1 // SPDX-License-Identifier: GPL-2.0-or-later 2 /* 3 * 4 * AVM BlueFRITZ! USB driver 5 * 6 * Copyright (C) 2003-2006 Marcel Holtmann <marcel@holtmann.org> 7 */ 8 9 #include <linux/module.h> 10 11 #include <linux/kernel.h> 12 #include <linux/init.h> 13 #include <linux/slab.h> 14 #include <linux/types.h> 15 #include <linux/errno.h> 16 #include <linux/skbuff.h> 17 18 #include <linux/device.h> 19 #include <linux/firmware.h> 20 21 #include <linux/usb.h> 22 23 #include <net/bluetooth/bluetooth.h> 24 #include <net/bluetooth/hci_core.h> 25 26 #define VERSION "1.2" 27 28 static struct usb_driver bfusb_driver; 29 30 static const struct usb_device_id bfusb_table[] = { 31 /* AVM BlueFRITZ! USB */ 32 { USB_DEVICE(0x057c, 0x2200) }, 33 34 { } /* Terminating entry */ 35 }; 36 37 MODULE_DEVICE_TABLE(usb, bfusb_table); 38 39 #define BFUSB_MAX_BLOCK_SIZE 256 40 41 #define BFUSB_BLOCK_TIMEOUT 3000 42 43 #define BFUSB_TX_PROCESS 1 44 #define BFUSB_TX_WAKEUP 2 45 46 #define BFUSB_MAX_BULK_TX 2 47 #define BFUSB_MAX_BULK_RX 2 48 49 struct bfusb_data { 50 struct hci_dev *hdev; 51 52 unsigned long state; 53 54 struct usb_device *udev; 55 56 unsigned int bulk_in_ep; 57 unsigned int bulk_out_ep; 58 unsigned int bulk_pkt_size; 59 60 rwlock_t lock; 61 62 struct sk_buff_head transmit_q; 63 64 struct sk_buff *reassembly; 65 66 atomic_t pending_tx; 67 struct sk_buff_head pending_q; 68 struct sk_buff_head completed_q; 69 }; 70 71 struct bfusb_data_scb { 72 struct urb *urb; 73 }; 74 75 static void bfusb_tx_complete(struct urb *urb); 76 static void bfusb_rx_complete(struct urb *urb); 77 78 static struct urb *bfusb_get_completed(struct bfusb_data *data) 79 { 80 struct sk_buff *skb; 81 struct urb *urb = NULL; 82 83 BT_DBG("bfusb %p", data); 84 85 skb = skb_dequeue(&data->completed_q); 86 if (skb) { 87 urb = ((struct bfusb_data_scb *) skb->cb)->urb; 88 kfree_skb(skb); 89 } 90 91 return urb; 92 } 93 94 static void bfusb_unlink_urbs(struct bfusb_data *data) 95 { 96 struct sk_buff *skb; 97 struct urb *urb; 98 99 BT_DBG("bfusb %p", data); 100 101 while ((skb = skb_dequeue(&data->pending_q))) { 102 urb = ((struct bfusb_data_scb *) skb->cb)->urb; 103 usb_kill_urb(urb); 104 skb_queue_tail(&data->completed_q, skb); 105 } 106 107 while ((urb = bfusb_get_completed(data))) 108 usb_free_urb(urb); 109 } 110 111 static int bfusb_send_bulk(struct bfusb_data *data, struct sk_buff *skb) 112 { 113 struct bfusb_data_scb *scb = (void *) skb->cb; 114 struct urb *urb = bfusb_get_completed(data); 115 int err, pipe; 116 117 BT_DBG("bfusb %p skb %p len %d", data, skb, skb->len); 118 119 if (!urb) { 120 urb = usb_alloc_urb(0, GFP_ATOMIC); 121 if (!urb) 122 return -ENOMEM; 123 } 124 125 pipe = usb_sndbulkpipe(data->udev, data->bulk_out_ep); 126 127 usb_fill_bulk_urb(urb, data->udev, pipe, skb->data, skb->len, 128 bfusb_tx_complete, skb); 129 130 scb->urb = urb; 131 132 skb_queue_tail(&data->pending_q, skb); 133 134 err = usb_submit_urb(urb, GFP_ATOMIC); 135 if (err) { 136 