1 /* 2 BlueZ - Bluetooth protocol stack for Linux 3 Copyright (C) 2000-2001 Qualcomm Incorporated 4 5 Written 2000,2001 by Maxim Krasnyansky <maxk@qualcomm.com> 6 7 This program is free software; you can redistribute it and/or modify 8 it under the terms of the GNU General Public License version 2 as 9 published by the Free Software Foundation; 10 11 THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS 12 OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, 13 FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS. 14 IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY 15 CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES 16 WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN 17 ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF 18 OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. 19 20 ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS, 21 COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS 22 SOFTWARE IS DISCLAIMED. 23 */ 24 25 /* Bluetooth HCI core. */ 26 27 #include <linux/jiffies.h> 28 #include <linux/module.h> 29 #include <linux/kmod.h> 30 31 #include <linux/types.h> 32 #include <linux/errno.h> 33 #include <linux/kernel.h> 34 #include <linux/sched.h> 35 #include <linux/slab.h> 36 #include <linux/poll.h> 37 #include <linux/fcntl.h> 38 #include <linux/init.h> 39 #include <linux/skbuff.h> 40 #include <linux/interrupt.h> 41 #include <linux/notifier.h> 42 #include <net/sock.h> 43 44 #include <asm/system.h> 45 #include <asm/uaccess.h> 46 #include <asm/unaligned.h> 47 48 #include <net/bluetooth/bluetooth.h> 49 #include <net/bluetooth/hci_core.h> 50 51 #ifndef CONFIG_BT_HCI_CORE_DEBUG 52 #undef BT_DBG 53 #define BT_DBG(D...) 54 #endif 55 56 static void hci_cmd_task(unsigned long arg); 57 static void hci_rx_task(unsigned long arg); 58 static void hci_tx_task(unsigned long arg); 59 static void hci_notify(struct hci_dev *hdev, int event); 60 61 static DEFINE_RWLOCK(hci_task_lock); 62 63 /* HCI device list */ 64 LIST_HEAD(hci_dev_list); 65 DEFINE_RWLOCK(hci_dev_list_lock); 66 67 /* HCI callback list */ 68 LIST_HEAD(hci_cb_list); 69 DEFINE_RWLOCK(hci_cb_list_lock); 70 71 /* HCI protocols */ 72 #define HCI_MAX_PROTO 2 73 struct hci_proto *hci_proto[HCI_MAX_PROTO]; 74 75 /* HCI notifiers list */ 76 static ATOMIC_NOTIFIER_HEAD(hci_notifier); 77 78 /* ---- HCI notifications ---- */ 79 80 int hci_register_notifier(struct notifier_block *nb) 81 { 82 return atomic_notifier_chain_register(&hci_notifier, nb); 83 } 84 85 int hci_unregister_notifier(struct notifier_block *nb) 86 { 87 return atomic_notifier_chain_unregister(&hci_notifier, nb); 88 } 89 90 static void hci_notify(struct hci_dev *hdev, int event) 91 { 92 atomic_notifier_call_chain(&hci_notifier, event, hdev); 93 } 94 95 /* ---- HCI requests ---- */ 96 97 void hci_req_complete(struct hci_dev *hdev, int result) 98 { 99 BT_DBG("%s result 0x%2.2x", hdev->name, result); 100 101 if (hdev->req_status == HCI_REQ_PEND) { 102 hdev->req_result = result; 103 hdev->req_status = HCI_REQ_DONE; 104 wake_up_interruptible(&hdev->req_wait_q); 105 } 106 } 107 108 static void hci_req_cancel(struct hci_dev *hdev, int err) 109 { 110 BT_DBG("%s err 0x%2.2x", hdev->name, err); 111 112 if (hdev->req_status == HCI_REQ_PEND) { 113 hdev->req_result = err; 114 hdev->req_status = HCI_REQ_CANCELED; 115 wake_up_interruptible(&hdev->req_wait_q); 116 } 117 } 118 119 /* Execute request and wait for completion. */ 120 static int __hci_request(struct hci_dev *hdev, void (*req)(struct hci_dev *hdev, unsigned long opt), 121 unsigned long opt, __u32 timeout) 122 { 123 DECLARE_WAITQUEUE(wait, current); 124 int err = 0; 125 126 BT_DBG("%s start", hdev->name); 127 128 hdev->req_status = HCI_REQ_PEND; 129 130 add_wait_queue(&hdev->req_wait_q, &wait); 131 set_current_state(TASK_INTERRUPTIBLE); 132 133 req(hdev, opt); 134 schedule_timeout(timeout); 135 136 remove_wait_queue(&hdev->req_wait_q, &wait); 137 138 if (signal_pending(current)) 139 return -EINTR; 140 141 switch (hdev->req_status) { 142 case HCI_REQ_DONE: 143 err = -bt_err(hdev->req_result); 144 break; 145 146 case HCI_REQ_CANCELED: 147 err = -hdev->req_result; 148 break; 149 150 default: 151 err = -ETIMEDOUT; 152 break; 153 } 154 155 hdev->req_status = hdev->req_result = 0; 156 157 BT_DBG("%s end: err %d", hdev->name, err); 158 159 return err; 160 } 161 162 static inline int hci_request(struct hci_dev *hdev, void (*req)(struct hci_dev *hdev, unsigned long opt), 163 unsigned long opt, __u32 timeout) 164 { 165 int ret; 166 167 if (!test_bit(HCI_UP, &hdev->flags)) 168 return -ENETDOWN; 169 170 /* Serialize all requests */ 171 hci_req_lock(hdev); 172 ret = __hci_request(hdev, req, opt, timeout); 173 hci_req_unlock(hdev); 174 175 return ret; 176 } 177 178 static void hci_reset_req(struct hci_dev *hdev, unsigned long opt) 179 { 180 BT_DBG("%s %ld", hdev->name, opt); 181 182 /* Reset device */ 183 hci_send_cmd(hdev, HCI_OP_RESET, 0, NULL); 184 } 