projects / linux-2.6-block.git / blame
? search:
summary | shortlog | log | commit | commitdiff | tree
blob | blame (incremental) | history | HEAD
Bluetooth: Turn hci_recv_frame into an exported function
[linux-2.6-block.git] / net / bluetooth / hci_core.c
CommitLineData
8e87d142 1/*
1da177e4
LT		 2 BlueZ - Bluetooth protocol stack for Linux
3 Copyright (C) 2000-2001 Qualcomm Incorporated
4
5 Written 2000,2001 by Maxim Krasnyansky <maxk@qualcomm.com>
6
7 This program is free software; you can redistribute it and/or modify
8 it under the terms of the GNU General Public License version 2 as
9 published by the Free Software Foundation;
10
11 THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
12 OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
13 FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
14 IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
8e87d142
YH		 15 CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
16 WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
17 ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
1da177e4
LT		 18 OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
19
8e87d142
YH		 20 ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
21 COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
1da177e4
LT		 22 SOFTWARE IS DISCLAIMED.
23*/
24
25/* Bluetooth HCI core. */
26
82453021 27#include <linux/jiffies.h>
1da177e4
LT		 28#include <linux/module.h>
29#include <linux/kmod.h>
30
31#include <linux/types.h>
32#include <linux/errno.h>
33#include <linux/kernel.h>
1da177e4
LT		 34#include <linux/sched.h>
35#include <linux/slab.h>
36#include <linux/poll.h>
37#include <linux/fcntl.h>
38#include <linux/init.h>
39#include <linux/skbuff.h>
40#include <linux/interrupt.h>
41#include <linux/notifier.h>
611b30f7 42#include <linux/rfkill.h>
1da177e4
LT		 43#include <net/sock.h>
44
45#include <asm/system.h>
46#include <asm/uaccess.h>
47#include <asm/unaligned.h>
48
49#include <net/bluetooth/bluetooth.h>
50#include <net/bluetooth/hci_core.h>
51
1da177e4
LT		 52static void hci_cmd_task(unsigned long arg);
53static void hci_rx_task(unsigned long arg);
54static void hci_tx_task(unsigned long arg);
55static void hci_notify(struct hci_dev *hdev, int event);
56
57static DEFINE_RWLOCK(hci_task_lock);
58
59/* HCI device list */
60LIST_HEAD(hci_dev_list);
61DEFINE_RWLOCK(hci_dev_list_lock);
62
63/* HCI callback list */
64LIST_HEAD(hci_cb_list);
65DEFINE_RWLOCK(hci_cb_list_lock);
66
67/* HCI protocols */
68#define HCI_MAX_PROTO 2
69struct hci_proto *hci_proto[HCI_MAX_PROTO];
70
71/* HCI notifiers list */
e041c683 72static ATOMIC_NOTIFIER_HEAD(hci_notifier);
1da177e4
LT		 73
74/* ---- HCI notifications ---- */
75
76int hci_register_notifier(struct notifier_block *nb)
77{
e041c683 78 return atomic_notifier_chain_register(&hci_notifier, nb);
1da177e4
LT		 79}
80
81int hci_unregister_notifier(struct notifier_block *nb)
82{
e041c683 83 return atomic_notifier_chain_unregister(&hci_notifier, nb);
1da177e4
LT		 84}
85
6516455d 86static void hci_notify(struct hci_dev *hdev, int event)
1da177e4 87{
e041c683 88 atomic_notifier_call_chain(&hci_notifier, event, hdev);
1da177e4
LT		 89}
90
91/* ---- HCI requests ---- */
92
93void hci_req_complete(struct hci_dev *hdev, int result)
94{
95 BT_DBG("%s result 0x%2.2x", hdev->name, result);
96
97 if (hdev->req_status == HCI_REQ_PEND) {
98 hdev->req_result = result;
99 hdev->req_status = HCI_REQ_DONE;
100 wake_up_interruptible(&hdev->req_wait_q);
101 }
102}
103
104static void hci_req_cancel(struct hci_dev *hdev, int err)
105{
106 BT_DBG("%s err 0x%2.2x", hdev->name, err);
107
108 if (hdev->req_status == HCI_REQ_PEND) {
109 hdev->req_result = err;
110 hdev->req_status = HCI_REQ_CANCELED;
111 wake_up_interruptible(&hdev->req_wait_q);
112 }
113}
114
115/* Execute request and wait for completion. */
8e87d142 116static int __hci_request(struct hci_dev *hdev, void (*req)(struct hci_dev *hdev, unsigned long opt),
1da177e4
LT		 117 unsigned long opt, __u32 timeout)
118{
119 DECLARE_WAITQUEUE(wait, current);
120 int err = 0;
121
122 BT_DBG("%s start", hdev->name);
123
124 hdev->req_status = HCI_REQ_PEND;
125
126 add_wait_queue(&hdev->req_wait_q, &wait);
127 set_current_state(TASK_INTERRUPTIBLE);
128
129 req(hdev, opt);
130 schedule_timeout(timeout);
131
132 remove_wait_queue(&hdev->req_wait_q, &wait);
133
134 if (signal_pending(current))
135 return -EINTR;
136
137 switch (hdev->req_status) {
138 case HCI_REQ_DONE:
139 err = -bt_err(hdev->req_result);
140 break;
141
142 case HCI_REQ_CANCELED:
143 err = -hdev->req_result;
144 break;
145
146 default:
147 err = -ETIMEDOUT;
148 break;
3ff50b79 149 }
1da177e4
LT		 150
151 hdev->req_status = hdev->req_result = 0;
152
153 BT_DBG("%s end: err %d", hdev->name, err);
154
155 return err;
156}
157
158static inline int hci_request(struct hci_dev *hdev, void (*req)(struct hci_dev *hdev, unsigned long opt),
159 unsigned long opt, __u32 timeout)
160{
161 int ret;
162
7c6a329e
MH		 163 if (!test_bit(HCI_UP, &hdev->flags))
164 return -ENETDOWN;
165
1da177e4
LT		 166 /* Serialize all requests */
167 hci_req_lock(hdev);
168 ret = __hci_request(hdev, req, opt, timeout);
169 hci_req_unlock(hdev);
170
171 return ret;
172}
173
174static void hci_reset_req(struct hci_dev *hdev, unsigned long opt)
175{
176 BT_DBG("%s %ld", hdev->name, opt);
177
178 /* Reset device */
a9de9248 179 hci_send_cmd(hdev, HCI_OP_RESET, 0, NULL);
1da177e4
LT		 180}
181
182static void hci_init_req(struct hci_dev *hdev, unsigned long opt)
183{
184 struct sk_buff *skb;
1ebb9252 185 __le16 param;
89f2783d 186 __u8 flt_type;
1da177e4
LT		 187
188 BT_DBG("%s %ld", hdev->name, opt);
189
190 /* Driver initialization */
191
192 /* Special commands */
193 while ((skb = skb_dequeue(&hdev->driver_init))) {
0d48d939 194 bt_cb(skb)->pkt_type = HCI_COMMAND_PKT;
1da177e4
LT		 195 skb->dev = (void *) hdev;
196 skb_queue_tail(&hdev->cmd_q, skb);
197 hci_sched_cmd(hdev);
198 }
199 skb_queue_purge(&hdev->driver_init);
200
201 /* Mandatory initialization */
202
203 /* Reset */
7a9d4020 204 if (!test_bit(HCI_QUIRK_NO_RESET, &hdev->quirks))
a9de9248 205 hci_send_cmd(hdev, HCI_OP_RESET, 0, NULL);
1da177e4
LT		 206
207 /* Read Local Supported Features */
a9de9248 208 hci_send_cmd(hdev, HCI_OP_READ_LOCAL_FEATURES, 0, NULL);
1da177e4 209
1143e5a6 210 /* Read Local Version */
a9de9248 211 hci_send_cmd(hdev, HCI_OP_READ_LOCAL_VERSION, 0, NULL);
1143e5a6 212
1da177e4 213 /* Read Buffer Size (ACL mtu, max pkt, etc.) */
a9de9248 214 hci_send_cmd(hdev, HCI_OP_READ_BUFFER_SIZE, 0, NULL);
1da177e4
LT		 215
216#if 0