bt_dev_err(data->hdev, "bulk tx submit failed urb %p err %d", 137 urb, err); 138 skb_unlink(skb, &data->pending_q); 139 usb_free_urb(urb); 140 } else 141 atomic_inc(&data->pending_tx); 142 143 return err; 144 } 145 146 static void bfusb_tx_wakeup(struct bfusb_data *data) 147 { 148 struct sk_buff *skb; 149 150 BT_DBG("bfusb %p", data); 151 152 if (test_and_set_bit(BFUSB_TX_PROCESS, &data->state)) { 153 set_bit(BFUSB_TX_WAKEUP, &data->state); 154 return; 155 } 156 157 do { 158 clear_bit(BFUSB_TX_WAKEUP, &data->state); 159 160 while ((atomic_read(&data->pending_tx) < BFUSB_MAX_BULK_TX) && 161 (skb = skb_dequeue(&data->transmit_q))) { 162 if (bfusb_send_bulk(data, skb) < 0) { 163 skb_queue_head(&data->transmit_q, skb); 164 break; 165 } 166 } 167 168 } while (test_bit(BFUSB_TX_WAKEUP, &data->state)); 169 170 clear_bit(BFUSB_TX_PROCESS, &data->state); 171 } 172 173 static void bfusb_tx_complete(struct urb *urb) 174 { 175 struct sk_buff *skb = (struct sk_buff *) urb->context; 176 struct bfusb_data *data = (struct bfusb_data *) skb->dev; 177 178 BT_DBG("bfusb %p urb %p skb %p len %d", data, urb, skb, skb->len); 179 180 atomic_dec(&data->pending_tx); 181 182 if (!test_bit(HCI_RUNNING, &data->hdev->flags)) 183 return; 184 185 if (!urb->status) 186 data->hdev->stat.byte_tx += skb->len; 187 else 188 data->hdev->stat.err_tx++; 189 190 read_lock(&data->lock); 191 192 skb_unlink(skb, &data->pending_q); 193 skb_queue_tail(&data->completed_q, skb); 194 195 bfusb_tx_wakeup(data); 196 197 read_unlock(&data->lock); 198 } 199 200 201 static int bfusb_rx_submit(struct bfusb_data *data, struct urb *urb) 202 { 203 struct bfusb_data_scb *scb; 204 struct sk_buff *skb; 205 int err, pipe, size = HCI_MAX_FRAME_SIZE + 32; 206 207 BT_DBG("bfusb %p urb %p", data, urb); 208 209 if (!urb) { 210 urb = usb_alloc_urb(0, GFP_ATOMIC); 211 if (!urb) 212 return -ENOMEM; 213 } 214 215 skb = bt_skb_alloc(size, GFP_ATOMIC); 216 if (!skb) { 217 usb_free_urb(urb); 218 return -ENOMEM; 219 } 220 221 skb->dev = (void *) data; 222 223 scb = (struct bfusb_data_scb *) skb->cb; 224 scb->urb = urb; 225 226 pipe = usb_rcvbulkpipe(data->udev, data->bulk_in_ep); 227 228 usb_fill_bulk_urb(urb, data->udev, pipe, skb->data, size, 229 bfusb_rx_complete, skb); 230 231 skb_queue_tail(&data->pending_q, skb); 232 233 err = usb_submit_urb(urb, GFP_ATOMIC); 234 if (err) { 235 bt_dev_err(data->hdev, "bulk rx submit failed urb %p err %d", 236 urb, err); 237 skb_unlink(skb, &data->pending_q); 238 kfree_skb(skb); 239 usb_free_urb(urb); 240 } 241 242 return err; 243 } 244 245 static inline int bfusb_recv_block(struct bfusb_data *data, int hdr, unsigned char *buf, int len) 246 { 247 BT_DBG("bfusb %p hdr 0x%02x data %p len %d", data, hdr, buf, len); 248 249 if (hdr & 0x10) { 250 bt_dev_err(data->hdev, "error in block"); 251 kfree_skb(data->reassembly); 252 data->reassembly = NULL; 253 return -EIO; 254 } 255 256 if (hdr & 0x04) { 257 struct sk_buff *skb; 258 unsigned char pkt_type; 259 int pkt_len = 0; 260 