projects / linux-block.git / blame
? search:
summary | shortlog | log | commit | commitdiff | tree
blob | blame (incremental) | history | HEAD
Bluetooth: Fix TX error path in btsdio driver
[linux-block.git] / net / bluetooth / hci_core.c
CommitLineData
8e87d142 1/*
1da177e4
LT		 2 BlueZ - Bluetooth protocol stack for Linux
3 Copyright (C) 2000-2001 Qualcomm Incorporated
4
5 Written 2000,2001 by Maxim Krasnyansky <maxk@qualcomm.com>
6
7 This program is free software; you can redistribute it and/or modify
8 it under the terms of the GNU General Public License version 2 as
9 published by the Free Software Foundation;
10
11 THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
12 OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
13 FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
14 IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
8e87d142
YH		 15 CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
16 WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
17 ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
1da177e4
LT		 18 OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
19
8e87d142
YH		 20 ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
21 COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
1da177e4
LT		 22 SOFTWARE IS DISCLAIMED.
23*/
24
25/* Bluetooth HCI core. */
26
82453021 27#include <linux/jiffies.h>
1da177e4
LT		 28#include <linux/module.h>
29#include <linux/kmod.h>
30
31#include <linux/types.h>
32#include <linux/errno.h>
33#include <linux/kernel.h>
1da177e4
LT		 34#include <linux/sched.h>
35#include <linux/slab.h>
36#include <linux/poll.h>
37#include <linux/fcntl.h>
38#include <linux/init.h>
39#include <linux/skbuff.h>
40#include <linux/interrupt.h>
41#include <linux/notifier.h>
42#include <net/sock.h>
43
44#include <asm/system.h>
45#include <asm/uaccess.h>
46#include <asm/unaligned.h>
47
48#include <net/bluetooth/bluetooth.h>
49#include <net/bluetooth/hci_core.h>
50
51#ifndef CONFIG_BT_HCI_CORE_DEBUG
52#undef BT_DBG
53#define BT_DBG(D...)
54#endif
55
56static void hci_cmd_task(unsigned long arg);
57static void hci_rx_task(unsigned long arg);
58static void hci_tx_task(unsigned long arg);
59static void hci_notify(struct hci_dev *hdev, int event);
60
61static DEFINE_RWLOCK(hci_task_lock);
62
63/* HCI device list */
64LIST_HEAD(hci_dev_list);
65DEFINE_RWLOCK(hci_dev_list_lock);
66
67/* HCI callback list */
68LIST_HEAD(hci_cb_list);
69DEFINE_RWLOCK(hci_cb_list_lock);
70
71/* HCI protocols */
72#define HCI_MAX_PROTO 2
73struct hci_proto *hci_proto[HCI_MAX_PROTO];
74
75/* HCI notifiers list */
e041c683 76static ATOMIC_NOTIFIER_HEAD(hci_notifier);
1da177e4
LT		 77
78/* ---- HCI notifications ---- */
79
80int hci_register_notifier(struct notifier_block *nb)
81{
e041c683 82 return atomic_notifier_chain_register(&hci_notifier, nb);
1da177e4
LT		 83}
84
85int hci_unregister_notifier(struct notifier_block *nb)
86{
e041c683 87 return atomic_notifier_chain_unregister(&hci_notifier, nb);
1da177e4
LT		 88}
89
6516455d 90static void hci_notify(struct hci_dev *hdev, int event)
1da177e4 91{
e041c683 92 atomic_notifier_call_chain(&hci_notifier, event, hdev);
1da177e4
LT		 93}
94
95/* ---- HCI requests ---- */
96
97void hci_req_complete(struct hci_dev *hdev, int result)
98{
99 BT_DBG("%s result 0x%2.2x", hdev->name, result);
100
101 if (hdev->req_status == HCI_REQ_PEND) {
102 hdev->req_result = result;
103 hdev->req_status = HCI_REQ_DONE;
104 wake_up_interruptible(&hdev->req_wait_q);
105 }
106}
107
108static void hci_req_cancel(struct hci_dev *hdev, int err)
109{
110 BT_DBG("%s err 0x%2.2x", hdev->name, err);
111
112 if (hdev->req_status == HCI_REQ_PEND) {
113 hdev->req_result = err;
114 hdev->req_status = HCI_REQ_CANCELED;
115 wake_up_interruptible(&hdev->req_wait_q);
116 }
117}
118
119/* Execute request and wait for completion. */
8e87d142 120static int __hci_request(struct hci_dev *hdev, void (*req)(struct hci_dev *hdev, unsigned long opt),
1da177e4
LT		 121 unsigned long opt, __u32 timeout)
122{
123 DECLARE_WAITQUEUE(wait, current);
124 int err = 0;
125
126 BT_DBG("%s start", hdev->name);
127
128 hdev->req_status = HCI_REQ_PEND;
129
130 add_wait_queue(&hdev->req_wait_q, &wait);
131 set_current_state(TASK_INTERRUPTIBLE);
132
133 req(hdev, opt);
134 schedule_timeout(timeout);
135
136 remove_wait_queue(&hdev->req_wait_q, &wait);
137
138 if (signal_pending(current))
139 return -EINTR;
140
141 switch (hdev->req_status) {
142 case HCI_REQ_DONE:
143 err = -bt_err(hdev->req_result);
144 break;
145
146 case HCI_REQ_CANCELED:
147 err = -hdev->req_result;
148 break;
149
150 default:
151 err = -ETIMEDOUT;
152 break;
3ff50b79 153 }
1da177e4
LT		 154
155 hdev->req_status = hdev->req_result = 0;
156
157 BT_DBG("%s end: err %d", hdev->name, err);
158
159 return err;
160}
161
162static inline int hci_request(struct hci_dev *hdev, void (*req)(struct hci_dev *hdev, unsigned long opt),
163 unsigned long opt, __u32 timeout)
164{
165 int ret;
166
7c6a329e
MH		 167 if (!test_bit(HCI_UP, &hdev->flags))
168 return -ENETDOWN;
169
1da177e4
LT		 170 /* Serialize all requests */
171 hci_req_lock(hdev);
172 ret = __hci_request(hdev, req, opt, timeout);
173 hci_req_unlock(hdev);
174
175 return ret;
176}
177
178static void hci_reset_req(struct hci_dev *hdev, unsigned long opt)
179{
180 BT_DBG("%s %ld", hdev->name, opt);
181
182 /* Reset device */
a9de9248 183 hci_send_cmd(hdev, HCI_OP_RESET, 0, NULL);
1da177e4
LT		 184}
185
186static void hci_init_req(struct hci_dev *hdev, unsigned long opt)
