1 /* 2 BlueZ - Bluetooth protocol stack for Linux 3 Copyright (C) 2000-2001 Qualcomm Incorporated 4 5 Written 2000,2001 by Maxim Krasnyansky <maxk@qualcomm.com> 6 7 This program is free software; you can redistribute it and/or modify 8 it under the terms of the GNU General Public License version 2 as 9 published by the Free Software Foundation; 10 11 THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS 12 OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, 13 FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS. 14 IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY 15 CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES 16 WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN 17 ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF 18 OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. 19 20 ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS, 21 COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS 22 SOFTWARE IS DISCLAIMED. 23 */ 24 25 /* Bluetooth HCI core. */ 26 27 #include <linux/jiffies.h> 28 #include <linux/module.h> 29 #include <linux/kmod.h> 30 31 #include <linux/types.h> 32 #include <linux/errno.h> 33 #include <linux/kernel.h> 34 #include <linux/sched.h> 35 #include <linux/slab.h> 36 #include <linux/poll.h> 37 #include <linux/fcntl.h> 38 #include <linux/init.h> 39 #include <linux/skbuff.h> 40 #include <linux/interrupt.h> 41 #include <linux/notifier.h> 42 #include <net/sock.h> 43 44 #include <asm/system.h> 45 #include <asm/uaccess.h> 46 #include <asm/unaligned.h> 47 48 #include <net/bluetooth/bluetooth.h> 49 #include <net/bluetooth/hci_core.h> 50 51 #ifndef CONFIG_BT_HCI_CORE_DEBUG 52 #undef BT_DBG 53 #define BT_DBG(D...) 54 #endif 55 56 static void hci_cmd_task(unsigned long arg); 57 static void hci_rx_task(unsigned long arg); 58 static void hci_tx_task(unsigned long arg); 59 static void hci_notify(struct hci_dev *hdev, int event); 60 61 static DEFINE_RWLOCK(hci_task_lock); 62 63 /* HCI device list */ 64 LIST_HEAD(hci_dev_list); 65 DEFINE_RWLOCK(hci_dev_list_lock); 66 67 /* HCI callback list */ 68 LIST_HEAD(hci_cb_list); 69 DEFINE_RWLOCK(hci_cb_list_lock); 70 71 /* HCI protocols */ 72 #define HCI_MAX_PROTO 2 73 struct hci_proto *hci_proto[HCI_MAX_PROTO]; 74 75 /* HCI notifiers list */ 76 static ATOMIC_NOTIFIER_HEAD(hci_notifier); 77 78 /* ---- HCI notifications ---- */ 79 80 int hci_register_notifier(struct notifier_block *nb) 81 { 82 return atomic_notifier_chain_register(&hci_notifier, nb); 83 } 84 85 int hci_unregister_notifier(struct notifier_block *nb) 86 { 87 return atomic_notifier_chain_unregister(&hci_notifier, nb); 88 } 89 90 static void hci_notify(struct hci_dev *hdev, int event) 91 { 92 atomic_notifier_call_chain(&hci_notifier, event, hdev); 93 } 94 95 /* ---- HCI requests ---- */ 96 97 void hci_req_complete(struct hci_dev *hdev, int result) 98 { 99 BT_DBG("%s result 0x%2.2x", hdev->name, result); 100 101 if (hdev->req_status == HCI_REQ_PEND) { 102 hdev->req_result = result; 103 hdev->req_status = HCI_REQ_DONE; 104 wake_up_interruptible(&hdev->req_wait_q); 105 } 106 } 107 108 static void hci_req_cancel(struct hci_dev *hdev, int err) 109 { 110 BT_DBG("%s err 0x%2.2x", hdev->name, err); 111 112 if (hdev->req_status == HCI_REQ_PEND) { 113 hdev->req_result = err; 114 hdev->req_status = HCI_REQ_CANCELED; 115 wake_up_interruptible(&hdev->req_wait_q); 116 } 117 } 118 119 /* Execute request and wait for completion. */ 120 static int __hci_request(struct hci_dev *hdev, void (*req)(struct hci_dev *hdev, unsigned long opt), 121 unsigned long opt, __u32 timeout) 122 { 123 DECLARE_WAITQUEUE(wait, current); 124 int err = 0; 125 126 BT_DBG("%s start", hdev->name); 127 128 hdev->req_status = HCI_REQ_PEND; 129 130 add_wait_queue(&hdev->req_wait_q, &wait); 131 set_current_state(TASK_INTERRUPTIBLE); 132 133 req(hdev, opt); 134 schedule_timeout(timeout); 135 136 remove_wait_queue(&hdev->req_wait_q, &wait); 137 138 if (signal_pending(current)) 139 return -EINTR; 140 141 switch (hdev->req_status) { 142 case HCI_REQ_DONE: 143 err = -bt_err(hdev->req_result); 144 break; 145 146 case HCI_REQ_CANCELED: 147 err = -hdev->req_result; 148 break; 149 150 default: 151 err = -ETIMEDOUT; 152 break; 153 } 154 155 hdev->req_status = hdev->req_result = 0; 156 157 BT_DBG("%s end: err %d", hdev->name, err); 158 159 return err; 160 } 161 162 static inline int hci_request(struct hci_dev *hdev, void (*req)(struct hci_dev *hdev, unsigned long opt), 163 unsigned long opt, __u32 timeout) 164 { 165 int ret; 166 167 /* Serialize all requests */ 168 hci_req_lock(hdev); 169 ret = __hci_request(hdev, req, opt, timeout); 170 hci_req_unlock(hdev); 171 172 return ret; 173 } 174 175 static void hci_reset_req(struct hci_dev *hdev, unsigned long opt) 176 { 177 BT_DBG("%s %ld", hdev->name, opt); 178 179 /* Reset device */ 180 hci_send_cmd(hdev, HCI_OP_RESET, 0, NULL); 181 } 182 183 static void hci_init_req(struct hci_dev *hdev, unsigned