?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
e1000: add missing length check to e1000 receive routine
[linux-2.6/mini2440.git] / net / bluetooth / hci_core.c
blobba78cc1eb8d9aaa8973c3a2395af86a98e71d4d6
1 /*
2 BlueZ - Bluetooth protocol stack for Linux
3 Copyright (C) 2000-2001 Qualcomm Incorporated
4
5 Written 2000,2001 by Maxim Krasnyansky <maxk@qualcomm.com>
6
7 This program is free software; you can redistribute it and/or modify
8 it under the terms of the GNU General Public License version 2 as
9 published by the Free Software Foundation;
10
11 THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
12 OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
13 FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
14 IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
15 CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
16 WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
17 ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
18 OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
19
20 ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
21 COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
22 SOFTWARE IS DISCLAIMED.
23 */
24
25 /* Bluetooth HCI core. */
26
27 #include <linux/jiffies.h>
28 #include <linux/module.h>
29 #include <linux/kmod.h>
30
31 #include <linux/types.h>
32 #include <linux/errno.h>
33 #include <linux/kernel.h>
34 #include <linux/sched.h>
35 #include <linux/slab.h>
36 #include <linux/poll.h>
37 #include <linux/fcntl.h>
38 #include <linux/init.h>
39 #include <linux/skbuff.h>
40 #include <linux/interrupt.h>
41 #include <linux/notifier.h>
42 #include <net/sock.h>
43
44 #include <asm/system.h>
45 #include <asm/uaccess.h>
46 #include <asm/unaligned.h>
47
48 #include <net/bluetooth/bluetooth.h>
49 #include <net/bluetooth/hci_core.h>
50
51 static void hci_cmd_task(unsigned long arg);
52 static void hci_rx_task(unsigned long arg);
53 static void hci_tx_task(unsigned long arg);
54 static void hci_notify(struct hci_dev *hdev, int event);
55
56 static DEFINE_RWLOCK(hci_task_lock);
57
58 /* HCI device list */
59 LIST_HEAD(hci_dev_list);
60 DEFINE_RWLOCK(hci_dev_list_lock);
61
62 /* HCI callback list */
63 LIST_HEAD(hci_cb_list);
64 DEFINE_RWLOCK(hci_cb_list_lock);
65
66 /* HCI protocols */
67 #define HCI_MAX_PROTO 2
68 struct hci_proto *hci_proto[HCI_MAX_PROTO];
69
70 /* HCI notifiers list */
71 static ATOMIC_NOTIFIER_HEAD(hci_notifier);
72
73 /* ---- HCI notifications ---- */
74
75 int hci_register_notifier(struct notifier_block *nb)
76 {
77 return atomic_notifier_chain_register(&hci_notifier, nb);
78 }
79
80 int hci_unregister_notifier(struct notifier_block *nb)
81 {
82 return atomic_notifier_chain_unregister(&hci_notifier, nb);
83 }
84
85 static void hci_notify(struct hci_dev *hdev, int event)
86 {
87 atomic_notifier_call_chain(&hci_notifier, event, hdev);
88 }
89
90 /* ---- HCI requests ---- */
91
92 void hci_req_complete(struct hci_dev *hdev, int result)
93 {
94 BT_DBG("%s result 0x%2.2x", hdev->name, result);
95
96 if (hdev->req_status == HCI_REQ_PEND) {
97 hdev->req_result = result;
98 hdev->req_status = HCI_REQ_DONE;
99 wake_up_interruptible(&hdev->req_wait_q);
100 }
101 }
102
103 static void hci_req_cancel(struct hci_dev *hdev, int err)
104 {
105 BT_DBG("%s err 0x%2.2x", hdev->name, err);
106
107 if (hdev->req_status == HCI_REQ_PEND) {
108 hdev->req_result = err;
109 hdev->req_status = HCI_REQ_CANCELED;
110 wake_up_interruptible(&hdev->req_wait_q);
111 }
112 }
113
114 /* Execute request and wait for completion. */
115 static int __hci_request(struct hci_dev *hdev, void (*req)(struct hci_dev *hdev, unsigned long opt),
116 unsigned long opt, __u32 timeout)
117 {
118 DECLARE_WAITQUEUE(wait, current);
119 int err = 0;
120
121 BT_DBG("%s start", hdev->name);
122
123 hdev->req_status = HCI_REQ_PEND;
124
125 add_wait_queue(&hdev->req_wait_q, &wait);
126 set_current_state(TASK_INTERRUPTIBLE);
127
128 req(hdev, opt);
129 schedule_timeout(timeout);
130
131 remove_wait_queue(&hdev->req_wait_q, &wait);
132
133 if (signal_pending(current))
134 return -EINTR;
135
136 switch (hdev->req_status) {
137 case HCI_REQ_DONE:
138 err = -bt_err(hdev->req_result);
139 break;
140
141 case HCI_REQ_CANCELED:
142 err = -hdev->req_result;
143 break;
144
145 default:
146 err = -ETIMEDOUT;
147 break;
148 }
149
150 hdev->req_status = hdev->req_result = 0;
151
152 BT_DBG("%s end: err %d", hdev->name, err);
153
154 return err;
155 }
156
157 static inline int hci_request(struct hci_dev *hdev, void (*req)(struct hci_dev *hdev, unsigned long opt),
158 unsigned long opt, __u32 timeout)
159 {
160 int ret;
161
162 if (!test_bit(HCI_UP, &hdev->flags))
163 return -ENETDOWN;
164
165 /* Serialize all requests */
166 hci_req_lock(hdev);
167 ret = __hci_request(hdev, req, opt, timeout);
168 hci_req_unlock(hdev);
169
170 return ret;
171 }
172
173 static void hci_reset_req(struct hci_dev *hdev, unsigned long opt)
174 {
175 BT_DBG("%s %ld", hdev->name, opt);
176
177 /* Reset device */
178 hci_send_cmd(hdev, HCI_OP_RESET, 0, NULL);
179 }
180
181 static void hci_init_req(struct hci_dev *hdev, unsigned long opt)
182 {
183 struct sk_buff *skb;
184 __le16 param;
185 __u8 flt_type;
186
187 BT_DBG("%s %ld", hdev->name, opt);
188
189 /* Driver initialization */
190
191 /* Special commands */
192 while ((skb = skb_dequeue(&hdev->driver_init))) {
193 bt_cb(skb)->pkt_type = HCI_COMMAND_PKT;
194 skb->dev = (void *) hdev;
195 skb_queue_tail(&hdev->cmd_q, skb);
196 hci_sched_cmd(hdev);
197 }
198 skb_queue_purge(&hdev->driver_init);
199
200 /* Mandatory initialization */
201
202 /* Reset */
203 if (!test_bit(HCI_QUIRK_NO_RESET, &hdev->quirks))
204 hci_send_cmd(hdev, HCI_OP_RESET, 0, NULL);
205
206 /* Read Local Supported Features */
207 hci_send_cmd(hdev, HCI_OP_READ_LOCAL_FEATURES, 0, NULL);
208
209 /* Read Local Version */
210 hci_send_cmd(hdev, HCI_OP_READ_LOCAL_VERSION, 0, NULL);
211
212 /* Read Buffer Size (ACL mtu, max pkt, etc.) */
213 hci_send_cmd(hdev, HCI_OP_READ_BUFFER_SIZE, 0, NULL);
214
215 #if 0
216 /* Host buffer size */
217 {
218 struct hci_cp_host_buffer_size cp;
