[deliverable/linux.git] / drivers / bluetooth / hci_h5.c

/*
 *
 *  Bluetooth HCI Three-wire UART driver
 *
 *  Copyright (C) 2012  Intel Corporation
 *
 *
 *  This program is free software; you can redistribute it and/or modify
 *  it under the terms of the GNU General Public License as published by
 *  the Free Software Foundation; either version 2 of the License, or
 *  (at your option) any later version.
 *
 *  This program is distributed in the hope that it will be useful,
 *  but WITHOUT ANY WARRANTY; without even the implied warranty of
 *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 *  GNU General Public License for more details.
 *
 *  You should have received a copy of the GNU General Public License
 *  along with this program; if not, write to the Free Software
 *  Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
 *
 */

#include <linux/kernel.h>
#include <linux/errno.h>
#include <linux/skbuff.h>

#include <net/bluetooth/bluetooth.h>
#include <net/bluetooth/hci_core.h>

#include "hci_uart.h"

#define HCI_3WIRE_ACK_PKT	0
#define HCI_3WIRE_LINK_PKT	15

#define H5_TXWINSIZE	4

#define H5_ACK_TIMEOUT	msecs_to_jiffies(250)
#define H5_SYNC_TIMEOUT	msecs_to_jiffies(100)

/*
 * Maximum Three-wire packet:
 *     4 byte header + max value for 12-bit length + 2 bytes for CRC
 */
#define H5_MAX_LEN (4 + 0xfff + 2)

/* Convenience macros for reading Three-wire header values */
#define H5_HDR_SEQ(hdr)		((hdr)[0] & 0x07)
#define H5_HDR_ACK(hdr)		(((hdr)[0] >> 3) & 0x07)
#define H5_HDR_CRC(hdr)		(((hdr)[0] >> 6) & 0x01)
#define H5_HDR_RELIABLE(hdr)	(((hdr)[0] >> 7) & 0x01)
#define H5_HDR_PKT_TYPE(hdr)	((hdr)[1] & 0x0f)
#define H5_HDR_LEN(hdr)		((((hdr)[1] >> 4) & 0xff) + ((hdr)[2] << 4))

#define SLIP_DELIMITER	0xc0
#define SLIP_ESC	0xdb
#define SLIP_ESC_DELIM	0xdc
#define SLIP_ESC_ESC	0xdd

struct h5 {
	struct sk_buff_head	unack;		/* Unack'ed packets queue */
	struct sk_buff_head	rel;		/* Reliable packets queue */
	struct sk_buff_head	unrel;		/* Unreliable packets queue */

	struct sk_buff		*rx_skb;	/* Receive buffer */
	size_t			rx_pending;	/* Expecting more bytes */
	bool			rx_esc;		/* SLIP escape mode */
	u8			rx_ack;		/* Last ack number received */

	int			(*rx_func) (struct hci_uart *hu, u8 c);

	struct timer_list	timer;		/* Retransmission timer */

	bool			tx_ack_req;	/* Pending ack to send */
	u8			tx_seq;		/* Next seq number to send */
	u8			tx_ack;		/* Next ack number to send */

	bool			sleeping;
};

static void h5_reset_rx(struct h5 *h5);

static void h5_timed_event(unsigned long arg)
{
	struct hci_uart *hu = (struct hci_uart *) arg;
	struct h5 *h5 = hu->priv;
	struct sk_buff *skb;
	unsigned long flags;

	BT_DBG("hu %p retransmitting %u pkts", hu, h5->unack.qlen);

	spin_lock_irqsave_nested(&h5->unack.lock, flags, SINGLE_DEPTH_NESTING);

	while ((skb = __skb_dequeue_tail(&h5->unack)) != NULL) {
		h5->tx_seq = (h5->tx_seq - 1) & 0x07;
		skb_queue_head(&h5->rel, skb);
	}

	spin_unlock_irqrestore(&h5->unack.lock, flags);

	hci_uart_tx_wakeup(hu);
}

static void h5_link_control(struct hci_uart *hu, const void *data, size_t len)
{
	struct h5 *h5 = hu->priv;
	struct sk_buff *nskb;

	nskb = alloc_skb(3, GFP_ATOMIC);
	if (!nskb)
		return;

	bt_cb(nskb)->pkt_type = HCI_3WIRE_LINK_PKT;

	memcpy(skb_put(nskb, len), data, len);

	skb_queue_tail(&h5->unrel, nskb);
}

static int h5_open(struct hci_uart *hu)
{
	struct h5 *h5;
	const unsigned char sync[] = { 0x01, 0x7e };

	BT_DBG("hu %p", hu);

	h5 = kzalloc(sizeof(*h5), GFP_KERNEL);
	if (!h5)
		return -ENOMEM;

	hu->priv = h5;

	skb_queue_head_init(&h5->unack);
	skb_queue_head_init(&h5->rel);
	skb_queue_head_init(&h5->unrel);

	h5_reset_rx(h5);

	init_timer(&h5->timer);
	h5->timer.function = h5_timed_event;
	h5->timer.data = (unsigned long) hu;

	set_bit(HCI_UART_INIT_PENDING, &hu->hdev_flags);

	/* Send initial sync request */
	h5_link_control(hu, sync, sizeof(sync));
	mod_timer(&h5->timer, jiffies + H5_SYNC_TIMEOUT);

	return 0;
}

static int h5_close(struct hci_uart *hu)
{
	struct h5 *h5 = hu->priv;

	skb_queue_purge(&h5->unack);
	skb_queue_purge(&h5->rel);
	skb_queue_purge(&h5->unrel);

	del_timer(&h5->timer);

	kfree(h5);

	return 0;
}

static void h5_pkt_cull(struct h5 *h5)
{
	struct sk_buff *skb, *tmp;
	unsigned long flags;
	int i, to_remove;
	u8 seq;

	spin_lock_irqsave(&h5->unack.lock, flags);

	to_remove = skb_queue_len(&h5->unack);
	if (to_remove == 0)
		goto unlock;

	seq = h5->tx_seq;

	while (to_remove > 0) {
		if (h5->rx_ack == seq)
			break;

		to_remove--;
		seq = (seq - 1) % 8;
	}

	if (seq != h5->rx_ack)
		BT_ERR("Controller acked invalid packet");

	i = 0;
	skb_queue_walk_safe(&h5->unack, skb, tmp) {
		if (i++ >= to_remove)
			break;

