1 /* 2 BlueZ - Bluetooth protocol stack for Linux 3 Copyright (C) 2000-2001 Qualcomm Incorporated 4 5 Written 2000,2001 by Maxim Krasnyansky <maxk@qualcomm.com> 6 7 This program is free software; you can redistribute it and/or modify 8 it under the terms of the GNU General Public License version 2 as 9 published by the Free Software Foundation; 10 11 THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS 12 OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, 13 FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS. 14 IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY 15 CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES 16 WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN 17 ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF 18 OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. 19 20 ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS, 21 COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS 22 SOFTWARE IS DISCLAIMED. 23 */ 24 25 /* Bluetooth HCI core. */ 26 27 #include <linux/jiffies.h> 28 #include <linux/module.h> 29 #include <linux/kmod.h> 30 31 #include <linux/types.h> 32 #include <linux/errno.h> 33 #include <linux/kernel.h> 34 #include <linux/sched.h> 35 #include <linux/slab.h> 36 #include <linux/poll.h> 37 #include <linux/fcntl.h> 38 #include <linux/init.h> 39 #include <linux/skbuff.h> 40 #include <linux/interrupt.h> 41 #include <linux/notifier.h> 42 #include <net/sock.h> 43 44 #include <asm/system.h> 45 #include <asm/uaccess.h> 46 #include <asm/unaligned.h> 47 48 #include <net/bluetooth/bluetooth.h> 49 #include <net/bluetooth/hci_core.h> 50 51 #ifndef CONFIG_BT_HCI_CORE_DEBUG 52 #undef BT_DBG 53 #define BT_DBG(D...) 54 #endif 55 56 static void hci_cmd_task(unsigned long arg); 57 static void hci_rx_task(unsigned long arg); 58 static void hci_tx_task(unsigned long arg); 59 static void hci_notify(struct hci_dev *hdev, int event); 60 61 static DEFINE_RWLOCK(hci_task_lock); 62 63 /* HCI device list */ 64 LIST_HEAD(hci_dev_list); 65 DEFINE_RWLOCK(hci_dev_list_lock); 66 67 /* HCI callback list */ 68 LIST_HEAD(hci_cb_list); 69 DEFINE_RWLOCK(hci_cb_list_lock); 70 71 /* HCI protocols */ 72 #define HCI_MAX_PROTO 2 73 struct hci_proto *hci_proto[HCI_MAX_PROTO]; 74 75 /* HCI notifiers list */ 76 static ATOMIC_NOTIFIER_HEAD(hci_notifier); 77 78 /* ---- HCI notifications ---- */ 79 80 int hci_register_notifier(struct notifier_block *nb) 81 { 82 return atomic_notifier_chain_register(&hci_notifier, nb); 83 } 84 85 int hci_unregister_notifier(struct notifier_block *nb) 86 { 87 return atomic_notifier_chain_unregister(&hci_notifier, nb); 88 } 89 90 static void hci_notify(struct hci_dev *hdev, int event) 91 { 92 atomic_notifier_call_chain(&hci_notifier, event, hdev); 93 } 94 95 /* ---- HCI requests ---- */ 96 97 void hci_req_complete(struct hci_dev *hdev, int result) 98 { 99 BT_DBG("%s result 0x%2.2x", hdev->name, result); 100 101 if (hdev->req_status == HCI_REQ_PEND) { 102 hdev->req_result = result; 103 hdev->req_status = HCI_REQ_DONE; 104 wake_up_interruptible(&hdev->req_wait_q); 105 } 106 } 107 108 static void hci_req_cancel(struct hci_dev *hdev, int err) 109 { 110 BT_DBG("%s err 0x%2.2x", hdev->name, err); 111 112 if (hdev->req_status == HCI_REQ_PEND) { 113 hdev->req_result = err; 114 hdev->req_status = HCI_REQ_CANCELED; 115 wake_up_interruptible(&hdev->req_wait_q); 116 } 117 } 118 119 /* Execute request and wait for completion. */ 120 static int __hci_request(struct hci_dev *hdev, void (*req)(struct hci_dev *hdev, unsigned long opt), 121 unsigned long opt, __u32 timeout) 122 { 123 DECLARE_WAITQUEUE(wait, current); 124 int err = 0; 125 126 BT_DBG("%s start", hdev->name); 127 128 hdev->req_status = HCI_REQ_PEND; 129 130 add_wait_queue(&hdev->req_wait_q, &wait); 131 set_current_state(TASK_INTERRUPTIBLE); 132 133 req(hdev, opt); 134 schedule_timeout(timeout); 135 136 remove_wait_queue(&hdev->req_wait_q, &wait); 137 138 if (signal_pending(current)) 139 return -EINTR; 140 141 switch (hdev->req_status) { 142 case HCI_REQ_DONE: 143 err = -bt_err(hdev->req_result); 144 break; 145 146 case HCI_REQ_CANCELED: 147 err = -hdev->req_result; 148 break; 149 150 default: 151 err = -ETIMEDOUT; 152 break; 153 } 154 155 hdev->req_status = hdev->req_result = 0; 156 157 BT_DBG("%s end: err %d", hdev->name, err); 158 159 return err; 160 } 161 162 static inline int hci_request(struct hci_dev *hdev, void (*req)(struct hci_dev *hdev, unsigned long opt), 163 unsigned long opt, __u32 timeout) 164 { 165 int ret; 166 167 /* Serialize all requests */ 168 hci_req_lock(hdev); 169 ret = __hci_request(hdev, req, opt, timeout); 170 hci_req_unlock(hdev); 171 172 return ret; 173 } 174 175 static void hci_reset_req(struct hci_dev *hdev, unsigned long opt) 176 { 177 BT_DBG("%s %ld", hdev->name, opt); 178 179 /* Reset device */ 180 hci_send_cmd(hdev, HCI_OP_RESET, 0, NULL); 181 } 182 183 