219 cp.acl_mtu = cpu_to_le16(HCI_MAX_ACL_SIZE);
220 cp.sco_mtu = HCI_MAX_SCO_SIZE;
221 cp.acl_max_pkt = cpu_to_le16(0xffff);
222 cp.sco_max_pkt = cpu_to_le16(0xffff);
223 hci_send_cmd(hdev, HCI_OP_HOST_BUFFER_SIZE, sizeof(cp), &cp);
224 }
225 #endif
226
227 /* Read BD Address */
228 hci_send_cmd(hdev, HCI_OP_READ_BD_ADDR, 0, NULL);
229
230 /* Read Class of Device */
231 hci_send_cmd(hdev, HCI_OP_READ_CLASS_OF_DEV, 0, NULL);
232
233 /* Read Local Name */
234 hci_send_cmd(hdev, HCI_OP_READ_LOCAL_NAME, 0, NULL);
235
236 /* Read Voice Setting */
237 hci_send_cmd(hdev, HCI_OP_READ_VOICE_SETTING, 0, NULL);
238
239 /* Optional initialization */
240
241 /* Clear Event Filters */
242 flt_type = HCI_FLT_CLEAR_ALL;
243 hci_send_cmd(hdev, HCI_OP_SET_EVENT_FLT, 1, &flt_type);
244
245 /* Page timeout ~20 secs */
246 param = cpu_to_le16(0x8000);
247 hci_send_cmd(hdev, HCI_OP_WRITE_PG_TIMEOUT, 2, &param);
248
249 /* Connection accept timeout ~20 secs */
250 param = cpu_to_le16(0x7d00);
251 hci_send_cmd(hdev, HCI_OP_WRITE_CA_TIMEOUT, 2, &param);
252 }
253
254 static void hci_scan_req(struct hci_dev *hdev, unsigned long opt)
255 {
256 __u8 scan = opt;
257
258 BT_DBG("%s %x", hdev->name, scan);
259
260 /* Inquiry and Page scans */
261 hci_send_cmd(hdev, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan);
262 }
263
264 static void hci_auth_req(struct hci_dev *hdev, unsigned long opt)
265 {
266 __u8 auth = opt;
267
268 BT_DBG("%s %x", hdev->name, auth);
269
270 /* Authentication */
271 hci_send_cmd(hdev, HCI_OP_WRITE_AUTH_ENABLE, 1, &auth);
272 }
273
274 static void hci_encrypt_req(struct hci_dev *hdev, unsigned long opt)
275 {
276 __u8 encrypt = opt;
277
278 BT_DBG("%s %x", hdev->name, encrypt);
279
280 /* Encryption */
281 hci_send_cmd(hdev, HCI_OP_WRITE_ENCRYPT_MODE, 1, &encrypt);
282 }
283
284 static void hci_linkpol_req(struct hci_dev *hdev, unsigned long opt)
285 {
286 __le16 policy = cpu_to_le16(opt);
287
288 BT_DBG("%s %x", hdev->name, policy);
289
290 /* Default link policy */
291 hci_send_cmd(hdev, HCI_OP_WRITE_DEF_LINK_POLICY, 2, &policy);
292 }
293
294 /* Get HCI device by index.
295 * Device is held on return. */
296 struct hci_dev *hci_dev_get(int index)
297 {
298 struct hci_dev *hdev = NULL;
299 struct list_head *p;
300
301 BT_DBG("%d", index);
302
303 if (index < 0)
304 return NULL;
305
306 read_lock(&hci_dev_list_lock);
307 list_for_each(p, &hci_dev_list) {
308 struct hci_dev *d = list_entry(p, struct hci_dev, list);
309 if (d->id == index) {
310 hdev = hci_dev_hold(d);
311 break;
312 }
313 }
314 read_unlock(&hci_dev_list_lock);
315 return hdev;
316 }
317
318 /* ---- Inquiry support ---- */
319 static void inquiry_cache_flush(struct hci_dev *hdev)
320 {
321 struct inquiry_cache *cache = &hdev->inq_cache;
322 struct inquiry_entry *next = cache->list, *e;
323
324 BT_DBG("cache %p", cache);
325
326 cache->list = NULL;
327 while ((e = next)) {
328 next = e->next;
329 kfree(e);
330 }
331 }
332
333 struct inquiry_entry *hci_inquiry_cache_lookup(struct hci_dev *hdev, bdaddr_t *bdaddr)
334 {
335 struct inquiry_cache *cache = &hdev->inq_cache;
336 struct inquiry_entry *e;
337
338 BT_DBG("cache %p, %s", cache, batostr(bdaddr));
339
340 for (e = cache->list; e; e = e->next)
341 if (!bacmp(&e->data.bdaddr, bdaddr))
342 break;
343 return e;
344 }
345
346 void hci_inquiry_cache_update(struct hci_dev *hdev, struct inquiry_data *data)
347 {
348 struct inquiry_cache *cache = &hdev->inq_cache;
349 struct inquiry_entry *e;
350
351 BT_DBG("cache %p, %s", cache, batostr(&data->bdaddr));
352
353 if (!(e = hci_inquiry_cache_lookup(hdev, &data->bdaddr))) {
354 /* Entry not in the cache. Add new one. */
355 if (!(e = kzalloc(sizeof(struct inquiry_entry), GFP_ATOMIC)))
356 return;
357 e->next = cache->list;
358 cache->list = e;
359 }
360
361 memcpy(&e->data, data, sizeof(*data));
362 e->timestamp = jiffies;
363 cache->timestamp = jiffies;
364 }
365
366 static int inquiry_cache_dump(struct hci_dev *hdev, int num, __u8 *buf)
367 {
368 struct inquiry_cache *cache = &hdev->inq_cache;
369 struct inquiry_info *info = (struct inquiry_info *) buf;
370 struct inquiry_entry *e;
371 int copied = 0;
372
373 for (e = cache->list; e && copied < num; e = e->next, copied++) {
374 struct inquiry_data *data = &e->data;
375 bacpy(&info->bdaddr, &data->bdaddr);
376 info->pscan_rep_mode = data->pscan_rep_mode;
377 info->pscan_period_mode = data->pscan_period_mode;
378 info->pscan_mode = data->pscan_mode;
379 memcpy(info->dev_class, data->dev_class, 3);
380 info->clock_offset = data->clock_offset;
381 info++;
382 }
383
384 BT_DBG("cache %p, copied %d", cache, copied);
385 return copied;
386 }
387
388 static void hci_inq_req(struct hci_dev *hdev, unsigned long opt)
389 {
390 struct hci_inquiry_req *ir = (struct hci_inquiry_req *) opt;
391 struct hci_cp_inquiry cp;
392
393 BT_DBG("%s", hdev->name);
394
395 if (test_bit(HCI_INQUIRY, &hdev->flags))
396 return;
397
398 /* Start Inquiry */
399 memcpy(&cp.lap, &ir->lap, 3);
400 cp.length = ir->length;
401 cp.num_rsp = ir->num_rsp;
402 hci_send_cmd(hdev, HCI_OP_INQUIRY, sizeof(cp), &cp);
403 }
404
405 int hci_inquiry(void __user *arg)
406 {
407 __u8 __user *ptr = arg;
408 struct hci_inquiry_req ir;
409 struct hci_dev *hdev;
410 int err = 0, do_inquiry = 0, max_rsp;
411 long timeo;
412 __u8 *buf;
413
414 if (copy_from_user(&ir, ptr, sizeof(ir)))
415 return -EFAULT;
416
417 if (!(hdev = hci_dev_get(ir.dev_id)))
418 return -ENODEV;
419
420 hci_dev_lock_bh(hdev);
421 if (inquiry_cache_age(hdev) > INQUIRY_CACHE_AGE_MAX ||
422 inquiry_cache_empty(hdev) ||
423 ir.flags & IREQ_CACHE_FLUSH) {
424 inquiry_cache_flush(hdev);
425 do_inquiry = 1;
426 }
427 hci_dev_unlock_bh(hdev);
428
429 timeo = ir.length * msecs_to_jiffies(2000);
430 if (do_inquiry && (err = hci_request(hdev, hci_inq_req, (unsigned long)&ir, timeo)) < 0)
431 goto done;
432
433 /* for unlimited number of responses we will use buffer with 255 entries */
434 max_rsp = (ir.num_rsp == 0) ? 255 : ir.num_rsp;
435
436 /* cache_dump can't sleep. Therefore we allocate temp buffer and then
437 * copy it to the user space.