185 186 static void hci_init_req(struct hci_dev *hdev, unsigned long opt) 187 { 188 struct sk_buff *skb; 189 __le16 param; 190 __u8 flt_type; 191 192 BT_DBG("%s %ld", hdev->name, opt); 193 194 /* Driver initialization */ 195 196 /* Special commands */ 197 while ((skb = skb_dequeue(&hdev->driver_init))) { 198 bt_cb(skb)->pkt_type = HCI_COMMAND_PKT; 199 skb->dev = (void *) hdev; 200 skb_queue_tail(&hdev->cmd_q, skb); 201 hci_sched_cmd(hdev); 202 } 203 skb_queue_purge(&hdev->driver_init); 204 205 /* Mandatory initialization */ 206 207 /* Reset */ 208 if (test_bit(HCI_QUIRK_RESET_ON_INIT, &hdev->quirks)) 209 hci_send_cmd(hdev, HCI_OP_RESET, 0, NULL); 210 211 /* Read Local Supported Features */ 212 hci_send_cmd(hdev, HCI_OP_READ_LOCAL_FEATURES, 0, NULL); 213 214 /* Read Local Version */ 215 hci_send_cmd(hdev, HCI_OP_READ_LOCAL_VERSION, 0, NULL); 216 217 /* Read Buffer Size (ACL mtu, max pkt, etc.) */ 218 hci_send_cmd(hdev, HCI_OP_READ_BUFFER_SIZE, 0, NULL); 219 220 #if 0 221 /* Host buffer size */ 222 { 223 struct hci_cp_host_buffer_size cp; 224 cp.acl_mtu = cpu_to_le16(HCI_MAX_ACL_SIZE); 225 cp.sco_mtu = HCI_MAX_SCO_SIZE; 226 cp.acl_max_pkt = cpu_to_le16(0xffff); 227 cp.sco_max_pkt = cpu_to_le16(0xffff); 228 hci_send_cmd(hdev, HCI_OP_HOST_BUFFER_SIZE, sizeof(cp), &cp); 229 } 230 #endif 231 232 /* Read BD Address */ 233 hci_send_cmd(hdev, HCI_OP_READ_BD_ADDR, 0, NULL); 234 235 /* Read Class of Device */ 236 hci_send_cmd(hdev, HCI_OP_READ_CLASS_OF_DEV, 0, NULL); 237 238 /* Read Local Name */ 239 hci_send_cmd(hdev, HCI_OP_READ_LOCAL_NAME, 0, NULL); 240 241 /* Read Voice Setting */ 242 hci_send_cmd(hdev, HCI_OP_READ_VOICE_SETTING, 0, NULL); 243 244 /* Optional initialization */ 245 246 /* Clear Event Filters */ 247 flt_type = HCI_FLT_CLEAR_ALL; 248 hci_send_cmd(hdev, HCI_OP_SET_EVENT_FLT, 1, &flt_type); 249 250 /* Page timeout ~20 secs */ 251 param = cpu_to_le16(0x8000); 252 hci_send_cmd(hdev, HCI_OP_WRITE_PG_TIMEOUT, 2, ¶m); 253 254 /* Connection accept timeout ~20 secs */ 255 param = cpu_to_le16(0x7d00); 256 hci_send_cmd(hdev, HCI_OP_WRITE_CA_TIMEOUT, 2, ¶m); 257 } 258 259 static void hci_scan_req(struct hci_dev *hdev, unsigned long opt) 260 { 261 __u8 scan = opt; 262 263 BT_DBG("%s %x", hdev->name, scan); 264 265 /* Inquiry and Page scans */ 266 hci_send_cmd(hdev, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan); 267 } 268 269 static void hci_auth_req(struct hci_dev *hdev, unsigned long opt) 270 { 271 __u8 auth = opt; 272 273 BT_DBG("%s %x", hdev->name, auth); 274 275 /* Authentication */ 276 hci_send_cmd(hdev, HCI_OP_WRITE_AUTH_ENABLE, 1, &auth); 277 } 278 279 static void hci_encrypt_req(struct hci_dev *hdev, unsigned long opt) 280 { 281 __u8 encrypt = opt; 282 283 BT_DBG("%s %x", hdev->name, encrypt); 284 285 /* Encryption */ 286 hci_send_cmd(hdev, HCI_OP_WRITE_ENCRYPT_MODE, 1, &encrypt); 287 } 288 289 static void hci_linkpol_req(struct hci_dev *hdev, unsigned long opt) 290 { 291 __le16 policy = cpu_to_le16(opt); 292 293 BT_DBG("%s %x", hdev->name, opt); 294 295 /* Default link policy */ 296 hci_send_cmd(hdev, HCI_OP_WRITE_DEF_LINK_POLICY, 2, &policy); 297 } 298 299 /* Get HCI device by index. 300 * Device is held on return. */ 301 struct hci_dev *hci_dev_get(int index) 302 { 303 struct hci_dev *hdev = NULL; 304 struct list_head *p; 305 306 BT_DBG("%d", index); 307 308 if (index < 0) 309 return NULL; 310 311 read_lock(&hci_dev_list_lock); 312 list_for_each(p, &hci_dev_list) { 313 struct hci_dev *d = list_entry(p, struct hci_dev, list); 314 if (d->id == index) { 315 hdev = hci_dev_hold(d); 316 break; 317 } 318 } 319 read_unlock(&hci_dev_list_lock); 320 return hdev; 321 } 322 323 /* ---- Inquiry support ---- */ 324 static void inquiry_cache_flush(struct hci_dev *hdev) 325 { 326 struct inquiry_cache *cache = &hdev->inq_cache; 327 struct inquiry_entry *next = cache->list, *e; 328 329 BT_DBG("cache %p", cache); 330 331 cache->list = NULL; 332 while ((e = next)) { 333 next = e->next; 334 kfree(e); 335 } 336 } 337 338 struct inquiry_entry *hci_inquiry_cache_lookup(struct hci_dev *hdev, bdaddr_t *bdaddr) 339 { 340 struct inquiry_cache *cache = &hdev->inq_cache; 341 struct inquiry_entry *e; 342 343 BT_DBG("cache %p, %s", cache, batostr(bdaddr)); 344 345 for (e = cache->list; e; e = e->next) 346 if (!bacmp(&e->data.bdaddr, bdaddr)) 347 break; 348 return e; 349 } 350 351 void hci_inquiry_cache_update(struct hci_dev *hdev, struct inquiry_data *data) 352 { 353 struct inquiry_cache *cache = &hdev->inq_cache; 354 struct inquiry_entry *e; 355 356 BT_DBG("cache %p, %s", cache, batostr(&data->bdaddr)); 357 358 if (!(e = hci_inquiry_cache_lookup(hdev, &data->bdaddr))) { 359 /* Entry not in the cache. Add new one. */ 360 if (!