		__skb_unlink(skb, &h5->unack);
		kfree_skb(skb);
	}

	if (skb_queue_empty(&h5->unack))
		del_timer(&h5->timer);

unlock:
	spin_unlock_irqrestore(&h5->unack.lock, flags);
}

static void h5_handle_internal_rx(struct hci_uart *hu)
{
	struct h5 *h5 = hu->priv;
	const unsigned char sync_req[] = { 0x01, 0x7e };
	const unsigned char sync_rsp[] = { 0x02, 0x7d };
	const unsigned char conf_req[] = { 0x03, 0xfc, 0x01 };
	const unsigned char conf_rsp[] = { 0x04, 0x7b, 0x01 };
	const unsigned char wakeup_req[] = { 0x05, 0xfa };
	const unsigned char woken_req[] = { 0x06, 0xf9 };
	const unsigned char sleep_req[] = { 0x07, 0x78 };
	const unsigned char *hdr = h5->rx_skb->data;
	const unsigned char *data = &h5->rx_skb->data[4];

	BT_DBG("%s", hu->hdev->name);

	if (H5_HDR_PKT_TYPE(hdr) != HCI_3WIRE_LINK_PKT)
		return;

	if (H5_HDR_LEN(hdr) < 2)
		return;

	if (memcmp(data, sync_req, 2) == 0) {
		h5_link_control(hu, sync_rsp, 2);
	} else if (memcmp(data, sync_rsp, 2) == 0) {
		h5_link_control(hu, conf_req, 3);
	} else if (memcmp(data, conf_req, 2) == 0) {
		h5_link_control(hu, conf_rsp, 2);
		h5_link_control(hu, conf_req, 3);
	} else if (memcmp(data, conf_rsp, 2) == 0) {
		BT_DBG("Three-wire init sequence complete");
		hci_uart_init_ready(hu);
		return;
	} else if (memcmp(data, sleep_req, 2) == 0) {
		BT_DBG("Peer went to sleep");
		h5->sleeping = true;
		h5_link_control(hu, wakeup_req, 2);
	} else if (memcmp(data, woken_req, 2) == 0) {
		BT_DBG("Peer woke up");
		h5->sleeping = false;
		return;
	} else {
		BT_DBG("Link Control: 0x%02hhx 0x%02hhx", data[0], data[1]);
		return;
	}

	hci_uart_tx_wakeup(hu);
}

static void h5_complete_rx_pkt(struct hci_uart *hu)
{
	struct h5 *h5 = hu->priv;
	const unsigned char *hdr = h5->rx_skb->data;

	if (H5_HDR_RELIABLE(hdr)) {
		h5->tx_ack = (h5->tx_ack + 1) % 8;
		h5->tx_ack_req = true;
		hci_uart_tx_wakeup(hu);
	}

	h5->rx_ack = H5_HDR_ACK(hdr);

	h5_pkt_cull(h5);

	switch (H5_HDR_PKT_TYPE(hdr)) {
	case HCI_EVENT_PKT:
	case HCI_ACLDATA_PKT:
	case HCI_SCODATA_PKT:
		bt_cb(h5->rx_skb)->pkt_type = H5_HDR_PKT_TYPE(hdr);

		/* Remove Three-wire header */
		skb_pull(h5->rx_skb, 4);

		hci_recv_frame(h5->rx_skb);
		h5->rx_skb = NULL;

		break;

	default:
		h5_handle_internal_rx(hu);
		break;
	}

	h5_reset_rx(h5);
}

static int h5_rx_crc(struct hci_uart *hu, unsigned char c)
{
	struct h5 *h5 = hu->priv;

	h5_complete_rx_pkt(hu);
	h5_reset_rx(h5);

	return 0;
}

static int h5_rx_payload(struct hci_uart *hu, unsigned char c)
{
	struct h5 *h5 = hu->priv;
	const unsigned char *hdr = h5->rx_skb->data;

	if (H5_HDR_CRC(hdr)) {
		h5->rx_func = h5_rx_crc;
		h5->rx_pending = 2;
	} else {
		h5_complete_rx_pkt(hu);
		h5_reset_rx(h5);
	}

	return 0;
}

static int h5_rx_3wire_hdr(struct hci_uart *hu, unsigned char c)
{
	struct h5 *h5 = hu->priv;
	const unsigned char *hdr = h5->rx_skb->data;

	BT_DBG("%s rx: seq %u ack %u crc %u rel %u type %u len %u",
	       hu->hdev->name, H5_HDR_SEQ(hdr), H5_HDR_ACK(hdr),
	       H5_HDR_CRC(hdr), H5_HDR_RELIABLE(hdr), H5_HDR_PKT_TYPE(hdr),
	       H5_HDR_LEN(hdr));

	if (((hdr[0] + hdr[1] + hdr[2] + hdr[3]) & 0xff) != 0xff) {
		BT_ERR("Invalid header checksum");
		h5_reset_rx(h5);
		return 0;
	}

	if (H5_HDR_RELIABLE(hdr) && H5_HDR_SEQ(hdr) != h5->tx_ack) {
		BT_ERR("Out-of-order packet arrived (%u != %u)",
		       H5_HDR_SEQ(hdr), h5->tx_ack);
		h5_reset_rx(h5);
		return 0;
	}

	h5->rx_func = h5_rx_payload;
	h5->rx_pending = H5_HDR_LEN(hdr);

	return 0;
}

static int h5_rx_pkt_start(struct hci_uart *hu, unsigned char c)
{
	struct h5 *h5 = hu->priv;

	if (c == SLIP_DELIMITER)
		return 1;

	h5->rx_func = h5_rx_3wire_hdr;
	h5->rx_pending = 4;