438 */
439 if (!(buf = kmalloc(sizeof(struct inquiry_info) * max_rsp, GFP_KERNEL))) {
440 err = -ENOMEM;
441 goto done;
442 }
443
444 hci_dev_lock_bh(hdev);
445 ir.num_rsp = inquiry_cache_dump(hdev, max_rsp, buf);
446 hci_dev_unlock_bh(hdev);
447
448 BT_DBG("num_rsp %d", ir.num_rsp);
449
450 if (!copy_to_user(ptr, &ir, sizeof(ir))) {
451 ptr += sizeof(ir);
452 if (copy_to_user(ptr, buf, sizeof(struct inquiry_info) *
453 ir.num_rsp))
454 err = -EFAULT;
455 } else
456 err = -EFAULT;
457
458 kfree(buf);
459
460 done:
461 hci_dev_put(hdev);
462 return err;
463 }
464
465 /* ---- HCI ioctl helpers ---- */
466
467 int hci_dev_open(__u16 dev)
468 {
469 struct hci_dev *hdev;
470 int ret = 0;
471
472 if (!(hdev = hci_dev_get(dev)))
473 return -ENODEV;
474
475 BT_DBG("%s %p", hdev->name, hdev);
476
477 hci_req_lock(hdev);
478
479 if (test_bit(HCI_UP, &hdev->flags)) {
480 ret = -EALREADY;
481 goto done;
482 }
483
484 if (test_bit(HCI_QUIRK_RAW_DEVICE, &hdev->quirks))
485 set_bit(HCI_RAW, &hdev->flags);
486
487 if (hdev->open(hdev)) {
488 ret = -EIO;
489 goto done;
490 }
491
492 if (!test_bit(HCI_RAW, &hdev->flags)) {
493 atomic_set(&hdev->cmd_cnt, 1);
494 set_bit(HCI_INIT, &hdev->flags);
495
496 //__hci_request(hdev, hci_reset_req, 0, HZ);
497 ret = __hci_request(hdev, hci_init_req, 0,
498 msecs_to_jiffies(HCI_INIT_TIMEOUT));
499
500 clear_bit(HCI_INIT, &hdev->flags);
501 }
502
503 if (!ret) {
504 hci_dev_hold(hdev);
505 set_bit(HCI_UP, &hdev->flags);
506 hci_notify(hdev, HCI_DEV_UP);
507 } else {
508 /* Init failed, cleanup */
509 tasklet_kill(&hdev->rx_task);
510 tasklet_kill(&hdev->tx_task);
511 tasklet_kill(&hdev->cmd_task);
512
513 skb_queue_purge(&hdev->cmd_q);
514 skb_queue_purge(&hdev->rx_q);
515
516 if (hdev->flush)
517 hdev->flush(hdev);
518
519 if (hdev->sent_cmd) {
520 kfree_skb(hdev->sent_cmd);
521 hdev->sent_cmd = NULL;
522 }
523
524 hdev->close(hdev);
525 hdev->flags = 0;
526 }
527
528 done:
529 hci_req_unlock(hdev);
530 hci_dev_put(hdev);
531 return ret;
532 }
533
534 static int hci_dev_do_close(struct hci_dev *hdev)
535 {
536 BT_DBG("%s %p", hdev->name, hdev);
537
538 hci_req_cancel(hdev, ENODEV);
539 hci_req_lock(hdev);
540
541 if (!test_and_clear_bit(HCI_UP, &hdev->flags)) {
542 hci_req_unlock(hdev);
543 return 0;
544 }
545
546 /* Kill RX and TX tasks */
547 tasklet_kill(&hdev->rx_task);
548 tasklet_kill(&hdev->tx_task);
549
550 hci_dev_lock_bh(hdev);
551 inquiry_cache_flush(hdev);
552 hci_conn_hash_flush(hdev);
553 hci_dev_unlock_bh(hdev);
554
555 hci_notify(hdev, HCI_DEV_DOWN);
556
557 if (hdev->flush)
558 hdev->flush(hdev);
559
560 /* Reset device */
561 skb_queue_purge(&hdev->cmd_q);
562 atomic_set(&hdev->cmd_cnt, 1);
563 if (!test_bit(HCI_RAW, &hdev->flags)) {
564 set_bit(HCI_INIT, &hdev->flags);
565 __hci_request(hdev, hci_reset_req, 0,
566 msecs_to_jiffies(250));
567 clear_bit(HCI_INIT, &hdev->flags);
568 }
569
570 /* Kill cmd task */
571 tasklet_kill(&hdev->cmd_task);
572
573 /* Drop queues */
574 skb_queue_purge(&hdev->rx_q);
575 skb_queue_purge(&hdev->cmd_q);
576 skb_queue_purge(&hdev->raw_q);
577
578 /* Drop last sent command */
579 if (hdev->sent_cmd) {
580 kfree_skb(hdev->sent_cmd);
581 hdev->sent_cmd = NULL;
582 }
583
584 /* After this point our queues are empty
585 * and no tasks are scheduled. */
586 hdev->close(hdev);
587
588 /* Clear flags */
589 hdev->flags = 0;
590
591 hci_req_unlock(hdev);
592
593 hci_dev_put(hdev);
594 return 0;
595 }
596
597 int hci_dev_close(__u16 dev)
598 {
599 struct hci_dev *hdev;
600 int err;
601
602 if (!(hdev = hci_dev_get(dev)))
603 return -ENODEV;
604 err = hci_dev_do_close(hdev);
605 hci_dev_put(hdev);
606 return err;
607 }
608
609 int hci_dev_reset(__u16 dev)
610 {
611 struct hci_dev *hdev;
612 int ret = 0;
613
614 if (!(hdev = hci_dev_get(dev)))
615 return -ENODEV;
616
617 hci_req_lock(hdev);
618 tasklet_disable(&hdev->tx_task);
619
620 if (!test_bit(HCI_UP, &hdev->flags))
621 goto done;
622
623 /* Drop queues */
624 skb_queue_purge(&hdev->rx_q);
625 skb_queue_purge(&hdev->cmd_q);
626
627 hci_dev_lock_bh(hdev);
628 inquiry_cache_flush(hdev);
629 hci_conn_hash_flush(hdev);
630 hci_dev_unlock_bh(hdev);
631
632 if (hdev->flush)
633 hdev->flush(hdev);
634
635 atomic_set(&hdev->cmd_cnt, 1);
636 hdev->acl_cnt = 0; hdev->sco_cnt = 0;
637
638 if (!test_bit(HCI_RAW, &hdev->flags))
639 ret = __hci_request(hdev, hci_reset_req, 0,
640 msecs_to_jiffies(HCI_INIT_TIMEOUT));
641
642 done:
643 tasklet_enable(&hdev->tx_task);
644 hci_req_unlock(hdev);
645 hci_dev_put(hdev);
646 return ret;
