmit:
-	husb->read_urb->dev = husb->udev;
-	if ((status = usb_submit_urb(husb->read_urb)))
-		DBG("%s read URB submit failed %d", husb->hdev.name, status);
+	hci_usb_rx_submit(husb, urb);
 
-	DBG("%s read URB re-submited", husb->hdev.name);
+	read_unlock(&husb->completion_lock);
+	return;
+		
+resubmit:
+	urb->dev = husb->udev;
+	status   = usb_submit_urb(urb);
+	BT_DBG("%s URB resubmit status %d", husb->hdev.name, status);
+	read_unlock(&husb->completion_lock);
 }
 
-static int hci_usb_ctrl_msg(struct hci_usb *husb, struct sk_buff *skb)
+static void hci_usb_destruct(struct hci_dev *hdev)
 {
-	struct urb *urb = husb->ctrl_urb;
-	devrequest *dr  = &husb->dev_req;
-	int pipe, status;
+	struct hci_usb *husb;
 
-	DBG("%s len %d", husb->hdev.name, skb->len);
+	if (!hdev) return;
 
-	pipe = usb_sndctrlpipe(husb->udev, 0);
+	BT_DBG("%s", hdev->name);
 
-	dr->requesttype = HCI_CTRL_REQ;
-	dr->request = 0;
-	dr->index   = 0;
-	dr->value   = 0;
-	dr->length  = cpu_to_le16(skb->len);
+	husb = (struct hci_usb *) hdev->driver_data;
+	kfree(husb);
+
+	MOD_DEC_USE_COUNT;
+}
 
-	FILL_CONTROL_URB(urb, husb->udev, pipe, (void*)dr, skb->data, skb->len,
-	                 hci_usb_ctrl, skb);
+#ifdef CONFIG_BLUEZ_USB_FW_LOAD
 
-	if ((status = usb_submit_urb(urb))) {
-		DBG("%s control URB submit failed %d", husb->hdev.name, status);
-		return status;
-	}
+/* Support for user mode Bluetooth USB firmware loader */
 
-	return 0;
-}
+#define FW_LOADER "/sbin/bluefw"
+static int errno;
 
-static int hci_usb_write_msg(struct hci_usb *husb, struct sk_buff *skb)
+static int hci_usb_fw_exec(void *dev)
 {
-	struct urb *urb = husb->write_urb;
-	int pipe, status;
+	char *envp[] = { "HOME=/", "TERM=linux", 
+			 "PATH=/sbin:/usr/sbin:/bin:/usr/bin", NULL };
+	char *argv[] = { FW_LOADER, dev, NULL };
+	int err;
 
-	DBG("%s len %d", husb->hdev.name, skb->len);
+	err = exec_usermodehelper(FW_LOADER, argv, envp);
+	if (err)
+		BT_ERR("failed to exec %s %s", FW_LOADER, (char *)dev);
+	return err;
+}
 
-	pipe = usb_sndbulkpipe(husb->udev, husb->bulk_out_ep_addr);
+static int hci_usb_fw_load(struct usb_device *udev)
+{
+	sigset_t tmpsig;
+	char dev[16];
+	pid_t pid;
+	int result;
 
-	FILL_BULK_URB(urb, husb->udev, pipe, skb->data, skb->len,
-	              hci_usb_bulk_write, skb);
-	urb->transfer_flags |= USB_QUEUE_BULK;
+	/* Check if root fs is mounted */
+	if (!current->fs->root) {
+		BT_ERR("root fs not mounted");
+		return -EPERM;
+	}
+
+	sprintf(dev, "%3.3d/%3.3d", udev->bus->busnum, udev->devnum);
 
-	if ((status = usb_submit_urb(urb))) {
-		DBG("%s write URB submit failed %d", husb->hdev.name, status);
-		return status;
+	pid = kernel_thread(hci_usb_fw_exec, (void *)dev, 0);
+	if (pid < 0) {
+		BT_ERR("fork failed, errno %d\n", -pid);
+		return pid;
 	}
 
