1 /* 2 BlueZ - Bluetooth protocol stack for Linux 3 Copyright (C) 2000-2001 Qualcomm Incorporated 4 5 Written 2000,2001 by Maxim Krasnyansky <maxk@qualcomm.com> 6 7 This program is free software; you can redistribute it and/or modify 8 it under the terms of the GNU General Public License version 2 as 9 published by the Free Software Foundation; 10 11 THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS 12 OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, 13 FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS. 14 IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY 15 CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES 16 WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN 17 ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF 18 OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. 19 20 ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS, 21 COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS 22 SOFTWARE IS DISCLAIMED. 23 */ 24 25 /* Bluetooth HCI core. */ 26 27 #include <linux/module.h> 28 #include <linux/kmod.h> 29 30 #include <linux/types.h> 31 #include <linux/errno.h> 32 #include <linux/kernel.h> 33 #include <linux/sched.h> 34 #include <linux/slab.h> 35 #include <linux/poll.h> 36 #include <linux/fcntl.h> 37 #include <linux/init.h> 38 #include <linux/skbuff.h> 39 #include <linux/interrupt.h> 40 #include <linux/notifier.h> 41 #include <net/sock.h> 42 43 #include <asm/system.h> 44 #include <asm/uaccess.h> 45 #include <asm/unaligned.h> 46 47 #include <net/bluetooth/bluetooth.h> 48 #include <net/bluetooth/hci_core.h> 49 50 #ifndef CONFIG_BT_HCI_CORE_DEBUG 51 #undef BT_DBG 52 #define BT_DBG(D...) 53 #endif 54 55 static void hci_cmd_task(unsigned long arg); 56 static void hci_rx_task(unsigned long arg); 57 static void hci_tx_task(unsigned long arg); 58 static void hci_notify(struct hci_dev *hdev, int event); 59 60 static DEFINE_RWLOCK(hci_task_lock); 61 62 /* HCI device list */ 63 LIST_HEAD(hci_dev_list); 64 DEFINE_RWLOCK(hci_dev_list_lock); 65 66 /* HCI callback list */ 67 LIST_HEAD(hci_cb_list); 68 DEFINE_RWLOCK(hci_cb_list_lock); 69 70 /* HCI protocols */ 71 #define HCI_MAX_PROTO 2 72 struct hci_proto *hci_proto[HCI_MAX_PROTO]; 73 74 /* HCI notifiers list */ 75 static ATOMIC_NOTIFIER_HEAD(hci_notifier); 76 77 /* ---- HCI notifications ---- */ 78 79 int hci_register_notifier(struct notifier_block *nb) 80 { 81 return atomic_notifier_chain_register(&hci_notifier, nb); 82 } 83 84 int hci_unregister_notifier(struct notifier_block *nb) 85 { 86 return atomic_notifier_chain_unregister(&hci_notifier, nb); 87 } 88 89 static void hci_notify(struct hci_dev *hdev, int event) 90 { 91 atomic_notifier_call_chain(&hci_notifier, event, hdev); 92 } 93 94 /* ---- HCI requests ---- */ 95 96 void hci_req_complete(struct hci_dev *hdev, int result) 97 { 98 BT_DBG("%s result 0x%2.2x", hdev->name, result); 99 100 if (hdev->req_status == HCI_REQ_PEND) { 101 hdev->req_result = result; 102 hdev->req_status = HCI_REQ_DONE; 103 wake_up_interruptible(&hdev->req_wait_q); 104 } 105 } 106 107 static void hci_req_cancel(struct hci_dev *hdev, int err) 108 { 109 BT_DBG("%s err 0x%2.2x", hdev->name, err); 110 111 if (hdev->req_status == HCI_REQ_PEND) { 112 hdev->req_result = err; 113 hdev->req_status = HCI_REQ_CANCELED; 114 wake_up_interruptible(&hdev->req_wait_q); 115 } 116 } 117 118 /* Execute request and wait for completion. */ 119 static int __hci_request(struct hci_dev *hdev, void (*req)(struct hci_dev *hdev, unsigned long opt), 120 unsigned long opt, __u32 timeout) 121 { 122 DECLARE_WAITQUEUE(wait, current); 123 int err = 0; 124 125 BT_DBG("%s start", hdev->name); 126 127 hdev->req_status = HCI_REQ_PEND; 128 129 add_wait_queue(&hdev->req_wait_q, &wait); 130 set_current_state(TASK_INTERRUPTIBLE); 131 132 req(hdev, opt); 133 schedule_timeout(timeout); 134 135 remove_wait_queue(&hdev->req_wait_q, &wait); 136 137 if (signal_pending(current)) 138 return -EINTR; 139 140 switch (hdev->req_status) { 141 case HCI_REQ_DONE: 142 err = -bt_err(hdev->req_result); 143 break; 144 145 case HCI_REQ_CANCELED: 146 err = -hdev->req_result; 147 break; 148 149 default: 150 err = -ETIMEDOUT; 151 break; 152 } 153 154 hdev->req_status = hdev->req_result = 0; 155 156 BT_DBG("%s end: err %d", hdev->name, err); 157 158 return err; 159 } 160 161 static inline int hci_request(struct hci_dev *hdev, void (*req)(struct hci_dev *hdev, unsigned long opt), 162 unsigned long opt, __u32 timeout) 163 { 164 int ret; 165 166 /* Serialize all requests */ 167 hci_req_lock(hdev); 168 ret = __hci_request(hdev, req, opt, timeout); 169 hci_req_unlock(hdev); 170 171 return ret; 172 } 173 174 static void hci_reset_req(struct hci_dev *hdev, unsigned long opt) 175 { 176 BT_DBG("%s %ld", hdev->name, opt); 177 178 /* Reset device */ 179 hci_send_cmd(hdev, OGF_HOST_CTL, OCF_RESET, 