0001
0002
0003
0004
0005
0006
0007
0008
0009 #include <linux/module.h>
0010
0011 #include <linux/kernel.h>
0012 #include <linux/init.h>
0013 #include <linux/slab.h>
0014 #include <linux/types.h>
0015 #include <linux/errno.h>
0016 #include <linux/skbuff.h>
0017
0018 #include <linux/device.h>
0019 #include <linux/firmware.h>
0020
0021 #include <linux/usb.h>
0022
0023 #include <net/bluetooth/bluetooth.h>
0024 #include <net/bluetooth/hci_core.h>
0025
0026 #define VERSION "1.2"
0027
0028 static struct usb_driver bfusb_driver;
0029
0030 static const struct usb_device_id bfusb_table[] = {
0031
0032 { USB_DEVICE(0x057c, 0x2200) },
0033
0034 { }
0035 };
0036
0037 MODULE_DEVICE_TABLE(usb, bfusb_table);
0038
0039 #define BFUSB_MAX_BLOCK_SIZE 256
0040
0041 #define BFUSB_BLOCK_TIMEOUT 3000
0042
0043 #define BFUSB_TX_PROCESS 1
0044 #define BFUSB_TX_WAKEUP 2
0045
0046 #define BFUSB_MAX_BULK_TX 2
0047 #define BFUSB_MAX_BULK_RX 2
0048
0049 struct bfusb_data {
0050 struct hci_dev *hdev;
0051
0052 unsigned long state;
0053
0054 struct usb_device *udev;
0055
0056 unsigned int bulk_in_ep;
0057 unsigned int bulk_out_ep;
0058 unsigned int bulk_pkt_size;
0059
0060 rwlock_t lock;
0061
0062 struct sk_buff_head transmit_q;
0063
0064 struct sk_buff *reassembly;
0065
0066 atomic_t pending_tx;
0067 struct sk_buff_head pending_q;
0068 struct sk_buff_head completed_q;
0069 };
0070
0071 struct bfusb_data_scb {
0072 struct urb *urb;
0073 };
0074
0075 static void bfusb_tx_complete(struct urb *urb);
0076 static void bfusb_rx_complete(struct urb *urb);
0077
0078 static struct urb *bfusb_get_completed(struct bfusb_data *data)
0079 {
0080 struct sk_buff *skb;
0081 struct urb *urb = NULL;
0082
0083 BT_DBG("bfusb %p", data);
0084
0085 skb = skb_dequeue(&data->completed_q);
0086 if (skb) {
0087 urb = ((struct bfusb_data_scb *) skb->cb)->urb;
0088 kfree_skb(skb);
0089 }
0090
0091 return urb;
0092 }
0093
0094 static void bfusb_unlink_urbs(struct bfusb_data *data)
0095 {
0096 struct sk_buff *skb;
0097 struct urb *urb;
0098
0099 BT_DBG("bfusb %p", data);
0100
0101 while ((skb = skb_dequeue(&data->pending_q))) {
0102 urb = ((struct bfusb_data_scb *) skb->cb)->urb;
0103 usb_kill_urb(urb);
0104 skb_queue_tail(&data->completed_q, skb);
0105 }
0106
0107 while ((urb = bfusb_get_completed(data)))
0108 usb_free_urb(urb);
0109 }
0110
0111 static int bfusb_send_bulk(struct bfusb_data *data, struct sk_buff *skb)
0112 {
0113 struct bfusb_data_scb *scb = (void *) skb->cb;
0114 struct urb *urb = bfusb_get_completed(data);
0115 int err, pipe;
0116
0117 BT_DBG("bfusb %p skb %p len %d", data, skb, skb->len);
0118
0119 if (!urb) {
0120 urb = usb_alloc_urb(0, GFP_ATOMIC);
0121 if (!urb)
0122 return -ENOMEM;
0123 }
0124
0125 pipe = usb_sndbulkpipe(data->udev, data->bulk_out_ep);
0126
0127 usb_fill_bulk_urb(urb, data->udev, pipe, skb->data, skb->len,
0128 bfusb_tx_complete, skb);
0129
0130 scb->urb = urb;
0131
