net/bluetooth/hci_core.c

   1 /*
   2    BlueZ - Bluetooth protocol stack for Linux
   3    Copyright (C) 2000-2001 Qualcomm Incorporated
   4
   5    Written 2000,2001 by Maxim Krasnyansky <maxk@qualcomm.com>
   6
   7    This program is free software; you can redistribute it and/or modify
   8    it under the terms of the GNU General Public License version 2 as
   9    published by the Free Software Foundation;
  10
  11    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
  12    OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
  13    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
  14    IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
  15    CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
  16    WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
  17    ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
  18    OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  19
  20    ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
  21    COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
  22    SOFTWARE IS DISCLAIMED.
  23 */
  24
  25 /* Bluetooth HCI core. */
  26
  27 #include <linux/config.h>
  28 #include <linux/module.h>
  29 #include <linux/kmod.h>
  30
  31 #include <linux/types.h>
  32 #include <linux/errno.h>
  33 #include <linux/kernel.h>
  34 #include <linux/major.h>
  35 #include <linux/sched.h>
  36 #include <linux/slab.h>
  37 #include <linux/poll.h>
  38 #include <linux/fcntl.h>
  39 #include <linux/init.h>
  40 #include <linux/skbuff.h>
  41 #include <linux/interrupt.h>
  42 #include <linux/notifier.h>
  43 #include <net/sock.h>
  44
  45 #include <asm/system.h>
  46 #include <asm/uaccess.h>
  47 #include <asm/unaligned.h>
  48
  49 #include <net/bluetooth/bluetooth.h>
  50 #include <net/bluetooth/hci_core.h>
  51
  52 #ifndef CONFIG_BT_HCI_CORE_DEBUG
  53 #undef  BT_DBG
  54 #define BT_DBG(D...)
  55 #endif
  56
  57 static void hci_cmd_task(unsigned long arg);
  58 static void hci_rx_task(unsigned long arg);
  59 static void hci_tx_task(unsigned long arg);
  60 static void hci_notify(struct hci_dev *hdev, int event);
  61
  62 static DEFINE_RWLOCK(hci_task_lock);
  63
  64 /* HCI device list */
  65 LIST_HEAD(hci_dev_list);
  66 DEFINE_RWLOCK(hci_dev_list_lock);
  67
  68 /* HCI callback list */
  69 LIST_HEAD(hci_cb_list);
  70 DEFINE_RWLOCK(hci_cb_list_lock);
  71
  72 /* HCI protocols */
  73 #define HCI_MAX_PROTO   2
  74 struct hci_proto *hci_proto[HCI_MAX_PROTO];
  75
  76 /* HCI notifiers list */
  77 static struct notifier_block *hci_notifier;
  78
  79 /* ---- HCI notifications ---- */
  80
  81 int hci_register_notifier(struct notifier_block *nb)
  82 {
  83         return notifier_chain_register(&hci_notifier, nb);
  84 }
  85
  86 int hci_unregister_notifier(struct notifier_block *nb)
  87 {
  88         return notifier_chain_unregister(&hci_notifier, nb);
  89 }
  90
  91 void hci_notify(struct hci_dev *hdev, int event)
  92 {
  93         notifier_call_chain(&hci_notifier, event, hdev);
  94 }
  95
  96 /* ---- HCI requests ---- */
  97
  98 void hci_req_complete(struct hci_dev *hdev, int result)
  99 {
 100         BT_DBG("%s result 0x%2.2x", hdev->name, result);
 101
 102         if (hdev->req_status == HCI_REQ_PEND) {
 103                 hdev->req_result = result;
 104                 hdev->req_status = HCI_REQ_DONE;
 105                 wake_up_interruptible(&hdev->req_wait_q);
 106         }
 107 }
 108
 109 static void hci_req_cancel(struct hci_dev *hdev, int err)
 110 {
 111         BT_DBG("%s err 0x%2.2x", hdev->name, err);
 112
 113         if (hdev->req_status == HCI_REQ_PEND) {
 114                 hdev->req_result = err;
 115                 hdev->req_status = HCI_REQ_CANCELED;
 116                 wake_up_interruptible(&hdev->req_wait_q);
 117         }
 118 }
 119
 120 /* Execute request and wait for completion. */
 121 static int __hci_request(struct hci_dev *hdev, void (*req)(struct hci_dev *hdev, unsigned long opt),
 122                                 unsigned long opt, __u32 timeout)
 123 {
 124         DECLARE_WAITQUEUE(wait, current);
 125         int err = 0;
 126
 127         BT_DBG("%s start", hdev->name);
 128
 129         hdev->req_status = HCI_REQ_PEND;
 130
 131         add_wait_queue(&hdev->req_wait_q, &wait);
 132         set_current_state(TASK_INTERRUPTIBLE);
 133
 134         req(hdev, opt);
 135         schedule_timeout(timeout);
 136
 137         remove_wait_queue(&hdev->req_wait_q, &wait);
 138
 139         if (signal_pending(current))
 140                 return -EINTR;
 141
 142         switch (hdev->req_status) {