217 /* Host buffer size */
218 {
219 struct hci_cp_host_buffer_size cp;
aca3192c 220 cp.acl_mtu = cpu_to_le16(HCI_MAX_ACL_SIZE);
1da177e4 221 cp.sco_mtu = HCI_MAX_SCO_SIZE;
aca3192c
YH		 222 cp.acl_max_pkt = cpu_to_le16(0xffff);
223 cp.sco_max_pkt = cpu_to_le16(0xffff);
a9de9248 224 hci_send_cmd(hdev, HCI_OP_HOST_BUFFER_SIZE, sizeof(cp), &cp);
1da177e4
LT		 225 }
226#endif
227
228 /* Read BD Address */
a9de9248
MH		 229 hci_send_cmd(hdev, HCI_OP_READ_BD_ADDR, 0, NULL);
230
231 /* Read Class of Device */
232 hci_send_cmd(hdev, HCI_OP_READ_CLASS_OF_DEV, 0, NULL);
233
234 /* Read Local Name */
235 hci_send_cmd(hdev, HCI_OP_READ_LOCAL_NAME, 0, NULL);
1da177e4
LT		 236
237 /* Read Voice Setting */
a9de9248 238 hci_send_cmd(hdev, HCI_OP_READ_VOICE_SETTING, 0, NULL);
1da177e4
LT		 239
240 /* Optional initialization */
241
242 /* Clear Event Filters */
89f2783d 243 flt_type = HCI_FLT_CLEAR_ALL;
a9de9248 244 hci_send_cmd(hdev, HCI_OP_SET_EVENT_FLT, 1, &flt_type);
1da177e4
LT		 245
246 /* Page timeout ~20 secs */
aca3192c 247 param = cpu_to_le16(0x8000);
a9de9248 248 hci_send_cmd(hdev, HCI_OP_WRITE_PG_TIMEOUT, 2, &param);
1da177e4
LT		 249
250 /* Connection accept timeout ~20 secs */
aca3192c 251 param = cpu_to_le16(0x7d00);
a9de9248 252 hci_send_cmd(hdev, HCI_OP_WRITE_CA_TIMEOUT, 2, &param);
1da177e4
LT		 253}
254
255static void hci_scan_req(struct hci_dev *hdev, unsigned long opt)
256{
257 __u8 scan = opt;
258
259 BT_DBG("%s %x", hdev->name, scan);
260
261 /* Inquiry and Page scans */
a9de9248 262 hci_send_cmd(hdev, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan);
1da177e4
LT		 263}
264
265static void hci_auth_req(struct hci_dev *hdev, unsigned long opt)
266{
267 __u8 auth = opt;
268
269 BT_DBG("%s %x", hdev->name, auth);
270
271 /* Authentication */
a9de9248 272 hci_send_cmd(hdev, HCI_OP_WRITE_AUTH_ENABLE, 1, &auth);
1da177e4
LT		 273}
274
275static void hci_encrypt_req(struct hci_dev *hdev, unsigned long opt)
276{
277 __u8 encrypt = opt;
278
279 BT_DBG("%s %x", hdev->name, encrypt);
280
e4e8e37c 281 /* Encryption */
a9de9248 282 hci_send_cmd(hdev, HCI_OP_WRITE_ENCRYPT_MODE, 1, &encrypt);
1da177e4
LT		 283}
284
e4e8e37c
MH		 285static void hci_linkpol_req(struct hci_dev *hdev, unsigned long opt)
286{
287 __le16 policy = cpu_to_le16(opt);
288
a418b893 289 BT_DBG("%s %x", hdev->name, policy);
e4e8e37c
MH		 290
291 /* Default link policy */
292 hci_send_cmd(hdev, HCI_OP_WRITE_DEF_LINK_POLICY, 2, &policy);
293}
294
8e87d142 295/* Get HCI device by index.
1da177e4
LT		 296 * Device is held on return. */
297struct hci_dev *hci_dev_get(int index)
298{
299 struct hci_dev *hdev = NULL;
300 struct list_head *p;
301
302 BT_DBG("%d", index);
303
304 if (index < 0)
305 return NULL;
306
307 read_lock(&hci_dev_list_lock);
308 list_for_each(p, &hci_dev_list) {
309 struct hci_dev *d = list_entry(p, struct hci_dev, list);
310 if (d->id == index) {
311 hdev = hci_dev_hold(d);
312 break;
313 }
314 }
315 read_unlock(&hci_dev_list_lock);
316 return hdev;
317}
1da177e4
LT		 318
319/* ---- Inquiry support ---- */
320static void inquiry_cache_flush(struct hci_dev *hdev)
321{
322 struct inquiry_cache *cache = &hdev->inq_cache;
323 struct inquiry_entry *next = cache->list, *e;
324
325 BT_DBG("cache %p", cache);
326
327 cache->list = NULL;
328 while ((e = next)) {
329 next = e->next;
330 kfree(e);
331 }
332}
333
334struct inquiry_entry *hci_inquiry_cache_lookup(struct hci_dev *hdev, bdaddr_t *bdaddr)
335{
336 struct inquiry_cache *cache = &hdev->inq_cache;
337 struct inquiry_entry *e;
338
339 BT_DBG("cache %p, %s", cache, batostr(bdaddr));
340
341 for (e = cache->list; e; e = e->next)
342 if (!bacmp(&e->data.bdaddr, bdaddr))
343 break;
344 return e;
345}
346
347void hci_inquiry_cache_update(struct hci_dev *hdev, struct inquiry_data *data)
348{
349 struct inquiry_cache *cache = &hdev->inq_cache;
350 struct inquiry_entry *e;
351
352 BT_DBG("cache %p, %s", cache, batostr(&data->bdaddr));
353
354 if (!(e = hci_inquiry_cache_lookup(hdev, &data->bdaddr))) {
355 /* Entry not in the cache. Add new one. */
25ea6db0 356 if (!(e = kzalloc(sizeof(struct inquiry_entry), GFP_ATOMIC)))
1da177e4 357 return;
1da177e4
LT		 358 e->next = cache->list;
359 cache->list = e;
360 }
361
362 memcpy(&e->data, data, sizeof(*data));
363 e->timestamp = jiffies;
364 cache->timestamp = jiffies;
365}
366
367static int inquiry_cache_dump(struct hci_dev *hdev, int num, __u8 *buf)
368{
369 struct inquiry_cache *cache = &hdev->inq_cache;
370 struct inquiry_info *info = (struct inquiry_info *) buf;
371 struct inquiry_entry *e;
372 int copied = 0;
373
374 for (e = cache->list; e && copied < num; e = e->next, copied++) {
375 struct inquiry_data *data = &e->data;
376 bacpy(&info->bdaddr, &data->bdaddr);
377 info->pscan_rep_mode = data->pscan_rep_mode;
378 info->pscan_period_mode = data->pscan_period_mode;
379 info->pscan_mode = data->pscan_mode;
380 memcpy(info->dev_class, data->dev_class, 3);
381 info->clock_offset = data->clock_offset;
382 info++;
383 }
384
385 BT_DBG("cache %p, copied %d", cache, copied);
386 return copied;
387}
388
389static void hci_inq_req(struct hci_dev *hdev, unsigned long opt)
390{
391 struct hci_inquiry_req *ir = (struct hci_inquiry_req *) opt;
392 struct hci_cp_inquiry cp;
393
394 BT_DBG("%s", hdev->name);
395
396 if (test_bit(HCI_INQUIRY, &hdev->flags))
397 return;
398
399 /* Start Inquiry */
400 memcpy(&cp.lap, &ir->lap, 3);
401 cp.length = ir->length;
402 cp.num_rsp = ir->num_rsp;
a9de9248 403 hci_send_cmd(hdev, HCI_OP_INQUIRY, sizeof(cp), &cp);
1da177e4
LT		 404}
405
406int hci_inquiry(void __user *arg)
407{
408 __u8 __user *ptr = arg;
409 struct hci_inquiry_req ir;
410 struct hci_dev *hdev;
411 int err = 0, do_inquiry = 0, max_rsp;
412 long timeo;
413 __u8 *buf;
414
415 if (copy_from_user(&ir, ptr, sizeof(ir)))
416 return -EFAULT;
417
418 if (!(hdev = hci_dev_get(ir.dev_id)))
419 return -ENODEV;
420
421 hci_dev_lock_bh(hdev);
8e87d142 422 if (inquiry_cache_age(hdev) > INQUIRY_CACHE_AGE_MAX ||
1da177e4
LT		 423 inquiry_cache_empty(hdev) ||
424 ir.flags & IREQ_CACHE_FLUSH) {
425 inquiry_cache_flush(hdev);
426 do_inquiry = 1;
427 }
428 hci_dev_unlock_bh(hdev);
429
04837f64 430 timeo = ir.length * msecs_to_jiffies(2000);
1da177e4
LT		 431 if (do_inquiry && (err = hci_request(hdev, hci_inq_req, (unsigned long)&ir, timeo)) < 0)
432 goto done;
433
434 /* for unlimited number of responses we will use buffer with 255 entries */
435 max_rsp = (ir.num_rsp == 0) ? 255 : ir.num_rsp;
436
437 /* cache_dump can't sleep. Therefore we allocate temp buffer and then
438 * copy it to the user space.