static void hci_init_req(struct hci_dev *hdev, unsigned long opt) 184 { 185 struct sk_buff *skb; 186 __le16 param; 187 __u8 flt_type; 188 189 BT_DBG("%s %ld", hdev->name, opt); 190 191 /* Driver initialization */ 192 193 /* Special commands */ 194 while ((skb = skb_dequeue(&hdev->driver_init))) { 195 bt_cb(skb)->pkt_type = HCI_COMMAND_PKT; 196 skb->dev = (void *) hdev; 197 skb_queue_tail(&hdev->cmd_q, skb); 198 hci_sched_cmd(hdev); 199 } 200 skb_queue_purge(&hdev->driver_init); 201 202 /* Mandatory initialization */ 203 204 /* Reset */ 205 if (test_bit(HCI_QUIRK_RESET_ON_INIT, &hdev->quirks)) 206 hci_send_cmd(hdev, HCI_OP_RESET, 0, NULL); 207 208 /* Read Local Supported Features */ 209 hci_send_cmd(hdev, HCI_OP_READ_LOCAL_FEATURES, 0, NULL); 210 211 /* Read Local Version */ 212 hci_send_cmd(hdev, HCI_OP_READ_LOCAL_VERSION, 0, NULL); 213 214 /* Read Buffer Size (ACL mtu, max pkt, etc.) */ 215 hci_send_cmd(hdev, HCI_OP_READ_BUFFER_SIZE, 0, NULL); 216 217 #if 0 218 /* Host buffer size */ 219 { 220 struct hci_cp_host_buffer_size cp; 221 cp.acl_mtu = cpu_to_le16(HCI_MAX_ACL_SIZE); 222 cp.sco_mtu = HCI_MAX_SCO_SIZE; 223 cp.acl_max_pkt = cpu_to_le16(0xffff); 224 cp.sco_max_pkt = cpu_to_le16(0xffff); 225 hci_send_cmd(hdev, HCI_OP_HOST_BUFFER_SIZE, sizeof(cp), &cp); 226 } 227 #endif 228 229 /* Read BD Address */ 230 hci_send_cmd(hdev, HCI_OP_READ_BD_ADDR, 0, NULL); 231 232 /* Read Class of Device */ 233 hci_send_cmd(hdev, HCI_OP_READ_CLASS_OF_DEV, 0, NULL); 234 235 /* Read Local Name */ 236 hci_send_cmd(hdev, HCI_OP_READ_LOCAL_NAME, 0, NULL); 237 238 /* Read Voice Setting */ 239 hci_send_cmd(hdev, HCI_OP_READ_VOICE_SETTING, 0, NULL); 240 241 /* Optional initialization */ 242 243 /* Clear Event Filters */ 244 flt_type = HCI_FLT_CLEAR_ALL; 245 hci_send_cmd(hdev, HCI_OP_SET_EVENT_FLT, 1, &flt_type); 246 247 /* Page timeout ~20 secs */ 248 param = cpu_to_le16(0x8000); 249 hci_send_cmd(hdev, HCI_OP_WRITE_PG_TIMEOUT, 2, ¶m); 250 251 /* Connection accept timeout ~20 secs */ 252 param = cpu_to_le16(0x7d00); 253 hci_send_cmd(hdev, HCI_OP_WRITE_CA_TIMEOUT, 2, ¶m); 254 } 255 256 static void hci_scan_req(struct hci_dev *hdev, unsigned long opt) 257 { 258 __u8 scan = opt; 259 260 BT_DBG("%s %x", hdev->name, scan); 261 262 /* Inquiry and Page scans */ 263 hci_send_cmd(hdev, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan); 264 } 265 266 static void hci_auth_req(struct hci_dev *hdev, unsigned long opt) 267 { 268 __u8 auth = opt; 269 270 BT_DBG("%s %x", hdev->name, auth); 271 272 /* Authentication */ 273 hci_send_cmd(hdev, HCI_OP_WRITE_AUTH_ENABLE, 1, &auth); 274 } 275 276 static void hci_encrypt_req(struct hci_dev *hdev, unsigned long opt) 277 { 278 __u8 encrypt = opt; 279 280 BT_DBG("%s %x", hdev->name, encrypt); 281 282 /* Authentication */ 283 hci_send_cmd(hdev, HCI_OP_WRITE_ENCRYPT_MODE, 1, &encrypt); 284 } 285 286 /* Get HCI device by index. 287 * Device is held on return. */ 288 struct hci_dev *hci_dev_get(int index) 289 { 290 struct hci_dev *hdev = NULL; 291 struct list_head *p; 292 293 BT_DBG("%d", index); 294 295 if (index < 0) 296 return NULL; 297 298 read_lock(&hci_dev_list_lock); 299 list_for_each(p, &hci_dev_list) { 300 struct hci_dev *d = list_entry(p, struct hci_dev, list); 301 if (d->id == index) { 302 hdev = hci_dev_hold(d); 303 break; 304 } 305 } 306 read_unlock(&hci_dev_list_lock); 307 return hdev; 308 } 309 310 /* ---- Inquiry support ---- */ 311 static void inquiry_cache_flush(struct hci_dev *hdev) 312 { 313 struct inquiry_cache *cache = &hdev->inq_cache; 314 struct inquiry_entry *next = cache->list, *e; 315 316 BT_DBG("cache %p", cache); 317 318 cache->list = NULL; 319 while ((e = next)) { 320 next = e->next; 321 kfree(e); 322 } 323 } 324 325 struct inquiry_entry *hci_inquiry_cache_lookup(struct hci_dev *hdev, bdaddr_t *bdaddr) 326 { 327 struct inquiry_cache *cache = &hdev->inq_cache; 328 struct inquiry_entry *e; 329 330 BT_DBG("cache %p, %s", cache, batostr(bdaddr)); 331 332 for (e = cache->list; e; e = e->next) 333 if (!bacmp(&e->data.bdaddr, bdaddr)) 334 break; 335 return e; 336 } 337 338 void hci_inquiry_cache_update(struct hci_dev *hdev, struct inquiry_data *data) 339 { 340 struct inquiry_cache *cache = &hdev->inq_cache; 341 struct inquiry_entry *e; 342 343 BT_DBG("cache %p, %s", cache, batostr(&data->bdaddr)); 344 345 if (!(e = hci_inquiry_cache_lookup(hdev, &data->bdaddr))) { 346 /* Entry not in the cache. Add new one. */ 347 if (!