[mirror_ubuntu-jammy-kernel.git] / drivers / bluetooth / hci_bcsp.c

/* 
   BlueCore Serial Protocol (BCSP) for Linux Bluetooth stack (BlueZ).
   Copyright 2002 by Fabrizio Gennari <fabrizio.gennari@philips.com>

   Based on
       hci_h4.c  by Maxim Krasnyansky <maxk@qualcomm.com>
       ABCSP     by Carl Orsborn <cjo@csr.com>

   This program is free software; you can redistribute it and/or modify
   it under the terms of the GNU General Public License version 2 as
   published by the Free Software Foundation;

   THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
   OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
   FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
   IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
   CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES 
   WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN 
   ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF 
   OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.

   ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS, 
   COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS 
   SOFTWARE IS DISCLAIMED.
*/

/*
 * $Id: hci_bcsp.c,v 1.2 2002/09/26 05:05:14 maxk Exp $
 */

#define VERSION "0.3"

#include <linux/config.h>
#include <linux/module.h>

#include <linux/kernel.h>
#include <linux/init.h>
#include <linux/sched.h>
#include <linux/types.h>
#include <linux/fcntl.h>
#include <linux/interrupt.h>
#include <linux/ptrace.h>
#include <linux/poll.h>

#include <linux/slab.h>
#include <linux/tty.h>
#include <linux/errno.h>
#include <linux/string.h>
#include <linux/signal.h>
#include <linux/ioctl.h>
#include <linux/skbuff.h>

#include <net/bluetooth/bluetooth.h>
#include <net/bluetooth/hci_core.h>
#include "hci_uart.h"
#include "hci_bcsp.h"

#ifndef CONFIG_BT_HCIUART_DEBUG
#undef  BT_DBG
#define BT_DBG( A... )
#endif

static int txcrc = 1;
static int hciextn = 1;

/* ---- BCSP CRC calculation ---- */

/* Table for calculating CRC for polynomial 0x1021, LSB processed first,
initial value 0xffff, bits shifted in reverse order. */

static const u16 crc_table[] = {
	0x0000, 0x1081, 0x2102, 0x3183,
	0x4204, 0x5285, 0x6306, 0x7387,
	0x8408, 0x9489, 0xa50a, 0xb58b,
	0xc60c, 0xd68d, 0xe70e, 0xf78f
};

/* Initialise the crc calculator */
#define BCSP_CRC_INIT(x) x = 0xffff

/*
   Update crc with next data byte

   Implementation note
        The data byte is treated as two nibbles.  The crc is generated
        in reverse, i.e., bits are fed into the register from the top.
*/
static void bcsp_crc_update(u16 *crc, u8 d)
{
	u16 reg = *crc;

	reg = (reg >> 4) ^ crc_table[(reg ^ d) & 0x000f];
	reg = (reg >> 4) ^ crc_table[(reg ^ (d >> 4)) & 0x000f];

	*crc = reg;
}

/*
   Get reverse of generated crc

   Implementation note
        The crc generator (bcsp_crc_init() and bcsp_crc_update())
        creates a reversed crc, so it needs to be swapped back before
        being passed on.
*/
static u16 bcsp_crc_reverse(u16 crc)
{
	u16 b, rev;

	for (b = 0, rev = 0; b < 16; b++) {
		rev = rev << 1;
		rev |= (crc & 1);
		crc = crc >> 1;
	}
	return (rev);
}

/* ---- BCSP core ---- */

static void bcsp_slip_msgdelim(struct sk_buff *skb)
{
	const char pkt_delim = 0xc0;
	memcpy(skb_put(skb, 1), &pkt_delim, 1);
}

static void bcsp_slip_one_byte(struct sk_buff *skb, u8 c)
{
	const char esc_c0[2] = { 0xdb, 0xdc };
	const char esc_db[2] = { 0xdb, 0xdd };

	switch (c) {
	case 0xc0:
		memcpy(skb_put(skb, 2), &esc_c0, 2);
		break;
	case 0xdb:
		memcpy(skb_put(skb, 2), &esc_db, 2);
		break;
	default:
		memcpy(skb_put(skb, 1), &c, 1);
	}
}

static int bcsp_enqueue(struct hci_uart *hu, struct sk_buff *skb)
{
	struct bcsp_struct *bcsp = hu->priv;

	if (skb->len > 0xFFF) {
		BT_ERR("Packet too long");
		kfree_skb(skb);
		return 0;
	}

	switch (bt_cb(skb)->pkt_type) {
	case HCI_ACLDATA_PKT:
	case HCI_COMMAND_PKT:
		skb_queue_tail(&bcsp->rel, skb);
		break;

	case HCI_SCODATA_PKT:
		skb_queue_tail(&bcsp->unrel, skb);
		break;

	default:
		BT_ERR("Unknown packet type");
		kfree_skb(skb);
		break;
	}

	return 0;
}

static struct sk_buff *bcsp_prepare_pkt(struct bcsp_struct *bcsp, u8 *data,
		int len, int pkt_type)
{
	struct sk_buff *nskb;
	u8 hdr[4], chan;
	u16 BCSP_CRC_INIT(bcsp_txmsg_crc);
	int rel, i;

	switch (pkt_type) {
	case HCI_ACLDATA_PKT:
		chan = 6;	/* BCSP ACL channel */
		rel = 1;	/* reliable channel */
		break;
	case HCI_COMMAND_PKT:
		chan = 5;	/* BCSP cmd/evt channel */
		rel = 1;	/* reliable channel */
		break;
	case HCI_SCODATA_PKT:
		chan = 7;	/* BCSP SCO channel */
		rel = 0;	/* unreliable channel */
		break;
	case BCSP_LE_PKT:
		chan = 1;	/* BCSP LE channel */
		rel = 0;	/* unreliable channel */
		break;
	case BCSP_ACK_PKT:
		chan = 0;	/* BCSP internal channel */
		rel = 0;	/* unreliable channel */
		break;
	default:
		BT_ERR("Unknown packet type");
		return NULL;
	}

	if (hciextn && chan == 5) {
		struct hci_command_hdr *hdr = (struct hci_command_hdr *) data;

		if (hci_opcode_ogf(__le16_to_cpu(hdr->opcode)) == OGF_VENDOR_CMD) {
			u8 desc = *(data + HCI_COMMAND_HDR_SIZE);
			if ((desc & 0xf0) == 0xc0) {
				data += HCI_COMMAND_HDR_SIZE + 1;
				len  -= HCI_COMMAND_HDR_SIZE + 1;
				chan = desc & 0x0f;
			}
		}
	}

	/* Max len of packet: (original len +4(bcsp hdr) +2(crc))*2
	   (because bytes 0xc0 and 0xdb are escaped, worst case is
	   when the packet is all made of 0xc0 and 0xdb :) )
	   + 2 (0xc0 delimiters at start and end). */

	nskb = alloc_skb((len + 6) * 2 + 2, GFP_ATOMIC);
	if (!nskb)
		return NULL;

	bt_cb(nskb)->pkt_type = pkt_type;

	bcsp_slip_msgdelim(nskb);

	hdr[0] = bcsp->rxseq_txack << 3;
	bcsp->txack_req = 0;
	BT_DBG("We request packet no %u to card", bcsp->rxseq_txack);

	if (rel) {
		hdr[0] |= 0x80 + bcsp->msgq_txseq;
		BT_DBG("Sending packet with seqno %u", bcsp->msgq_txseq);
		bcsp->msgq_txseq = ++(bcsp->msgq_txseq) & 0x07;
	}

	if (bcsp->use_crc)
		hdr[0] |= 0x40;

	hdr[1] = ((len << 4) & 0xff) | chan;
	hdr[2] = len >> 4;
	hdr[3] = ~(hdr[0] + hdr[1] + hdr[2]);