439 */
440 if (!(buf = kmalloc(sizeof(struct inquiry_info) * max_rsp, GFP_KERNEL))) {
441 err = -ENOMEM;
442 goto done;
443 }
444
445 hci_dev_lock_bh(hdev);
446 ir.num_rsp = inquiry_cache_dump(hdev, max_rsp, buf);
447 hci_dev_unlock_bh(hdev);
448
449 BT_DBG("num_rsp %d", ir.num_rsp);
450
451 if (!copy_to_user(ptr, &ir, sizeof(ir))) {
452 ptr += sizeof(ir);
453 if (copy_to_user(ptr, buf, sizeof(struct inquiry_info) *
454 ir.num_rsp))
455 err = -EFAULT;
8e87d142 456 } else
1da177e4
LT		 457 err = -EFAULT;
458
459 kfree(buf);
460
461done:
462 hci_dev_put(hdev);
463 return err;
464}
465
466/* ---- HCI ioctl helpers ---- */
467
468int hci_dev_open(__u16 dev)
469{
470 struct hci_dev *hdev;
471 int ret = 0;
472
473 if (!(hdev = hci_dev_get(dev)))
474 return -ENODEV;
475
476 BT_DBG("%s %p", hdev->name, hdev);
477
478 hci_req_lock(hdev);
479
611b30f7
MH		 480 if (hdev->rfkill && rfkill_blocked(hdev->rfkill)) {
481 ret = -ERFKILL;
482 goto done;
483 }
484
1da177e4
LT		 485 if (test_bit(HCI_UP, &hdev->flags)) {
486 ret = -EALREADY;
487 goto done;
488 }
489
490 if (test_bit(HCI_QUIRK_RAW_DEVICE, &hdev->quirks))
491 set_bit(HCI_RAW, &hdev->flags);
492
493 if (hdev->open(hdev)) {
494 ret = -EIO;
495 goto done;
496 }
497
498 if (!test_bit(HCI_RAW, &hdev->flags)) {
499 atomic_set(&hdev->cmd_cnt, 1);
500 set_bit(HCI_INIT, &hdev->flags);
501
502 //__hci_request(hdev, hci_reset_req, 0, HZ);
04837f64
MH		 503 ret = __hci_request(hdev, hci_init_req, 0,
504 msecs_to_jiffies(HCI_INIT_TIMEOUT));
1da177e4
LT		 505
506 clear_bit(HCI_INIT, &hdev->flags);
507 }
508
509 if (!ret) {
510 hci_dev_hold(hdev);
511 set_bit(HCI_UP, &hdev->flags);
512 hci_notify(hdev, HCI_DEV_UP);
8e87d142 513 } else {
1da177e4
LT		 514 /* Init failed, cleanup */
515 tasklet_kill(&hdev->rx_task);
516 tasklet_kill(&hdev->tx_task);
517 tasklet_kill(&hdev->cmd_task);
518
519 skb_queue_purge(&hdev->cmd_q);
520 skb_queue_purge(&hdev->rx_q);
521
522 if (hdev->flush)
523 hdev->flush(hdev);
524
525 if (hdev->sent_cmd) {
526 kfree_skb(hdev->sent_cmd);
527 hdev->sent_cmd = NULL;
528 }
529
530 hdev->close(hdev);
531 hdev->flags = 0;
532 }
533
534done:
535 hci_req_unlock(hdev);
536 hci_dev_put(hdev);
537 return ret;
538}
539
540static int hci_dev_do_close(struct hci_dev *hdev)
541{
542 BT_DBG("%s %p", hdev->name, hdev);
543
544 hci_req_cancel(hdev, ENODEV);
545 hci_req_lock(hdev);
546
547 if (!test_and_clear_bit(HCI_UP, &hdev->flags)) {
548 hci_req_unlock(hdev);
549 return 0;
550 }
551
552 /* Kill RX and TX tasks */
553 tasklet_kill(&hdev->rx_task);
554 tasklet_kill(&hdev->tx_task);
555
556 hci_dev_lock_bh(hdev);
557 inquiry_cache_flush(hdev);
558 hci_conn_hash_flush(hdev);
559 hci_dev_unlock_bh(hdev);
560
561 hci_notify(hdev, HCI_DEV_DOWN);
562
563 if (hdev->flush)
564 hdev->flush(hdev);
565
566 /* Reset device */
567 skb_queue_purge(&hdev->cmd_q);
568 atomic_set(&hdev->cmd_cnt, 1);
569 if (!test_bit(HCI_RAW, &hdev->flags)) {
570 set_bit(HCI_INIT, &hdev->flags);
04837f64
MH		 571 __hci_request(hdev, hci_reset_req, 0,
572 msecs_to_jiffies(250));
1da177e4
LT		 573 clear_bit(HCI_INIT, &hdev->flags);
574 }
575
576 /* Kill cmd task */
577 tasklet_kill(&hdev->cmd_task);
578
579 /* Drop queues */
580 skb_queue_purge(&hdev->rx_q);
581 skb_queue_purge(&hdev->cmd_q);
582 skb_queue_purge(&hdev->raw_q);
583
584 /* Drop last sent command */
585 if (hdev->sent_cmd) {
586 kfree_skb(hdev->sent_cmd);
587 hdev->sent_cmd = NULL;
588 }
589
590 /* After this point our queues are empty
591 * and no tasks are scheduled. */
592 hdev->close(hdev);
593
594 /* Clear flags */
595 hdev->flags = 0;
596
597 hci_req_unlock(hdev);
598
599 hci_dev_put(hdev);
600 return 0;
601}
602
603int hci_dev_close(__u16 dev)
604{
605 struct hci_dev *hdev;
606 int err;
607
608 if (!(hdev = hci_dev_get(dev)))
609 return -ENODEV;
610 err = hci_dev_do_close(hdev);
611 hci_dev_put(hdev);
612 return err;
613}
614
615int hci_dev_reset(__u16 dev)
616{
617 struct hci_dev *hdev;
618 int ret = 0;
619
620 if (!(hdev = hci_dev_get(dev)))
621 return -ENODEV;
622
623 hci_req_lock(hdev);
624 tasklet_disable(&hdev->tx_task);
625
626 if (!test_bit(HCI_UP, &hdev->flags))
627 goto done;
628
629 /* Drop queues */
630 skb_queue_purge(&hdev->rx_q);
631 skb_queue_purge(&hdev->cmd_q);
632
633 hci_dev_lock_bh(hdev);
634 inquiry_cache_flush(hdev);
635 hci_conn_hash_flush(hdev);
636 hci_dev_unlock_bh(hdev);
637
638 if (hdev->flush)
639 hdev->flush(hdev);
640
8e87d142 641 atomic_set(&hdev->cmd_cnt, 1);
1da177e4
LT		 642 hdev->acl_cnt = 0; hdev->sco_cnt = 0;
643
644 if (!test_bit(HCI_RAW, &hdev->flags))
04837f64
MH		 645 ret = __hci_request(hdev, hci_reset_req, 0,
646 msecs_to_jiffies(HCI_INIT_TIMEOUT));
1da177e4
LT		 647
648done:
649 tasklet_enable(&hdev->tx_task);
650 hci_req_unlock(hdev);
651 hci_dev_put(hdev);
652 return ret;
653}
654
655int hci_dev_reset_stat(__u16 dev)
656{
657 struct hci_dev *hdev;
658 int ret = 0;
659
660 if (!(hdev = hci_dev_get(dev)))
661 return -ENODEV;
662
663 memset(&hdev->stat, 0, sizeof(struct hci_dev_stats));
664
665 hci_dev_put(hdev);
666
667 return ret;
668}
669
670int hci_dev_cmd(unsigned int cmd, void __user *arg)
671{
672 struct hci_dev *hdev;
673 struct hci_dev_req dr;
674 int err = 0;
675
676 if (copy_from_user(&dr, arg, sizeof(dr)))
677 return -EFAULT;
678
679 if (!(hdev = hci_dev_get(dr.dev_id)))