long opt) 184 { 185 struct sk_buff *skb; 186 __le16 param; 187 __u8 flt_type; 188 189 BT_DBG("%s %ld", hdev->name, opt); 190 191 /* Driver initialization */ 192 193 /* Special commands */ 194 while ((skb = skb_dequeue(&hdev->driver_init))) { 195 bt_cb(skb)->pkt_type = HCI_COMMAND_PKT; 196 skb->dev = (void *) hdev; 197 skb_queue_tail(&hdev->cmd_q, skb); 198 hci_sched_cmd(hdev); 199 } 200 skb_queue_purge(&hdev->driver_init); 201 202 /* Mandatory initialization */ 203 204 /* Reset */ 205 if (test_bit(HCI_QUIRK_RESET_ON_INIT, &hdev->quirks)) 206 hci_send_cmd(hdev, HCI_OP_RESET, 0, NULL); 207 208 /* Read Local Supported Features */ 209 hci_send_cmd(hdev, HCI_OP_READ_LOCAL_FEATURES, 0, NULL); 210 211 /* Read Local Version */ 212 hci_send_cmd(hdev, HCI_OP_READ_LOCAL_VERSION, 0, NULL); 213 214 /* Read Buffer Size (ACL mtu, max pkt, etc.) */ 215 hci_send_cmd(hdev, HCI_OP_READ_BUFFER_SIZE, 0, NULL); 216 217 #if 0 218 /* Host buffer size */ 219 { 220 struct hci_cp_host_buffer_size cp; 221 cp.acl_mtu = cpu_to_le16(HCI_MAX_ACL_SIZE); 222 cp.sco_mtu = HCI_MAX_SCO_SIZE; 223 cp.acl_max_pkt = cpu_to_le16(0xffff); 224 cp.sco_max_pkt = cpu_to_le16(0xffff); 225 hci_send_cmd(hdev, HCI_OP_HOST_BUFFER_SIZE, sizeof(cp), &cp); 226 } 227 #endif 228 229 /* Read BD Address */ 230 hci_send_cmd(hdev, HCI_OP_READ_BD_ADDR, 0, NULL); 231 232 /* Read Class of Device */ 233 hci_send_cmd(hdev, HCI_OP_READ_CLASS_OF_DEV, 0, NULL); 234 235 /* Read Local Name */ 236 hci_send_cmd(hdev, HCI_OP_READ_LOCAL_NAME, 0, NULL); 237 238 /* Read Voice Setting */ 239 hci_send_cmd(hdev, HCI_OP_READ_VOICE_SETTING, 0, NULL); 240 241 /* Optional initialization */ 242 243 /* Clear Event Filters */ 244 flt_type = HCI_FLT_CLEAR_ALL; 245 hci_send_cmd(hdev, HCI_OP_SET_EVENT_FLT, 1, &flt_type); 246 247 /* Page timeout ~20 secs */ 248 param = cpu_to_le16(0x8000); 249 hci_send_cmd(hdev, HCI_OP_WRITE_PG_TIMEOUT, 2, ¶m); 250 251 /* Connection accept timeout ~20 secs */ 252 param = cpu_to_le16(0x7d00); 253 hci_send_cmd(hdev, HCI_OP_WRITE_CA_TIMEOUT, 2, ¶m); 254 } 255 256 static void hci_scan_req(struct hci_dev *hdev, unsigned long opt) 257 { 258 __u8 scan = opt; 259 260 BT_DBG("%s %x", hdev->name, scan); 261 262 /* Inquiry and Page scans */ 263 hci_send_cmd(hdev, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan); 264 } 265 266 static void hci_auth_req(struct hci_dev *hdev, unsigned long opt) 267 { 268 __u8 auth = opt; 269 270 BT_DBG("%s %x", hdev->name, auth); 271 272 /* Authentication */ 273 hci_send_cmd(hdev, HCI_OP_WRITE_AUTH_ENABLE, 1, &auth); 274 } 275 276 static void hci_encrypt_req(struct hci_dev *hdev, unsigned long opt) 277 { 278 __u8 encrypt = opt; 279 280 BT_DBG("%s %x", hdev->name, encrypt); 281 282 /* Encryption */ 283 hci_send_cmd(hdev, HCI_OP_WRITE_ENCRYPT_MODE, 1, &encrypt); 284 } 285 286 static void hci_linkpol_req(struct hci_dev *hdev, unsigned long opt) 287 { 288 __le16 policy = cpu_to_le16(opt); 289 290 BT_DBG("%s %x", hdev->name, opt); 291 292 /* Default link policy */ 293 hci_send_cmd(hdev, HCI_OP_WRITE_DEF_LINK_POLICY, 2, &policy); 294 } 295 296 /* Get HCI device by index. 297 * Device is held on return. */ 298 struct hci_dev *hci_dev_get(int index) 299 { 300 struct hci_dev *hdev = NULL; 301 struct list_head *p; 302 303 BT_DBG("%d", index); 304 305 if (index < 0) 306 return NULL; 307 308 read_lock(&hci_dev_list_lock); 309 list_for_each(p, &hci_dev_list) { 310 struct hci_dev *d = list_entry(p, struct hci_dev, list); 311 if (d->id == index) { 312 hdev = hci_dev_hold(d); 313 break; 314 } 315 } 316 read_unlock(&hci_dev_list_lock); 317 return hdev; 318 } 319 320 /* ---- Inquiry support ---- */ 321 static void inquiry_cache_flush(struct hci_dev *hdev) 322 { 323 struct inquiry_cache *cache = &hdev->inq_cache; 324 struct inquiry_entry *next = cache->list, *e; 325 326 BT_DBG("cache %p", cache); 327 328 cache->list = NULL; 329 while ((e = next)) { 330 next = e->next; 331 kfree(e); 332 } 333 } 334 335 struct inquiry_entry *hci_inquiry_cache_lookup(struct hci_dev *hdev, bdaddr_t *bdaddr) 336 { 337 struct inquiry_cache *cache = &hdev->inq_cache; 338 struct inquiry_entry *e; 339 340 BT_DBG("cache %p, %s", cache, batostr(bdaddr)); 341 342 for (e = cache->list; e; e = e->next) 343 if (!bacmp(&e->data.bdaddr, bdaddr)) 344 break; 345 return e; 346 } 347 348 void hci_inquiry_cache_update(struct hci_dev *hdev, struct inquiry_data *data) 349 { 350 struct inquiry_cache *cache = &hdev->inq_cache; 351 struct inquiry_entry *e; 352 353 BT_DBG("cache %p, %s", cache, batostr(&data->bdaddr)); 354 355 if (!(e = hci_inquiry_cache_lookup(hdev, &data->bdaddr))) { 356 /* Entry not in the cache. Add new one. */ 357 if (!