647 }
648
649 int hci_dev_reset_stat(__u16 dev)
650 {
651 struct hci_dev *hdev;
652 int ret = 0;
653
654 if (!(hdev = hci_dev_get(dev)))
655 return -ENODEV;
656
657 memset(&hdev->stat, 0, sizeof(struct hci_dev_stats));
658
659 hci_dev_put(hdev);
660
661 return ret;
662 }
663
664 int hci_dev_cmd(unsigned int cmd, void __user *arg)
665 {
666 struct hci_dev *hdev;
667 struct hci_dev_req dr;
668 int err = 0;
669
670 if (copy_from_user(&dr, arg, sizeof(dr)))
671 return -EFAULT;
672
673 if (!(hdev = hci_dev_get(dr.dev_id)))
674 return -ENODEV;
675
676 switch (cmd) {
677 case HCISETAUTH:
678 err = hci_request(hdev, hci_auth_req, dr.dev_opt,
679 msecs_to_jiffies(HCI_INIT_TIMEOUT));
680 break;
681
682 case HCISETENCRYPT:
683 if (!lmp_encrypt_capable(hdev)) {
684 err = -EOPNOTSUPP;
685 break;
686 }
687
688 if (!test_bit(HCI_AUTH, &hdev->flags)) {
689 /* Auth must be enabled first */
690 err = hci_request(hdev, hci_auth_req, dr.dev_opt,
691 msecs_to_jiffies(HCI_INIT_TIMEOUT));
692 if (err)
693 break;
694 }
695
696 err = hci_request(hdev, hci_encrypt_req, dr.dev_opt,
697 msecs_to_jiffies(HCI_INIT_TIMEOUT));
698 break;
699
700 case HCISETSCAN:
701 err = hci_request(hdev, hci_scan_req, dr.dev_opt,
702 msecs_to_jiffies(HCI_INIT_TIMEOUT));
703 break;
704
705 case HCISETLINKPOL:
706 err = hci_request(hdev, hci_linkpol_req, dr.dev_opt,
707 msecs_to_jiffies(HCI_INIT_TIMEOUT));
708 break;
709
710 case HCISETLINKMODE:
711 hdev->link_mode = ((__u16) dr.dev_opt) &
712 (HCI_LM_MASTER | HCI_LM_ACCEPT);
713 break;
714
715 case HCISETPTYPE:
716 hdev->pkt_type = (__u16) dr.dev_opt;
717 break;
718
719 case HCISETACLMTU:
720 hdev->acl_mtu = *((__u16 *) &dr.dev_opt + 1);
721 hdev->acl_pkts = *((__u16 *) &dr.dev_opt + 0);
722 break;
723
724 case HCISETSCOMTU:
725 hdev->sco_mtu = *((__u16 *) &dr.dev_opt + 1);
726 hdev->sco_pkts = *((__u16 *) &dr.dev_opt + 0);
727 break;
728
729 default:
730 err = -EINVAL;
731 break;
732 }
733
734 hci_dev_put(hdev);
735 return err;
736 }
737
738 int hci_get_dev_list(void __user *arg)
739 {
740 struct hci_dev_list_req *dl;
741 struct hci_dev_req *dr;
742 struct list_head *p;
743 int n = 0, size, err;
744 __u16 dev_num;
745
746 if (get_user(dev_num, (__u16 __user *) arg))
747 return -EFAULT;
748
749 if (!dev_num || dev_num > (PAGE_SIZE * 2) / sizeof(*dr))
750 return -EINVAL;
751
752 size = sizeof(*dl) + dev_num * sizeof(*dr);
753
754 if (!(dl = kzalloc(size, GFP_KERNEL)))
755 return -ENOMEM;
756
757 dr = dl->dev_req;
758
759 read_lock_bh(&hci_dev_list_lock);
760 list_for_each(p, &hci_dev_list) {
761 struct hci_dev *hdev;
762 hdev = list_entry(p, struct hci_dev, list);
763 (dr + n)->dev_id = hdev->id;
764 (dr + n)->dev_opt = hdev->flags;
765 if (++n >= dev_num)
766 break;
767 }
768 read_unlock_bh(&hci_dev_list_lock);
769
770 dl->dev_num = n;
771 size = sizeof(*dl) + n * sizeof(*dr);
772
773 err = copy_to_user(arg, dl, size);
774 kfree(dl);
775
776 return err ? -EFAULT : 0;
777 }
778
779 int hci_get_dev_info(void __user *arg)
780 {
781 struct hci_dev *hdev;
782 struct hci_dev_info di;
783 int err = 0;
784
785 if (copy_from_user(&di, arg, sizeof(di)))
786 return -EFAULT;
787
788 if (!(hdev = hci_dev_get(di.dev_id)))
789 return -ENODEV;
790
791 strcpy(di.name, hdev->name);
792 di.bdaddr = hdev->bdaddr;
793 di.type = hdev->type;
794 di.flags = hdev->flags;
795 di.pkt_type = hdev->pkt_type;
796 di.acl_mtu = hdev->acl_mtu;
797 di.acl_pkts = hdev->acl_pkts;
798 di.sco_mtu = hdev->sco_mtu;
799 di.sco_pkts = hdev->sco_pkts;
800 di.link_policy = hdev->link_policy;
801 di.link_mode = hdev->link_mode;
802
803 memcpy(&di.stat, &hdev->stat, sizeof(di.stat));
804 memcpy(&di.features, &hdev->features, sizeof(di.features));
805
806 if (copy_to_user(arg, &di, sizeof(di)))
807 err = -EFAULT;
808
809 hci_dev_put(hdev);
810
811 return err;
812 }
813
814 /* ---- Interface to HCI drivers ---- */
815
816 /* Alloc HCI device */
817 struct hci_dev *hci_alloc_dev(void)
818 {
819 struct hci_dev *hdev;
820
821 hdev = kzalloc(sizeof(struct hci_dev), GFP_KERNEL);
822 if (!hdev)
823 return NULL;
824
825 skb_queue_head_init(&hdev->driver_init);
826
827 return hdev;
828 }
829 EXPORT_SYMBOL(hci_alloc_dev);
830
831 /* Free HCI device */
832 void hci_free_dev(struct hci_dev *hdev)
833 {
834 skb_queue_purge(&hdev->driver_init);
835
836 /* will free via device release */
837 put_device(&hdev->dev);
838 }
839 EXPORT_SYMBOL(hci_free_dev);
840
841 /* Register HCI device */
842 int hci_register_dev(struct hci_dev *hdev)
843 {
844 struct list_head *head = &hci_dev_list, *p;