	/* Put BCSP header */
	for (i = 0; i < 4; i++) {
		bcsp_slip_one_byte(nskb, hdr[i]);

		if (bcsp->use_crc)
			bcsp_crc_update(&bcsp_txmsg_crc, hdr[i]);
	}

	/* Put payload */
	for (i = 0; i < len; i++) {
		bcsp_slip_one_byte(nskb, data[i]);

		if (bcsp->use_crc)
			bcsp_crc_update(&bcsp_txmsg_crc, data[i]);
	}

	/* Put CRC */
	if (bcsp->use_crc) {
		bcsp_txmsg_crc = bcsp_crc_reverse(bcsp_txmsg_crc);
		bcsp_slip_one_byte(nskb, (u8) ((bcsp_txmsg_crc >> 8) & 0x00ff));
		bcsp_slip_one_byte(nskb, (u8) (bcsp_txmsg_crc & 0x00ff));
	}

	bcsp_slip_msgdelim(nskb);
	return nskb;
}

/* This is a rewrite of pkt_avail in ABCSP */
static struct sk_buff *bcsp_dequeue(struct hci_uart *hu)
{
	struct bcsp_struct *bcsp = hu->priv;
	unsigned long flags;
	struct sk_buff *skb;
	
	/* First of all, check for unreliable messages in the queue,
	   since they have priority */

	if ((skb = skb_dequeue(&bcsp->unrel)) != NULL) {
		struct sk_buff *nskb = bcsp_prepare_pkt(bcsp, skb->data, skb->len, bt_cb(skb)->pkt_type);
		if (nskb) {
			kfree_skb(skb);
			return nskb;
		} else {
			skb_queue_head(&bcsp->unrel, skb);
			BT_ERR("Could not dequeue pkt because alloc_skb failed");
		}
	}

	/* Now, try to send a reliable pkt. We can only send a
	   reliable packet if the number of packets sent but not yet ack'ed
	   is < than the winsize */

	spin_lock_irqsave(&bcsp->unack.lock, flags);

	if (bcsp->unack.qlen < BCSP_TXWINSIZE && (skb = skb_dequeue(&bcsp->rel)) != NULL) {
		struct sk_buff *nskb = bcsp_prepare_pkt(bcsp, skb->data, skb->len, bt_cb(skb)->pkt_type);
		if (nskb) {
			__skb_queue_tail(&bcsp->unack, skb);
			mod_timer(&bcsp->tbcsp, jiffies + HZ / 4);
			spin_unlock_irqrestore(&bcsp->unack.lock, flags);
			return nskb;
		} else {
			skb_queue_head(&bcsp->rel, skb);
			BT_ERR("Could not dequeue pkt because alloc_skb failed");
		}
	}

	spin_unlock_irqrestore(&bcsp->unack.lock, flags);


	/* We could not send a reliable packet, either because there are
	   none or because there are too many unack'ed pkts. Did we receive
	   any packets we have not acknowledged yet ? */

	if (bcsp->txack_req) {
		/* if so, craft an empty ACK pkt and send it on BCSP unreliable
		   channel 0 */
		struct sk_buff *nskb = bcsp_prepare_pkt(bcsp, NULL, 0, BCSP_ACK_PKT);
		return nskb;
	}

	/* We have nothing to send */
	return NULL;
}

static int bcsp_flush(struct hci_uart *hu)
{
	BT_DBG("hu %p", hu);
	return 0;
}

/* Remove ack'ed packets */
static void bcsp_pkt_cull(struct bcsp_struct *bcsp)
{
	unsigned long flags;
	struct sk_buff *skb;
	int i, pkts_to_be_removed;
	u8 seqno;

	spin_lock_irqsave(&bcsp->unack.lock, flags);

	pkts_to_be_removed = bcsp->unack.qlen;
	seqno = bcsp->msgq_txseq;

	while (pkts_to_be_removed) {
		if (bcsp->rxack == seqno)
			break;
		pkts_to_be_removed--;
		seqno = (seqno - 1) & 0x07;
	}

	if (bcsp->rxack != seqno)
		BT_ERR("Peer acked invalid packet");

	BT_DBG("Removing %u pkts out of %u, up to seqno %u",
	       pkts_to_be_removed, bcsp->unack.qlen, (seqno - 1) & 0x07);

	for (i = 0, skb = ((struct sk_buff *) &bcsp->unack)->next; i < pkts_to_be_removed
			&& skb != (struct sk_buff *) &bcsp->unack; i++) {
		struct sk_buff *nskb;

		nskb = skb->next;
		__skb_unlink(skb, &bcsp->unack);
		kfree_skb(skb);
		skb = nskb;
	}
	if (bcsp->unack.qlen == 0)
		del_timer(&bcsp->tbcsp);
	spin_unlock_irqrestore(&bcsp->unack.lock, flags);

	if (i != pkts_to_be_removed)
		BT_ERR("Removed only %u out of %u pkts", i, pkts_to_be_removed);
}

/* Handle BCSP link-establishment packets. When we
   detect a "sync" packet, symptom that the BT module has reset,
   we do nothing :) (yet) */
static void bcsp_handle_le_pkt(struct hci_uart *hu)
{
	struct bcsp_struct *bcsp = hu->priv;
	u8 conf_pkt[4]     = { 0xad, 0xef, 0xac, 0xed };
	u8 conf_rsp_pkt[4] = { 0xde, 0xad, 0xd0, 0xd0 };
	u8 sync_pkt[4]     = { 0xda, 0xdc, 0xed, 0xed };

	/* spot "conf" pkts and reply with a "conf rsp" pkt */
	if (bcsp->rx_skb->data[1] >> 4 == 4 && bcsp->rx_skb->data[2] == 0 &&
			!memcmp(&bcsp->rx_skb->data[4], conf_pkt, 4)) {
		struct sk_buff *nskb = alloc_skb(4, GFP_ATOMIC);