680 return -ENODEV;
681
682 switch (cmd) {
683 case HCISETAUTH:
04837f64
MH		 684 err = hci_request(hdev, hci_auth_req, dr.dev_opt,
685 msecs_to_jiffies(HCI_INIT_TIMEOUT));
1da177e4
LT		 686 break;
687
688 case HCISETENCRYPT:
689 if (!lmp_encrypt_capable(hdev)) {
690 err = -EOPNOTSUPP;
691 break;
692 }
693
694 if (!test_bit(HCI_AUTH, &hdev->flags)) {
695 /* Auth must be enabled first */
04837f64
MH		 696 err = hci_request(hdev, hci_auth_req, dr.dev_opt,
697 msecs_to_jiffies(HCI_INIT_TIMEOUT));
1da177e4
LT		 698 if (err)
699 break;
700 }
701
04837f64
MH		 702 err = hci_request(hdev, hci_encrypt_req, dr.dev_opt,
703 msecs_to_jiffies(HCI_INIT_TIMEOUT));
1da177e4
LT		 704 break;
705
706 case HCISETSCAN:
04837f64
MH		 707 err = hci_request(hdev, hci_scan_req, dr.dev_opt,
708 msecs_to_jiffies(HCI_INIT_TIMEOUT));
1da177e4
LT		 709 break;
710
1da177e4 711 case HCISETLINKPOL:
e4e8e37c
MH		 712 err = hci_request(hdev, hci_linkpol_req, dr.dev_opt,
713 msecs_to_jiffies(HCI_INIT_TIMEOUT));
1da177e4
LT		 714 break;
715
716 case HCISETLINKMODE:
e4e8e37c
MH		 717 hdev->link_mode = ((__u16) dr.dev_opt) &
718 (HCI_LM_MASTER | HCI_LM_ACCEPT);
719 break;
720
721 case HCISETPTYPE:
722 hdev->pkt_type = (__u16) dr.dev_opt;
1da177e4
LT		 723 break;
724
725 case HCISETACLMTU:
e4e8e37c
MH		 726 hdev->acl_mtu = *((__u16 *) &dr.dev_opt + 1);
727 hdev->acl_pkts = *((__u16 *) &dr.dev_opt + 0);
1da177e4
LT		 728 break;
729
730 case HCISETSCOMTU:
e4e8e37c
MH		 731 hdev->sco_mtu = *((__u16 *) &dr.dev_opt + 1);
732 hdev->sco_pkts = *((__u16 *) &dr.dev_opt + 0);
1da177e4
LT		 733 break;
734
735 default:
736 err = -EINVAL;
737 break;
738 }
e4e8e37c 739
1da177e4
LT		 740 hci_dev_put(hdev);
741 return err;
742}
743
744int hci_get_dev_list(void __user *arg)
745{
746 struct hci_dev_list_req *dl;
747 struct hci_dev_req *dr;
748 struct list_head *p;
749 int n = 0, size, err;
750 __u16 dev_num;
751
752 if (get_user(dev_num, (__u16 __user *) arg))
753 return -EFAULT;
754
755 if (!dev_num || dev_num > (PAGE_SIZE * 2) / sizeof(*dr))
756 return -EINVAL;
757
758 size = sizeof(*dl) + dev_num * sizeof(*dr);
759
c6bf514c 760 if (!(dl = kzalloc(size, GFP_KERNEL)))
1da177e4
LT		 761 return -ENOMEM;
762
763 dr = dl->dev_req;
764
765 read_lock_bh(&hci_dev_list_lock);
766 list_for_each(p, &hci_dev_list) {
767 struct hci_dev *hdev;
768 hdev = list_entry(p, struct hci_dev, list);
769 (dr + n)->dev_id = hdev->id;
770 (dr + n)->dev_opt = hdev->flags;
771 if (++n >= dev_num)
772 break;
773 }
774 read_unlock_bh(&hci_dev_list_lock);
775
776 dl->dev_num = n;
777 size = sizeof(*dl) + n * sizeof(*dr);
778
779 err = copy_to_user(arg, dl, size);
780 kfree(dl);
781
782 return err ? -EFAULT : 0;
783}
784
785int hci_get_dev_info(void __user *arg)
786{
787 struct hci_dev *hdev;
788 struct hci_dev_info di;
789 int err = 0;
790
791 if (copy_from_user(&di, arg, sizeof(di)))
792 return -EFAULT;
793
794 if (!(hdev = hci_dev_get(di.dev_id)))
795 return -ENODEV;
796
797 strcpy(di.name, hdev->name);
798 di.bdaddr = hdev->bdaddr;
799 di.type = hdev->type;
800 di.flags = hdev->flags;
801 di.pkt_type = hdev->pkt_type;
802 di.acl_mtu = hdev->acl_mtu;
803 di.acl_pkts = hdev->acl_pkts;
804 di.sco_mtu = hdev->sco_mtu;
805 di.sco_pkts = hdev->sco_pkts;
806 di.link_policy = hdev->link_policy;
807 di.link_mode = hdev->link_mode;
808
809 memcpy(&di.stat, &hdev->stat, sizeof(di.stat));
810 memcpy(&di.features, &hdev->features, sizeof(di.features));
811
812 if (copy_to_user(arg, &di, sizeof(di)))
813 err = -EFAULT;
814
815 hci_dev_put(hdev);
816
817 return err;
818}
819
820/* ---- Interface to HCI drivers ---- */
821
611b30f7
MH		 822static int hci_rfkill_set_block(void *data, bool blocked)
823{
824 struct hci_dev *hdev = data;
825
826 BT_DBG("%p name %s blocked %d", hdev, hdev->name, blocked);
827
828 if (!blocked)
829 return 0;
830
831 hci_dev_do_close(hdev);
832
833 return 0;
834}
835
836static const struct rfkill_ops hci_rfkill_ops = {
837 .set_block = hci_rfkill_set_block,
838};
839
1da177e4
LT		 840/* Alloc HCI device */
841struct hci_dev *hci_alloc_dev(void)
842{
843 struct hci_dev *hdev;
844
25ea6db0 845 hdev = kzalloc(sizeof(struct hci_dev), GFP_KERNEL);
1da177e4
LT		 846 if (!hdev)
847 return NULL;
848
1da177e4
LT		 849 skb_queue_head_init(&hdev->driver_init);
850
851 return hdev;
852}
853EXPORT_SYMBOL(hci_alloc_dev);
854
855/* Free HCI device */
856void hci_free_dev(struct hci_dev *hdev)
857{
858 skb_queue_purge(&hdev->driver_init);
859
a91f2e39
MH		 860 /* will free via device release */
861 put_device(&hdev->dev);
1da177e4
LT		 862}
863EXPORT_SYMBOL(hci_free_dev);
864
865/* Register HCI device */
866int hci_register_dev(struct hci_dev *hdev)
867{
868 struct list_head *head = &hci_dev_list, *p;
ef222013 869 int i, id = 0;
1da177e4 870
611b30f7
MH		 871 BT_DBG("%p name %s type %d owner %p", hdev, hdev->name,
872 hdev->type, hdev->owner);
1da177e4
LT		 873
874 if (!hdev->open || !hdev->close || !hdev->destruct)
875 return -EINVAL;
876
877 write_lock_bh(&hci_dev_list_lock);
878
879 /* Find first available device id */
880 list_for_each(p, &hci_dev_list) {
881 if (list_entry(p, struct hci_dev, list)->id != id)
882 break;
883 head = p; id++;
884 }
8e87d142 885
1da177e4
LT		 886 sprintf(hdev->name, "hci%d", id);
887 hdev->id = id;
888 list_add(&hdev->list, head);