261 if (data->reassembly) { 262 bt_dev_err(data->hdev, "unexpected start block"); 263 kfree_skb(data->reassembly); 264 data->reassembly = NULL; 265 } 266 267 if (len < 1) { 268 bt_dev_err(data->hdev, "no packet type found"); 269 return -EPROTO; 270 } 271 272 pkt_type = *buf++; len--; 273 274 switch (pkt_type) { 275 case HCI_EVENT_PKT: 276 if (len >= HCI_EVENT_HDR_SIZE) { 277 struct hci_event_hdr *hdr = (struct hci_event_hdr *) buf; 278 pkt_len = HCI_EVENT_HDR_SIZE + hdr->plen; 279 } else { 280 bt_dev_err(data->hdev, "event block is too short"); 281 return -EILSEQ; 282 } 283 break; 284 285 case HCI_ACLDATA_PKT: 286 if (len >= HCI_ACL_HDR_SIZE) { 287 struct hci_acl_hdr *hdr = (struct hci_acl_hdr *) buf; 288 pkt_len = HCI_ACL_HDR_SIZE + __le16_to_cpu(hdr->dlen); 289 } else { 290 bt_dev_err(data->hdev, "data block is too short"); 291 return -EILSEQ; 292 } 293 break; 294 295 case HCI_SCODATA_PKT: 296 if (len >= HCI_SCO_HDR_SIZE) { 297 struct hci_sco_hdr *hdr = (struct hci_sco_hdr *) buf; 298 pkt_len = HCI_SCO_HDR_SIZE + hdr->dlen; 299 } else { 300 bt_dev_err(data->hdev, "audio block is too short"); 301 return -EILSEQ; 302 } 303 break; 304 305 default: 306 bt_dev_err(data->hdev, "unknown packet type 0x%02x", 307 pkt_type); 308 return -EILSEQ; 309 } 310 311 skb = bt_skb_alloc(pkt_len, GFP_ATOMIC); 312 if (!skb) { 313 bt_dev_err(data->hdev, "no memory for the packet"); 314 return -ENOMEM; 315 } 316 317 hci_skb_pkt_type(skb) = pkt_type; 318 319 data->reassembly = skb; 320 } else { 321 if (!data->reassembly) { 322 bt_dev_err(data->hdev, "unexpected continuation block"); 323 return -EIO; 324 } 325 } 326 327 if (len > skb_tailroom(data->reassembly)) { 328 bt_dev_err(data->hdev, "block exceeds packet length"); 329 kfree_skb(data->reassembly); 330 data->reassembly = NULL; 331 return -EILSEQ; 332 } 333 334 if (len > 0) 335 skb_put_data(data->reassembly, buf, len); 336 337 if (hdr & 0x08) { 338 hci_recv_frame(data->hdev, data->reassembly); 339 data->reassembly = NULL; 340 } 341 342 return 0; 343 } 344 345 static void bfusb_rx_complete(struct urb *urb) 346 { 347 struct sk_buff *skb = (struct sk_buff *) urb->context; 348 struct bfusb_data *data = (struct bfusb_data *) skb->dev; 349 unsigned char *buf = urb->transfer_buffer; 350 int count = urb->actual_length; 351 int err, hdr, len; 352 353 BT_DBG("bfusb %p urb %p skb %p len %d", data, urb, skb, skb->len); 354 355 read_lock(&data->lock); 356 357 if (!test_bit(HCI_RUNNING, &data->hdev->flags)) 358 goto unlock; 359 360 if (urb->status || !count) 361 goto resubmit; 362 363 data->hdev->stat.byte_rx += count; 364 365 skb_put(skb, count); 366 367 while (count) { 368 if (count < 2) { 369 bt_dev_err(data->hdev, "short block header"); 370 kfree_skb(data->reassembly); 371 data->reassembly = NULL; 372 break; 373 } 374 375 hdr = buf[0] | (buf[1] << 8); 376 377 if (hdr & 0x4000) { 378 len = 0; 379 count -= 2; 380 buf += 2; 381 } else { 382 if (count < 3) { 383 bt_dev_err(data->hdev, "short block header"); 384 kfree_skb(data->reassembly); 385 data->reassembly = NULL; 386 break; 387 } 388 389 len = (buf[2] == 0) ? 