(e = kzalloc(sizeof(struct inquiry_entry), GFP_ATOMIC))) 361 return; 362 e->next = cache->list; 363 cache->list = e; 364 } 365 366 memcpy(&e->data, data, sizeof(*data)); 367 e->timestamp = jiffies; 368 cache->timestamp = jiffies; 369 } 370 371 static int inquiry_cache_dump(struct hci_dev *hdev, int num, __u8 *buf) 372 { 373 struct inquiry_cache *cache = &hdev->inq_cache; 374 struct inquiry_info *info = (struct inquiry_info *) buf; 375 struct inquiry_entry *e; 376 int copied = 0; 377 378 for (e = cache->list; e && copied < num; e = e->next, copied++) { 379 struct inquiry_data *data = &e->data; 380 bacpy(&info->bdaddr, &data->bdaddr); 381 info->pscan_rep_mode = data->pscan_rep_mode; 382 info->pscan_period_mode = data->pscan_period_mode; 383 info->pscan_mode = data->pscan_mode; 384 memcpy(info->dev_class, data->dev_class, 3); 385 info->clock_offset = data->clock_offset; 386 info++; 387 } 388 389 BT_DBG("cache %p, copied %d", cache, copied); 390 return copied; 391 } 392 393 static void hci_inq_req(struct hci_dev *hdev, unsigned long opt) 394 { 395 struct hci_inquiry_req *ir = (struct hci_inquiry_req *) opt; 396 struct hci_cp_inquiry cp; 397 398 BT_DBG("%s", hdev->name); 399 400 if (test_bit(HCI_INQUIRY, &hdev->flags)) 401 return; 402 403 /* Start Inquiry */ 404 memcpy(&cp.lap, &ir->lap, 3); 405 cp.length = ir->length; 406 cp.num_rsp = ir->num_rsp; 407 hci_send_cmd(hdev, HCI_OP_INQUIRY, sizeof(cp), &cp); 408 } 409 410 int hci_inquiry(void __user *arg) 411 { 412 __u8 __user *ptr = arg; 413 struct hci_inquiry_req ir; 414 struct hci_dev *hdev; 415 int err = 0, do_inquiry = 0, max_rsp; 416 long timeo; 417 __u8 *buf; 418 419 if (copy_from_user(&ir, ptr, sizeof(ir))) 420 return -EFAULT; 421 422 if (!(hdev = hci_dev_get(ir.dev_id))) 423 return -ENODEV; 424 425 hci_dev_lock_bh(hdev); 426 if (inquiry_cache_age(hdev) > INQUIRY_CACHE_AGE_MAX || 427 inquiry_cache_empty(hdev) || 428 ir.flags & IREQ_CACHE_FLUSH) { 429 inquiry_cache_flush(hdev); 430 do_inquiry = 1; 431 } 432 hci_dev_unlock_bh(hdev); 433 434 timeo = ir.length * msecs_to_jiffies(2000); 435 if (do_inquiry && (err = hci_request(hdev, hci_inq_req, (unsigned long)&ir, timeo)) < 0) 436 goto done; 437 438 /* for unlimited number of responses we will use buffer with 255 entries */ 439 max_rsp = (ir.num_rsp == 0) ? 255 : ir.num_rsp; 440 441 /* cache_dump can't sleep. Therefore we allocate temp buffer and then 442 * copy it to the user space. 443 */ 444 if (!(buf = kmalloc(sizeof(struct inquiry_info) * max_rsp, GFP_KERNEL))) { 445 err = -ENOMEM; 446 goto done; 447 } 448 449 hci_dev_lock_bh(hdev); 450 ir.num_rsp = inquiry_cache_dump(hdev, max_rsp, buf); 451 hci_dev_unlock_bh(hdev); 452 453 BT_DBG("num_rsp %d", ir.num_rsp); 454 455 if (!copy_to_user(ptr, &ir, sizeof(ir))) { 456 ptr += sizeof(ir); 457 if (copy_to_user(ptr, buf, sizeof(struct inquiry_info) * 458 ir.num_rsp)) 459 err = -EFAULT; 460 } else 461 err = -EFAULT; 462 463 kfree(buf); 464 465 done: 466 hci_dev_put(hdev); 467 return err; 468 } 469 470 /* ---- HCI ioctl helpers ---- */ 471 472 int hci_dev_open(__u16 dev) 473 { 474 struct hci_dev *hdev; 475 int ret = 0; 476 477 if (!(hdev = hci_dev_get(dev))) 478 return -ENODEV; 479 480 BT_DBG("%s %p", hdev->name, hdev); 481 482 hci_req_lock(hdev); 483 484 if (test_bit(HCI_UP, &hdev->flags)) { 485 ret = -EALREADY; 486 goto done; 487 } 488 489 if (test_bit(HCI_QUIRK_RAW_DEVICE, &hdev->quirks)) 490 set_bit(HCI_RAW, &hdev->flags); 491 492 if (hdev->open(hdev)) { 493 ret = -EIO; 494 goto done; 495 } 496 497 if (!test_bit(HCI_RAW, &hdev->flags)) { 498 atomic_set(&hdev->cmd_cnt, 1); 499 set_bit(HCI_INIT, &hdev->flags); 500 501 //__hci_request(hdev, hci_reset_req, 0, HZ); 502 ret = __hci_request(hdev, hci_init_req, 0, 503 msecs_to_jiffies(HCI_INIT_TIMEOUT)); 504 505 clear_bit(HCI_INIT, &hdev->flags); 506 } 507 508 if (!ret) { 509 hci_dev_hold(hdev); 510 set_bit(HCI_UP, &hdev->flags); 511 hci_notify(hdev, HCI_DEV_UP); 512 } else { 513 /* Init failed, cleanup */ 514 tasklet_kill(&hdev->rx_task); 515 tasklet_kill(&hdev->tx_task); 516 tasklet_kill(&hdev->cmd_task); 517 518 skb_queue_purge(&hdev->cmd_q); 519 skb_queue_purge(&hdev->rx_q); 520 521 if (hdev->flush) 522 hdev->flush(hdev); 523 524 if (hdev->sent_cmd) { 525 kfree_skb(hdev->sent_cmd); 526 hdev->sent_cmd = NULL; 527 } 528 529 hdev->close(hdev); 530 hdev->flags = 0; 531 } 532 533 done: 534 hci_req_unlock(hdev); 535 hci_dev_put(hdev); 536 return ret; 537 } 538 539 static int hci_dev_do_close(struct hci_dev *hdev) 540 { 541 BT_DBG("%s %p", hdev->name, hdev); 542 543 hci_req_cancel(hdev, ENODEV); 544 hci_req_lock(hdev); 545 546 if (!test_and_clear_bit(HCI_UP, &hdev->flags)) { 547 hci_req_unlock(hdev); 548 return 0; 549 } 550 551 /* Kill RX and TX tasks */ 552 tasklet_kill(&hdev->rx_task); 553 tasklet_kill(&hdev->tx_task); 554 555 hci_dev_lock_bh(hdev); 556 inquiry_cache_flush(hdev); 557 hci_conn_hash_flush(hdev); 558 hci_dev_unlock_bh(hdev); 559 560 hci_notify(hdev, HCI_DEV_DOWN); 561 562 if (hdev->flush) 563 hdev->flush(hdev); 564 565 /* Reset device */ 566 skb_queue_purge(&hdev->cmd_q); 567 atomic_set(&hdev->cmd_cnt, 1); 568 if (!test_bit(HCI_RAW, &hdev->flags)) { 569 