889
890 atomic_set(&hdev->refcnt, 1);
891 spin_lock_init(&hdev->lock);
892
893 hdev->flags = 0;
894 hdev->pkt_type = (HCI_DM1 | HCI_DH1 | HCI_HV1);
5b7f9909 895 hdev->esco_type = (ESCO_HV1);
1da177e4
LT		 896 hdev->link_mode = (HCI_LM_ACCEPT);
897
04837f64
MH		 898 hdev->idle_timeout = 0;
899 hdev->sniff_max_interval = 800;
900 hdev->sniff_min_interval = 80;
901
1da177e4
LT		 902 tasklet_init(&hdev->cmd_task, hci_cmd_task,(unsigned long) hdev);
903 tasklet_init(&hdev->rx_task, hci_rx_task, (unsigned long) hdev);
904 tasklet_init(&hdev->tx_task, hci_tx_task, (unsigned long) hdev);
905
906 skb_queue_head_init(&hdev->rx_q);
907 skb_queue_head_init(&hdev->cmd_q);
908 skb_queue_head_init(&hdev->raw_q);
909
ef222013
MH		 910 for (i = 0; i < 3; i++)
911 hdev->reassembly[i] = NULL;
912
1da177e4 913 init_waitqueue_head(&hdev->req_wait_q);
a6a67efd 914 mutex_init(&hdev->req_lock);
1da177e4
LT		 915
916 inquiry_cache_init(hdev);
917
918 hci_conn_hash_init(hdev);
919
920 memset(&hdev->stat, 0, sizeof(struct hci_dev_stats));
921
922 atomic_set(&hdev->promisc, 0);
923
924 write_unlock_bh(&hci_dev_list_lock);
925
926 hci_register_sysfs(hdev);
927
611b30f7
MH		 928 hdev->rfkill = rfkill_alloc(hdev->name, &hdev->dev,
929 RFKILL_TYPE_BLUETOOTH, &hci_rfkill_ops, hdev);
930 if (hdev->rfkill) {
931 if (rfkill_register(hdev->rfkill) < 0) {
932 rfkill_destroy(hdev->rfkill);
933 hdev->rfkill = NULL;
934 }
935 }
936
1da177e4
LT		 937 hci_notify(hdev, HCI_DEV_REG);
938
939 return id;
940}
941EXPORT_SYMBOL(hci_register_dev);
942
943/* Unregister HCI device */
944int hci_unregister_dev(struct hci_dev *hdev)
945{
ef222013
MH		 946 int i;
947
1da177e4
LT		 948 BT_DBG("%p name %s type %d", hdev, hdev->name, hdev->type);
949
1da177e4
LT		 950 write_lock_bh(&hci_dev_list_lock);
951 list_del(&hdev->list);
952 write_unlock_bh(&hci_dev_list_lock);
953
954 hci_dev_do_close(hdev);
955
ef222013
MH		 956 for (i = 0; i < 3; i++)
957 kfree_skb(hdev->reassembly[i]);
958
1da177e4
LT		 959 hci_notify(hdev, HCI_DEV_UNREG);
960
611b30f7
MH		 961 if (hdev->rfkill) {
962 rfkill_unregister(hdev->rfkill);
963 rfkill_destroy(hdev->rfkill);
964 }
965
147e2d59
DY		 966 hci_unregister_sysfs(hdev);
967
1da177e4 968 __hci_dev_put(hdev);
ef222013 969
1da177e4
LT		 970 return 0;
971}
972EXPORT_SYMBOL(hci_unregister_dev);
973
974/* Suspend HCI device */
975int hci_suspend_dev(struct hci_dev *hdev)
976{
977 hci_notify(hdev, HCI_DEV_SUSPEND);
978 return 0;
979}
980EXPORT_SYMBOL(hci_suspend_dev);
981
982/* Resume HCI device */
983int hci_resume_dev(struct hci_dev *hdev)
984{
985 hci_notify(hdev, HCI_DEV_RESUME);
986 return 0;
987}
988EXPORT_SYMBOL(hci_resume_dev);
989
76bca880
MH		 990/* Receive frame from HCI drivers */
991int hci_recv_frame(struct sk_buff *skb)
992{
993 struct hci_dev *hdev = (struct hci_dev *) skb->dev;
994 if (!hdev || (!test_bit(HCI_UP, &hdev->flags)
995 && !test_bit(HCI_INIT, &hdev->flags))) {
996 kfree_skb(skb);
997 return -ENXIO;
998 }
999
1000 /* Incomming skb */
1001 bt_cb(skb)->incoming = 1;
1002
1003 /* Time stamp */
1004 __net_timestamp(skb);
1005
1006 /* Queue frame for rx task */
1007 skb_queue_tail(&hdev->rx_q, skb);
1008 hci_sched_rx(hdev);
1009 return 0;
1010}
1011EXPORT_SYMBOL(hci_recv_frame);
1012
ef222013
MH		 1013/* Receive packet type fragment */
1014#define __reassembly(hdev, type) ((hdev)->reassembly[(type) - 2])
1015
1016int hci_recv_fragment(struct hci_dev *hdev, int type, void *data, int count)
1017{
1018 if (type < HCI_ACLDATA_PKT || type > HCI_EVENT_PKT)
1019 return -EILSEQ;
1020
1021 while (count) {
1022 struct sk_buff *skb = __reassembly(hdev, type);
1023 struct { int expect; } *scb;
1024 int len = 0;
1025
1026 if (!skb) {
1027 /* Start of the frame */
1028
1029 switch (type) {
1030 case HCI_EVENT_PKT:
1031 if (count >= HCI_EVENT_HDR_SIZE) {
1032 struct hci_event_hdr *h = data;
1033 len = HCI_EVENT_HDR_SIZE + h->plen;
1034 } else
1035 return -EILSEQ;
1036 break;
1037
1038 case HCI_ACLDATA_PKT:
1039 if (count >= HCI_ACL_HDR_SIZE) {
1040 struct hci_acl_hdr *h = data;
1041 len = HCI_ACL_HDR_SIZE + __le16_to_cpu(h->dlen);
1042 } else
1043 return -EILSEQ;
1044 break;
1045
1046 case HCI_SCODATA_PKT:
1047 if (count >= HCI_SCO_HDR_SIZE) {
1048 struct hci_sco_hdr *h = data;
1049 len = HCI_SCO_HDR_SIZE + h->dlen;
1050 } else
1051 return -EILSEQ;
1052 break;
1053 }
1054
1055 skb = bt_skb_alloc(len, GFP_ATOMIC);
1056 if (!skb) {
1057 BT_ERR("%s no memory for packet", hdev->name);
1058 return -ENOMEM;
1059 }
1060
1061 skb->dev = (void *) hdev;
1062 bt_cb(skb)->pkt_type = type;
00ae02f3 1063
ef222013
MH		 1064 __reassembly(hdev, type) = skb;
1065
1066 scb = (void *) skb->cb;
1067 scb->expect = len;
1068 } else {
1069 /* Continuation */
1070
1071 scb = (void *) skb->cb;
1072 len = scb->expect;
1073 }
1074
1075 len = min(len, count);
1076
1077 memcpy(skb_put(skb, len), data, len);
1078
1079 scb->expect -= len;
1080
1081 if (scb->expect == 0) {
1082 /* Complete frame */
1083
1084 __reassembly(hdev, type) = NULL;
1085
1086 bt_cb(skb)->pkt_type = type;
1087 hci_recv_frame(skb);
1088 }
1089
1090 count -= len; data += len;
1091 }
1092
1093 return 0;
1094}
1095EXPORT_SYMBOL(hci_recv_fragment);
1096
1da177e4
LT		 1097/* ---- Interface to upper protocols ---- */
1098
1099/* Register/Unregister protocols.