(e = kzalloc(sizeof(struct inquiry_entry), GFP_ATOMIC))) 348 return; 349 e->next = cache->list; 350 cache->list = e; 351 } 352 353 memcpy(&e->data, data, sizeof(*data)); 354 e->timestamp = jiffies; 355 cache->timestamp = jiffies; 356 } 357 358 static int inquiry_cache_dump(struct hci_dev *hdev, int num, __u8 *buf) 359 { 360 struct inquiry_cache *cache = &hdev->inq_cache; 361 struct inquiry_info *info = (struct inquiry_info *) buf; 362 struct inquiry_entry *e; 363 int copied = 0; 364 365 for (e = cache->list; e && copied < num; e = e->next, copied++) { 366 struct inquiry_data *data = &e->data; 367 bacpy(&info->bdaddr, &data->bdaddr); 368 info->pscan_rep_mode = data->pscan_rep_mode; 369 info->pscan_period_mode = data->pscan_period_mode; 370 info->pscan_mode = data->pscan_mode; 371 memcpy(info->dev_class, data->dev_class, 3); 372 info->clock_offset = data->clock_offset; 373 info++; 374 } 375 376 BT_DBG("cache %p, copied %d", cache, copied); 377 return copied; 378 } 379 380 static void hci_inq_req(struct hci_dev *hdev, unsigned long opt) 381 { 382 struct hci_inquiry_req *ir = (struct hci_inquiry_req *) opt; 383 struct hci_cp_inquiry cp; 384 385 BT_DBG("%s", hdev->name); 386 387 if (test_bit(HCI_INQUIRY, &hdev->flags)) 388 return; 389 390 /* Start Inquiry */ 391 memcpy(&cp.lap, &ir->lap, 3); 392 cp.length = ir->length; 393 cp.num_rsp = ir->num_rsp; 394 hci_send_cmd(hdev, HCI_OP_INQUIRY, sizeof(cp), &cp); 395 } 396 397 int hci_inquiry(void __user *arg) 398 { 399 __u8 __user *ptr = arg; 400 struct hci_inquiry_req ir; 401 struct hci_dev *hdev; 402 int err = 0, do_inquiry = 0, max_rsp; 403 long timeo; 404 __u8 *buf; 405 406 if (copy_from_user(&ir, ptr, sizeof(ir))) 407 return -EFAULT; 408 409 if (!(hdev = hci_dev_get(ir.dev_id))) 410 return -ENODEV; 411 412 hci_dev_lock_bh(hdev); 413 if (inquiry_cache_age(hdev) > INQUIRY_CACHE_AGE_MAX || 414 inquiry_cache_empty(hdev) || 415 ir.flags & IREQ_CACHE_FLUSH) { 416 inquiry_cache_flush(hdev); 417 do_inquiry = 1; 418 } 419 hci_dev_unlock_bh(hdev); 420 421 timeo = ir.length * msecs_to_jiffies(2000); 422 if (do_inquiry && (err = hci_request(hdev, hci_inq_req, (unsigned long)&ir, timeo)) < 0) 423 goto done; 424 425 /* for unlimited number of responses we will use buffer with 255 entries */ 426 max_rsp = (ir.num_rsp == 0) ? 255 : ir.num_rsp; 427 428 /* cache_dump can't sleep. Therefore we allocate temp buffer and then 429 * copy it to the user space. 430 */ 431 if (!(buf = kmalloc(sizeof(struct inquiry_info) * max_rsp, GFP_KERNEL))) { 432 err = -ENOMEM; 433 goto done; 434 } 435 436 hci_dev_lock_bh(hdev); 437 ir.num_rsp = inquiry_cache_dump(hdev, max_rsp, buf); 438 hci_dev_unlock_bh(hdev); 439 440 BT_DBG("num_rsp %d", ir.num_rsp); 441 442 if (!copy_to_user(ptr, &ir, sizeof(ir))) { 443 ptr += sizeof(ir); 444 if (copy_to_user(ptr, buf, sizeof(struct inquiry_info) * 445 ir.num_rsp)) 446 err = -EFAULT; 447 } else 448 err = -EFAULT; 449 450 kfree(buf); 451 452 done: 453 hci_dev_put(hdev); 454 return err; 455 } 456 457 /* ---- HCI ioctl helpers ---- */ 458 459 int hci_dev_open(__u16 dev) 460 { 461 struct hci_dev *hdev; 462 int ret = 0; 463 464 if (!(hdev = hci_dev_get(dev))) 465 return -ENODEV; 466 467 BT_DBG("%s %p", hdev->name, hdev); 468 469 hci_req_lock(hdev); 470 471 if (test_bit(HCI_UP, &hdev->flags)) { 472 ret = -EALREADY; 473 goto done; 474 } 475 476 if (test_bit(HCI_QUIRK_RAW_DEVICE, &hdev->quirks)) 477 set_bit(HCI_RAW, &hdev->flags); 478 479 if (hdev->open(hdev)) { 480 ret = -EIO; 481 goto done; 482 } 483 484 if (!test_bit(HCI_RAW, &hdev->flags)) { 485 atomic_set(&hdev->cmd_cnt, 1); 486 set_bit(HCI_INIT, &hdev->flags); 487 488 //__hci_request(hdev, hci_reset_req, 0, HZ); 489 ret = __hci_request(hdev, hci_init_req, 0, 490 msecs_to_jiffies(HCI_INIT_TIMEOUT)); 491 492 clear_bit(HCI_INIT, &hdev->flags); 493 } 494 495 if (!ret) { 496 hci_dev_hold(hdev); 497 set_bit(HCI_UP, &hdev->flags); 498 hci_notify(hdev, HCI_DEV_UP); 499 } else { 500 /* Init failed, cleanup */ 501 tasklet_kill(&hdev->rx_task); 502 tasklet_kill(&hdev->tx_task); 503 tasklet_kill(&hdev->cmd_task); 504 505 skb_queue_purge(&hdev->cmd_q); 506 skb_queue_purge(&hdev->rx_q); 507 508 if (hdev->flush) 509 hdev->flush(hdev); 510 511 if (hdev->sent_cmd) { 512 kfree_skb(hdev->sent_cmd); 513 hdev->sent_cmd = NULL; 514 } 515 516 hdev->close(hdev); 517 hdev->flags = 0; 518 } 519 520 done: 521 hci_req_unlock(hdev); 522 hci_dev_put(hdev); 523 return ret; 524 } 525 526 static int hci_dev_do_close(struct hci_dev *hdev) 527 { 528 BT_DBG("%s %p", hdev->name, hdev); 529 530 hci_req_cancel(hdev, ENODEV); 531 hci_req_lock(hdev); 532 533 if (!test_and_clear_bit(HCI_UP, &hdev->flags)) { 534 hci_req_unlock(hdev); 535 return 0; 536 } 537 538 /* Kill RX and TX tasks */ 539 tasklet_kill(&hdev->rx_task); 540 tasklet_kill(&hdev->tx_task); 541 542 hci_dev_lock_bh(hdev); 543 inquiry_cache_flush(hdev); 544 hci_conn_hash_flush(hdev); 545 hci_dev_unlock_bh(hdev); 546 547 hci_notify(hdev, HCI_DEV_DOWN); 548 549 if (hdev->flush) 550 hdev->flush(hdev); 551 552 /* Reset device */ 553 skb_queue_purge(&hdev->cmd_q); 554 atomic_set(&hdev->cmd_cnt, 1); 555 if (!test_bit(HCI_RAW, &hdev->flags)) { 556 set_bit(HCI_INIT, &hdev->flags); 557 __hci_request(hdev, hci_reset_req, 0, 558 msecs_to_jiffies(250)); 559 clear_bit(HCI_INIT, &hdev->flags); 560 } 561 562 /* Kill cmd task */ 563 tasklet_kill(&hdev->cmd_task); 564 565 /* Drop queues */ 566 skb_queue_purge(&hdev->rx_q); 567 skb_queue_purge(&hdev->cmd_q); 568 skb_queue_purge(&hdev->raw_q); 569 570 /* Drop last sent command */ 571 if (hdev->sent_cmd) { 572 kfree_skb(hdev->sent_cmd); 573 hdev->sent_cmd = NULL; 574 } 575 576 /* After this point our queues are empty 577 * and no tasks are scheduled. */ 578 hdev->close(hdev); 579 580 /* Clear flags */ 581 hdev->flags = 0; 582 583 hci_req_unlock(hdev); 584 585 hci_dev_put(hdev); 586 return 0; 587 } 588 589 int hci_dev_close(__u16 dev) 590 { 591 struct hci_dev *hdev; 592 int err; 593 594 if (!