0132 skb_queue_tail(&data->pending_q, skb);
0133
0134 err = usb_submit_urb(urb, GFP_ATOMIC);
0135 if (err) {
0136 bt_dev_err(data->hdev, "bulk tx submit failed urb %p err %d",
0137 urb, err);
0138 skb_unlink(skb, &data->pending_q);
0139 usb_free_urb(urb);
0140 } else
0141 atomic_inc(&data->pending_tx);
0142
0143 return err;
0144 }
0145
0146 static void bfusb_tx_wakeup(struct bfusb_data *data)
0147 {
0148 struct sk_buff *skb;
0149
0150 BT_DBG("bfusb %p", data);
0151
0152 if (test_and_set_bit(BFUSB_TX_PROCESS, &data->state)) {
0153 set_bit(BFUSB_TX_WAKEUP, &data->state);
0154 return;
0155 }
0156
0157 do {
0158 clear_bit(BFUSB_TX_WAKEUP, &data->state);
0159
0160 while ((atomic_read(&data->pending_tx) < BFUSB_MAX_BULK_TX) &&
0161 (skb = skb_dequeue(&data->transmit_q))) {
0162 if (bfusb_send_bulk(data, skb) < 0) {
0163 skb_queue_head(&data->transmit_q, skb);
0164 break;
0165 }
0166 }
0167
0168 } while (test_bit(BFUSB_TX_WAKEUP, &data->state));
0169
0170 clear_bit(BFUSB_TX_PROCESS, &data->state);
0171 }
0172
0173 static void bfusb_tx_complete(struct urb *urb)
0174 {
0175 struct sk_buff *skb = (struct sk_buff *) urb->context;
0176 struct bfusb_data *data = (struct bfusb_data *) skb->dev;
0177
0178 BT_DBG("bfusb %p urb %p skb %p len %d", data, urb, skb, skb->len);
0179
0180 atomic_dec(&data->pending_tx);
0181
0182 if (!test_bit(HCI_RUNNING, &data->hdev->flags))
0183 return;
0184
0185 if (!urb->status)
0186 data->hdev->stat.byte_tx += skb->len;
0187 else
0188 data->hdev->stat.err_tx++;
0189
0190 read_lock(&data->lock);
0191
0192 skb_unlink(skb, &data->pending_q);
0193 skb_queue_tail(&data->completed_q, skb);
0194
0195 bfusb_tx_wakeup(data);
0196
0197 read_unlock(&data->lock);
0198 }
0199
0200
0201 static int bfusb_rx_submit(struct bfusb_data *data, struct urb *urb)
0202 {
0203 struct bfusb_data_scb *scb;
0204 struct sk_buff *skb;
0205 int err, pipe, size = HCI_MAX_FRAME_SIZE + 32;
0206
0207 BT_DBG("bfusb %p urb %p", data, urb);
0208
0209 if (!urb) {
0210 urb = usb_alloc_urb(0, GFP_ATOMIC);
0211 if (!urb)
0212 return -ENOMEM;
0213 }
0214
0215 skb = bt_skb_alloc(size, GFP_ATOMIC);
0216 if (!skb) {
0217 usb_free_urb(urb);
0218 return -ENOMEM;
0219 }
0220
0221 skb->dev = (void *) data;
0222
0223 scb = (struct bfusb_data_scb *) skb->cb;
0224 scb->urb = urb;
0225
0226 pipe = usb_rcvbulkpipe(data->udev, data->bulk_in_ep);
0227
0228 usb_fill_bulk_urb(urb, data->udev, pipe, skb->data, size,
0229 bfusb_rx_complete, skb);
0230
0231 skb_queue_tail(&data->pending_q, skb);
0232
0233 err = usb_submit_urb(urb, GFP_ATOMIC);
0234 if (err) {
0235 bt_dev_err(data->hdev, "bulk rx submit failed urb %p err %d",
0236 urb, err);
0237 skb_unlink(skb, &data->pending_q);
0238 kfree_skb(skb);
0239 usb_free_urb(urb);
0240 }
0241
0242 return err;
0243 }
0244
0245 static inline int bfusb_recv_block(struct bfusb_data *data, int hdr, unsigned char *buf, int len)
0246 {
0247 BT_DBG("bfusb %p hdr 0x%02x data %p len %d", data, hdr, buf, len);