256 : buf[2]; 390 count -= 3; 391 buf += 3; 392 } 393 394 if (count < len) { 395 bt_dev_err(data->hdev, "block extends over URB buffer ranges"); 396 kfree_skb(data->reassembly); 397 data->reassembly = NULL; 398 break; 399 } 400 401 if ((hdr & 0xe1) == 0xc1 && 402 bfusb_recv_block(data, hdr, buf, len) < 0) 403 data->hdev->stat.err_rx++; 404 405 count -= len; 406 buf += len; 407 } 408 409 skb_unlink(skb, &data->pending_q); 410 kfree_skb(skb); 411 412 bfusb_rx_submit(data, urb); 413 414 read_unlock(&data->lock); 415 416 return; 417 418 resubmit: 419 urb->dev = data->udev; 420 421 err = usb_submit_urb(urb, GFP_ATOMIC); 422 if (err) { 423 bt_dev_err(data->hdev, "bulk resubmit failed urb %p err %d", 424 urb, err); 425 } 426 427 unlock: 428 read_unlock(&data->lock); 429 } 430 431 static int bfusb_open(struct hci_dev *hdev) 432 { 433 struct bfusb_data *data = hci_get_drvdata(hdev); 434 unsigned long flags; 435 int i, err; 436 437 BT_DBG("hdev %p bfusb %p", hdev, data); 438 439 write_lock_irqsave(&data->lock, flags); 440 441 err = bfusb_rx_submit(data, NULL); 442 if (!err) { 443 for (i = 1; i < BFUSB_MAX_BULK_RX; i++) 444 bfusb_rx_submit(data, NULL); 445 } 446 447 write_unlock_irqrestore(&data->lock, flags); 448 449 return err; 450 } 451 452 static int bfusb_flush(struct hci_dev *hdev) 453 { 454 struct bfusb_data *data = hci_get_drvdata(hdev); 455 456 BT_DBG("hdev %p bfusb %p", hdev, data); 457 458 skb_queue_purge(&data->transmit_q); 459 460 return 0; 461 } 462 463 static int bfusb_close(struct hci_dev *hdev) 464 { 465 struct bfusb_data *data = hci_get_drvdata(hdev); 466 unsigned long flags; 467 468 BT_DBG("hdev %p bfusb %p", hdev, data); 469 470 write_lock_irqsave(&data->lock, flags); 471 write_unlock_irqrestore(&data->lock, flags); 472 473 bfusb_unlink_urbs(data); 474 bfusb_flush(hdev); 475 476 return 0; 477 } 478 479 static int bfusb_send_frame(struct hci_dev *hdev, struct sk_buff *skb) 480 { 481 struct bfusb_data *data = hci_get_drvdata(hdev); 482 struct sk_buff *nskb; 483 unsigned char buf[3]; 484 int sent = 0, size, count; 485 486 BT_DBG("hdev %p skb %p type %d len %d", hdev, skb, 487 hci_skb_pkt_type(skb), skb->len); 488 489 switch (hci_skb_pkt_type(skb)) { 490 case HCI_COMMAND_PKT: 491 hdev->stat.cmd_tx++; 492 break; 493 case HCI_ACLDATA_PKT: 494 hdev->stat.acl_tx++; 495 break; 496 case HCI_SCODATA_PKT: 497 hdev->stat.sco_tx++; 498 break; 499 } 500 501 /* Prepend skb with frame type */ 502 memcpy(skb_push(skb, 1), &hci_skb_pkt_type(skb), 1); 503 504 count = skb->len; 505 506 /* Max HCI frame size seems to be 1511 + 1 */ 507 nskb = bt_skb_alloc(count + 32, GFP_KERNEL); 508 if (!nskb) { 509 bt_dev_err(hdev, "Can't allocate memory for new packet"); 510 return -ENOMEM; 511 } 512 513 nskb->dev = (void *) data; 514 515 while (count) { 516 size = min_t(uint, count, BFUSB_MAX_BLOCK_SIZE); 517 518 buf[0] = 0xc1 | ((sent == 0) ? 