+	/* Block signals, everything but SIGKILL/SIGSTOP */
+	spin_lock_irq(&current->sigmask_lock);
+	tmpsig = current->blocked;
+	siginitsetinv(&current->blocked, sigmask(SIGKILL) | sigmask(SIGSTOP));
+	recalc_sigpending(current);
+	spin_unlock_irq(&current->sigmask_lock);
+
+	result = waitpid(pid, NULL, __WCLONE);
+
+	/* Allow signals again */
+	spin_lock_irq(&current->sigmask_lock);
+	current->blocked = tmpsig;
+	recalc_sigpending(current);
+	spin_unlock_irq(&current->sigmask_lock);
+
+	if (result != pid) {
+		BT_ERR("waitpid failed pid %d errno %d\n", pid, -result);
+		return -result;
+	}
 	return 0;
 }
 
+#endif /* CONFIG_BLUEZ_USB_FW_LOAD */
+
 static void * hci_usb_probe(struct usb_device *udev, unsigned int ifnum, const struct usb_device_id *id)
 {
-	struct usb_endpoint_descriptor *bulk_out_ep, *intr_in_ep, *bulk_in_ep;
+	struct usb_endpoint_descriptor *bulk_out_ep[HCI_MAX_IFACE_NUM];
+	struct usb_endpoint_descriptor *isoc_out_ep[HCI_MAX_IFACE_NUM];
+	struct usb_endpoint_descriptor *bulk_in_ep[HCI_MAX_IFACE_NUM];
+	struct usb_endpoint_descriptor *isoc_in_ep[HCI_MAX_IFACE_NUM];
+	struct usb_endpoint_descriptor *intr_in_ep[HCI_MAX_IFACE_NUM];
 	struct usb_interface_descriptor *uif;
 	struct usb_endpoint_descriptor *ep;
+	struct usb_interface *iface, *isoc_iface;
 	struct hci_usb *husb;
 	struct hci_dev *hdev;
-	int i, size, pipe;
-	__u8 * buf;
+	int i, a, e, size, ifn, isoc_ifnum, isoc_alts;
 
-	DBG("udev %p ifnum %d", udev, ifnum);
+	BT_DBG("udev %p ifnum %d", udev, ifnum);
 
-	/* Check device signature */
-	if ((udev->descriptor.bDeviceClass    != HCI_DEV_CLASS)   ||
-	    (udev->descriptor.bDeviceSubClass != HCI_DEV_SUBCLASS)||
-	    (udev->descriptor.bDeviceProtocol != HCI_DEV_PROTOCOL) )
+	/* Check number of endpoints */
+	if (udev->actconfig->interface[ifnum].altsetting[0].bNumEndpoints < 3)
 		return NULL;
 
 	MOD_INC_USE_COUNT;
 
-	uif = &udev->actconfig->interface[ifnum].altsetting[0];
-
-	if (uif->bNumEndpoints != 3) {
-		DBG("Wrong number of endpoints %d", uif->bNumEndpoints);
-		MOD_DEC_USE_COUNT;
-		return NULL;
-	}
-
-	bulk_out_ep = intr_in_ep = bulk_in_ep = NULL;
+#ifdef CONFIG_BLUEZ_USB_FW_LOAD
+	hci_usb_fw_load(udev);
+#endif
 
+	memset(bulk_out_ep, 0, sizeof(bulk_out_ep));
+	memset(isoc_out_ep, 0, sizeof(isoc_out_ep));
+	memset(bulk_in_ep,  0, sizeof(bulk_in_ep));
+	memset(isoc_in_ep,  0, sizeof(isoc_in_ep));
+	memset(intr_in_ep,  0, sizeof(intr_in_ep));
+
+	size = 0; 
+	isoc_iface = NULL;
+	isoc_alts  = isoc_ifnum = 0;
+	
 	/* Find endpoints that we need */
-	for ( i = 0; i < uif->bNumEndpoints; ++i) {
-		ep = &uif->endpoint[i];
 