0248
0249 if (hdr & 0x10) {
0250 bt_dev_err(data->hdev, "error in block");
0251 kfree_skb(data->reassembly);
0252 data->reassembly = NULL;
0253 return -EIO;
0254 }
0255
0256 if (hdr & 0x04) {
0257 struct sk_buff *skb;
0258 unsigned char pkt_type;
0259 int pkt_len = 0;
0260
0261 if (data->reassembly) {
0262 bt_dev_err(data->hdev, "unexpected start block");
0263 kfree_skb(data->reassembly);
0264 data->reassembly = NULL;
0265 }
0266
0267 if (len < 1) {
0268 bt_dev_err(data->hdev, "no packet type found");
0269 return -EPROTO;
0270 }
0271
0272 pkt_type = *buf++; len--;
0273
0274 switch (pkt_type) {
0275 case HCI_EVENT_PKT:
0276 if (len >= HCI_EVENT_HDR_SIZE) {
0277 struct hci_event_hdr *hdr = (struct hci_event_hdr *) buf;
0278 pkt_len = HCI_EVENT_HDR_SIZE + hdr->plen;
0279 } else {
0280 bt_dev_err(data->hdev, "event block is too short");
0281 return -EILSEQ;
0282 }
0283 break;
0284
0285 case HCI_ACLDATA_PKT:
0286 if (len >= HCI_ACL_HDR_SIZE) {
0287 struct hci_acl_hdr *hdr = (struct hci_acl_hdr *) buf;
0288 pkt_len = HCI_ACL_HDR_SIZE + __le16_to_cpu(hdr->dlen);
0289 } else {
0290 bt_dev_err(data->hdev, "data block is too short");
0291 return -EILSEQ;
0292 }
0293 break;
0294
0295 case HCI_SCODATA_PKT:
0296 if (len >= HCI_SCO_HDR_SIZE) {
0297 struct hci_sco_hdr *hdr = (struct hci_sco_hdr *) buf;
0298 pkt_len = HCI_SCO_HDR_SIZE + hdr->dlen;
0299 } else {
0300 bt_dev_err(data->hdev, "audio block is too short");
0301 return -EILSEQ;
0302 }
0303 break;
0304 }
0305
0306 skb = bt_skb_alloc(pkt_len, GFP_ATOMIC);
0307 if (!skb) {
0308 bt_dev_err(data->hdev, "no memory for the packet");
0309 return -ENOMEM;
0310 }
0311
0312 hci_skb_pkt_type(skb) = pkt_type;
0313
0314 data->reassembly = skb;
0315 } else {
0316 if (!data->reassembly) {
0317 bt_dev_err(data->hdev, "unexpected continuation block");
0318 return -EIO;
0319 }
0320 }
0321
0322 if (len > 0)
0323 skb_put_data(data->reassembly, buf, len);
0324
0325 if (hdr & 0x08) {
0326 hci_recv_frame(data->hdev, data->reassembly);
0327 data->reassembly = NULL;
0328 }
0329
0330 return 0;
0331 }
0332
0333 static void bfusb_rx_complete(struct urb *urb)
0334 {
0335 struct sk_buff *skb = (struct sk_buff *) urb->context;
0336 struct bfusb_data *data = (struct bfusb_data *) skb->dev;
0337 unsigned char *buf = urb->transfer_buffer;
0338 int count = urb->actual_length;
0339 int err, hdr, len;
0340
0341 BT_DBG("bfusb %p urb %p skb %p len %d", data, urb, skb, skb->len);
0342
0343 read_lock(&data->lock);
0344
0345 if (!test_bit(HCI_RUNNING, &data->hdev->flags))
0346 goto unlock;
0347
0348 if (urb->status || !count)
0349 goto resubmit;
0350
0351 data->hdev->stat.byte_rx += count;
0352
0353 skb_put(skb, count);
0354
0355 while (count) {
0356 hdr = buf[0] | (buf[1] << 8);
0357
0358 if (hdr & 0x4000) {
0359 len = 0;
0360 count -= 2;
0361 buf += 2;
0362 } else {
0363 len = (buf[2] == 0) ? 256 : buf[2];
0364 count -= 3;
0365 buf += 3;