0, NULL); 180 } 181 182 static void hci_init_req(struct hci_dev *hdev, unsigned long opt) 183 { 184 struct sk_buff *skb; 185 __le16 param; 186 187 BT_DBG("%s %ld", hdev->name, opt); 188 189 /* Driver initialization */ 190 191 /* Special commands */ 192 while ((skb = skb_dequeue(&hdev->driver_init))) { 193 bt_cb(skb)->pkt_type = HCI_COMMAND_PKT; 194 skb->dev = (void *) hdev; 195 skb_queue_tail(&hdev->cmd_q, skb); 196 hci_sched_cmd(hdev); 197 } 198 skb_queue_purge(&hdev->driver_init); 199 200 /* Mandatory initialization */ 201 202 /* Reset */ 203 if (test_bit(HCI_QUIRK_RESET_ON_INIT, &hdev->quirks)) 204 hci_send_cmd(hdev, OGF_HOST_CTL, OCF_RESET, 0, NULL); 205 206 /* Read Local Supported Features */ 207 hci_send_cmd(hdev, OGF_INFO_PARAM, OCF_READ_LOCAL_FEATURES, 0, NULL); 208 209 /* Read Local Version */ 210 hci_send_cmd(hdev, OGF_INFO_PARAM, OCF_READ_LOCAL_VERSION, 0, NULL); 211 212 /* Read Buffer Size (ACL mtu, max pkt, etc.) */ 213 hci_send_cmd(hdev, OGF_INFO_PARAM, OCF_READ_BUFFER_SIZE, 0, NULL); 214 215 #if 0 216 /* Host buffer size */ 217 { 218 struct hci_cp_host_buffer_size cp; 219 cp.acl_mtu = cpu_to_le16(HCI_MAX_ACL_SIZE); 220 cp.sco_mtu = HCI_MAX_SCO_SIZE; 221 cp.acl_max_pkt = cpu_to_le16(0xffff); 222 cp.sco_max_pkt = cpu_to_le16(0xffff); 223 hci_send_cmd(hdev, OGF_HOST_CTL, OCF_HOST_BUFFER_SIZE, sizeof(cp), &cp); 224 } 225 #endif 226 227 /* Read BD Address */ 228 hci_send_cmd(hdev, OGF_INFO_PARAM, OCF_READ_BD_ADDR, 0, NULL); 229 230 /* Read Voice Setting */ 231 hci_send_cmd(hdev, OGF_HOST_CTL, OCF_READ_VOICE_SETTING, 0, NULL); 232 233 /* Optional initialization */ 234 235 /* Clear Event Filters */ 236 { 237 struct hci_cp_set_event_flt cp; 238 cp.flt_type = HCI_FLT_CLEAR_ALL; 239 hci_send_cmd(hdev, OGF_HOST_CTL, OCF_SET_EVENT_FLT, sizeof(cp), &cp); 240 } 241 242 /* Page timeout ~20 secs */ 243 param = cpu_to_le16(0x8000); 244 hci_send_cmd(hdev, OGF_HOST_CTL, OCF_WRITE_PG_TIMEOUT, 2, ¶m); 245 246 /* Connection accept timeout ~20 secs */ 247 param = cpu_to_le16(0x7d00); 248 hci_send_cmd(hdev, OGF_HOST_CTL, OCF_WRITE_CA_TIMEOUT, 2, ¶m); 249 } 250 251 static void hci_scan_req(struct hci_dev *hdev, unsigned long opt) 252 { 253 __u8 scan = opt; 254 255 BT_DBG("%s %x", hdev->name, scan); 256 257 /* Inquiry and Page scans */ 258 hci_send_cmd(hdev, OGF_HOST_CTL, OCF_WRITE_SCAN_ENABLE, 1, &scan); 259 } 260 261 static void hci_auth_req(struct hci_dev *hdev, unsigned long opt) 262 { 263 __u8 auth = opt; 264 265 BT_DBG("%s %x", hdev->name, auth); 266 267 /* Authentication */ 268 hci_send_cmd(hdev, OGF_HOST_CTL, OCF_WRITE_AUTH_ENABLE, 1, &auth); 269 } 270 271 static void hci_encrypt_req(struct hci_dev *hdev, unsigned long opt) 272 { 273 __u8 encrypt = opt; 274 275 BT_DBG("%s %x", hdev->name, encrypt); 276 277 /* Authentication */ 278 hci_send_cmd(hdev, OGF_HOST_CTL, OCF_WRITE_ENCRYPT_MODE, 1, &encrypt); 279 } 280 281 /* Get HCI device by index. 282 * Device is held on return. */ 283 struct hci_dev *hci_dev_get(int index) 284 { 285 struct hci_dev *hdev = NULL; 286 struct list_head *p; 287 288 BT_DBG("%d", index); 289 290 if (index < 0) 291 return NULL; 292 293 read_lock(&hci_dev_list_lock); 294 list_for_each(p, &hci_dev_list) { 295 struct hci_dev *d = list_entry(p, struct hci_dev, list); 296 if (d->id == index) { 297 hdev = hci_dev_hold(d); 298 break; 299 } 300 } 301 read_unlock(&hci_dev_list_lock); 302 return hdev; 303 } 304 305 /* ---- Inquiry support ---- */ 306 static void inquiry_cache_flush(struct hci_dev *hdev) 307 { 308 struct inquiry_cache *cache = &hdev->inq_cache; 309 struct inquiry_entry *next = cache->list, *e; 310 311 BT_DBG("cache %p", cache); 312 313 cache->list = NULL; 314 while ((e = next)) { 315 next = e->next; 316 kfree(e); 317 } 318 } 319 320 struct inquiry_entry *hci_inquiry_cache_lookup(struct hci_dev *hdev, bdaddr_t *bdaddr) 321 { 322 struct inquiry_cache *cache = &hdev->inq_cache; 323 struct inquiry_entry *e; 324 325 BT_DBG("cache %p, %s", cache, batostr(bdaddr)); 326 327 for (e = cache->list; e; e = e->next) 328 if (!bacmp(&e->data.bdaddr, bdaddr)) 329 break; 330 return e; 331 } 332 333 void hci_inquiry_cache_update(struct hci_dev *hdev, struct inquiry_data *data) 334 { 335 struct inquiry_cache *cache = &hdev->inq_cache; 336 struct inquiry_entry *e; 337 338 BT_DBG("cache %p, %s", cache, batostr(&data->bdaddr)); 339 340 if (!(e = hci_inquiry_cache_lookup(hdev, &data->bdaddr))) { 341 /* Entry not in the cache. Add new one. */ 342 if (!