		BT_DBG("Found a LE conf pkt");
		if (!nskb)
			return;
		memcpy(skb_put(nskb, 4), conf_rsp_pkt, 4);
		bt_cb(nskb)->pkt_type = BCSP_LE_PKT;

		skb_queue_head(&bcsp->unrel, nskb);
		hci_uart_tx_wakeup(hu);
	}
	/* Spot "sync" pkts. If we find one...disaster! */
	else if (bcsp->rx_skb->data[1] >> 4 == 4 && bcsp->rx_skb->data[2] == 0 &&
			!memcmp(&bcsp->rx_skb->data[4], sync_pkt, 4)) {
		BT_ERR("Found a LE sync pkt, card has reset");
	}
}

static inline void bcsp_unslip_one_byte(struct bcsp_struct *bcsp, unsigned char byte)
{
	const u8 c0 = 0xc0, db = 0xdb;

	switch (bcsp->rx_esc_state) {
	case BCSP_ESCSTATE_NOESC:
		switch (byte) {
		case 0xdb:
			bcsp->rx_esc_state = BCSP_ESCSTATE_ESC;
			break;
		default:
			memcpy(skb_put(bcsp->rx_skb, 1), &byte, 1);
			if ((bcsp->rx_skb-> data[0] & 0x40) != 0 && 
					bcsp->rx_state != BCSP_W4_CRC)
				bcsp_crc_update(&bcsp->message_crc, byte);
			bcsp->rx_count--;
		}
		break;

	case BCSP_ESCSTATE_ESC:
		switch (byte) {
		case 0xdc:
			memcpy(skb_put(bcsp->rx_skb, 1), &c0, 1);
			if ((bcsp->rx_skb-> data[0] & 0x40) != 0 && 
					bcsp->rx_state != BCSP_W4_CRC)
				bcsp_crc_update(&bcsp-> message_crc, 0xc0);
			bcsp->rx_esc_state = BCSP_ESCSTATE_NOESC;
			bcsp->rx_count--;
			break;

		case 0xdd:
			memcpy(skb_put(bcsp->rx_skb, 1), &db, 1);
			if ((bcsp->rx_skb-> data[0] & 0x40) != 0 && 
					bcsp->rx_state != BCSP_W4_CRC) 
				bcsp_crc_update(&bcsp-> message_crc, 0xdb);
			bcsp->rx_esc_state = BCSP_ESCSTATE_NOESC;
			bcsp->rx_count--;
			break;

		default:
			BT_ERR ("Invalid byte %02x after esc byte", byte);
			kfree_skb(bcsp->rx_skb);
			bcsp->rx_skb = NULL;
			bcsp->rx_state = BCSP_W4_PKT_DELIMITER;
			bcsp->rx_count = 0;
		}
	}
}

static inline void bcsp_complete_rx_pkt(struct hci_uart *hu)
{
	struct bcsp_struct *bcsp = hu->priv;
	int pass_up;

	if (bcsp->rx_skb->data[0] & 0x80) {	/* reliable pkt */
		BT_DBG("Received seqno %u from card", bcsp->rxseq_txack);
		bcsp->rxseq_txack++;
		bcsp->rxseq_txack %= 0x8;
		bcsp->txack_req    = 1;

		/* If needed, transmit an ack pkt */
		hci_uart_tx_wakeup(hu);
	}

	bcsp->rxack = (bcsp->rx_skb->data[0] >> 3) & 0x07;
	BT_DBG("Request for pkt %u from card", bcsp->rxack);

	bcsp_pkt_cull(bcsp);
	if ((bcsp->rx_skb->data[1] & 0x0f) == 6 &&
			bcsp->rx_skb->data[0] & 0x80) {
		bt_cb(bcsp->rx_skb)->pkt_type = HCI_ACLDATA_PKT;
		pass_up = 1;
	} else if ((bcsp->rx_skb->data[1] & 0x0f) == 5 &&
			bcsp->rx_skb->data[0] & 0x80) {
		bt_cb(bcsp->rx_skb)->pkt_type = HCI_EVENT_PKT;
		pass_up = 1;
	} else if ((bcsp->rx_skb->data[1] & 0x0f) == 7) {
		bt_cb(bcsp->rx_skb)->pkt_type = HCI_SCODATA_PKT;
		pass_up = 1;
	} else if ((bcsp->rx_skb->data[1] & 0x0f) == 1 &&
			!(bcsp->rx_skb->data[0] & 0x80)) {
		bcsp_handle_le_pkt(hu);
		pass_up = 0;
	} else
		pass_up = 0;

	if (!pass_up) {
		struct hci_event_hdr hdr;
		u8 desc = (bcsp->rx_skb->data[1] & 0x0f);

		if (desc != 0 && desc != 1) {
			if (hciextn) {
				desc |= 0xc0;
				skb_pull(bcsp->rx_skb, 4);
				memcpy(skb_push(bcsp->rx_skb, 1), &desc, 1);

				hdr.evt = 0xff;
				hdr.plen = bcsp->rx_skb->len;
				memcpy(skb_push(bcsp->rx_skb, HCI_EVENT_HDR_SIZE), &hdr, HCI_EVENT_HDR_SIZE);
				bt_cb(bcsp->rx_skb)->pkt_type = HCI_EVENT_PKT;

				hci_recv_frame(bcsp->rx_skb);
			} else {
				BT_ERR ("Packet for unknown channel (%u %s)",
					bcsp->rx_skb->data[1] & 0x0f,
					bcsp->rx_skb->data[0] & 0x80 ? 
					"reliable" : "unreliable");
				kfree_skb(bcsp->rx_skb);
			}
		} else
			kfree_skb(bcsp->rx_skb);
	} else {
		/* Pull out BCSP hdr */
		skb_pull(bcsp->rx_skb, 4);

		hci_recv_frame(bcsp->rx_skb);
	}
	bcsp->rx_state = BCSP_W4_PKT_DELIMITER;
	bcsp->rx_skb = NULL;
}

/* Recv data */
static int bcsp_recv(struct hci_uart *hu, void *data, int count)
{
	struct bcsp_struct *bcsp = hu->priv;
	register unsigned char *ptr;

	BT_DBG("hu %p count %d rx_state %d rx_count %ld", 
		hu, count, bcsp->rx_state, bcsp->rx_count);

	ptr = data;
	while (count) {
		if (bcsp->rx_count) {
			if (*ptr == 0xc0) {
				BT_ERR("Short BCSP packet");
				kfree_skb(bcsp->rx_skb);
				bcsp->rx_state = BCSP_W4_PKT_START;
				bcsp->rx_count = 0;
			} else
				bcsp_unslip_one_byte(bcsp, *ptr);

			ptr++; count--;
			continue;
		}

		switch (bcsp->rx_state) {
		case BCSP_W4_BCSP_HDR:
			if ((0xff & (u8) ~ (bcsp->rx_skb->data[0] + bcsp->rx_skb->data[1] +
					bcsp->rx_skb->data[2])) != bcsp->rx_skb->data[3]) {
				BT_ERR("Error in BCSP hdr checksum");
				kfree_skb(bcsp->rx_skb);
				bcsp->rx_state = BCSP_W4_PKT_DELIMITER;
				bcsp->rx_count = 0;
				continue;
			}
			if (bcsp->rx_skb->data[0] & 0x80	/* reliable pkt */
			    		&& (bcsp->rx_skb->data[0] & 0x07) != bcsp->rxseq_txack) {
				BT_ERR ("Out-of-order packet arrived, got %u expected %u",
					bcsp->rx_skb->data[0] & 0x07, bcsp->rxseq_txack);

				kfree_skb(bcsp->rx_skb);
				bcsp->rx_state = BCSP_W4_PKT_DELIMITER;
				bcsp->rx_count = 0;
				continue;
			}
			bcsp->rx_state = BCSP_W4_DATA;
			bcsp->rx_count = (bcsp->rx_skb->data[1] >> 4) + 
					(bcsp->rx_skb->data[2] << 4);	/* May be 0 */
			continue;

		case BCSP_W4_DATA:
			if (bcsp->rx_skb->data[0] & 0x40) {	/* pkt with crc */
				bcsp->rx_state = BCSP_W4_CRC;
				bcsp->rx_count = 2;
			} else
				bcsp_complete_rx_pkt(hu);
			continue;

		case BCSP_W4_CRC:
			if (bcsp_crc_reverse(bcsp->message_crc) !=
					(bcsp->rx_skb->data[bcsp->rx_skb->len - 2] << 8) +
					bcsp->rx_skb->data[bcsp->rx_skb->len - 1]) {

