[mirror_ubuntu-bionic-kernel.git] / drivers / bluetooth / hci_h5.c

/*
 *
 *  Bluetooth HCI Three-wire UART driver
 *
 *  Copyright (C) 2012  Intel Corporation
 *
 *
 *  This program is free software; you can redistribute it and/or modify
 *  it under the terms of the GNU General Public License as published by
 *  the Free Software Foundation; either version 2 of the License, or
 *  (at your option) any later version.
 *
 *  This program is distributed in the hope that it will be useful,
 *  but WITHOUT ANY WARRANTY; without even the implied warranty of
 *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 *  GNU General Public License for more details.
 *
 *  You should have received a copy of the GNU General Public License
 *  along with this program; if not, write to the Free Software
 *  Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
 *
 */

#include <linux/kernel.h>
#include <linux/errno.h>
#include <linux/skbuff.h>

#include <net/bluetooth/bluetooth.h>
#include <net/bluetooth/hci_core.h>

#include "hci_uart.h"

#define HCI_3WIRE_ACK_PKT	0
#define HCI_3WIRE_LINK_PKT	15

/* Sliding window size */
#define H5_TX_WIN_MAX		4

#define H5_ACK_TIMEOUT	msecs_to_jiffies(250)
#define H5_SYNC_TIMEOUT	msecs_to_jiffies(100)

/*
 * Maximum Three-wire packet:
 *     4 byte header + max value for 12-bit length + 2 bytes for CRC
 */
#define H5_MAX_LEN (4 + 0xfff + 2)

/* Convenience macros for reading Three-wire header values */
#define H5_HDR_SEQ(hdr)		((hdr)[0] & 0x07)
#define H5_HDR_ACK(hdr)		(((hdr)[0] >> 3) & 0x07)
#define H5_HDR_CRC(hdr)		(((hdr)[0] >> 6) & 0x01)
#define H5_HDR_RELIABLE(hdr)	(((hdr)[0] >> 7) & 0x01)
#define H5_HDR_PKT_TYPE(hdr)	((hdr)[1] & 0x0f)
#define H5_HDR_LEN(hdr)		((((hdr)[1] >> 4) & 0x0f) + ((hdr)[2] << 4))

#define SLIP_DELIMITER	0xc0
#define SLIP_ESC	0xdb
#define SLIP_ESC_DELIM	0xdc
#define SLIP_ESC_ESC	0xdd

/* H5 state flags */
enum {
	H5_RX_ESC,	/* SLIP escape mode */
	H5_TX_ACK_REQ,	/* Pending ack to send */
};

struct h5 {
	struct sk_buff_head	unack;		/* Unack'ed packets queue */
	struct sk_buff_head	rel;		/* Reliable packets queue */
	struct sk_buff_head	unrel;		/* Unreliable packets queue */

	unsigned long		flags;

	struct sk_buff		*rx_skb;	/* Receive buffer */
	size_t			rx_pending;	/* Expecting more bytes */
	u8			rx_ack;		/* Last ack number received */

	int			(*rx_func)(struct hci_uart *hu, u8 c);

	struct timer_list	timer;		/* Retransmission timer */
	struct hci_uart		*hu;		/* Parent HCI UART */

	u8			tx_seq;		/* Next seq number to send */
	u8			tx_ack;		/* Next ack number to send */
	u8			tx_win;		/* Sliding window size */

	enum {
		H5_UNINITIALIZED,
		H5_INITIALIZED,
		H5_ACTIVE,
	} state;

	enum {
		H5_AWAKE,
		H5_SLEEPING,
		H5_WAKING_UP,
	} sleep;
};

static void h5_reset_rx(struct h5 *h5);

static void h5_link_control(struct hci_uart *hu, const void *data, size_t len)
{
	struct h5 *h5 = hu->priv;
	struct sk_buff *nskb;

	nskb = alloc_skb(3, GFP_ATOMIC);
	if (!nskb)
		return;

	hci_skb_pkt_type(nskb) = HCI_3WIRE_LINK_PKT;

	skb_put_data(nskb, data, len);

	skb_queue_tail(&h5->unrel, nskb);
}

static u8 h5_cfg_field(struct h5 *h5)
{
	/* Sliding window size (first 3 bits) */
	return h5->tx_win & 0x07;
}

static void h5_timed_event(struct timer_list *t)
{
	const unsigned char sync_req[] = { 0x01, 0x7e };
	unsigned char conf_req[3] = { 0x03, 0xfc };
	struct h5 *h5 = from_timer(h5, t, timer);
	struct hci_uart *hu = h5->hu;
	struct sk_buff *skb;
	unsigned long flags;

	BT_DBG("%s", hu->hdev->name);

	if (h5->state == H5_UNINITIALIZED)
		h5_link_control(hu, sync_req, sizeof(sync_req));

	if (h5->state == H5_INITIALIZED) {
		conf_req[2] = h5_cfg_field(h5);
		h5_link_control(hu, conf_req, sizeof(conf_req));
	}

	if (h5->state != H5_ACTIVE) {
		mod_timer(&h5->timer, jiffies + H5_SYNC_TIMEOUT);
		goto wakeup;
	}

	if (h5->sleep != H5_AWAKE) {
		h5->sleep = H5_SLEEPING;
		goto wakeup;
	}

	BT_DBG("hu %p retransmitting %u pkts", hu, h5->unack.qlen);

	spin_lock_irqsave_nested(&h5->unack.lock, flags, SINGLE_DEPTH_NESTING);

	while ((skb = __skb_dequeue_tail(&h5->unack)) != NULL) {
		h5->tx_seq = (h5->tx_seq - 1) & 0x07;
		skb_queue_head(&h5->rel, skb);
	}

	spin_unlock_irqrestore(&h5->unack.lock, flags);

wakeup:
	hci_uart_tx_wakeup(hu);
}

static void h5_peer_reset(struct hci_uart *hu)
{
	struct h5 *h5 = hu->priv;

	BT_ERR("Peer device has reset");

	h5->state = H5_UNINITIALIZED;

	del_timer(&h5->timer);

	skb_queue_purge(&h5->rel);
	skb_queue_purge(&h5->unrel);
	skb_queue_purge(&h5->unack);

	h5->tx_seq = 0;
	h5->tx_ack = 0;

	/* Send reset request to upper stack */
	hci_reset_dev(hu->hdev);
}

static int h5_open(struct hci_uart *hu)
{
	struct h5 *h5;
	const unsigned char sync[] = { 0x01, 0x7e };

	BT_DBG("hu %p", hu);

	h5 = kzalloc(sizeof(*h5), GFP_KERNEL);
	if (!h5)
		return -ENOMEM;

	hu->priv = h5;
	h5->hu = hu;

	skb_queue_head_init(&h5->unack);
	skb_queue_head_init(&h5->rel);
	skb_queue_head_init(&h5->unrel);

	h5_reset_rx(h5);

	timer_setup(&h5->timer, h5_timed_event, 0);

	h5->tx_win = H5_TX_WIN_MAX;

	set_bit(HCI_UART_INIT_PENDING, &hu->hdev_flags);