(hdev = hci_dev_get(dev))) 595 return -ENODEV; 596 err = hci_dev_do_close(hdev); 597 hci_dev_put(hdev); 598 return err; 599 } 600 601 int hci_dev_reset(__u16 dev) 602 { 603 struct hci_dev *hdev; 604 int ret = 0; 605 606 if (!(hdev = hci_dev_get(dev))) 607 return -ENODEV; 608 609 hci_req_lock(hdev); 610 tasklet_disable(&hdev->tx_task); 611 612 if (!test_bit(HCI_UP, &hdev->flags)) 613 goto done; 614 615 /* Drop queues */ 616 skb_queue_purge(&hdev->rx_q); 617 skb_queue_purge(&hdev->cmd_q); 618 619 hci_dev_lock_bh(hdev); 620 inquiry_cache_flush(hdev); 621 hci_conn_hash_flush(hdev); 622 hci_dev_unlock_bh(hdev); 623 624 if (hdev->flush) 625 hdev->flush(hdev); 626 627 atomic_set(&hdev->cmd_cnt, 1); 628 hdev->acl_cnt = 0; hdev->sco_cnt = 0; 629 630 if (!test_bit(HCI_RAW, &hdev->flags)) 631 ret = __hci_request(hdev, hci_reset_req, 0, 632 msecs_to_jiffies(HCI_INIT_TIMEOUT)); 633 634 done: 635 tasklet_enable(&hdev->tx_task); 636 hci_req_unlock(hdev); 637 hci_dev_put(hdev); 638 return ret; 639 } 640 641 int hci_dev_reset_stat(__u16 dev) 642 { 643 struct hci_dev *hdev; 644 int ret = 0; 645 646 if (!(hdev = hci_dev_get(dev))) 647 return -ENODEV; 648 649 memset(&hdev->stat, 0, sizeof(struct hci_dev_stats)); 650 651 hci_dev_put(hdev); 652 653 return ret; 654 } 655 656 int hci_dev_cmd(unsigned int cmd, void __user *arg) 657 { 658 struct hci_dev *hdev; 659 struct hci_dev_req dr; 660 int err = 0; 661 662 if (copy_from_user(&dr, arg, sizeof(dr))) 663 return -EFAULT; 664 665 if (!(hdev = hci_dev_get(dr.dev_id))) 666 return -ENODEV; 667 668 switch (cmd) { 669 case HCISETAUTH: 670 err = hci_request(hdev, hci_auth_req, dr.dev_opt, 671 msecs_to_jiffies(HCI_INIT_TIMEOUT)); 672 break; 673 674 case HCISETENCRYPT: 675 if (!lmp_encrypt_capable(hdev)) { 676 err = -EOPNOTSUPP; 677 break; 678 } 679 680 if (!test_bit(HCI_AUTH, &hdev->flags)) { 681 /* Auth must be enabled first */ 682 err = hci_request(hdev, hci_auth_req, dr.dev_opt, 683 msecs_to_jiffies(HCI_INIT_TIMEOUT)); 684 if (err) 685 break; 686 } 687 688 err = hci_request(hdev, hci_encrypt_req, dr.dev_opt, 689 msecs_to_jiffies(HCI_INIT_TIMEOUT)); 690 break; 691 692 case HCISETSCAN: 693 err = hci_request(hdev, hci_scan_req, dr.dev_opt, 694 msecs_to_jiffies(HCI_INIT_TIMEOUT)); 695 break; 696 697 case HCISETPTYPE: 698 hdev->pkt_type = (__u16) dr.dev_opt; 699 break; 700 701 case HCISETLINKPOL: 702 hdev->link_policy = (__u16) dr.dev_opt; 703 break; 704 705 case HCISETLINKMODE: 706 hdev->link_mode = ((__u16) dr.dev_opt) & (HCI_LM_MASTER | HCI_LM_ACCEPT); 707 break; 708 709 case HCISETACLMTU: 710 hdev->acl_mtu = *((__u16 *)&dr.dev_opt + 1); 711 hdev->acl_pkts = *((__u16 *)&dr.dev_opt + 0); 712 break; 713 714 case HCISETSCOMTU: 715 hdev->sco_mtu = *((__u16 *)&dr.dev_opt + 1); 716 hdev->sco_pkts = *((__u16 *)&dr.dev_opt + 0); 717 break; 718 719 default: 720 err = -EINVAL; 721 break; 722 } 723 hci_dev_put(hdev); 724 return err; 725 } 726 727 int hci_get_dev_list(void __user *arg) 728 { 729 struct hci_dev_list_req *dl; 730 struct hci_dev_req *dr; 731 struct list_head *p; 732 int n = 0, size, err; 733 __u16 dev_num; 734 735 if (get_user(dev_num, (__u16 __user *) arg)) 736 return -EFAULT; 737 738 if (!dev_num || dev_num > (PAGE_SIZE * 2) / sizeof(*dr)) 739 return -EINVAL; 740 741 size = sizeof(*dl) + dev_num * sizeof(*dr); 742 743 if (!(dl = kmalloc(size, GFP_KERNEL))) 744 return -ENOMEM; 745 746 dr = dl->dev_req; 747 748 read_lock_bh(&hci_dev_list_lock); 749 list_for_each(p, &hci_dev_list) { 750 struct hci_dev *hdev; 751 hdev = list_entry(p, struct hci_dev, list); 752 (dr + n)->dev_id = hdev->id; 753 (dr + n)->dev_opt = hdev->flags; 754 if (++n >= dev_num) 755 break; 756 } 757 read_unlock_bh(&hci_dev_list_lock); 758 759 dl->dev_num = n; 760 size = sizeof(*dl) + n * sizeof(*dr); 761 762 err = copy_to_user(arg, dl, size); 763 kfree(dl); 764 765 return err ? -EFAULT : 0; 766 } 767 768 int hci_get_dev_info(void __user *arg) 769 { 770 struct hci_dev *hdev; 771 struct hci_dev_info di; 772 int err = 0; 773 774 if (copy_from_user(&di, arg, sizeof(di))) 775 return -EFAULT; 776 777 if (!