				BT_ERR ("Checksum failed: computed %04x received %04x",
					bcsp_crc_reverse(bcsp->message_crc),
				     	(bcsp->rx_skb-> data[bcsp->rx_skb->len - 2] << 8) +
				     	bcsp->rx_skb->data[bcsp->rx_skb->len - 1]);

				kfree_skb(bcsp->rx_skb);
				bcsp->rx_state = BCSP_W4_PKT_DELIMITER;
				bcsp->rx_count = 0;
				continue;
			}
			skb_trim(bcsp->rx_skb, bcsp->rx_skb->len - 2);
			bcsp_complete_rx_pkt(hu);
			continue;

		case BCSP_W4_PKT_DELIMITER:
			switch (*ptr) {
			case 0xc0:
				bcsp->rx_state = BCSP_W4_PKT_START;
				break;
			default:
				/*BT_ERR("Ignoring byte %02x", *ptr);*/
				break;
			}
			ptr++; count--;
			break;

		case BCSP_W4_PKT_START:
			switch (*ptr) {
			case 0xc0:
				ptr++; count--;
				break;

			default:
				bcsp->rx_state = BCSP_W4_BCSP_HDR;
				bcsp->rx_count = 4;
				bcsp->rx_esc_state = BCSP_ESCSTATE_NOESC;
				BCSP_CRC_INIT(bcsp->message_crc);
				
				/* Do not increment ptr or decrement count
				 * Allocate packet. Max len of a BCSP pkt= 
				 * 0xFFF (payload) +4 (header) +2 (crc) */

				bcsp->rx_skb = bt_skb_alloc(0x1005, GFP_ATOMIC);
				if (!bcsp->rx_skb) {
					BT_ERR("Can't allocate mem for new packet");
					bcsp->rx_state = BCSP_W4_PKT_DELIMITER;
					bcsp->rx_count = 0;
					return 0;
				}
				bcsp->rx_skb->dev = (void *) hu->hdev;
				break;
			}
			break;
		}
	}
	return count;
}

	/* Arrange to retransmit all messages in the relq. */
static void bcsp_timed_event(unsigned long arg)
{
	struct hci_uart *hu = (struct hci_uart *) arg;
	struct bcsp_struct *bcsp = hu->priv;
	struct sk_buff *skb;
	unsigned long flags;

	BT_DBG("hu %p retransmitting %u pkts", hu, bcsp->unack.qlen);

	spin_lock_irqsave(&bcsp->unack.lock, flags);

	while ((skb = __skb_dequeue_tail(&bcsp->unack)) != NULL) {
		bcsp->msgq_txseq = (bcsp->msgq_txseq - 1) & 0x07;
		skb_queue_head(&bcsp->rel, skb);
	}

	spin_unlock_irqrestore(&bcsp->unack.lock, flags);

	hci_uart_tx_wakeup(hu);
}

static int bcsp_open(struct hci_uart *hu)
{
	struct bcsp_struct *bcsp;

	BT_DBG("hu %p", hu);

	bcsp = kmalloc(sizeof(*bcsp), GFP_ATOMIC);
	if (!bcsp)
		return -ENOMEM;
	memset(bcsp, 0, sizeof(*bcsp));

	hu->priv = bcsp;
	skb_queue_head_init(&bcsp->unack);
	skb_queue_head_init(&bcsp->rel);
	skb_queue_head_init(&bcsp->unrel);

	init_timer(&bcsp->tbcsp);
	bcsp->tbcsp.function = bcsp_timed_event;
	bcsp->tbcsp.data     = (u_long) hu;

	bcsp->rx_state = BCSP_W4_PKT_DELIMITER;

	if (txcrc)
		bcsp->use_crc = 1;

	return 0;
}

static int bcsp_close(struct hci_uart *hu)
{
	struct bcsp_struct *bcsp = hu->priv;
	hu->priv = NULL;

	BT_DBG("hu %p", hu);

	skb_queue_purge(&bcsp->unack);
	skb_queue_purge(&bcsp->rel);
	skb_queue_purge(&bcsp->unrel);
	del_timer(&bcsp->tbcsp);

	kfree(bcsp);
	return 0;
}

static struct hci_uart_proto bcsp = {
	.id      = HCI_UART_BCSP,
	.open    = bcsp_open,
	.close   = bcsp_close,
	.enqueue = bcsp_enqueue,
	.dequeue = bcsp_dequeue,
	.recv    = bcsp_recv,
	.flush   = bcsp_flush
};

int bcsp_init(void)
{
	int err = hci_uart_register_proto(&bcsp);
	if (!err)
		BT_INFO("HCI BCSP protocol initialized");
	else
		BT_ERR("HCI BCSP protocol registration failed");

	return err;
}

int bcsp_deinit(void)
{
	return hci_uart_unregister_proto(&bcsp);
}

module_param(txcrc, bool, 0644);
MODULE_PARM_DESC(txcrc, "Transmit CRC with every BCSP packet");