	/* Send initial sync request */
	h5_link_control(hu, sync, sizeof(sync));
	mod_timer(&h5->timer, jiffies + H5_SYNC_TIMEOUT);

	return 0;
}

static int h5_close(struct hci_uart *hu)
{
	struct h5 *h5 = hu->priv;

	del_timer_sync(&h5->timer);

	skb_queue_purge(&h5->unack);
	skb_queue_purge(&h5->rel);
	skb_queue_purge(&h5->unrel);

	kfree(h5);

	return 0;
}

static void h5_pkt_cull(struct h5 *h5)
{
	struct sk_buff *skb, *tmp;
	unsigned long flags;
	int i, to_remove;
	u8 seq;

	spin_lock_irqsave(&h5->unack.lock, flags);

	to_remove = skb_queue_len(&h5->unack);
	if (to_remove == 0)
		goto unlock;

	seq = h5->tx_seq;

	while (to_remove > 0) {
		if (h5->rx_ack == seq)
			break;

		to_remove--;
		seq = (seq - 1) & 0x07;
	}

	if (seq != h5->rx_ack)
		BT_ERR("Controller acked invalid packet");

	i = 0;
	skb_queue_walk_safe(&h5->unack, skb, tmp) {
		if (i++ >= to_remove)
			break;

		__skb_unlink(skb, &h5->unack);
		kfree_skb(skb);
	}

	if (skb_queue_empty(&h5->unack))
		del_timer(&h5->timer);

unlock:
	spin_unlock_irqrestore(&h5->unack.lock, flags);
}

static void h5_handle_internal_rx(struct hci_uart *hu)
{
	struct h5 *h5 = hu->priv;
	const unsigned char sync_req[] = { 0x01, 0x7e };
	const unsigned char sync_rsp[] = { 0x02, 0x7d };
	unsigned char conf_req[3] = { 0x03, 0xfc };
	const unsigned char conf_rsp[] = { 0x04, 0x7b };
	const unsigned char wakeup_req[] = { 0x05, 0xfa };
	const unsigned char woken_req[] = { 0x06, 0xf9 };
	const unsigned char sleep_req[] = { 0x07, 0x78 };
	const unsigned char *hdr = h5->rx_skb->data;
	const unsigned char *data = &h5->rx_skb->data[4];

	BT_DBG("%s", hu->hdev->name);

	if (H5_HDR_PKT_TYPE(hdr) != HCI_3WIRE_LINK_PKT)
		return;

	if (H5_HDR_LEN(hdr) < 2)
		return;

	conf_req[2] = h5_cfg_field(h5);

	if (memcmp(data, sync_req, 2) == 0) {
		if (h5->state == H5_ACTIVE)
			h5_peer_reset(hu);
		h5_link_control(hu, sync_rsp, 2);
	} else if (memcmp(data, sync_rsp, 2) == 0) {
		if (h5->state == H5_ACTIVE)
			h5_peer_reset(hu);
		h5->state = H5_INITIALIZED;
		h5_link_control(hu, conf_req, 3);
	} else if (memcmp(data, conf_req, 2) == 0) {
		h5_link_control(hu, conf_rsp, 2);
		h5_link_control(hu, conf_req, 3);
	} else if (memcmp(data, conf_rsp, 2) == 0) {
		if (H5_HDR_LEN(hdr) > 2)
			h5->tx_win = (data[2] & 0x07);
		BT_DBG("Three-wire init complete. tx_win %u", h5->tx_win);
		h5->state = H5_ACTIVE;
		hci_uart_init_ready(hu);
		return;
	} else if (memcmp(data, sleep_req, 2) == 0) {
		BT_DBG("Peer went to sleep");
		h5->sleep = H5_SLEEPING;
		return;
	} else if (memcmp(data, woken_req, 2) == 0) {
		BT_DBG("Peer woke up");
		h5->sleep = H5_AWAKE;
	} else if (memcmp(data, wakeup_req, 2) == 0) {
		BT_DBG("Peer requested wakeup");
		h5_link_control(hu, woken_req, 2);
		h5->sleep = H5_AWAKE;
	} else {
		BT_DBG("Link Control: 0x%02hhx 0x%02hhx", data[0], data[1]);
		return;
	}

	hci_uart_tx_wakeup(hu);
}

static void h5_complete_rx_pkt(struct hci_uart *hu)
{
	struct h5 *h5 = hu->priv;
	const unsigned char *hdr = h5->rx_skb->data;

	if (H5_HDR_RELIABLE(hdr)) {
		h5->tx_ack = (h5->tx_ack + 1) % 8;
		set_bit(H5_TX_ACK_REQ, &h5->flags);
		hci_uart_tx_wakeup(hu);
	}

	h5->rx_ack = H5_HDR_ACK(hdr);

	h5_pkt_cull(h5);

	switch (H5_HDR_PKT_TYPE(hdr)) {
	case HCI_EVENT_PKT:
	case HCI_ACLDATA_PKT:
	case HCI_SCODATA_PKT:
		hci_skb_pkt_type(h5->rx_skb) = H5_HDR_PKT_TYPE(hdr);

		/* Remove Three-wire header */
		skb_pull(h5->rx_skb, 4);

		hci_recv_frame(hu->hdev, h5->rx_skb);
		h5->rx_skb = NULL;

		break;

	default:
		h5_handle_internal_rx(hu);
		break;
	}

	h5_reset_rx(h5);
}

static int h5_rx_crc(struct hci_uart *hu, unsigned char c)
{
	h5_complete_rx_pkt(hu);

	return 0;
}

static int h5_rx_payload(struct hci_uart *hu, unsigned char c)
{
	struct h5 *h5 = hu->priv;
	const unsigned char *hdr = h5->rx_skb->data;

	if (H5_HDR_CRC(hdr)) {
		h5->rx_func = h5_rx_crc;
		h5->rx_pending = 2;
	} else {
		h5_complete_rx_pkt(hu);
	}

	return 0;
}

static int h5_rx_3wire_hdr(struct hci_uart *hu, unsigned char c)
{
	struct h5 *h5 = hu->priv;
	const unsigned char *hdr = h5->rx_skb->data;

	BT_DBG("%s rx: seq %u ack %u crc %u rel %u type %u len %u",
	       hu->hdev->name, H5_HDR_SEQ(hdr), H5_HDR_ACK(hdr),
	       H5_HDR_CRC(hdr), H5_HDR_RELIABLE(hdr), H5_HDR_PKT_TYPE(hdr),
	       H5_HDR_LEN(hdr));

	if (((hdr[0] + hdr[1] + hdr[2] + hdr[3]) & 0xff) != 0xff) {
		BT_ERR("Invalid header checksum");
		h5_reset_rx(h5);
		return 0;
	}

	if (H5_HDR_RELIABLE(hdr) && H5_HDR_SEQ(hdr) != h5->tx_ack) {
		BT_ERR("Out-of-order packet arrived (%u != %u)",
		       H5_HDR_SEQ(hdr), h5->tx_ack);
		h5_reset_rx(h5);
		return 0;
	}

	if (h5->state != H5_ACTIVE &&
	    H5_HDR_PKT_TYPE(hdr) != HCI_3WIRE_LINK_PKT) {
		BT_ERR("Non-link packet received in non-active state");
		h5_reset_rx(h5);
		return 0;
	}

	h5->rx_func = h5_rx_payload;
	h5->rx_pending = H5_HDR_LEN(hdr);