845 int i, id = 0;
846
847 BT_DBG("%p name %s type %d owner %p", hdev, hdev->name, hdev->type, hdev->owner);
848
849 if (!hdev->open || !hdev->close || !hdev->destruct)
850 return -EINVAL;
851
852 write_lock_bh(&hci_dev_list_lock);
853
854 /* Find first available device id */
855 list_for_each(p, &hci_dev_list) {
856 if (list_entry(p, struct hci_dev, list)->id != id)
857 break;
858 head = p; id++;
859 }
860
861 sprintf(hdev->name, "hci%d", id);
862 hdev->id = id;
863 list_add(&hdev->list, head);
864
865 atomic_set(&hdev->refcnt, 1);
866 spin_lock_init(&hdev->lock);
867
868 hdev->flags = 0;
869 hdev->pkt_type = (HCI_DM1 | HCI_DH1 | HCI_HV1);
870 hdev->esco_type = (ESCO_HV1);
871 hdev->link_mode = (HCI_LM_ACCEPT);
872
873 hdev->idle_timeout = 0;
874 hdev->sniff_max_interval = 800;
875 hdev->sniff_min_interval = 80;
876
877 tasklet_init(&hdev->cmd_task, hci_cmd_task,(unsigned long) hdev);
878 tasklet_init(&hdev->rx_task, hci_rx_task, (unsigned long) hdev);
879 tasklet_init(&hdev->tx_task, hci_tx_task, (unsigned long) hdev);
880
881 skb_queue_head_init(&hdev->rx_q);
882 skb_queue_head_init(&hdev->cmd_q);
883 skb_queue_head_init(&hdev->raw_q);
884
885 for (i = 0; i < 3; i++)
886 hdev->reassembly[i] = NULL;
887
888 init_waitqueue_head(&hdev->req_wait_q);
889 init_MUTEX(&hdev->req_lock);
890
891 inquiry_cache_init(hdev);
892
893 hci_conn_hash_init(hdev);
894
895 memset(&hdev->stat, 0, sizeof(struct hci_dev_stats));
896
897 atomic_set(&hdev->promisc, 0);
898
899 write_unlock_bh(&hci_dev_list_lock);
900
901 hci_register_sysfs(hdev);
902
903 hci_notify(hdev, HCI_DEV_REG);
904
905 return id;
906 }
907 EXPORT_SYMBOL(hci_register_dev);
908
909 /* Unregister HCI device */
910 int hci_unregister_dev(struct hci_dev *hdev)
911 {
912 int i;
913
914 BT_DBG("%p name %s type %d", hdev, hdev->name, hdev->type);
915
916 write_lock_bh(&hci_dev_list_lock);
917 list_del(&hdev->list);
918 write_unlock_bh(&hci_dev_list_lock);
919
920 hci_dev_do_close(hdev);
921
922 for (i = 0; i < 3; i++)
923 kfree_skb(hdev->reassembly[i]);
924
925 hci_notify(hdev, HCI_DEV_UNREG);
926
927 hci_unregister_sysfs(hdev);
928
929 __hci_dev_put(hdev);
930
931 return 0;
932 }
933 EXPORT_SYMBOL(hci_unregister_dev);
934
935 /* Suspend HCI device */
936 int hci_suspend_dev(struct hci_dev *hdev)
937 {
938 hci_notify(hdev, HCI_DEV_SUSPEND);
939 return 0;
940 }
941 EXPORT_SYMBOL(hci_suspend_dev);
942
943 /* Resume HCI device */
944 int hci_resume_dev(struct hci_dev *hdev)
945 {
946 hci_notify(hdev, HCI_DEV_RESUME);
947 return 0;
948 }
949 EXPORT_SYMBOL(hci_resume_dev);
950
951 /* Receive packet type fragment */
952 #define __reassembly(hdev, type) ((hdev)->reassembly[(type) - 2])
953
954 int hci_recv_fragment(struct hci_dev *hdev, int type, void *data, int count)
955 {
956 if (type < HCI_ACLDATA_PKT || type > HCI_EVENT_PKT)
957 return -EILSEQ;
958
959 while (count) {
960 struct sk_buff *skb = __reassembly(hdev, type);
961 struct { int expect; } *scb;
962 int len = 0;
963
964 if (!skb) {
965 /* Start of the frame */
966
967 switch (type) {
968 case HCI_EVENT_PKT:
969 if (count >= HCI_EVENT_HDR_SIZE) {
970 struct hci_event_hdr *h = data;
971 len = HCI_EVENT_HDR_SIZE + h->plen;
972 } else
973 return -EILSEQ;
974 break;
975
976 case HCI_ACLDATA_PKT:
977 if (count >= HCI_ACL_HDR_SIZE) {
978 struct hci_acl_hdr *h = data;
979 len = HCI_ACL_HDR_SIZE + __le16_to_cpu(h->dlen);
980 } else
981 return -EILSEQ;
982 break;
983
984 case HCI_SCODATA_PKT:
985 if (count >= HCI_SCO_HDR_SIZE) {
986 struct hci_sco_hdr *h = data;
987 len = HCI_SCO_HDR_SIZE + h->dlen;
988 } else
989 return -EILSEQ;
990 break;
991 }
992
993 skb = bt_skb_alloc(len, GFP_ATOMIC);
994 if (!skb) {
995 BT_ERR("%s no memory for packet", hdev->name);
996 return -ENOMEM;
997 }
998
999 skb->dev = (void *) hdev;
1000 bt_cb(skb)->pkt_type = type;
1001
1002 __reassembly(hdev, type) = skb;
1003
1004 scb = (void *) skb->cb;
1005 scb->expect = len;
1006 } else {
1007 /* Continuation */
1008
1009 scb = (void *) skb->cb;
1010 len = scb->expect;
1011 }
1012
1013 len = min(len, count);
1014
1015 memcpy(skb_put(skb, len), data, len);
1016
1017 scb->expect -= len;
1018
1019 if (scb->expect == 0) {
1020 /* Complete frame */
1021
1022 __reassembly(hdev, type) = NULL;
1023
1024 bt_cb(skb)->pkt_type = type;
1025 hci_recv_frame(skb);
1026 }
1027
1028 count -= len; data += len;
1029 }
1030
1031 return 0;
1032 }
1033 EXPORT_SYMBOL(hci_recv_fragment);
1034
1035 /* ---- Interface to upper protocols ---- */
1036
1037 /* Register/Unregister protocols.