module_param(hciextn, bool, 0644);
MODULE_PARM_DESC(hciextn, "Convert HCI Extensions into BCSP packets");
Commit	Line	Data
1da177e4 LT	1	/*
	2	BlueCore Serial Protocol (BCSP) for Linux Bluetooth stack (BlueZ).
	3	Copyright 2002 by Fabrizio Gennari <fabrizio.gennari@philips.com>
	4
	5	Based on
	6	hci_h4.c by Maxim Krasnyansky <maxk@qualcomm.com>
	7	ABCSP by Carl Orsborn <cjo@csr.com>
	8
	9	This program is free software; you can redistribute it and/or modify
	10	it under the terms of the GNU General Public License version 2 as
	11	published by the Free Software Foundation;
	12
	13	THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
	14	OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
	15	FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
	16	IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
	17	CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
	18	WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
	19	ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
	20	OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
	21
	22	ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
	23	COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
	24	SOFTWARE IS DISCLAIMED.
	25	*/
	26
	27	/*
	28	* $Id: hci_bcsp.c,v 1.2 2002/09/26 05:05:14 maxk Exp $
	29	*/
	30
20dd6f59	31	#define VERSION "0.3"
1da177e4 LT	32
	33	#include <linux/config.h>
	34	#include <linux/module.h>
	35
	36	#include <linux/kernel.h>
	37	#include <linux/init.h>
	38	#include <linux/sched.h>
	39	#include <linux/types.h>
	40	#include <linux/fcntl.h>
	41	#include <linux/interrupt.h>
	42	#include <linux/ptrace.h>
	43	#include <linux/poll.h>
	44
	45	#include <linux/slab.h>
	46	#include <linux/tty.h>
	47	#include <linux/errno.h>
	48	#include <linux/string.h>
	49	#include <linux/signal.h>
	50	#include <linux/ioctl.h>
	51	#include <linux/skbuff.h>
	52
	53	#include <net/bluetooth/bluetooth.h>
	54	#include <net/bluetooth/hci_core.h>
	55	#include "hci_uart.h"
	56	#include "hci_bcsp.h"
	57
	58	#ifndef CONFIG_BT_HCIUART_DEBUG
	59	#undef BT_DBG
	60	#define BT_DBG( A... )
1da177e4 LT	61	#endif
1da177e4 LT	62
20dd6f59	63	static int txcrc = 1;
1da177e4 LT	64	static int hciextn = 1;
	65
	66	/* ---- BCSP CRC calculation ---- */
	67
	68	/* Table for calculating CRC for polynomial 0x1021, LSB processed first,
	69	initial value 0xffff, bits shifted in reverse order. */
	70
	71	static const u16 crc_table[] = {
	72	0x0000, 0x1081, 0x2102, 0x3183,
	73	0x4204, 0x5285, 0x6306, 0x7387,
	74	0x8408, 0x9489, 0xa50a, 0xb58b,
	75	0xc60c, 0xd68d, 0xe70e, 0xf78f
	76	};
	77
	78	/* Initialise the crc calculator */
	79	#define BCSP_CRC_INIT(x) x = 0xffff
	80
	81	/*
	82	Update crc with next data byte
	83
	84	Implementation note
	85	The data byte is treated as two nibbles. The crc is generated
	86	in reverse, i.e., bits are fed into the register from the top.
	87	*/
	88	static void bcsp_crc_update(u16 *crc, u8 d)
	89	{
	90	u16 reg = *crc;
	91
	92	reg = (reg >> 4) ^ crc_table[(reg ^ d) & 0x000f];
	93	reg = (reg >> 4) ^ crc_table[(reg ^ (d >> 4)) & 0x000f];
	94
	95	*crc = reg;
	96	}
	97
	98	/*
	99	Get reverse of generated crc
	100
	101	Implementation note
	102	The crc generator (bcsp_crc_init() and bcsp_crc_update())
	103	creates a reversed crc, so it needs to be swapped back before
	104	being passed on.
	105	*/
	106	static u16 bcsp_crc_reverse(u16 crc)
	107	{
	108	u16 b, rev;
	109
	110	for (b = 0, rev = 0; b < 16; b++) {
	111	rev = rev << 1;
	112	rev \|= (crc & 1);
	113	crc = crc >> 1;
	114	}
	115	return (rev);
	116	}
	117
	118	/* ---- BCSP core ---- */
	119
	120	static void bcsp_slip_msgdelim(struct sk_buff *skb)
	121	{
	122	const char pkt_delim = 0xc0;
	123	memcpy(skb_put(skb, 1), &pkt_delim, 1);
	124	}
	125
	126	static void bcsp_slip_one_byte(struct sk_buff *skb, u8 c)
	127	{
128	const char esc_c0[2] = { 0xdb, 0xdc };
129	const char esc_db[2] = { 0xdb, 0xdd };
130
131	switch (c) {
132	case 0xc0:
133	memcpy(skb_put(skb, 2), &esc_c0, 2);
134	break;
135	case 0xdb:
136	memcpy(skb_put(skb, 2), &esc_db, 2);
137	break;
138	default:
139	memcpy(skb_put(skb, 1), &c, 1);
140	}
141	}
142
143	static int bcsp_enqueue(struct hci_uart hu, struct sk_buff skb)
144	{
145	struct bcsp_struct *bcsp = hu->priv;
146
147	if (skb->len > 0xFFF) {
148	BT_ERR("Packet too long");
149	kfree_skb(skb);
150	return 0;
151	}
152
0d48d939	153	switch (bt_cb(skb)->pkt_type) {
1da177e4 LT	154	case HCI_ACLDATA_PKT:
	155	case HCI_COMMAND_PKT:
	156	skb_queue_tail(&bcsp->rel, skb);
	157	break;
	158
	159	case HCI_SCODATA_PKT:
	160	skb_queue_tail(&bcsp->unrel, skb);
	161	break;
	162
	163	default:
	164	BT_ERR("Unknown packet type");
	165	kfree_skb(skb);
	166	break;
	167	}
	168
	169	return 0;
	170	}
	171
	172	static struct sk_buff bcsp_prepare_pkt(struct bcsp_struct bcsp, u8 *data,
	173	int len, int pkt_type)
	174	{
	175	struct sk_buff *nskb;
	176	u8 hdr[4], chan;
1da177e4	177	u16 BCSP_CRC_INIT(bcsp_txmsg_crc);
20dd6f59	178	int rel, i;
1da177e4 LT	179
	180	switch (pkt_type) {
	181	case HCI_ACLDATA_PKT:
	182	chan = 6; /* BCSP ACL channel */
	183	rel = 1; /* reliable channel */
	184	break;
	185	case HCI_COMMAND_PKT:
	186	chan = 5; /* BCSP cmd/evt channel */
	187	rel = 1; /* reliable channel */
	188	break;
	189	case HCI_SCODATA_PKT:
	190	chan = 7; /* BCSP SCO channel */
	191	rel = 0; /* unreliable channel */
	192	break;
	193	case BCSP_LE_PKT:
	194	chan = 1; /* BCSP LE channel */