	h5->rx_skb = bt_skb_alloc(H5_MAX_LEN, GFP_ATOMIC);
	if (!h5->rx_skb) {
		BT_ERR("Can't allocate mem for new packet");
		h5_reset_rx(h5);
		return -ENOMEM;
	}

	h5->rx_skb->dev = (void *) hu->hdev;

	return 0;
}

static int h5_rx_delimiter(struct hci_uart *hu, unsigned char c)
{
	struct h5 *h5 = hu->priv;

	if (c == SLIP_DELIMITER)
		h5->rx_func = h5_rx_pkt_start;

	return 1;
}

static void h5_unslip_one_byte(struct h5 *h5, unsigned char c)
{
	const u8 delim = SLIP_DELIMITER, esc = SLIP_ESC;
	const u8 *byte = &c;

	if (!h5->rx_esc && c == SLIP_ESC) {
		h5->rx_esc = true;
		return;
	}

	if (h5->rx_esc) {
		switch (c) {
		case SLIP_ESC_DELIM:
			byte = &delim;
			break;
		case SLIP_ESC_ESC:
			byte = &esc;
			break;
		default:
			BT_ERR("Invalid esc byte 0x%02hhx", c);
			h5_reset_rx(h5);
			return;
		}

		h5->rx_esc = false;
	}

	memcpy(skb_put(h5->rx_skb, 1), byte, 1);
	h5->rx_pending--;

	BT_DBG("unsliped 0x%02hhx, rx_pending %zu", *byte, h5->rx_pending);
}

static void h5_reset_rx(struct h5 *h5)
{
	if (h5->rx_skb) {
		kfree_skb(h5->rx_skb);
		h5->rx_skb = NULL;
	}

	h5->rx_func = h5_rx_delimiter;
	h5->rx_pending = 0;
	h5->rx_esc = false;
}

static int h5_recv(struct hci_uart *hu, void *data, int count)
{
	struct h5 *h5 = hu->priv;
	unsigned char *ptr = data;

	BT_DBG("%s pending %zu count %d", hu->hdev->name, h5->rx_pending,
	       count);

	while (count > 0) {
		int processed;

		if (h5->rx_pending > 0) {
			if (*ptr == SLIP_DELIMITER) {
				BT_ERR("Too short H5 packet");
				h5_reset_rx(h5);
				continue;
			}

			h5_unslip_one_byte(h5, *ptr);

			ptr++; count--;
			continue;
		}

		processed = h5->rx_func(hu, *ptr);
		if (processed < 0)
			return processed;

		ptr += processed;
		count -= processed;
	}

	return 0;
}

static int h5_enqueue(struct hci_uart *hu, struct sk_buff *skb)
{
	struct h5 *h5 = hu->priv;

	if (skb->len > 0xfff) {
		BT_ERR("Packet too long (%u bytes)", skb->len);
		kfree_skb(skb);
		return 0;
	}

	switch (bt_cb(skb)->pkt_type) {
	case HCI_ACLDATA_PKT:
	case HCI_COMMAND_PKT:
		skb_queue_tail(&h5->rel, skb);
		break;

	case HCI_SCODATA_PKT:
		skb_queue_tail(&h5->unrel, skb);
		break;

	default:
		BT_ERR("Unknown packet type %u", bt_cb(skb)->pkt_type);
		kfree_skb(skb);
		break;
	}

	return 0;
}

static void h5_slip_delim(struct sk_buff *skb)
{
	const char delim = SLIP_DELIMITER;

	memcpy(skb_put(skb, 1), &delim, 1);
}

static void h5_slip_one_byte(struct sk_buff *skb, u8 c)
{
	const char esc_delim[2] = { SLIP_ESC, SLIP_ESC_DELIM };
	const char esc_esc[2] = { SLIP_ESC, SLIP_ESC_ESC };

	switch (c) {
	case SLIP_DELIMITER:
		memcpy(skb_put(skb, 2), &esc_delim, 2);
		break;
	case SLIP_ESC:
		memcpy(skb_put(skb, 2), &esc_esc, 2);
		break;
	default:
		memcpy(skb_put(skb, 1), &c, 1);
	}
}

static struct sk_buff *h5_build_pkt(struct hci_uart *hu, bool rel, u8 pkt_type,
				    const u8 *data, size_t len)
{
	struct h5 *h5 = hu->priv;
	struct sk_buff *nskb;
	u8 hdr[4];
	int i;

	/*
	 * Max len of packet: (original len + 4 (H5 hdr) + 2 (crc)) * 2
	 * (because bytes 0xc0 and 0xdb are escaped, worst case is when
	 * the packet is all made of 0xc0 and 0xdb) + 2 (0xc0
	 * delimiters at start and end).
	 */
	nskb = alloc_skb((len + 6) * 2 + 2, GFP_ATOMIC);
	if (!nskb)
		return NULL;

	bt_cb(nskb)->pkt_type = pkt_type;

	h5_slip_delim(nskb);

	hdr[0] = h5->tx_ack << 3;
	h5->tx_ack_req = false;

	if (rel) {
		hdr[0] |= 1 << 7;
		hdr[0] |= h5->tx_seq;
		h5->tx_seq = (h5->tx_seq + 1) % 8;
	}

	hdr[1] = pkt_type | ((len & 0x0f) << 4);
	hdr[2] = len >> 4;
	hdr[3] = ~((hdr[0] + hdr[1] + hdr[2]) & 0xff);