(e = kzalloc(sizeof(struct inquiry_entry), GFP_ATOMIC))) 343 return; 344 e->next = cache->list; 345 cache->list = e; 346 } 347 348 memcpy(&e->data, data, sizeof(*data)); 349 e->timestamp = jiffies; 350 cache->timestamp = jiffies; 351 } 352 353 static int inquiry_cache_dump(struct hci_dev *hdev, int num, __u8 *buf) 354 { 355 struct inquiry_cache *cache = &hdev->inq_cache; 356 struct inquiry_info *info = (struct inquiry_info *) buf; 357 struct inquiry_entry *e; 358 int copied = 0; 359 360 for (e = cache->list; e && copied < num; e = e->next, copied++) { 361 struct inquiry_data *data = &e->data; 362 bacpy(&info->bdaddr, &data->bdaddr); 363 info->pscan_rep_mode = data->pscan_rep_mode; 364 info->pscan_period_mode = data->pscan_period_mode; 365 info->pscan_mode = data->pscan_mode; 366 memcpy(info->dev_class, data->dev_class, 3); 367 info->clock_offset = data->clock_offset; 368 info++; 369 } 370 371 BT_DBG("cache %p, copied %d", cache, copied); 372 return copied; 373 } 374 375 static void hci_inq_req(struct hci_dev *hdev, unsigned long opt) 376 { 377 struct hci_inquiry_req *ir = (struct hci_inquiry_req *) opt; 378 struct hci_cp_inquiry cp; 379 380 BT_DBG("%s", hdev->name); 381 382 if (test_bit(HCI_INQUIRY, &hdev->flags)) 383 return; 384 385 /* Start Inquiry */ 386 memcpy(&cp.lap, &ir->lap, 3); 387 cp.length = ir->length; 388 cp.num_rsp = ir->num_rsp; 389 hci_send_cmd(hdev, OGF_LINK_CTL, OCF_INQUIRY, sizeof(cp), &cp); 390 } 391 392 int hci_inquiry(void __user *arg) 393 { 394 __u8 __user *ptr = arg; 395 struct hci_inquiry_req ir; 396 struct hci_dev *hdev; 397 int err = 0, do_inquiry = 0, max_rsp; 398 long timeo; 399 __u8 *buf; 400 401 if (copy_from_user(&ir, ptr, sizeof(ir))) 402 return -EFAULT; 403 404 if (!(hdev = hci_dev_get(ir.dev_id))) 405 return -ENODEV; 406 407 hci_dev_lock_bh(hdev); 408 if (inquiry_cache_age(hdev) > INQUIRY_CACHE_AGE_MAX || 409 inquiry_cache_empty(hdev) || 410 ir.flags & IREQ_CACHE_FLUSH) { 411 inquiry_cache_flush(hdev); 412 do_inquiry = 1; 413 } 414 hci_dev_unlock_bh(hdev); 415 416 timeo = ir.length * msecs_to_jiffies(2000); 417 if (do_inquiry && (err = hci_request(hdev, hci_inq_req, (unsigned long)&ir, timeo)) < 0) 418 goto done; 419 420 /* for unlimited number of responses we will use buffer with 255 entries */ 421 max_rsp = (ir.num_rsp == 0) ? 255 : ir.num_rsp; 422 423 /* cache_dump can't sleep. Therefore we allocate temp buffer and then 424 * copy it to the user space. 425 */ 426 if (!(buf = kmalloc(sizeof(struct inquiry_info) * max_rsp, GFP_KERNEL))) { 427 err = -ENOMEM; 428 goto done; 429 } 430 431 hci_dev_lock_bh(hdev); 432 ir.num_rsp = inquiry_cache_dump(hdev, max_rsp, buf); 433 hci_dev_unlock_bh(hdev); 434 435 BT_DBG("num_rsp %d", ir.num_rsp); 436 437 if (!copy_to_user(ptr, &ir, sizeof(ir))) { 438 ptr += sizeof(ir); 439 if (copy_to_user(ptr, buf, sizeof(struct inquiry_info) * 440 ir.num_rsp)) 441 err = -EFAULT; 442 } else 443 err = -EFAULT; 444 445 kfree(buf); 446 447 done: 448 hci_dev_put(hdev); 449 return err; 450 } 451 452 /* ---- HCI ioctl helpers ---- */ 453 454 int hci_dev_open(__u16 dev) 455 { 456 struct hci_dev *hdev; 457 int ret = 0; 458 459 if (!(hdev = hci_dev_get(dev))) 460 return -ENODEV; 461 462 BT_DBG("%s %p", hdev->name, hdev); 463 464 hci_req_lock(hdev); 465 466 if (test_bit(HCI_UP, &hdev->flags)) { 467 ret = -EALREADY; 468 goto done; 469 } 470 471 if (test_bit(HCI_QUIRK_RAW_DEVICE, &hdev->quirks)) 472 set_bit(HCI_RAW, &hdev->flags); 473 474 if (hdev->open(hdev)) { 475 ret = -EIO; 476 goto done; 477 } 478 479 if (!test_bit(HCI_RAW, &hdev->flags)) { 480 atomic_set(&hdev->cmd_cnt, 1); 481 set_bit(HCI_INIT, &hdev->flags); 482 483 //__hci_request(hdev, hci_reset_req, 0, HZ); 484 ret = __hci_request(hdev, hci_init_req, 0, 485 msecs_to_jiffies(HCI_INIT_TIMEOUT)); 486 487 clear_bit(HCI_INIT, &hdev->flags); 488 } 489 490 if (!ret) { 491 hci_dev_hold(hdev); 492 set_bit(HCI_UP, &hdev->flags); 493 hci_notify(hdev, HCI_DEV_UP); 494 } else { 495 /* Init failed, cleanup */ 496 tasklet_kill(&hdev->rx_task); 497 tasklet_kill(&hdev->tx_task); 498 tasklet_kill(&hdev->cmd_task); 499 500 skb_queue_purge(&hdev->cmd_q); 501 skb_queue_purge(&hdev->rx_q); 502 503 if (hdev->flush) 504 hdev->flush(hdev); 505 506 if (hdev->sent_cmd) { 507 kfree_skb(hdev->sent_cmd); 508 hdev->sent_cmd = NULL; 509 } 510 511 hdev->close(hdev); 512 hdev->flags = 0; 513 } 514 515 done: 516 hci_req_unlock(hdev); 517 hci_dev_put(hdev); 518 return ret; 519 } 520 521 static int hci_dev_do_close(struct hci_dev *hdev) 522 { 523 BT_DBG("%s %p", hdev->name, hdev); 524 525 hci_req_cancel(hdev, ENODEV); 526 hci_req_lock(hdev); 527 528 if (!test_and_clear_bit(HCI_UP, &hdev->flags)) { 529 hci_req_unlock(hdev); 530 return 0; 531 } 532 533 /* Kill RX and TX tasks */ 534 tasklet_kill(&hdev->rx_task); 535 tasklet_kill(&hdev->tx_task); 536 537 hci_dev_lock_bh(hdev); 538 inquiry_cache_flush(hdev); 539 hci_conn_hash_flush(hdev); 540 hci_dev_unlock_bh(hdev); 541 542 hci_notify(hdev, HCI_DEV_DOWN); 543 544 if (hdev->flush) 545 hdev->flush(hdev); 546 547 /* Reset device */ 548 skb_queue_purge(&hdev->cmd_q); 549 atomic_set(&hdev->cmd_cnt, 1); 550 if (!test_bit(HCI_RAW, &hdev->flags)) { 551 