(hdev = hci_dev_get(di.dev_id))) 778 return -ENODEV; 779 780 strcpy(di.name, hdev->name); 781 di.bdaddr = hdev->bdaddr; 782 di.type = hdev->type; 783 di.flags = hdev->flags; 784 di.pkt_type = hdev->pkt_type; 785 di.acl_mtu = hdev->acl_mtu; 786 di.acl_pkts = hdev->acl_pkts; 787 di.sco_mtu = hdev->sco_mtu; 788 di.sco_pkts = hdev->sco_pkts; 789 di.link_policy = hdev->link_policy; 790 di.link_mode = hdev->link_mode; 791 792 memcpy(&di.stat, &hdev->stat, sizeof(di.stat)); 793 memcpy(&di.features, &hdev->features, sizeof(di.features)); 794 795 if (copy_to_user(arg, &di, sizeof(di))) 796 err = -EFAULT; 797 798 hci_dev_put(hdev); 799 800 return err; 801 } 802 803 /* ---- Interface to HCI drivers ---- */ 804 805 /* Alloc HCI device */ 806 struct hci_dev *hci_alloc_dev(void) 807 { 808 struct hci_dev *hdev; 809 810 hdev = kzalloc(sizeof(struct hci_dev), GFP_KERNEL); 811 if (!hdev) 812 return NULL; 813 814 skb_queue_head_init(&hdev->driver_init); 815 816 return hdev; 817 } 818 EXPORT_SYMBOL(hci_alloc_dev); 819 820 /* Free HCI device */ 821 void hci_free_dev(struct hci_dev *hdev) 822 { 823 skb_queue_purge(&hdev->driver_init); 824 825 /* will free via device release */ 826 put_device(&hdev->dev); 827 } 828 EXPORT_SYMBOL(hci_free_dev); 829 830 /* Register HCI device */ 831 int hci_register_dev(struct hci_dev *hdev) 832 { 833 struct list_head *head = &hci_dev_list, *p; 834 int i, id = 0; 835 836 BT_DBG("%p name %s type %d owner %p", hdev, hdev->name, hdev->type, hdev->owner); 837 838 if (!hdev->open || !hdev->close || !hdev->destruct) 839 return -EINVAL; 840 841 write_lock_bh(&hci_dev_list_lock); 842 843 /* Find first available device id */ 844 list_for_each(p, &hci_dev_list) { 845 if (list_entry(p, struct hci_dev, list)->id != id) 846 break; 847 head = p; id++; 848 } 849 850 sprintf(hdev->name, "hci%d", id); 851 hdev->id = id; 852 list_add(&hdev->list, head); 853 854 atomic_set(&hdev->refcnt, 1); 855 spin_lock_init(&hdev->lock); 856 857 hdev->flags = 0; 858 hdev->pkt_type = (HCI_DM1 | HCI_DH1 | HCI_HV1); 859 hdev->esco_type = (ESCO_HV1); 860 hdev->link_mode = (HCI_LM_ACCEPT); 861 862 hdev->idle_timeout = 0; 863 hdev->sniff_max_interval = 800; 864 hdev->sniff_min_interval = 80; 865 866 tasklet_init(&hdev->cmd_task, hci_cmd_task,(unsigned long) hdev); 867 tasklet_init(&hdev->rx_task, hci_rx_task, (unsigned long) hdev); 868 tasklet_init(&hdev->tx_task, hci_tx_task, (unsigned long) hdev); 869 870 skb_queue_head_init(&hdev->rx_q); 871 skb_queue_head_init(&hdev->cmd_q); 872 skb_queue_head_init(&hdev->raw_q); 873 874 for (i = 0; i < 3; i++) 875 hdev->reassembly[i] = NULL; 876 877 init_waitqueue_head(&hdev->req_wait_q); 878 init_MUTEX(&hdev->req_lock); 879 880 inquiry_cache_init(hdev); 881 882 hci_conn_hash_init(hdev); 883 884 memset(&hdev->stat, 0, sizeof(struct hci_dev_stats)); 885 886 atomic_set(&hdev->promisc, 0); 887 888 write_unlock_bh(&hci_dev_list_lock); 889 890 hci_register_sysfs(hdev); 891 892 hci_notify(hdev, HCI_DEV_REG); 893 894 return id; 895 } 896 EXPORT_SYMBOL(hci_register_dev); 897 898 /* Unregister HCI device */ 899 int hci_unregister_dev(struct hci_dev *hdev) 900 { 901 int i; 902 903 BT_DBG("%p name %s type %d", hdev, hdev->name, hdev->type); 904 905 write_lock_bh(&hci_dev_list_lock); 906 list_del(&hdev->list); 907 write_unlock_bh(&hci_dev_list_lock); 908 909 hci_dev_do_close(hdev); 910 911 for (i = 0; i < 3; i++) 912 kfree_skb(hdev->reassembly[i]); 913 914 hci_notify(hdev, HCI_DEV_UNREG); 915 916 hci_unregister_sysfs(hdev); 917 918 __hci_dev_put(hdev); 919 920 return 0; 921 } 922 EXPORT_SYMBOL(hci_unregister_dev); 923 924 /* Suspend HCI device */ 925 int hci_suspend_dev(struct hci_dev *hdev) 926 { 927 hci_notify(hdev, HCI_DEV_SUSPEND); 928 return 0; 929 } 930 EXPORT_SYMBOL(hci_suspend_dev); 931 932 /* Resume HCI device */ 933 int hci_resume_dev(struct hci_dev *hdev) 934 { 935 hci_notify(hdev, HCI_DEV_RESUME); 936 return 0; 937 } 938 EXPORT_SYMBOL(hci_resume_dev); 939 940 /* Receive packet type fragment */ 941 #define __reassembly(hdev, type) ((hdev)->reassembly[(type) - 2]) 942 943 int hci_recv_fragment(struct hci_dev *hdev, int type, void *data, int count) 944 { 945 if (type < HCI_ACLDATA_PKT || type > HCI_EVENT_PKT) 946 return -EILSEQ; 947 948 while (count) { 949 struct sk_buff *skb = __reassembly(hdev, type); 950 struct { int expect; } *scb; 951 int len = 0; 952 953 if (!skb) { 954 /* Start of the frame */ 955 956 switch (type) { 957 case HCI_EVENT_PKT: 958 if (count >= HCI_EVENT_HDR_SIZE) { 959 struct hci_event_hdr *h = data; 960 len = HCI_EVENT_HDR_SIZE + h->plen; 961 } else 962 return -EILSEQ; 963 break; 964 965 case HCI_ACLDATA_PKT: 966 if (count >= HCI_ACL_HDR_SIZE) { 967 struct hci_acl_hdr *h = data; 968 len = HCI_ACL_HDR_SIZE + __le16_to_cpu(h->dlen); 969 } else 970 return -EILSEQ; 971 break; 972 973 case HCI_SCODATA_PKT: 974 if (count >= HCI_SCO_HDR_SIZE) { 975 struct hci_sco_hdr *h = data; 976 len = HCI_SCO_HDR_SIZE + h->dlen; 977 } else 978 return -EILSEQ; 979 break; 980 } 981 982 skb = bt_skb_alloc(len, GFP_ATOMIC); 983 if (!skb) { 984 BT_ERR("%s no