187{
188 struct sk_buff *skb;
1ebb9252 189 __le16 param;
89f2783d 190 __u8 flt_type;
1da177e4
LT		 191
192 BT_DBG("%s %ld", hdev->name, opt);
193
194 /* Driver initialization */
195
196 /* Special commands */
197 while ((skb = skb_dequeue(&hdev->driver_init))) {
0d48d939 198 bt_cb(skb)->pkt_type = HCI_COMMAND_PKT;
1da177e4
LT		 199 skb->dev = (void *) hdev;
200 skb_queue_tail(&hdev->cmd_q, skb);
201 hci_sched_cmd(hdev);
202 }
203 skb_queue_purge(&hdev->driver_init);
204
205 /* Mandatory initialization */
206
207 /* Reset */
208 if (test_bit(HCI_QUIRK_RESET_ON_INIT, &hdev->quirks))
a9de9248 209 hci_send_cmd(hdev, HCI_OP_RESET, 0, NULL);
1da177e4
LT		 210
211 /* Read Local Supported Features */
a9de9248 212 hci_send_cmd(hdev, HCI_OP_READ_LOCAL_FEATURES, 0, NULL);
1da177e4 213
1143e5a6 214 /* Read Local Version */
a9de9248 215 hci_send_cmd(hdev, HCI_OP_READ_LOCAL_VERSION, 0, NULL);
1143e5a6 216
1da177e4 217 /* Read Buffer Size (ACL mtu, max pkt, etc.) */
a9de9248 218 hci_send_cmd(hdev, HCI_OP_READ_BUFFER_SIZE, 0, NULL);
1da177e4
LT		 219
220#if 0
221 /* Host buffer size */
222 {
223 struct hci_cp_host_buffer_size cp;
aca3192c 224 cp.acl_mtu = cpu_to_le16(HCI_MAX_ACL_SIZE);
1da177e4 225 cp.sco_mtu = HCI_MAX_SCO_SIZE;
aca3192c
YH		 226 cp.acl_max_pkt = cpu_to_le16(0xffff);
227 cp.sco_max_pkt = cpu_to_le16(0xffff);
a9de9248 228 hci_send_cmd(hdev, HCI_OP_HOST_BUFFER_SIZE, sizeof(cp), &cp);
1da177e4
LT		 229 }
230#endif
231
232 /* Read BD Address */
a9de9248
MH		 233 hci_send_cmd(hdev, HCI_OP_READ_BD_ADDR, 0, NULL);
234
235 /* Read Class of Device */
236 hci_send_cmd(hdev, HCI_OP_READ_CLASS_OF_DEV, 0, NULL);
237
238 /* Read Local Name */
239 hci_send_cmd(hdev, HCI_OP_READ_LOCAL_NAME, 0, NULL);
1da177e4
LT		 240
241 /* Read Voice Setting */
a9de9248 242 hci_send_cmd(hdev, HCI_OP_READ_VOICE_SETTING, 0, NULL);
1da177e4
LT		 243
244 /* Optional initialization */
245
246 /* Clear Event Filters */
89f2783d 247 flt_type = HCI_FLT_CLEAR_ALL;
a9de9248 248 hci_send_cmd(hdev, HCI_OP_SET_EVENT_FLT, 1, &flt_type);
1da177e4
LT		 249
250 /* Page timeout ~20 secs */
aca3192c 251 param = cpu_to_le16(0x8000);
a9de9248 252 hci_send_cmd(hdev, HCI_OP_WRITE_PG_TIMEOUT, 2, &param);
1da177e4
LT		 253
254 /* Connection accept timeout ~20 secs */
aca3192c 255 param = cpu_to_le16(0x7d00);
a9de9248 256 hci_send_cmd(hdev, HCI_OP_WRITE_CA_TIMEOUT, 2, &param);
1da177e4
LT		 257}
258
259static void hci_scan_req(struct hci_dev *hdev, unsigned long opt)
260{
261 __u8 scan = opt;
262
263 BT_DBG("%s %x", hdev->name, scan);
264
265 /* Inquiry and Page scans */
a9de9248 266 hci_send_cmd(hdev, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan);
1da177e4
LT		 267}
268
269static void hci_auth_req(struct hci_dev *hdev, unsigned long opt)
270{
271 __u8 auth = opt;
272
273 BT_DBG("%s %x", hdev->name, auth);
274
275 /* Authentication */
a9de9248 276 hci_send_cmd(hdev, HCI_OP_WRITE_AUTH_ENABLE, 1, &auth);
1da177e4
LT		 277}
278
279static void hci_encrypt_req(struct hci_dev *hdev, unsigned long opt)
280{
281 __u8 encrypt = opt;
282
283 BT_DBG("%s %x", hdev->name, encrypt);
284
e4e8e37c 285 /* Encryption */
a9de9248 286 hci_send_cmd(hdev, HCI_OP_WRITE_ENCRYPT_MODE, 1, &encrypt);
1da177e4
LT		 287}
288
e4e8e37c
MH		 289static void hci_linkpol_req(struct hci_dev *hdev, unsigned long opt)
290{
291 __le16 policy = cpu_to_le16(opt);
292
293 BT_DBG("%s %x", hdev->name, opt);
294
295 /* Default link policy */
296 hci_send_cmd(hdev, HCI_OP_WRITE_DEF_LINK_POLICY, 2, &policy);
297}
298
8e87d142 299/* Get HCI device by index.
1da177e4
LT		 300 * Device is held on return. */
301struct hci_dev *hci_dev_get(int index)
302{
303 struct hci_dev *hdev = NULL;
304 struct list_head *p;
305
306 BT_DBG("%d", index);
307
308 if (index < 0)
309 return NULL;
310
311 read_lock(&hci_dev_list_lock);
312 list_for_each(p, &hci_dev_list) {
313 struct hci_dev *d = list_entry(p, struct hci_dev, list);
314 if (d->id == index) {
315 hdev = hci_dev_hold(d);
316 break;
317 }
318 }
319 read_unlock(&hci_dev_list_lock);
320 return hdev;
321}
1da177e4
LT		 322
323/* ---- Inquiry support ---- */
324static void inquiry_cache_flush(struct hci_dev *hdev)
325{
326 struct inquiry_cache *cache = &hdev->inq_cache;
327 struct inquiry_entry *next = cache->list, *e;
328
329 BT_DBG("cache %p", cache);
330
331 cache->list = NULL;
332 while ((e = next)) {
333 next = e->next;
334 kfree(e);
335 }
336}
337
338struct inquiry_entry *hci_inquiry_cache_lookup(struct hci_dev *hdev, bdaddr_t *bdaddr)
339{
340 struct inquiry_cache *cache = &hdev->inq_cache;
341 struct inquiry_entry *e;
342
343 BT_DBG("cache %p, %s", cache, batostr(bdaddr));
344
345 for (e = cache->list; e; e = e->next)
346 if (!bacmp(&e->data.bdaddr, bdaddr))
347 break;
348 return e;
349}
350
351void hci_inquiry_cache_update(struct hci_dev *hdev, struct inquiry_data *data)
352{
353 struct inquiry_cache *cache = &hdev->inq_cache;
354 struct inquiry_entry *e;
355
356 BT_DBG("cache %p, %s", cache, batostr(&data->bdaddr));
357
358 if (!(e = hci_inquiry_cache_lookup(hdev, &data->bdaddr))) {
359 /* Entry not in the cache. Add new one. */
25ea6db0 360 if (!(e = kzalloc(sizeof(struct inquiry_entry), GFP_ATOMIC)))
1da177e4 361 return;
1da177e4
LT		 362 e->next = cache->list;
363 cache->list = e;
364 }
365
366 memcpy(&e->data, data, sizeof(*data));
367 e->timestamp = jiffies;
368 cache->timestamp = jiffies;
369}
370
371static int inquiry_cache_dump(struct hci_dev *hdev, int num, __u8 *buf)
372{