(e = kzalloc(sizeof(struct inquiry_entry), GFP_ATOMIC))) 358 return; 359 e->next = cache->list; 360 cache->list = e; 361 } 362 363 memcpy(&e->data, data, sizeof(*data)); 364 e->timestamp = jiffies; 365 cache->timestamp = jiffies; 366 } 367 368 static int inquiry_cache_dump(struct hci_dev *hdev, int num, __u8 *buf) 369 { 370 struct inquiry_cache *cache = &hdev->inq_cache; 371 struct inquiry_info *info = (struct inquiry_info *) buf; 372 struct inquiry_entry *e; 373 int copied = 0; 374 375 for (e = cache->list; e && copied < num; e = e->next, copied++) { 376 struct inquiry_data *data = &e->data; 377 bacpy(&info->bdaddr, &data->bdaddr); 378 info->pscan_rep_mode = data->pscan_rep_mode; 379 info->pscan_period_mode = data->pscan_period_mode; 380 info->pscan_mode = data->pscan_mode; 381 memcpy(info->dev_class, data->dev_class, 3); 382 info->clock_offset = data->clock_offset; 383 info++; 384 } 385 386 BT_DBG("cache %p, copied %d", cache, copied); 387 return copied; 388 } 389 390 static void hci_inq_req(struct hci_dev *hdev, unsigned long opt) 391 { 392 struct hci_inquiry_req *ir = (struct hci_inquiry_req *) opt; 393 struct hci_cp_inquiry cp; 394 395 BT_DBG("%s", hdev->name); 396 397 if (test_bit(HCI_INQUIRY, &hdev->flags)) 398 return; 399 400 /* Start Inquiry */ 401 memcpy(&cp.lap, &ir->lap, 3); 402 cp.length = ir->length; 403 cp.num_rsp = ir->num_rsp; 404 hci_send_cmd(hdev, HCI_OP_INQUIRY, sizeof(cp), &cp); 405 } 406 407 int hci_inquiry(void __user *arg) 408 { 409 __u8 __user *ptr = arg; 410 struct hci_inquiry_req ir; 411 struct hci_dev *hdev; 412 int err = 0, do_inquiry = 0, max_rsp; 413 long timeo; 414 __u8 *buf; 415 416 if (copy_from_user(&ir, ptr, sizeof(ir))) 417 return -EFAULT; 418 419 if (!(hdev = hci_dev_get(ir.dev_id))) 420 return -ENODEV; 421 422 hci_dev_lock_bh(hdev); 423 if (inquiry_cache_age(hdev) > INQUIRY_CACHE_AGE_MAX || 424 inquiry_cache_empty(hdev) || 425 ir.flags & IREQ_CACHE_FLUSH) { 426 inquiry_cache_flush(hdev); 427 do_inquiry = 1; 428 } 429 hci_dev_unlock_bh(hdev); 430 431 timeo = ir.length * msecs_to_jiffies(2000); 432 if (do_inquiry && (err = hci_request(hdev, hci_inq_req, (unsigned long)&ir, timeo)) < 0) 433 goto done; 434 435 /* for unlimited number of responses we will use buffer with 255 entries */ 436 max_rsp = (ir.num_rsp == 0) ? 255 : ir.num_rsp; 437 438 /* cache_dump can't sleep. Therefore we allocate temp buffer and then 439 * copy it to the user space. 440 */ 441 if (!(buf = kmalloc(sizeof(struct inquiry_info) * max_rsp, GFP_KERNEL))) { 442 err = -ENOMEM; 443 goto done; 444 } 445 446 hci_dev_lock_bh(hdev); 447 ir.num_rsp = inquiry_cache_dump(hdev, max_rsp, buf); 448 hci_dev_unlock_bh(hdev); 449 450 BT_DBG("num_rsp %d", ir.num_rsp); 451 452 if (!copy_to_user(ptr, &ir, sizeof(ir))) { 453 ptr += sizeof(ir); 454 if (copy_to_user(ptr, buf, sizeof(struct inquiry_info) * 455 ir.num_rsp)) 456 err = -EFAULT; 457 } else 458 err = -EFAULT; 459 460 kfree(buf); 461 462 done: 463 hci_dev_put(hdev); 464 return err; 465 } 466 467 /* ---- HCI ioctl helpers ---- */ 468 469 int hci_dev_open(__u16 dev) 470 { 471 struct hci_dev *hdev; 472 int ret = 0; 473 474 if (!(hdev = hci_dev_get(dev))) 475 return -ENODEV; 476 477 BT_DBG("%s %p", hdev->name, hdev); 478 479 hci_req_lock(hdev); 480 481 if (test_bit(HCI_UP, &hdev->flags)) { 482 ret = -EALREADY; 483 goto done; 484 } 485 486 if (test_bit(HCI_QUIRK_RAW_DEVICE, &hdev->quirks)) 487 set_bit(HCI_RAW, &hdev->flags); 488 489 if (hdev->open(hdev)) { 490 ret = -EIO; 491 goto done; 492 } 493 494 if (!test_bit(HCI_RAW, &hdev->flags)) { 495 atomic_set(&hdev->cmd_cnt, 1); 496 set_bit(HCI_INIT, &hdev->flags); 497 498 //__hci_request(hdev, hci_reset_req, 0, HZ); 499 ret = __hci_request(hdev, hci_init_req, 0, 500 msecs_to_jiffies(HCI_INIT_TIMEOUT)); 501 502 clear_bit(HCI_INIT, &hdev->flags); 503 } 504 505 if (!ret) { 506 hci_dev_hold(hdev); 507 set_bit(HCI_UP, &hdev->flags); 508 hci_notify(hdev, HCI_DEV_UP); 509 } else { 510 /* Init failed, cleanup */ 511 tasklet_kill(&hdev->rx_task); 512 tasklet_kill(&hdev->tx_task); 513 tasklet_kill(&hdev->cmd_task); 514 515 skb_queue_purge(&hdev->cmd_q); 516 skb_queue_purge(&hdev->rx_q); 517 518 if (hdev->flush) 519 hdev->flush(hdev); 520 521 if (hdev->sent_cmd) { 522 kfree_skb(hdev->sent_cmd); 523 hdev->sent_cmd = NULL; 524 } 525 526 hdev->close(hdev); 527 hdev->flags = 0; 528 } 529 530 done: 531 hci_req_unlock(hdev); 532 hci_dev_put(hdev); 533 return ret; 534 } 535 536 static int hci_dev_do_close(struct hci_dev *hdev) 537 { 538 BT_DBG("%s %p", hdev->name, hdev); 539 540 hci_req_cancel(hdev, ENODEV); 541 hci_req_lock(hdev); 542 543 if (!test_and_clear_bit(HCI_UP, &hdev->flags)) { 544 hci_req_unlock(hdev); 545 return 0; 546 } 547 548 /* Kill RX and TX tasks */ 549 tasklet_kill(&hdev->rx_task); 550 tasklet_kill(&hdev->tx_task); 551 552 hci_dev_lock_bh(hdev); 553 inquiry_cache_flush(hdev); 554 hci_conn_hash_flush(hdev); 555 hci_dev_unlock_bh(hdev); 556 557 hci_notify(hdev, HCI_DEV_DOWN); 558 559 if (hdev->flush) 560 hdev->flush(hdev); 561 562 /* Reset device */ 563 skb_queue_purge(&hdev->cmd_q); 564 atomic_set(&hdev->cmd_cnt, 1); 565 if (!test_bit(HCI_RAW, &hdev->flags)) { 566 set_bit(HCI_INIT, &hdev->flags); 567 __hci_request(hdev, hci_reset_req, 