	BT_DBG("%s tx: seq %u ack %u crc %u rel %u type %u len %u",
	       hu->hdev->name, H5_HDR_SEQ(hdr), H5_HDR_ACK(hdr),
	       H5_HDR_CRC(hdr), H5_HDR_RELIABLE(hdr), H5_HDR_PKT_TYPE(hdr),
	       H5_HDR_LEN(hdr));

	for (i = 0; i < 4; i++)
		h5_slip_one_byte(nskb, hdr[i]);

	for (i = 0; i < len; i++)
		h5_slip_one_byte(nskb, data[i]);

	h5_slip_delim(nskb);

	return nskb;
}

static struct sk_buff *h5_prepare_pkt(struct hci_uart *hu, u8 pkt_type,
				      const u8 *data, size_t len)
{
	bool rel;

	switch (pkt_type) {
	case HCI_ACLDATA_PKT:
	case HCI_COMMAND_PKT:
		rel = true;
		break;
	case HCI_SCODATA_PKT:
	case HCI_3WIRE_LINK_PKT:
	case HCI_3WIRE_ACK_PKT:
		rel = false;
		break;
	default:
		BT_ERR("Unknown packet type %u", pkt_type);
		return NULL;
	}

	return h5_build_pkt(hu, rel, pkt_type, data, len);
}

static struct sk_buff *h5_dequeue(struct hci_uart *hu)
{
	struct h5 *h5 = hu->priv;
	unsigned long flags;
	struct sk_buff *skb, *nskb;

	if ((skb = skb_dequeue(&h5->unrel)) != NULL) {
		nskb = h5_prepare_pkt(hu, bt_cb(skb)->pkt_type,
				      skb->data, skb->len);
		if (nskb) {
			kfree_skb(skb);
			return nskb;
		}

		skb_queue_head(&h5->unrel, skb);
		BT_ERR("Could not dequeue pkt because alloc_skb failed");
	}

	spin_lock_irqsave_nested(&h5->unack.lock, flags, SINGLE_DEPTH_NESTING);

	if (h5->unack.qlen >= H5_TXWINSIZE)
		goto unlock;

	if ((skb = skb_dequeue(&h5->rel)) != NULL) {
		nskb = h5_prepare_pkt(hu, bt_cb(skb)->pkt_type,
				      skb->data, skb->len);
		if (nskb) {
			__skb_queue_tail(&h5->unack, skb);
			mod_timer(&h5->timer, jiffies + H5_ACK_TIMEOUT);
			spin_unlock_irqrestore(&h5->unack.lock, flags);
			return nskb;
		}

		skb_queue_head(&h5->rel, skb);
		BT_ERR("Could not dequeue pkt because alloc_skb failed");
	}

unlock:
	spin_unlock_irqrestore(&h5->unack.lock, flags);

	if (h5->tx_ack_req)
		return h5_prepare_pkt(hu, HCI_3WIRE_ACK_PKT, NULL, 0);

	return NULL;
}

static int h5_flush(struct hci_uart *hu)
{
	BT_DBG("hu %p", hu);
	return 0;
}

static struct hci_uart_proto h5p = {
	.id		= HCI_UART_3WIRE,
	.open		= h5_open,
	.close		= h5_close,
	.recv		= h5_recv,
	.enqueue	= h5_enqueue,
	.dequeue	= h5_dequeue,
	.flush		= h5_flush,
};

int __init h5_init(void)
{
	int err = hci_uart_register_proto(&h5p);

	if (!err)
		BT_INFO("HCI Three-wire UART (H5) protocol initialized");
	else
		BT_ERR("HCI Three-wire UART (H5) protocol init failed");