 143         case HCI_REQ_DONE:
 144                 err = -bt_err(hdev->req_result);
 145                 break;
 146
 147         case HCI_REQ_CANCELED:
 148                 err = -hdev->req_result;
 149                 break;
 150
 151         default:
 152                 err = -ETIMEDOUT;
 153                 break;
 154         };
 155
 156         hdev->req_status = hdev->req_result = 0;
 157
 158         BT_DBG("%s end: err %d", hdev->name, err);
 159
 160         return err;
 161 }
 162
 163 static inline int hci_request(struct hci_dev *hdev, void (*req)(struct hci_dev *hdev, unsigned long opt),
 164                                 unsigned long opt, __u32 timeout)
 165 {
 166         int ret;
 167
 168         /* Serialize all requests */
 169         hci_req_lock(hdev);
 170         ret = __hci_request(hdev, req, opt, timeout);
 171         hci_req_unlock(hdev);
 172
 173         return ret;
 174 }
 175
 176 static void hci_reset_req(struct hci_dev *hdev, unsigned long opt)
 177 {
 178         BT_DBG("%s %ld", hdev->name, opt);
 179
 180         /* Reset device */
 181         hci_send_cmd(hdev, OGF_HOST_CTL, OCF_RESET, 0, NULL);
 182 }
 183
 184 static void hci_init_req(struct hci_dev *hdev, unsigned long opt)
 185 {
 186         struct sk_buff *skb;
 187         __u16 param;
 188
 189         BT_DBG("%s %ld", hdev->name, opt);
 190
 191         /* Driver initialization */
 192
 193         /* Special commands */
 194         while ((skb = skb_dequeue(&hdev->driver_init))) {
 195                 skb->pkt_type = HCI_COMMAND_PKT;
 196                 skb->dev = (void *) hdev;
 197                 skb_queue_tail(&hdev->cmd_q, skb);
 198                 hci_sched_cmd(hdev);
 199         }
 200         skb_queue_purge(&hdev->driver_init);
 201
 202         /* Mandatory initialization */
 203
 204         /* Reset */
 205         if (test_bit(HCI_QUIRK_RESET_ON_INIT, &hdev->quirks))
 206                         hci_send_cmd(hdev, OGF_HOST_CTL, OCF_RESET, 0, NULL);
 207
 208         /* Read Local Supported Features */
 209         hci_send_cmd(hdev, OGF_INFO_PARAM, OCF_READ_LOCAL_FEATURES, 0, NULL);
 210
 211         /* Read Buffer Size (ACL mtu, max pkt, etc.) */
 212         hci_send_cmd(hdev, OGF_INFO_PARAM, OCF_READ_BUFFER_SIZE, 0, NULL);
 213
 214 #if 0
 215         /* Host buffer size */
 216         {
 217                 struct hci_cp_host_buffer_size cp;
 218                 cp.acl_mtu = __cpu_to_le16(HCI_MAX_ACL_SIZE);
 219                 cp.sco_mtu = HCI_MAX_SCO_SIZE;
 220                 cp.acl_max_pkt = __cpu_to_le16(0xffff);
 221                 cp.sco_max_pkt = __cpu_to_le16(0xffff);
 222                 hci_send_cmd(hdev, OGF_HOST_CTL, OCF_HOST_BUFFER_SIZE, sizeof(cp), &cp);
 223         }
 224 #endif
 225
 226         /* Read BD Address */
 227         hci_send_cmd(hdev, OGF_INFO_PARAM, OCF_READ_BD_ADDR, 0, NULL);
 228
 229         /* Read Voice Setting */
 230         hci_send_cmd(hdev, OGF_HOST_CTL, OCF_READ_VOICE_SETTING, 0, NULL);
 231
 232         /* Optional initialization */
 233
 234         /* Clear Event Filters */
 235         {
 236                 struct hci_cp_set_event_flt cp;
 237                 cp.flt_type  = HCI_FLT_CLEAR_ALL;
 238                 hci_send_cmd(hdev, OGF_HOST_CTL, OCF_SET_EVENT_FLT, sizeof(cp), &cp);
 239         }
 240
 241         /* Page timeout ~20 secs */
 242         param = __cpu_to_le16(0x8000);
 243         hci_send_cmd(hdev, OGF_HOST_CTL, OCF_WRITE_PG_TIMEOUT, 2, &param);
 244
 245         /* Connection accept timeout ~20 secs */
 246         param = __cpu_to_le16(0x7d00);
 247         hci_send_cmd(hdev, OGF_HOST_CTL, OCF_WRITE_CA_TIMEOUT, 2, &param);
 248 }
 249
 250 static void hci_scan_req(struct hci_dev *hdev, unsigned long opt)
 251 {
 252         __u8 scan = opt;
 253
 254         BT_DBG("%s %x", hdev->name, scan);
 255
 256         /* Inquiry and Page scans */
 257         hci_send_cmd(hdev, OGF_HOST_CTL, OCF_WRITE_SCAN_ENABLE, 1, &scan);
 258 }
 259
 260 static void hci_auth_req(struct hci_dev *hdev, unsigned long opt)
 261 {
 262         __u8 auth = opt;
 263
 264         BT_DBG("%s %x", hdev->name, auth);
 265
 266         /* Authentication */
 267         hci_send_cmd(hdev, OGF_HOST_CTL, OCF_WRITE_AUTH_ENABLE, 1, &auth);
 268 }
 269
 270 static void hci_encrypt_req(struct hci_dev *hdev, unsigned long opt)
 271 {
 272         __u8 encrypt = opt;
 273
 274         BT_DBG("%s %x", hdev->name, encrypt);
 275
 276         /* Authentication */
 277         hci_send_cmd(hdev, OGF_HOST_CTL, OCF_WRITE_ENCRYPT_MODE, 1, &encrypt);
 278 }
 279
 280 /* Get HCI device by index.