set_bit(HCI_INIT, &hdev->flags); 570 __hci_request(hdev, hci_reset_req, 0, 571 msecs_to_jiffies(250)); 572 clear_bit(HCI_INIT, &hdev->flags); 573 } 574 575 /* Kill cmd task */ 576 tasklet_kill(&hdev->cmd_task); 577 578 /* Drop queues */ 579 skb_queue_purge(&hdev->rx_q); 580 skb_queue_purge(&hdev->cmd_q); 581 skb_queue_purge(&hdev->raw_q); 582 583 /* Drop last sent command */ 584 if (hdev->sent_cmd) { 585 kfree_skb(hdev->sent_cmd); 586 hdev->sent_cmd = NULL; 587 } 588 589 /* After this point our queues are empty 590 * and no tasks are scheduled. */ 591 hdev->close(hdev); 592 593 /* Clear flags */ 594 hdev->flags = 0; 595 596 hci_req_unlock(hdev); 597 598 hci_dev_put(hdev); 599 return 0; 600 } 601 602 int hci_dev_close(__u16 dev) 603 { 604 struct hci_dev *hdev; 605 int err; 606 607 if (!(hdev = hci_dev_get(dev))) 608 return -ENODEV; 609 err = hci_dev_do_close(hdev); 610 hci_dev_put(hdev); 611 return err; 612 } 613 614 int hci_dev_reset(__u16 dev) 615 { 616 struct hci_dev *hdev; 617 int ret = 0; 618 619 if (!(hdev = hci_dev_get(dev))) 620 return -ENODEV; 621 622 hci_req_lock(hdev); 623 tasklet_disable(&hdev->tx_task); 624 625 if (!test_bit(HCI_UP, &hdev->flags)) 626 goto done; 627 628 /* Drop queues */ 629 skb_queue_purge(&hdev->rx_q); 630 skb_queue_purge(&hdev->cmd_q); 631 632 hci_dev_lock_bh(hdev); 633 inquiry_cache_flush(hdev); 634 hci_conn_hash_flush(hdev); 635 hci_dev_unlock_bh(hdev); 636 637 if (hdev->flush) 638 hdev->flush(hdev); 639 640 atomic_set(&hdev->cmd_cnt, 1); 641 hdev->acl_cnt = 0; hdev->sco_cnt = 0; 642 643 if (!test_bit(HCI_RAW, &hdev->flags)) 644 ret = __hci_request(hdev, hci_reset_req, 0, 645 msecs_to_jiffies(HCI_INIT_TIMEOUT)); 646 647 done: 648 tasklet_enable(&hdev->tx_task); 649 hci_req_unlock(hdev); 650 hci_dev_put(hdev); 651 return ret; 652 } 653 654 int hci_dev_reset_stat(__u16 dev) 655 { 656 struct hci_dev *hdev; 657 int ret = 0; 658 659 if (!(hdev = hci_dev_get(dev))) 660 return -ENODEV; 661 662 memset(&hdev->stat, 0, sizeof(struct hci_dev_stats)); 663 664 hci_dev_put(hdev); 665 666 return ret; 667 } 668 669 int hci_dev_cmd(unsigned int cmd, void __user *arg) 670 { 671 struct hci_dev *hdev; 672 struct hci_dev_req dr; 673 int err = 0; 674 675 if (copy_from_user(&dr, arg, sizeof(dr))) 676 return -EFAULT; 677 678 if (!(hdev = hci_dev_get(dr.dev_id))) 679 return -ENODEV; 680 681 switch (cmd) { 682 case HCISETAUTH: 683 err = hci_request(hdev, hci_auth_req, dr.dev_opt, 684 msecs_to_jiffies(HCI_INIT_TIMEOUT)); 685 break; 686 687 case HCISETENCRYPT: 688 if (!lmp_encrypt_capable(hdev)) { 689 err = -EOPNOTSUPP; 690 break; 691 } 692 693 if (!test_bit(HCI_AUTH, &hdev->flags)) { 694 /* Auth must be enabled first */ 695 err = hci_request(hdev, hci_auth_req, dr.dev_opt, 696 msecs_to_jiffies(HCI_INIT_TIMEOUT)); 697 if (err) 698 break; 699 } 700 701 err = hci_request(hdev, hci_encrypt_req, dr.dev_opt, 702 msecs_to_jiffies(HCI_INIT_TIMEOUT)); 703 break; 704 705 case HCISETSCAN: 706 err = hci_request(hdev, hci_scan_req, dr.dev_opt, 707 msecs_to_jiffies(HCI_INIT_TIMEOUT)); 708 break; 709 710 case HCISETLINKPOL: 711 err = hci_request(hdev, hci_linkpol_req, dr.dev_opt, 712 msecs_to_jiffies(HCI_INIT_TIMEOUT)); 713 break; 714 715 case HCISETLINKMODE: 716 hdev->link_mode = ((__u16) dr.dev_opt) & 717 (HCI_LM_MASTER | HCI_LM_ACCEPT); 718 break; 719 720 case HCISETPTYPE: 721 hdev->pkt_type = (__u16) dr.dev_opt; 722 break; 723 724 case HCISETACLMTU: 725 hdev->acl_mtu = *((__u16 *) &dr.dev_opt + 1); 726 hdev->acl_pkts = *((__u16 *) &dr.dev_opt + 0); 727 break; 728 729 case HCISETSCOMTU: 730 hdev->sco_mtu = *((__u16 *) &dr.dev_opt + 1); 731 hdev->sco_pkts = *((__u16 *) &dr.dev_opt + 0); 732 break; 733 734 default: 735 err = -EINVAL; 736 break; 737 } 738 739 hci_dev_put(hdev); 740 return err; 741 } 742 743 int hci_get_dev_list(void __user *arg) 744 { 745 struct hci_dev_list_req *dl; 746 struct hci_dev_req *dr; 747 struct list_head *p; 748 int n = 0, size, err; 749 __u16 dev_num; 750 751 if (get_user(dev_num, (__u16 __user *) arg)) 752 return -EFAULT; 753 754 if (!dev_num || dev_num > (PAGE_SIZE * 2) / sizeof(*dr)) 755 return -EINVAL; 756 757 size = sizeof(*dl) + dev_num * sizeof(*dr); 758 759 if (!(dl = kmalloc(size, GFP_KERNEL))) 760 return -ENOMEM; 761 762 dr = dl->dev_req; 763 764 read_lock_bh(&hci_dev_list_lock); 765 list_for_each(p, &hci_dev_list) { 766 struct hci_dev *hdev; 767 hdev = list_entry(p, struct hci_dev, list); 768 (dr + n)->dev_id = hdev->id; 769 (dr + n)->dev_opt = hdev->flags; 770 if (++n >= dev_num) 771 break; 772 } 773 read_unlock_bh(&hci_dev_list_lock); 774 775 dl->dev_num = n; 776 size = sizeof(*dl) + n * sizeof(*dr); 777 778 err = copy_to_user(arg, dl, size); 779 kfree(dl); 780 781 return err ? -EFAULT : 0; 782 } 783 784 int hci_get_dev_info(void __user *arg) 785 { 786 struct hci_dev *hdev; 787 struct hci_dev_info di; 788 int err = 0; 789 790 if (copy_from_user(&di, arg, sizeof(di))) 791 return -EFAULT; 792 793 if (!