	return err;
}

int __exit h5_deinit(void)
{
	return hci_uart_unregister_proto(&h5p);
}
Commit	Line	Data
7dec65c8 JH	1	/*
	2	*
	3	* Bluetooth HCI Three-wire UART driver
	4	*
	5	* Copyright (C) 2012 Intel Corporation
	6	*
	7	*
	8	* This program is free software; you can redistribute it and/or modify
	9	* it under the terms of the GNU General Public License as published by
	10	* the Free Software Foundation; either version 2 of the License, or
	11	* (at your option) any later version.
	12	*
	13	* This program is distributed in the hope that it will be useful,
	14	* but WITHOUT ANY WARRANTY; without even the implied warranty of
	15	* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
	16	* GNU General Public License for more details.
	17	*
	18	* You should have received a copy of the GNU General Public License
	19	* along with this program; if not, write to the Free Software
	20	* Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
	21	*
	22	*/
	23
	24	#include <linux/kernel.h>
	25	#include <linux/errno.h>
	26	#include <linux/skbuff.h>
	27
	28	#include <net/bluetooth/bluetooth.h>
	29	#include <net/bluetooth/hci_core.h>
	30
	31	#include "hci_uart.h"
	32
c0a1b73c JH	33	#define HCI_3WIRE_ACK_PKT 0
	34	#define HCI_3WIRE_LINK_PKT 15
	35
3f27e95b JH	36	#define H5_TXWINSIZE 4
	37
	38	#define H5_ACK_TIMEOUT msecs_to_jiffies(250)
40f10224	39	#define H5_SYNC_TIMEOUT msecs_to_jiffies(100)
3f27e95b	40
bc1f35b9 JH	41	/*
	42	* Maximum Three-wire packet:
	43	* 4 byte header + max value for 12-bit length + 2 bytes for CRC
	44	*/
	45	#define H5_MAX_LEN (4 + 0xfff + 2)
	46
01977c0b JH	47	/* Convenience macros for reading Three-wire header values */
	48	#define H5_HDR_SEQ(hdr) ((hdr)[0] & 0x07)
	49	#define H5_HDR_ACK(hdr) (((hdr)[0] >> 3) & 0x07)
	50	#define H5_HDR_CRC(hdr) (((hdr)[0] >> 6) & 0x01)
	51	#define H5_HDR_RELIABLE(hdr) (((hdr)[0] >> 7) & 0x01)
	52	#define H5_HDR_PKT_TYPE(hdr) ((hdr)[1] & 0x0f)
	53	#define H5_HDR_LEN(hdr) ((((hdr)[1] >> 4) & 0xff) + ((hdr)[2] << 4))
	54
bc1f35b9 JH	55	#define SLIP_DELIMITER 0xc0
	56	#define SLIP_ESC 0xdb
	57	#define SLIP_ESC_DELIM 0xdc
	58	#define SLIP_ESC_ESC 0xdd
	59
7d664fba	60	struct h5 {
bc1f35b9 JH	61	struct sk_buff_head unack; /* Unack'ed packets queue */
	62	struct sk_buff_head rel; /* Reliable packets queue */
	63	struct sk_buff_head unrel; /* Unreliable packets queue */
	64
	65	struct sk_buff rx_skb; / Receive buffer */
	66	size_t rx_pending; /* Expecting more bytes */
	67	bool rx_esc; /* SLIP escape mode */
43eb12d7	68	u8 rx_ack; /* Last ack number received */
7d664fba	69
bc1f35b9	70	int (rx_func) (struct hci_uart hu, u8 c);
7d664fba	71
bc1f35b9	72	struct timer_list timer; /* Retransmission timer */
3f27e95b	73
43eb12d7 JH	74	bool tx_ack_req; /* Pending ack to send */
43eb12d7 JH	75	u8 tx_seq; /* Next seq number to send */
40f10224	76	u8 tx_ack; /* Next ack number to send */
10122d07 JH	77
10122d07 JH	78	bool sleeping;
7d664fba JH	79	};
7d664fba JH	80
bc1f35b9 JH	81	static void h5_reset_rx(struct h5 *h5);
bc1f35b9 JH	82
3f27e95b JH	83	static void h5_timed_event(unsigned long arg)
	84	{
	85	struct hci_uart hu = (struct hci_uart ) arg;
	86	struct h5 *h5 = hu->priv;
	87	struct sk_buff *skb;
	88	unsigned long flags;
	89
	90	BT_DBG("hu %p retransmitting %u pkts", hu, h5->unack.qlen);
	91
	92	spin_lock_irqsave_nested(&h5->unack.lock, flags, SINGLE_DEPTH_NESTING);
	93
	94	while ((skb = __skb_dequeue_tail(&h5->unack)) != NULL) {
43eb12d7	95	h5->tx_seq = (h5->tx_seq - 1) & 0x07;
3f27e95b JH	96	skb_queue_head(&h5->rel, skb);
	97	}
	98
	99	spin_unlock_irqrestore(&h5->unack.lock, flags);
	100
	101	hci_uart_tx_wakeup(hu);
	102	}
	103
40f10224 JH	104	static void h5_link_control(struct hci_uart hu, const void data, size_t len)
	105	{
	106	struct h5 *h5 = hu->priv;
	107	struct sk_buff *nskb;
	108
	109	nskb = alloc_skb(3, GFP_ATOMIC);
	110	if (!nskb)
	111	return;
	112
	113	bt_cb(nskb)->pkt_type = HCI_3WIRE_LINK_PKT;
	114
	115	memcpy(skb_put(nskb, len), data, len);
	116
	117	skb_queue_tail(&h5->unrel, nskb);
	118	}
	119
7dec65c8 JH	120	static int h5_open(struct hci_uart *hu)
7dec65c8 JH	121	{
7d664fba	122	struct h5 *h5;
40f10224	123	const unsigned char sync[] = { 0x01, 0x7e };
7d664fba JH	124
	125	BT_DBG("hu %p", hu);
	126
	127	h5 = kzalloc(sizeof(*h5), GFP_KERNEL);
	128	if (!h5)
	129	return -ENOMEM;
	130
	131	hu->priv = h5;
	132
	133	skb_queue_head_init(&h5->unack);
	134	skb_queue_head_init(&h5->rel);
	135	skb_queue_head_init(&h5->unrel);
	136
bc1f35b9 JH	137	h5_reset_rx(h5);
bc1f35b9 JH	138
3f27e95b JH	139	init_timer(&h5->timer);
