1/* 2 * 3 * AVM BlueFRITZ! USB driver 4 * 5 * Copyright (C) 2003-2006 Marcel Holtmann <marcel@holtmann.org> 6 * 7 * 8 * This program is free software; you can redistribute it and/or modify 9 * it under the terms of the GNU General Public License as published by 10 * the Free Software Foundation; either version 2 of the License, or 11 * (at your option) any later version. 12 * 13 * This program is distributed in the hope that it will be useful, 14 * but WITHOUT ANY WARRANTY; without even the implied warranty of 15 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the 16 * GNU General Public License for more details. 17 * 18 * You should have received a copy of the GNU General Public License 19 * along with this program; if not, write to the Free Software 20 * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA 21 * 22 */ 23 24#include <linux/module.h> 25 26#include <linux/kernel.h> 27#include <linux/init.h> 28#include <linux/slab.h> 29#include <linux/types.h> 30#include <linux/errno.h> 31#include <linux/skbuff.h> 32 33#include <linux/device.h> 34#include <linux/firmware.h> 35 36#include <linux/usb.h> 37 38#include <net/bluetooth/bluetooth.h> 39#include <net/bluetooth/hci_core.h> 40 41#define VERSION "1.2" 42 43static struct usb_driver bfusb_driver; 44 45static const struct usb_device_id bfusb_table[] = { 46 /* AVM BlueFRITZ! USB */ 47 { USB_DEVICE(0x057c, 0x2200) }, 48 49 { } /* Terminating entry */ 50}; 51 52MODULE_DEVICE_TABLE(usb, bfusb_table); 53 54#define BFUSB_MAX_BLOCK_SIZE 256 55 56#define BFUSB_BLOCK_TIMEOUT 3000 57 58#define BFUSB_TX_PROCESS 1 59#define BFUSB_TX_WAKEUP 2 60 61#define BFUSB_MAX_BULK_TX 2 62#define BFUSB_MAX_BULK_RX 2 63 64struct bfusb_data { 65 struct hci_dev *hdev; 66 67 unsigned long state; 68 69 struct usb_device *udev; 70 71 unsigned int bulk_in_ep; 72 unsigned int bulk_out_ep; 73 unsigned int bulk_pkt_size; 74 75 rwlock_t lock; 76 77 struct sk_buff_head transmit_q; 78 79 struct sk_buff *reassembly; 80 81 atomic_t pending_tx; 82 struct sk_buff_head pending_q; 83 struct sk_buff_head completed_q; 84}; 85 86struct bfusb_data_scb { 87 struct urb *urb; 88}; 89 90static void bfusb_tx_complete(struct urb *urb); 91static void bfusb_rx_complete(struct urb *urb); 92 93static struct urb *bfusb_get_completed(struct bfusb_data *data) 94{ 95 struct sk_buff *skb; 96 struct urb *urb = NULL; 97 98 BT_DBG("bfusb %p", data); 99 100 skb = skb_dequeue(&data->completed_q); 101 if (skb) { 102 urb = ((struct bfusb_data_scb *) skb->cb)->urb; 103 kfree_skb(skb); 104 } 105 106 return urb; 107} 108 109static void bfusb_unlink_urbs(struct bfusb_data *data) 110{ 111 struct sk_buff *skb; 112 struct urb *urb; 113 114 BT_DBG("bfusb %p", data); 115 116 while ((skb = skb_dequeue(&data->pending_q))) { 117 urb = ((struct bfusb_data_scb *) skb->cb)->urb; 118 usb_kill_urb(urb); 119 skb_queue_tail(&data->completed_q, skb); 120 } 121 122 while ((urb = bfusb_get_completed(data))) 123 usb_free_urb(urb); 124} 125 126static int bfusb_send_bulk(struct bfusb_data *data, struct sk_buff *skb) 127{ 128 struct bfusb_data_scb *scb = (void *) skb->cb; 129 struct urb *urb = bfusb_get_completed(data); 130 int err, pipe; 131 132 BT_DBG("bfusb %p skb %p len %d", data, skb, skb->len); 133 134 if (!urb) { 135 urb = usb_alloc_urb(0, GFP_ATOMIC); 136 if (!urb) 137 return -ENOMEM; 138 } 139 140 pipe = usb_sndbulkpipe(data->udev, data->bulk_out_ep); 141 142 usb_fill_bulk_urb(urb, data->udev, pipe, skb->data, skb->len, 143 bfusb_tx_complete, skb); 144 145 scb->urb = urb; 146 147 skb_queue_tail(&data->pending_q, skb); 148 149 err = usb_submit_urb(urb, GFP_ATOMIC); 150 if (err) { 151 BT_ERR("%s bulk tx submit failed urb %p err %d", 152 data->hdev->name, urb, err); 153 skb_unlink(skb, &data->pending_q); 154 usb_free_urb(urb); 155 } else 156 atomic_inc(&data->pending_tx); 157 158 return err; 159} 160 161static void bfusb_tx_wakeup(struct bfusb_data *data) 162{ 163 struct sk_buff *skb; 164 165 BT_DBG("bfusb %p", data); 166 167 if (test_and_set_bit(BFUSB_TX_PROCESS, &data->state)) { 168 set_bit(BFUSB_TX_WAKEUP, &data->state); 169 return; 170 } 171 172 do { 173 clear_bit(BFUSB_TX_WAKEUP, &data->state); 174 175 while ((atomic_read(&data->pending_tx) < BFUSB_MAX_BULK_TX) && 176 (skb = skb_dequeue(&data->transmit_q))) { 177 if (bfusb_send_bulk(data, skb) < 0) { 178 skb_queue_head(&data->transmit_q, skb); 179 break; 180 } 181 } 182 183 } while (test_bit(BFUSB_TX_WAKEUP, &data->state)); 184 185 clear_bit(BFUSB_TX_PROCESS, &data->state); 186} 187 188static void bfusb_tx_complete(struct urb *urb) 189{ 190 struct sk_buff *skb = (struct sk_buff *) urb->context; 191 struct bfusb_data *data = (struct bfusb_data *) skb->dev; 192 193 BT_DBG("bfusb %p urb %p skb %p len %d", data, urb, skb, skb->len); 194 195 atomic_dec(&data->pending_tx); 196 197 if (!test_bit(HCI_RUNNING, &data->hdev->flags)) 198 return; 199 200 if (!urb->status) 201 data->hdev->stat.byte_tx += skb->len; 202 else 203 data->hdev->stat.err_tx++; 204 205 read_lock(&data->lock); 206 207 skb_unlink(skb, &data->pending_q); 208 skb_queue_tail(&data->completed_q, skb); 209 210 bfusb_tx_wakeup(data); 211 212 read_unlock(&data->lock); 213} 214 215 216static int bfusb_rx_submit(struct bfusb_data *data, struct urb *urb) 217{ 218 struct bfusb_data_scb *scb; 219 struct sk_buff *skb; 220 int err, pipe, size = HCI_MAX_FRAME_SIZE + 32; 221 222 BT_DBG("bfusb %p urb %p", data, urb); 223 224 if (!urb) { 225 urb = usb_alloc_urb(0, GFP_ATOMIC); 226 if (!urb) 227 return -ENOMEM; 228 } 229 230 skb = bt_skb_alloc(size, GFP_ATOMIC); 231 if (!skb) { 232 usb_free_urb(urb); 233 return -ENOMEM; 234 } 235 236 skb->dev = (void *) data; 237 238 scb = (struct bfusb_data_scb *) skb->cb; 239 scb->urb = urb; 240 241 pipe = usb_rcvbulkpipe(data->udev, data->bulk_in_ep); 242 243 usb_fill_bulk_urb(urb, data->udev, pipe, skb->data, size, 244 bfusb_rx_complete, skb); 245 246 skb_queue_tail(&data->pending_q, skb); 247 248 err = usb_submit_urb(urb, GFP_ATOMIC); 249 if (err) { 250 BT_ERR("%s bulk rx submit failed urb %p err %d", 251 data->hdev->name, urb, err); 252 skb_unlink(skb, &data->pending_q); 253 kfree_skb(skb); 254 usb_free_urb(urb); 255 } 256 257 return err; 258} 259 260static inline int bfusb_recv_block(struct bfusb_data *data, int hdr, unsigned char *buf, int len) 261{ 262 BT_DBG("bfusb %p hdr 0x%02x data %p len %d", data, hdr, buf, len); 263 264 if (hdr & 0x10) { 265 BT_ERR("%s error in block", data->hdev->name); 266 kfree_skb(data->reassembly); 267 data->reassembly = NULL; 268 return -EIO; 269 } 270 271 if (hdr & 0x04) { 272 struct sk_buff *skb; 273 unsigned char pkt_type; 274 int pkt_len = 0; 275 276 if (data->reassembly) { 277 BT_ERR("%s unexpected start block", data->hdev->name); 278 kfree_skb(data->reassembly); 279 data->reassembly = NULL; 280 } 281 282 if (len < 1) { 283 BT_ERR("%s no packet type found", data->hdev->name); 284 return -EPROTO; 285 } 286 287 pkt_type = *buf++; len--; 288 289 switch (pkt_type) { 290 case HCI_EVENT_PKT: 291 if (len >= HCI_EVENT_HDR_SIZE) { 292 struct hci_event_hdr *hdr = (struct hci_event_hdr *) buf; 293 pkt_len = HCI_EVENT_HDR_SIZE + hdr->plen; 294 } else { 295 BT_ERR("%s event block is too short", data->hdev->name); 296 return -EILSEQ; 297 } 298 break; 299 300 case HCI_ACLDATA_PKT: 301 if (len >= HCI_ACL_HDR_SIZE) { 302 struct hci_acl_hdr *hdr = (struct hci_acl_hdr *) buf; 303 pkt_len = HCI_ACL_HDR_SIZE + __le16_to_cpu(hdr->dlen); 304 } else { 305 BT_ERR("%s data block is too short", data->hdev->name); 306 return -EILSEQ; 307 } 308 break; 309 310 case HCI_SCODATA_PKT: 311 if (len >= HCI_SCO_HDR_SIZE) { 312 struct hci_sco_hdr *hdr = (struct hci_sco_hdr *) buf; 313 pkt_len = HCI_SCO_HDR_SIZE + hdr->dlen; 314 } else { 315 BT_ERR("%s audio block is too short", data->hdev->name); 316 return -EILSEQ; 317 } 318 break; 319 } 320 321 skb = bt_skb_alloc(pkt_len, GFP_ATOMIC); 322 if (!skb) { 323 BT_ERR("%s no memory for the packet", data->hdev->name); 324 return -ENOMEM; 325 } 326 327 bt_cb(skb)->pkt_type = pkt_type; 328 329 data->reassembly = skb; 330 } else { 331 if (!data->reassembly) { 332 BT_ERR("%s unexpected continuation block", data->hdev->name); 333 return -EIO; 334 } 335 } 336 337 if (len > 0) 338 memcpy(skb_put(data->reassembly, len), buf, len); 339 340 if (hdr & 0x08) { 341 hci_recv_frame(data->hdev, data->reassembly); 342 data->reassembly = NULL; 343 } 344 345 return 0; 346} 347 348static void bfusb_rx_complete(struct urb *urb) 349{ 350 struct sk_buff *skb = (struct sk_buff *) urb->context; 351 struct bfusb_data *data = (struct bfusb_data *) skb->dev; 352 unsigned char *buf = urb->transfer_buffer; 353 int count = urb->actual_length; 354 int err, hdr, len; 355 356 BT_DBG("bfusb %p urb %p skb %p len %d", data, urb, skb, skb->len); 357 358 read_lock(&data->lock); 359 360 if (!test_bit(HCI_RUNNING, &data->hdev->flags)) 361 goto unlock; 362 363 if (urb->status || !count) 364 goto resubmit; 365 366 data->hdev->stat.byte_rx += count; 367 368 skb_put(skb, count); 369 370 while (count) { 371 hdr = buf[0] | (buf[1] << 8); 372 373 if (hdr & 0x4000) { 374 len = 0; 375 count -= 2; 376 buf += 2; 377 } else { 378 len = (buf[2] == 0) ? 