373 struct inquiry_cache *cache = &hdev->inq_cache;
374 struct inquiry_info *info = (struct inquiry_info *) buf;
375 struct inquiry_entry *e;
376 int copied = 0;
377
378 for (e = cache->list; e && copied < num; e = e->next, copied++) {
379 struct inquiry_data *data = &e->data;
380 bacpy(&info->bdaddr, &data->bdaddr);
381 info->pscan_rep_mode = data->pscan_rep_mode;
382 info->pscan_period_mode = data->pscan_period_mode;
383 info->pscan_mode = data->pscan_mode;
384 memcpy(info->dev_class, data->dev_class, 3);
385 info->clock_offset = data->clock_offset;
386 info++;
387 }
388
389 BT_DBG("cache %p, copied %d", cache, copied);
390 return copied;
391}
392
393static void hci_inq_req(struct hci_dev *hdev, unsigned long opt)
394{
395 struct hci_inquiry_req *ir = (struct hci_inquiry_req *) opt;
396 struct hci_cp_inquiry cp;
397
398 BT_DBG("%s", hdev->name);
399
400 if (test_bit(HCI_INQUIRY, &hdev->flags))
401 return;
402
403 /* Start Inquiry */
404 memcpy(&cp.lap, &ir->lap, 3);
405 cp.length = ir->length;
406 cp.num_rsp = ir->num_rsp;
a9de9248 407 hci_send_cmd(hdev, HCI_OP_INQUIRY, sizeof(cp), &cp);
1da177e4
LT		 408}
409
410int hci_inquiry(void __user *arg)
411{
412 __u8 __user *ptr = arg;
413 struct hci_inquiry_req ir;
414 struct hci_dev *hdev;
415 int err = 0, do_inquiry = 0, max_rsp;
416 long timeo;
417 __u8 *buf;
418
419 if (copy_from_user(&ir, ptr, sizeof(ir)))
420 return -EFAULT;
421
422 if (!(hdev = hci_dev_get(ir.dev_id)))
423 return -ENODEV;
424
425 hci_dev_lock_bh(hdev);
8e87d142 426 if (inquiry_cache_age(hdev) > INQUIRY_CACHE_AGE_MAX ||
1da177e4
LT		 427 inquiry_cache_empty(hdev) ||
428 ir.flags & IREQ_CACHE_FLUSH) {
429 inquiry_cache_flush(hdev);
430 do_inquiry = 1;
431 }
432 hci_dev_unlock_bh(hdev);
433
04837f64 434 timeo = ir.length * msecs_to_jiffies(2000);
1da177e4
LT		 435 if (do_inquiry && (err = hci_request(hdev, hci_inq_req, (unsigned long)&ir, timeo)) < 0)
436 goto done;
437
438 /* for unlimited number of responses we will use buffer with 255 entries */
439 max_rsp = (ir.num_rsp == 0) ? 255 : ir.num_rsp;
440
441 /* cache_dump can't sleep. Therefore we allocate temp buffer and then
442 * copy it to the user space.
443 */
444 if (!(buf = kmalloc(sizeof(struct inquiry_info) * max_rsp, GFP_KERNEL))) {
445 err = -ENOMEM;
446 goto done;
447 }
448
449 hci_dev_lock_bh(hdev);
450 ir.num_rsp = inquiry_cache_dump(hdev, max_rsp, buf);
451 hci_dev_unlock_bh(hdev);
452
453 BT_DBG("num_rsp %d", ir.num_rsp);
454
455 if (!copy_to_user(ptr, &ir, sizeof(ir))) {
456 ptr += sizeof(ir);
457 if (copy_to_user(ptr, buf, sizeof(struct inquiry_info) *
458 ir.num_rsp))
459 err = -EFAULT;
8e87d142 460 } else
1da177e4
LT		 461 err = -EFAULT;
462
463 kfree(buf);
464
465done:
466 hci_dev_put(hdev);
467 return err;
468}
469
470/* ---- HCI ioctl helpers ---- */
471
472int hci_dev_open(__u16 dev)
473{
474 struct hci_dev *hdev;
475 int ret = 0;
476
477 if (!(hdev = hci_dev_get(dev)))
478 return -ENODEV;
479
480 BT_DBG("%s %p", hdev->name, hdev);
481
482 hci_req_lock(hdev);
483
484 if (test_bit(HCI_UP, &hdev->flags)) {
485 ret = -EALREADY;
486 goto done;
487 }
488
489 if (test_bit(HCI_QUIRK_RAW_DEVICE, &hdev->quirks))
490 set_bit(HCI_RAW, &hdev->flags);
491
492 if (hdev->open(hdev)) {
493 ret = -EIO;
494 goto done;
495 }
496
497 if (!test_bit(HCI_RAW, &hdev->flags)) {
498 atomic_set(&hdev->cmd_cnt, 1);
499 set_bit(HCI_INIT, &hdev->flags);
500
501 //__hci_request(hdev, hci_reset_req, 0, HZ);
04837f64
MH		 502 ret = __hci_request(hdev, hci_init_req, 0,
503 msecs_to_jiffies(HCI_INIT_TIMEOUT));
1da177e4
LT		 504
505 clear_bit(HCI_INIT, &hdev->flags);
506 }
507
508 if (!ret) {
509 hci_dev_hold(hdev);
510 set_bit(HCI_UP, &hdev->flags);
511 hci_notify(hdev, HCI_DEV_UP);
8e87d142 512 } else {
1da177e4
LT		 513 /* Init failed, cleanup */
514 tasklet_kill(&hdev->rx_task);
515 tasklet_kill(&hdev->tx_task);
516 tasklet_kill(&hdev->cmd_task);
517
518 skb_queue_purge(&hdev->cmd_q);
519 skb_queue_purge(&hdev->rx_q);
520
521 if (hdev->flush)
522 hdev->flush(hdev);
523
524 if (hdev->sent_cmd) {
525 kfree_skb(hdev->sent_cmd);
526 hdev->sent_cmd = NULL;
527 }
528
529 hdev->close(hdev);
530 hdev->flags = 0;
531 }
532
533done:
534 hci_req_unlock(hdev);
535 hci_dev_put(hdev);
536 return ret;
537}
538
539static int hci_dev_do_close(struct hci_dev *hdev)
540{
541 BT_DBG("%s %p", hdev->name, hdev);
542
543 hci_req_cancel(hdev, ENODEV);
544 hci_req_lock(hdev);
545
546 if (!test_and_clear_bit(HCI_UP, &hdev->flags)) {
547 hci_req_unlock(hdev);
548 return 0;
549 }
550
551 /* Kill RX and TX tasks */
552 tasklet_kill(&hdev->rx_task);
553 tasklet_kill(&hdev->tx_task);
554
555 hci_dev_lock_bh(hdev);
556 inquiry_cache_flush(hdev);
557 hci_conn_hash_flush(hdev);
558 hci_dev_unlock_bh(hdev);
559
560 hci_notify(hdev, HCI_DEV_DOWN);
561
562 if (hdev->flush)
563 hdev->flush(hdev);
564
565 /* Reset device */
566 skb_queue_purge(&hdev->cmd_q);
567 atomic_set(&hdev->cmd_cnt, 1);
568 if (!test_bit(HCI_RAW, &hdev->flags)) {
569 set_bit(HCI_INIT, &hdev->flags);
04837f64
MH		 570 __hci_request(hdev, hci_reset_req, 0,
571 msecs_to_jiffies(250));
1da177e4
LT		 572 clear_bit(HCI_INIT, &hdev->flags);
573 }
574
575 /* Kill cmd task */
576 tasklet_kill(&hdev->cmd_task);
577
578 /* Drop queues */
579 skb_queue_purge(&hdev->rx_q);
580 skb_queue_purge(&hdev->cmd_q);
581 skb_queue_purge(&hdev->raw_q);
582
583 /* Drop last sent command */
584 if (hdev->sent_cmd) {
585 kfree_skb(hdev->sent_cmd);
586 hdev->sent_cmd = NULL;
587 }
588
