// SPDX-License-Identifier: GPL-2.0-or-later/* * *  AVM BlueFRITZ! USB driver * *  Copyright (C) 2003-2006  Marcel Holtmann <marcel@holtmann.org> */ #include <linux/module.h> #include <linux/kernel.h>#include <linux/init.h>#include <linux/slab.h>#include <linux/types.h>#include <linux/errno.h>#include <linux/skbuff.h> #include <linux/device.h>#include <linux/firmware.h> #include <linux/usb.h> #include <net/bluetooth/bluetooth.h>#include <net/bluetooth/hci_core.h> #define VERSION "1.2" static struct usb_driver bfusb_driver; static const struct usb_device_id bfusb_table[] = {	/* AVM BlueFRITZ! USB */	{ USB_DEVICE(0x057c, 0x2200) }, 	{ }	/* Terminating entry */}; MODULE_DEVICE_TABLE(usb, bfusb_table); #define BFUSB_MAX_BLOCK_SIZE	256 #define BFUSB_BLOCK_TIMEOUT	3000 #define BFUSB_TX_PROCESS	1#define BFUSB_TX_WAKEUP		2 #define BFUSB_MAX_BULK_TX	2#define BFUSB_MAX_BULK_RX	2 struct bfusb_data {	struct hci_dev		*hdev; 	unsigned long		state; 	struct usb_device	*udev; 	unsigned int		bulk_in_ep;	unsigned int		bulk_out_ep;	unsigned int		bulk_pkt_size; 	rwlock_t		lock; 	struct sk_buff_head	transmit_q; 	struct sk_buff		*reassembly; 	atomic_t		pending_tx;	struct sk_buff_head	pending_q;	struct sk_buff_head	completed_q;}; struct bfusb_data_scb {	struct urb *urb;}; static void bfusb_tx_complete(struct urb *urb);static void bfusb_rx_complete(struct urb *urb); static struct urb *bfusb_get_completed(struct bfusb_data *data){	struct sk_buff *skb;	struct urb *urb = NULL; 	BT_DBG("bfusb %p", data); 	skb = skb_dequeue(&data->completed_q);	if (skb) {		urb = ((struct bfusb_data_scb *) skb->cb)->urb;		kfree_skb(skb);	} 	return urb;} static void bfusb_unlink_urbs(struct bfusb_data *data){	struct sk_buff *skb;	struct urb *urb; 	BT_DBG("bfusb %p", data); 	while ((skb = skb_dequeue(&data->pending_q))) {		urb = ((struct bfusb_data_scb *) skb->cb)->urb;		usb_kill_urb(urb);		skb_queue_tail(&data->completed_q, skb);	} 	while ((urb = bfusb_get_completed(data)))		usb_free_urb(urb);} static int bfusb_send_bulk(struct bfusb_data *data, struct sk_buff *skb){	struct bfusb_data_scb *scb = (void *) skb->cb;	struct urb *urb = bfusb_get_completed(data);	int err, pipe; 	BT_DBG("bfusb %p skb %p len %d", data, skb, skb->len); 	if (!urb) {		urb = usb_alloc_urb(0, GFP_ATOMIC);		if (!urb)			return -ENOMEM;	} 	pipe = usb_sndbulkpipe(data->udev, data->bulk_out_ep); 	usb_fill_bulk_urb(urb, data->udev, pipe, skb->data, skb->len,			bfusb_tx_complete, skb); 	scb->urb = urb; 	skb_queue_tail(&data->pending_q, skb); 	err = usb_submit_urb(urb, GFP_ATOMIC);	if (err) {		bt_dev_err(data->hdev, "bulk tx submit failed urb %p err %d",			   urb, err);		skb_unlink(skb, &data->pending_q);		usb_free_urb(urb);	} else		atomic_inc(&data->pending_tx); 	return err;} static void bfusb_tx_wakeup(struct bfusb_data *data){	struct sk_buff *skb; 	BT_DBG("bfusb %p", data); 	if (test_and_set_bit(BFUSB_TX_PROCESS, &data->state)) {		set_bit(BFUSB_TX_WAKEUP, &data->state);		return;	} 	do {		clear_bit(BFUSB_TX_WAKEUP, &data->state); 		while ((atomic_read(&data->pending_tx) < BFUSB_MAX_BULK_TX) &&				(skb = skb_dequeue(&data->transmit_q))) {			if (bfusb_send_bulk(data, skb) < 0) {				skb_queue_head(&data->transmit_q, skb);				break;			}		} 	} while (test_bit(BFUSB_TX_WAKEUP, &data->state)); 	clear_bit(BFUSB_TX_PROCESS, &data->state);} static