	195	rel = 0; /* unreliable channel */
	196	break;
	197	case BCSP_ACK_PKT:
	198	chan = 0; /* BCSP internal channel */
	199	rel = 0; /* unreliable channel */
	200	break;
	201	default:
	202	BT_ERR("Unknown packet type");
	203	return NULL;
	204	}
	205
	206	if (hciextn && chan == 5) {
	207	struct hci_command_hdr hdr = (struct hci_command_hdr ) data;
	208
	209	if (hci_opcode_ogf(__le16_to_cpu(hdr->opcode)) == OGF_VENDOR_CMD) {
	210	u8 desc = *(data + HCI_COMMAND_HDR_SIZE);
	211	if ((desc & 0xf0) == 0xc0) {
	212	data += HCI_COMMAND_HDR_SIZE + 1;
	213	len -= HCI_COMMAND_HDR_SIZE + 1;
	214	chan = desc & 0x0f;
	215	}
	216	}
	217	}
	218
	219	/* Max len of packet: (original len +4(bcsp hdr) +2(crc))*2
	220	(because bytes 0xc0 and 0xdb are escaped, worst case is
	221	when the packet is all made of 0xc0 and 0xdb :) )
	222	+ 2 (0xc0 delimiters at start and end). */
	223
	224	nskb = alloc_skb((len + 6) * 2 + 2, GFP_ATOMIC);
	225	if (!nskb)
	226	return NULL;
	227
0d48d939	228	bt_cb(nskb)->pkt_type = pkt_type;
1da177e4 LT	229
	230	bcsp_slip_msgdelim(nskb);
	231
	232	hdr[0] = bcsp->rxseq_txack << 3;
	233	bcsp->txack_req = 0;
	234	BT_DBG("We request packet no %u to card", bcsp->rxseq_txack);
	235
	236	if (rel) {
	237	hdr[0] \|= 0x80 + bcsp->msgq_txseq;
	238	BT_DBG("Sending packet with seqno %u", bcsp->msgq_txseq);
	239	bcsp->msgq_txseq = ++(bcsp->msgq_txseq) & 0x07;
	240	}
20dd6f59 MH	241
	242	if (bcsp->use_crc)
	243	hdr[0] \|= 0x40;
1da177e4 LT	244
	245	hdr[1] = ((len << 4) & 0xff) \| chan;
	246	hdr[2] = len >> 4;
	247	hdr[3] = ~(hdr[0] + hdr[1] + hdr[2]);
	248
	249	/* Put BCSP header */
	250	for (i = 0; i < 4; i++) {
	251	bcsp_slip_one_byte(nskb, hdr[i]);
20dd6f59 MH	252
	253	if (bcsp->use_crc)
	254	bcsp_crc_update(&bcsp_txmsg_crc, hdr[i]);
1da177e4 LT	255	}
	256
	257	/* Put payload */
	258	for (i = 0; i < len; i++) {
	259	bcsp_slip_one_byte(nskb, data[i]);
20dd6f59 MH	260
	261	if (bcsp->use_crc)
	262	bcsp_crc_update(&bcsp_txmsg_crc, data[i]);
1da177e4 LT	263	}
1da177e4 LT	264
1da177e4	265	/* Put CRC */
20dd6f59 MH	266	if (bcsp->use_crc) {
	267	bcsp_txmsg_crc = bcsp_crc_reverse(bcsp_txmsg_crc);
	268	bcsp_slip_one_byte(nskb, (u8) ((bcsp_txmsg_crc >> 8) & 0x00ff));
	269	bcsp_slip_one_byte(nskb, (u8) (bcsp_txmsg_crc & 0x00ff));
	270	}
1da177e4 LT	271
	272	bcsp_slip_msgdelim(nskb);
	273	return nskb;
	274	}
	275
	276	/* This is a rewrite of pkt_avail in ABCSP */
	277	static struct sk_buff bcsp_dequeue(struct hci_uart hu)
	278	{
	279	struct bcsp_struct *bcsp = hu->priv;
	280	unsigned long flags;
	281	struct sk_buff *skb;
	282
	283	/* First of all, check for unreliable messages in the queue,
	284	since they have priority */
	285
	286	if ((skb = skb_dequeue(&bcsp->unrel)) != NULL) {
0d48d939	287	struct sk_buff *nskb = bcsp_prepare_pkt(bcsp, skb->data, skb->len, bt_cb(skb)->pkt_type);
1da177e4 LT	288	if (nskb) {
	289	kfree_skb(skb);
	290	return nskb;
	291	} else {
	292	skb_queue_head(&bcsp->unrel, skb);
	293	BT_ERR("Could not dequeue pkt because alloc_skb failed");
	294	}
	295	}
	296
	297	/* Now, try to send a reliable pkt. We can only send a
	298	reliable packet if the number of packets sent but not yet ack'ed
	299	is < than the winsize */
	300
	301	spin_lock_irqsave(&bcsp->unack.lock, flags);
	302
	303	if (bcsp->unack.qlen < BCSP_TXWINSIZE && (skb = skb_dequeue(&bcsp->rel)) != NULL) {
0d48d939	304	struct sk_buff *nskb = bcsp_prepare_pkt(bcsp, skb->data, skb->len, bt_cb(skb)->pkt_type);
1da177e4 LT	305	if (nskb) {
	306	__skb_queue_tail(&bcsp->unack, skb);
	307	mod_timer(&bcsp->tbcsp, jiffies + HZ / 4);
	308	spin_unlock_irqrestore(&bcsp->unack.lock, flags);
	309	return nskb;
	310	} else {
	311	skb_queue_head(&bcsp->rel, skb);
	312	BT_ERR("Could not dequeue pkt because alloc_skb failed");
	313	}
	314	}
	315
	316	spin_unlock_irqrestore(&bcsp->unack.lock, flags);
	317
	318
	319	/* We could not send a reliable packet, either because there are
	320	none or because there are too many unack'ed pkts. Did we receive
	321	any packets we have not acknowledged yet ? */
	322
	323	if (bcsp->txack_req) {
	324	/* if so, craft an empty ACK pkt and send it on BCSP unreliable
	325	channel 0 */
	326	struct sk_buff *nskb = bcsp_prepare_pkt(bcsp, NULL, 0, BCSP_ACK_PKT);
	327	return nskb;
	328	}
	329
	330	/* We have nothing to send */
	331	return NULL;
	332	}
	333
	334	static int bcsp_flush(struct hci_uart *hu)
	335	{
	336	BT_DBG("hu %p", hu);
	337	return 0;
	338	}
	339
	340	/* Remove ack'ed packets */
	341	static void bcsp_pkt_cull(struct bcsp_struct *bcsp)
	342	{
	343	unsigned long flags;
	344	struct sk_buff *skb;
	345	int i, pkts_to_be_removed;
	346	u8 seqno;
	347
	348	spin_lock_irqsave(&bcsp->unack.lock, flags);
	349
	350	pkts_to_be_removed = bcsp->unack.qlen;
	351	seqno = bcsp->msgq_txseq;
	352
	353	while (pkts_to_be_removed) {
	354	if (bcsp->rxack == seqno)
	355	break;
	356	pkts_to_be_removed--;
	357	seqno = (seqno - 1) & 0x07;
	358	}
	359
	360	if (bcsp->rxack != seqno)
	361	BT_ERR("Peer acked invalid packet");
	362
	363	BT_DBG("Removing %u pkts out of %u, up to seqno %u",
	364	pkts_to_be_removed, bcsp->unack.qlen, (seqno - 1) & 0x07);
	365
	366	for (i = 0, skb = ((struct sk_buff *) &bcsp->unack)->next; i < pkts_to_be_removed
	367	&& skb != (struct sk_buff *) &bcsp->unack; i++) {
	368	struct sk_buff *nskb;
369
370	nskb = skb->next;
371	__skb_unlink(skb, &bcsp->unack);
372	kfree_skb(skb);