	return 0;
}

static int h5_rx_pkt_start(struct hci_uart *hu, unsigned char c)
{
	struct h5 *h5 = hu->priv;

	if (c == SLIP_DELIMITER)
		return 1;

	h5->rx_func = h5_rx_3wire_hdr;
	h5->rx_pending = 4;

	h5->rx_skb = bt_skb_alloc(H5_MAX_LEN, GFP_ATOMIC);
	if (!h5->rx_skb) {
		BT_ERR("Can't allocate mem for new packet");
		h5_reset_rx(h5);
		return -ENOMEM;
	}

	h5->rx_skb->dev = (void *)hu->hdev;

	return 0;
}

static int h5_rx_delimiter(struct hci_uart *hu, unsigned char c)
{
	struct h5 *h5 = hu->priv;

	if (c == SLIP_DELIMITER)
		h5->rx_func = h5_rx_pkt_start;

	return 1;
}

static void h5_unslip_one_byte(struct h5 *h5, unsigned char c)
{
	const u8 delim = SLIP_DELIMITER, esc = SLIP_ESC;
	const u8 *byte = &c;

	if (!test_bit(H5_RX_ESC, &h5->flags) && c == SLIP_ESC) {
		set_bit(H5_RX_ESC, &h5->flags);
		return;
	}

	if (test_and_clear_bit(H5_RX_ESC, &h5->flags)) {
		switch (c) {
		case SLIP_ESC_DELIM:
			byte = &delim;
			break;
		case SLIP_ESC_ESC:
			byte = &esc;
			break;
		default:
			BT_ERR("Invalid esc byte 0x%02hhx", c);
			h5_reset_rx(h5);
			return;
		}
	}

	skb_put_data(h5->rx_skb, byte, 1);
	h5->rx_pending--;

	BT_DBG("unsliped 0x%02hhx, rx_pending %zu", *byte, h5->rx_pending);
}

static void h5_reset_rx(struct h5 *h5)
{
	if (h5->rx_skb) {
		kfree_skb(h5->rx_skb);
		h5->rx_skb = NULL;
	}

	h5->rx_func = h5_rx_delimiter;
	h5->rx_pending = 0;
	clear_bit(H5_RX_ESC, &h5->flags);
}

static int h5_recv(struct hci_uart *hu, const void *data, int count)
{
	struct h5 *h5 = hu->priv;
	const unsigned char *ptr = data;

	BT_DBG("%s pending %zu count %d", hu->hdev->name, h5->rx_pending,
	       count);

	while (count > 0) {
		int processed;

		if (h5->rx_pending > 0) {
			if (*ptr == SLIP_DELIMITER) {
				BT_ERR("Too short H5 packet");
				h5_reset_rx(h5);
				continue;
			}

			h5_unslip_one_byte(h5, *ptr);

			ptr++; count--;
			continue;
		}

		processed = h5->rx_func(hu, *ptr);
		if (processed < 0)
			return processed;

		ptr += processed;
		count -= processed;
	}

	return 0;
}

static int h5_enqueue(struct hci_uart *hu, struct sk_buff *skb)
{
	struct h5 *h5 = hu->priv;

	if (skb->len > 0xfff) {
		BT_ERR("Packet too long (%u bytes)", skb->len);
		kfree_skb(skb);
		return 0;
	}

	if (h5->state != H5_ACTIVE) {
		BT_ERR("Ignoring HCI data in non-active state");
		kfree_skb(skb);
		return 0;
	}

	switch (hci_skb_pkt_type(skb)) {
	case HCI_ACLDATA_PKT:
	case HCI_COMMAND_PKT:
		skb_queue_tail(&h5->rel, skb);
		break;

	case HCI_SCODATA_PKT:
		skb_queue_tail(&h5->unrel, skb);
		break;

	default:
		BT_ERR("Unknown packet type %u", hci_skb_pkt_type(skb));
		kfree_skb(skb);
		break;
	}

	return 0;
}

static void h5_slip_delim(struct sk_buff *skb)
{
	const char delim = SLIP_DELIMITER;

	skb_put_data(skb, &delim, 1);
}

static void h5_slip_one_byte(struct sk_buff *skb, u8 c)
{
	const char esc_delim[2] = { SLIP_ESC, SLIP_ESC_DELIM };
	const char esc_esc[2] = { SLIP_ESC, SLIP_ESC_ESC };

	switch (c) {
	case SLIP_DELIMITER:
		skb_put_data(skb, &esc_delim, 2);
		break;
	case SLIP_ESC:
		skb_put_data(skb, &esc_esc, 2);
		break;
	default:
		skb_put_data(skb, &c, 1);
	}
}

static bool valid_packet_type(u8 type)
{
	switch (type) {
	case HCI_ACLDATA_PKT:
	case HCI_COMMAND_PKT:
	case HCI_SCODATA_PKT:
	case HCI_3WIRE_LINK_PKT:
	case HCI_3WIRE_ACK_PKT:
		return true;
	default:
		return false;
	}
}

static struct sk_buff *h5_prepare_pkt(struct hci_uart *hu, u8 pkt_type,
				      const u8 *data, size_t len)
{
	struct h5 *h5 = hu->priv;
	struct sk_buff *nskb;
	u8 hdr[4];
	int i;

	if (!valid_packet_type(pkt_type)) {
		BT_ERR("Unknown packet type %u", pkt_type);
		return NULL;
	}

	/*
	 * Max len of packet: (original len + 4 (H5 hdr) + 2 (crc)) * 2
	 * (because bytes 0xc0 and 0xdb are escaped, worst case is when
	 * the packet is all made of 0xc0 and 0xdb) + 2 (0xc0
	 * delimiters at start and end).
	 */
	nskb = alloc_skb((len + 6) * 2 + 2, GFP_ATOMIC);
	if (!nskb)
		return NULL;

	hci_skb_pkt_type(nskb) = pkt_type;

	h5_slip_delim(nskb);

	hdr[0] = h5->tx_ack << 3;
	clear_bit(H5_TX_ACK_REQ, &h5->flags);

	/* Reliable packet? */
	if (pkt_type == HCI_ACLDATA_PKT || pkt_type == HCI_COMMAND_PKT) {
		hdr[0] |= 1 << 7;
		hdr[0] |= h5->tx_seq;
		h5->tx_seq = (h5->tx_seq + 1) % 8;
	}

	hdr[1] = pkt_type | ((len & 0x0f) << 4);
	hdr[2] = len >> 4;
	hdr[3] = ~((hdr[0] + hdr[1] + hdr[2]) & 0xff);