-		switch (ep->bmAttributes & USB_ENDPOINT_XFERTYPE_MASK) {
-			case USB_ENDPOINT_XFER_BULK:
-				if (ep->bEndpointAddress & USB_DIR_IN)
-					bulk_in_ep  = ep;
-				else
-					bulk_out_ep = ep;
-				break;
+	ifn = MIN(udev->actconfig->bNumInterfaces, HCI_MAX_IFACE_NUM);
+	for (i = 0; i < ifn; i++) {
+		iface = &udev->actconfig->interface[i];
+		for (a = 0; a < iface->num_altsetting; a++) {
+			uif = &iface->altsetting[a];
+			for (e = 0; e < uif->bNumEndpoints; e++) {
+				ep = &uif->endpoint[e];
+
+				switch (ep->bmAttributes & USB_ENDPOINT_XFERTYPE_MASK) {
+				case USB_ENDPOINT_XFER_INT:
+					if (ep->bEndpointAddress & USB_DIR_IN)
+						intr_in_ep[i] = ep;
+					break;
+
+				case USB_ENDPOINT_XFER_BULK:
+					if (ep->bEndpointAddress & USB_DIR_IN)
+						bulk_in_ep[i]  = ep;
+					else
+						bulk_out_ep[i] = ep;
+					break;
+
+				case USB_ENDPOINT_XFER_ISOC:
+					if (ep->wMaxPacketSize < size)
+						break;
+					size = ep->wMaxPacketSize;
+
+					isoc_iface = iface;
+					isoc_alts  = a;
+					isoc_ifnum = i;
+
+					if (ep->bEndpointAddress & USB_DIR_IN)
+						isoc_in_ep[i]  = ep;
+					else
+						isoc_out_ep[i] = ep;
+					break;
+				}
+			}
+		}
+	}
 
-			case USB_ENDPOINT_XFER_INT:
-				intr_in_ep = ep;
-				break;
-		};
+	if (!bulk_in_ep[0] || !bulk_out_ep[0] || !intr_in_ep[0]) {
+		BT_DBG("Bulk endpoints not found");
+		goto done;
 	}
 
-	if (!bulk_in_ep || !bulk_out_ep || !intr_in_ep) {
-		DBG("Endpoints not found: %p %p %p", bulk_in_ep, bulk_out_ep, intr_in_ep);
-		MOD_DEC_USE_COUNT;
-		return NULL;
+	if (!isoc_in_ep[1] || !isoc_out_ep[1]) {
+		BT_DBG("Isoc endpoints not found");
+		isoc_iface = NULL;
 	}
 
 	if (!(husb = kmalloc(sizeof(struct hci_usb), GFP_KERNEL))) {
-		ERR("Can't allocate: control structure");
-		MOD_DEC_USE_COUNT;
-		return NULL;
+		BT_ERR("Can't allocate: control structure");
+		goto done;
 	}
 
 	memset(husb, 0, sizeof(struct hci_usb));
 
 	husb->udev = udev;
-	husb->bulk_out_ep_addr = bulk_out_ep->bEndpointAddress;
-
-	if (!(husb->ctrl_urb = usb_alloc_urb(0))) {
-		ERR("Can't allocate: control URB");
-		goto probe_error;
-	}
+	husb->bulk_out_ep = bulk_out_ep[0]->bEndpointAddress;
+	husb->bulk_in_ep  = bulk_in_ep[0]->bEndpointAddress;
 
-	if (!(husb->write_urb = usb_alloc_urb(0))) {
-		ERR("Can't allocate: write URB");
-		goto probe_error;
-	}
-
-	if (!(husb->read_urb = usb_alloc_urb(0))) {
-		ERR("Can't allocate: read URB");
-		goto probe_error;
-	}
-
-	ep = bulk_in_ep;
-	pipe = usb_rcvbulkpipe(udev, ep->bEndpointAddress);
-	size = HCI_MAX_FRAME_SIZE;
-
-	if (!(buf = kmalloc(size, GFP_KERNEL))) {
-		ERR("Can't allocate: read buffer");
-		goto probe_error;
-	}
+	husb->intr_ep = intr_in_ep[0]->bEndpointAddress;
+	husb->intr_interval = intr_in_ep[0]->bInterval;
 