373	skb = nskb;
374	}
375	if (bcsp->unack.qlen == 0)
376	del_timer(&bcsp->tbcsp);
377	spin_unlock_irqrestore(&bcsp->unack.lock, flags);
378
379	if (i != pkts_to_be_removed)
380	BT_ERR("Removed only %u out of %u pkts", i, pkts_to_be_removed);
381	}
382
383	/* Handle BCSP link-establishment packets. When we
384	detect a "sync" packet, symptom that the BT module has reset,
385	we do nothing :) (yet) */
386	static void bcsp_handle_le_pkt(struct hci_uart *hu)
387	{
388	struct bcsp_struct *bcsp = hu->priv;
389	u8 conf_pkt[4] = { 0xad, 0xef, 0xac, 0xed };
390	u8 conf_rsp_pkt[4] = { 0xde, 0xad, 0xd0, 0xd0 };
391	u8 sync_pkt[4] = { 0xda, 0xdc, 0xed, 0xed };
392
393	/* spot "conf" pkts and reply with a "conf rsp" pkt */
394	if (bcsp->rx_skb->data[1] >> 4 == 4 && bcsp->rx_skb->data[2] == 0 &&
395	!memcmp(&bcsp->rx_skb->data[4], conf_pkt, 4)) {
396	struct sk_buff *nskb = alloc_skb(4, GFP_ATOMIC);
397
398	BT_DBG("Found a LE conf pkt");
399	if (!nskb)
400	return;
401	memcpy(skb_put(nskb, 4), conf_rsp_pkt, 4);
0d48d939	402	bt_cb(nskb)->pkt_type = BCSP_LE_PKT;
1da177e4 LT	403
	404	skb_queue_head(&bcsp->unrel, nskb);
	405	hci_uart_tx_wakeup(hu);
	406	}
	407	/* Spot "sync" pkts. If we find one...disaster! */
	408	else if (bcsp->rx_skb->data[1] >> 4 == 4 && bcsp->rx_skb->data[2] == 0 &&
	409	!memcmp(&bcsp->rx_skb->data[4], sync_pkt, 4)) {
	410	BT_ERR("Found a LE sync pkt, card has reset");
	411	}
	412	}
	413
	414	static inline void bcsp_unslip_one_byte(struct bcsp_struct *bcsp, unsigned char byte)
	415	{
	416	const u8 c0 = 0xc0, db = 0xdb;
	417
	418	switch (bcsp->rx_esc_state) {
	419	case BCSP_ESCSTATE_NOESC:
	420	switch (byte) {
	421	case 0xdb:
	422	bcsp->rx_esc_state = BCSP_ESCSTATE_ESC;
	423	break;
	424	default:
	425	memcpy(skb_put(bcsp->rx_skb, 1), &byte, 1);
	426	if ((bcsp->rx_skb-> data[0] & 0x40) != 0 &&
	427	bcsp->rx_state != BCSP_W4_CRC)
	428	bcsp_crc_update(&bcsp->message_crc, byte);
	429	bcsp->rx_count--;
	430	}
	431	break;
	432
	433	case BCSP_ESCSTATE_ESC:
	434	switch (byte) {
	435	case 0xdc:
	436	memcpy(skb_put(bcsp->rx_skb, 1), &c0, 1);
	437	if ((bcsp->rx_skb-> data[0] & 0x40) != 0 &&
	438	bcsp->rx_state != BCSP_W4_CRC)
	439	bcsp_crc_update(&bcsp-> message_crc, 0xc0);
	440	bcsp->rx_esc_state = BCSP_ESCSTATE_NOESC;
	441	bcsp->rx_count--;
	442	break;
	443
	444	case 0xdd:
	445	memcpy(skb_put(bcsp->rx_skb, 1), &db, 1);
	446	if ((bcsp->rx_skb-> data[0] & 0x40) != 0 &&
	447	bcsp->rx_state != BCSP_W4_CRC)
	448	bcsp_crc_update(&bcsp-> message_crc, 0xdb);
	449	bcsp->rx_esc_state = BCSP_ESCSTATE_NOESC;
	450	bcsp->rx_count--;
	451	break;
	452
	453	default:
	454	BT_ERR ("Invalid byte %02x after esc byte", byte);
	455	kfree_skb(bcsp->rx_skb);
	456	bcsp->rx_skb = NULL;
	457	bcsp->rx_state = BCSP_W4_PKT_DELIMITER;
	458	bcsp->rx_count = 0;
	459	}
	460	}
	461	}
	462
	463	static inline void bcsp_complete_rx_pkt(struct hci_uart *hu)
	464	{
	465	struct bcsp_struct *bcsp = hu->priv;
	466	int pass_up;
467
468	if (bcsp->rx_skb->data[0] & 0x80) { /* reliable pkt */
469	BT_DBG("Received seqno %u from card", bcsp->rxseq_txack);
470	bcsp->rxseq_txack++;
471	bcsp->rxseq_txack %= 0x8;
472	bcsp->txack_req = 1;
473
474	/* If needed, transmit an ack pkt */
475	hci_uart_tx_wakeup(hu);
476	}
477
478	bcsp->rxack = (bcsp->rx_skb->data[0] >> 3) & 0x07;
479	BT_DBG("Request for pkt %u from card", bcsp->rxack);
480
481	bcsp_pkt_cull(bcsp);
482	if ((bcsp->rx_skb->data[1] & 0x0f) == 6 &&
483	bcsp->rx_skb->data[0] & 0x80) {
0d48d939	484	bt_cb(bcsp->rx_skb)->pkt_type = HCI_ACLDATA_PKT;
1da177e4 LT	485	pass_up = 1;
	486	} else if ((bcsp->rx_skb->data[1] & 0x0f) == 5 &&
	487	bcsp->rx_skb->data[0] & 0x80) {
0d48d939	488	bt_cb(bcsp->rx_skb)->pkt_type = HCI_EVENT_PKT;
1da177e4 LT	489	pass_up = 1;
1da177e4 LT	490	} else if ((bcsp->rx_skb->data[1] & 0x0f) == 7) {
0d48d939	491	bt_cb(bcsp->rx_skb)->pkt_type = HCI_SCODATA_PKT;
1da177e4 LT	492	pass_up = 1;
	493	} else if ((bcsp->rx_skb->data[1] & 0x0f) == 1 &&
	494	!(bcsp->rx_skb->data[0] & 0x80)) {
	495	bcsp_handle_le_pkt(hu);
	496	pass_up = 0;
	497	} else
	498	pass_up = 0;
	499
	500	if (!pass_up) {
	501	struct hci_event_hdr hdr;
	502	u8 desc = (bcsp->rx_skb->data[1] & 0x0f);
	503
	504	if (desc != 0 && desc != 1) {
	505	if (hciextn) {
	506	desc \|= 0xc0;
	507	skb_pull(bcsp->rx_skb, 4);
	508	memcpy(skb_push(bcsp->rx_skb, 1), &desc, 1);
	509
	510	hdr.evt = 0xff;
	511	hdr.plen = bcsp->rx_skb->len;
	512	memcpy(skb_push(bcsp->rx_skb, HCI_EVENT_HDR_SIZE), &hdr, HCI_EVENT_HDR_SIZE);
0d48d939	513	bt_cb(bcsp->rx_skb)->pkt_type = HCI_EVENT_PKT;
1da177e4 LT	514
	515	hci_recv_frame(bcsp->rx_skb);
	516	} else {
	517	BT_ERR ("Packet for unknown channel (%u %s)",
	518	bcsp->rx_skb->data[1] & 0x0f,
	519	bcsp->rx_skb->data[0] & 0x80 ?
	520	"reliable" : "unreliable");
	521	kfree_skb(bcsp->rx_skb);
	522	}
	523	} else
	524	kfree_skb(bcsp->rx_skb);
	525	} else {
	526	/* Pull out BCSP hdr */
	527	skb_pull(bcsp->rx_skb, 4);
	528
	529	hci_recv_frame(bcsp->rx_skb);
	530	}
	531	bcsp->rx_state = BCSP_W4_PKT_DELIMITER;
	532	bcsp->rx_skb = NULL;
	533	}
	534
	535	/* Recv data */
	536	static int bcsp_recv(struct hci_uart hu, void data, int count)
	537	{
	538	struct bcsp_struct *bcsp = hu->priv;
	539	register unsigned char *ptr;
	540
	541	BT_DBG("hu %p count %d rx_state %d rx_count %ld",
	542	hu, count, bcsp->rx_state, bcsp->rx_count);
	543
	544	ptr = data;
	545	while (count) {