 281  * Device is held on return. */
 282 struct hci_dev *hci_dev_get(int index)
 283 {
 284         struct hci_dev *hdev = NULL;
 285         struct list_head *p;
 286
 287         BT_DBG("%d", index);
 288
 289         if (index < 0)
 290                 return NULL;
 291
 292         read_lock(&hci_dev_list_lock);
 293         list_for_each(p, &hci_dev_list) {
 294                 struct hci_dev *d = list_entry(p, struct hci_dev, list);
 295                 if (d->id == index) {
 296                         hdev = hci_dev_hold(d);
 297                         break;
 298                 }
 299         }
 300         read_unlock(&hci_dev_list_lock);
 301         return hdev;
 302 }
 303 EXPORT_SYMBOL(hci_dev_get);
 304
 305 /* ---- Inquiry support ---- */
 306 static void inquiry_cache_flush(struct hci_dev *hdev)
 307 {
 308         struct inquiry_cache *cache = &hdev->inq_cache;
 309         struct inquiry_entry *next  = cache->list, *e;
 310
 311         BT_DBG("cache %p", cache);
 312
 313         cache->list = NULL;
 314         while ((e = next)) {
 315                 next = e->next;
 316                 kfree(e);
 317         }
 318 }
 319
 320 struct inquiry_entry *hci_inquiry_cache_lookup(struct hci_dev *hdev, bdaddr_t *bdaddr)
 321 {
 322         struct inquiry_cache *cache = &hdev->inq_cache;
 323         struct inquiry_entry *e;
 324
 325         BT_DBG("cache %p, %s", cache, batostr(bdaddr));
 326
 327         for (e = cache->list; e; e = e->next)
 328                 if (!bacmp(&e->data.bdaddr, bdaddr))
 329                         break;
 330         return e;
 331 }
 332
 333 void hci_inquiry_cache_update(struct hci_dev *hdev, struct inquiry_data *data)
 334 {
 335         struct inquiry_cache *cache = &hdev->inq_cache;
 336         struct inquiry_entry *e;
 337
 338         BT_DBG("cache %p, %s", cache, batostr(&data->bdaddr));
 339
 340         if (!(e = hci_inquiry_cache_lookup(hdev, &data->bdaddr))) {
 341                 /* Entry not in the cache. Add new one. */
 342                 if (!(e = kmalloc(sizeof(struct inquiry_entry), GFP_ATOMIC)))
 343                         return;
 344                 memset(e, 0, sizeof(struct inquiry_entry));
 345                 e->next     = cache->list;
 346                 cache->list = e;
 347         }
 348
 349         memcpy(&e->data, data, sizeof(*data));
 350         e->timestamp = jiffies;
 351         cache->timestamp = jiffies;
 352 }
 353
 354 static int inquiry_cache_dump(struct hci_dev *hdev, int num, __u8 *buf)
 355 {
 356         struct inquiry_cache *cache = &hdev->inq_cache;
 357         struct inquiry_info *info = (struct inquiry_info *) buf;
 358         struct inquiry_entry *e;
 359         int copied = 0;
 360
 361         for (e = cache->list; e && copied < num; e = e->next, copied++) {
 362                 struct inquiry_data *data = &e->data;
 363                 bacpy(&info->bdaddr, &data->bdaddr);
 364                 info->pscan_rep_mode    = data->pscan_rep_mode;
 365                 info->pscan_period_mode = data->pscan_period_mode;
 366                 info->pscan_mode        = data->pscan_mode;
 367                 memcpy(info->dev_class, data->dev_class, 3);
 368                 info->clock_offset      = data->clock_offset;
 369                 info++;
 370         }
 371
 372         BT_DBG("cache %p, copied %d", cache, copied);
 373         return copied;
 374 }
 375
 376 static void hci_inq_req(struct hci_dev *hdev, unsigned long opt)
 377 {
 378         struct hci_inquiry_req *ir = (struct hci_inquiry_req *) opt;
 379         struct hci_cp_inquiry cp;
 380
 381         BT_DBG("%s", hdev->name);
 382
 383         if (test_bit(HCI_INQUIRY, &hdev->flags))
 384                 return;
 385
 386         /* Start Inquiry */
 387         memcpy(&cp.lap, &ir->lap, 3);
 388         cp.length  = ir->length;
 389         cp.num_rsp = ir->num_rsp;
 390         hci_send_cmd(hdev, OGF_LINK_CTL, OCF_INQUIRY, sizeof(cp), &cp);
 391 }
 392
 393 int hci_inquiry(void __user *arg)
 394 {
 395         __u8 __user *ptr = arg;
 396         struct hci_inquiry_req ir;
 397         struct hci_dev *hdev;
 398         int err = 0, do_inquiry = 0, max_rsp;
 399         long timeo;
 400         __u8 *buf;
 401
 402         if (copy_from_user(&ir, ptr, sizeof(ir)))
 403                 return -EFAULT;
 404
 405         if (!(hdev = hci_dev_get(ir.dev_id)))
 406                 return -ENODEV;
 407
 408         hci_dev_lock_bh(hdev);
 409         if (inquiry_cache_age(hdev) > INQUIRY_CACHE_AGE_MAX ||
 410                                         inquiry_cache_empty(hdev) ||
 411                                         ir.flags & IREQ_CACHE_FLUSH) {
 412                 inquiry_cache_flush(hdev);
 413                 do_inquiry = 1;
 414         }
 415         hci_dev_unlock_bh(hdev);
 416
 417         timeo = ir.length * 2 * HZ;
 418         if (do_inquiry && (err = hci_request(hdev, hci_inq_req, (unsigned long)&ir, timeo)) < 0)
 419                 goto done;
 420
 421         /* for unlimited number of responses we will use buffer with 255 entries */
 422         max_rsp = (ir.num_rsp == 0) ? 255 : ir.num_rsp;
 423
 424         /* cache_dump can't sleep. Therefore we allocate temp buffer and then
 425          * copy it to the user space.