589 /* After this point our queues are empty
590 * and no tasks are scheduled. */
591 hdev->close(hdev);
592
593 /* Clear flags */
594 hdev->flags = 0;
595
596 hci_req_unlock(hdev);
597
598 hci_dev_put(hdev);
599 return 0;
600}
601
602int hci_dev_close(__u16 dev)
603{
604 struct hci_dev *hdev;
605 int err;
606
607 if (!(hdev = hci_dev_get(dev)))
608 return -ENODEV;
609 err = hci_dev_do_close(hdev);
610 hci_dev_put(hdev);
611 return err;
612}
613
614int hci_dev_reset(__u16 dev)
615{
616 struct hci_dev *hdev;
617 int ret = 0;
618
619 if (!(hdev = hci_dev_get(dev)))
620 return -ENODEV;
621
622 hci_req_lock(hdev);
623 tasklet_disable(&hdev->tx_task);
624
625 if (!test_bit(HCI_UP, &hdev->flags))
626 goto done;
627
628 /* Drop queues */
629 skb_queue_purge(&hdev->rx_q);
630 skb_queue_purge(&hdev->cmd_q);
631
632 hci_dev_lock_bh(hdev);
633 inquiry_cache_flush(hdev);
634 hci_conn_hash_flush(hdev);
635 hci_dev_unlock_bh(hdev);
636
637 if (hdev->flush)
638 hdev->flush(hdev);
639
8e87d142 640 atomic_set(&hdev->cmd_cnt, 1);
1da177e4
LT		 641 hdev->acl_cnt = 0; hdev->sco_cnt = 0;
642
643 if (!test_bit(HCI_RAW, &hdev->flags))
04837f64
MH		 644 ret = __hci_request(hdev, hci_reset_req, 0,
645 msecs_to_jiffies(HCI_INIT_TIMEOUT));
1da177e4
LT		 646
647done:
648 tasklet_enable(&hdev->tx_task);
649 hci_req_unlock(hdev);
650 hci_dev_put(hdev);
651 return ret;
652}
653
654int hci_dev_reset_stat(__u16 dev)
655{
656 struct hci_dev *hdev;
657 int ret = 0;
658
659 if (!(hdev = hci_dev_get(dev)))
660 return -ENODEV;
661
662 memset(&hdev->stat, 0, sizeof(struct hci_dev_stats));
663
664 hci_dev_put(hdev);
665
666 return ret;
667}
668
669int hci_dev_cmd(unsigned int cmd, void __user *arg)
670{
671 struct hci_dev *hdev;
672 struct hci_dev_req dr;
673 int err = 0;
674
675 if (copy_from_user(&dr, arg, sizeof(dr)))
676 return -EFAULT;
677
678 if (!(hdev = hci_dev_get(dr.dev_id)))
679 return -ENODEV;
680
681 switch (cmd) {
682 case HCISETAUTH:
04837f64
MH		 683 err = hci_request(hdev, hci_auth_req, dr.dev_opt,
684 msecs_to_jiffies(HCI_INIT_TIMEOUT));
1da177e4
LT		 685 break;
686
687 case HCISETENCRYPT:
688 if (!lmp_encrypt_capable(hdev)) {
689 err = -EOPNOTSUPP;
690 break;
691 }
692
693 if (!test_bit(HCI_AUTH, &hdev->flags)) {
694 /* Auth must be enabled first */
04837f64
MH		 695 err = hci_request(hdev, hci_auth_req, dr.dev_opt,
696 msecs_to_jiffies(HCI_INIT_TIMEOUT));
1da177e4
LT		 697 if (err)
698 break;
699 }
700
04837f64
MH		 701 err = hci_request(hdev, hci_encrypt_req, dr.dev_opt,
702 msecs_to_jiffies(HCI_INIT_TIMEOUT));
1da177e4
LT		 703 break;
704
705 case HCISETSCAN:
04837f64
MH		 706 err = hci_request(hdev, hci_scan_req, dr.dev_opt,
707 msecs_to_jiffies(HCI_INIT_TIMEOUT));
1da177e4
LT		 708 break;
709
1da177e4 710 case HCISETLINKPOL:
e4e8e37c
MH		 711 err = hci_request(hdev, hci_linkpol_req, dr.dev_opt,
712 msecs_to_jiffies(HCI_INIT_TIMEOUT));
1da177e4
LT		 713 break;
714
715 case HCISETLINKMODE:
e4e8e37c
MH		 716 hdev->link_mode = ((__u16) dr.dev_opt) &
717 (HCI_LM_MASTER | HCI_LM_ACCEPT);
718 break;
719
720 case HCISETPTYPE:
721 hdev->pkt_type = (__u16) dr.dev_opt;
1da177e4
LT		 722 break;
723
724 case HCISETACLMTU:
e4e8e37c
MH		 725 hdev->acl_mtu = *((__u16 *) &dr.dev_opt + 1);
726 hdev->acl_pkts = *((__u16 *) &dr.dev_opt + 0);
1da177e4
LT		 727 break;
728
729 case HCISETSCOMTU:
e4e8e37c
MH		 730 hdev->sco_mtu = *((__u16 *) &dr.dev_opt + 1);
731 hdev->sco_pkts = *((__u16 *) &dr.dev_opt + 0);
1da177e4
LT		 732 break;
733
734 default:
735 err = -EINVAL;
736 break;
737 }
e4e8e37c 738
1da177e4
LT		 739 hci_dev_put(hdev);
740 return err;
741}
742
743int hci_get_dev_list(void __user *arg)
744{
745 struct hci_dev_list_req *dl;
746 struct hci_dev_req *dr;
747 struct list_head *p;
748 int n = 0, size, err;
749 __u16 dev_num;
750
751 if (get_user(dev_num, (__u16 __user *) arg))
752 return -EFAULT;
753
754 if (!dev_num || dev_num > (PAGE_SIZE * 2) / sizeof(*dr))
755 return -EINVAL;
756
757 size = sizeof(*dl) + dev_num * sizeof(*dr);
758
759 if (!(dl = kmalloc(size, GFP_KERNEL)))
760 return -ENOMEM;
761
762 dr = dl->dev_req;
763
764 read_lock_bh(&hci_dev_list_lock);
765 list_for_each(p, &hci_dev_list) {
766 struct hci_dev *hdev;
767 hdev = list_entry(p, struct hci_dev, list);
768 (dr + n)->dev_id = hdev->id;
769 (dr + n)->dev_opt = hdev->flags;
770 if (++n >= dev_num)
771 break;
772 }
773 read_unlock_bh(&hci_dev_list_lock);
774
775 dl->dev_num = n;
776 size = sizeof(*dl) + n * sizeof(*dr);
777
778 err = copy_to_user(arg, dl, size);
779 kfree(dl);
780
781 return err ? -EFAULT : 0;
782}
783
784int hci_get_dev_info(void __user *arg)
785{
786 struct hci_dev *hdev;
787 struct hci_dev_info di;
788 int err = 0;
789
790 if (copy_from_user(&di, arg, sizeof(di)))
791 return -EFAULT;
792
793 if (!(hdev = hci_dev_get(di.dev_id)))
794 return -ENODEV;
795
796 strcpy(di.name, hdev->name);
797 di.bdaddr = hdev->bdaddr;
798 di.type = hdev->type;
799 di.flags = hdev->flags;
800 di.pkt_type = hdev->pkt_type;
801 di.acl_mtu = hdev->acl_mtu;
802 di.acl_pkts = hdev->acl_pkts;
803 di.sco_mtu = hdev->sco_mtu;
804 di.sco_pkts = hdev->sco_pkts;
805 di.link_policy = hdev->link_policy;
806 di.link_mode = hdev->link_mode;
807
808 memcpy(&di.stat, &hdev->stat, sizeof(di.stat));
809 memcpy(&di.features, &hdev->features, sizeof(di.features));
810
811 if (copy_to_user(arg, &di, sizeof(di)))
812 err = -EFAULT;
813
814 hci_dev_put(hdev);
815
816 return err;
817}
818
819/* ---- Interface to HCI drivers ---- */
820
821/* Alloc HCI device */