0366 }
0367
0368 if (count < len) {
0369 bt_dev_err(data->hdev, "block extends over URB buffer ranges");
0370 }
0371
0372 if ((hdr & 0xe1) == 0xc1)
0373 bfusb_recv_block(data, hdr, buf, len);
0374
0375 count -= len;
0376 buf += len;
0377 }
0378
0379 skb_unlink(skb, &data->pending_q);
0380 kfree_skb(skb);
0381
0382 bfusb_rx_submit(data, urb);
0383
0384 read_unlock(&data->lock);
0385
0386 return;
0387
0388 resubmit:
0389 urb->dev = data->udev;
0390
0391 err = usb_submit_urb(urb, GFP_ATOMIC);
0392 if (err) {
0393 bt_dev_err(data->hdev, "bulk resubmit failed urb %p err %d",
0394 urb, err);
0395 }
0396
0397 unlock:
0398 read_unlock(&data->lock);
0399 }
0400
0401 static int bfusb_open(struct hci_dev *hdev)
0402 {
0403 struct bfusb_data *data = hci_get_drvdata(hdev);
0404 unsigned long flags;
0405 int i, err;
0406
0407 BT_DBG("hdev %p bfusb %p", hdev, data);
0408
0409 write_lock_irqsave(&data->lock, flags);
0410
0411 err = bfusb_rx_submit(data, NULL);
0412 if (!err) {
0413 for (i = 1; i < BFUSB_MAX_BULK_RX; i++)
0414 bfusb_rx_submit(data, NULL);
0415 }
0416
0417 write_unlock_irqrestore(&data->lock, flags);
0418
0419 return err;
0420 }
0421
0422 static int bfusb_flush(struct hci_dev *hdev)
0423 {
0424 struct bfusb_data *data = hci_get_drvdata(hdev);
0425
0426 BT_DBG("hdev %p bfusb %p", hdev, data);
0427
0428 skb_queue_purge(&data->transmit_q);
0429
0430 return 0;
0431 }
0432
0433 static int bfusb_close(struct hci_dev *hdev)
0434 {
0435 struct bfusb_data *data = hci_get_drvdata(hdev);
0436 unsigned long flags;
0437
0438 BT_DBG("hdev %p bfusb %p", hdev, data);
0439
0440 write_lock_irqsave(&data->lock, flags);
0441 write_unlock_irqrestore(&data->lock, flags);
0442
0443 bfusb_unlink_urbs(data);
0444 bfusb_flush(hdev);
0445
0446 return 0;
0447 }
0448
0449 static int bfusb_send_frame(struct hci_dev *hdev, struct sk_buff *skb)
0450 {
0451 struct bfusb_data *data = hci_get_drvdata(hdev);
0452 struct sk_buff *nskb;
0453 unsigned char buf[3];
0454 int sent = 0, size, count;
0455
0456 BT_DBG("hdev %p skb %p type %d len %d", hdev, skb,
0457 hci_skb_pkt_type(skb), skb->len);
0458
0459 switch (hci_skb_pkt_type(skb)) {
0460 case HCI_COMMAND_PKT:
0461 hdev->stat.cmd_tx++;
0462 break;
0463 case HCI_ACLDATA_PKT:
0464 hdev->stat.acl_tx++;
0465 break;
0466 case HCI_SCODATA_PKT:
0467 hdev->stat.sco_tx++;
0468 break;
0469 }
0470
0471
0472 memcpy(skb_push(skb, 1), &hci_skb_pkt_type(skb), 1);
0473
0474 count = skb->len;
0475
0476
0477 nskb = bt_skb_alloc(count + 32, GFP_KERNEL);
0478 if (!nskb) {
0479 bt_dev_err(hdev, "Can't allocate memory for new packet");
0480 return -ENOMEM;
0481 }
0482
0483 nskb->dev = (void *) data;
0484
0485 while (count) {
0486 size = min_t(uint, count, BFUSB_MAX_BLOCK_SIZE);
0487
0488 buf[0] = 0xc1 | ((sent == 0) ? 0x04 : 0) | ((count == size) ? 0x08 : 0);
0489 buf[1] = 0x00;
0490 buf[2] = (size == BFUSB_MAX_BLOCK_SIZE) ? 0 : size;
0491
0492 skb_put_data(nskb, buf, 3);