 426          */
 427         if (!(buf = kmalloc(sizeof(struct inquiry_info) * max_rsp, GFP_KERNEL))) {
 428                 err = -ENOMEM;
 429                 goto done;
 430         }
 431
 432         hci_dev_lock_bh(hdev);
 433         ir.num_rsp = inquiry_cache_dump(hdev, max_rsp, buf);
 434         hci_dev_unlock_bh(hdev);
 435
 436         BT_DBG("num_rsp %d", ir.num_rsp);
 437
 438         if (!copy_to_user(ptr, &ir, sizeof(ir))) {
 439                 ptr += sizeof(ir);
 440                 if (copy_to_user(ptr, buf, sizeof(struct inquiry_info) *
 441                                         ir.num_rsp))
 442                         err = -EFAULT;
 443         } else
 444                 err = -EFAULT;
 445
 446         kfree(buf);
 447
 448 done:
 449         hci_dev_put(hdev);
 450         return err;
 451 }
 452
 453 /* ---- HCI ioctl helpers ---- */
 454
 455 int hci_dev_open(__u16 dev)
 456 {
 457         struct hci_dev *hdev;
 458         int ret = 0;
 459
 460         if (!(hdev = hci_dev_get(dev)))
 461                 return -ENODEV;
 462
 463         BT_DBG("%s %p", hdev->name, hdev);
 464
 465         hci_req_lock(hdev);
 466
 467         if (test_bit(HCI_UP, &hdev->flags)) {
 468                 ret = -EALREADY;
 469                 goto done;
 470         }
 471
 472         if (test_bit(HCI_QUIRK_RAW_DEVICE, &hdev->quirks))
 473                 set_bit(HCI_RAW, &hdev->flags);
 474
 475         if (hdev->open(hdev)) {
 476                 ret = -EIO;
 477                 goto done;
 478         }
 479
 480         if (!test_bit(HCI_RAW, &hdev->flags)) {
 481                 atomic_set(&hdev->cmd_cnt, 1);
 482                 set_bit(HCI_INIT, &hdev->flags);
 483
 484                 //__hci_request(hdev, hci_reset_req, 0, HZ);
 485                 ret = __hci_request(hdev, hci_init_req, 0, HCI_INIT_TIMEOUT);
 486
 487                 clear_bit(HCI_INIT, &hdev->flags);
 488         }
 489
 490         if (!ret) {
 491                 hci_dev_hold(hdev);
 492                 set_bit(HCI_UP, &hdev->flags);
 493                 hci_notify(hdev, HCI_DEV_UP);
 494         } else {
 495                 /* Init failed, cleanup */
 496                 tasklet_kill(&hdev->rx_task);
 497                 tasklet_kill(&hdev->tx_task);
 498                 tasklet_kill(&hdev->cmd_task);
 499
 500                 skb_queue_purge(&hdev->cmd_q);
 501                 skb_queue_purge(&hdev->rx_q);
 502
 503                 if (hdev->flush)
 504                         hdev->flush(hdev);
 505
 506                 if (hdev->sent_cmd) {
 507                         kfree_skb(hdev->sent_cmd);
 508                         hdev->sent_cmd = NULL;
 509                 }
 510
 511                 hdev->close(hdev);
 512                 hdev->flags = 0;
 513         }
 514
 515 done:
 516         hci_req_unlock(hdev);
 517         hci_dev_put(hdev);
 518         return ret;
 519 }
 520
 521 static int hci_dev_do_close(struct hci_dev *hdev)
 522 {
 523         BT_DBG("%s %p", hdev->name, hdev);
 524
 525         hci_req_cancel(hdev, ENODEV);
 526         hci_req_lock(hdev);
 527
 528         if (!test_and_clear_bit(HCI_UP, &hdev->flags)) {
 529                 hci_req_unlock(hdev);
 530                 return 0;
 531         }
 532
 533         /* Kill RX and TX tasks */
 534         tasklet_kill(&hdev->rx_task);
 535         tasklet_kill(&hdev->tx_task);
 536
 537         hci_dev_lock_bh(hdev);
 538         inquiry_cache_flush(hdev);
 539         hci_conn_hash_flush(hdev);
 540         hci_dev_unlock_bh(hdev);
 541
 542         hci_notify(hdev, HCI_DEV_DOWN);
 543
 544         if (hdev->flush)
 545                 hdev->flush(hdev);
 546
 547         /* Reset device */
 548         skb_queue_purge(&hdev->cmd_q);
 549         atomic_set(&hdev->cmd_cnt, 1);
 550         if (!test_bit(HCI_RAW, &hdev->flags)) {
 551                 set_bit(HCI_INIT, &hdev->flags);
 552                 __hci_request(hdev, hci_reset_req, 0, HZ/4);
 553                 clear_bit(HCI_INIT, &hdev->flags);
 554         }
 555
 556         /* Kill cmd task */
 557         tasklet_kill(&hdev->cmd_task);
 558
 559         /* Drop queues */
 560         skb_queue_purge(&hdev->rx_q);
 561         skb_queue_purge(&hdev->cmd_q);
 562         skb_queue_purge(&hdev->raw_q);
 563
 564         /* Drop last sent command */
 565         if (hdev->sent_cmd) {
 566                 kfree_skb(hdev->sent_cmd);
 567                 hdev->sent_cmd = NULL;
 568         }
 569
 570         /* After this point our queues are empty
 571          * and no tasks are scheduled. */
 572         hdev->close(hdev);
 573
 574         /* Clear flags */
 575         hdev->flags = 0;
 576
 577         hci_req_unlock(hdev);
 578
 579         hci_dev_put(hdev);
 580         return 0;
 581 }
 582
 583 int hci_dev_close(__u16 dev)
 584 {
 585         struct hci_dev *hdev;
 586         int err;
 587
 588         if (!(hdev = hci_dev_get(dev)))
 589                 return -ENODEV;
 590         err = hci_dev_do_close(hdev);
 591         hci_dev_put(hdev);