1038 * hci_task_lock is used to ensure that no tasks are running. */
1039 int hci_register_proto(struct hci_proto *hp)
1040 {
1041 int err = 0;
1042
1043 BT_DBG("%p name %s id %d", hp, hp->name, hp->id);
1044
1045 if (hp->id >= HCI_MAX_PROTO)
1046 return -EINVAL;
1047
1048 write_lock_bh(&hci_task_lock);
1049
1050 if (!hci_proto[hp->id])
1051 hci_proto[hp->id] = hp;
1052 else
1053 err = -EEXIST;
1054
1055 write_unlock_bh(&hci_task_lock);
1056
1057 return err;
1058 }
1059 EXPORT_SYMBOL(hci_register_proto);
1060
1061 int hci_unregister_proto(struct hci_proto *hp)
1062 {
1063 int err = 0;
1064
1065 BT_DBG("%p name %s id %d", hp, hp->name, hp->id);
1066
1067 if (hp->id >= HCI_MAX_PROTO)
1068 return -EINVAL;
1069
1070 write_lock_bh(&hci_task_lock);
1071
1072 if (hci_proto[hp->id])
1073 hci_proto[hp->id] = NULL;
1074 else
1075 err = -ENOENT;
1076
1077 write_unlock_bh(&hci_task_lock);
1078
1079 return err;
1080 }
1081 EXPORT_SYMBOL(hci_unregister_proto);
1082
1083 int hci_register_cb(struct hci_cb *cb)
1084 {
1085 BT_DBG("%p name %s", cb, cb->name);
1086
1087 write_lock_bh(&hci_cb_list_lock);
1088 list_add(&cb->list, &hci_cb_list);
1089 write_unlock_bh(&hci_cb_list_lock);
1090
1091 return 0;
1092 }
1093 EXPORT_SYMBOL(hci_register_cb);
1094
1095 int hci_unregister_cb(struct hci_cb *cb)
1096 {
1097 BT_DBG("%p name %s", cb, cb->name);
1098
1099 write_lock_bh(&hci_cb_list_lock);
1100 list_del(&cb->list);
1101 write_unlock_bh(&hci_cb_list_lock);
1102
1103 return 0;
1104 }
1105 EXPORT_SYMBOL(hci_unregister_cb);
1106
1107 static int hci_send_frame(struct sk_buff *skb)
1108 {
1109 struct hci_dev *hdev = (struct hci_dev *) skb->dev;
1110
1111 if (!hdev) {
1112 kfree_skb(skb);
1113 return -ENODEV;
1114 }
1115
1116 BT_DBG("%s type %d len %d", hdev->name, bt_cb(skb)->pkt_type, skb->len);
1117
1118 if (atomic_read(&hdev->promisc)) {
1119 /* Time stamp */
1120 __net_timestamp(skb);
1121
1122 hci_send_to_sock(hdev, skb);
1123 }
1124
1125 /* Get rid of skb owner, prior to sending to the driver. */
1126 skb_orphan(skb);
1127
1128 return hdev->send(skb);
1129 }
1130
1131 /* Send HCI command */
1132 int hci_send_cmd(struct hci_dev *hdev, __u16 opcode, __u32 plen, void *param)
1133 {
1134 int len = HCI_COMMAND_HDR_SIZE + plen;
1135 struct hci_command_hdr *hdr;
1136 struct sk_buff *skb;
1137
1138 BT_DBG("%s opcode 0x%x plen %d", hdev->name, opcode, plen);
1139
1140 skb = bt_skb_alloc(len, GFP_ATOMIC);
1141 if (!skb) {
1142 BT_ERR("%s no memory for command", hdev->name);
1143 return -ENOMEM;
1144 }
1145
1146 hdr = (struct hci_command_hdr *) skb_put(skb, HCI_COMMAND_HDR_SIZE);
1147 hdr->opcode = cpu_to_le16(opcode);
1148 hdr->plen = plen;
1149
1150 if (plen)
1151 memcpy(skb_put(skb, plen), param, plen);
1152
1153 BT_DBG("skb len %d", skb->len);
1154
1155 bt_cb(skb)->pkt_type = HCI_COMMAND_PKT;
1156 skb->dev = (void *) hdev;
1157 skb_queue_tail(&hdev->cmd_q, skb);
1158 hci_sched_cmd(hdev);
1159
1160 return 0;
1161 }
1162
1163 /* Get data from the previously sent command */
1164 void *hci_sent_cmd_data(struct hci_dev *hdev, __u16 opcode)
1165 {
1166 struct hci_command_hdr *hdr;
1167
1168 if (!hdev->sent_cmd)
1169 return NULL;
1170
1171 hdr = (void *) hdev->sent_cmd->data;
1172
1173 if (hdr->opcode != cpu_to_le16(opcode))
1174 return NULL;
1175
1176 BT_DBG("%s opcode 0x%x", hdev->name, opcode);
1177
1178 return hdev->sent_cmd->data + HCI_COMMAND_HDR_SIZE;
1179 }
1180
1181 /* Send ACL data */
1182 static void hci_add_acl_hdr(struct sk_buff *skb, __u16 handle, __u16 flags)
1183 {
1184 struct hci_acl_hdr *hdr;
1185 int len = skb->len;
1186
1187 skb_push(skb, HCI_ACL_HDR_SIZE);
1188 skb_reset_transport_header(skb);
1189 hdr = (struct hci_acl_hdr *)skb_transport_header(skb);
1190 hdr->handle = cpu_to_le16(hci_handle_pack(handle, flags));
1191 hdr->dlen = cpu_to_le16(len);
1192 }
1193
1194 int hci_send_acl(struct hci_conn *conn, struct sk_buff *skb, __u16 flags)
1195 {
1196 struct hci_dev *hdev = conn->hdev;
1197 struct sk_buff *list;
1198
1199 BT_DBG("%s conn %p flags 0x%x", hdev->name, conn, flags);
1200
1201 skb->dev = (void *) hdev;
1202 bt_cb(skb)->pkt_type = HCI_ACLDATA_PKT;
1203 hci_add_acl_hdr(skb, conn->handle, flags | ACL_START);
1204
1205 if (!(list = skb_shinfo(skb)->frag_list)) {
1206 /* Non fragmented */
1207 BT_DBG("%s nonfrag skb %p len %d", hdev->name, skb, skb->len);
1208
1209 skb_queue_tail(&conn->data_q, skb);
1210 } else {
1211 /* Fragmented */
1212 BT_DBG("%s frag %p len %d", hdev->name, skb, skb->len);
1213
1214 skb_shinfo(skb)->frag_list = NULL;
1215
1216 /* Queue all fragments atomically */
1217 spin_lock_bh(&conn->data_q.lock);
1218
1219 __skb_queue_tail(&conn->data_q, skb);