0, 568 msecs_to_jiffies(250)); 569 clear_bit(HCI_INIT, &hdev->flags); 570 } 571 572 /* Kill cmd task */ 573 tasklet_kill(&hdev->cmd_task); 574 575 /* Drop queues */ 576 skb_queue_purge(&hdev->rx_q); 577 skb_queue_purge(&hdev->cmd_q); 578 skb_queue_purge(&hdev->raw_q); 579 580 /* Drop last sent command */ 581 if (hdev->sent_cmd) { 582 kfree_skb(hdev->sent_cmd); 583 hdev->sent_cmd = NULL; 584 } 585 586 /* After this point our queues are empty 587 * and no tasks are scheduled. */ 588 hdev->close(hdev); 589 590 /* Clear flags */ 591 hdev->flags = 0; 592 593 hci_req_unlock(hdev); 594 595 hci_dev_put(hdev); 596 return 0; 597 } 598 599 int hci_dev_close(__u16 dev) 600 { 601 struct hci_dev *hdev; 602 int err; 603 604 if (!(hdev = hci_dev_get(dev))) 605 return -ENODEV; 606 err = hci_dev_do_close(hdev); 607 hci_dev_put(hdev); 608 return err; 609 } 610 611 int hci_dev_reset(__u16 dev) 612 { 613 struct hci_dev *hdev; 614 int ret = 0; 615 616 if (!(hdev = hci_dev_get(dev))) 617 return -ENODEV; 618 619 hci_req_lock(hdev); 620 tasklet_disable(&hdev->tx_task); 621 622 if (!test_bit(HCI_UP, &hdev->flags)) 623 goto done; 624 625 /* Drop queues */ 626 skb_queue_purge(&hdev->rx_q); 627 skb_queue_purge(&hdev->cmd_q); 628 629 hci_dev_lock_bh(hdev); 630 inquiry_cache_flush(hdev); 631 hci_conn_hash_flush(hdev); 632 hci_dev_unlock_bh(hdev); 633 634 if (hdev->flush) 635 hdev->flush(hdev); 636 637 atomic_set(&hdev->cmd_cnt, 1); 638 hdev->acl_cnt = 0; hdev->sco_cnt = 0; 639 640 if (!test_bit(HCI_RAW, &hdev->flags)) 641 ret = __hci_request(hdev, hci_reset_req, 0, 642 msecs_to_jiffies(HCI_INIT_TIMEOUT)); 643 644 done: 645 tasklet_enable(&hdev->tx_task); 646 hci_req_unlock(hdev); 647 hci_dev_put(hdev); 648 return ret; 649 } 650 651 int hci_dev_reset_stat(__u16 dev) 652 { 653 struct hci_dev *hdev; 654 int ret = 0; 655 656 if (!(hdev = hci_dev_get(dev))) 657 return -ENODEV; 658 659 memset(&hdev->stat, 0, sizeof(struct hci_dev_stats)); 660 661 hci_dev_put(hdev); 662 663 return ret; 664 } 665 666 int hci_dev_cmd(unsigned int cmd, void __user *arg) 667 { 668 struct hci_dev *hdev; 669 struct hci_dev_req dr; 670 int err = 0; 671 672 if (copy_from_user(&dr, arg, sizeof(dr))) 673 return -EFAULT; 674 675 if (!(hdev = hci_dev_get(dr.dev_id))) 676 return -ENODEV; 677 678 switch (cmd) { 679 case HCISETAUTH: 680 err = hci_request(hdev, hci_auth_req, dr.dev_opt, 681 msecs_to_jiffies(HCI_INIT_TIMEOUT)); 682 break; 683 684 case HCISETENCRYPT: 685 if (!lmp_encrypt_capable(hdev)) { 686 err = -EOPNOTSUPP; 687 break; 688 } 689 690 if (!test_bit(HCI_AUTH, &hdev->flags)) { 691 /* Auth must be enabled first */ 692 err = hci_request(hdev, hci_auth_req, dr.dev_opt, 693 msecs_to_jiffies(HCI_INIT_TIMEOUT)); 694 if (err) 695 break; 696 } 697 698 err = hci_request(hdev, hci_encrypt_req, dr.dev_opt, 699 msecs_to_jiffies(HCI_INIT_TIMEOUT)); 700 break; 701 702 case HCISETSCAN: 703 err = hci_request(hdev, hci_scan_req, dr.dev_opt, 704 msecs_to_jiffies(HCI_INIT_TIMEOUT)); 705 break; 706 707 case HCISETLINKPOL: 708 err = hci_request(hdev, hci_linkpol_req, dr.dev_opt, 709 msecs_to_jiffies(HCI_INIT_TIMEOUT)); 710 break; 711 712 case HCISETLINKMODE: 713 hdev->link_mode = ((__u16) dr.dev_opt) & 714 (HCI_LM_MASTER | HCI_LM_ACCEPT); 715 break; 716 717 case HCISETPTYPE: 718 hdev->pkt_type = (__u16) dr.dev_opt; 719 break; 720 721 case HCISETACLMTU: 722 hdev->acl_mtu = *((__u16 *) &dr.dev_opt + 1); 723 hdev->acl_pkts = *((__u16 *) &dr.dev_opt + 0); 724 break; 725 726 case HCISETSCOMTU: 727 hdev->sco_mtu = *((__u16 *) &dr.dev_opt + 1); 728 hdev->sco_pkts = *((__u16 *) &dr.dev_opt + 0); 729 break; 730 731 default: 732 err = -EINVAL; 733 break; 734 } 735 736 hci_dev_put(hdev); 737 return err; 738 } 739 740 int hci_get_dev_list(void __user *arg) 741 { 742 struct hci_dev_list_req *dl; 743 struct hci_dev_req *dr; 744 struct list_head *p; 745 int n = 0, size, err; 746 __u16 dev_num; 747 748 if (get_user(dev_num, (__u16 __user *) arg)) 749 return -EFAULT; 750 751 if (!dev_num || dev_num > (PAGE_SIZE * 2) / sizeof(*dr)) 752 return -EINVAL; 753 754 size = sizeof(*dl) + dev_num * sizeof(*dr); 755 756 if (!(dl = kmalloc(size, GFP_KERNEL))) 757 return -ENOMEM; 758 759 dr = dl->dev_req; 760 761 read_lock_bh(&hci_dev_list_lock); 762 list_for_each(p, &hci_dev_list) { 763 struct hci_dev *hdev; 764 hdev = list_entry(p, struct hci_dev, list); 765 (dr + n)->dev_id = hdev->id; 766 (dr + n)->dev_opt = hdev->flags; 767 if (++n >= dev_num) 768 break; 769 } 770 read_unlock_bh(&hci_dev_list_lock); 771 772 dl->dev_num = n; 773 size = sizeof(*dl) + n * sizeof(*dr); 774 775 err = copy_to_user(arg, dl, size); 776 kfree(dl); 777 778 return err ? -EFAULT : 0; 779 } 780 781 int hci_get_dev_info(void __user *arg) 782 { 783 struct hci_dev *hdev; 784 struct hci_dev_info di; 785 int err = 0; 786 787 if (copy_from_user(&di, arg, sizeof(di))) 788 return -EFAULT; 789 790 if (!