	BT_DBG("%s tx: seq %u ack %u crc %u rel %u type %u len %u",
	       hu->hdev->name, H5_HDR_SEQ(hdr), H5_HDR_ACK(hdr),
	       H5_HDR_CRC(hdr), H5_HDR_RELIABLE(hdr), H5_HDR_PKT_TYPE(hdr),
	       H5_HDR_LEN(hdr));

	for (i = 0; i < 4; i++)
		h5_slip_one_byte(nskb, hdr[i]);

	for (i = 0; i < len; i++)
		h5_slip_one_byte(nskb, data[i]);

	h5_slip_delim(nskb);

	return nskb;
}

static struct sk_buff *h5_dequeue(struct hci_uart *hu)
{
	struct h5 *h5 = hu->priv;
	unsigned long flags;
	struct sk_buff *skb, *nskb;

	if (h5->sleep != H5_AWAKE) {
		const unsigned char wakeup_req[] = { 0x05, 0xfa };

		if (h5->sleep == H5_WAKING_UP)
			return NULL;

		h5->sleep = H5_WAKING_UP;
		BT_DBG("Sending wakeup request");

		mod_timer(&h5->timer, jiffies + HZ / 100);
		return h5_prepare_pkt(hu, HCI_3WIRE_LINK_PKT, wakeup_req, 2);
	}

	skb = skb_dequeue(&h5->unrel);
	if (skb) {
		nskb = h5_prepare_pkt(hu, hci_skb_pkt_type(skb),
				      skb->data, skb->len);
		if (nskb) {
			kfree_skb(skb);
			return nskb;
		}

		skb_queue_head(&h5->unrel, skb);
		BT_ERR("Could not dequeue pkt because alloc_skb failed");
	}

	spin_lock_irqsave_nested(&h5->unack.lock, flags, SINGLE_DEPTH_NESTING);

	if (h5->unack.qlen >= h5->tx_win)
		goto unlock;

	skb = skb_dequeue(&h5->rel);
	if (skb) {
		nskb = h5_prepare_pkt(hu, hci_skb_pkt_type(skb),
				      skb->data, skb->len);
		if (nskb) {
			__skb_queue_tail(&h5->unack, skb);
			mod_timer(&h5->timer, jiffies + H5_ACK_TIMEOUT);
			spin_unlock_irqrestore(&h5->unack.lock, flags);
			return nskb;
		}

		skb_queue_head(&h5->rel, skb);
		BT_ERR("Could not dequeue pkt because alloc_skb failed");
	}

unlock:
	spin_unlock_irqrestore(&h5->unack.lock, flags);

	if (test_bit(H5_TX_ACK_REQ, &h5->flags))
		return h5_prepare_pkt(hu, HCI_3WIRE_ACK_PKT, NULL, 0);

	return NULL;
}

static int h5_flush(struct hci_uart *hu)
{
	BT_DBG("hu %p", hu);
	return 0;
}

static const struct hci_uart_proto h5p = {
	.id		= HCI_UART_3WIRE,
	.name		= "Three-wire (H5)",
	.open		= h5_open,
	.close		= h5_close,
	.recv		= h5_recv,
	.enqueue	= h5_enqueue,
	.dequeue	= h5_dequeue,
	.flush		= h5_flush,
};