	140	h5->timer.function = h5_timed_event;
	141	h5->timer.data = (unsigned long) hu;
	142
cd1b4425 JH	143	set_bit(HCI_UART_INIT_PENDING, &hu->hdev_flags);
cd1b4425 JH	144
40f10224 JH	145	/* Send initial sync request */
	146	h5_link_control(hu, sync, sizeof(sync));
	147	mod_timer(&h5->timer, jiffies + H5_SYNC_TIMEOUT);
	148
7d664fba	149	return 0;
7dec65c8 JH	150	}
	151
	152	static int h5_close(struct hci_uart *hu)
	153	{
7d664fba JH	154	struct h5 *h5 = hu->priv;
	155
	156	skb_queue_purge(&h5->unack);
	157	skb_queue_purge(&h5->rel);
	158	skb_queue_purge(&h5->unrel);
	159
3f27e95b JH	160	del_timer(&h5->timer);
3f27e95b JH	161
7d664fba JH	162	kfree(h5);
	163
	164	return 0;
7dec65c8 JH	165	}
7dec65c8 JH	166
43eb12d7 JH	167	static void h5_pkt_cull(struct h5 *h5)
	168	{
	169	struct sk_buff skb, tmp;
	170	unsigned long flags;
	171	int i, to_remove;
	172	u8 seq;
	173
	174	spin_lock_irqsave(&h5->unack.lock, flags);
	175
	176	to_remove = skb_queue_len(&h5->unack);
40f10224 JH	177	if (to_remove == 0)
40f10224 JH	178	goto unlock;
43eb12d7 JH	179
	180	seq = h5->tx_seq;
	181
	182	while (to_remove > 0) {
	183	if (h5->rx_ack == seq)
	184	break;
	185
	186	to_remove--;
	187	seq = (seq - 1) % 8;
	188	}
	189
	190	if (seq != h5->rx_ack)
	191	BT_ERR("Controller acked invalid packet");
	192
	193	i = 0;
	194	skb_queue_walk_safe(&h5->unack, skb, tmp) {
	195	if (i++ >= to_remove)
	196	break;
	197
	198	__skb_unlink(skb, &h5->unack);
	199	kfree_skb(skb);
	200	}
	201
	202	if (skb_queue_empty(&h5->unack))
	203	del_timer(&h5->timer);
	204
40f10224	205	unlock:
43eb12d7 JH	206	spin_unlock_irqrestore(&h5->unack.lock, flags);
	207	}
	208
bc1f35b9 JH	209	static void h5_handle_internal_rx(struct hci_uart *hu)
bc1f35b9 JH	210	{
40f10224 JH	211	struct h5 *h5 = hu->priv;
	212	const unsigned char sync_req[] = { 0x01, 0x7e };
	213	const unsigned char sync_rsp[] = { 0x02, 0x7d };
	214	const unsigned char conf_req[] = { 0x03, 0xfc, 0x01 };
	215	const unsigned char conf_rsp[] = { 0x04, 0x7b, 0x01 };
10122d07 JH	216	const unsigned char wakeup_req[] = { 0x05, 0xfa };
	217	const unsigned char woken_req[] = { 0x06, 0xf9 };
	218	const unsigned char sleep_req[] = { 0x07, 0x78 };
40f10224 JH	219	const unsigned char *hdr = h5->rx_skb->data;
	220	const unsigned char *data = &h5->rx_skb->data[4];
	221
bc1f35b9	222	BT_DBG("%s", hu->hdev->name);
40f10224 JH	223
	224	if (H5_HDR_PKT_TYPE(hdr) != HCI_3WIRE_LINK_PKT)
	225	return;
	226
	227	if (H5_HDR_LEN(hdr) < 2)
	228	return;
	229
	230	if (memcmp(data, sync_req, 2) == 0) {
	231	h5_link_control(hu, sync_rsp, 2);
	232	} else if (memcmp(data, sync_rsp, 2) == 0) {
	233	h5_link_control(hu, conf_req, 3);
	234	} else if (memcmp(data, conf_req, 2) == 0) {
	235	h5_link_control(hu, conf_rsp, 2);
	236	h5_link_control(hu, conf_req, 3);
	237	} else if (memcmp(data, conf_rsp, 2) == 0) {
	238	BT_DBG("Three-wire init sequence complete");
cd1b4425	239	hci_uart_init_ready(hu);
40f10224	240	return;
10122d07 JH	241	} else if (memcmp(data, sleep_req, 2) == 0) {
	242	BT_DBG("Peer went to sleep");
	243	h5->sleeping = true;
	244	h5_link_control(hu, wakeup_req, 2);
	245	} else if (memcmp(data, woken_req, 2) == 0) {
	246	BT_DBG("Peer woke up");
	247	h5->sleeping = false;
	248	return;
40f10224 JH	249	} else {
	250	BT_DBG("Link Control: 0x%02hhx 0x%02hhx", data[0], data[1]);
	251	return;
	252	}
	253
	254	hci_uart_tx_wakeup(hu);
bc1f35b9 JH	255	}
	256
	257	static void h5_complete_rx_pkt(struct hci_uart *hu)
	258	{
	259	struct h5 *h5 = hu->priv;
43eb12d7	260	const unsigned char *hdr = h5->rx_skb->data;
bc1f35b9	261
43eb12d7	262	if (H5_HDR_RELIABLE(hdr)) {
40f10224	263	h5->tx_ack = (h5->tx_ack + 1) % 8;
43eb12d7	264	h5->tx_ack_req = true;
40f10224	265	hci_uart_tx_wakeup(hu);
43eb12d7	266	}
bc1f35b9	267
43eb12d7 JH	268	h5->rx_ack = H5_HDR_ACK(hdr);
	269
	270	h5_pkt_cull(h5);
	271
	272	switch (H5_HDR_PKT_TYPE(hdr)) {
bc1f35b9 JH	273	case HCI_EVENT_PKT:
	274	case HCI_ACLDATA_PKT:
	275	case HCI_SCODATA_PKT:
43eb12d7	276	bt_cb(h5->rx_skb)->pkt_type = H5_HDR_PKT_TYPE(hdr);
bc1f35b9 JH	277
	278	/* Remove Three-wire header */
	279	skb_pull(h5->rx_skb, 4);
	280
	281	hci_recv_frame(h5->rx_skb);
	282	h5->rx_skb = NULL;
	283
	284	break;
	285
	286	default:
	287	h5_handle_internal_rx(hu);
	288	break;
	289	}
	290
	291	h5_reset_rx(h5);
	292	}
	293
	294	static int h5_rx_crc(struct hci_uart *hu, unsigned char c)
	295	{
	296	struct h5 *h5 = hu->priv;
	297
bc1f35b9 JH	298	h5_complete_rx_pkt(hu);
	299	h5_reset_rx(h5);
	300
	301	return 0;
	302	}
	303
	304	static int h5_rx_payload(struct hci_uart *hu, unsigned char c)