set_bit(HCI_INIT, &hdev->flags); 552 __hci_request(hdev, hci_reset_req, 0, 553 msecs_to_jiffies(250)); 554 clear_bit(HCI_INIT, &hdev->flags); 555 } 556 557 /* Kill cmd task */ 558 tasklet_kill(&hdev->cmd_task); 559 560 /* Drop queues */ 561 skb_queue_purge(&hdev->rx_q); 562 skb_queue_purge(&hdev->cmd_q); 563 skb_queue_purge(&hdev->raw_q); 564 565 /* Drop last sent command */ 566 if (hdev->sent_cmd) { 567 kfree_skb(hdev->sent_cmd); 568 hdev->sent_cmd = NULL; 569 } 570 571 /* After this point our queues are empty 572 * and no tasks are scheduled. */ 573 hdev->close(hdev); 574 575 /* Clear flags */ 576 hdev->flags = 0; 577 578 hci_req_unlock(hdev); 579 580 hci_dev_put(hdev); 581 return 0; 582 } 583 584 int hci_dev_close(__u16 dev) 585 { 586 struct hci_dev *hdev; 587 int err; 588 589 if (!(hdev = hci_dev_get(dev))) 590 return -ENODEV; 591 err = hci_dev_do_close(hdev); 592 hci_dev_put(hdev); 593 return err; 594 } 595 596 int hci_dev_reset(__u16 dev) 597 { 598 struct hci_dev *hdev; 599 int ret = 0; 600 601 if (!(hdev = hci_dev_get(dev))) 602 return -ENODEV; 603 604 hci_req_lock(hdev); 605 tasklet_disable(&hdev->tx_task); 606 607 if (!test_bit(HCI_UP, &hdev->flags)) 608 goto done; 609 610 /* Drop queues */ 611 skb_queue_purge(&hdev->rx_q); 612 skb_queue_purge(&hdev->cmd_q); 613 614 hci_dev_lock_bh(hdev); 615 inquiry_cache_flush(hdev); 616 hci_conn_hash_flush(hdev); 617 hci_dev_unlock_bh(hdev); 618 619 if (hdev->flush) 620 hdev->flush(hdev); 621 622 atomic_set(&hdev->cmd_cnt, 1); 623 hdev->acl_cnt = 0; hdev->sco_cnt = 0; 624 625 if (!test_bit(HCI_RAW, &hdev->flags)) 626 ret = __hci_request(hdev, hci_reset_req, 0, 627 msecs_to_jiffies(HCI_INIT_TIMEOUT)); 628 629 done: 630 tasklet_enable(&hdev->tx_task); 631 hci_req_unlock(hdev); 632 hci_dev_put(hdev); 633 return ret; 634 } 635 636 int hci_dev_reset_stat(__u16 dev) 637 { 638 struct hci_dev *hdev; 639 int ret = 0; 640 641 if (!(hdev = hci_dev_get(dev))) 642 return -ENODEV; 643 644 memset(&hdev->stat, 0, sizeof(struct hci_dev_stats)); 645 646 hci_dev_put(hdev); 647 648 return ret; 649 } 650 651 int hci_dev_cmd(unsigned int cmd, void __user *arg) 652 { 653 struct hci_dev *hdev; 654 struct hci_dev_req dr; 655 int err = 0; 656 657 if (copy_from_user(&dr, arg, sizeof(dr))) 658 return -EFAULT; 659 660 if (!(hdev = hci_dev_get(dr.dev_id))) 661 return -ENODEV; 662 663 switch (cmd) { 664 case HCISETAUTH: 665 err = hci_request(hdev, hci_auth_req, dr.dev_opt, 666 msecs_to_jiffies(HCI_INIT_TIMEOUT)); 667 break; 668 669 case HCISETENCRYPT: 670 if (!lmp_encrypt_capable(hdev)) { 671 err = -EOPNOTSUPP; 672 break; 673 } 674 675 if (!test_bit(HCI_AUTH, &hdev->flags)) { 676 /* Auth must be enabled first */ 677 err = hci_request(hdev, hci_auth_req, dr.dev_opt, 678 msecs_to_jiffies(HCI_INIT_TIMEOUT)); 679 if (err) 680 break; 681 } 682 683 err = hci_request(hdev, hci_encrypt_req, dr.dev_opt, 684 msecs_to_jiffies(HCI_INIT_TIMEOUT)); 685 break; 686 687 case HCISETSCAN: 688 err = hci_request(hdev, hci_scan_req, dr.dev_opt, 689 msecs_to_jiffies(HCI_INIT_TIMEOUT)); 690 break; 691 692 case HCISETPTYPE: 693 hdev->pkt_type = (__u16) dr.dev_opt; 694 break; 695 696 case HCISETLINKPOL: 697 hdev->link_policy = (__u16) dr.dev_opt; 698 break; 699 700 case HCISETLINKMODE: 701 hdev->link_mode = ((__u16) dr.dev_opt) & (HCI_LM_MASTER | HCI_LM_ACCEPT); 702 break; 703 704 case HCISETACLMTU: 705 hdev->acl_mtu = *((__u16 *)&dr.dev_opt + 1); 706 hdev->acl_pkts = *((__u16 *)&dr.dev_opt + 0); 707 break; 708 709 case HCISETSCOMTU: 710 hdev->sco_mtu = *((__u16 *)&dr.dev_opt + 1); 711 hdev->sco_pkts = *((__u16 *)&dr.dev_opt + 0); 712 break; 713 714 default: 715 err = -EINVAL; 716 break; 717 } 718 hci_dev_put(hdev); 719 return err; 720 } 721 722 int hci_get_dev_list(void __user *arg) 723 { 724 struct hci_dev_list_req *dl; 725 struct hci_dev_req *dr; 726 struct list_head *p; 727 int n = 0, size, err; 728 __u16 dev_num; 729 730 if (get_user(dev_num, (__u16 __user *) arg)) 731 return -EFAULT; 732 733 if (!dev_num || dev_num > (PAGE_SIZE * 2) / sizeof(*dr)) 734 return -EINVAL; 735 736 size = sizeof(*dl) + dev_num * sizeof(*dr); 737 738 if (!(dl = kmalloc(size, GFP_KERNEL))) 739 return -ENOMEM; 740 741 dr = dl->dev_req; 742 743 read_lock_bh(&hci_dev_list_lock); 744 list_for_each(p, &hci_dev_list) { 745 struct hci_dev *hdev; 746 hdev = list_entry(p, struct hci_dev, list); 747 (dr + n)->dev_id = hdev->id; 748 (dr + n)->dev_opt = hdev->flags; 749 if (++n >= dev_num) 750 break; 751 } 752 read_unlock_bh(&hci_dev_list_lock); 753 754 dl->dev_num = n; 755 size = sizeof(*dl) + n * sizeof(*dr); 756 757 err = copy_to_user(arg, dl, size); 758 kfree(dl); 759 760 return err ? -EFAULT : 0; 761 } 762 763 int hci_get_dev_info(void __user *arg) 764 { 765 struct hci_dev *hdev; 766 struct hci_dev_info di; 767 int err = 0; 768 769 if (copy_from_user(&di, arg, sizeof(di))) 770 return -EFAULT; 771 772 if (!