256 : buf[2]; 379 count -= 3; 380 buf += 3; 381 } 382 383 if (count < len) { 384 BT_ERR("%s block extends over URB buffer ranges", 385 data->hdev->name); 386 } 387 388 if ((hdr & 0xe1) == 0xc1) 389 bfusb_recv_block(data, hdr, buf, len); 390 391 count -= len; 392 buf += len; 393 } 394 395 skb_unlink(skb, &data->pending_q); 396 kfree_skb(skb); 397 398 bfusb_rx_submit(data, urb); 399 400 read_unlock(&data->lock); 401 402 return; 403 404resubmit: 405 urb->dev = data->udev; 406 407 err = usb_submit_urb(urb, GFP_ATOMIC); 408 if (err) { 409 BT_ERR("%s bulk resubmit failed urb %p err %d", 410 data->hdev->name, urb, err); 411 } 412 413unlock: 414 read_unlock(&data->lock); 415} 416 417static int bfusb_open(struct hci_dev *hdev) 418{ 419 struct bfusb_data *data = hci_get_drvdata(hdev); 420 unsigned long flags; 421 int i, err; 422 423 BT_DBG("hdev %p bfusb %p", hdev, data); 424 425 if (test_and_set_bit(HCI_RUNNING, &hdev->flags)) 426 return 0; 427 428 write_lock_irqsave(&data->lock, flags); 429 430 err = bfusb_rx_submit(data, NULL); 431 if (!err) { 432 for (i = 1; i < BFUSB_MAX_BULK_RX; i++) 433 bfusb_rx_submit(data, NULL); 434 } else { 435 clear_bit(HCI_RUNNING, &hdev->flags); 436 } 437 438 write_unlock_irqrestore(&data->lock, flags); 439 440 return err; 441} 442 443static int bfusb_flush(struct hci_dev *hdev) 444{ 445 struct bfusb_data *data = hci_get_drvdata(hdev); 446 447 BT_DBG("hdev %p bfusb %p", hdev, data); 448 449 skb_queue_purge(&data->transmit_q); 450 451 return 0; 452} 453 454static int bfusb_close(struct hci_dev *hdev) 455{ 456 struct bfusb_data *data = hci_get_drvdata(hdev); 457 unsigned long flags; 458 459 BT_DBG("hdev %p bfusb %p", hdev, data); 460 461 if (!test_and_clear_bit(HCI_RUNNING, &hdev->flags)) 462 return 0; 463 464 write_lock_irqsave(&data->lock, flags); 465 write_unlock_irqrestore(&data->lock, flags); 466 467 bfusb_unlink_urbs(data); 468 bfusb_flush(hdev); 469 470 return 0; 471} 472 473static int bfusb_send_frame(struct hci_dev *hdev, struct sk_buff *skb) 474{ 475 struct bfusb_data *data = hci_get_drvdata(hdev); 476 struct sk_buff *nskb; 477 unsigned char buf[3]; 478 int sent = 0, size, count; 479 480 BT_DBG("hdev %p skb %p type %d len %d", hdev, skb, bt_cb(skb)->pkt_type, skb->len); 481 482 if (!test_bit(HCI_RUNNING, &hdev->flags)) 483 return -EBUSY; 484 485 switch (bt_cb(skb)->pkt_type) { 486 case HCI_COMMAND_PKT: 487 hdev->stat.cmd_tx++; 488 break; 489 case HCI_ACLDATA_PKT: 490 hdev->stat.acl_tx++; 491 break; 492 case HCI_SCODATA_PKT: 493 hdev->stat.sco_tx++; 494 break; 495 }; 496 497 /* Prepend skb with frame type */ 498 memcpy(skb_push(skb, 1), &bt_cb(skb)->pkt_type, 1); 499 500 count = skb->len; 501 502 /* Max HCI frame size seems to be 1511 + 1 */ 503 nskb = bt_skb_alloc(count + 32, GFP_ATOMIC); 504 if (!nskb) { 505 BT_ERR("Can't allocate memory for new packet"); 506 return -ENOMEM; 507 } 508 509 nskb->dev = (void *) data; 510 511 while (count) { 512 size = min_t(uint, count, BFUSB_MAX_BLOCK_SIZE); 513 514 buf[0] = 0xc1 | ((sent == 0) ? 