	305	{
	306	struct h5 *h5 = hu->priv;
	307	const unsigned char *hdr = h5->rx_skb->data;
	308
43eb12d7	309	if (H5_HDR_CRC(hdr)) {
bc1f35b9 JH	310	h5->rx_func = h5_rx_crc;
	311	h5->rx_pending = 2;
	312	} else {
	313	h5_complete_rx_pkt(hu);
	314	h5_reset_rx(h5);
	315	}
	316
	317	return 0;
	318	}
	319
	320	static int h5_rx_3wire_hdr(struct hci_uart *hu, unsigned char c)
	321	{
	322	struct h5 *h5 = hu->priv;
	323	const unsigned char *hdr = h5->rx_skb->data;
	324
40f10224 JH	325	BT_DBG("%s rx: seq %u ack %u crc %u rel %u type %u len %u",
	326	hu->hdev->name, H5_HDR_SEQ(hdr), H5_HDR_ACK(hdr),
	327	H5_HDR_CRC(hdr), H5_HDR_RELIABLE(hdr), H5_HDR_PKT_TYPE(hdr),
	328	H5_HDR_LEN(hdr));
	329
bc1f35b9 JH	330	if (((hdr[0] + hdr[1] + hdr[2] + hdr[3]) & 0xff) != 0xff) {
	331	BT_ERR("Invalid header checksum");
	332	h5_reset_rx(h5);
	333	return 0;
	334	}
	335
40f10224	336	if (H5_HDR_RELIABLE(hdr) && H5_HDR_SEQ(hdr) != h5->tx_ack) {
43eb12d7	337	BT_ERR("Out-of-order packet arrived (%u != %u)",
40f10224	338	H5_HDR_SEQ(hdr), h5->tx_ack);
43eb12d7 JH	339	h5_reset_rx(h5);
	340	return 0;
	341	}
	342
bc1f35b9	343	h5->rx_func = h5_rx_payload;
43eb12d7	344	h5->rx_pending = H5_HDR_LEN(hdr);
bc1f35b9 JH	345
	346	return 0;
	347	}
	348
	349	static int h5_rx_pkt_start(struct hci_uart *hu, unsigned char c)
	350	{
	351	struct h5 *h5 = hu->priv;
	352
bc1f35b9 JH	353	if (c == SLIP_DELIMITER)
	354	return 1;
	355
	356	h5->rx_func = h5_rx_3wire_hdr;
	357	h5->rx_pending = 4;
	358
	359	h5->rx_skb = bt_skb_alloc(H5_MAX_LEN, GFP_ATOMIC);
	360	if (!h5->rx_skb) {
	361	BT_ERR("Can't allocate mem for new packet");
	362	h5_reset_rx(h5);
	363	return -ENOMEM;
	364	}
	365
	366	h5->rx_skb->dev = (void *) hu->hdev;
	367
	368	return 0;
	369	}
	370
	371	static int h5_rx_delimiter(struct hci_uart *hu, unsigned char c)
	372	{
	373	struct h5 *h5 = hu->priv;
	374
bc1f35b9 JH	375	if (c == SLIP_DELIMITER)
	376	h5->rx_func = h5_rx_pkt_start;
	377
	378	return 1;
	379	}
	380
	381	static void h5_unslip_one_byte(struct h5 *h5, unsigned char c)
	382	{
	383	const u8 delim = SLIP_DELIMITER, esc = SLIP_ESC;
	384	const u8 *byte = &c;
	385
	386	if (!h5->rx_esc && c == SLIP_ESC) {
	387	h5->rx_esc = true;
	388	return;
	389	}
	390
	391	if (h5->rx_esc) {
	392	switch (c) {
	393	case SLIP_ESC_DELIM:
	394	byte = &delim;
	395	break;
	396	case SLIP_ESC_ESC:
	397	byte = &esc;
	398	break;
	399	default:
	400	BT_ERR("Invalid esc byte 0x%02hhx", c);
	401	h5_reset_rx(h5);
	402	return;
	403	}
	404
	405	h5->rx_esc = false;
	406	}
	407
	408	memcpy(skb_put(h5->rx_skb, 1), byte, 1);
	409	h5->rx_pending--;
	410
255a68e0	411	BT_DBG("unsliped 0x%02hhx, rx_pending %zu", *byte, h5->rx_pending);
bc1f35b9 JH	412	}
	413
	414	static void h5_reset_rx(struct h5 *h5)
	415	{
	416	if (h5->rx_skb) {
	417	kfree_skb(h5->rx_skb);
	418	h5->rx_skb = NULL;
	419	}
	420
	421	h5->rx_func = h5_rx_delimiter;
	422	h5->rx_pending = 0;
	423	h5->rx_esc = false;
	424	}
	425
7dec65c8 JH	426	static int h5_recv(struct hci_uart hu, void data, int count)
7dec65c8 JH	427	{
bc1f35b9 JH	428	struct h5 *h5 = hu->priv;
	429	unsigned char *ptr = data;
	430
255a68e0 JH	431	BT_DBG("%s pending %zu count %d", hu->hdev->name, h5->rx_pending,
255a68e0 JH	432	count);
bc1f35b9 JH	433
	434	while (count > 0) {
	435	int processed;
	436
	437	if (h5->rx_pending > 0) {
	438	if (*ptr == SLIP_DELIMITER) {
	439	BT_ERR("Too short H5 packet");
	440	h5_reset_rx(h5);
	441	continue;
	442	}
	443
	444	h5_unslip_one_byte(h5, *ptr);
	445
	446	ptr++; count--;
	447	continue;
	448	}
	449
	450	processed = h5->rx_func(hu, *ptr);
	451	if (processed < 0)
	452	return processed;
	453
	454	ptr += processed;
	455	count -= processed;
	456	}
	457
	458	return 0;
7dec65c8 JH	459	}
	460
	461	static int h5_enqueue(struct hci_uart hu, struct sk_buff skb)
	462	{
7d664fba JH	463	struct h5 *h5 = hu->priv;
	464
	465	if (skb->len > 0xfff) {
	466	BT_ERR("Packet too long (%u bytes)", skb->len);
	467	kfree_skb(skb);
	468	return 0;
	469	}
	470
	471	switch (bt_cb(skb)->pkt_type) {
	472	case HCI_ACLDATA_PKT:
	473	case HCI_COMMAND_PKT:
	474	skb_queue_tail(&h5->rel, skb);
	475	break;
	476
	477	case HCI_SCODATA_PKT:
	478	skb_queue_tail(&h5->unrel, skb);
	479	break;
	480
	481	default:
	482	BT_ERR("Unknown packet type %u", bt_cb(skb)->pkt_type);
	483	kfree_skb(skb);
	484	break;
	485	}
	486
	487	return 0;
	488	}
	489
c0a1b73c JH	490	static void h5_slip_delim(struct sk_buff *skb)
	491	{
	492	const char delim = SLIP_DELIMITER;
	493
	494	memcpy(skb_put(skb, 1), &delim, 1);
	495	}
	496
	497	static void h5_slip_one_byte(struct sk_buff *skb, u8 c)