(hdev = hci_dev_get(di.dev_id))) 791 return -ENODEV; 792 793 strcpy(di.name, hdev->name); 794 di.bdaddr = hdev->bdaddr; 795 di.type = hdev->type; 796 di.flags = hdev->flags; 797 di.pkt_type = hdev->pkt_type; 798 di.acl_mtu = hdev->acl_mtu; 799 di.acl_pkts = hdev->acl_pkts; 800 di.sco_mtu = hdev->sco_mtu; 801 di.sco_pkts = hdev->sco_pkts; 802 di.link_policy = hdev->link_policy; 803 di.link_mode = hdev->link_mode; 804 805 memcpy(&di.stat, &hdev->stat, sizeof(di.stat)); 806 memcpy(&di.features, &hdev->features, sizeof(di.features)); 807 808 if (copy_to_user(arg, &di, sizeof(di))) 809 err = -EFAULT; 810 811 hci_dev_put(hdev); 812 813 return err; 814 } 815 816 /* ---- Interface to HCI drivers ---- */ 817 818 /* Alloc HCI device */ 819 struct hci_dev *hci_alloc_dev(void) 820 { 821 struct hci_dev *hdev; 822 823 hdev = kzalloc(sizeof(struct hci_dev), GFP_KERNEL); 824 if (!hdev) 825 return NULL; 826 827 skb_queue_head_init(&hdev->driver_init); 828 829 return hdev; 830 } 831 EXPORT_SYMBOL(hci_alloc_dev); 832 833 /* Free HCI device */ 834 void hci_free_dev(struct hci_dev *hdev) 835 { 836 skb_queue_purge(&hdev->driver_init); 837 838 /* will free via device release */ 839 put_device(&hdev->dev); 840 } 841 EXPORT_SYMBOL(hci_free_dev); 842 843 /* Register HCI device */ 844 int hci_register_dev(struct hci_dev *hdev) 845 { 846 struct list_head *head = &hci_dev_list, *p; 847 int i, id = 0; 848 849 BT_DBG("%p name %s type %d owner %p", hdev, hdev->name, hdev->type, hdev->owner); 850 851 if (!hdev->open || !hdev->close || !hdev->destruct) 852 return -EINVAL; 853 854 write_lock_bh(&hci_dev_list_lock); 855 856 /* Find first available device id */ 857 list_for_each(p, &hci_dev_list) { 858 if (list_entry(p, struct hci_dev, list)->id != id) 859 break; 860 head = p; id++; 861 } 862 863 sprintf(hdev->name, "hci%d", id); 864 hdev->id = id; 865 list_add(&hdev->list, head); 866 867 atomic_set(&hdev->refcnt, 1); 868 spin_lock_init(&hdev->lock); 869 870 hdev->flags = 0; 871 hdev->pkt_type = (HCI_DM1 | HCI_DH1 | HCI_HV1); 872 hdev->esco_type = (ESCO_HV1); 873 hdev->link_mode = (HCI_LM_ACCEPT); 874 875 hdev->idle_timeout = 0; 876 hdev->sniff_max_interval = 800; 877 hdev->sniff_min_interval = 80; 878 879 tasklet_init(&hdev->cmd_task, hci_cmd_task,(unsigned long) hdev); 880 tasklet_init(&hdev->rx_task, hci_rx_task, (unsigned long) hdev); 881 tasklet_init(&hdev->tx_task, hci_tx_task, (unsigned long) hdev); 882 883 skb_queue_head_init(&hdev->rx_q); 884 skb_queue_head_init(&hdev->cmd_q); 885 skb_queue_head_init(&hdev->raw_q); 886 887 for (i = 0; i < 3; i++) 888 hdev->reassembly[i] = NULL; 889 890 init_waitqueue_head(&hdev->req_wait_q); 891 init_MUTEX(&hdev->req_lock); 892 893 inquiry_cache_init(hdev); 894 895 hci_conn_hash_init(hdev); 896 897 memset(&hdev->stat, 0, sizeof(struct hci_dev_stats)); 898 899 atomic_set(&hdev->promisc, 0); 900 901 write_unlock_bh(&hci_dev_list_lock); 902 903 hci_register_sysfs(hdev); 904 905 hci_notify(hdev, HCI_DEV_REG); 906 907 return id; 908 } 909 EXPORT_SYMBOL(hci_register_dev); 910 911 /* Unregister HCI device */ 912 int hci_unregister_dev(struct hci_dev *hdev) 913 { 914 int i; 915 916 BT_DBG("%p name %s type %d", hdev, hdev->name, hdev->type); 917 918 write_lock_bh(&hci_dev_list_lock); 919 list_del(&hdev->list); 920 write_unlock_bh(&hci_dev_list_lock); 921 922 hci_dev_do_close(hdev); 923 924 for (i = 0; i < 3; i++) 925 kfree_skb(hdev->reassembly[i]); 926 927 hci_notify(hdev, HCI_DEV_UNREG); 928 929 hci_unregister_sysfs(hdev); 930 931 __hci_dev_put(hdev); 932 933 return 0; 934 } 935 EXPORT_SYMBOL(hci_unregister_dev); 936 937 /* Suspend HCI device */ 938 int hci_suspend_dev(struct hci_dev *hdev) 939 { 940 hci_notify(hdev, HCI_DEV_SUSPEND); 941 return 0; 942 } 943 EXPORT_SYMBOL(hci_suspend_dev); 944 945 /* Resume HCI device */ 946 int hci_resume_dev(struct hci_dev *hdev) 947 { 948 hci_notify(hdev, HCI_DEV_RESUME); 949 return 0; 950 } 951 EXPORT_SYMBOL(hci_resume_dev); 952 953 /* Receive packet type fragment */ 954 #define __reassembly(hdev, type) ((hdev)->reassembly[(type) - 2]) 955 956 int hci_recv_fragment(struct hci_dev *hdev, int type, void *data, int count) 957 { 958 if (type < HCI_ACLDATA_PKT || type > HCI_EVENT_PKT) 959 return -EILSEQ; 960 961 while (count) { 962 struct sk_buff *skb = __reassembly(hdev, type); 963 struct { int expect; } *scb; 964 int len = 0; 965 966 if (!skb) { 967 /* Start of the frame */ 968 969 switch (type) { 970 case HCI_EVENT_PKT: 971 if (count >= HCI_EVENT_HDR_SIZE) { 972 struct hci_event_hdr *h = data; 973 len = HCI_EVENT_HDR_SIZE + h->plen; 974 } else 975 return -EILSEQ; 976 break; 977 978 case HCI_ACLDATA_PKT: 979 if (count >= HCI_ACL_HDR_SIZE) { 980 struct hci_acl_hdr *h = data; 981 len = HCI_ACL_HDR_SIZE + __le16_to_cpu(h->dlen); 982 } else 983 return -EILSEQ; 984 break; 985 986 case HCI_SCODATA_PKT: 987 if (count >= HCI_SCO_HDR_SIZE) { 988 struct hci_sco_hdr *h = data; 989 len = HCI_SCO_HDR_SIZE + h->dlen; 990 } else 991 return -EILSEQ; 992 break; 