int __init h5_init(void)
{
	return hci_uart_register_proto(&h5p);
}

int __exit h5_deinit(void)
{
	return hci_uart_unregister_proto(&h5p);
}
Commit	Line	Data
7dec65c8 JH	1	/*
	2	*
	3	* Bluetooth HCI Three-wire UART driver
	4	*
	5	* Copyright (C) 2012 Intel Corporation
	6	*
	7	*
	8	* This program is free software; you can redistribute it and/or modify
	9	* it under the terms of the GNU General Public License as published by
	10	* the Free Software Foundation; either version 2 of the License, or
	11	* (at your option) any later version.
	12	*
	13	* This program is distributed in the hope that it will be useful,
	14	* but WITHOUT ANY WARRANTY; without even the implied warranty of
	15	* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
	16	* GNU General Public License for more details.
	17	*
	18	* You should have received a copy of the GNU General Public License
	19	* along with this program; if not, write to the Free Software
	20	* Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
	21	*
	22	*/
	23
	24	#include <linux/kernel.h>
	25	#include <linux/errno.h>
	26	#include <linux/skbuff.h>
	27
	28	#include <net/bluetooth/bluetooth.h>
	29	#include <net/bluetooth/hci_core.h>
	30
	31	#include "hci_uart.h"
	32
c0a1b73c JH	33	#define HCI_3WIRE_ACK_PKT 0
	34	#define HCI_3WIRE_LINK_PKT 15
	35
afdc944c JH	36	/* Sliding window size */
afdc944c JH	37	#define H5_TX_WIN_MAX 4
3f27e95b JH	38
3f27e95b JH	39	#define H5_ACK_TIMEOUT msecs_to_jiffies(250)
40f10224	40	#define H5_SYNC_TIMEOUT msecs_to_jiffies(100)
3f27e95b	41
bc1f35b9 JH	42	/*
	43	* Maximum Three-wire packet:
	44	* 4 byte header + max value for 12-bit length + 2 bytes for CRC
	45	*/
	46	#define H5_MAX_LEN (4 + 0xfff + 2)
	47
01977c0b JH	48	/* Convenience macros for reading Three-wire header values */
	49	#define H5_HDR_SEQ(hdr) ((hdr)[0] & 0x07)
	50	#define H5_HDR_ACK(hdr) (((hdr)[0] >> 3) & 0x07)
	51	#define H5_HDR_CRC(hdr) (((hdr)[0] >> 6) & 0x01)
	52	#define H5_HDR_RELIABLE(hdr) (((hdr)[0] >> 7) & 0x01)
	53	#define H5_HDR_PKT_TYPE(hdr) ((hdr)[1] & 0x0f)
4223f368	54	#define H5_HDR_LEN(hdr) ((((hdr)[1] >> 4) & 0x0f) + ((hdr)[2] << 4))
01977c0b	55
bc1f35b9 JH	56	#define SLIP_DELIMITER 0xc0
	57	#define SLIP_ESC 0xdb
	58	#define SLIP_ESC_DELIM 0xdc
	59	#define SLIP_ESC_ESC 0xdd
	60
e0482103 JH	61	/* H5 state flags */
	62	enum {
	63	H5_RX_ESC, /* SLIP escape mode */
	64	H5_TX_ACK_REQ, /* Pending ack to send */
	65	};
	66
7d664fba	67	struct h5 {
bc1f35b9 JH	68	struct sk_buff_head unack; /* Unack'ed packets queue */
	69	struct sk_buff_head rel; /* Reliable packets queue */
	70	struct sk_buff_head unrel; /* Unreliable packets queue */
	71
e0482103 JH	72	unsigned long flags;
e0482103 JH	73
bc1f35b9 JH	74	struct sk_buff rx_skb; / Receive buffer */
bc1f35b9 JH	75	size_t rx_pending; /* Expecting more bytes */
43eb12d7	76	u8 rx_ack; /* Last ack number received */
7d664fba	77
fa4cf04e	78	int (rx_func)(struct hci_uart hu, u8 c);
7d664fba	79
bc1f35b9	80	struct timer_list timer; /* Retransmission timer */
04356052	81	struct hci_uart hu; / Parent HCI UART */
3f27e95b	82
43eb12d7	83	u8 tx_seq; /* Next seq number to send */
40f10224	84	u8 tx_ack; /* Next ack number to send */
afdc944c	85	u8 tx_win; /* Sliding window size */
10122d07	86
f674a057 JH	87	enum {
	88	H5_UNINITIALIZED,
	89	H5_INITIALIZED,
	90	H5_ACTIVE,
	91	} state;
	92
95c5c220 JH	93	enum {
	94	H5_AWAKE,
	95	H5_SLEEPING,
	96	H5_WAKING_UP,
	97	} sleep;
7d664fba JH	98	};
7d664fba JH	99
bc1f35b9 JH	100	static void h5_reset_rx(struct h5 *h5);
bc1f35b9 JH	101
f674a057 JH	102	static void h5_link_control(struct hci_uart hu, const void data, size_t len)
	103	{
	104	struct h5 *h5 = hu->priv;
	105	struct sk_buff *nskb;
	106
	107	nskb = alloc_skb(3, GFP_ATOMIC);
	108	if (!nskb)
	109	return;
	110
618e8bc2	111	hci_skb_pkt_type(nskb) = HCI_3WIRE_LINK_PKT;
f674a057	112
59ae1d12	113	skb_put_data(nskb, data, len);
f674a057 JH	114
	115	skb_queue_tail(&h5->unrel, nskb);
	116	}
	117
afdc944c JH	118	static u8 h5_cfg_field(struct h5 *h5)
afdc944c JH	119	{
afdc944c	120	/* Sliding window size (first 3 bits) */
742c5951	121	return h5->tx_win & 0x07;
afdc944c JH	122	}
afdc944c JH	123
04356052	124	static void h5_timed_event(struct timer_list *t)
3f27e95b	125	{
f674a057	126	const unsigned char sync_req[] = { 0x01, 0x7e };
87a6b9bd	127	unsigned char conf_req[3] = { 0x03, 0xfc };
04356052 KC	128	struct h5 *h5 = from_timer(h5, t, timer);
04356052 KC	129	struct hci_uart *hu = h5->hu;
3f27e95b JH	130	struct sk_buff *skb;
	131	unsigned long flags;
	132
95c5c220 JH	133	BT_DBG("%s", hu->hdev->name);
95c5c220 JH	134
f674a057 JH	135	if (h5->state == H5_UNINITIALIZED)
	136	h5_link_control(hu, sync_req, sizeof(sync_req));
	137
afdc944c JH	138	if (h5->state == H5_INITIALIZED) {
afdc944c JH	139	conf_req[2] = h5_cfg_field(h5);
f674a057	140	h5_link_control(hu, conf_req, sizeof(conf_req));
afdc944c	141	}
f674a057 JH	142
	143	if (h5->state != H5_ACTIVE) {
	144	mod_timer(&h5->timer, jiffies + H5_SYNC_TIMEOUT);
	145	goto wakeup;
	146	}
	147
95c5c220 JH	148	if (h5->sleep != H5_AWAKE) {
	149	h5->sleep = H5_SLEEPING;
	150	goto wakeup;
	151	}
	152
3f27e95b JH	153	BT_DBG("hu %p retransmitting %u pkts", hu, h5->unack.qlen);
	154
	155	spin_lock_irqsave_nested(&h5->unack.lock, flags, SINGLE_DEPTH_NESTING);
	156
	157	while ((skb = __skb_dequeue_tail(&h5->unack)) != NULL) {
43eb12d7	158	h5->tx_seq = (h5->tx_seq - 1) & 0x07;
3f27e95b JH	159	skb_queue_head(&h5->rel, skb);
	160	}
	161
	162	spin_unlock_irqrestore(&h5->unack.lock, flags);
	163
f674a057	164	wakeup:
3f27e95b JH	165	hci_uart_tx_wakeup(hu);
	166	}
	167
b509c02d LP	168	static void h5_peer_reset(struct hci_uart *hu)
	169	{
	170	struct h5 *h5 = hu->priv;
b509c02d LP	171
	172	BT_ERR("Peer device has reset");
	173
	174	h5->state = H5_UNINITIALIZED;
	175
	176	del_timer(&h5->timer);
	177
	178	skb_queue_purge(&h5->rel);
	179	skb_queue_purge(&h5->unrel);
	180	skb_queue_purge(&h5->unack);
	181
	182	h5->tx_seq = 0;
	183	h5->tx_ack = 0;
	184
882809fb MH	185	/* Send reset request to upper stack */
882809fb MH	186	hci_reset_dev(hu->hdev);
b509c02d LP	187	}
b509c02d LP	188
7dec65c8 JH	189	static int h5_open(struct hci_uart *hu)
7dec65c8 JH	190	{
7d664fba	191	struct h5 *h5;
40f10224	192	const unsigned char sync[] = { 0x01, 0x7e };
7d664fba JH	193
	194	BT_DBG("hu %p", hu);
	195
	196	h5 = kzalloc(sizeof(*h5), GFP_KERNEL);
	197	if (!h5)
	198	return -ENOMEM;
	199
	200	hu->priv = h5;
04356052	201	h5->hu = hu;
7d664fba JH	202
	203	skb_queue_head_init(&h5->unack);
	204	skb_queue_head_init(&h5->rel);
	205	skb_queue_head_init(&h5->unrel);
	206
bc1f35b9 JH	207	h5_reset_rx(h5);
bc1f35b9 JH	208
04356052	209	timer_setup(&h5->timer, h5_timed_event, 0);
3f27e95b	210
afdc944c JH	211	h5->tx_win = H5_TX_WIN_MAX;
afdc944c JH	212
cd1b4425 JH	213	set_bit(HCI_UART_INIT_PENDING, &hu->hdev_flags);
cd1b4425 JH	214
40f10224 JH	215	/* Send initial sync request */
	216	h5_link_control(hu, sync, sizeof(sync));
	217	mod_timer(&h5->timer, jiffies + H5_SYNC_TIMEOUT);
	218
7d664fba	219	return 0;
7dec65c8 JH	220	}
	221
	222	static int h5_close(struct hci_uart *hu)
	223	{
7d664fba JH	224	struct h5 *h5 = hu->priv;
7d664fba JH	225
c327cddd MK	226	del_timer_sync(&h5->timer);
c327cddd MK	227
7d664fba JH	228	skb_queue_purge(&h5->unack);
	229	skb_queue_purge(&h5->rel);
	230	skb_queue_purge(&h5->unrel);
	231
	232	kfree(h5);
	233
	234	return 0;
7dec65c8 JH	235	}
7dec65c8 JH	236
43eb12d7 JH	237	static void h5_pkt_cull(struct h5 *h5)
	238	{
	239	struct sk_buff skb, tmp;
	240	unsigned long flags;
	241	int i, to_remove;
	242	u8 seq;
	243
	244	spin_lock_irqsave(&h5->unack.lock, flags);
	245
	246	to_remove = skb_queue_len(&h5->unack);
40f10224 JH	247	if (to_remove == 0)
40f10224 JH	248	goto unlock;
43eb12d7 JH	249
	250	seq = h5->tx_seq;
	251
	252	while (to_remove > 0) {
	253	if (h5->rx_ack == seq)
	254	break;
	255
	256	to_remove--;
4807b518	257	seq = (seq - 1) & 0x07;
43eb12d7 JH	258	}
	259
	260	if (seq != h5->rx_ack)
	261	BT_ERR("Controller acked invalid packet");
	262
	263	i = 0;
	264	skb_queue_walk_safe(&h5->unack, skb, tmp) {
	265	if (i++ >= to_remove)
	266	break;
	267
	268	__skb_unlink(skb, &h5->unack);
	269	kfree_skb(skb);
	270	}
	271
	272	if (skb_queue_empty(&h5->unack))
	273	del_timer(&h5->timer);
	274
40f10224	275	unlock:
43eb12d7 JH	276	spin_unlock_irqrestore(&h5->unack.lock, flags);
	277	}
	278
bc1f35b9 JH	279	static void h5_handle_internal_rx(struct hci_uart *hu)
bc1f35b9 JH	280	{
40f10224 JH	281	struct h5 *h5 = hu->priv;
	282	const unsigned char sync_req[] = { 0x01, 0x7e };
	283	const unsigned char sync_rsp[] = { 0x02, 0x7d };
87a6b9bd	284	unsigned char conf_req[3] = { 0x03, 0xfc };
afdc944c	285	const unsigned char conf_rsp[] = { 0x04, 0x7b };
10122d07 JH	286	const unsigned char wakeup_req[] = { 0x05, 0xfa };
	287	const unsigned char woken_req[] = { 0x06, 0xf9 };
	288	const unsigned char sleep_req[] = { 0x07, 0x78 };
40f10224 JH	289	const unsigned char *hdr = h5->rx_skb->data;
	290	const unsigned char *data = &h5->rx_skb->data[4];
	291
bc1f35b9	292	BT_DBG("%s", hu->hdev->name);
40f10224 JH	293
	294	if (H5_HDR_PKT_TYPE(hdr) != HCI_3WIRE_LINK_PKT)
	295	return;
	296
	297	if (H5_HDR_LEN(hdr) < 2)
	298	return;
	299
afdc944c JH	300	conf_req[2] = h5_cfg_field(h5);
afdc944c JH	301
40f10224	302	if (memcmp(data, sync_req, 2) == 0) {
b509c02d LP	303	if (h5->state == H5_ACTIVE)
b509c02d LP	304	h5_peer_reset(hu);
40f10224 JH	305	h5_link_control(hu, sync_rsp, 2);
40f10224 JH	306	} else if (memcmp(data, sync_rsp, 2) == 0) {
b509c02d LP	307	if (h5->state == H5_ACTIVE)
b509c02d LP	308	h5_peer_reset(hu);
f674a057	309	h5->state = H5_INITIALIZED;
40f10224 JH	310	h5_link_control(hu, conf_req, 3);
	311	} else if (memcmp(data, conf_req, 2) == 0) {
	312	h5_link_control(hu, conf_rsp, 2);
	313	h5_link_control(hu, conf_req, 3);
	314	} else if (memcmp(data, conf_rsp, 2) == 0) {
afdc944c	315	if (H5_HDR_LEN(hdr) > 2)
1d3a1e69	316	h5->tx_win = (data[2] & 0x07);
afdc944c	317	BT_DBG("Three-wire init complete. tx_win %u", h5->tx_win);
f674a057	318	h5->state = H5_ACTIVE;
cd1b4425	319	hci_uart_init_ready(hu);
40f10224	320	return;
10122d07 JH	321	} else if (memcmp(data, sleep_req, 2) == 0) {
10122d07 JH	322	BT_DBG("Peer went to sleep");
95c5c220 JH	323	h5->sleep = H5_SLEEPING;
95c5c220 JH	324	return;
10122d07 JH	325	} else if (memcmp(data, woken_req, 2) == 0) {
10122d07 JH	326	BT_DBG("Peer woke up");
95c5c220 JH	327	h5->sleep = H5_AWAKE;
	328	} else if (memcmp(data, wakeup_req, 2) == 0) {
	329	BT_DBG("Peer requested wakeup");
	330	h5_link_control(hu, woken_req, 2);
	331	h5->sleep = H5_AWAKE;
40f10224 JH	332	} else {
	333	BT_DBG("Link Control: 0x%02hhx 0x%02hhx", data[0], data[1]);
	334	return;
	335	}
	336
	337	hci_uart_tx_wakeup(hu);
bc1f35b9 JH	338	}
	339
	340	static void h5_complete_rx_pkt(struct hci_uart *hu)
	341	{
	342	struct h5 *h5 = hu->priv;
43eb12d7	343	const unsigned char *hdr = h5->rx_skb->data;
bc1f35b9	344
43eb12d7	345	if (H5_HDR_RELIABLE(hdr)) {
40f10224	346	h5->tx_ack = (h5->tx_ack + 1) % 8;
e0482103	347	set_bit(H5_TX_ACK_REQ, &h5->flags);
40f10224	348	hci_uart_tx_wakeup(hu);