822struct hci_dev *hci_alloc_dev(void)
823{
824 struct hci_dev *hdev;
825
25ea6db0 826 hdev = kzalloc(sizeof(struct hci_dev), GFP_KERNEL);
1da177e4
LT		 827 if (!hdev)
828 return NULL;
829
1da177e4
LT		 830 skb_queue_head_init(&hdev->driver_init);
831
832 return hdev;
833}
834EXPORT_SYMBOL(hci_alloc_dev);
835
836/* Free HCI device */
837void hci_free_dev(struct hci_dev *hdev)
838{
839 skb_queue_purge(&hdev->driver_init);
840
a91f2e39
MH		 841 /* will free via device release */
842 put_device(&hdev->dev);
1da177e4
LT		 843}
844EXPORT_SYMBOL(hci_free_dev);
845
846/* Register HCI device */
847int hci_register_dev(struct hci_dev *hdev)
848{
849 struct list_head *head = &hci_dev_list, *p;
ef222013 850 int i, id = 0;
1da177e4
LT		 851
852 BT_DBG("%p name %s type %d owner %p", hdev, hdev->name, hdev->type, hdev->owner);
853
854 if (!hdev->open || !hdev->close || !hdev->destruct)
855 return -EINVAL;
856
857 write_lock_bh(&hci_dev_list_lock);
858
859 /* Find first available device id */
860 list_for_each(p, &hci_dev_list) {
861 if (list_entry(p, struct hci_dev, list)->id != id)
862 break;
863 head = p; id++;
864 }
8e87d142 865
1da177e4
LT		 866 sprintf(hdev->name, "hci%d", id);
867 hdev->id = id;
868 list_add(&hdev->list, head);
869
870 atomic_set(&hdev->refcnt, 1);
871 spin_lock_init(&hdev->lock);
872
873 hdev->flags = 0;
874 hdev->pkt_type = (HCI_DM1 | HCI_DH1 | HCI_HV1);
5b7f9909 875 hdev->esco_type = (ESCO_HV1);
1da177e4
LT		 876 hdev->link_mode = (HCI_LM_ACCEPT);
877
04837f64
MH		 878 hdev->idle_timeout = 0;
879 hdev->sniff_max_interval = 800;
880 hdev->sniff_min_interval = 80;
881
1da177e4
LT		 882 tasklet_init(&hdev->cmd_task, hci_cmd_task,(unsigned long) hdev);
883 tasklet_init(&hdev->rx_task, hci_rx_task, (unsigned long) hdev);
884 tasklet_init(&hdev->tx_task, hci_tx_task, (unsigned long) hdev);
885
886 skb_queue_head_init(&hdev->rx_q);
887 skb_queue_head_init(&hdev->cmd_q);
888 skb_queue_head_init(&hdev->raw_q);
889
ef222013
MH		 890 for (i = 0; i < 3; i++)
891 hdev->reassembly[i] = NULL;
892
1da177e4
LT		 893 init_waitqueue_head(&hdev->req_wait_q);
894 init_MUTEX(&hdev->req_lock);
895
896 inquiry_cache_init(hdev);
897
898 hci_conn_hash_init(hdev);
899
900 memset(&hdev->stat, 0, sizeof(struct hci_dev_stats));
901
902 atomic_set(&hdev->promisc, 0);
903
904 write_unlock_bh(&hci_dev_list_lock);
905
906 hci_register_sysfs(hdev);
907
908 hci_notify(hdev, HCI_DEV_REG);
909
910 return id;
911}
912EXPORT_SYMBOL(hci_register_dev);
913
914/* Unregister HCI device */
915int hci_unregister_dev(struct hci_dev *hdev)
916{
ef222013
MH		 917 int i;
918
1da177e4
LT		 919 BT_DBG("%p name %s type %d", hdev, hdev->name, hdev->type);
920
1da177e4
LT		 921 write_lock_bh(&hci_dev_list_lock);
922 list_del(&hdev->list);
923 write_unlock_bh(&hci_dev_list_lock);
924
925 hci_dev_do_close(hdev);
926
ef222013
MH		 927 for (i = 0; i < 3; i++)
928 kfree_skb(hdev->reassembly[i]);
929
1da177e4
LT		 930 hci_notify(hdev, HCI_DEV_UNREG);
931
147e2d59
DY		 932 hci_unregister_sysfs(hdev);
933
1da177e4 934 __hci_dev_put(hdev);
ef222013 935
1da177e4
LT		 936 return 0;
937}
938EXPORT_SYMBOL(hci_unregister_dev);
939
940/* Suspend HCI device */
941int hci_suspend_dev(struct hci_dev *hdev)
942{
943 hci_notify(hdev, HCI_DEV_SUSPEND);
944 return 0;
945}
946EXPORT_SYMBOL(hci_suspend_dev);
947
948/* Resume HCI device */
949int hci_resume_dev(struct hci_dev *hdev)
950{
951 hci_notify(hdev, HCI_DEV_RESUME);
952 return 0;
953}
954EXPORT_SYMBOL(hci_resume_dev);
955
ef222013
MH		 956/* Receive packet type fragment */
957#define __reassembly(hdev, type) ((hdev)->reassembly[(type) - 2])
958
959int hci_recv_fragment(struct hci_dev *hdev, int type, void *data, int count)
960{
961 if (type < HCI_ACLDATA_PKT || type > HCI_EVENT_PKT)
962 return -EILSEQ;
963
964 while (count) {
965 struct sk_buff *skb = __reassembly(hdev, type);
966 struct { int expect; } *scb;
967 int len = 0;
968
969 if (!skb) {
970 /* Start of the frame */
971
972 switch (type) {
973 case HCI_EVENT_PKT:
974 if (count >= HCI_EVENT_HDR_SIZE) {
975 struct hci_event_hdr *h = data;
976 len = HCI_EVENT_HDR_SIZE + h->plen;
977 } else
978 return -EILSEQ;
979 break;
980
981 case HCI_ACLDATA_PKT:
982 if (count >= HCI_ACL_HDR_SIZE) {
983 struct hci_acl_hdr *h = data;
984 len = HCI_ACL_HDR_SIZE + __le16_to_cpu(h->dlen);
985 } else
986 return -EILSEQ;
987 break;
988
989 case HCI_SCODATA_PKT:
990 if (count >= HCI_SCO_HDR_SIZE) {
991 struct hci_sco_hdr *h = data;
992 len = HCI_SCO_HDR_SIZE + h->dlen;
993 } else
994 return -EILSEQ;
995 break;
996 }
997
998 skb = bt_skb_alloc(len, GFP_ATOMIC);
999 if (!skb) {
1000 BT_ERR("%s no memory for packet", hdev->name);
1001 return -ENOMEM;
1002 }
1003
1004 skb->dev = (void *) hdev;
1005 bt_cb(skb)->pkt_type = type;
00ae02f3 1006
ef222013
MH		 1007 __reassembly(hdev, type) = skb;
1008
1009 scb = (void *) skb->cb;
1010 scb->expect = len;
1011 } else {
1012 /* Continuation */
1013
1014 scb = (void *) skb->cb;
1015 len = scb->expect;
1016 }
1017
1018 len = min(len, count);
1019
1020 memcpy(skb_put(skb, len), data, len);
1021
1022 scb->expect -= len;
1023
1024 if (scb->expect == 0) {
1025 /* Complete frame */
1026
1027 __reassembly(hdev, type) = NULL;
1028
1029 bt_cb(skb)->pkt_type = type;
1030 hci_recv_frame(skb);
1031 }
1032
1033 count -= len; data += len;
1034 }
1035
1036 return 0;
1037}
1038EXPORT_SYMBOL(hci_recv_fragment);
1039
1da177e4
LT		 1040/* ---- Interface to upper protocols ---- */
1041
1042/* Register/Unregister protocols.