memory for packet", hdev->name); 985 return -ENOMEM; 986 } 987 988 skb->dev = (void *) hdev; 989 bt_cb(skb)->pkt_type = type; 990 991 __reassembly(hdev, type) = skb; 992 993 scb = (void *) skb->cb; 994 scb->expect = len; 995 } else { 996 /* Continuation */ 997 998 scb = (void *) skb->cb; 999 len = scb->expect; 1000 } 1001 1002 len = min(len, count); 1003 1004 memcpy(skb_put(skb, len), data, len); 1005 1006 scb->expect -= len; 1007 1008 if (scb->expect == 0) { 1009 /* Complete frame */ 1010 1011 __reassembly(hdev, type) = NULL; 1012 1013 bt_cb(skb)->pkt_type = type; 1014 hci_recv_frame(skb); 1015 } 1016 1017 count -= len; data += len; 1018 } 1019 1020 return 0; 1021 } 1022 EXPORT_SYMBOL(hci_recv_fragment); 1023 1024 /* ---- Interface to upper protocols ---- */ 1025 1026 /* Register/Unregister protocols. 1027 * hci_task_lock is used to ensure that no tasks are running. */ 1028 int hci_register_proto(struct hci_proto *hp) 1029 { 1030 int err = 0; 1031 1032 BT_DBG("%p name %s id %d", hp, hp->name, hp->id); 1033 1034 if (hp->id >= HCI_MAX_PROTO) 1035 return -EINVAL; 1036 1037 write_lock_bh(&hci_task_lock); 1038 1039 if (!hci_proto[hp->id]) 1040 hci_proto[hp->id] = hp; 1041 else 1042 err = -EEXIST; 1043 1044 write_unlock_bh(&hci_task_lock); 1045 1046 return err; 1047 } 1048 EXPORT_SYMBOL(hci_register_proto); 1049 1050 int hci_unregister_proto(struct hci_proto *hp) 1051 { 1052 int err = 0; 1053 1054 BT_DBG("%p name %s id %d", hp, hp->name, hp->id); 1055 1056 if (hp->id >= HCI_MAX_PROTO) 1057 return -EINVAL; 1058 1059 write_lock_bh(&hci_task_lock); 1060 1061 if (hci_proto[hp->id]) 1062 hci_proto[hp->id] = NULL; 1063 else 1064 err = -ENOENT; 1065 1066 write_unlock_bh(&hci_task_lock); 1067 1068 return err; 1069 } 1070 EXPORT_SYMBOL(hci_unregister_proto); 1071 1072 int hci_register_cb(struct hci_cb *cb) 1073 { 1074 BT_DBG("%p name %s", cb, cb->name); 1075 1076 write_lock_bh(&hci_cb_list_lock); 1077 list_add(&cb->list, &hci_cb_list); 1078 write_unlock_bh(&hci_cb_list_lock); 1079 1080 return 0; 1081 } 1082 EXPORT_SYMBOL(hci_register_cb); 1083 1084 int hci_unregister_cb(struct hci_cb *cb) 1085 { 1086 BT_DBG("%p name %s", cb, cb->name); 1087 1088 write_lock_bh(&hci_cb_list_lock); 1089 list_del(&cb->list); 1090 write_unlock_bh(&hci_cb_list_lock); 1091 1092 return 0; 1093 } 1094 EXPORT_SYMBOL(hci_unregister_cb); 1095 1096 static int hci_send_frame(struct sk_buff *skb) 1097 { 1098 struct hci_dev *hdev = (struct hci_dev *) skb->dev; 1099 1100 if (!hdev) { 1101 kfree_skb(skb); 1102 return -ENODEV; 1103 } 1104 1105 BT_DBG("%s type %d len %d", hdev->name, bt_cb(skb)->pkt_type, skb->len); 1106 1107 if (atomic_read(&hdev->promisc)) { 1108 /* Time stamp */ 1109 __net_timestamp(skb); 1110 1111 hci_send_to_sock(hdev, skb); 1112 } 1113 1114 /* Get rid of skb owner, prior to sending to the driver. */ 1115 skb_orphan(skb); 1116 1117 return hdev->send(skb); 1118 } 1119 1120 /* Send HCI command */ 1121 int hci_send_cmd(struct hci_dev *hdev, __u16 opcode, __u32 plen, void *param) 1122 { 1123 int len = HCI_COMMAND_HDR_SIZE + plen; 1124 struct hci_command_hdr *hdr; 1125 struct sk_buff *skb; 1126 1127 BT_DBG("%s opcode 0x%x plen %d", hdev->name, opcode, plen); 1128 1129 skb = bt_skb_alloc(len, GFP_ATOMIC); 1130 if (!skb) { 1131 BT_ERR("%s no memory for command", hdev->name); 1132 return -ENOMEM; 1133 } 1134 1135 hdr = (struct hci_command_hdr *) skb_put(skb, HCI_COMMAND_HDR_SIZE); 1136 hdr->opcode = cpu_to_le16(opcode); 1137 hdr->plen = plen; 1138 1139 if (plen) 1140 memcpy(skb_put(skb, plen), param, plen); 1141 1142 BT_DBG("skb len %d", skb->len); 1143 1144 bt_cb(skb)->pkt_type = HCI_COMMAND_PKT; 1145 skb->dev = (void *) hdev; 1146 skb_queue_tail(&hdev->cmd_q, skb); 1147 hci_sched_cmd(hdev); 1148 1149 return 0; 1150 } 1151 1152 /* Get data from the previously sent command */ 1153 void *hci_sent_cmd_data(struct hci_dev *hdev, __u16 opcode) 1154 { 1155 struct hci_command_hdr *hdr; 1156 1157 if (!hdev->sent_cmd) 1158 return NULL; 1159 1160 hdr = (void *) hdev->sent_cmd->data; 1161 1162 if (hdr->opcode != cpu_to_le16(opcode)) 1163 return NULL; 1164 1165 BT_DBG("%s opcode 0x%x", hdev->name, opcode); 1166 1167 return hdev->sent_cmd->data + HCI_COMMAND_HDR_SIZE; 1168 } 1169 1170 /* Send ACL data */ 1171 static void hci_add_acl_hdr(struct sk_buff *skb, __u16 handle, __u16 flags) 1172 { 1173 struct hci_acl_hdr *hdr; 1174 int len = skb->len; 1175 1176 skb_push(skb, HCI_ACL_HDR_SIZE); 1177 skb_reset_transport_header(skb); 1178 hdr = (struct hci_acl_hdr *)skb_transport_header(skb); 1179 hdr->handle = cpu_to_le16(hci_handle_pack(handle, flags)); 1180 hdr->dlen = cpu_to_le16(len); 1181 } 1182 1183 int hci_send_acl(struct hci_conn *conn, struct sk_buff *skb, __u16 flags) 1184 { 1185 struct hci_dev *hdev = conn->hdev; 1186 struct sk_buff *list; 1187 1188 BT_DBG("%s conn %p flags 0x%x", hdev->name, conn, flags); 1189 1190 skb->dev = (void *) hdev; 1191 bt_cb(skb)->pkt_type = HCI_ACLDATA_PKT; 1192 hci_add_acl_hdr(skb, conn->handle, flags | ACL_START); 1193 1194 if (!