(hdev = hci_dev_get(di.dev_id))) 773 return -ENODEV; 774 775 strcpy(di.name, hdev->name); 776 di.bdaddr = hdev->bdaddr; 777 di.type = hdev->type; 778 di.flags = hdev->flags; 779 di.pkt_type = hdev->pkt_type; 780 di.acl_mtu = hdev->acl_mtu; 781 di.acl_pkts = hdev->acl_pkts; 782 di.sco_mtu = hdev->sco_mtu; 783 di.sco_pkts = hdev->sco_pkts; 784 di.link_policy = hdev->link_policy; 785 di.link_mode = hdev->link_mode; 786 787 memcpy(&di.stat, &hdev->stat, sizeof(di.stat)); 788 memcpy(&di.features, &hdev->features, sizeof(di.features)); 789 790 if (copy_to_user(arg, &di, sizeof(di))) 791 err = -EFAULT; 792 793 hci_dev_put(hdev); 794 795 return err; 796 } 797 798 /* ---- Interface to HCI drivers ---- */ 799 800 /* Alloc HCI device */ 801 struct hci_dev *hci_alloc_dev(void) 802 { 803 struct hci_dev *hdev; 804 805 hdev = kzalloc(sizeof(struct hci_dev), GFP_KERNEL); 806 if (!hdev) 807 return NULL; 808 809 skb_queue_head_init(&hdev->driver_init); 810 811 return hdev; 812 } 813 EXPORT_SYMBOL(hci_alloc_dev); 814 815 /* Free HCI device */ 816 void hci_free_dev(struct hci_dev *hdev) 817 { 818 skb_queue_purge(&hdev->driver_init); 819 820 /* will free via device release */ 821 put_device(&hdev->dev); 822 } 823 EXPORT_SYMBOL(hci_free_dev); 824 825 /* Register HCI device */ 826 int hci_register_dev(struct hci_dev *hdev) 827 { 828 struct list_head *head = &hci_dev_list, *p; 829 int i, id = 0; 830 831 BT_DBG("%p name %s type %d owner %p", hdev, hdev->name, hdev->type, hdev->owner); 832 833 if (!hdev->open || !hdev->close || !hdev->destruct) 834 return -EINVAL; 835 836 write_lock_bh(&hci_dev_list_lock); 837 838 /* Find first available device id */ 839 list_for_each(p, &hci_dev_list) { 840 if (list_entry(p, struct hci_dev, list)->id != id) 841 break; 842 head = p; id++; 843 } 844 845 sprintf(hdev->name, "hci%d", id); 846 hdev->id = id; 847 list_add(&hdev->list, head); 848 849 atomic_set(&hdev->refcnt, 1); 850 spin_lock_init(&hdev->lock); 851 852 hdev->flags = 0; 853 hdev->pkt_type = (HCI_DM1 | HCI_DH1 | HCI_HV1); 854 hdev->esco_type = (ESCO_HV1); 855 hdev->link_mode = (HCI_LM_ACCEPT); 856 857 hdev->idle_timeout = 0; 858 hdev->sniff_max_interval = 800; 859 hdev->sniff_min_interval = 80; 860 861 tasklet_init(&hdev->cmd_task, hci_cmd_task,(unsigned long) hdev); 862 tasklet_init(&hdev->rx_task, hci_rx_task, (unsigned long) hdev); 863 tasklet_init(&hdev->tx_task, hci_tx_task, (unsigned long) hdev); 864 865 skb_queue_head_init(&hdev->rx_q); 866 skb_queue_head_init(&hdev->cmd_q); 867 skb_queue_head_init(&hdev->raw_q); 868 869 for (i = 0; i < 3; i++) 870 hdev->reassembly[i] = NULL; 871 872 init_waitqueue_head(&hdev->req_wait_q); 873 init_MUTEX(&hdev->req_lock); 874 875 inquiry_cache_init(hdev); 876 877 hci_conn_hash_init(hdev); 878 879 memset(&hdev->stat, 0, sizeof(struct hci_dev_stats)); 880 881 atomic_set(&hdev->promisc, 0); 882 883 write_unlock_bh(&hci_dev_list_lock); 884 885 hci_register_sysfs(hdev); 886 887 hci_notify(hdev, HCI_DEV_REG); 888 889 return id; 890 } 891 EXPORT_SYMBOL(hci_register_dev); 892 893 /* Unregister HCI device */ 894 int hci_unregister_dev(struct hci_dev *hdev) 895 { 896 int i; 897 898 BT_DBG("%p name %s type %d", hdev, hdev->name, hdev->type); 899 900 hci_unregister_sysfs(hdev); 901 902 write_lock_bh(&hci_dev_list_lock); 903 list_del(&hdev->list); 904 write_unlock_bh(&hci_dev_list_lock); 905 906 hci_dev_do_close(hdev); 907 908 for (i = 0; i < 3; i++) 909 kfree_skb(hdev->reassembly[i]); 910 911 hci_notify(hdev, HCI_DEV_UNREG); 912 913 __hci_dev_put(hdev); 914 915 return 0; 916 } 917 EXPORT_SYMBOL(hci_unregister_dev); 918 919 /* Suspend HCI device */ 920 int hci_suspend_dev(struct hci_dev *hdev) 921 { 922 hci_notify(hdev, HCI_DEV_SUSPEND); 923 return 0; 924 } 925 EXPORT_SYMBOL(hci_suspend_dev); 926 927 /* Resume HCI device */ 928 int hci_resume_dev(struct hci_dev *hdev) 929 { 930 hci_notify(hdev, HCI_DEV_RESUME); 931 return 0; 932 } 933 EXPORT_SYMBOL(hci_resume_dev); 934 935 /* Receive packet type fragment */ 936 #define __reassembly(hdev, type) ((hdev)->reassembly[(type) - 2]) 937 938 int hci_recv_fragment(struct hci_dev *hdev, int type, void *data, int count) 939 { 940 if (type < HCI_ACLDATA_PKT || type > HCI_EVENT_PKT) 941 return -EILSEQ; 942 943 while (count) { 944 struct sk_buff *skb = __reassembly(hdev, type); 945 struct { int expect; } *scb; 946 int len = 0; 947 948 if (!skb) { 949 /* Start of the frame */ 950 951 switch (type) { 952 case HCI_EVENT_PKT: 953 if (count >= HCI_EVENT_HDR_SIZE) { 954 struct hci_event_hdr *h = data; 955 len = HCI_EVENT_HDR_SIZE + h->plen; 956 } else 957 return -EILSEQ; 958 break; 959 960 case HCI_ACLDATA_PKT: 961 if (count >= HCI_ACL_HDR_SIZE) { 962 struct hci_acl_hdr *h = data; 963 len = HCI_ACL_HDR_SIZE + __le16_to_cpu(h->dlen); 964 } else 965 return -EILSEQ; 966 break; 967 968 case HCI_SCODATA_PKT: 969 if (count >= HCI_SCO_HDR_SIZE) { 970 struct hci_sco_hdr *h = data; 971 len = HCI_SCO_HDR_SIZE + h->dlen; 972 } else 973 return -EILSEQ; 974 break; 975 } 976 977 skb = bt_skb_alloc(len, GFP_ATOMIC); 978 if (!skb) { 979 BT_ERR("%s no memory for packet", hdev->name); 980 return -ENOMEM; 981 } 982 983 skb->dev = (void *) hdev; 984 bt_cb(skb)->pkt_type = type; 985 986 __reassembly(hdev, type) = skb; 987 988 scb = (void *) skb->cb; 989 scb->expect = len; 990 } else { 991 /* Continuation */ 992 993 scb = (void *) skb->cb; 994 len = scb->expect; 995 } 996 997 len = min(len, count); 998 999 memcpy(skb_put(skb, len), data, len); 1000 1001 scb->expect -= len; 1002 1003 if (scb->expect == 0) { 1004 /* Complete frame */ 1005 1006 __reassembly(hdev, type) = NULL; 1007 1008 bt_cb(skb)->pkt_type = type; 1009 hci_recv_frame(skb); 1010 } 1011 1012 count -= len; data += len; 1013 } 1014 1015 return 0; 1016 } 1017 EXPORT_SYMBOL(hci_recv_fragment); 1018 1019 /* ---- Interface to upper protocols ---- */ 1020 1021 /* Register/Unregister protocols. 1022 * hci_task_lock is used to ensure that no tasks are running. */ 1023 int hci_register_proto(struct hci_proto *hp) 1024 { 1025 int err = 0; 1026 1027 BT_DBG("%p name %s id %d", hp, hp->name, hp->id); 1028 1029 if (hp->id >= HCI_MAX_PROTO) 1030 return -EINVAL; 1031 1032 write_lock_bh(&hci_task_lock); 1033 1034 if (!hci_proto[hp->id]) 1035 hci_proto[hp->id] = hp; 1036 else 1037 err = -EEXIST; 1038 1039 write_unlock_bh(&hci_task_lock); 1040 1041 return err; 1042 } 1043 EXPORT_SYMBOL(hci_register_proto); 1044 1045 int hci_unregister_proto(struct hci_proto *hp) 1046 { 1047 int err = 0; 1048 1049 BT_DBG("%p name %s id %d", hp, hp->name, hp->id); 1050 1051 if (hp->id >= HCI_MAX_PROTO) 1052 return -EINVAL; 1053 1054 write_lock_bh(&hci_task_lock); 1055 1056 if (hci_proto[hp->id]) 1057 hci_proto[hp->id] = NULL; 1058 else 1059 err = -ENOENT; 1060 1061 write_unlock_bh(&hci_task_lock); 1062 1063 return err; 1064 } 1065 EXPORT_SYMBOL(hci_unregister_proto); 1066 1067 int hci_register_cb(struct hci_cb *cb) 1068 { 1069 BT_DBG("%p name %s", cb, cb->name); 1070 1071 write_lock_bh(&hci_cb_list_lock); 1072 list_add(&cb->list, &hci_cb_list); 1073 write_unlock_bh(&hci_cb_list_lock); 1074 1075 return 0; 1076 } 1077 EXPORT_SYMBOL(hci_register_cb); 1078 1079 int hci_unregister_cb(struct hci_cb *cb) 1080 { 1081 BT_DBG("%p name %s", cb, cb->name); 1082 1083 write_lock_bh(&hci_cb_list_lock); 1084 list_del(&cb->list); 1085 write_unlock_bh(&hci_cb_list_lock); 1086 1087 return 0; 1088 } 1089 EXPORT_SYMBOL(hci_unregister_cb); 1090 1091 static int hci_send_frame(struct sk_buff *skb) 1092 { 1093 struct hci_dev *hdev = (struct hci_dev *) skb->dev; 1094 1095 if (!hdev) { 1096 kfree_skb(skb); 1097 return -ENODEV; 1098 } 1099 1100 BT_DBG("%s type %d len %d", hdev->name, bt_cb(skb)->pkt_type, skb->len); 1101 1102 if (atomic_read(&hdev->promisc)) { 1103 /* Time stamp */ 1104 __net_timestamp(skb); 1105 1106 hci_send_to_sock(hdev, skb); 1107 } 1108 1109 /* Get rid of skb owner, prior to sending to the driver. */ 1110 skb_orphan(skb); 1111 1112 return hdev->send(skb); 1113 } 1114 1115 /* Send HCI command */ 1116 int hci_send_cmd(struct hci_dev *hdev, __u16 ogf, __u16 ocf, __u32 plen, void *param) 1117 { 1118 int len = HCI_COMMAND_HDR_SIZE + plen; 1119 struct hci_command_hdr *hdr; 1120 struct sk_buff *skb; 1121 1122 BT_DBG("%s ogf 0x%x ocf 0x%x plen %d", hdev->name, ogf, ocf, plen); 1123 1124 skb = bt_skb_alloc(len, GFP_ATOMIC); 1125 if (!skb) { 1126 BT_ERR("%s no memory for command", hdev->name); 1127 return -ENOMEM; 1128 } 1129 1130 hdr = (struct hci_command_hdr *) skb_put(skb, HCI_COMMAND_HDR_SIZE); 1131 hdr->opcode = cpu_to_le16(hci_opcode_pack(ogf, ocf)); 1132 hdr->plen = plen; 1133 1134 if (plen) 1135 memcpy(skb_put(skb, plen), param, plen); 1136 1137 BT_DBG("skb len %d", skb->len); 1138 1139 bt_cb(skb)->pkt_type = HCI_COMMAND_PKT; 1140 skb->dev = (void *) hdev; 1141 skb_queue_tail(&hdev->cmd_q, skb); 1142 hci_sched_cmd(hdev); 1143 1144 return 0; 1145 } 1146 1147 /* Get data from the previously sent command */ 1148 void *hci_sent_cmd_data(struct hci_dev *hdev, __u16 ogf, __u16 ocf) 1149 { 1150 struct hci_command_hdr *hdr; 1151 1152 if (!hdev->sent_cmd) 1153 return NULL; 1154 1155 hdr = (void *) hdev->sent_cmd->data; 1156 1157 if (hdr->opcode != cpu_to_le16(hci_opcode_pack(ogf, ocf))) 1158 return NULL; 1159 1160 BT_DBG("%s ogf 0x%x ocf 0x%x", hdev->name, ogf, ocf); 1161 1162 return hdev->sent_cmd->data + HCI_COMMAND_HDR_SIZE; 1163 } 1164 1165 /* Send ACL data */ 1166 static void hci_add_acl_hdr(struct sk_buff *skb, __u16 handle, __u16 flags) 1167 { 1168 struct hci_acl_hdr *hdr; 1169 int len = skb->len; 1170 1171 skb_push(skb, HCI_ACL_HDR_SIZE); 1172 skb_reset_transport_header(skb); 1173 hdr = (struct hci_acl_hdr *)skb_transport_header(skb); 1174 hdr->handle = cpu_to_le16(hci_handle_pack(handle, flags)); 1175 hdr->dlen = cpu_to_le16(len); 1176 } 1177 1178 int hci_send_acl(struct hci_conn *conn, struct sk_buff *skb, __u16 flags) 1179 { 1180 struct hci_dev *hdev = conn->hdev; 1181 struct sk_buff *list; 1182 1183 BT_DBG("%s conn %p flags 0x%x", hdev->name, conn, flags); 1184 1185 skb->dev = (void *) hdev; 1186 bt_cb(skb)->pkt_type = HCI_ACLDATA_PKT; 1187 hci_add_acl_hdr(skb, conn->handle, flags | ACL_START); 1188 1189 if (!