993 } 994 995 skb = bt_skb_alloc(len, GFP_ATOMIC); 996 if (!skb) { 997 BT_ERR("%s no memory for packet", hdev->name); 998 return -ENOMEM; 999 } 1000 1001 skb->dev = (void *) hdev; 1002 bt_cb(skb)->pkt_type = type; 1003 1004 __reassembly(hdev, type) = skb; 1005 1006 scb = (void *) skb->cb; 1007 scb->expect = len; 1008 } else { 1009 /* Continuation */ 1010 1011 scb = (void *) skb->cb; 1012 len = scb->expect; 1013 } 1014 1015 len = min(len, count); 1016 1017 memcpy(skb_put(skb, len), data, len); 1018 1019 scb->expect -= len; 1020 1021 if (scb->expect == 0) { 1022 /* Complete frame */ 1023 1024 __reassembly(hdev, type) = NULL; 1025 1026 bt_cb(skb)->pkt_type = type; 1027 hci_recv_frame(skb); 1028 } 1029 1030 count -= len; data += len; 1031 } 1032 1033 return 0; 1034 } 1035 EXPORT_SYMBOL(hci_recv_fragment); 1036 1037 /* ---- Interface to upper protocols ---- */ 1038 1039 /* Register/Unregister protocols. 1040 * hci_task_lock is used to ensure that no tasks are running. */ 1041 int hci_register_proto(struct hci_proto *hp) 1042 { 1043 int err = 0; 1044 1045 BT_DBG("%p name %s id %d", hp, hp->name, hp->id); 1046 1047 if (hp->id >= HCI_MAX_PROTO) 1048 return -EINVAL; 1049 1050 write_lock_bh(&hci_task_lock); 1051 1052 if (!hci_proto[hp->id]) 1053 hci_proto[hp->id] = hp; 1054 else 1055 err = -EEXIST; 1056 1057 write_unlock_bh(&hci_task_lock); 1058 1059 return err; 1060 } 1061 EXPORT_SYMBOL(hci_register_proto); 1062 1063 int hci_unregister_proto(struct hci_proto *hp) 1064 { 1065 int err = 0; 1066 1067 BT_DBG("%p name %s id %d", hp, hp->name, hp->id); 1068 1069 if (hp->id >= HCI_MAX_PROTO) 1070 return -EINVAL; 1071 1072 write_lock_bh(&hci_task_lock); 1073 1074 if (hci_proto[hp->id]) 1075 hci_proto[hp->id] = NULL; 1076 else 1077 err = -ENOENT; 1078 1079 write_unlock_bh(&hci_task_lock); 1080 1081 return err; 1082 } 1083 EXPORT_SYMBOL(hci_unregister_proto); 1084 1085 int hci_register_cb(struct hci_cb *cb) 1086 { 1087 BT_DBG("%p name %s", cb, cb->name); 1088 1089 write_lock_bh(&hci_cb_list_lock); 1090 list_add(&cb->list, &hci_cb_list); 1091 write_unlock_bh(&hci_cb_list_lock); 1092 1093 return 0; 1094 } 1095 EXPORT_SYMBOL(hci_register_cb); 1096 1097 int hci_unregister_cb(struct hci_cb *cb) 1098 { 1099 BT_DBG("%p name %s", cb, cb->name); 1100 1101 write_lock_bh(&hci_cb_list_lock); 1102 list_del(&cb->list); 1103 write_unlock_bh(&hci_cb_list_lock); 1104 1105 return 0; 1106 } 1107 EXPORT_SYMBOL(hci_unregister_cb); 1108 1109 static int hci_send_frame(struct sk_buff *skb) 1110 { 1111 struct hci_dev *hdev = (struct hci_dev *) skb->dev; 1112 1113 if (!hdev) { 1114 kfree_skb(skb); 1115 return -ENODEV; 1116 } 1117 1118 BT_DBG("%s type %d len %d", hdev->name, bt_cb(skb)->pkt_type, skb->len); 1119 1120 if (atomic_read(&hdev->promisc)) { 1121 /* Time stamp */ 1122 __net_timestamp(skb); 1123 1124 hci_send_to_sock(hdev, skb); 1125 } 1126 1127 /* Get rid of skb owner, prior to sending to the driver. */ 1128 skb_orphan(skb); 1129 1130 return hdev->send(skb); 1131 } 1132 1133 /* Send HCI command */ 1134 int hci_send_cmd(struct hci_dev *hdev, __u16 opcode, __u32 plen, void *param) 1135 { 1136 int len = HCI_COMMAND_HDR_SIZE + plen; 1137 struct hci_command_hdr *hdr; 1138 struct sk_buff *skb; 1139 1140 BT_DBG("%s opcode 0x%x plen %d", hdev->name, opcode, plen); 1141 1142 skb = bt_skb_alloc(len, GFP_ATOMIC); 1143 if (!skb) { 1144 BT_ERR("%s no memory for command", hdev->name); 1145 return -ENOMEM; 1146 } 1147 1148 hdr = (struct hci_command_hdr *) skb_put(skb, HCI_COMMAND_HDR_SIZE); 1149 hdr->opcode = cpu_to_le16(opcode); 1150 hdr->plen = plen; 1151 1152 if (plen) 1153 memcpy(skb_put(skb, plen), param, plen); 1154 1155 BT_DBG("skb len %d", skb->len); 1156 1157 bt_cb(skb)->pkt_type = HCI_COMMAND_PKT; 1158 skb->dev = (void *) hdev; 1159 skb_queue_tail(&hdev->cmd_q, skb); 1160 hci_sched_cmd(hdev); 1161 1162 return 0; 1163 } 1164 1165 /* Get data from the previously sent command */ 1166 void *hci_sent_cmd_data(struct hci_dev *hdev, __u16 opcode) 1167 { 1168 struct hci_command_hdr *hdr; 1169 1170 if (!hdev->sent_cmd) 1171 return NULL; 1172 1173 hdr = (void *) hdev->sent_cmd->data; 1174 1175 if (hdr->opcode != cpu_to_le16(opcode)) 1176 return NULL; 1177 1178 BT_DBG("%s opcode 0x%x", hdev->name, opcode); 1179 1180 return hdev->sent_cmd->data + HCI_COMMAND_HDR_SIZE; 1181 } 1182 1183 /* Send ACL data */ 1184 static void hci_add_acl_hdr(struct sk_buff *skb, __u16 handle, __u16 flags) 1185 { 1186 struct hci_acl_hdr *hdr; 1187 int len = skb->len; 1188 1189 skb_push(skb, HCI_ACL_HDR_SIZE); 1190 skb_reset_transport_header(skb); 1191 hdr = (struct hci_acl_hdr *)skb_transport_header(skb); 1192 hdr->handle = cpu_to_le16(hci_handle_pack(handle, flags)); 1193 hdr->dlen = cpu_to_le16(len); 1194 } 1195 1196 int hci_send_acl(struct hci_conn *conn, struct sk_buff *skb, __u16 flags) 1197 { 1198 struct hci_dev *hdev = conn->hdev; 1199 struct sk_buff *list; 1200 1201 BT_DBG("%s conn %p flags 0x%x", hdev->name, conn, flags); 1202 1203 skb->dev = (void *) hdev; 1204 bt_cb(skb)->pkt_type = HCI_ACLDATA_PKT; 1205 hci_add_acl_hdr(skb, conn->handle, flags | ACL_START); 1206 1207 if (!