(list = skb_shinfo(skb)->frag_list)) { 1195 /* Non fragmented */ 1196 BT_DBG("%s nonfrag skb %p len %d", hdev->name, skb, skb->len); 1197 1198 skb_queue_tail(&conn->data_q, skb); 1199 } else { 1200 /* Fragmented */ 1201 BT_DBG("%s frag %p len %d", hdev->name, skb, skb->len); 1202 1203 skb_shinfo(skb)->frag_list = NULL; 1204 1205 /* Queue all fragments atomically */ 1206 spin_lock_bh(&conn->data_q.lock); 1207 1208 __skb_queue_tail(&conn->data_q, skb); 1209 do { 1210 skb = list; list = list->next; 1211 1212 skb->dev = (void *) hdev; 1213 bt_cb(skb)->pkt_type = HCI_ACLDATA_PKT; 1214 hci_add_acl_hdr(skb, conn->handle, flags | ACL_CONT); 1215 1216 BT_DBG("%s frag %p len %d", hdev->name, skb, skb->len); 1217 1218 __skb_queue_tail(&conn->data_q, skb); 1219 } while (list); 1220 1221 spin_unlock_bh(&conn->data_q.lock); 1222 } 1223 1224 hci_sched_tx(hdev); 1225 return 0; 1226 } 1227 EXPORT_SYMBOL(hci_send_acl); 1228 1229 /* Send SCO data */ 1230 int hci_send_sco(struct hci_conn *conn, struct sk_buff *skb) 1231 { 1232 struct hci_dev *hdev = conn->hdev; 1233 struct hci_sco_hdr hdr; 1234 1235 BT_DBG("%s len %d", hdev->name, skb->len); 1236 1237 if (skb->len > hdev->sco_mtu) { 1238 kfree_skb(skb); 1239 return -EINVAL; 1240 } 1241 1242 hdr.handle = cpu_to_le16(conn->handle); 1243 hdr.dlen = skb->len; 1244 1245 skb_push(skb, HCI_SCO_HDR_SIZE); 1246 skb_reset_transport_header(skb); 1247 memcpy(skb_transport_header(skb), &hdr, HCI_SCO_HDR_SIZE); 1248 1249 skb->dev = (void *) hdev; 1250 bt_cb(skb)->pkt_type = HCI_SCODATA_PKT; 1251 skb_queue_tail(&conn->data_q, skb); 1252 hci_sched_tx(hdev); 1253 return 0; 1254 } 1255 EXPORT_SYMBOL(hci_send_sco); 1256 1257 /* ---- HCI TX task (outgoing data) ---- */ 1258 1259 /* HCI Connection scheduler */ 1260 static inline struct hci_conn *hci_low_sent(struct hci_dev *hdev, __u8 type, int *quote) 1261 { 1262 struct hci_conn_hash *h = &hdev->conn_hash; 1263 struct hci_conn *conn = NULL; 1264 int num = 0, min = ~0; 1265 struct list_head *p; 1266 1267 /* We don't have to lock device here. Connections are always 1268 * added and removed with TX task disabled. */ 1269 list_for_each(p, &h->list) { 1270 struct hci_conn *c; 1271 c = list_entry(p, struct hci_conn, list); 1272 1273 if (c->type != type || c->state != BT_CONNECTED 1274 || skb_queue_empty(&c->data_q)) 1275 continue; 1276 num++; 1277 1278 if (c->sent < min) { 1279 min = c->sent; 1280 conn = c; 1281 } 1282 } 1283 1284 if (conn) { 1285 int cnt = (type == ACL_LINK ? hdev->acl_cnt : hdev->sco_cnt); 1286 int q = cnt / num; 1287 *quote = q ? q : 1; 1288 } else 1289 *quote = 0; 1290 1291 BT_DBG("conn %p quote %d", conn, *quote); 1292 return conn; 1293 } 1294 1295 static inline void hci_acl_tx_to(struct hci_dev *hdev) 1296 { 1297 struct hci_conn_hash *h = &hdev->conn_hash; 1298 struct list_head *p; 1299 struct hci_conn *c; 1300 1301 BT_ERR("%s ACL tx timeout", hdev->name); 1302 1303 /* Kill stalled connections */ 1304 list_for_each(p, &h->list) { 1305 c = list_entry(p, struct hci_conn, list); 1306 if (c->type == ACL_LINK && c->sent) { 1307 BT_ERR("%s killing stalled ACL connection %s", 1308 hdev->name, batostr(&c->dst)); 1309 hci_acl_disconn(c, 0x13); 1310 } 1311 } 1312 } 1313 1314 static inline void hci_sched_acl(struct hci_dev *hdev) 1315 { 1316 struct hci_conn *conn; 1317 struct sk_buff *skb; 1318 int quote; 1319 1320 BT_DBG("%s", hdev->name); 1321 1322 if (!test_bit(HCI_RAW, &hdev->flags)) { 1323 /* ACL tx timeout must be longer than maximum 1324 * link supervision timeout (40.9 seconds) */ 1325 if (!hdev->acl_cnt && time_after(jiffies, hdev->acl_last_tx + HZ * 45)) 1326 hci_acl_tx_to(hdev); 1327 } 1328 1329 while (hdev->acl_cnt && (conn = hci_low_sent(hdev, ACL_LINK, "e))) { 1330 while (quote-- && (skb = skb_dequeue(&conn->data_q))) { 1331 BT_DBG("skb %p len %d", skb, skb->len); 1332 1333 hci_conn_enter_active_mode(conn); 1334 1335 hci_send_frame(skb); 1336 hdev->acl_last_tx = jiffies; 1337 1338 hdev->acl_cnt--; 1339 conn->sent++; 1340 } 1341 } 1342 } 1343 1344 /* Schedule SCO */ 1345 static inline void hci_sched_sco(struct hci_dev *hdev) 1346 { 1347 struct hci_conn *conn; 1348 struct sk_buff *skb; 1349 int quote; 1350 1351 BT_DBG("%s", hdev->name); 1352 1353 while (hdev->sco_cnt && (conn = hci_low_sent(hdev, SCO_LINK, "e))) { 1354 while (quote-- && (skb = skb_dequeue(&conn->data_q))) { 1355 BT_DBG("skb %p len %d", skb, skb->len); 1356 hci_send_frame(skb); 1357 1358 conn->sent++; 1359 if (conn->sent == ~0) 1360 conn->sent = 0; 1361 } 1362 } 1363 } 1364 1365 static inline void hci_sched_esco(struct hci_dev *hdev) 1366 { 1367 struct hci_conn *conn; 1368 struct sk_buff *skb; 1369 int quote; 1370 1371 BT_DBG("%s", hdev->name); 1372 1373 while (hdev->sco_cnt && (conn = hci_low_sent(hdev, ESCO_LINK, "e))) { 1374 while (quote-- && (skb = skb_dequeue(&conn->data_q))) { 1375 BT_DBG("skb %p len %d", skb, skb->len); 1376 hci_send_frame(skb); 1377 1378 conn->sent++; 1379 if (conn->sent == ~0) 1380 conn->sent = 0; 1381 } 1382 } 1383 } 1384 1385 static void hci_tx_task(unsigned long arg) 1386 { 1387 struct hci_dev *hdev = (struct hci_dev *) arg; 1388 struct sk_buff *skb; 1389 1390 read_lock(&hci_task_lock); 1391 1392 BT_DBG("%s acl %d sco %d", hdev->name, hdev->acl_cnt, hdev->sco_cnt); 1393 1394 /* Schedule queues and send stuff to HCI driver */ 1395 1396 hci_sched_acl(hdev); 1397 1398 hci_sched_sco(hdev); 1399 1400 hci_sched_esco(hdev); 1401 1402 /* Send next queued raw (unknown type) packet */ 1403 while ((skb = skb_dequeue(&hdev->raw_q))) 1404 hci_send_frame(skb); 1405 1406 read_unlock(&hci_task_lock); 1407 } 1408 1409 /* ----- HCI RX task (incoming data proccessing) ----- */ 1410 1411 /* ACL data packet */ 1412 static inline void hci_acldata_packet(struct hci_dev *hdev, struct sk_buff *skb) 1413 { 1414 struct hci_acl_hdr *hdr = (void *) skb->data; 1415 struct hci_conn *conn; 1416 __u16 handle, flags; 1417 1418 skb_pull(skb, HCI_ACL_HDR_SIZE); 1419 1420 handle = __le16_to_cpu(hdr->handle); 1421 flags = hci_flags(handle); 1422 handle = hci_handle(handle); 1423 1424 BT_DBG("%s len %d handle 0x%x flags 0x%x", hdev->name, skb->len, handle, flags); 1425 1426 hdev->stat.acl_rx++; 1427 1428 hci_dev_lock(hdev); 1429 conn = hci_conn_hash_lookup_handle(hdev, handle); 1430 hci_dev_unlock(hdev); 1431 1432 if (conn) { 1433 register struct hci_proto *hp; 1434 1435 hci_conn_enter_active_mode(conn); 1436 1437 /* Send to upper protocol */ 1438 if ((hp = hci_proto[HCI_PROTO_L2CAP]) && hp->recv_acldata) { 1439 hp->recv_acldata(conn, skb, flags); 1440 return; 1441 } 1442 } else { 1443 BT_ERR("%s ACL packet for unknown connection handle %d", 1444 hdev->name, handle); 1445 } 1446 1447 kfree_skb(skb); 1448 } 1449 1450 /* SCO data packet */ 1451 static inline void hci_scodata_packet(struct hci_dev *hdev, struct sk_buff *skb) 1452 { 1453 struct hci_sco_hdr *hdr = (void *) skb->data; 1454 struct hci_conn *conn; 1455 __u16 handle; 1456 1457 skb_pull(skb, HCI_SCO_HDR_SIZE); 1458 1459 handle = __le16_to_cpu(hdr->handle); 1460 1461 BT_DBG("%s len %d handle 0x%x", hdev->name, skb->len, handle); 1462 1463 hdev->stat.sco_rx++; 1464 1465 hci_dev_lock(hdev); 1466 conn = hci_conn_hash_lookup_handle(hdev, handle); 1467 hci_dev_unlock(hdev); 1468 1469 if (conn) { 1470 register struct hci_proto *hp; 1471 1472 /* Send to upper protocol */ 1473 if ((hp = hci_proto[HCI_PROTO_SCO]) && hp->recv_scodata) { 1474 hp->recv_scodata(conn, skb); 1475 return; 1476 } 1477 } else { 1478 BT_ERR("%s SCO packet for unknown connection handle %d", 1479 hdev->name, handle); 1480 } 1481 1482 kfree_skb(skb); 1483 } 1484 1485 static void hci_rx_task(unsigned long arg) 1486 { 1487 struct hci_dev *hdev = (struct hci_dev *) arg; 1488 struct sk_buff *skb; 1489 1490 BT_DBG("%s", hdev->name); 1491 1492 read_lock(&hci_task_lock); 1493 1494 while ((skb = skb_dequeue(&hdev->rx_q))) { 1495 if (atomic_read(&hdev->promisc)) { 1496 /* Send copy to the sockets */ 1497 hci_send_to_sock(hdev, skb); 1498 } 1499 1500 if (test_bit(HCI_RAW, &hdev->flags)) { 1501 kfree_skb(skb); 1502 continue; 1503 } 1504 1505 if (test_bit(HCI_INIT, &hdev->flags)) { 1506 /* Don't process data packets in this states. */ 1507 switch (bt_cb(skb)->pkt_type) { 1508 case HCI_ACLDATA_PKT: 1509 case HCI_SCODATA_PKT: 1510 kfree_skb(skb); 1511 continue; 1512 } 1513 } 1514 1515 /* Process frame */ 1516 switch (bt_cb(skb)->pkt_type) { 1517 case HCI_EVENT_PKT: 1518 hci_event_packet(hdev, skb); 1519 break; 1520 1521 case HCI_ACLDATA_PKT: 1522 BT_DBG("%s ACL data packet", hdev->name); 1523 hci_acldata_packet(hdev, skb); 1524 break; 1525 1526 case HCI_SCODATA_PKT: 1527 BT_DBG("%s SCO data packet", hdev->name); 1528 hci_scodata_packet(hdev, skb); 1529 break; 1530 1531 default: 1532 kfree_skb(skb); 1533 break; 1534 } 1535 } 1536 1537 read_unlock(&hci_task_lock); 1538 } 1539 1540 static void hci_cmd_task(unsigned long arg) 1541 { 1542 struct hci_dev *hdev = (struct hci_dev *) arg; 1543 struct sk_buff *skb; 1544 1545 BT_DBG("%s cmd %d", hdev->name, atomic_read(&hdev->cmd_cnt)); 1546 1547 if (!atomic_read(&hdev->cmd_cnt) && time_after(jiffies, hdev->cmd_last_tx + HZ)) { 1548 BT_ERR("%s command tx timeout", hdev->name); 1549 atomic_set(&hdev->cmd_cnt, 1); 1550 } 1551 1552 /* Send queued commands */ 1553 if (atomic_read(&hdev->cmd_cnt) && (skb = skb_dequeue(&hdev->cmd_q))) { 1554 if (hdev->sent_cmd) 1555 kfree_skb(hdev->sent_cmd); 1556 1557 if ((hdev->sent_cmd = skb_clone(skb, GFP_ATOMIC))) { 1558 atomic_dec(&hdev->cmd_cnt); 1559 hci_send_frame(skb); 1560 hdev->cmd_last_tx = jiffies; 1561 } else { 1562 skb_queue_head(&hdev->cmd_q, skb); 1563 hci_sched_cmd(hdev); 1564 } 1565 } 1566 } 1567