0x04 : 0) | ((count == size) ? 0x08 : 0); 515 buf[1] = 0x00; 516 buf[2] = (size == BFUSB_MAX_BLOCK_SIZE) ? 0 : size; 517 518 memcpy(skb_put(nskb, 3), buf, 3); 519 skb_copy_from_linear_data_offset(skb, sent, skb_put(nskb, size), size); 520 521 sent += size; 522 count -= size; 523 } 524 525 /* Don't send frame with multiple size of bulk max packet */ 526 if ((nskb->len % data->bulk_pkt_size) == 0) { 527 buf[0] = 0xdd; 528 buf[1] = 0x00; 529 memcpy(skb_put(nskb, 2), buf, 2); 530 } 531 532 read_lock(&data->lock); 533 534 skb_queue_tail(&data->transmit_q, nskb); 535 bfusb_tx_wakeup(data); 536 537 read_unlock(&data->lock); 538 539 kfree_skb(skb); 540 541 return 0; 542} 543 544static int bfusb_load_firmware(struct bfusb_data *data, 545 const unsigned char *firmware, int count) 546{ 547 unsigned char *buf; 548 int err, pipe, len, size, sent = 0; 549 550 BT_DBG("bfusb %p udev %p", data, data->udev); 551 552 BT_INFO("BlueFRITZ! USB loading firmware"); 553 554 buf = kmalloc(BFUSB_MAX_BLOCK_SIZE + 3, GFP_KERNEL); 555 if (!buf) { 556 BT_ERR("Can't allocate memory chunk for firmware"); 557 return -ENOMEM; 558 } 559 560 pipe = usb_sndctrlpipe(data->udev, 0); 561 562 if (usb_control_msg(data->udev, pipe, USB_REQ_SET_CONFIGURATION, 563 0, 1, 0, NULL, 0, USB_CTRL_SET_TIMEOUT) < 0) { 564 BT_ERR("Can't change to loading configuration"); 565 kfree(buf); 566 return -EBUSY; 567 } 568 569 data->udev->toggle[0] = data->udev->toggle[1] = 0; 570 571 pipe = usb_sndbulkpipe(data->udev, data->bulk_out_ep); 572 573 while (count) { 574 size = min_t(uint, count, BFUSB_MAX_BLOCK_SIZE + 3); 575 576 memcpy(buf, firmware + sent, size); 577 578 err = usb_bulk_msg(data->udev, pipe, buf, size, 579 &len, BFUSB_BLOCK_TIMEOUT); 580 581 if (err || (len != size)) { 582 BT_ERR("Error in firmware loading"); 583 goto error; 584 } 585 586 sent += size; 587 count -= size; 588 } 589 590 err = usb_bulk_msg(data->udev, pipe, NULL, 0, 591 &len, BFUSB_BLOCK_TIMEOUT); 592 if (err < 0) { 593 BT_ERR("Error in null packet request"); 594 goto error; 595 } 596 597 pipe = usb_sndctrlpipe(data->udev, 0); 598 599 err = usb_control_msg(data->udev, pipe, USB_REQ_SET_CONFIGURATION, 600 0, 2, 0, NULL, 0, USB_CTRL_SET_TIMEOUT); 601 if (err < 0) { 602 BT_ERR("Can't change to running configuration"); 603 goto error; 604 } 605 606 data->udev->toggle[0] = data->udev->toggle[1] = 0; 607 608 BT_INFO("BlueFRITZ! USB device ready"); 609 610 kfree(buf); 611 return 0; 612 613error: 614 kfree(buf); 615 616 pipe = usb_sndctrlpipe(data->udev, 0); 617 618 usb_control_msg(data->udev, pipe, USB_REQ_SET_CONFIGURATION, 619 0, 0, 0, NULL, 0, USB_CTRL_SET_TIMEOUT); 620 621 return err; 622} 623 624static int bfusb_probe(struct usb_interface *intf, const struct usb_device_id *id) 625{ 626 const struct firmware *firmware; 627 struct usb_device *udev = interface_to_usbdev(intf); 628 struct usb_host_endpoint *bulk_out_ep; 