1220 do {
1221 skb = list; list = list->next;
1222
1223 skb->dev = (void *) hdev;
1224 bt_cb(skb)->pkt_type = HCI_ACLDATA_PKT;
1225 hci_add_acl_hdr(skb, conn->handle, flags | ACL_CONT);
1226
1227 BT_DBG("%s frag %p len %d", hdev->name, skb, skb->len);
1228
1229 __skb_queue_tail(&conn->data_q, skb);
1230 } while (list);
1231
1232 spin_unlock_bh(&conn->data_q.lock);
1233 }
1234
1235 hci_sched_tx(hdev);
1236 return 0;
1237 }
1238 EXPORT_SYMBOL(hci_send_acl);
1239
1240 /* Send SCO data */
1241 int hci_send_sco(struct hci_conn *conn, struct sk_buff *skb)
1242 {
1243 struct hci_dev *hdev = conn->hdev;
1244 struct hci_sco_hdr hdr;
1245
1246 BT_DBG("%s len %d", hdev->name, skb->len);
1247
1248 if (skb->len > hdev->sco_mtu) {
1249 kfree_skb(skb);
1250 return -EINVAL;
1251 }
1252
1253 hdr.handle = cpu_to_le16(conn->handle);
1254 hdr.dlen = skb->len;
1255
1256 skb_push(skb, HCI_SCO_HDR_SIZE);
1257 skb_reset_transport_header(skb);
1258 memcpy(skb_transport_header(skb), &hdr, HCI_SCO_HDR_SIZE);
1259
1260 skb->dev = (void *) hdev;
1261 bt_cb(skb)->pkt_type = HCI_SCODATA_PKT;
1262 skb_queue_tail(&conn->data_q, skb);
1263 hci_sched_tx(hdev);
1264 return 0;
1265 }
1266 EXPORT_SYMBOL(hci_send_sco);
1267
1268 /* ---- HCI TX task (outgoing data) ---- */
1269
1270 /* HCI Connection scheduler */
1271 static inline struct hci_conn *hci_low_sent(struct hci_dev *hdev, __u8 type, int *quote)
1272 {
1273 struct hci_conn_hash *h = &hdev->conn_hash;
1274 struct hci_conn *conn = NULL;
1275 int num = 0, min = ~0;
1276 struct list_head *p;
1277
1278 /* We don't have to lock device here. Connections are always
1279 * added and removed with TX task disabled. */
1280 list_for_each(p, &h->list) {
1281 struct hci_conn *c;
1282 c = list_entry(p, struct hci_conn, list);
1283
1284 if (c->type != type || skb_queue_empty(&c->data_q))
1285 continue;
1286
1287 if (c->state != BT_CONNECTED && c->state != BT_CONFIG)
1288 continue;
1289
1290 num++;
1291
1292 if (c->sent < min) {
1293 min = c->sent;
1294 conn = c;
1295 }
1296 }
1297
1298 if (conn) {
1299 int cnt = (type == ACL_LINK ? hdev->acl_cnt : hdev->sco_cnt);
1300 int q = cnt / num;
1301 *quote = q ? q : 1;
1302 } else
1303 *quote = 0;
1304
1305 BT_DBG("conn %p quote %d", conn, *quote);
1306 return conn;
1307 }
1308
1309 static inline void hci_acl_tx_to(struct hci_dev *hdev)
1310 {
1311 struct hci_conn_hash *h = &hdev->conn_hash;
1312 struct list_head *p;
1313 struct hci_conn *c;
1314
1315 BT_ERR("%s ACL tx timeout", hdev->name);
1316
1317 /* Kill stalled connections */
1318 list_for_each(p, &h->list) {
1319 c = list_entry(p, struct hci_conn, list);
1320 if (c->type == ACL_LINK && c->sent) {
1321 BT_ERR("%s killing stalled ACL connection %s",
1322 hdev->name, batostr(&c->dst));
1323 hci_acl_disconn(c, 0x13);
1324 }
1325 }
1326 }
1327
1328 static inline void hci_sched_acl(struct hci_dev *hdev)
1329 {
1330 struct hci_conn *conn;
1331 struct sk_buff *skb;
1332 int quote;
1333
1334 BT_DBG("%s", hdev->name);
1335
1336 if (!test_bit(HCI_RAW, &hdev->flags)) {
1337 /* ACL tx timeout must be longer than maximum
1338 * link supervision timeout (40.9 seconds) */
1339 if (!hdev->acl_cnt && time_after(jiffies, hdev->acl_last_tx + HZ * 45))
1340 hci_acl_tx_to(hdev);
1341 }
1342
1343 while (hdev->acl_cnt && (conn = hci_low_sent(hdev, ACL_LINK, &quote))) {
1344 while (quote-- && (skb = skb_dequeue(&conn->data_q))) {
1345 BT_DBG("skb %p len %d", skb, skb->len);
1346
1347 hci_conn_enter_active_mode(conn);
1348
1349 hci_send_frame(skb);
1350 hdev->acl_last_tx = jiffies;
1351
1352 hdev->acl_cnt--;
1353 conn->sent++;
1354 }
1355 }
1356 }
1357
1358 /* Schedule SCO */
1359 static inline void hci_sched_sco(struct hci_dev *hdev)
1360 {
1361 struct hci_conn *conn;
1362 struct sk_buff *skb;
1363 int quote;
1364
1365 BT_DBG("%s", hdev->name);
1366
1367 while (hdev->sco_cnt && (conn = hci_low_sent(hdev, SCO_LINK, &quote))) {
1368 while (quote-- && (skb = skb_dequeue(&conn->data_q))) {
1369 BT_DBG("skb %p len %d", skb, skb->len);
1370 hci_send_frame(skb);
1371
1372 conn->sent++;
1373 if (conn->sent == ~0)
1374 conn->sent = 0;
1375 }
1376 }
1377 }
1378
1379 static inline void hci_sched_esco(struct hci_dev *hdev)
1380 {
1381 struct hci_conn *conn;
1382 struct sk_buff *skb;
1383 int quote;
1384
1385 BT_DBG("%s", hdev->name);
1386
1387 while (hdev->sco_cnt && (conn = hci_low_sent(hdev, ESCO_LINK, &quote))) {
1388 while (quote-- && (skb = skb_dequeue(&conn->data_q))) {
1389 BT_DBG("skb %p len %d", skb, skb->len);
1390 hci_send_frame(skb);
1391
1392 conn->sent++;
1393 if (conn->sent == ~0)
1394 conn->sent = 0;
1395 }
1396 }
1397 }
1398
1399 static void hci_tx_task(unsigned long arg)