0493 skb_copy_from_linear_data_offset(skb, sent, skb_put(nskb, size), size);
0494
0495 sent += size;
0496 count -= size;
0497 }
0498
0499
0500 if ((nskb->len % data->bulk_pkt_size) == 0) {
0501 buf[0] = 0xdd;
0502 buf[1] = 0x00;
0503 skb_put_data(nskb, buf, 2);
0504 }
0505
0506 read_lock(&data->lock);
0507
0508 skb_queue_tail(&data->transmit_q, nskb);
0509 bfusb_tx_wakeup(data);
0510
0511 read_unlock(&data->lock);
0512
0513 kfree_skb(skb);
0514
0515 return 0;
0516 }
0517
0518 static int bfusb_load_firmware(struct bfusb_data *data,
0519 const unsigned char *firmware, int count)
0520 {
0521 unsigned char *buf;
0522 int err, pipe, len, size, sent = 0;
0523
0524 BT_DBG("bfusb %p udev %p", data, data->udev);
0525
0526 BT_INFO("BlueFRITZ! USB loading firmware");
0527
0528 buf = kmalloc(BFUSB_MAX_BLOCK_SIZE + 3, GFP_KERNEL);
0529 if (!buf) {
0530 BT_ERR("Can't allocate memory chunk for firmware");
0531 return -ENOMEM;
0532 }
0533
0534 pipe = usb_sndctrlpipe(data->udev, 0);
0535
0536 if (usb_control_msg(data->udev, pipe, USB_REQ_SET_CONFIGURATION,
0537 0, 1, 0, NULL, 0, USB_CTRL_SET_TIMEOUT) < 0) {
0538 BT_ERR("Can't change to loading configuration");
0539 kfree(buf);
0540 return -EBUSY;
0541 }
0542
0543 data->udev->toggle[0] = data->udev->toggle[1] = 0;
0544
0545 pipe = usb_sndbulkpipe(data->udev, data->bulk_out_ep);
0546
0547 while (count) {
0548 size = min_t(uint, count, BFUSB_MAX_BLOCK_SIZE + 3);
0549
0550 memcpy(buf, firmware + sent, size);
0551
0552 err = usb_bulk_msg(data->udev, pipe, buf, size,
0553 &len, BFUSB_BLOCK_TIMEOUT);
0554
0555 if (err || (len != size)) {
0556 BT_ERR("Error in firmware loading");
0557 goto error;
0558 }
0559
0560 sent += size;
0561 count -= size;
0562 }
0563
0564 err = usb_bulk_msg(data->udev, pipe, NULL, 0,
0565 &len, BFUSB_BLOCK_TIMEOUT);
0566 if (err < 0) {
0567 BT_ERR("Error in null packet request");
0568 goto error;
0569 }
0570
0571 pipe = usb_sndctrlpipe(data->udev, 0);
0572
0573 err = usb_control_msg(data->udev, pipe, USB_REQ_SET_CONFIGURATION,
0574 0, 2, 0, NULL, 0, USB_CTRL_SET_TIMEOUT);
0575 if (err < 0) {
0576 BT_ERR("Can't change to running configuration");
0577 goto error;
0578 }
0579
0580 data->udev->toggle[0] = data->udev->toggle[1] = 0;
0581
0582 BT_INFO("BlueFRITZ! USB device ready");
0583
0584 kfree(buf);
0585 return 0;
0586
0587 error:
0588 kfree(buf);
0589
0590 pipe = usb_sndctrlpipe(data->udev, 0);
0591
0592 usb_control_msg(data->udev, pipe, USB_REQ_SET_CONFIGURATION,
0593 0, 0, 0, NULL, 0, USB_CTRL_SET_TIMEOUT);
0594
0595 return err;
0596 }
0597
0598 static int bfusb_probe(struct usb_interface *intf, const struct usb_device_id *id)
0599 {
0600 const struct firmware *firmware;
0601 struct usb_device *udev = interface_to_usbdev(intf);
0602 struct usb_host_endpoint *bulk_out_ep;
0603 struct usb_host_endpoint *bulk_in_ep;
0604 struct hci_dev *hdev;
0605 struct bfusb_data *data;
0606
0607 BT_DBG("intf %p id %p", intf, id);