 592         return err;
 593 }
 594
 595 int hci_dev_reset(__u16 dev)
 596 {
 597         struct hci_dev *hdev;
 598         int ret = 0;
 599
 600         if (!(hdev = hci_dev_get(dev)))
 601                 return -ENODEV;
 602
 603         hci_req_lock(hdev);
 604         tasklet_disable(&hdev->tx_task);
 605
 606         if (!test_bit(HCI_UP, &hdev->flags))
 607                 goto done;
 608
 609         /* Drop queues */
 610         skb_queue_purge(&hdev->rx_q);
 611         skb_queue_purge(&hdev->cmd_q);
 612
 613         hci_dev_lock_bh(hdev);
 614         inquiry_cache_flush(hdev);
 615         hci_conn_hash_flush(hdev);
 616         hci_dev_unlock_bh(hdev);
 617
 618         if (hdev->flush)
 619                 hdev->flush(hdev);
 620
 621         atomic_set(&hdev->cmd_cnt, 1);
 622         hdev->acl_cnt = 0; hdev->sco_cnt = 0;
 623
 624         if (!test_bit(HCI_RAW, &hdev->flags))
 625                 ret = __hci_request(hdev, hci_reset_req, 0, HCI_INIT_TIMEOUT);
 626
 627 done:
 628         tasklet_enable(&hdev->tx_task);
 629         hci_req_unlock(hdev);
 630         hci_dev_put(hdev);
 631         return ret;
 632 }
 633
 634 int hci_dev_reset_stat(__u16 dev)
 635 {
 636         struct hci_dev *hdev;
 637         int ret = 0;
 638
 639         if (!(hdev = hci_dev_get(dev)))
 640                 return -ENODEV;
 641
 642         memset(&hdev->stat, 0, sizeof(struct hci_dev_stats));
 643
 644         hci_dev_put(hdev);
 645
 646         return ret;
 647 }
 648
 649 int hci_dev_cmd(unsigned int cmd, void __user *arg)
 650 {
 651         struct hci_dev *hdev;
 652         struct hci_dev_req dr;
 653         int err = 0;
 654
 655         if (copy_from_user(&dr, arg, sizeof(dr)))
 656                 return -EFAULT;
 657
 658         if (!(hdev = hci_dev_get(dr.dev_id)))
 659                 return -ENODEV;
 660
 661         switch (cmd) {
 662         case HCISETAUTH:
 663                 err = hci_request(hdev, hci_auth_req, dr.dev_opt, HCI_INIT_TIMEOUT);
 664                 break;
 665
 666         case HCISETENCRYPT:
 667                 if (!lmp_encrypt_capable(hdev)) {
 668                         err = -EOPNOTSUPP;
 669                         break;
 670                 }
 671
 672                 if (!test_bit(HCI_AUTH, &hdev->flags)) {
 673                         /* Auth must be enabled first */
 674                         err = hci_request(hdev, hci_auth_req,
 675                                         dr.dev_opt, HCI_INIT_TIMEOUT);
 676                         if (err)
 677                                 break;
 678                 }
 679
 680                 err = hci_request(hdev, hci_encrypt_req,
 681                                         dr.dev_opt, HCI_INIT_TIMEOUT);
 682                 break;
 683
 684         case HCISETSCAN:
 685                 err = hci_request(hdev, hci_scan_req, dr.dev_opt, HCI_INIT_TIMEOUT);
 686                 break;
 687
 688         case HCISETPTYPE:
 689                 hdev->pkt_type = (__u16) dr.dev_opt;
 690                 break;
 691
 692         case HCISETLINKPOL:
 693                 hdev->link_policy = (__u16) dr.dev_opt;
 694                 break;
 695
 696         case HCISETLINKMODE:
 697                 hdev->link_mode = ((__u16) dr.dev_opt) & (HCI_LM_MASTER | HCI_LM_ACCEPT);
 698                 break;
 699
 700         case HCISETACLMTU:
 701                 hdev->acl_mtu  = *((__u16 *)&dr.dev_opt + 1);
 702                 hdev->acl_pkts = *((__u16 *)&dr.dev_opt + 0);
 703                 break;
 704
 705         case HCISETSCOMTU:
 706                 hdev->sco_mtu  = *((__u16 *)&dr.dev_opt + 1);
 707                 hdev->sco_pkts = *((__u16 *)&dr.dev_opt + 0);
 708                 break;
 709
 710         default:
 711                 err = -EINVAL;
 712                 break;
 713         }
 714         hci_dev_put(hdev);
 715         return err;
 716 }
 717
 718 int hci_get_dev_list(void __user *arg)
 719 {
 720         struct hci_dev_list_req *dl;
 721         struct hci_dev_req *dr;
 722         struct list_head *p;
 723         int n = 0, size, err;
 724         __u16 dev_num;
 725
 726         if (get_user(dev_num, (__u16 __user *) arg))
 727                 return -EFAULT;
 728
 729         if (!dev_num || dev_num > (PAGE_SIZE * 2) / sizeof(*dr))
 730                 return -EINVAL;
 731
 732         size = sizeof(*dl) + dev_num * sizeof(*dr);
 733
 734         if (!(dl = kmalloc(size, GFP_KERNEL)))
 735                 return -ENOMEM;
 736
 737         dr = dl->dev_req;
 738
 739         read_lock_bh(&hci_dev_list_lock);
 740         list_for_each(p, &hci_dev_list) {
 741                 struct hci_dev *hdev;
 742                 hdev = list_entry(p, struct hci_dev, list);
 743                 (dr + n)->dev_id  = hdev->id;
 744                 (dr + n)->dev_opt = hdev->flags;
 745                 if (++n >= dev_num)
 746                         break;
 747         }
 748         read_unlock_bh(&hci_dev_list_lock);
 749
 750         dl->dev_num = n;