(list = skb_shinfo(skb)->frag_list)) { 1190 /* Non fragmented */ 1191 BT_DBG("%s nonfrag skb %p len %d", hdev->name, skb, skb->len); 1192 1193 skb_queue_tail(&conn->data_q, skb); 1194 } else { 1195 /* Fragmented */ 1196 BT_DBG("%s frag %p len %d", hdev->name, skb, skb->len); 1197 1198 skb_shinfo(skb)->frag_list = NULL; 1199 1200 /* Queue all fragments atomically */ 1201 spin_lock_bh(&conn->data_q.lock); 1202 1203 __skb_queue_tail(&conn->data_q, skb); 1204 do { 1205 skb = list; list = list->next; 1206 1207 skb->dev = (void *) hdev; 1208 bt_cb(skb)->pkt_type = HCI_ACLDATA_PKT; 1209 hci_add_acl_hdr(skb, conn->handle, flags | ACL_CONT); 1210 1211 BT_DBG("%s frag %p len %d", hdev->name, skb, skb->len); 1212 1213 __skb_queue_tail(&conn->data_q, skb); 1214 } while (list); 1215 1216 spin_unlock_bh(&conn->data_q.lock); 1217 } 1218 1219 hci_sched_tx(hdev); 1220 return 0; 1221 } 1222 EXPORT_SYMBOL(hci_send_acl); 1223 1224 /* Send SCO data */ 1225 int hci_send_sco(struct hci_conn *conn, struct sk_buff *skb) 1226 { 1227 struct hci_dev *hdev = conn->hdev; 1228 struct hci_sco_hdr hdr; 1229 1230 BT_DBG("%s len %d", hdev->name, skb->len); 1231 1232 if (skb->len > hdev->sco_mtu) { 1233 kfree_skb(skb); 1234 return -EINVAL; 1235 } 1236 1237 hdr.handle = cpu_to_le16(conn->handle); 1238 hdr.dlen = skb->len; 1239 1240 skb_push(skb, HCI_SCO_HDR_SIZE); 1241 skb_reset_transport_header(skb); 1242 memcpy(skb_transport_header(skb), &hdr, HCI_SCO_HDR_SIZE); 1243 1244 skb->dev = (void *) hdev; 1245 bt_cb(skb)->pkt_type = HCI_SCODATA_PKT; 1246 skb_queue_tail(&conn->data_q, skb); 1247 hci_sched_tx(hdev); 1248 return 0; 1249 } 1250 EXPORT_SYMBOL(hci_send_sco); 1251 1252 /* ---- HCI TX task (outgoing data) ---- */ 1253 1254 /* HCI Connection scheduler */ 1255 static inline struct hci_conn *hci_low_sent(struct hci_dev *hdev, __u8 type, int *quote) 1256 { 1257 struct hci_conn_hash *h = &hdev->conn_hash; 1258 struct hci_conn *conn = NULL; 1259 int num = 0, min = ~0; 1260 struct list_head *p; 1261 1262 /* We don't have to lock device here. Connections are always 1263 * added and removed with TX task disabled. */ 1264 list_for_each(p, &h->list) { 1265 struct hci_conn *c; 1266 c = list_entry(p, struct hci_conn, list); 1267 1268 if (c->type != type || c->state != BT_CONNECTED 1269 || skb_queue_empty(&c->data_q)) 1270 continue; 1271 num++; 1272 1273 if (c->sent < min) { 1274 min = c->sent; 1275 conn = c; 1276 } 1277 } 1278 1279 if (conn) { 1280 int cnt = (type == ACL_LINK ? hdev->acl_cnt : hdev->sco_cnt); 1281 int q = cnt / num; 1282 *quote = q ? q : 1; 1283 } else 1284 *quote = 0; 1285 1286 BT_DBG("conn %p quote %d", conn, *quote); 1287 return conn; 1288 } 1289 1290 static inline void hci_acl_tx_to(struct hci_dev *hdev) 1291 { 1292 struct hci_conn_hash *h = &hdev->conn_hash; 1293 struct list_head *p; 1294 struct hci_conn *c; 1295 1296 BT_ERR("%s ACL tx timeout", hdev->name); 1297 1298 /* Kill stalled connections */ 1299 list_for_each(p, &h->list) { 1300 c = list_entry(p, struct hci_conn, list); 1301 if (c->type == ACL_LINK && c->sent) { 1302 BT_ERR("%s killing stalled ACL connection %s", 1303 hdev->name, batostr(&c->dst)); 1304 hci_acl_disconn(c, 0x13); 1305 } 1306 } 1307 } 1308 1309 static inline void hci_sched_acl(struct hci_dev *hdev) 1310 { 1311 struct hci_conn *conn; 1312 struct sk_buff *skb; 1313 int quote; 1314 1315 BT_DBG("%s", hdev->name); 1316 1317 if (!test_bit(HCI_RAW, &hdev->flags)) { 1318 /* ACL tx timeout must be longer than maximum 1319 * link supervision timeout (40.9 seconds) */ 1320 if (!hdev->acl_cnt && (jiffies - hdev->acl_last_tx) > (HZ * 45)) 1321 hci_acl_tx_to(hdev); 1322 } 1323 1324 while (hdev->acl_cnt && (conn = hci_low_sent(hdev, ACL_LINK, "e))) { 1325 while (quote-- && (skb = skb_dequeue(&conn->data_q))) { 1326 BT_DBG("skb %p len %d", skb, skb->len); 1327 1328 hci_conn_enter_active_mode(conn); 1329 1330 hci_send_frame(skb); 1331 hdev->acl_last_tx = jiffies; 1332 1333 hdev->acl_cnt--; 1334 conn->sent++; 1335 } 1336 } 1337 } 1338 1339 /* Schedule SCO */ 1340 static inline void hci_sched_sco(struct hci_dev *hdev) 1341 { 1342 struct hci_conn *conn; 1343 struct sk_buff *skb; 1344 int quote; 1345 1346 BT_DBG("%s", hdev->name); 1347 1348 while (hdev->sco_cnt && (conn = hci_low_sent(hdev, SCO_LINK, "e))) { 