(hdev = hci_dev_get(di.dev_id))) 794 return -ENODEV; 795 796 strcpy(di.name, hdev->name); 797 di.bdaddr = hdev->bdaddr; 798 di.type = hdev->type; 799 di.flags = hdev->flags; 800 di.pkt_type = hdev->pkt_type; 801 di.acl_mtu = hdev->acl_mtu; 802 di.acl_pkts = hdev->acl_pkts; 803 di.sco_mtu = hdev->sco_mtu; 804 di.sco_pkts = hdev->sco_pkts; 805 di.link_policy = hdev->link_policy; 806 di.link_mode = hdev->link_mode; 807 808 memcpy(&di.stat, &hdev->stat, sizeof(di.stat)); 809 memcpy(&di.features, &hdev->features, sizeof(di.features)); 810 811 if (copy_to_user(arg, &di, sizeof(di))) 812 err = -EFAULT; 813 814 hci_dev_put(hdev); 815 816 return err; 817 } 818 819 /* ---- Interface to HCI drivers ---- */ 820 821 /* Alloc HCI device */ 822 struct hci_dev *hci_alloc_dev(void) 823 { 824 struct hci_dev *hdev; 825 826 hdev = kzalloc(sizeof(struct hci_dev), GFP_KERNEL); 827 if (!hdev) 828 return NULL; 829 830 skb_queue_head_init(&hdev->driver_init); 831 832 return hdev; 833 } 834 EXPORT_SYMBOL(hci_alloc_dev); 835 836 /* Free HCI device */ 837 void hci_free_dev(struct hci_dev *hdev) 838 { 839 skb_queue_purge(&hdev->driver_init); 840 841 /* will free via device release */ 842 put_device(&hdev->dev); 843 } 844 EXPORT_SYMBOL(hci_free_dev); 845 846 /* Register HCI device */ 847 int hci_register_dev(struct hci_dev *hdev) 848 { 849 struct list_head *head = &hci_dev_list, *p; 850 int i, id = 0; 851 852 BT_DBG("%p name %s type %d owner %p", hdev, hdev->name, hdev->type, hdev->owner); 853 854 if (!hdev->open || !hdev->close || !hdev->destruct) 855 return -EINVAL; 856 857 write_lock_bh(&hci_dev_list_lock); 858 859 /* Find first available device id */ 860 list_for_each(p, &hci_dev_list) { 861 if (list_entry(p, struct hci_dev, list)->id != id) 862 break; 863 head = p; id++; 864 } 865 866 sprintf(hdev->name, "hci%d", id); 867 hdev->id = id; 868 list_add(&hdev->list, head); 869 870 atomic_set(&hdev->refcnt, 1); 871 spin_lock_init(&hdev->lock); 872 873 hdev->flags = 0; 874 hdev->pkt_type = (HCI_DM1 | HCI_DH1 | HCI_HV1); 875 hdev->esco_type = (ESCO_HV1); 876 hdev->link_mode = (HCI_LM_ACCEPT); 877 878 hdev->idle_timeout = 0; 879 hdev->sniff_max_interval = 800; 880 hdev->sniff_min_interval = 80; 881 882 tasklet_init(&hdev->cmd_task, hci_cmd_task,(unsigned long) hdev); 883 tasklet_init(&hdev->rx_task, hci_rx_task, (unsigned long) hdev); 884 tasklet_init(&hdev->tx_task, hci_tx_task, (unsigned long) hdev); 885 886 skb_queue_head_init(&hdev->rx_q); 887 skb_queue_head_init(&hdev->cmd_q); 888 skb_queue_head_init(&hdev->raw_q); 889 890 for (i = 0; i < 3; i++) 891 hdev->reassembly[i] = NULL; 892 893 init_waitqueue_head(&hdev->req_wait_q); 894 init_MUTEX(&hdev->req_lock); 895 896 inquiry_cache_init(hdev); 897 898 hci_conn_hash_init(hdev); 899 900 memset(&hdev->stat, 0, sizeof(struct hci_dev_stats)); 901 902 atomic_set(&hdev->promisc, 0); 903 904 write_unlock_bh(&hci_dev_list_lock); 905 906 hci_register_sysfs(hdev); 907 908 hci_notify(hdev, HCI_DEV_REG); 909 910 return id; 911 } 912 EXPORT_SYMBOL(hci_register_dev); 913 914 /* Unregister HCI device */ 915 int hci_unregister_dev(struct hci_dev *hdev) 916 { 917 int i; 918 919 BT_DBG("%p name %s type %d", hdev, hdev->name, hdev->type); 920 921 write_lock_bh(&hci_dev_list_lock); 922 list_del(&hdev->list); 923 write_unlock_bh(&hci_dev_list_lock); 924 925 hci_dev_do_close(hdev); 926 927 for (i = 0; i < 3; i++) 928 kfree_skb(hdev->reassembly[i]); 929 930 hci_notify(hdev, HCI_DEV_UNREG); 931 932 hci_unregister_sysfs(hdev); 933 934 __hci_dev_put(hdev); 935 936 return 0; 937 } 938 EXPORT_SYMBOL(hci_unregister_dev); 939 940 /* Suspend HCI device */ 941 int hci_suspend_dev(struct hci_dev *hdev) 942 { 943 hci_notify(hdev, HCI_DEV_SUSPEND); 944 return 0; 945 } 946 EXPORT_SYMBOL(hci_suspend_dev); 947 948 /* Resume HCI device */ 949 int hci_resume_dev(struct hci_dev *hdev) 950 { 951 hci_notify(hdev, HCI_DEV_RESUME); 952 return 0; 953 } 954 EXPORT_SYMBOL(hci_resume_dev); 955 956 /* Receive packet type fragment */ 957 #define __reassembly(hdev, type) ((hdev)->reassembly[(type) - 2]) 958 959 int hci_recv_fragment(struct hci_dev *hdev, int type, void *data, int count) 960 { 961 if (type < HCI_ACLDATA_PKT || type > HCI_EVENT_PKT) 962 return -EILSEQ; 963 964 while (count) { 965 struct sk_buff *skb = __reassembly(hdev, type); 966 struct { int expect; } *scb; 967 int len = 0; 968 969 if (!skb) { 970 /* Start of the frame */ 971 972 switch (type) { 973 case HCI_EVENT_PKT: 974 if (count >= HCI_EVENT_HDR_SIZE) { 975 struct hci_event_hdr *h = data; 976 len = HCI_EVENT_HDR_SIZE + h->plen; 977 } else 978 return -EILSEQ; 979 break; 980 981 case HCI_ACLDATA_PKT: 982 if (count >= HCI_ACL_HDR_SIZE) { 983 struct hci_acl_hdr *h = data; 984 len = HCI_ACL_HDR_SIZE + __le16_to_cpu(h->dlen); 985 } else 986 return -EILSEQ; 987 break; 988 989 case HCI_SCODATA_PKT: 990 if (count >= HCI_SCO_HDR_SIZE) { 991 struct hci_sco_hdr *h = data; 992 len = HCI_SCO_HDR_SIZE + h->dlen; 993 } else 994 return -EILSEQ; 995 break; 996 } 997 998 skb = bt_skb_alloc(len, GFP_ATOMIC); 999 if (!skb) { 1000 BT_ERR("%s no memory for packet", hdev->name); 1001 return -ENOMEM; 1002 } 1003 1004 skb->dev = (void *) hdev; 1005 bt_cb(skb)->pkt_type = type; 1006 1007 __reassembly(hdev, type) = skb; 1008 1009 scb = (void *) skb->cb; 1010 scb->expect = len; 1011 } else { 1012 /* Continuation */ 1013 1014 scb = (void *) skb->cb; 1015 len = scb->expect; 1016 } 1017 1018 len = min(len, count); 1019 1020 memcpy(skb_put(skb, len), data, len); 1021 1022 scb->expect -= len; 1023 1024 if (scb->expect == 0) { 1025 /* Complete frame */ 1026 1027 __reassembly(hdev, type) = NULL; 1028 1029 bt_cb(skb)->pkt_type = type; 1030 hci_recv_frame(skb); 1031 } 1032 1033 count -= len; data += len; 1034 } 1035 1036 return 0; 1037 } 1038 EXPORT_SYMBOL(hci_recv_fragment); 1039 1040 /* ---- Interface to upper protocols ---- */ 1041 1042 /* Register/Unregister protocols. 1043 * hci_task_lock is used to ensure that no tasks are running. */ 1044 int hci_register_proto(struct hci_proto *hp) 1045 { 1046 int err = 0; 1047 1048 BT_DBG("%p name %s id %d", hp, hp->name, hp->id); 1049 1050 if (hp->id >= HCI_MAX_PROTO) 1051 return -EINVAL; 1052 1053 write_lock_bh(&hci_task_lock); 1054 1055 if (!hci_proto[hp->id]) 1056 hci_proto[hp->id] = hp; 1057 else 1058 err = -EEXIST; 1059 1060 write_unlock_bh(&hci_task_lock); 1061 1062 return err; 1063 } 1064 EXPORT_SYMBOL(hci_register_proto); 1065 1066 int hci_unregister_proto(struct hci_proto *hp) 1067 { 1068 int err = 0; 1069 1070 BT_DBG("%p name %s id %d", hp, hp->name, hp->id); 1071 1072 if (hp->id >= HCI_MAX_PROTO) 1073 return -EINVAL; 1074 1075 write_lock_bh(&hci_task_lock); 1076 1077 if (hci_proto[hp->id]) 1078 hci_proto[hp->id] = NULL; 1079 else 1080 err = -ENOENT; 1081 1082 write_unlock_bh(&hci_task_lock); 1083 1084 return err; 1085 } 1086 EXPORT_SYMBOL(hci_unregister_proto); 1087 1088 int hci_register_cb(struct hci_cb *cb) 1089 { 1090 BT_DBG("%p name %s", cb, cb->name); 1091 1092 write_lock_bh(&hci_cb_list_lock); 1093 list_add(&cb->list, &hci_cb_list); 1094 write_unlock_bh(&hci_cb_list_lock); 1095 1096 return 0; 1097 } 1098 EXPORT_SYMBOL(hci_register_cb); 1099 1100 int hci_unregister_cb(struct hci_cb *cb) 1101 { 1102 BT_DBG("%p name %s", cb, cb->name); 1103 1104 write_lock_bh(&hci_cb_list_lock); 1105 list_del(&cb->list); 1106 write_unlock_bh(&hci_cb_list_lock); 1107 1108 return 0; 1109 } 1110 EXPORT_SYMBOL(hci_unregister_cb); 1111 1112 static int hci_send_frame(struct sk_buff *skb) 1113 { 1114 struct hci_dev *hdev = (struct hci_dev *) skb->dev; 1115 1116 if (!hdev) { 1117 kfree_skb(skb); 1118 return -ENODEV; 1119 } 1120 1121 BT_DBG("%s type %d len %d", hdev->name, bt_cb(skb)->pkt_type, skb->len); 1122 1123 if (atomic_read(&hdev->promisc)) { 1124 /* Time stamp */ 1125 __net_timestamp(skb); 1126 1127 hci_send_to_sock(hdev, skb); 1128 } 1129 1130 /* Get rid of skb owner, prior to sending to the driver. */ 1131 skb_orphan(skb); 1132 1133 return hdev->send(skb); 1134 } 1135 1136 /* Send HCI command */ 1137 int hci_send_cmd(struct hci_dev *hdev, __u16 opcode, __u32 plen, void *param) 1138 { 1139 int len = HCI_COMMAND_HDR_SIZE + plen; 1140 struct hci_command_hdr *hdr; 1141 struct sk_buff *skb; 1142 1143 BT_DBG("%s opcode 0x%x plen %d", hdev->name, opcode, plen); 1144 1145 skb = bt_skb_alloc(len, GFP_ATOMIC); 1146 if (!skb) { 1147 BT_ERR("%s no memory for command", hdev->name); 1148 return -ENOMEM; 1149 } 1150 1151 hdr = (struct hci_command_hdr *) skb_put(skb, HCI_COMMAND_HDR_SIZE); 1152 hdr->opcode = cpu_to_le16(opcode); 1153 hdr->plen = plen; 1154 1155 if (plen) 1156 memcpy(skb_put(skb, plen), param, plen); 1157 1158 BT_DBG("skb len %d", skb->len); 1159 1160 bt_cb(skb)->pkt_type = HCI_COMMAND_PKT; 1161 skb->dev = (void *) hdev; 1162 skb_queue_tail(&hdev->cmd_q, skb); 1163 hci_sched_cmd(hdev); 1164 1165 return 0; 1166 } 1167 1168 /* Get data from the previously sent command */ 1169 void *hci_sent_cmd_data(struct hci_dev *hdev, __u16 opcode) 1170 { 1171 struct hci_command_hdr *hdr; 1172 1173 if (!hdev->sent_cmd) 1174 return NULL; 1175 1176 hdr = (void *) hdev->sent_cmd->data; 1177 1178 if (hdr->opcode != cpu_to_le16(opcode)) 1179 return NULL; 1180 1181 BT_DBG("%s opcode 0x%x", hdev->name, opcode); 1182 1183 return hdev->sent_cmd->data + HCI_COMMAND_HDR_SIZE; 1184 } 1185 1186 /* Send ACL data */ 1187 static void hci_add_acl_hdr(struct sk_buff *skb, __u16 handle, __u16 flags) 1188 { 1189 struct hci_acl_hdr *hdr; 1190 int len = skb->len; 1191 1192 skb_push(skb, HCI_ACL_HDR_SIZE); 1193 skb_reset_transport_header(skb); 1194 hdr = (struct hci_acl_hdr *)skb_transport_header(skb); 1195 hdr->handle = cpu_to_le16(hci_handle_pack(handle, flags)); 1196 hdr->dlen = cpu_to_le16(len); 1197 } 1198 1199 int hci_send_acl(struct hci_conn *conn, struct sk_buff *skb, __u16 flags) 1200 { 1201 struct hci_dev *hdev = conn->hdev; 1202 struct sk_buff *list; 1203 1204 BT_DBG("%s conn %p flags 0x%x", hdev->name, conn, flags); 1205 1206 skb->dev = (void *) hdev; 1207 bt_cb(skb)->pkt_type = HCI_ACLDATA_PKT; 1208 hci_add_acl_hdr(skb, conn->handle, flags | ACL_START); 1209 1210 if (!