	498	{
	499	const char esc_delim[2] = { SLIP_ESC, SLIP_ESC_DELIM };
	500	const char esc_esc[2] = { SLIP_ESC, SLIP_ESC_ESC };
	501
	502	switch (c) {
	503	case SLIP_DELIMITER:
	504	memcpy(skb_put(skb, 2), &esc_delim, 2);
	505	break;
	506	case SLIP_ESC:
	507	memcpy(skb_put(skb, 2), &esc_esc, 2);
	508	break;
	509	default:
	510	memcpy(skb_put(skb, 1), &c, 1);
	511	}
	512	}
	513
40f10224	514	static struct sk_buff h5_build_pkt(struct hci_uart hu, bool rel, u8 pkt_type,
c0a1b73c	515	const u8 *data, size_t len)
7d664fba	516	{
40f10224	517	struct h5 *h5 = hu->priv;
c0a1b73c JH	518	struct sk_buff *nskb;
	519	u8 hdr[4];
	520	int i;
	521
	522	/*
	523	* Max len of packet: (original len + 4 (H5 hdr) + 2 (crc)) * 2
	524	* (because bytes 0xc0 and 0xdb are escaped, worst case is when
	525	* the packet is all made of 0xc0 and 0xdb) + 2 (0xc0
	526	* delimiters at start and end).
	527	*/
	528	nskb = alloc_skb((len + 6) * 2 + 2, GFP_ATOMIC);
	529	if (!nskb)
	530	return NULL;
	531
	532	bt_cb(nskb)->pkt_type = pkt_type;
	533
	534	h5_slip_delim(nskb);
	535
40f10224	536	hdr[0] = h5->tx_ack << 3;
43eb12d7	537	h5->tx_ack_req = false;
c0a1b73c JH	538
	539	if (rel) {
	540	hdr[0] \|= 1 << 7;
43eb12d7 JH	541	hdr[0] \|= h5->tx_seq;
43eb12d7 JH	542	h5->tx_seq = (h5->tx_seq + 1) % 8;
c0a1b73c JH	543	}
	544
	545	hdr[1] = pkt_type \| ((len & 0x0f) << 4);
	546	hdr[2] = len >> 4;
	547	hdr[3] = ~((hdr[0] + hdr[1] + hdr[2]) & 0xff);
	548
40f10224 JH	549	BT_DBG("%s tx: seq %u ack %u crc %u rel %u type %u len %u",
	550	hu->hdev->name, H5_HDR_SEQ(hdr), H5_HDR_ACK(hdr),
	551	H5_HDR_CRC(hdr), H5_HDR_RELIABLE(hdr), H5_HDR_PKT_TYPE(hdr),
	552	H5_HDR_LEN(hdr));
	553
c0a1b73c JH	554	for (i = 0; i < 4; i++)
	555	h5_slip_one_byte(nskb, hdr[i]);
	556
	557	for (i = 0; i < len; i++)
	558	h5_slip_one_byte(nskb, data[i]);
	559
	560	h5_slip_delim(nskb);
	561
	562	return nskb;
	563	}
	564
40f10224	565	static struct sk_buff h5_prepare_pkt(struct hci_uart hu, u8 pkt_type,
c0a1b73c JH	566	const u8 *data, size_t len)
	567	{
	568	bool rel;
	569
	570	switch (pkt_type) {
	571	case HCI_ACLDATA_PKT:
	572	case HCI_COMMAND_PKT:
	573	rel = true;
	574	break;
	575	case HCI_SCODATA_PKT:
	576	case HCI_3WIRE_LINK_PKT:
	577	case HCI_3WIRE_ACK_PKT:
	578	rel = false;
	579	break;
	580	default:
	581	BT_ERR("Unknown packet type %u", pkt_type);
	582	return NULL;
	583	}
	584
40f10224	585	return h5_build_pkt(hu, rel, pkt_type, data, len);
7dec65c8 JH	586	}
	587
	588	static struct sk_buff h5_dequeue(struct hci_uart hu)
	589	{
7d664fba	590	struct h5 *h5 = hu->priv;
3f27e95b	591	unsigned long flags;
7d664fba JH	592	struct sk_buff skb, nskb;
	593
	594	if ((skb = skb_dequeue(&h5->unrel)) != NULL) {
40f10224	595	nskb = h5_prepare_pkt(hu, bt_cb(skb)->pkt_type,
c0a1b73c	596	skb->data, skb->len);
7d664fba JH	597	if (nskb) {
	598	kfree_skb(skb);
	599	return nskb;
	600	}
	601
	602	skb_queue_head(&h5->unrel, skb);
	603	BT_ERR("Could not dequeue pkt because alloc_skb failed");
	604	}
	605
3f27e95b JH	606	spin_lock_irqsave_nested(&h5->unack.lock, flags, SINGLE_DEPTH_NESTING);
	607
	608	if (h5->unack.qlen >= H5_TXWINSIZE)
	609	goto unlock;
	610
	611	if ((skb = skb_dequeue(&h5->rel)) != NULL) {
40f10224	612	nskb = h5_prepare_pkt(hu, bt_cb(skb)->pkt_type,
c0a1b73c	613	skb->data, skb->len);
3f27e95b JH	614	if (nskb) {
	615	__skb_queue_tail(&h5->unack, skb);
	616	mod_timer(&h5->timer, jiffies + H5_ACK_TIMEOUT);
	617	spin_unlock_irqrestore(&h5->unack.lock, flags);
	618	return nskb;
	619	}
	620
	621	skb_queue_head(&h5->rel, skb);
	622	BT_ERR("Could not dequeue pkt because alloc_skb failed");
	623	}
	624
	625	unlock:
	626	spin_unlock_irqrestore(&h5->unack.lock, flags);
	627
43eb12d7	628	if (h5->tx_ack_req)
40f10224	629	return h5_prepare_pkt(hu, HCI_3WIRE_ACK_PKT, NULL, 0);
7d664fba	630
7dec65c8 JH	631	return NULL;
	632	}
	633
	634	static int h5_flush(struct hci_uart *hu)
	635	{
7d664fba JH	636	BT_DBG("hu %p", hu);
7d664fba JH	637	return 0;
7dec65c8 JH	638	}
	639
	640	static struct hci_uart_proto h5p = {
	641	.id = HCI_UART_3WIRE,
	642	.open = h5_open,
	643	.close = h5_close,
	644	.recv = h5_recv,
	645	.enqueue = h5_enqueue,
	646	.dequeue = h5_dequeue,
	647	.flush = h5_flush,
	648	};
	649
	650	int __init h5_init(void)
	651	{
	652	int err = hci_uart_register_proto(&h5p);
	653
	654	if (!err)
	655	BT_INFO("HCI Three-wire UART (H5) protocol initialized");
	656	else
	657	BT_ERR("HCI Three-wire UART (H5) protocol init failed");
	658
	659	return err;
	660	}
	661
	662	int __exit h5_deinit(void)
	663	{
	664	return hci_uart_unregister_proto(&h5p);
	665	}