1400 {
1401 struct hci_dev *hdev = (struct hci_dev *) arg;
1402 struct sk_buff *skb;
1403
1404 read_lock(&hci_task_lock);
1405
1406 BT_DBG("%s acl %d sco %d", hdev->name, hdev->acl_cnt, hdev->sco_cnt);
1407
1408 /* Schedule queues and send stuff to HCI driver */
1409
1410 hci_sched_acl(hdev);
1411
1412 hci_sched_sco(hdev);
1413
1414 hci_sched_esco(hdev);
1415
1416 /* Send next queued raw (unknown type) packet */
1417 while ((skb = skb_dequeue(&hdev->raw_q)))
1418 hci_send_frame(skb);
1419
1420 read_unlock(&hci_task_lock);
1421 }
1422
1423 /* ----- HCI RX task (incoming data proccessing) ----- */
1424
1425 /* ACL data packet */
1426 static inline void hci_acldata_packet(struct hci_dev *hdev, struct sk_buff *skb)
1427 {
1428 struct hci_acl_hdr *hdr = (void *) skb->data;
1429 struct hci_conn *conn;
1430 __u16 handle, flags;
1431
1432 skb_pull(skb, HCI_ACL_HDR_SIZE);
1433
1434 handle = __le16_to_cpu(hdr->handle);
1435 flags = hci_flags(handle);
1436 handle = hci_handle(handle);
1437
1438 BT_DBG("%s len %d handle 0x%x flags 0x%x", hdev->name, skb->len, handle, flags);
1439
1440 hdev->stat.acl_rx++;
1441
1442 hci_dev_lock(hdev);
1443 conn = hci_conn_hash_lookup_handle(hdev, handle);
1444 hci_dev_unlock(hdev);
1445
1446 if (conn) {
1447 register struct hci_proto *hp;
1448
1449 hci_conn_enter_active_mode(conn);
1450
1451 /* Send to upper protocol */
1452 if ((hp = hci_proto[HCI_PROTO_L2CAP]) && hp->recv_acldata) {
1453 hp->recv_acldata(conn, skb, flags);
1454 return;
1455 }
1456 } else {
1457 BT_ERR("%s ACL packet for unknown connection handle %d",
1458 hdev->name, handle);
1459 }
1460
1461 kfree_skb(skb);
1462 }
1463
1464 /* SCO data packet */
1465 static inline void hci_scodata_packet(struct hci_dev *hdev, struct sk_buff *skb)
1466 {
1467 struct hci_sco_hdr *hdr = (void *) skb->data;
1468 struct hci_conn *conn;
1469 __u16 handle;
1470
1471 skb_pull(skb, HCI_SCO_HDR_SIZE);
1472
1473 handle = __le16_to_cpu(hdr->handle);
1474
1475 BT_DBG("%s len %d handle 0x%x", hdev->name, skb->len, handle);
1476
1477 hdev->stat.sco_rx++;
1478
1479 hci_dev_lock(hdev);
1480 conn = hci_conn_hash_lookup_handle(hdev, handle);
1481 hci_dev_unlock(hdev);
1482
1483 if (conn) {
1484 register struct hci_proto *hp;
1485
1486 /* Send to upper protocol */
1487 if ((hp = hci_proto[HCI_PROTO_SCO]) && hp->recv_scodata) {
1488 hp->recv_scodata(conn, skb);
1489 return;
1490 }
1491 } else {
1492 BT_ERR("%s SCO packet for unknown connection handle %d",
1493 hdev->name, handle);
1494 }
1495
1496 kfree_skb(skb);
1497 }
1498
1499 static void hci_rx_task(unsigned long arg)
1500 {
1501 struct hci_dev *hdev = (struct hci_dev *) arg;
1502 struct sk_buff *skb;
1503
1504 BT_DBG("%s", hdev->name);
1505
1506 read_lock(&hci_task_lock);
1507
1508 while ((skb = skb_dequeue(&hdev->rx_q))) {
1509 if (atomic_read(&hdev->promisc)) {
1510 /* Send copy to the sockets */
1511 hci_send_to_sock(hdev, skb);
1512 }
1513
1514 if (test_bit(HCI_RAW, &hdev->flags)) {
1515 kfree_skb(skb);
1516 continue;
1517 }
1518
1519 if (test_bit(HCI_INIT, &hdev->flags)) {
1520 /* Don't process data packets in this states. */
1521 switch (bt_cb(skb)->pkt_type) {
1522 case HCI_ACLDATA_PKT:
1523 case HCI_SCODATA_PKT:
1524 kfree_skb(skb);
1525 continue;
1526 }
1527 }
1528
1529 /* Process frame */
1530 switch (bt_cb(skb)->pkt_type) {
1531 case HCI_EVENT_PKT:
1532 hci_event_packet(hdev, skb);
1533 break;
1534
1535 case HCI_ACLDATA_PKT:
1536 BT_DBG("%s ACL data packet", hdev->name);
1537 hci_acldata_packet(hdev, skb);
1538 break;
1539
1540 case HCI_SCODATA_PKT:
1541 BT_DBG("%s SCO data packet", hdev->name);
1542 hci_scodata_packet(hdev, skb);
1543 break;
1544
1545 default:
1546 kfree_skb(skb);
1547 break;
1548 }
1549 }
1550
1551 read_unlock(&hci_task_lock);
1552 }
1553
1554 static void hci_cmd_task(unsigned long arg)
1555 {
1556 struct hci_dev *hdev = (struct hci_dev *) arg;
1557 struct sk_buff *skb;
1558
1559 BT_DBG("%s cmd %d", hdev->name, atomic_read(&hdev->cmd_cnt));
1560
1561 if (!atomic_read(&hdev->cmd_cnt) && time_after(jiffies, hdev->cmd_last_tx + HZ)) {
1562 BT_ERR("%s command tx timeout", hdev->name);
1563 atomic_set(&hdev->cmd_cnt, 1);
1564 }
1565
1566 /* Send queued commands */
1567 if (atomic_read(&hdev->cmd_cnt) && (skb = skb_dequeue(&hdev->cmd_q))) {
1568 if (hdev->sent_cmd)
1569 kfree_skb(hdev->sent_cmd);
1570
1571 if ((hdev->sent_cmd = skb_clone(skb, GFP_ATOMIC))) {
1572 atomic_dec(&hdev->cmd_cnt);
1573 hci_send_frame(skb);
1574 hdev->cmd_last_tx = jiffies;
1575 } else {
1576 skb_queue_head(&hdev->cmd_q, skb);
1577 hci_sched_cmd(hdev);
1578 }
1579 }
1580 }
Support for the Chinese Samsung S3C2440 based development boards