0608
0609
0610 if (intf->cur_altsetting->desc.bNumEndpoints < 2)
0611 return -EIO;
0612
0613 bulk_out_ep = &intf->cur_altsetting->endpoint[0];
0614 bulk_in_ep = &intf->cur_altsetting->endpoint[1];
0615
0616 if (!bulk_out_ep || !bulk_in_ep) {
0617 BT_ERR("Bulk endpoints not found");
0618 goto done;
0619 }
0620
0621
0622 data = devm_kzalloc(&intf->dev, sizeof(struct bfusb_data), GFP_KERNEL);
0623 if (!data)
0624 return -ENOMEM;
0625
0626 data->udev = udev;
0627 data->bulk_in_ep = bulk_in_ep->desc.bEndpointAddress;
0628 data->bulk_out_ep = bulk_out_ep->desc.bEndpointAddress;
0629 data->bulk_pkt_size = le16_to_cpu(bulk_out_ep->desc.wMaxPacketSize);
0630
0631 if (!data->bulk_pkt_size)
0632 goto done;
0633
0634 rwlock_init(&data->lock);
0635
0636 data->reassembly = NULL;
0637
0638 skb_queue_head_init(&data->transmit_q);
0639 skb_queue_head_init(&data->pending_q);
0640 skb_queue_head_init(&data->completed_q);
0641
0642 if (request_firmware(&firmware, "bfubase.frm", &udev->dev) < 0) {
0643 BT_ERR("Firmware request failed");
0644 goto done;
0645 }
0646
0647 BT_DBG("firmware data %p size %zu", firmware->data, firmware->size);
0648
0649 if (bfusb_load_firmware(data, firmware->data, firmware->size) < 0) {
0650 BT_ERR("Firmware loading failed");
0651 goto release;
0652 }
0653
0654 release_firmware(firmware);
0655
0656
0657 hdev = hci_alloc_dev();
0658 if (!hdev) {
0659 BT_ERR("Can't allocate HCI device");
0660 goto done;
0661 }
0662
0663 data->hdev = hdev;
0664
0665 hdev->bus = HCI_USB;
0666 hci_set_drvdata(hdev, data);
0667 SET_HCIDEV_DEV(hdev, &intf->dev);
0668
0669 hdev->open = bfusb_open;
0670 hdev->close = bfusb_close;
0671 hdev->flush = bfusb_flush;
0672 hdev->send = bfusb_send_frame;
0673
0674 set_bit(HCI_QUIRK_BROKEN_LOCAL_COMMANDS, &hdev->quirks);
0675
0676 if (hci_register_dev(hdev) < 0) {
0677 BT_ERR("Can't register HCI device");
0678 hci_free_dev(hdev);
0679 goto done;
0680 }
0681
0682 usb_set_intfdata(intf, data);
0683
0684 return 0;
0685
0686 release:
0687 release_firmware(firmware);
0688
0689 done:
0690 return -EIO;
0691 }
0692
0693 static void bfusb_disconnect(struct usb_interface *intf)
0694 {
0695 struct bfusb_data *data = usb_get_intfdata(intf);
0696 struct hci_dev *hdev = data->hdev;
0697
0698 BT_DBG("intf %p", intf);
0699
0700 if (!hdev)
0701 return;
0702
0703 usb_set_intfdata(intf, NULL);
0704
0705 bfusb_close(hdev);
0706
0707 hci_unregister_dev(hdev);
0708 hci_free_dev(hdev);
0709 }
0710
0711 static struct usb_driver bfusb_driver = {
0712 .name = "bfusb",
0713 .probe = bfusb_probe,
0714 .disconnect = bfusb_disconnect,
0715 .id_table = bfusb_table,
0716 .disable_hub_initiated_lpm = 1,
0717 };
0718
0719 module_usb_driver(bfusb_driver);
0720
0721 MODULE_AUTHOR("Marcel Holtmann <marcel@holtmann.org>");
0722 MODULE_DESCRIPTION("BlueFRITZ! USB driver ver " VERSION);
0723 MODULE_VERSION(VERSION);
0724 MODULE_LICENSE("GPL");
0725 MODULE_FIRMWARE("bfubase.frm");