 751         size = sizeof(*dl) + n * sizeof(*dr);
 752
 753         err = copy_to_user(arg, dl, size);
 754         kfree(dl);
 755
 756         return err ? -EFAULT : 0;
 757 }
 758
 759 int hci_get_dev_info(void __user *arg)
 760 {
 761         struct hci_dev *hdev;
 762         struct hci_dev_info di;
 763         int err = 0;
 764
 765         if (copy_from_user(&di, arg, sizeof(di)))
 766                 return -EFAULT;
 767
 768         if (!(hdev = hci_dev_get(di.dev_id)))
 769                 return -ENODEV;
 770
 771         strcpy(di.name, hdev->name);
 772         di.bdaddr   = hdev->bdaddr;
 773         di.type     = hdev->type;
 774         di.flags    = hdev->flags;
 775         di.pkt_type = hdev->pkt_type;
 776         di.acl_mtu  = hdev->acl_mtu;
 777         di.acl_pkts = hdev->acl_pkts;
 778         di.sco_mtu  = hdev->sco_mtu;
 779         di.sco_pkts = hdev->sco_pkts;
 780         di.link_policy = hdev->link_policy;
 781         di.link_mode   = hdev->link_mode;
 782
 783         memcpy(&di.stat, &hdev->stat, sizeof(di.stat));
 784         memcpy(&di.features, &hdev->features, sizeof(di.features));
 785
 786         if (copy_to_user(arg, &di, sizeof(di)))
 787                 err = -EFAULT;
 788
 789         hci_dev_put(hdev);
 790
 791         return err;
 792 }
 793
 794 /* ---- Interface to HCI drivers ---- */
 795
 796 /* Alloc HCI device */
 797 struct hci_dev *hci_alloc_dev(void)
 798 {
 799         struct hci_dev *hdev;
 800
 801         hdev = kmalloc(sizeof(struct hci_dev), GFP_KERNEL);
 802         if (!hdev)
 803                 return NULL;
 804
 805         memset(hdev, 0, sizeof(struct hci_dev));
 806
 807         skb_queue_head_init(&hdev->driver_init);
 808
 809         return hdev;
 810 }
 811 EXPORT_SYMBOL(hci_alloc_dev);
 812
 813 /* Free HCI device */
 814 void hci_free_dev(struct hci_dev *hdev)
 815 {
 816         skb_queue_purge(&hdev->driver_init);
 817
 818         /* will free via class release */
 819         class_device_put(&hdev->class_dev);
 820 }
 821 EXPORT_SYMBOL(hci_free_dev);
 822
 823 /* Register HCI device */
 824 int hci_register_dev(struct hci_dev *hdev)
 825 {
 826         struct list_head *head = &hci_dev_list, *p;
 827         int id = 0;
 828
 829         BT_DBG("%p name %s type %d owner %p", hdev, hdev->name, hdev->type, hdev->owner);
 830
 831         if (!hdev->open || !hdev->close || !hdev->destruct)
 832                 return -EINVAL;
 833
 834         write_lock_bh(&hci_dev_list_lock);
 835
 836         /* Find first available device id */
 837         list_for_each(p, &hci_dev_list) {
 838                 if (list_entry(p, struct hci_dev, list)->id != id)
 839                         break;
 840                 head = p; id++;
 841         }
 842
 843         sprintf(hdev->name, "hci%d", id);
 844         hdev->id = id;
 845         list_add(&hdev->list, head);
 846
 847         atomic_set(&hdev->refcnt, 1);
 848         spin_lock_init(&hdev->lock);
 849
 850         hdev->flags = 0;
 851         hdev->pkt_type  = (HCI_DM1 | HCI_DH1 | HCI_HV1);
 852         hdev->link_mode = (HCI_LM_ACCEPT);
 853
 854         tasklet_init(&hdev->cmd_task, hci_cmd_task,(unsigned long) hdev);
 855         tasklet_init(&hdev->rx_task, hci_rx_task, (unsigned long) hdev);
 856         tasklet_init(&hdev->tx_task, hci_tx_task, (unsigned long) hdev);
 857
 858         skb_queue_head_init(&hdev->rx_q);
 859         skb_queue_head_init(&hdev->cmd_q);
 860         skb_queue_head_init(&hdev->raw_q);
 861
 862         init_waitqueue_head(&hdev->req_wait_q);
 863         init_MUTEX(&hdev->req_lock);
 864
 865         inquiry_cache_init(hdev);
 866
 867         hci_conn_hash_init(hdev);
 868
 869         memset(&hdev->stat, 0, sizeof(struct hci_dev_stats));
 870
 871         atomic_set(&hdev->promisc, 0);
 872
 873         write_unlock_bh(&hci_dev_list_lock);
 874
 875         hci_register_sysfs(hdev);
 876
 877         hci_notify(hdev, HCI_DEV_REG);
 878
 879         return id;
 880 }
 881 EXPORT_SYMBOL(hci_register_dev);
 882
 883 /* Unregister HCI device */
 884 int hci_unregister_dev(struct hci_dev *hdev)
 885 {
 886         BT_DBG("%p name %s type %d", hdev, hdev->name, hdev->type);
 887
 888         hci_unregister_sysfs(hdev);
 889
 890         write_lock_bh(&hci_dev_list_lock);
 891         list_del(&hdev->list);
 892         write_unlock_bh(&hci_dev_list_lock);
 893
 894         hci_dev_do_close(hdev);
 895
 896         hci_notify(hdev, HCI_DEV_UNREG);
 897
 898         __hci_dev_put(hdev);
 899         return 0;
 900 }
 901 EXPORT_SYMBOL(hci_unregister_dev);
 902
 903 /* Suspend HCI device */
 904 int hci_suspend_dev(struct hci_dev *hdev)
 905 {
 906         hci_notify(hdev, HCI_DEV_SUSPEND);
 907         return 0;
 908 }
 909 EXPORT_SYMBOL(hci_suspend_dev);
 910
 911 /* Resume HCI device */
 912 int hci_resume_dev(struct hci_dev *hdev)
 913 {
 914         hci_notify(hdev, HCI_DEV_RESUME);
 915         return 0;
 916 }
 917 EXPORT_SYMBOL(hci_resume_dev);
 918
 919 /* ---- Interface to upper protocols ---- */
 920
 921 /* Register/Unregister protocols.