(list = skb_shinfo(skb)->frag_list)) { 1208 /* Non fragmented */ 1209 BT_DBG("%s nonfrag skb %p len %d", hdev->name, skb, skb->len); 1210 1211 skb_queue_tail(&conn->data_q, skb); 1212 } else { 1213 /* Fragmented */ 1214 BT_DBG("%s frag %p len %d", hdev->name, skb, skb->len); 1215 1216 skb_shinfo(skb)->frag_list = NULL; 1217 1218 /* Queue all fragments atomically */ 1219 spin_lock_bh(&conn->data_q.lock); 1220 1221 __skb_queue_tail(&conn->data_q, skb); 1222 do { 1223 skb = list; list = list->next; 1224 1225 skb->dev = (void *) hdev; 1226 bt_cb(skb)->pkt_type = HCI_ACLDATA_PKT; 1227 hci_add_acl_hdr(skb, conn->handle, flags | ACL_CONT); 1228 1229 BT_DBG("%s frag %p len %d", hdev->name, skb, skb->len); 1230 1231 __skb_queue_tail(&conn->data_q, skb); 1232 } while (list); 1233 1234 spin_unlock_bh(&conn->data_q.lock); 1235 } 1236 1237 hci_sched_tx(hdev); 1238 return 0; 1239 } 1240 EXPORT_SYMBOL(hci_send_acl); 1241 1242 /* Send SCO data */ 1243 int hci_send_sco(struct hci_conn *conn, struct sk_buff *skb) 1244 { 1245 struct hci_dev *hdev = conn->hdev; 1246 struct hci_sco_hdr hdr; 1247 1248 BT_DBG("%s len %d", hdev->name, skb->len); 1249 1250 if (skb->len > hdev->sco_mtu) { 1251 kfree_skb(skb); 1252 return -EINVAL; 1253 } 1254 1255 hdr.handle = cpu_to_le16(conn->handle); 1256 hdr.dlen = skb->len; 1257 1258 skb_push(skb, HCI_SCO_HDR_SIZE); 1259 skb_reset_transport_header(skb); 1260 memcpy(skb_transport_header(skb), &hdr, HCI_SCO_HDR_SIZE); 1261 1262 skb->dev = (void *) hdev; 1263 bt_cb(skb)->pkt_type = HCI_SCODATA_PKT; 1264 skb_queue_tail(&conn->data_q, skb); 1265 hci_sched_tx(hdev); 1266 return 0; 1267 } 1268 EXPORT_SYMBOL(hci_send_sco); 1269 1270 /* ---- HCI TX task (outgoing data) ---- */ 1271 1272 /* HCI Connection scheduler */ 1273 static inline struct hci_conn *hci_low_sent(struct hci_dev *hdev, __u8 type, int *quote) 1274 { 1275 struct hci_conn_hash *h = &hdev->conn_hash; 1276 struct hci_conn *conn = NULL; 1277 int num = 0, min = ~0; 1278 struct list_head *p; 1279 1280 /* We don't have to lock device here. Connections are always 1281 * added and removed with TX task disabled. */ 1282 list_for_each(p, &h->list) { 1283 struct hci_conn *c; 1284 c = list_entry(p, struct hci_conn, list); 1285 1286 if (c->type != type || skb_queue_empty(&c->data_q)) 1287 continue; 1288 1289 if (c->state != BT_CONNECTED && c->state != BT_CONFIG) 1290 continue; 1291 1292 num++; 1293 1294 if (c->sent < min) { 1295 min = c->sent; 1296 conn = c; 1297 } 1298 } 1299 1300 if (conn) { 1301 int cnt = (type == ACL_LINK ? hdev->acl_cnt : hdev->sco_cnt); 1302 int q = cnt / num; 1303 *quote = q ? q : 1; 1304 } else 1305 *quote = 0; 1306 1307 BT_DBG("conn %p quote %d", conn, *quote); 1308 return conn; 1309 } 1310 1311 static inline void hci_acl_tx_to(struct hci_dev *hdev) 1312 { 1313 struct hci_conn_hash *h = &hdev->conn_hash; 1314 struct list_head *p; 1315 struct hci_conn *c; 1316 1317 BT_ERR("%s ACL tx timeout", hdev->name); 1318 1319 /* Kill stalled connections */ 1320 list_for_each(p, &h->list) { 1321 c = list_entry(p, struct hci_conn, list); 1322 if (c->type == ACL_LINK && c->sent) { 1323 BT_ERR("%s killing stalled ACL connection %s", 1324 hdev->name, batostr(&c->dst)); 1325 hci_acl_disconn(c, 0x13); 1326 } 1327 } 1328 } 1329 1330 static inline void hci_sched_acl(struct hci_dev *hdev) 1331 { 1332 struct hci_conn *conn; 1333 struct sk_buff *skb; 1334 int quote; 1335 1336 BT_DBG("%s", hdev->name); 1337 1338 if (!test_bit(HCI_RAW, &hdev->flags)) { 1339 /* ACL tx timeout must be longer than maximum 1340 * link supervision timeout (40.9 seconds) */ 1341 if (!hdev->acl_cnt && time_after(jiffies, hdev->acl_last_tx + HZ * 45)) 1342 hci_acl_tx_to(hdev); 1343 } 1344 1345 while (hdev->acl_cnt && (conn = hci_low_sent(hdev, ACL_LINK, "e))) { 1346 while (quote-- && (skb = skb_dequeue(&conn->data_q))) { 1347 BT_DBG("skb %p len %d", skb, skb->len); 1348 1349 hci_conn_enter_active_mode(conn); 1350 1351 hci_send_frame(skb); 1352 hdev->acl_last_tx = jiffies; 1353 1354 hdev->acl_cnt--; 1355 conn->sent++; 1356 } 1357 } 1358 } 1359 1360 /* Schedule SCO */ 1361 static inline void hci_sched_sco(struct hci_dev *hdev) 1362 { 1363 struct hci_conn *conn; 1364 struct sk_buff *skb; 1365 int quote; 1366 1367 BT_DBG("%s", hdev->name); 1368 1369 while (hdev->sco_cnt && (conn = hci_low_sent(hdev, SCO_LINK, "e))) { 1370 while (quote-- && (skb = skb_dequeue(&conn->data_q))) { 1371 BT_DBG("skb %p len %d", skb, skb->len); 1372 hci_send_frame(skb); 1373 1374 conn->sent++; 1375 if (conn->sent == ~0) 1376 conn->sent = 0; 1377 } 1378 } 1379 } 1380 1381 static inline void hci_sched_esco(struct hci_dev *hdev) 1382 { 1383 struct hci_conn *conn; 1384 struct sk_buff *skb; 1385 int quote; 1386 1387 BT_DBG("%s", hdev->name); 1388 1389 