(list = skb_shinfo(skb)->frag_list)) { 1211 /* Non fragmented */ 1212 BT_DBG("%s nonfrag skb %p len %d", hdev->name, skb, skb->len); 1213 1214 skb_queue_tail(&conn->data_q, skb); 1215 } else { 1216 /* Fragmented */ 1217 BT_DBG("%s frag %p len %d", hdev->name, skb, skb->len); 1218 1219 skb_shinfo(skb)->frag_list = NULL; 1220 1221 /* Queue all fragments atomically */ 1222 spin_lock_bh(&conn->data_q.lock); 1223 1224 __skb_queue_tail(&conn->data_q, skb); 1225 do { 1226 skb = list; list = list->next; 1227 1228 skb->dev = (void *) hdev; 1229 bt_cb(skb)->pkt_type = HCI_ACLDATA_PKT; 1230 hci_add_acl_hdr(skb, conn->handle, flags | ACL_CONT); 1231 1232 BT_DBG("%s frag %p len %d", hdev->name, skb, skb->len); 1233 1234 __skb_queue_tail(&conn->data_q, skb); 1235 } while (list); 1236 1237 spin_unlock_bh(&conn->data_q.lock); 1238 } 1239 1240 hci_sched_tx(hdev); 1241 return 0; 1242 } 1243 EXPORT_SYMBOL(hci_send_acl); 1244 1245 /* Send SCO data */ 1246 int hci_send_sco(struct hci_conn *conn, struct sk_buff *skb) 1247 { 1248 struct hci_dev *hdev = conn->hdev; 1249 struct hci_sco_hdr hdr; 1250 1251 BT_DBG("%s len %d", hdev->name, skb->len); 1252 1253 if (skb->len > hdev->sco_mtu) { 1254 kfree_skb(skb); 1255 return -EINVAL; 1256 } 1257 1258 hdr.handle = cpu_to_le16(conn->handle); 1259 hdr.dlen = skb->len; 1260 1261 skb_push(skb, HCI_SCO_HDR_SIZE); 1262 skb_reset_transport_header(skb); 1263 memcpy(skb_transport_header(skb), &hdr, HCI_SCO_HDR_SIZE); 1264 1265 skb->dev = (void *) hdev; 1266 bt_cb(skb)->pkt_type = HCI_SCODATA_PKT; 1267 skb_queue_tail(&conn->data_q, skb); 1268 hci_sched_tx(hdev); 1269 return 0; 1270 } 1271 EXPORT_SYMBOL(hci_send_sco); 1272 1273 /* ---- HCI TX task (outgoing data) ---- */ 1274 1275 /* HCI Connection scheduler */ 1276 static inline struct hci_conn *hci_low_sent(struct hci_dev *hdev, __u8 type, int *quote) 1277 { 1278 struct hci_conn_hash *h = &hdev->conn_hash; 1279 struct hci_conn *conn = NULL; 1280 int num = 0, min = ~0; 1281 struct list_head *p; 1282 1283 /* We don't have to lock device here. Connections are always 1284 * added and removed with TX task disabled. */ 1285 list_for_each(p, &h->list) { 1286 struct hci_conn *c; 1287 c = list_entry(p, struct hci_conn, list); 1288 1289 if (c->type != type || skb_queue_empty(&c->data_q)) 1290 continue; 1291 1292 if (c->state != BT_CONNECTED && c->state != BT_CONFIG) 1293 continue; 1294 1295 num++; 1296 1297 if (c->sent < min) { 1298 min = c->sent; 1299 conn = c; 1300 } 1301 } 1302 1303 if (conn) { 1304 int cnt = (type == ACL_LINK ? hdev->acl_cnt : hdev->sco_cnt); 1305 int q = cnt / num; 1306 *quote = q ? q : 1; 1307 } else 1308 *quote = 0; 1309 1310 BT_DBG("conn %p quote %d", conn, *quote); 1311 return conn; 1312 } 1313 1314 static inline void hci_acl_tx_to(struct hci_dev *hdev) 1315 { 1316 struct hci_conn_hash *h = &hdev->conn_hash; 1317 struct list_head *p; 1318 struct hci_conn *c; 1319 1320 BT_ERR("%s ACL tx timeout", hdev->name); 1321 1322 /* Kill stalled connections */ 1323 list_for_each(p, &h->list) { 1324 c = list_entry(p, struct hci_conn, list); 1325 if (c->type == ACL_LINK && c->sent) { 1326 BT_ERR("%s killing stalled ACL connection %s", 1327 hdev->name, batostr(&c->dst)); 1328 hci_acl_disconn(c, 0x13); 1329 } 1330 } 1331 } 1332 1333 static inline void hci_sched_acl(struct hci_dev *hdev) 1334 { 1335 struct hci_conn *conn; 1336 struct sk_buff *skb; 1337 int quote; 1338 1339 BT_DBG("%s", hdev->name); 1340 1341 if (!test_bit(HCI_RAW, &hdev->flags)) { 1342 /* ACL tx timeout must be longer than maximum 1343 * link supervision timeout (40.9 seconds) */ 1344 if (!hdev->acl_cnt && time_after(jiffies, hdev->acl_last_tx + HZ * 45)) 1345 hci_acl_tx_to(hdev); 1346 } 1347 1348 while (hdev->acl_cnt && (conn = hci_low_sent(hdev, ACL_LINK, "e))) { 1349 while (quote-- && (skb = skb_dequeue(&conn->data_q))) { 1350 BT_DBG("skb %p len %d", skb, skb->len); 1351 1352 hci_conn_enter_active_mode(conn); 1353 1354 hci_send_frame(skb); 1355 hdev->acl_last_tx = jiffies; 1356 1357 hdev->acl_cnt--; 1358 conn->sent++; 1359 } 1360 } 1361 } 1362 1363 /* Schedule SCO */ 1364 static inline void hci_sched_sco(struct hci_dev *hdev) 1365 { 1366 struct hci_conn *conn; 1367 struct sk_buff *skb; 1368 int quote; 1369 1370 BT_DBG("%s", hdev->name); 1371 1372 while (hdev->sco_cnt && (conn = hci_low_sent(hdev, SCO_LINK, "e))) { 1373 while (quote-- && (skb = skb_dequeue(&conn->data_q))) { 1374 BT_DBG("skb %p len %d", skb, skb->len); 1375 hci_send_frame(skb); 1376 1377 conn->sent++; 1378 if (conn->sent == ~0) 1379 conn->sent = 0; 1380 } 1381 } 1382 } 1383 1384 static inline void hci_sched_esco(struct hci_dev *hdev) 1385 { 1386 struct hci_conn *conn; 1387 struct sk_buff *skb; 1388 int quote; 1389 1390 BT_DBG("%s", hdev->name); 