 922  * hci_task_lock is used to ensure that no tasks are running. */
 923 int hci_register_proto(struct hci_proto *hp)
 924 {
 925         int err = 0;
 926
 927         BT_DBG("%p name %s id %d", hp, hp->name, hp->id);
 928
 929         if (hp->id >= HCI_MAX_PROTO)
 930                 return -EINVAL;
 931
 932         write_lock_bh(&hci_task_lock);
 933
 934         if (!hci_proto[hp->id])
 935                 hci_proto[hp->id] = hp;
 936         else
 937                 err = -EEXIST;
 938
 939         write_unlock_bh(&hci_task_lock);
 940
 941         return err;
 942 }
 943 EXPORT_SYMBOL(hci_register_proto);
 944
 945 int hci_unregister_proto(struct hci_proto *hp)
 946 {
 947         int err = 0;
 948
 949         BT_DBG("%p name %s id %d", hp, hp->name, hp->id);
 950
 951         if (hp->id >= HCI_MAX_PROTO)
 952                 return -EINVAL;
 953
 954         write_lock_bh(&hci_task_lock);
 955
 956         if (hci_proto[hp->id])
 957                 hci_proto[hp->id] = NULL;
 958         else
 959                 err = -ENOENT;
 960
 961         write_unlock_bh(&hci_task_lock);
 962
 963         return err;
 964 }
 965 EXPORT_SYMBOL(hci_unregister_proto);
 966
 967 int hci_register_cb(struct hci_cb *cb)
 968 {
 969         BT_DBG("%p name %s", cb, cb->name);
 970
 971         write_lock_bh(&hci_cb_list_lock);
 972         list_add(&cb->list, &hci_cb_list);
 973         write_unlock_bh(&hci_cb_list_lock);
 974
 975         return 0;
 976 }
 977 EXPORT_SYMBOL(hci_register_cb);
 978
 979 int hci_unregister_cb(struct hci_cb *cb)
 980 {
 981         BT_DBG("%p name %s", cb, cb->name);
 982
 983         write_lock_bh(&hci_cb_list_lock);
 984         list_del(&cb->list);
 985         write_unlock_bh(&hci_cb_list_lock);
 986
 987         return 0;
 988 }
 989 EXPORT_SYMBOL(hci_unregister_cb);
 990
 991 static int hci_send_frame(struct sk_buff *skb)
 992 {
 993         struct hci_dev *hdev = (struct hci_dev *) skb->dev;
 994
 995         if (!hdev) {
 996                 kfree_skb(skb);
 997                 return -ENODEV;
 998         }
 999
1000         BT_DBG("%s type %d len %d", hdev->name, skb->pkt_type, skb->len);
1001
1002         if (atomic_read(&hdev->promisc)) {
1003                 /* Time stamp */
1004                 do_gettimeofday(&skb->stamp);
1005
1006                 hci_send_to_sock(hdev, skb);
1007         }
1008
1009         /* Get rid of skb owner, prior to sending to the driver. */
1010         skb_orphan(skb);
1011
1012         return hdev->send(skb);
1013 }
1014
1015 /* Send HCI command */
1016 int hci_send_cmd(struct hci_dev *hdev, __u16 ogf, __u16 ocf, __u32 plen, void *param)
1017 {
1018         int len = HCI_COMMAND_HDR_SIZE + plen;
1019         struct hci_command_hdr *hdr;
1020         struct sk_buff *skb;
1021
1022         BT_DBG("%s ogf 0x%x ocf 0x%x plen %d", hdev->name, ogf, ocf, plen);
1023
1024         skb = bt_skb_alloc(len, GFP_ATOMIC);
1025         if (!skb) {
1026                 BT_ERR("%s Can't allocate memory for HCI command", hdev->name);
1027                 return -ENOMEM;
1028         }
1029
1030         hdr = (struct hci_command_hdr *) skb_put(skb, HCI_COMMAND_HDR_SIZE);
1031         hdr->opcode = __cpu_to_le16(hci_opcode_pack(ogf, ocf));
1032         hdr->plen   = plen;
1033
1034         if (plen)
1035                 memcpy(skb_put(skb, plen), param, plen);
1036
1037         BT_DBG("skb len %d", skb->len);
1038
1039         skb->pkt_type = HCI_COMMAND_PKT;
1040         skb->dev = (void *) hdev;
1041         skb_queue_tail(&hdev->cmd_q, skb);
1042         hci_sched_cmd(hdev);
1043
1044         return 0;
1045 }
1046 EXPORT_SYMBOL(hci_send_cmd);
1047
1048 /* Get data from the previously sent command */
1049 void *hci_sent_cmd_data(struct hci_dev *hdev, __u16 ogf, __u16 ocf)
1050 {
1051         struct hci_command_hdr *hdr;
1052
1053         if (!hdev->sent_cmd)
1054                 return NULL;
1055
1056         hdr = (void *) hdev->sent_cmd->data;
1057
1058         if (hdr->opcode != __cpu_to_le16(hci_opcode_pack(ogf, ocf)))
1059                 return NULL;
1060
1061         BT_DBG("%s ogf 0x%x ocf 0x%x", hdev->name, ogf, ocf);
1062
1063         return hdev->sent_cmd->data + HCI_COMMAND_HDR_SIZE;
1064 }
1065
1066 /* Send ACL data */