void bfusb_tx_complete(struct urb *urb){	struct sk_buff *skb = (struct sk_buff *) urb->context;	struct bfusb_data *data = (struct bfusb_data *) skb->dev; 	BT_DBG("bfusb %p urb %p skb %p len %d", data, urb, skb, skb->len); 	atomic_dec(&data->pending_tx); 	if (!test_bit(HCI_RUNNING, &data->hdev->flags))		return; 	if (!urb->status)		data->hdev->stat.byte_tx += skb->len;	else		data->hdev->stat.err_tx++; 	read_lock(&data->lock); 	skb_unlink(skb, &data->pending_q);	skb_queue_tail(&data->completed_q, skb); 	bfusb_tx_wakeup(data); 	read_unlock(&data->lock);}  static int bfusb_rx_submit(struct bfusb_data *data, struct urb *urb){	struct bfusb_data_scb *scb;	struct sk_buff *skb;	int err, pipe, size = HCI_MAX_FRAME_SIZE + 32; 	BT_DBG("bfusb %p urb %p", data, urb); 	if (!urb) {		urb = usb_alloc_urb(0, GFP_ATOMIC);		if (!urb)			return -ENOMEM;	} 	skb = bt_skb_alloc(size, GFP_ATOMIC);	if (!skb) {		usb_free_urb(urb);		return -ENOMEM;	} 	skb->dev = (void *) data; 	scb = (struct bfusb_data_scb *) skb->cb;	scb->urb = urb; 	pipe = usb_rcvbulkpipe(data->udev, data->bulk_in_ep); 	usb_fill_bulk_urb(urb, data->udev, pipe, skb->data, size,			bfusb_rx_complete, skb); 	skb_queue_tail(&data->pending_q, skb); 	err = usb_submit_urb(urb, GFP_ATOMIC);	if (err) {		bt_dev_err(data->hdev, "bulk rx submit failed urb %p err %d",			   urb, err);		skb_unlink(skb, &data->pending_q);		kfree_skb(skb);		usb_free_urb(urb);	} 	return err;} static inline int bfusb_recv_block(struct bfusb_data *data, int hdr, unsigned char *buf, int len){	BT_DBG("bfusb %p hdr 0x%02x data %p len %d", data, hdr, buf, len); 	if (hdr & 0x10) {		bt_dev_err(data->hdev, "error in block");		kfree_skb(data->reassembly);		data->reassembly = NULL;		return -EIO;	} 	if (hdr & 0x04) {		struct sk_buff *skb;		unsigned char pkt_type;		int pkt_len = 0; 		if (data->reassembly) {			bt_dev_err(data->hdev, "unexpected start block");			kfree_skb(data->reassembly);			data->reassembly = NULL;		} 		if (len < 1) {			bt_dev_err(data->hdev, "no packet type found");			return -EPROTO;		} 		pkt_type = *buf++; len--; 		switch (pkt_type) {		case HCI_EVENT_PKT:			if (len >= HCI_EVENT_HDR_SIZE) {				struct hci_event_hdr *hdr = (struct hci_event_hdr *) buf;				pkt_len = HCI_EVENT_HDR_SIZE + hdr->plen;			} else {				bt_dev_err(data->hdev, "event block is too short");				return -EILSEQ;			}			break; 		case HCI_ACLDATA_PKT:			if (len >= HCI_ACL_HDR_SIZE) {				struct hci_acl_hdr *hdr = (struct hci_acl_hdr *) buf;				pkt_len = HCI_ACL_HDR_SIZE + __le16_to_cpu(hdr->dlen);			} else {				bt_dev_err(data->hdev, "data block is too short");				return -EILSEQ;			}			break; 		case HCI_SCODATA_PKT:			if (len >= HCI_SCO_HDR_SIZE) {				struct hci_sco_hdr *hdr = (struct hci_sco_hdr *) buf;				pkt_len = HCI_SCO_HDR_SIZE + hdr->dlen;			} else {				bt_dev_err(data->hdev, "audio block is too short");				return -EILSEQ;			}			break; 		default:			bt_dev_err(data->hdev, "unknown packet type 0x%02x",				   pkt_type);			return -EILSEQ;		} 		skb = bt_skb_alloc(pkt_len, GFP_ATOMIC);		if (!skb) {			bt_dev_err(data->hdev, "no memory for the packet");			return -ENOMEM;		} 		hci_skb_pkt_type(skb) = pkt_type; 		data->reassembly = skb;	} else {		if (!data->reassembly) {			bt_dev_err(data->hdev, "unexpected continuation block");			return -EIO;		}	} 	if (len > skb_tailroom(data->reassembly)) {		bt_dev_err(data->hdev, "block exceeds packet length");		kfree_skb(data->reassembly);		data->reassembly = NULL;		return -EILSEQ;	} 	if (len > 0)		skb_put_data(data->reassembly, buf, len); 	if (hdr & 0x08) {		hci_recv_frame(data->hdev, data->reassembly);		data->reassembly = NULL;	} 	return 0;} static void bfusb_rx_complete(struct urb *urb){	struct sk_buff *skb = (struct sk_buff *) urb->context;	struct bfusb_data *data = (struct bfusb_data *) skb->dev;	unsigned char *buf = urb->transfer_buffer;	int count = urb->actual_length;	int err, hdr, len; 	BT_DBG("bfusb %p urb %p skb %p len %d", data, urb, skb, skb->len); 	read_lock(&data->lock); 	if (!test_bit(HCI_RUNNING, &data->hdev->flags))		goto unlock; 	if (urb->status || !count)		goto resubmit; 	data->hdev->stat.byte_rx += count; 	skb_put(skb, count); 	while (count) {		if (count < 2) {			bt_dev_err(data->hdev, "short block header");			kfree_skb(data->reassembly);			data->reassembly = NULL;			break;		} 		hdr = buf[0] | (buf[1] << 8); 		if (hdr & 0x4000) {			len = 0;			count -= 2;			buf   += 2;		} else {			if (count < 3) {				bt_dev_err(data->hdev, "short block header");				kfree_skb(data->reassembly);				data->reassembly = NULL;				break;			} 			len = (buf[2] == 0) ? 256 : buf[2];			count -= 3;			buf   += 3;		} 		if (count < len) {			bt_dev_err(data->hdev, "block extends over URB buffer ranges");			kfree_skb(data->reassembly);			data->reassembly = NULL;			break;		} 		if ((hdr & 0xe1) == 0xc1 &&		    bfusb_recv_block(data, hdr, buf, len) < 0)			data->hdev->stat.err_rx++; 		count -= len;		buf   += len;	} 	skb_unlink(skb, &data->pending_q);	kfree_skb(skb); 	bfusb_rx_submit(data, urb); 	read_unlock(&data->lock); 	return; resubmit:	urb->dev = data->udev; 	err = usb_submit_urb(urb, GFP_ATOMIC);	if (err) {		bt_dev_err(data->hdev, "bulk resubmit failed urb %p err %d",			   urb, err);	} unlock:	read_unlock(&data->lock);} static int bfusb_open(struct hci_dev *hdev){	struct bfusb_data *data = hci_get_drvdata(hdev);	unsigned long flags;	int i, err; 	BT_DBG("hdev %p bfusb %p", hdev, data); 	write_lock_irqsave(&data->lock, flags); 	err = bfusb_rx_submit(data, NULL);	if (!err) {		for (i = 1; i < BFUSB_MAX_BULK_RX; i++)			bfusb_rx_submit(data, NULL);	} 	write_unlock_irqrestore(&data->lock, flags); 	return err;} static int bfusb_flush(struct hci_dev *hdev){	struct bfusb_data *data = hci_get_drvdata(hdev); 	BT_DBG("hdev %p bfusb %p", hdev, data); 	skb_queue_purge(&data->transmit_q); 	return 0;} static int bfusb_close(struct hci_dev *hdev){	struct bfusb_data *data = hci_get_drvdata(hdev);	unsigned long flags; 	BT_DBG("hdev %p bfusb %p", hdev, data); 	write_lock_irqsave(&data->lock, flags);	write_unlock_irqrestore(&data->lock, flags); 	bfusb_unlink_urbs(data);	bfusb_flush(hdev); 	return 0;} static int bfusb_send_frame(struct hci_dev *hdev, struct sk_buff *skb){	struct bfusb_data *data = hci_get_drvdata(hdev);	struct sk_buff *nskb;	unsigned char buf[3];	int sent = 0, size, count; 	BT_DBG("hdev %p skb %p type %d len %d", hdev, skb,	       hci_skb_pkt_type(skb), skb->len); 	switch (hci_skb_pkt_type(skb)) {	case HCI_COMMAND_PKT:		hdev->stat.cmd_tx++;		break;	case HCI_ACLDATA_PKT:		hdev->stat.acl_tx++;		break;	case HCI_SCODATA_PKT:		hdev->stat.sco_tx++;		break;	} 

Lines 1–500 of 755. Load more