1043 * hci_task_lock is used to ensure that no tasks are running. */
1044int hci_register_proto(struct hci_proto *hp)
1045{
1046 int err = 0;
1047
1048 BT_DBG("%p name %s id %d", hp, hp->name, hp->id);
1049
1050 if (hp->id >= HCI_MAX_PROTO)
1051 return -EINVAL;
1052
1053 write_lock_bh(&hci_task_lock);
1054
1055 if (!hci_proto[hp->id])
1056 hci_proto[hp->id] = hp;
1057 else
1058 err = -EEXIST;
1059
1060 write_unlock_bh(&hci_task_lock);
1061
1062 return err;
1063}
1064EXPORT_SYMBOL(hci_register_proto);
1065
1066int hci_unregister_proto(struct hci_proto *hp)
1067{
1068 int err = 0;
1069
1070 BT_DBG("%p name %s id %d", hp, hp->name, hp->id);
1071
1072 if (hp->id >= HCI_MAX_PROTO)
1073 return -EINVAL;
1074
1075 write_lock_bh(&hci_task_lock);
1076
1077 if (hci_proto[hp->id])
1078 hci_proto[hp->id] = NULL;
1079 else
1080 err = -ENOENT;
1081
1082 write_unlock_bh(&hci_task_lock);
1083
1084 return err;
1085}
1086EXPORT_SYMBOL(hci_unregister_proto);
1087
1088int hci_register_cb(struct hci_cb *cb)
1089{
1090 BT_DBG("%p name %s", cb, cb->name);
1091
1092 write_lock_bh(&hci_cb_list_lock);
1093 list_add(&cb->list, &hci_cb_list);
1094 write_unlock_bh(&hci_cb_list_lock);
1095
1096 return 0;
1097}
1098EXPORT_SYMBOL(hci_register_cb);
1099
1100int hci_unregister_cb(struct hci_cb *cb)
1101{
1102 BT_DBG("%p name %s", cb, cb->name);
1103
1104 write_lock_bh(&hci_cb_list_lock);
1105 list_del(&cb->list);
1106 write_unlock_bh(&hci_cb_list_lock);
1107
1108 return 0;
1109}
1110EXPORT_SYMBOL(hci_unregister_cb);
1111
1112static int hci_send_frame(struct sk_buff *skb)
1113{
1114 struct hci_dev *hdev = (struct hci_dev *) skb->dev;
1115
1116 if (!hdev) {
1117 kfree_skb(skb);
1118 return -ENODEV;
1119 }
1120
0d48d939 1121 BT_DBG("%s type %d len %d", hdev->name, bt_cb(skb)->pkt_type, skb->len);
1da177e4
LT		 1122
1123 if (atomic_read(&hdev->promisc)) {
1124 /* Time stamp */
a61bbcf2 1125 __net_timestamp(skb);
1da177e4
LT		 1126
1127 hci_send_to_sock(hdev, skb);
1128 }
1129
1130 /* Get rid of skb owner, prior to sending to the driver. */
1131 skb_orphan(skb);
1132
1133 return hdev->send(skb);
1134}
1135
1136/* Send HCI command */
a9de9248 1137int hci_send_cmd(struct hci_dev *hdev, __u16 opcode, __u32 plen, void *param)
1da177e4
LT		 1138{
1139 int len = HCI_COMMAND_HDR_SIZE + plen;
1140 struct hci_command_hdr *hdr;
1141 struct sk_buff *skb;
1142
a9de9248 1143 BT_DBG("%s opcode 0x%x plen %d", hdev->name, opcode, plen);
1da177e4
LT		 1144
1145 skb = bt_skb_alloc(len, GFP_ATOMIC);
1146 if (!skb) {
ef222013 1147 BT_ERR("%s no memory for command", hdev->name);
1da177e4
LT		 1148 return -ENOMEM;
1149 }
1150
1151 hdr = (struct hci_command_hdr *) skb_put(skb, HCI_COMMAND_HDR_SIZE);
a9de9248 1152 hdr->opcode = cpu_to_le16(opcode);
1da177e4
LT		 1153 hdr->plen = plen;
1154
1155 if (plen)
1156 memcpy(skb_put(skb, plen), param, plen);
1157
1158 BT_DBG("skb len %d", skb->len);
1159
0d48d939 1160 bt_cb(skb)->pkt_type = HCI_COMMAND_PKT;
1da177e4
LT		 1161 skb->dev = (void *) hdev;
1162 skb_queue_tail(&hdev->cmd_q, skb);
1163 hci_sched_cmd(hdev);
1164
1165 return 0;
1166}
1da177e4
LT		 1167
1168/* Get data from the previously sent command */
a9de9248 1169void *hci_sent_cmd_data(struct hci_dev *hdev, __u16 opcode)
1da177e4
LT		 1170{
1171 struct hci_command_hdr *hdr;
1172
1173 if (!hdev->sent_cmd)
1174 return NULL;
1175
1176 hdr = (void *) hdev->sent_cmd->data;
1177
a9de9248 1178 if (hdr->opcode != cpu_to_le16(opcode))
1da177e4
LT		 1179 return NULL;
1180
a9de9248 1181 BT_DBG("%s opcode 0x%x", hdev->name, opcode);
1da177e4
LT		 1182
1183 return hdev->sent_cmd->data + HCI_COMMAND_HDR_SIZE;
1184}
1185
1186/* Send ACL data */
1187static void hci_add_acl_hdr(struct sk_buff *skb, __u16 handle, __u16 flags)
1188{
1189 struct hci_acl_hdr *hdr;
1190 int len = skb->len;
1191
badff6d0
ACM		 1192 skb_push(skb, HCI_ACL_HDR_SIZE);
1193 skb_reset_transport_header(skb);
9c70220b 1194 hdr = (struct hci_acl_hdr *)skb_transport_header(skb);
aca3192c
YH		 1195 hdr->handle = cpu_to_le16(hci_handle_pack(handle, flags));
1196 hdr->dlen = cpu_to_le16(len);
1da177e4
LT		 1197}
1198
1199int hci_send_acl(struct hci_conn *conn, struct sk_buff *skb, __u16 flags)
1200{
1201 struct hci_dev *hdev = conn->hdev;
1202 struct sk_buff *list;
1203
1204 BT_DBG("%s conn %p flags 0x%x", hdev->name, conn, flags);
1205
1206 skb->dev = (void *) hdev;
0d48d939 1207 bt_cb(skb)->pkt_type = HCI_ACLDATA_PKT;
1da177e4
LT		 1208 hci_add_acl_hdr(skb, conn->handle, flags | ACL_START);
1209
1210 if (!(list = skb_shinfo(skb)->frag_list)) {
1211 /* Non fragmented */
1212 BT_DBG("%s nonfrag skb %p len %d", hdev->name, skb, skb->len);
1213
1214 skb_queue_tail(&conn->data_q, skb);
1215 } else {
1216 /* Fragmented */
1217 BT_DBG("%s frag %p len %d", hdev->name, skb, skb->len);
1218
1219 skb_shinfo(skb)->frag_list = NULL;
1220
1221 /* Queue all fragments atomically */
1222 spin_lock_bh(&conn->data_q.lock);
1223