1349 while (quote-- && (skb = skb_dequeue(&conn->data_q))) { 1350 BT_DBG("skb %p len %d", skb, skb->len); 1351 hci_send_frame(skb); 1352 1353 conn->sent++; 1354 if (conn->sent == ~0) 1355 conn->sent = 0; 1356 } 1357 } 1358 } 1359 1360 static void hci_tx_task(unsigned long arg) 1361 { 1362 struct hci_dev *hdev = (struct hci_dev *) arg; 1363 struct sk_buff *skb; 1364 1365 read_lock(&hci_task_lock); 1366 1367 BT_DBG("%s acl %d sco %d", hdev->name, hdev->acl_cnt, hdev->sco_cnt); 1368 1369 /* Schedule queues and send stuff to HCI driver */ 1370 1371 hci_sched_acl(hdev); 1372 1373 hci_sched_sco(hdev); 1374 1375 /* Send next queued raw (unknown type) packet */ 1376 while ((skb = skb_dequeue(&hdev->raw_q))) 1377 hci_send_frame(skb); 1378 1379 read_unlock(&hci_task_lock); 1380 } 1381 1382 /* ----- HCI RX task (incoming data proccessing) ----- */ 1383 1384 /* ACL data packet */ 1385 static inline void hci_acldata_packet(struct hci_dev *hdev, struct sk_buff *skb) 1386 { 1387 struct hci_acl_hdr *hdr = (void *) skb->data; 1388 struct hci_conn *conn; 1389 __u16 handle, flags; 1390 1391 skb_pull(skb, HCI_ACL_HDR_SIZE); 1392 1393 handle = __le16_to_cpu(hdr->handle); 1394 flags = hci_flags(handle); 1395 handle = hci_handle(handle); 1396 1397 BT_DBG("%s len %d handle 0x%x flags 0x%x", hdev->name, skb->len, handle, flags); 1398 1399 hdev->stat.acl_rx++; 1400 1401 hci_dev_lock(hdev); 1402 conn = hci_conn_hash_lookup_handle(hdev, handle); 1403 hci_dev_unlock(hdev); 1404 1405 if (conn) { 1406 register struct hci_proto *hp; 1407 1408 hci_conn_enter_active_mode(conn); 1409 1410 /* Send to upper protocol */ 1411 if ((hp = hci_proto[HCI_PROTO_L2CAP]) && hp->recv_acldata) { 1412 hp->recv_acldata(conn, skb, flags); 1413 return; 1414 } 1415 } else { 1416 BT_ERR("%s ACL packet for unknown connection handle %d", 1417 hdev->name, handle); 1418 } 1419 1420 kfree_skb(skb); 1421 } 1422 1423 /* SCO data packet */ 1424 static inline void hci_scodata_packet(struct hci_dev *hdev, struct sk_buff *skb) 1425 { 1426 struct hci_sco_hdr *hdr = (void *) skb->data; 1427 struct hci_conn *conn; 1428 __u16 handle; 1429 1430 skb_pull(skb, HCI_SCO_HDR_SIZE); 1431 1432 handle = __le16_to_cpu(hdr->handle); 1433 1434 BT_DBG("%s len %d handle 0x%x", hdev->name, skb->len, handle); 1435 1436 hdev->stat.sco_rx++; 1437 1438 hci_dev_lock(hdev); 1439 conn = hci_conn_hash_lookup_handle(hdev, handle); 1440 hci_dev_unlock(hdev); 1441 1442 if (conn) { 1443 register struct hci_proto *hp; 1444 1445 /* Send to upper protocol */ 1446 if ((hp = hci_proto[HCI_PROTO_SCO]) && hp->recv_scodata) { 1447 hp->recv_scodata(conn, skb); 1448 return; 1449 } 1450 } else { 1451 BT_ERR("%s SCO packet for unknown connection handle %d", 1452 hdev->name, handle); 1453 } 1454 1455 kfree_skb(skb); 1456 } 1457 1458 static void hci_rx_task(unsigned long arg) 1459 { 1460 struct hci_dev *hdev = (struct hci_dev *) arg; 1461 struct sk_buff *skb; 1462 1463 BT_DBG("%s", hdev->name); 1464 1465 read_lock(&hci_task_lock); 1466 1467 while ((skb = skb_dequeue(&hdev->rx_q))) { 1468 if (atomic_read(&hdev->promisc)) { 1469 /* Send copy to the sockets */ 1470 hci_send_to_sock(hdev, skb); 1471 } 1472 1473 if (test_bit(HCI_RAW, &hdev->flags)) { 1474 kfree_skb(skb); 1475 continue; 1476 } 1477 1478 if (test_bit(HCI_INIT, &hdev->flags)) { 1479 /* Don't process data packets in this states. */ 1480 switch (bt_cb(skb)->pkt_type) { 1481 case HCI_ACLDATA_PKT: 1482 case HCI_SCODATA_PKT: 1483 kfree_skb(skb); 1484 continue; 1485 } 1486 } 1487 1488 /* Process frame */ 1489 switch (bt_cb(skb)->pkt_type) { 1490 case HCI_EVENT_PKT: 1491 hci_event_packet(hdev, skb); 1492 break; 1493 1494 case HCI_ACLDATA_PKT: 1495 BT_DBG("%s ACL data packet", hdev->name); 1496 hci_acldata_packet(hdev, skb); 1497 break; 1498 1499 case HCI_SCODATA_PKT: 1500 BT_DBG("%s SCO data packet", hdev->name); 1501 hci_scodata_packet(hdev, skb); 1502 break; 1503 1504 default: 1505 kfree_skb(skb); 1506 break; 1507 } 1508 } 1509 1510 read_unlock(&hci_task_lock); 1511 } 1512 1513 static void hci_cmd_task(unsigned long arg) 1514 { 1515 struct hci_dev *hdev = (struct hci_dev *) arg; 1516 struct sk_buff *skb; 1517 1518 BT_DBG("%s cmd %d", hdev->name, atomic_read(&hdev->cmd_cnt)); 1519 1520 if (!atomic_read(&hdev->cmd_cnt) && (jiffies - hdev->cmd_last_tx) > HZ) { 1521 BT_ERR("%s command tx timeout", hdev->name); 1522 atomic_set(&hdev->cmd_cnt, 1); 1523 } 1524 1525 /* Send queued commands */ 1526 if (atomic_read(&hdev->cmd_cnt) && (skb = skb_dequeue(&hdev->cmd_q))) { 1527 if (hdev->sent_cmd) 1528 kfree_skb(hdev->sent_cmd); 1529 1530 if ((hdev->sent_cmd = skb_clone(skb, GFP_ATOMIC))) { 1531 atomic_dec(&hdev->cmd_cnt); 1532 hci_send_frame(skb); 1533 hdev->cmd_last_tx = jiffies; 1534 } else { 1535 skb_queue_head(&hdev->cmd_q, skb); 1536 hci_sched_cmd(hdev); 1537 } 1538 } 1539 } 1540