-	FILL_BULK_URB(husb->read_urb, udev, pipe, buf, size, hci_usb_bulk_read, husb);
-	husb->read_urb->transfer_flags |= USB_QUEUE_BULK;
-
-	ep = intr_in_ep;
-	pipe = usb_rcvintpipe(udev, ep->bEndpointAddress);
-	size = usb_maxpacket(udev, pipe, usb_pipeout(pipe));
-
-	if (!(husb->intr_urb = usb_alloc_urb(0))) {
-		ERR("Can't allocate: interrupt URB");
-		goto probe_error;
-	}
+	if (isoc_iface) {
+		if (usb_set_interface(udev, isoc_ifnum, isoc_alts)) {
+			BT_ERR("Can't set isoc interface settings");
+			isoc_iface = NULL;
+		}
+		usb_driver_claim_interface(&hci_usb_driver, isoc_iface, husb);
+		husb->isoc_iface  = isoc_iface;
 
-	if (!(buf = kmalloc(size, GFP_KERNEL))) {
-		ERR("Can't allocate: interrupt buffer");
-		goto probe_error;
+		husb->isoc_in_ep  = isoc_in_ep[1]->bEndpointAddress;
+		husb->isoc_out_ep = isoc_in_ep[1]->bEndpointAddress;
 	}
 
-	FILL_INT_URB(husb->intr_urb, udev, pipe, buf, size, hci_usb_intr, husb, ep->bInterval);
-
-	skb_queue_head_init(&husb->tx_ctrl_q);
-	skb_queue_head_init(&husb->tx_write_q);
+	husb->completion_lock = RW_LOCK_UNLOCKED;
+	
+	skb_queue_head_init(&husb->acl_q);
+	skb_queue_head_init(&husb->cmd_q);
+	skb_queue_head_init(&husb->pending_q);
+	skb_queue_head_init(&husb->completed_q);
 
 	/* Initialize and register HCI device */
 	hdev = &husb->hdev;
@@ -602,18 +787,20 @@
 	hdev->open  = hci_usb_open;
 	hdev->close = hci_usb_close;
 	hdev->flush = hci_usb_flush;
-	hdev->send	= hci_usb_send_frame;
+	hdev->send  = hci_usb_send_frame;
+	hdev->destruct = hci_usb_destruct;
 
 	if (hci_register_dev(hdev) < 0) {
-		ERR("Can't register HCI device %s", hdev->name);
+		BT_ERR("Can't register HCI device");
 		goto probe_error;
 	}
 
 	return husb;
 
 probe_error:
-	hci_usb_free_bufs(husb);
 	kfree(husb);
+
+done:
 	MOD_DEC_USE_COUNT;
 	return NULL;
 }
@@ -626,22 +813,18 @@
 	if (!husb)
 		return;
 
-	DBG("%s", hdev->name);
+	BT_DBG("%s", hdev->name);
 
 	hci_usb_close(hdev);
 
-	if (hci_unregister_dev(hdev) < 0) {
-		ERR("Can't unregister HCI device %s", hdev->name);
-	}
+	if (husb->isoc_iface)
+		usb_driver_release_interface(&hci_usb_driver, husb->isoc_iface);
 
-	hci_usb_free_bufs(husb);
-	kfree(husb);
-
-	MOD_DEC_USE_COUNT;
+	if (hci_unregister_dev(hdev) < 0)
+		BT_ERR("Can't unregister HCI device %s", hdev->name);
 }
 
-static struct usb_driver hci_usb_driver =
-{
+static struct usb_driver hci_usb_driver = {
 	name:           "hci_usb",
 	probe:          hci_usb_probe,
 	disconnect:     hci_usb_disconnect,
@@ -652,12 +835,12 @@
 {
 	int err;
 
-	INF("BlueZ HCI USB driver ver %s Copyright (C) 2000,2001 Qualcomm Inc",  
+	BT_INFO("BlueZ HCI USB driver ver %s Copyright (C) 2000,2001 Qualcomm Inc",  
 		VERSION);
-	INF("Written 2000,2001 by Maxim Krasnyansky <maxk@qualcomm.com>");
+	BT_INFO("Written 2000,2001 by Maxim Krasnyansky <maxk@qualcomm.com>");
 
 	if ((err = usb_register(&hci_usb_driver)) < 0)
-		ERR("Failed to register HCI USB driver");
+		BT_ERR("Failed to register HCI USB driver");
 
 	return err;
 }
FUNET's LINUX-ADM group, linux-adm@nic.funet.fi
TCL-scripts by Sam Shen (who was at: slshen@lbl.gov)