1391 1392 while (hdev->sco_cnt && (conn = hci_low_sent(hdev, ESCO_LINK, "e))) { 1393 while (quote-- && (skb = skb_dequeue(&conn->data_q))) { 1394 BT_DBG("skb %p len %d", skb, skb->len); 1395 hci_send_frame(skb); 1396 1397 conn->sent++; 1398 if (conn->sent == ~0) 1399 conn->sent = 0; 1400 } 1401 } 1402 } 1403 1404 static void hci_tx_task(unsigned long arg) 1405 { 1406 struct hci_dev *hdev = (struct hci_dev *) arg; 1407 struct sk_buff *skb; 1408 1409 read_lock(&hci_task_lock); 1410 1411 BT_DBG("%s acl %d sco %d", hdev->name, hdev->acl_cnt, hdev->sco_cnt); 1412 1413 /* Schedule queues and send stuff to HCI driver */ 1414 1415 hci_sched_acl(hdev); 1416 1417 hci_sched_sco(hdev); 1418 1419 hci_sched_esco(hdev); 1420 1421 /* Send next queued raw (unknown type) packet */ 1422 while ((skb = skb_dequeue(&hdev->raw_q))) 1423 hci_send_frame(skb); 1424 1425 read_unlock(&hci_task_lock); 1426 } 1427 1428 /* ----- HCI RX task (incoming data proccessing) ----- */ 1429 1430 /* ACL data packet */ 1431 static inline void hci_acldata_packet(struct hci_dev *hdev, struct sk_buff *skb) 1432 { 1433 struct hci_acl_hdr *hdr = (void *) skb->data; 1434 struct hci_conn *conn; 1435 __u16 handle, flags; 1436 1437 skb_pull(skb, HCI_ACL_HDR_SIZE); 1438 1439 handle = __le16_to_cpu(hdr->handle); 1440 flags = hci_flags(handle); 1441 handle = hci_handle(handle); 1442 1443 BT_DBG("%s len %d handle 0x%x flags 0x%x", hdev->name, skb->len, handle, flags); 1444 1445 hdev->stat.acl_rx++; 1446 1447 hci_dev_lock(hdev); 1448 conn = hci_conn_hash_lookup_handle(hdev, handle); 1449 hci_dev_unlock(hdev); 1450 1451 if (conn) { 1452 register struct hci_proto *hp; 1453 1454 hci_conn_enter_active_mode(conn); 1455 1456 /* Send to upper protocol */ 1457 if ((hp = hci_proto[HCI_PROTO_L2CAP]) && hp->recv_acldata) { 1458 hp->recv_acldata(conn, skb, flags); 1459 return; 1460 } 1461 } else { 1462 BT_ERR("%s ACL packet for unknown connection handle %d", 1463 hdev->name, handle); 1464 } 1465 1466 kfree_skb(skb); 1467 } 1468 1469 /* SCO data packet */ 1470 static inline void hci_scodata_packet(struct hci_dev *hdev, struct sk_buff *skb) 1471 { 1472 struct hci_sco_hdr *hdr = (void *) skb->data; 1473 struct hci_conn *conn; 1474 __u16 handle; 1475 1476 skb_pull(skb, HCI_SCO_HDR_SIZE); 1477 1478 handle = __le16_to_cpu(hdr->handle); 1479 1480 BT_DBG("%s len %d handle 0x%x", hdev->name, skb->len, handle); 1481 1482 hdev->stat.sco_rx++; 1483 1484 hci_dev_lock(hdev); 1485 conn = hci_conn_hash_lookup_handle(hdev, handle); 1486 hci_dev_unlock(hdev); 1487 1488 if (conn) { 1489 register struct hci_proto *hp; 1490 1491 /* Send to upper protocol */ 1492 if ((hp = hci_proto[HCI_PROTO_SCO]) && hp->recv_scodata) { 1493 hp->recv_scodata(conn, skb); 1494 return; 1495 } 1496 } else { 1497 BT_ERR("%s SCO packet for unknown connection handle %d", 1498 hdev->name, handle); 1499 } 1500 1501 kfree_skb(skb); 1502 } 1503 1504 static void hci_rx_task(unsigned long arg) 1505 { 1506 struct hci_dev *hdev = (struct hci_dev *) arg; 1507 struct sk_buff *skb; 1508 1509 BT_DBG("%s", hdev->name); 1510 1511 read_lock(&hci_task_lock); 1512 1513 while ((skb = skb_dequeue(&hdev->rx_q))) { 1514 if (atomic_read(&hdev->promisc)) { 1515 /* Send copy to the sockets */ 1516 hci_send_to_sock(hdev, skb); 1517 } 1518 1519 if (test_bit(HCI_RAW, &hdev->flags)) { 1520 kfree_skb(skb); 1521 continue; 1522 } 1523 1524 if (test_bit(HCI_INIT, &hdev->flags)) { 1525 /* Don't process data packets in this states. */ 1526 switch (bt_cb(skb)->pkt_type) { 1527 case HCI_ACLDATA_PKT: 1528 case HCI_SCODATA_PKT: 1529 kfree_skb(skb); 1530 continue; 1531 } 1532 } 1533 1534 /* Process frame */ 1535 switch (bt_cb(skb)->pkt_type) { 1536 case HCI_EVENT_PKT: 1537 hci_event_packet(hdev, skb); 1538 break; 1539 1540 case HCI_ACLDATA_PKT: 1541 BT_DBG("%s ACL data packet", hdev->name); 1542 hci_acldata_packet(hdev, skb); 1543 break; 1544 1545 case HCI_SCODATA_PKT: 1546 BT_DBG("%s SCO data packet", hdev->name); 1547 hci_scodata_packet(hdev, skb); 1548 break; 1549 1550 default: 1551 kfree_skb(skb); 1552 break; 1553 } 1554 } 1555 1556 read_unlock(&hci_task_lock); 1557 } 1558 1559 static void hci_cmd_task(unsigned long arg) 1560 { 1561 struct hci_dev *hdev = (struct hci_dev *) arg; 1562 struct sk_buff *skb; 1563 1564 BT_DBG("%s cmd %d", hdev->name, atomic_read(&hdev->cmd_cnt)); 1565 1566 if (!atomic_read(&hdev->cmd_cnt) && time_after(jiffies, hdev->cmd_last_tx + HZ)) { 1567 BT_ERR("%s command tx timeout", hdev->name); 1568 atomic_set(&hdev->cmd_cnt, 1); 1569 } 1570 1571 /* Send queued commands */ 1572 if (atomic_read(&hdev->cmd_cnt) && (skb = skb_dequeue(&hdev->cmd_q))) { 1573 if (hdev->sent_cmd) 1574 kfree_skb(hdev->sent_cmd); 1575 1576 if ((hdev->sent_cmd = skb_clone(skb, GFP_ATOMIC))) { 1577 atomic_dec(&hdev->cmd_cnt); 1578 hci_send_frame(skb); 1579 hdev->cmd_last_tx = jiffies; 1580 } else { 1581 skb_queue_head(&hdev->cmd_q, skb); 1582 hci_sched_cmd(hdev); 1583 } 1584 } 1585 } 1586