629 struct usb_host_endpoint *bulk_in_ep; 630 struct hci_dev *hdev; 631 struct bfusb_data *data; 632 633 BT_DBG("intf %p id %p", intf, id); 634 635 /* Check number of endpoints */ 636 if (intf->cur_altsetting->desc.bNumEndpoints < 2) 637 return -EIO; 638 639 bulk_out_ep = &intf->cur_altsetting->endpoint[0]; 640 bulk_in_ep = &intf->cur_altsetting->endpoint[1]; 641 642 if (!bulk_out_ep || !bulk_in_ep) { 643 BT_ERR("Bulk endpoints not found"); 644 goto done; 645 } 646 647 /* Initialize control structure and load firmware */ 648 data = devm_kzalloc(&intf->dev, sizeof(struct bfusb_data), GFP_KERNEL); 649 if (!data) { 650 BT_ERR("Can't allocate memory for control structure"); 651 goto done; 652 } 653 654 data->udev = udev; 655 data->bulk_in_ep = bulk_in_ep->desc.bEndpointAddress; 656 data->bulk_out_ep = bulk_out_ep->desc.bEndpointAddress; 657 data->bulk_pkt_size = le16_to_cpu(bulk_out_ep->desc.wMaxPacketSize); 658 659 rwlock_init(&data->lock); 660 661 data->reassembly = NULL; 662 663 skb_queue_head_init(&data->transmit_q); 664 skb_queue_head_init(&data->pending_q); 665 skb_queue_head_init(&data->completed_q); 666 667 if (request_firmware(&firmware, "bfubase.frm", &udev->dev) < 0) { 668 BT_ERR("Firmware request failed"); 669 goto done; 670 } 671 672 BT_DBG("firmware data %p size %zu", firmware->data, firmware->size); 673 674 if (bfusb_load_firmware(data, firmware->data, firmware->size) < 0) { 675 BT_ERR("Firmware loading failed"); 676 goto release; 677 } 678 679 release_firmware(firmware); 680 681 /* Initialize and register HCI device */ 682 hdev = hci_alloc_dev(); 683 if (!hdev) { 684 BT_ERR("Can't allocate HCI device"); 685 goto done; 686 } 687 688 data->hdev = hdev; 689 690 hdev->bus = HCI_USB; 691 hci_set_drvdata(hdev, data); 692 SET_HCIDEV_DEV(hdev, &intf->dev); 693 694 hdev->open = bfusb_open; 695 hdev->close = bfusb_close; 696 hdev->flush = bfusb_flush; 697 hdev->send = bfusb_send_frame; 698 699 if (hci_register_dev(hdev) < 0) { 700 BT_ERR("Can't register HCI device"); 701 hci_free_dev(hdev); 702 goto done; 703 } 704 705 usb_set_intfdata(intf, data); 706 707 return 0; 708 709release: 710 release_firmware(firmware); 711 712done: 713 return -EIO; 714} 715 716static void bfusb_disconnect(struct usb_interface *intf) 717{ 718 struct bfusb_data *data = usb_get_intfdata(intf); 719 struct hci_dev *hdev = data->hdev; 720 721 BT_DBG("intf %p", intf); 722 723 if (!hdev) 724 return; 725 726 usb_set_intfdata(intf, NULL); 727 728 bfusb_close(hdev); 729 730 hci_unregister_dev(hdev); 731 hci_free_dev(hdev); 732} 733 734static struct usb_driver bfusb_driver = { 735 .name = "bfusb", 736 .probe = bfusb_probe, 737 .disconnect = bfusb_disconnect, 738 .id_table = bfusb_table, 739 .disable_hub_initiated_lpm = 1, 740}; 741 742module_usb_driver(bfusb_driver); 743 744MODULE_AUTHOR("Marcel Holtmann <marcel@holtmann.org>"); 745MODULE_DESCRIPTION("BlueFRITZ! USB driver ver " VERSION); 746MODULE_VERSION(VERSION); 747MODULE_LICENSE("GPL"); 748MODULE_FIRMWARE("bfubase.frm"); 749