1224 __skb_queue_tail(&conn->data_q, skb);
1225 do {
1226 skb = list; list = list->next;
8e87d142 1227
1da177e4 1228 skb->dev = (void *) hdev;
0d48d939 1229 bt_cb(skb)->pkt_type = HCI_ACLDATA_PKT;
1da177e4
LT		 1230 hci_add_acl_hdr(skb, conn->handle, flags | ACL_CONT);
1231
1232 BT_DBG("%s frag %p len %d", hdev->name, skb, skb->len);
1233
1234 __skb_queue_tail(&conn->data_q, skb);
1235 } while (list);
1236
1237 spin_unlock_bh(&conn->data_q.lock);
1238 }
1239
1240 hci_sched_tx(hdev);
1241 return 0;
1242}
1243EXPORT_SYMBOL(hci_send_acl);
1244
1245/* Send SCO data */
1246int hci_send_sco(struct hci_conn *conn, struct sk_buff *skb)
1247{
1248 struct hci_dev *hdev = conn->hdev;
1249 struct hci_sco_hdr hdr;
1250
1251 BT_DBG("%s len %d", hdev->name, skb->len);
1252
1253 if (skb->len > hdev->sco_mtu) {
1254 kfree_skb(skb);
1255 return -EINVAL;
1256 }
1257
aca3192c 1258 hdr.handle = cpu_to_le16(conn->handle);
1da177e4
LT		 1259 hdr.dlen = skb->len;
1260
badff6d0
ACM		 1261 skb_push(skb, HCI_SCO_HDR_SIZE);
1262 skb_reset_transport_header(skb);
9c70220b 1263 memcpy(skb_transport_header(skb), &hdr, HCI_SCO_HDR_SIZE);
1da177e4
LT		 1264
1265 skb->dev = (void *) hdev;
0d48d939 1266 bt_cb(skb)->pkt_type = HCI_SCODATA_PKT;
1da177e4
LT		 1267 skb_queue_tail(&conn->data_q, skb);
1268 hci_sched_tx(hdev);
1269 return 0;
1270}
1271EXPORT_SYMBOL(hci_send_sco);
1272
1273/* ---- HCI TX task (outgoing data) ---- */
1274
1275/* HCI Connection scheduler */
1276static inline struct hci_conn *hci_low_sent(struct hci_dev *hdev, __u8 type, int *quote)
1277{
1278 struct hci_conn_hash *h = &hdev->conn_hash;
5b7f9909 1279 struct hci_conn *conn = NULL;
1da177e4
LT		 1280 int num = 0, min = ~0;
1281 struct list_head *p;
1282
8e87d142 1283 /* We don't have to lock device here. Connections are always
1da177e4
LT		 1284 * added and removed with TX task disabled. */
1285 list_for_each(p, &h->list) {
1286 struct hci_conn *c;
1287 c = list_entry(p, struct hci_conn, list);
1288
769be974 1289 if (c->type != type || skb_queue_empty(&c->data_q))
1da177e4 1290 continue;
769be974
MH		 1291
1292 if (c->state != BT_CONNECTED && c->state != BT_CONFIG)
1293 continue;
1294
1da177e4
LT		 1295 num++;
1296
1297 if (c->sent < min) {
1298 min = c->sent;
1299 conn = c;
1300 }
1301 }
1302
1303 if (conn) {
1304 int cnt = (type == ACL_LINK ? hdev->acl_cnt : hdev->sco_cnt);
1305 int q = cnt / num;
1306 *quote = q ? q : 1;
1307 } else
1308 *quote = 0;
1309
1310 BT_DBG("conn %p quote %d", conn, *quote);
1311 return conn;
1312}
1313
1314static inline void hci_acl_tx_to(struct hci_dev *hdev)
1315{
1316 struct hci_conn_hash *h = &hdev->conn_hash;
1317 struct list_head *p;
1318 struct hci_conn *c;
1319
1320 BT_ERR("%s ACL tx timeout", hdev->name);
1321
1322 /* Kill stalled connections */
1323 list_for_each(p, &h->list) {
1324 c = list_entry(p, struct hci_conn, list);
1325 if (c->type == ACL_LINK && c->sent) {
1326 BT_ERR("%s killing stalled ACL connection %s",
1327 hdev->name, batostr(&c->dst));
1328 hci_acl_disconn(c, 0x13);
1329 }
1330 }
1331}
1332
1333static inline void hci_sched_acl(struct hci_dev *hdev)
1334{
1335 struct hci_conn *conn;
1336 struct sk_buff *skb;
1337 int quote;
1338
1339 BT_DBG("%s", hdev->name);
1340
1341 if (!test_bit(HCI_RAW, &hdev->flags)) {
1342 /* ACL tx timeout must be longer than maximum
1343 * link supervision timeout (40.9 seconds) */
82453021 1344 if (!hdev->acl_cnt && time_after(jiffies, hdev->acl_last_tx + HZ * 45))
1da177e4
LT		 1345 hci_acl_tx_to(hdev);
1346 }
1347
1348 while (hdev->acl_cnt && (conn = hci_low_sent(hdev, ACL_LINK, &quote))) {
1349 while (quote-- && (skb = skb_dequeue(&conn->data_q))) {
1350 BT_DBG("skb %p len %d", skb, skb->len);
04837f64
MH		 1351
1352 hci_conn_enter_active_mode(conn);
1353
1da177e4
LT		 1354 hci_send_frame(skb);
1355 hdev->acl_last_tx = jiffies;
1356
1357 hdev->acl_cnt--;
1358 conn->sent++;
1359 }
1360 }
1361}
1362
1363/* Schedule SCO */
1364static inline void hci_sched_sco(struct hci_dev *hdev)
1365{
1366 struct hci_conn *conn;
1367 struct sk_buff *skb;
1368 int quote;
1369
1370 BT_DBG("%s", hdev->name);
1371
1372 while (hdev->sco_cnt && (conn = hci_low_sent(hdev, SCO_LINK, &quote))) {
1373 while (quote-- && (skb = skb_dequeue(&conn->data_q))) {
1374 BT_DBG("skb %p len %d", skb, skb->len);
1375 hci_send_frame(skb);
1376
1377 conn->sent++;
1378 if (conn->sent == ~0)
1379 conn->sent = 0;
1380 }
1381 }
1382}
1383
b6a0dc82
MH		 1384static inline void hci_sched_esco(struct hci_dev *hdev)
1385{
1386 struct hci_conn *conn;
1387 struct sk_buff *skb;
1388 int quote;
1389
1390 BT_DBG("%s", hdev->name);
1391
1392 while (hdev->sco_cnt && (conn = hci_low_sent(hdev, ESCO_LINK, &quote))) {
1393 while (quote-- && (skb = skb_dequeue(&conn->data_q))) {
1394 BT_DBG("skb %p len %d", skb, skb->len);
1395 hci_send_frame(skb);
1396
1397 conn->sent++;
1398 if (conn->sent == ~0)
1399 conn->sent = 0;
1400 }
1401 }
1402}
1403