1100 * hci_task_lock is used to ensure that no tasks are running. */
1101int hci_register_proto(struct hci_proto *hp)
1102{
1103 int err = 0;
1104
1105 BT_DBG("%p name %s id %d", hp, hp->name, hp->id);
1106
1107 if (hp->id >= HCI_MAX_PROTO)
1108 return -EINVAL;
1109
1110 write_lock_bh(&hci_task_lock);
1111
1112 if (!hci_proto[hp->id])
1113 hci_proto[hp->id] = hp;
1114 else
1115 err = -EEXIST;
1116
1117 write_unlock_bh(&hci_task_lock);
1118
1119 return err;
1120}
1121EXPORT_SYMBOL(hci_register_proto);
1122
1123int hci_unregister_proto(struct hci_proto *hp)
1124{
1125 int err = 0;
1126
1127 BT_DBG("%p name %s id %d", hp, hp->name, hp->id);
1128
1129 if (hp->id >= HCI_MAX_PROTO)
1130 return -EINVAL;
1131
1132 write_lock_bh(&hci_task_lock);
1133
1134 if (hci_proto[hp->id])
1135 hci_proto[hp->id] = NULL;
1136 else
1137 err = -ENOENT;
1138
1139 write_unlock_bh(&hci_task_lock);
1140
1141 return err;
1142}
1143EXPORT_SYMBOL(hci_unregister_proto);
1144
1145int hci_register_cb(struct hci_cb *cb)
1146{
1147 BT_DBG("%p name %s", cb, cb->name);
1148
1149 write_lock_bh(&hci_cb_list_lock);
1150 list_add(&cb->list, &hci_cb_list);
1151 write_unlock_bh(&hci_cb_list_lock);
1152
1153 return 0;
1154}
1155EXPORT_SYMBOL(hci_register_cb);
1156
1157int hci_unregister_cb(struct hci_cb *cb)
1158{
1159 BT_DBG("%p name %s", cb, cb->name);
1160
1161 write_lock_bh(&hci_cb_list_lock);
1162 list_del(&cb->list);
1163 write_unlock_bh(&hci_cb_list_lock);
1164
1165 return 0;
1166}
1167EXPORT_SYMBOL(hci_unregister_cb);
1168
1169static int hci_send_frame(struct sk_buff *skb)
1170{
1171 struct hci_dev *hdev = (struct hci_dev *) skb->dev;
1172
1173 if (!hdev) {
1174 kfree_skb(skb);
1175 return -ENODEV;
1176 }
1177
0d48d939 1178 BT_DBG("%s type %d len %d", hdev->name, bt_cb(skb)->pkt_type, skb->len);
1da177e4
LT		 1179
1180 if (atomic_read(&hdev->promisc)) {
1181 /* Time stamp */
a61bbcf2 1182 __net_timestamp(skb);
1da177e4
LT		 1183
1184 hci_send_to_sock(hdev, skb);
1185 }
1186
1187 /* Get rid of skb owner, prior to sending to the driver. */
1188 skb_orphan(skb);
1189
1190 return hdev->send(skb);
1191}
1192
1193/* Send HCI command */
a9de9248 1194int hci_send_cmd(struct hci_dev *hdev, __u16 opcode, __u32 plen, void *param)
1da177e4
LT		 1195{
1196 int len = HCI_COMMAND_HDR_SIZE + plen;
1197 struct hci_command_hdr *hdr;
1198 struct sk_buff *skb;
1199
a9de9248 1200 BT_DBG("%s opcode 0x%x plen %d", hdev->name, opcode, plen);
1da177e4
LT		 1201
1202 skb = bt_skb_alloc(len, GFP_ATOMIC);
1203 if (!skb) {
ef222013 1204 BT_ERR("%s no memory for command", hdev->name);
1da177e4
LT		 1205 return -ENOMEM;
1206 }
1207
1208 hdr = (struct hci_command_hdr *) skb_put(skb, HCI_COMMAND_HDR_SIZE);
a9de9248 1209 hdr->opcode = cpu_to_le16(opcode);
1da177e4
LT		 1210 hdr->plen = plen;
1211
1212 if (plen)
1213 memcpy(skb_put(skb, plen), param, plen);
1214
1215 BT_DBG("skb len %d", skb->len);
1216
0d48d939 1217 bt_cb(skb)->pkt_type = HCI_COMMAND_PKT;
1da177e4
LT		 1218 skb->dev = (void *) hdev;
1219 skb_queue_tail(&hdev->cmd_q, skb);
1220 hci_sched_cmd(hdev);
1221
1222 return 0;
1223}
1da177e4
LT		 1224
1225/* Get data from the previously sent command */
a9de9248 1226void *hci_sent_cmd_data(struct hci_dev *hdev, __u16 opcode)
1da177e4
LT		 1227{
1228 struct hci_command_hdr *hdr;
1229
1230 if (!hdev->sent_cmd)
1231 return NULL;
1232
1233 hdr = (void *) hdev->sent_cmd->data;
1234
a9de9248 1235 if (hdr->opcode != cpu_to_le16(opcode))
1da177e4
LT		 1236 return NULL;
1237
a9de9248 1238 BT_DBG("%s opcode 0x%x", hdev->name, opcode);
1da177e4
LT		 1239
1240 return hdev->sent_cmd->data + HCI_COMMAND_HDR_SIZE;
1241}
1242
1243/* Send ACL data */
1244static void hci_add_acl_hdr(struct sk_buff *skb, __u16 handle, __u16 flags)
1245{
1246 struct hci_acl_hdr *hdr;
1247 int len = skb->len;
1248
badff6d0
ACM		 1249 skb_push(skb, HCI_ACL_HDR_SIZE);
1250 skb_reset_transport_header(skb);
9c70220b 1251 hdr = (struct hci_acl_hdr *)skb_transport_header(skb);
aca3192c
YH		 1252 hdr->handle = cpu_to_le16(hci_handle_pack(handle, flags));
1253 hdr->dlen = cpu_to_le16(len);
1da177e4
LT		 1254}
1255
1256int hci_send_acl(struct hci_conn *conn, struct sk_buff *skb, __u16 flags)
1257{
1258 struct hci_dev *hdev = conn->hdev;
1259 struct sk_buff *list;
1260
1261 BT_DBG("%s conn %p flags 0x%x", hdev->name, conn, flags);
1262
1263 skb->dev = (void *) hdev;
0d48d939 1264 bt_cb(skb)->pkt_type = HCI_ACLDATA_PKT;
1da177e4
LT		 1265 hci_add_acl_hdr(skb, conn->handle, flags | ACL_START);
1266
1267 if (!(list = skb_shinfo(skb)->frag_list)) {
1268 /* Non fragmented */
1269 BT_DBG("%s nonfrag skb %p len %d", hdev->name, skb, skb->len);
1270
1271 skb_queue_tail(&conn->data_q, skb);
1272 } else {
1273 /* Fragmented */
1274 BT_DBG("%s frag %p len %d", hdev->name, skb, skb->len);
1275
1276 skb_shinfo(skb)->frag_list = NULL;
1277
1278 /* Queue all fragments atomically */
1279 spin_lock_bh(&conn->data_q.lock);
1280