0x04 : 0) | ((count == size) ? 0x08 : 0); 519 buf[1] = 0x00; 520 buf[2] = (size == BFUSB_MAX_BLOCK_SIZE) ? 0 : size; 521 522 skb_put_data(nskb, buf, 3); 523 skb_copy_from_linear_data_offset(skb, sent, skb_put(nskb, size), size); 524 525 sent += size; 526 count -= size; 527 } 528 529 /* Don't send frame with multiple size of bulk max packet */ 530 if ((nskb->len % data->bulk_pkt_size) == 0) { 531 buf[0] = 0xdd; 532 buf[1] = 0x00; 533 skb_put_data(nskb, buf, 2); 534 } 535 536 read_lock(&data->lock); 537 538 skb_queue_tail(&data->transmit_q, nskb); 539 bfusb_tx_wakeup(data); 540 541 read_unlock(&data->lock); 542 543 kfree_skb(skb); 544 545 return 0; 546 } 547 548 static int bfusb_load_firmware(struct bfusb_data *data, 549 const unsigned char *firmware, int count) 550 { 551 unsigned char *buf; 552 int err, pipe, len, size, sent = 0; 553 554 BT_DBG("bfusb %p udev %p", data, data->udev); 555 556 BT_INFO("BlueFRITZ! USB loading firmware"); 557 558 buf = kmalloc(BFUSB_MAX_BLOCK_SIZE + 3, GFP_KERNEL); 559 if (!buf) { 560 BT_ERR("Can't allocate memory chunk for firmware"); 561 return -ENOMEM; 562 } 563 564 pipe = usb_sndctrlpipe(data->udev, 0); 565 566 if (usb_control_msg(data->udev, pipe, USB_REQ_SET_CONFIGURATION, 567 0, 1, 0, NULL, 0, USB_CTRL_SET_TIMEOUT) < 0) { 568 BT_ERR("Can't change to loading configuration"); 569 kfree(buf); 570 return -EBUSY; 571 } 572 573 data->udev->toggle[0] = data->udev->toggle[1] = 0; 574 575 pipe = usb_sndbulkpipe(data->udev, data->bulk_out_ep); 576 577 while (count) { 578 size = min_t(uint, count, BFUSB_MAX_BLOCK_SIZE + 3); 579 580 memcpy(buf, firmware + sent, size); 581 582 err = usb_bulk_msg(data->udev, pipe, buf, size, 583 &len, BFUSB_BLOCK_TIMEOUT); 584 585 if (err || (len != size)) { 586 BT_ERR("Error in firmware loading"); 587 goto error; 588 } 589 590 sent += size; 591 count -= size; 592 } 593 594 err = usb_bulk_msg(data->udev, pipe, NULL, 0, 595 &len, BFUSB_BLOCK_TIMEOUT); 596 if (err < 0) { 597 BT_ERR("Error in null packet request"); 598 goto error; 599 } 600 601 pipe = usb_sndctrlpipe(data->udev, 0); 602 603 err = usb_control_msg(data->udev, pipe, USB_REQ_SET_CONFIGURATION, 604 0, 2, 0, NULL, 0, USB_CTRL_SET_TIMEOUT); 605 if (err < 0) { 606 BT_ERR("Can't change to running configuration"); 607 goto error; 608 } 609 610 data->udev->toggle[0] = data->udev->toggle[1] = 0; 611 612 BT_INFO("BlueFRITZ! USB device ready"); 613 614 kfree(buf); 615 return 0; 616 617 error: 618 kfree(buf); 619 620 pipe = usb_sndctrlpipe(data->udev, 0); 621 622 usb_control_msg(data->udev, pipe, USB_REQ_SET_CONFIGURATION, 623 0, 0, 0, NULL, 0, USB_CTRL_SET_TIMEOUT); 624 625 return err; 626 } 627 628 static int bfusb_probe(struct usb_interface *intf, const struct usb_device_id *id) 629 { 630 const struct firmware *firmware; 631 struct usb_device *udev = interface_to_usbdev(intf); 632 struct usb_host_endpoint *bulk_out_ep; 633 struct usb_host_endpoint *bulk_in_ep; 634 struct hci_dev *hdev; 635 struct bfusb_data *data; 636 637 BT_DBG("intf %p id %p", intf, id); 638 639 /* Check number of endpoints */ 640 if (intf->cur_altsetting->desc.bNumEndpoints < 2) 641 return -EIO; 642 643 bulk_out_ep = &intf->cur_altsetting->endpoint[0]; 644 bulk_in_ep = &intf->cur_altsetting->endpoint[1]; 645 646 if (!bulk_out_ep || !bulk_in_ep) { 647 BT_ERR("Bulk endpoints not found"); 648 goto done; 649 } 650 651 /* Initialize control structure and load firmware */ 652 data = devm_kzalloc(&intf->dev, sizeof(struct bfusb_data), GFP_KERNEL); 653 if (!data) 654 return -ENOMEM; 655 656 data->udev = udev; 657 data->bulk_in_ep = bulk_in_ep->desc.bEndpointAddress; 658 data->bulk_out_ep = bulk_out_ep->desc.bEndpointAddress; 659 data->bulk_pkt_size = le16_to_cpu(bulk_out_ep->desc.wMaxPacketSize); 660 661 if (!data->bulk_pkt_size) 662 goto done; 663 664 rwlock_init(&data->lock); 665 666 data->reassembly = NULL; 667 668 skb_queue_head_init(&data->transmit_q); 669 skb_queue_head_init(&data->pending_q); 670 skb_queue_head_init(&data->completed_q); 671 672 if (request_firmware(&firmware, "bfubase.frm", &udev->dev) < 0) { 673 BT_ERR("Firmware request failed"); 674 goto done; 675 } 676 677 BT_DBG("firmware data %p size %zu", firmware->data, firmware->size); 678 679 if (bfusb_load_firmware(data, firmware->data, firmware->size) < 0) { 680 BT_ERR("Firmware loading failed"); 681 goto release; 682 } 683 684 release_firmware(firmware); 685 686 /* Initialize and register HCI device */ 687 hdev = hci_alloc_dev(); 688 if (!hdev) { 689 BT_ERR("Can't allocate HCI device"); 690 goto done; 691 } 692 693 data->hdev = hdev; 694 695 hdev->bus = HCI_USB; 696 hci_set_drvdata(hdev, data); 697 SET_HCIDEV_DEV(hdev, &intf->dev); 698 699 hdev->open = bfusb_open; 700 hdev->close = bfusb_close; 701 hdev->flush = bfusb_flush; 702 hdev->send = bfusb_send_frame; 703 704 hci_set_quirk(hdev, HCI_QUIRK_BROKEN_LOCAL_COMMANDS); 705 706 if (hci_register_dev(hdev) < 0) { 707 BT_ERR("Can't register HCI device"); 708 hci_free_dev(hdev); 709 goto done; 710 } 711 712 usb_set_intfdata(intf, data); 713 714 return 0; 715 716 release: 717 release_firmware(firmware); 718 719 done: 720 return -EIO; 721 } 722 723 static void bfusb_disconnect(struct usb_interface *intf) 724 { 725 struct bfusb_data *data = usb_get_intfdata(intf); 726 struct hci_dev *hdev = data->hdev; 727 728 BT_DBG("intf %p", intf); 729 730 if (!hdev) 731 return; 732 733 usb_set_intfdata(intf, NULL); 734 735 bfusb_close(hdev); 736 737 hci_unregister_dev(hdev); 738 hci_free_dev(hdev); 739 } 740 741 static struct usb_driver bfusb_driver = { 742 .name = "bfusb", 743 .probe = bfusb_probe, 744 .disconnect = bfusb_disconnect, 745 .id_table = bfusb_table, 746 .disable_hub_initiated_lpm = 1, 747 }; 748 749 module_usb_driver(bfusb_driver); 750 751 MODULE_AUTHOR("Marcel Holtmann <marcel@holtmann.org>"); 752 MODULE_DESCRIPTION("BlueFRITZ! USB driver ver " VERSION); 753 MODULE_VERSION(VERSION); 754 MODULE_LICENSE("GPL"); 755 MODULE_FIRMWARE("bfubase.frm"); 756