1da177e4
LT		 1404static void hci_tx_task(unsigned long arg)
1405{
1406 struct hci_dev *hdev = (struct hci_dev *) arg;
1407 struct sk_buff *skb;
1408
1409 read_lock(&hci_task_lock);
1410
1411 BT_DBG("%s acl %d sco %d", hdev->name, hdev->acl_cnt, hdev->sco_cnt);
1412
1413 /* Schedule queues and send stuff to HCI driver */
1414
1415 hci_sched_acl(hdev);
1416
1417 hci_sched_sco(hdev);
1418
b6a0dc82
MH		 1419 hci_sched_esco(hdev);
1420
1da177e4
LT		 1421 /* Send next queued raw (unknown type) packet */
1422 while ((skb = skb_dequeue(&hdev->raw_q)))
1423 hci_send_frame(skb);
1424
1425 read_unlock(&hci_task_lock);
1426}
1427
1428/* ----- HCI RX task (incoming data proccessing) ----- */
1429
1430/* ACL data packet */
1431static inline void hci_acldata_packet(struct hci_dev *hdev, struct sk_buff *skb)
1432{
1433 struct hci_acl_hdr *hdr = (void *) skb->data;
1434 struct hci_conn *conn;
1435 __u16 handle, flags;
1436
1437 skb_pull(skb, HCI_ACL_HDR_SIZE);
1438
1439 handle = __le16_to_cpu(hdr->handle);
1440 flags = hci_flags(handle);
1441 handle = hci_handle(handle);
1442
1443 BT_DBG("%s len %d handle 0x%x flags 0x%x", hdev->name, skb->len, handle, flags);
1444
1445 hdev->stat.acl_rx++;
1446
1447 hci_dev_lock(hdev);
1448 conn = hci_conn_hash_lookup_handle(hdev, handle);
1449 hci_dev_unlock(hdev);
8e87d142 1450
1da177e4
LT		 1451 if (conn) {
1452 register struct hci_proto *hp;
1453
04837f64
MH		 1454 hci_conn_enter_active_mode(conn);
1455
1da177e4
LT		 1456 /* Send to upper protocol */
1457 if ((hp = hci_proto[HCI_PROTO_L2CAP]) && hp->recv_acldata) {
1458 hp->recv_acldata(conn, skb, flags);
1459 return;
1460 }
1461 } else {
8e87d142 1462 BT_ERR("%s ACL packet for unknown connection handle %d",
1da177e4
LT		 1463 hdev->name, handle);
1464 }
1465
1466 kfree_skb(skb);
1467}
1468
1469/* SCO data packet */
1470static inline void hci_scodata_packet(struct hci_dev *hdev, struct sk_buff *skb)
1471{
1472 struct hci_sco_hdr *hdr = (void *) skb->data;
1473 struct hci_conn *conn;
1474 __u16 handle;
1475
1476 skb_pull(skb, HCI_SCO_HDR_SIZE);
1477
1478 handle = __le16_to_cpu(hdr->handle);
1479
1480 BT_DBG("%s len %d handle 0x%x", hdev->name, skb->len, handle);
1481
1482 hdev->stat.sco_rx++;
1483
1484 hci_dev_lock(hdev);
1485 conn = hci_conn_hash_lookup_handle(hdev, handle);
1486 hci_dev_unlock(hdev);
1487
1488 if (conn) {
1489 register struct hci_proto *hp;
1490
1491 /* Send to upper protocol */
1492 if ((hp = hci_proto[HCI_PROTO_SCO]) && hp->recv_scodata) {
1493 hp->recv_scodata(conn, skb);
1494 return;
1495 }
1496 } else {
8e87d142 1497 BT_ERR("%s SCO packet for unknown connection handle %d",
1da177e4
LT		 1498 hdev->name, handle);
1499 }
1500
1501 kfree_skb(skb);
1502}
1503
6516455d 1504static void hci_rx_task(unsigned long arg)
1da177e4
LT		 1505{
1506 struct hci_dev *hdev = (struct hci_dev *) arg;
1507 struct sk_buff *skb;
1508
1509 BT_DBG("%s", hdev->name);
1510
1511 read_lock(&hci_task_lock);
1512
1513 while ((skb = skb_dequeue(&hdev->rx_q))) {
1514 if (atomic_read(&hdev->promisc)) {
1515 /* Send copy to the sockets */
1516 hci_send_to_sock(hdev, skb);
1517 }
1518
1519 if (test_bit(HCI_RAW, &hdev->flags)) {
1520 kfree_skb(skb);
1521 continue;
1522 }
1523
1524 if (test_bit(HCI_INIT, &hdev->flags)) {
1525 /* Don't process data packets in this states. */
0d48d939 1526 switch (bt_cb(skb)->pkt_type) {
1da177e4
LT		 1527 case HCI_ACLDATA_PKT:
1528 case HCI_SCODATA_PKT:
1529 kfree_skb(skb);
1530 continue;
3ff50b79 1531 }
1da177e4
LT		 1532 }
1533
1534 /* Process frame */
0d48d939 1535 switch (bt_cb(skb)->pkt_type) {
1da177e4
LT		 1536 case HCI_EVENT_PKT:
1537 hci_event_packet(hdev, skb);
1538 break;
1539
1540 case HCI_ACLDATA_PKT:
1541 BT_DBG("%s ACL data packet", hdev->name);
1542 hci_acldata_packet(hdev, skb);
1543 break;
1544
1545 case HCI_SCODATA_PKT:
1546 BT_DBG("%s SCO data packet", hdev->name);
1547 hci_scodata_packet(hdev, skb);
1548 break;
1549
1550 default:
1551 kfree_skb(skb);
1552 break;
1553 }
1554 }
1555
1556 read_unlock(&hci_task_lock);
1557}
1558
1559static void hci_cmd_task(unsigned long arg)
1560{
1561 struct hci_dev *hdev = (struct hci_dev *) arg;
1562 struct sk_buff *skb;
1563
1564 BT_DBG("%s cmd %d", hdev->name, atomic_read(&hdev->cmd_cnt));
1565
82453021 1566 if (!atomic_read(&hdev->cmd_cnt) && time_after(jiffies, hdev->cmd_last_tx + HZ)) {
1da177e4
LT		 1567 BT_ERR("%s command tx timeout", hdev->name);
1568 atomic_set(&hdev->cmd_cnt, 1);
1569 }
1570
1571 /* Send queued commands */
1572 if (atomic_read(&hdev->cmd_cnt) && (skb = skb_dequeue(&hdev->cmd_q))) {
1573 if (hdev->sent_cmd)
1574 kfree_skb(hdev->sent_cmd);
1575
1576 if ((hdev->sent_cmd = skb_clone(skb, GFP_ATOMIC))) {
1577 atomic_dec(&hdev->cmd_cnt);
1578 hci_send_frame(skb);
1579 hdev->cmd_last_tx = jiffies;
1580 } else {
1581 skb_queue_head(&hdev->cmd_q, skb);
1582 hci_sched_cmd(hdev);
1583 }
1584 }
1585}
Linux 6.x block layer and io_uring tree(s)