1281 __skb_queue_tail(&conn->data_q, skb);
1282 do {
1283 skb = list; list = list->next;
8e87d142 1284
1da177e4 1285 skb->dev = (void *) hdev;
0d48d939 1286 bt_cb(skb)->pkt_type = HCI_ACLDATA_PKT;
1da177e4
LT		 1287 hci_add_acl_hdr(skb, conn->handle, flags | ACL_CONT);
1288
1289 BT_DBG("%s frag %p len %d", hdev->name, skb, skb->len);
1290
1291 __skb_queue_tail(&conn->data_q, skb);
1292 } while (list);
1293
1294 spin_unlock_bh(&conn->data_q.lock);
1295 }
1296
1297 hci_sched_tx(hdev);
1298 return 0;
1299}
1300EXPORT_SYMBOL(hci_send_acl);
1301
1302/* Send SCO data */
1303int hci_send_sco(struct hci_conn *conn, struct sk_buff *skb)
1304{
1305 struct hci_dev *hdev = conn->hdev;
1306 struct hci_sco_hdr hdr;
1307
1308 BT_DBG("%s len %d", hdev->name, skb->len);
1309
1310 if (skb->len > hdev->sco_mtu) {
1311 kfree_skb(skb);
1312 return -EINVAL;
1313 }
1314
aca3192c 1315 hdr.handle = cpu_to_le16(conn->handle);
1da177e4
LT		 1316 hdr.dlen = skb->len;
1317
badff6d0
ACM		 1318 skb_push(skb, HCI_SCO_HDR_SIZE);
1319 skb_reset_transport_header(skb);
9c70220b 1320 memcpy(skb_transport_header(skb), &hdr, HCI_SCO_HDR_SIZE);
1da177e4
LT		 1321
1322 skb->dev = (void *) hdev;
0d48d939 1323 bt_cb(skb)->pkt_type = HCI_SCODATA_PKT;
1da177e4
LT		 1324 skb_queue_tail(&conn->data_q, skb);
1325 hci_sched_tx(hdev);
1326 return 0;
1327}
1328EXPORT_SYMBOL(hci_send_sco);
1329
1330/* ---- HCI TX task (outgoing data) ---- */
1331
1332/* HCI Connection scheduler */
1333static inline struct hci_conn *hci_low_sent(struct hci_dev *hdev, __u8 type, int *quote)
1334{
1335 struct hci_conn_hash *h = &hdev->conn_hash;
5b7f9909 1336 struct hci_conn *conn = NULL;
1da177e4
LT		 1337 int num = 0, min = ~0;
1338 struct list_head *p;
1339
8e87d142 1340 /* We don't have to lock device here. Connections are always
1da177e4
LT		 1341 * added and removed with TX task disabled. */
1342 list_for_each(p, &h->list) {
1343 struct hci_conn *c;
1344 c = list_entry(p, struct hci_conn, list);
1345
769be974 1346 if (c->type != type || skb_queue_empty(&c->data_q))
1da177e4 1347 continue;
769be974
MH		 1348
1349 if (c->state != BT_CONNECTED && c->state != BT_CONFIG)
1350 continue;
1351
1da177e4
LT		 1352 num++;
1353
1354 if (c->sent < min) {
1355 min = c->sent;
1356 conn = c;
1357 }
1358 }
1359
1360 if (conn) {
1361 int cnt = (type == ACL_LINK ? hdev->acl_cnt : hdev->sco_cnt);
1362 int q = cnt / num;
1363 *quote = q ? q : 1;
1364 } else
1365 *quote = 0;
1366
1367 BT_DBG("conn %p quote %d", conn, *quote);
1368 return conn;
1369}
1370
1371static inline void hci_acl_tx_to(struct hci_dev *hdev)
1372{
1373 struct hci_conn_hash *h = &hdev->conn_hash;
1374 struct list_head *p;
1375 struct hci_conn *c;
1376
1377 BT_ERR("%s ACL tx timeout", hdev->name);
1378
1379 /* Kill stalled connections */
1380 list_for_each(p, &h->list) {
1381 c = list_entry(p, struct hci_conn, list);
1382 if (c->type == ACL_LINK && c->sent) {
1383 BT_ERR("%s killing stalled ACL connection %s",
1384 hdev->name, batostr(&c->dst));
1385 hci_acl_disconn(c, 0x13);
1386 }
1387 }
1388}
1389
1390static inline void hci_sched_acl(struct hci_dev *hdev)
1391{
1392 struct hci_conn *conn;
1393 struct sk_buff *skb;
1394 int quote;
1395
1396 BT_DBG("%s", hdev->name);
1397
1398 if (!test_bit(HCI_RAW, &hdev->flags)) {
1399 /* ACL tx timeout must be longer than maximum
1400 * link supervision timeout (40.9 seconds) */
82453021 1401 if (!hdev->acl_cnt && time_after(jiffies, hdev->acl_last_tx + HZ * 45))
1da177e4
LT		 1402 hci_acl_tx_to(hdev);
1403 }
1404
1405 while (hdev->acl_cnt && (conn = hci_low_sent(hdev, ACL_LINK, &quote))) {
1406 while (quote-- && (skb = skb_dequeue(&conn->data_q))) {
1407 BT_DBG("skb %p len %d", skb, skb->len);
04837f64
MH		 1408
1409 hci_conn_enter_active_mode(conn);
1410
1da177e4
LT		 1411 hci_send_frame(skb);
1412 hdev->acl_last_tx = jiffies;
1413
1414 hdev->acl_cnt--;
1415 conn->sent++;
1416 }
1417 }
1418}
1419
1420/* Schedule SCO */
1421static inline void hci_sched_sco(struct hci_dev *hdev)
1422{
1423 struct hci_conn *conn;
1424 struct sk_buff *skb;
1425 int quote;
1426
1427 BT_DBG("%s", hdev->name);
1428
1429 while (hdev->sco_cnt && (conn = hci_low_sent(hdev, SCO_LINK, &quote))) {
1430 while (quote-- && (skb = skb_dequeue(&conn->data_q))) {
1431 BT_DBG("skb %p len %d", skb, skb->len);
1432 hci_send_frame(skb);
1433
1434 conn->sent++;
1435 if (conn->sent == ~0)
1436 conn->sent = 0;
1437 }
1438 }
1439}
1440
b6a0dc82
MH		 1441static inline void hci_sched_esco(struct hci_dev *hdev)
1442{
1443 struct hci_conn *conn;
1444 struct sk_buff *skb;
1445 int quote;
1446
1447 BT_DBG("%s", hdev->name);
1448
1449 while (hdev->sco_cnt && (conn = hci_low_sent(hdev, ESCO_LINK, &quote))) {
1450 while (quote-- && (skb = skb_dequeue(&conn->data_q))) {
1451 BT_DBG("skb %p len %d", skb, skb->len);
1452 hci_send_frame(skb);
1453
1454 conn->sent++;
1455 if (conn->sent == ~0)
1456 conn->sent = 0;
1457 }
1458 }
1459}
1460