43eb12d7	349	}
bc1f35b9	350
43eb12d7 JH	351	h5->rx_ack = H5_HDR_ACK(hdr);
	352
	353	h5_pkt_cull(h5);
	354
	355	switch (H5_HDR_PKT_TYPE(hdr)) {
bc1f35b9 JH	356	case HCI_EVENT_PKT:
	357	case HCI_ACLDATA_PKT:
	358	case HCI_SCODATA_PKT:
618e8bc2	359	hci_skb_pkt_type(h5->rx_skb) = H5_HDR_PKT_TYPE(hdr);
bc1f35b9 JH	360
	361	/* Remove Three-wire header */
	362	skb_pull(h5->rx_skb, 4);
	363
e1a26170	364	hci_recv_frame(hu->hdev, h5->rx_skb);
bc1f35b9 JH	365	h5->rx_skb = NULL;
	366
	367	break;
	368
	369	default:
	370	h5_handle_internal_rx(hu);
	371	break;
	372	}
	373
	374	h5_reset_rx(h5);
	375	}
	376
	377	static int h5_rx_crc(struct hci_uart *hu, unsigned char c)
	378	{
bc1f35b9	379	h5_complete_rx_pkt(hu);
bc1f35b9 JH	380
	381	return 0;
	382	}
	383
	384	static int h5_rx_payload(struct hci_uart *hu, unsigned char c)
	385	{
	386	struct h5 *h5 = hu->priv;
	387	const unsigned char *hdr = h5->rx_skb->data;
	388
43eb12d7	389	if (H5_HDR_CRC(hdr)) {
bc1f35b9 JH	390	h5->rx_func = h5_rx_crc;
	391	h5->rx_pending = 2;
	392	} else {
	393	h5_complete_rx_pkt(hu);
bc1f35b9 JH	394	}
	395
	396	return 0;
	397	}
	398
	399	static int h5_rx_3wire_hdr(struct hci_uart *hu, unsigned char c)
	400	{
	401	struct h5 *h5 = hu->priv;
	402	const unsigned char *hdr = h5->rx_skb->data;
	403
40f10224 JH	404	BT_DBG("%s rx: seq %u ack %u crc %u rel %u type %u len %u",
	405	hu->hdev->name, H5_HDR_SEQ(hdr), H5_HDR_ACK(hdr),
	406	H5_HDR_CRC(hdr), H5_HDR_RELIABLE(hdr), H5_HDR_PKT_TYPE(hdr),
	407	H5_HDR_LEN(hdr));
	408
bc1f35b9 JH	409	if (((hdr[0] + hdr[1] + hdr[2] + hdr[3]) & 0xff) != 0xff) {
	410	BT_ERR("Invalid header checksum");
	411	h5_reset_rx(h5);
	412	return 0;
	413	}
	414
40f10224	415	if (H5_HDR_RELIABLE(hdr) && H5_HDR_SEQ(hdr) != h5->tx_ack) {
43eb12d7	416	BT_ERR("Out-of-order packet arrived (%u != %u)",
40f10224	417	H5_HDR_SEQ(hdr), h5->tx_ack);
43eb12d7 JH	418	h5_reset_rx(h5);
	419	return 0;
	420	}
	421
f674a057 JH	422	if (h5->state != H5_ACTIVE &&
	423	H5_HDR_PKT_TYPE(hdr) != HCI_3WIRE_LINK_PKT) {
	424	BT_ERR("Non-link packet received in non-active state");
	425	h5_reset_rx(h5);
48439d50	426	return 0;
f674a057 JH	427	}
f674a057 JH	428
bc1f35b9	429	h5->rx_func = h5_rx_payload;
43eb12d7	430	h5->rx_pending = H5_HDR_LEN(hdr);
bc1f35b9 JH	431
	432	return 0;
	433	}
	434
	435	static int h5_rx_pkt_start(struct hci_uart *hu, unsigned char c)
	436	{
	437	struct h5 *h5 = hu->priv;
	438
bc1f35b9 JH	439	if (c == SLIP_DELIMITER)
	440	return 1;
	441
	442	h5->rx_func = h5_rx_3wire_hdr;
	443	h5->rx_pending = 4;
	444
	445	h5->rx_skb = bt_skb_alloc(H5_MAX_LEN, GFP_ATOMIC);
	446	if (!h5->rx_skb) {
	447	BT_ERR("Can't allocate mem for new packet");
	448	h5_reset_rx(h5);
	449	return -ENOMEM;
	450	}
	451
4a2fa2b8	452	h5->rx_skb->dev = (void *)hu->hdev;
bc1f35b9 JH	453
	454	return 0;
	455	}
	456
	457	static int h5_rx_delimiter(struct hci_uart *hu, unsigned char c)
	458	{
	459	struct h5 *h5 = hu->priv;
	460
bc1f35b9 JH	461	if (c == SLIP_DELIMITER)
	462	h5->rx_func = h5_rx_pkt_start;
	463
	464	return 1;
	465	}
	466
	467	static void h5_unslip_one_byte(struct h5 *h5, unsigned char c)
	468	{
	469	const u8 delim = SLIP_DELIMITER, esc = SLIP_ESC;
	470	const u8 *byte = &c;
	471
e0482103 JH	472	if (!test_bit(H5_RX_ESC, &h5->flags) && c == SLIP_ESC) {
e0482103 JH	473	set_bit(H5_RX_ESC, &h5->flags);
bc1f35b9 JH	474	return;
	475	}
	476
e0482103	477	if (test_and_clear_bit(H5_RX_ESC, &h5->flags)) {
bc1f35b9 JH	478	switch (c) {
	479	case SLIP_ESC_DELIM:
	480	byte = &delim;
	481	break;
	482	case SLIP_ESC_ESC:
	483	byte = &esc;
	484	break;
	485	default:
	486	BT_ERR("Invalid esc byte 0x%02hhx", c);
	487	h5_reset_rx(h5);
	488	return;
	489	}
bc1f35b9 JH	490	}
bc1f35b9 JH	491
59ae1d12	492	skb_put_data(h5->rx_skb, byte, 1);
bc1f35b9 JH	493	h5->rx_pending--;
bc1f35b9 JH	494
255a68e0	495	BT_DBG("unsliped 0x%02hhx, rx_pending %zu", *byte, h5->rx_pending);
bc1f35b9 JH	496	}
	497
	498	static void h5_reset_rx(struct h5 *h5)
	499	{
	500	if (h5->rx_skb) {
	501	kfree_skb(h5->rx_skb);
	502	h5->rx_skb = NULL;
	503	}
	504
	505	h5->rx_func = h5_rx_delimiter;
	506	h5->rx_pending = 0;
e0482103	507	clear_bit(H5_RX_ESC, &h5->flags);
bc1f35b9 JH	508	}
bc1f35b9 JH	509
9d1c40eb	510	static int h5_recv(struct hci_uart hu, const void data, int count)
7dec65c8	511	{
bc1f35b9	512	struct h5 *h5 = hu->priv;
9d1c40eb	513	const unsigned char *ptr = data;
bc1f35b9	514
255a68e0 JH	515	BT_DBG("%s pending %zu count %d", hu->hdev->name, h5->rx_pending,
255a68e0 JH	516	count);
bc1f35b9 JH	517
	518	while (count > 0) {
	519	int processed;
	520
	521	if (h5->rx_pending > 0) {
	522	if (*ptr == SLIP_DELIMITER) {
	523	BT_ERR("Too short H5 packet");
	524	h5_reset_rx(h5);
	525	continue;
	526	}
	527
	528	h5_unslip_one_byte(h5, *ptr);
	529
	530	ptr++; count--;
	531	continue;
	532	}
	533
	534	processed = h5->rx_func(hu, *ptr);
	535	if (processed < 0)
	536	return processed;
	537
	538	ptr += processed;
	539	count -= processed;
	540	}
	541
	542	return 0;
7dec65c8 JH	543	}
	544
	545	static int h5_enqueue(struct hci_uart hu, struct sk_buff skb)
	546	{
7d664fba JH	547	struct h5 *h5 = hu->priv;
	548
	549	if (skb->len > 0xfff) {
	550	BT_ERR("Packet too long (%u bytes)", skb->len);
	551	kfree_skb(skb);
	552	return 0;
	553	}
	554
f674a057 JH	555	if (h5->state != H5_ACTIVE) {
	556	BT_ERR("Ignoring HCI data in non-active state");
	557	kfree_skb(skb);
	558	return 0;
	559	}
	560
618e8bc2	561	switch (hci_skb_pkt_type(skb)) {
7d664fba JH	562	case HCI_ACLDATA_PKT:
	563	case HCI_COMMAND_PKT:
	564	skb_queue_tail(&h5->rel, skb);
	565	break;