	546	if (bcsp->rx_count) {
	547	if (*ptr == 0xc0) {
	548	BT_ERR("Short BCSP packet");
	549	kfree_skb(bcsp->rx_skb);
	550	bcsp->rx_state = BCSP_W4_PKT_START;
	551	bcsp->rx_count = 0;
	552	} else
	553	bcsp_unslip_one_byte(bcsp, *ptr);
	554
	555	ptr++; count--;
	556	continue;
	557	}
	558
	559	switch (bcsp->rx_state) {
	560	case BCSP_W4_BCSP_HDR:
	561	if ((0xff & (u8) ~ (bcsp->rx_skb->data[0] + bcsp->rx_skb->data[1] +
	562	bcsp->rx_skb->data[2])) != bcsp->rx_skb->data[3]) {
	563	BT_ERR("Error in BCSP hdr checksum");
	564	kfree_skb(bcsp->rx_skb);
	565	bcsp->rx_state = BCSP_W4_PKT_DELIMITER;
	566	bcsp->rx_count = 0;
	567	continue;
	568	}
	569	if (bcsp->rx_skb->data[0] & 0x80 /* reliable pkt */
	570	&& (bcsp->rx_skb->data[0] & 0x07) != bcsp->rxseq_txack) {
	571	BT_ERR ("Out-of-order packet arrived, got %u expected %u",
	572	bcsp->rx_skb->data[0] & 0x07, bcsp->rxseq_txack);
	573
	574	kfree_skb(bcsp->rx_skb);
	575	bcsp->rx_state = BCSP_W4_PKT_DELIMITER;
	576	bcsp->rx_count = 0;
	577	continue;
578	}
579	bcsp->rx_state = BCSP_W4_DATA;
580	bcsp->rx_count = (bcsp->rx_skb->data[1] >> 4) +
581	(bcsp->rx_skb->data[2] << 4); /* May be 0 */
582	continue;
583
584	case BCSP_W4_DATA:
585	if (bcsp->rx_skb->data[0] & 0x40) { /* pkt with crc */
586	bcsp->rx_state = BCSP_W4_CRC;
587	bcsp->rx_count = 2;
588	} else
589	bcsp_complete_rx_pkt(hu);
590	continue;
591
592	case BCSP_W4_CRC:
593	if (bcsp_crc_reverse(bcsp->message_crc) !=
594	(bcsp->rx_skb->data[bcsp->rx_skb->len - 2] << 8) +
595	bcsp->rx_skb->data[bcsp->rx_skb->len - 1]) {
596
597	BT_ERR ("Checksum failed: computed %04x received %04x",
598	bcsp_crc_reverse(bcsp->message_crc),
599	(bcsp->rx_skb-> data[bcsp->rx_skb->len - 2] << 8) +
600	bcsp->rx_skb->data[bcsp->rx_skb->len - 1]);
601
602	kfree_skb(bcsp->rx_skb);
603	bcsp->rx_state = BCSP_W4_PKT_DELIMITER;
604	bcsp->rx_count = 0;
605	continue;
606	}
607	skb_trim(bcsp->rx_skb, bcsp->rx_skb->len - 2);
608	bcsp_complete_rx_pkt(hu);
609	continue;
610
611	case BCSP_W4_PKT_DELIMITER:
612	switch (*ptr) {
613	case 0xc0:
614	bcsp->rx_state = BCSP_W4_PKT_START;
615	break;
616	default:
617	/BT_ERR("Ignoring byte %02x", ptr);*/
618	break;
619	}
620	ptr++; count--;
621	break;
622
623	case BCSP_W4_PKT_START:
624	switch (*ptr) {
625	case 0xc0:
626	ptr++; count--;
627	break;
628
629	default:
630	bcsp->rx_state = BCSP_W4_BCSP_HDR;
631	bcsp->rx_count = 4;
632	bcsp->rx_esc_state = BCSP_ESCSTATE_NOESC;
633	BCSP_CRC_INIT(bcsp->message_crc);
634
635	/* Do not increment ptr or decrement count
636	* Allocate packet. Max len of a BCSP pkt=
637	* 0xFFF (payload) +4 (header) +2 (crc) */
638
639	bcsp->rx_skb = bt_skb_alloc(0x1005, GFP_ATOMIC);
640	if (!bcsp->rx_skb) {
641	BT_ERR("Can't allocate mem for new packet");
642	bcsp->rx_state = BCSP_W4_PKT_DELIMITER;
643	bcsp->rx_count = 0;
644	return 0;
645	}
646	bcsp->rx_skb->dev = (void *) hu->hdev;
647	break;
648	}
649	break;
650	}
651	}
652	return count;
653	}
654
655	/* Arrange to retransmit all messages in the relq. */
656	static void bcsp_timed_event(unsigned long arg)
657	{
658	struct hci_uart hu = (struct hci_uart ) arg;
659	struct bcsp_struct *bcsp = hu->priv;
660	struct sk_buff *skb;
661	unsigned long flags;
662
663	BT_DBG("hu %p retransmitting %u pkts", hu, bcsp->unack.qlen);
664
665	spin_lock_irqsave(&bcsp->unack.lock, flags);
666
667	while ((skb = __skb_dequeue_tail(&bcsp->unack)) != NULL) {
668	bcsp->msgq_txseq = (bcsp->msgq_txseq - 1) & 0x07;
669	skb_queue_head(&bcsp->rel, skb);
670	}
671
672	spin_unlock_irqrestore(&bcsp->unack.lock, flags);
673
674	hci_uart_tx_wakeup(hu);
675	}
676
677	static int bcsp_open(struct hci_uart *hu)
678	{
679	struct bcsp_struct *bcsp;
680
681	BT_DBG("hu %p", hu);
682
683	bcsp = kmalloc(sizeof(*bcsp), GFP_ATOMIC);
684	if (!bcsp)
685	return -ENOMEM;
686	memset(bcsp, 0, sizeof(*bcsp));
687
688	hu->priv = bcsp;
689	skb_queue_head_init(&bcsp->unack);
690	skb_queue_head_init(&bcsp->rel);
691	skb_queue_head_init(&bcsp->unrel);
692
693	init_timer(&bcsp->tbcsp);
694	bcsp->tbcsp.function = bcsp_timed_event;
695	bcsp->tbcsp.data = (u_long) hu;
696
697	bcsp->rx_state = BCSP_W4_PKT_DELIMITER;
698
20dd6f59 MH	699	if (txcrc)
	700	bcsp->use_crc = 1;
	701
1da177e4 LT	702	return 0;
	703	}
	704
	705	static int bcsp_close(struct hci_uart *hu)
	706	{
	707	struct bcsp_struct *bcsp = hu->priv;
	708	hu->priv = NULL;
	709
	710	BT_DBG("hu %p", hu);
	711
	712	skb_queue_purge(&bcsp->unack);
	713	skb_queue_purge(&bcsp->rel);
	714	skb_queue_purge(&bcsp->unrel);
	715	del_timer(&bcsp->tbcsp);
	716
	717	kfree(bcsp);
	718	return 0;
	719	}
	720
	721	static struct hci_uart_proto bcsp = {
	722	.id = HCI_UART_BCSP,
	723	.open = bcsp_open,
	724	.close = bcsp_close,
	725	.enqueue = bcsp_enqueue,
	726	.dequeue = bcsp_dequeue,
	727	.recv = bcsp_recv,
	728	.flush = bcsp_flush
	729	};
	730
	731	int bcsp_init(void)
	732	{
	733	int err = hci_uart_register_proto(&bcsp);
	734	if (!err)
	735	BT_INFO("HCI BCSP protocol initialized");
	736	else
	737	BT_ERR("HCI BCSP protocol registration failed");
	738
	739	return err;
	740	}
	741
	742	int bcsp_deinit(void)
	743	{
	744	return hci_uart_unregister_proto(&bcsp);
	745	}
	746
20dd6f59 MH	747	module_param(txcrc, bool, 0644);
	748	MODULE_PARM_DESC(txcrc, "Transmit CRC with every BCSP packet");
	749
1da177e4 LT	750	module_param(hciextn, bool, 0644);
1da177e4 LT	751	MODULE_PARM_DESC(hciextn, "Convert HCI Extensions into BCSP packets");