1da177e4
LT		 1461static void hci_tx_task(unsigned long arg)
1462{
1463 struct hci_dev *hdev = (struct hci_dev *) arg;
1464 struct sk_buff *skb;
1465
1466 read_lock(&hci_task_lock);
1467
1468 BT_DBG("%s acl %d sco %d", hdev->name, hdev->acl_cnt, hdev->sco_cnt);
1469
1470 /* Schedule queues and send stuff to HCI driver */
1471
1472 hci_sched_acl(hdev);
1473
1474 hci_sched_sco(hdev);
1475
b6a0dc82
MH		 1476 hci_sched_esco(hdev);
1477
1da177e4
LT		 1478 /* Send next queued raw (unknown type) packet */
1479 while ((skb = skb_dequeue(&hdev->raw_q)))
1480 hci_send_frame(skb);
1481
1482 read_unlock(&hci_task_lock);
1483}
1484
1485/* ----- HCI RX task (incoming data proccessing) ----- */
1486
1487/* ACL data packet */
1488static inline void hci_acldata_packet(struct hci_dev *hdev, struct sk_buff *skb)
1489{
1490 struct hci_acl_hdr *hdr = (void *) skb->data;
1491 struct hci_conn *conn;
1492 __u16 handle, flags;
1493
1494 skb_pull(skb, HCI_ACL_HDR_SIZE);
1495
1496 handle = __le16_to_cpu(hdr->handle);
1497 flags = hci_flags(handle);
1498 handle = hci_handle(handle);
1499
1500 BT_DBG("%s len %d handle 0x%x flags 0x%x", hdev->name, skb->len, handle, flags);
1501
1502 hdev->stat.acl_rx++;
1503
1504 hci_dev_lock(hdev);
1505 conn = hci_conn_hash_lookup_handle(hdev, handle);
1506 hci_dev_unlock(hdev);
8e87d142 1507
1da177e4
LT		 1508 if (conn) {
1509 register struct hci_proto *hp;
1510
04837f64
MH		 1511 hci_conn_enter_active_mode(conn);
1512
1da177e4
LT		 1513 /* Send to upper protocol */
1514 if ((hp = hci_proto[HCI_PROTO_L2CAP]) && hp->recv_acldata) {
1515 hp->recv_acldata(conn, skb, flags);
1516 return;
1517 }
1518 } else {
8e87d142 1519 BT_ERR("%s ACL packet for unknown connection handle %d",
1da177e4
LT		 1520 hdev->name, handle);
1521 }
1522
1523 kfree_skb(skb);
1524}
1525
1526/* SCO data packet */
1527static inline void hci_scodata_packet(struct hci_dev *hdev, struct sk_buff *skb)
1528{
1529 struct hci_sco_hdr *hdr = (void *) skb->data;
1530 struct hci_conn *conn;
1531 __u16 handle;
1532
1533 skb_pull(skb, HCI_SCO_HDR_SIZE);
1534
1535 handle = __le16_to_cpu(hdr->handle);
1536
1537 BT_DBG("%s len %d handle 0x%x", hdev->name, skb->len, handle);
1538
1539 hdev->stat.sco_rx++;
1540
1541 hci_dev_lock(hdev);
1542 conn = hci_conn_hash_lookup_handle(hdev, handle);
1543 hci_dev_unlock(hdev);
1544
1545 if (conn) {
1546 register struct hci_proto *hp;
1547
1548 /* Send to upper protocol */
1549 if ((hp = hci_proto[HCI_PROTO_SCO]) && hp->recv_scodata) {
1550 hp->recv_scodata(conn, skb);
1551 return;
1552 }
1553 } else {
8e87d142 1554 BT_ERR("%s SCO packet for unknown connection handle %d",
1da177e4
LT		 1555 hdev->name, handle);
1556 }
1557
1558 kfree_skb(skb);
1559}
1560
6516455d 1561static void hci_rx_task(unsigned long arg)
1da177e4
LT		 1562{
1563 struct hci_dev *hdev = (struct hci_dev *) arg;
1564 struct sk_buff *skb;
1565
1566 BT_DBG("%s", hdev->name);
1567
1568 read_lock(&hci_task_lock);
1569
1570 while ((skb = skb_dequeue(&hdev->rx_q))) {
1571 if (atomic_read(&hdev->promisc)) {
1572 /* Send copy to the sockets */
1573 hci_send_to_sock(hdev, skb);
1574 }
1575
1576 if (test_bit(HCI_RAW, &hdev->flags)) {
1577 kfree_skb(skb);
1578 continue;
1579 }
1580
1581 if (test_bit(HCI_INIT, &hdev->flags)) {
1582 /* Don't process data packets in this states. */
0d48d939 1583 switch (bt_cb(skb)->pkt_type) {
1da177e4
LT		 1584 case HCI_ACLDATA_PKT:
1585 case HCI_SCODATA_PKT:
1586 kfree_skb(skb);
1587 continue;
3ff50b79 1588 }
1da177e4
LT		 1589 }
1590
1591 /* Process frame */
0d48d939 1592 switch (bt_cb(skb)->pkt_type) {
1da177e4
LT		 1593 case HCI_EVENT_PKT:
1594 hci_event_packet(hdev, skb);
1595 break;
1596
1597 case HCI_ACLDATA_PKT:
1598 BT_DBG("%s ACL data packet", hdev->name);
1599 hci_acldata_packet(hdev, skb);
1600 break;
1601
1602 case HCI_SCODATA_PKT:
1603 BT_DBG("%s SCO data packet", hdev->name);
1604 hci_scodata_packet(hdev, skb);
1605 break;
1606
1607 default:
1608 kfree_skb(skb);
1609 break;
1610 }
1611 }
1612
1613 read_unlock(&hci_task_lock);
1614}
1615
1616static void hci_cmd_task(unsigned long arg)
1617{
1618 struct hci_dev *hdev = (struct hci_dev *) arg;
1619 struct sk_buff *skb;
1620
1621 BT_DBG("%s cmd %d", hdev->name, atomic_read(&hdev->cmd_cnt));
1622
82453021 1623 if (!atomic_read(&hdev->cmd_cnt) && time_after(jiffies, hdev->cmd_last_tx + HZ)) {
1da177e4
LT		 1624 BT_ERR("%s command tx timeout", hdev->name);
1625 atomic_set(&hdev->cmd_cnt, 1);
1626 }
1627
1628 /* Send queued commands */
1629 if (atomic_read(&hdev->cmd_cnt) && (skb = skb_dequeue(&hdev->cmd_q))) {
7585b97a 1630 kfree_skb(hdev->sent_cmd);
1da177e4
LT		 1631
1632 if ((hdev->sent_cmd = skb_clone(skb, GFP_ATOMIC))) {
1633 atomic_dec(&hdev->cmd_cnt);
1634 hci_send_frame(skb);
1635 hdev->cmd_last_tx = jiffies;
1636 } else {
1637 skb_queue_head(&hdev->cmd_q, skb);
1638 hci_sched_cmd(hdev);
1639 }
1640 }
1641}
Linux 6.x block layer and io_uring tree(s)