	566
	567	case HCI_SCODATA_PKT:
	568	skb_queue_tail(&h5->unrel, skb);
	569	break;
	570
	571	default:
618e8bc2	572	BT_ERR("Unknown packet type %u", hci_skb_pkt_type(skb));
7d664fba JH	573	kfree_skb(skb);
	574	break;
	575	}
	576
	577	return 0;
	578	}
	579
c0a1b73c JH	580	static void h5_slip_delim(struct sk_buff *skb)
	581	{
	582	const char delim = SLIP_DELIMITER;
	583
59ae1d12	584	skb_put_data(skb, &delim, 1);
c0a1b73c JH	585	}
	586
	587	static void h5_slip_one_byte(struct sk_buff *skb, u8 c)
	588	{
	589	const char esc_delim[2] = { SLIP_ESC, SLIP_ESC_DELIM };
	590	const char esc_esc[2] = { SLIP_ESC, SLIP_ESC_ESC };
	591
	592	switch (c) {
	593	case SLIP_DELIMITER:
59ae1d12	594	skb_put_data(skb, &esc_delim, 2);
c0a1b73c JH	595	break;
c0a1b73c JH	596	case SLIP_ESC:
59ae1d12	597	skb_put_data(skb, &esc_esc, 2);
c0a1b73c JH	598	break;
c0a1b73c JH	599	default:
59ae1d12	600	skb_put_data(skb, &c, 1);
c0a1b73c JH	601	}
	602	}
	603
c826ed09 JH	604	static bool valid_packet_type(u8 type)
	605	{
	606	switch (type) {
	607	case HCI_ACLDATA_PKT:
	608	case HCI_COMMAND_PKT:
	609	case HCI_SCODATA_PKT:
	610	case HCI_3WIRE_LINK_PKT:
	611	case HCI_3WIRE_ACK_PKT:
	612	return true;
	613	default:
	614	return false;
	615	}
	616	}
	617
	618	static struct sk_buff h5_prepare_pkt(struct hci_uart hu, u8 pkt_type,
	619	const u8 *data, size_t len)
7d664fba	620	{
40f10224	621	struct h5 *h5 = hu->priv;
c0a1b73c JH	622	struct sk_buff *nskb;
	623	u8 hdr[4];
	624	int i;
	625
c826ed09 JH	626	if (!valid_packet_type(pkt_type)) {
	627	BT_ERR("Unknown packet type %u", pkt_type);
	628	return NULL;
	629	}
	630
c0a1b73c JH	631	/*
	632	* Max len of packet: (original len + 4 (H5 hdr) + 2 (crc)) * 2
	633	* (because bytes 0xc0 and 0xdb are escaped, worst case is when
	634	* the packet is all made of 0xc0 and 0xdb) + 2 (0xc0
	635	* delimiters at start and end).
	636	*/
	637	nskb = alloc_skb((len + 6) * 2 + 2, GFP_ATOMIC);
	638	if (!nskb)
	639	return NULL;
	640
618e8bc2	641	hci_skb_pkt_type(nskb) = pkt_type;
c0a1b73c JH	642
	643	h5_slip_delim(nskb);
	644
40f10224	645	hdr[0] = h5->tx_ack << 3;
e0482103	646	clear_bit(H5_TX_ACK_REQ, &h5->flags);
c0a1b73c	647
c826ed09 JH	648	/* Reliable packet? */
c826ed09 JH	649	if (pkt_type == HCI_ACLDATA_PKT \|\| pkt_type == HCI_COMMAND_PKT) {
c0a1b73c	650	hdr[0] \|= 1 << 7;
43eb12d7 JH	651	hdr[0] \|= h5->tx_seq;
43eb12d7 JH	652	h5->tx_seq = (h5->tx_seq + 1) % 8;
c0a1b73c JH	653	}
	654
	655	hdr[1] = pkt_type \| ((len & 0x0f) << 4);
	656	hdr[2] = len >> 4;
	657	hdr[3] = ~((hdr[0] + hdr[1] + hdr[2]) & 0xff);
	658
40f10224 JH	659	BT_DBG("%s tx: seq %u ack %u crc %u rel %u type %u len %u",
	660	hu->hdev->name, H5_HDR_SEQ(hdr), H5_HDR_ACK(hdr),
	661	H5_HDR_CRC(hdr), H5_HDR_RELIABLE(hdr), H5_HDR_PKT_TYPE(hdr),
	662	H5_HDR_LEN(hdr));
	663
c0a1b73c JH	664	for (i = 0; i < 4; i++)
	665	h5_slip_one_byte(nskb, hdr[i]);
	666
	667	for (i = 0; i < len; i++)
	668	h5_slip_one_byte(nskb, data[i]);
	669
	670	h5_slip_delim(nskb);
	671
	672	return nskb;
	673	}
	674
7dec65c8 JH	675	static struct sk_buff h5_dequeue(struct hci_uart hu)
7dec65c8 JH	676	{
7d664fba	677	struct h5 *h5 = hu->priv;
3f27e95b	678	unsigned long flags;
7d664fba JH	679	struct sk_buff skb, nskb;
7d664fba JH	680
95c5c220 JH	681	if (h5->sleep != H5_AWAKE) {
	682	const unsigned char wakeup_req[] = { 0x05, 0xfa };
	683
	684	if (h5->sleep == H5_WAKING_UP)
	685	return NULL;
	686
	687	h5->sleep = H5_WAKING_UP;
	688	BT_DBG("Sending wakeup request");
	689
	690	mod_timer(&h5->timer, jiffies + HZ / 100);
	691	return h5_prepare_pkt(hu, HCI_3WIRE_LINK_PKT, wakeup_req, 2);
	692	}
	693
a08b15e6	694	skb = skb_dequeue(&h5->unrel);
4a2fa2b8	695	if (skb) {
618e8bc2	696	nskb = h5_prepare_pkt(hu, hci_skb_pkt_type(skb),
c0a1b73c	697	skb->data, skb->len);
7d664fba JH	698	if (nskb) {
	699	kfree_skb(skb);
	700	return nskb;
	701	}
	702
	703	skb_queue_head(&h5->unrel, skb);
	704	BT_ERR("Could not dequeue pkt because alloc_skb failed");
	705	}
	706
3f27e95b JH	707	spin_lock_irqsave_nested(&h5->unack.lock, flags, SINGLE_DEPTH_NESTING);
3f27e95b JH	708
afdc944c	709	if (h5->unack.qlen >= h5->tx_win)
3f27e95b JH	710	goto unlock;
3f27e95b JH	711
a08b15e6	712	skb = skb_dequeue(&h5->rel);
4a2fa2b8	713	if (skb) {
618e8bc2	714	nskb = h5_prepare_pkt(hu, hci_skb_pkt_type(skb),
c0a1b73c	715	skb->data, skb->len);
3f27e95b JH	716	if (nskb) {
	717	__skb_queue_tail(&h5->unack, skb);
	718	mod_timer(&h5->timer, jiffies + H5_ACK_TIMEOUT);
	719	spin_unlock_irqrestore(&h5->unack.lock, flags);
	720	return nskb;
	721	}
	722
	723	skb_queue_head(&h5->rel, skb);
	724	BT_ERR("Could not dequeue pkt because alloc_skb failed");
	725	}
	726
	727	unlock:
	728	spin_unlock_irqrestore(&h5->unack.lock, flags);
	729
e0482103	730	if (test_bit(H5_TX_ACK_REQ, &h5->flags))
40f10224	731	return h5_prepare_pkt(hu, HCI_3WIRE_ACK_PKT, NULL, 0);
7d664fba	732
7dec65c8 JH	733	return NULL;
	734	}
	735
	736	static int h5_flush(struct hci_uart *hu)
	737	{
7d664fba JH	738	BT_DBG("hu %p", hu);
7d664fba JH	739	return 0;
7dec65c8 JH	740	}
7dec65c8 JH	741
4ee7ef19	742	static const struct hci_uart_proto h5p = {
7dec65c8	743	.id = HCI_UART_3WIRE,
7c40fb8d	744	.name = "Three-wire (H5)",
7dec65c8 JH	745	.open = h5_open,
	746	.close = h5_close,
	747	.recv = h5_recv,
	748	.enqueue = h5_enqueue,
	749	.dequeue = h5_dequeue,
	750	.flush = h5_flush,
	751	};
	752
	753	int __init h5_init(void)
	754	{
01009eec	755	return hci_uart_register_proto(&h5p);
7dec65c8 JH	756	}
	757
	758	int __exit h5_deinit(void)
	759	{
	760	return hci_uart_unregister_proto(&h5p);
	761	}