while (hdev->sco_cnt && (conn = hci_low_sent(hdev, ESCO_LINK, "e))) { 1390 while (quote-- && (skb = skb_dequeue(&conn->data_q))) { 1391 BT_DBG("skb %p len %d", skb, skb->len); 1392 hci_send_frame(skb); 1393 1394 conn->sent++; 1395 if (conn->sent == ~0) 1396 conn->sent = 0; 1397 } 1398 } 1399 } 1400 1401 static void hci_tx_task(unsigned long arg) 1402 { 1403 struct hci_dev *hdev = (struct hci_dev *) arg; 1404 struct sk_buff *skb; 1405 1406 read_lock(&hci_task_lock); 1407 1408 BT_DBG("%s acl %d sco %d", hdev->name, hdev->acl_cnt, hdev->sco_cnt); 1409 1410 /* Schedule queues and send stuff to HCI driver */ 1411 1412 hci_sched_acl(hdev); 1413 1414 hci_sched_sco(hdev); 1415 1416 hci_sched_esco(hdev); 1417 1418 /* Send next queued raw (unknown type) packet */ 1419 while ((skb = skb_dequeue(&hdev->raw_q))) 1420 hci_send_frame(skb); 1421 1422 read_unlock(&hci_task_lock); 1423 } 1424 1425 /* ----- HCI RX task (incoming data proccessing) ----- */ 1426 1427 /* ACL data packet */ 1428 static inline void hci_acldata_packet(struct hci_dev *hdev, struct sk_buff *skb) 1429 { 1430 struct hci_acl_hdr *hdr = (void *) skb->data; 1431 struct hci_conn *conn; 1432 __u16 handle, flags; 1433 1434 skb_pull(skb, HCI_ACL_HDR_SIZE); 1435 1436 handle = __le16_to_cpu(hdr->handle); 1437 flags = hci_flags(handle); 1438 handle = hci_handle(handle); 1439 1440 BT_DBG("%s len %d handle 0x%x flags 0x%x", hdev->name, skb->len, handle, flags); 1441 1442 hdev->stat.acl_rx++; 1443 1444 hci_dev_lock(hdev); 1445 conn = hci_conn_hash_lookup_handle(hdev, handle); 1446 hci_dev_unlock(hdev); 1447 1448 if (conn) { 1449 register struct hci_proto *hp; 1450 1451 hci_conn_enter_active_mode(conn); 1452 1453 /* Send to upper protocol */ 1454 if ((hp = hci_proto[HCI_PROTO_L2CAP]) && hp->recv_acldata) { 1455 hp->recv_acldata(conn, skb, flags); 1456 return; 1457 } 1458 } else { 1459 BT_ERR("%s ACL packet for unknown connection handle %d", 1460 hdev->name, handle); 1461 } 1462 1463 kfree_skb(skb); 1464 } 1465 1466 /* SCO data packet */ 1467 static inline void hci_scodata_packet(struct hci_dev *hdev, struct sk_buff *skb) 1468 { 1469 struct hci_sco_hdr *hdr = (void *) skb->data; 1470 struct hci_conn *conn; 1471 __u16 handle; 1472 1473 skb_pull(skb, HCI_SCO_HDR_SIZE); 1474 1475 handle = __le16_to_cpu(hdr->handle); 1476 1477 BT_DBG("%s len %d handle 0x%x", hdev->name, skb->len, handle); 1478 1479 hdev->stat.sco_rx++; 1480 1481 hci_dev_lock(hdev); 1482 conn = hci_conn_hash_lookup_handle(hdev, handle); 1483 hci_dev_unlock(hdev); 1484 1485 if (conn) { 1486 register struct hci_proto *hp; 1487 1488 /* Send to upper protocol */ 1489 if ((hp = hci_proto[HCI_PROTO_SCO]) && hp->recv_scodata) { 1490 hp->recv_scodata(conn, skb); 1491 return; 1492 } 1493 } else { 1494 BT_ERR("%s SCO packet for unknown connection handle %d", 1495 hdev->name, handle); 1496 } 1497 1498 kfree_skb(skb); 1499 } 1500 1501 static void hci_rx_task(unsigned long arg) 1502 { 1503 struct hci_dev *hdev = (struct hci_dev *) arg; 1504 struct sk_buff *skb; 1505 1506 BT_DBG("%s", hdev->name); 1507 1508 read_lock(&hci_task_lock); 1509 1510 while ((skb = skb_dequeue(&hdev->rx_q))) { 1511 if (atomic_read(&hdev->promisc)) { 1512 /* Send copy to the sockets */ 1513 hci_send_to_sock(hdev, skb); 1514 } 1515 1516 if (test_bit(HCI_RAW, &hdev->flags)) { 1517 kfree_skb(skb); 1518 continue; 1519 } 1520 1521 if (test_bit(HCI_INIT, &hdev->flags)) { 1522 /* Don't process data packets in this states. */ 1523 switch (bt_cb(skb)->pkt_type) { 1524 case HCI_ACLDATA_PKT: 1525 case HCI_SCODATA_PKT: 1526 kfree_skb(skb); 1527 continue; 1528 } 1529 } 1530 1531 /* Process frame */ 1532 switch (bt_cb(skb)->pkt_type) { 1533 case HCI_EVENT_PKT: 1534 hci_event_packet(hdev, skb); 1535 break; 1536 1537 case HCI_ACLDATA_PKT: 1538 BT_DBG("%s ACL data packet", hdev->name); 1539 hci_acldata_packet(hdev, skb); 1540 break; 1541 1542 case HCI_SCODATA_PKT: 1543 BT_DBG("%s SCO data packet", hdev->name); 1544 hci_scodata_packet(hdev, skb); 1545 break; 1546 1547 default: 1548 kfree_skb(skb); 1549 break; 1550 } 1551 } 1552 1553 read_unlock(&hci_task_lock); 1554 } 1555 1556 static void hci_cmd_task(unsigned long arg) 1557 { 1558 struct hci_dev *hdev = (struct hci_dev *) arg; 1559 struct sk_buff *skb; 1560 1561 BT_DBG("%s cmd %d", hdev->name, atomic_read(&hdev->cmd_cnt)); 1562 1563 if (!atomic_read(&hdev->cmd_cnt) && time_after(jiffies, hdev->cmd_last_tx + HZ)) { 1564 BT_ERR("%s command tx timeout", hdev->name); 1565 atomic_set(&hdev->cmd_cnt, 1); 1566 } 1567 1568 /* Send queued commands */ 1569 if (atomic_read(&hdev->cmd_cnt) && (skb = skb_dequeue(&hdev->cmd_q))) { 1570 if (hdev->sent_cmd) 1571 kfree_skb(hdev->sent_cmd); 1572 1573 if ((hdev->sent_cmd = skb_clone(skb, GFP_ATOMIC))) { 1574 atomic_dec(&hdev->cmd_cnt); 1575 hci_send_frame(skb); 1576 hdev->cmd_last_tx = jiffies; 1577 } else { 1578 skb_queue_head(&hdev->cmd_q, skb); 1579 hci_sched_cmd(hdev); 1580 } 1581 } 1582 } 1583