1067 static void hci_add_acl_hdr(struct sk_buff *skb, __u16 handle, __u16 flags)
1068 {
1069         struct hci_acl_hdr *hdr;
1070         int len = skb->len;
1071
1072         hdr = (struct hci_acl_hdr *) skb_push(skb, HCI_ACL_HDR_SIZE);
1073         hdr->handle = __cpu_to_le16(hci_handle_pack(handle, flags));
1074         hdr->dlen   = __cpu_to_le16(len);
1075
1076         skb->h.raw = (void *) hdr;
1077 }
1078
1079 int hci_send_acl(struct hci_conn *conn, struct sk_buff *skb, __u16 flags)
1080 {
1081         struct hci_dev *hdev = conn->hdev;
1082         struct sk_buff *list;
1083
1084         BT_DBG("%s conn %p flags 0x%x", hdev->name, conn, flags);
1085
1086         skb->dev = (void *) hdev;
1087         skb->pkt_type = HCI_ACLDATA_PKT;
1088         hci_add_acl_hdr(skb, conn->handle, flags | ACL_START);
1089
1090         if (!(list = skb_shinfo(skb)->frag_list)) {
1091                 /* Non fragmented */
1092                 BT_DBG("%s nonfrag skb %p len %d", hdev->name, skb, skb->len);
1093
1094                 skb_queue_tail(&conn->data_q, skb);
1095         } else {
1096                 /* Fragmented */
1097                 BT_DBG("%s frag %p len %d", hdev->name, skb, skb->len);
1098
1099                 skb_shinfo(skb)->frag_list = NULL;
1100
1101                 /* Queue all fragments atomically */
1102                 spin_lock_bh(&conn->data_q.lock);
1103
1104                 __skb_queue_tail(&conn->data_q, skb);
1105                 do {
1106                         skb = list; list = list->next;
1107
1108                         skb->dev = (void *) hdev;
1109                         skb->pkt_type = HCI_ACLDATA_PKT;
1110                         hci_add_acl_hdr(skb, conn->handle, flags | ACL_CONT);
1111
1112                         BT_DBG("%s frag %p len %d", hdev->name, skb, skb->len);
1113
1114                         __skb_queue_tail(&conn->data_q, skb);
1115                 } while (list);
1116
1117                 spin_unlock_bh(&conn->data_q.lock);
1118         }
1119
1120         hci_sched_tx(hdev);
1121         return 0;
1122 }
1123 EXPORT_SYMBOL(hci_send_acl);
1124
1125 /* Send SCO data */
1126 int hci_send_sco(struct hci_conn *conn, struct sk_buff *skb)
1127 {
1128         struct hci_dev *hdev = conn->hdev;
1129         struct hci_sco_hdr hdr;
1130
1131         BT_DBG("%s len %d", hdev->name, skb->len);
1132
1133         if (skb->len > hdev->sco_mtu) {
1134                 kfree_skb(skb);
1135                 return -EINVAL;
1136         }
1137
1138         hdr.handle = __cpu_to_le16(conn->handle);
1139         hdr.dlen   = skb->len;
1140
1141         skb->h.raw = skb_push(skb, HCI_SCO_HDR_SIZE);
1142         memcpy(skb->h.raw, &hdr, HCI_SCO_HDR_SIZE);
1143
1144         skb->dev = (void *) hdev;
1145         skb->pkt_type = HCI_SCODATA_PKT;
1146         skb_queue_tail(&conn->data_q, skb);
1147         hci_sched_tx(hdev);
1148         return 0;
1149 }
1150 EXPORT_SYMBOL(hci_send_sco);
1151
1152 /* ---- HCI TX task (outgoing data) ---- */
1153
1154 /* HCI Connection scheduler */
1155 static inline struct hci_conn *hci_low_sent(struct hci_dev *hdev, __u8 type, int *quote)
1156 {
1157         struct hci_conn_hash *h = &hdev->conn_hash;
1158         struct hci_conn  *conn = NULL;
1159         int num = 0, min = ~0;
1160         struct list_head *p;
1161
1162         /* We don't have to lock device here. Connections are always
1163          * added and removed with TX task disabled. */
1164         list_for_each(p, &h->list) {
1165                 struct hci_conn *c;
1166                 c = list_entry(p, struct hci_conn, list);
1167
1168                 if (c->type != type || c->state != BT_CONNECTED
1169                                 || skb_queue_empty(&c->data_q))
1170                         continue;
1171                 num++;
1172
1173                 if (c->sent < min) {
1174                         min  = c->sent;
1175                         conn = c;
1176                 }
1177         }
1178
1179         if (conn) {
1180                 int cnt = (type == ACL_LINK ? hdev->acl_cnt : hdev->sco_cnt);
1181                 int q = cnt / num;
1182                 *quote = q ? q : 1;
1183         } else
1184                 *quote = 0;
1185
1186         BT_DBG("conn %p quote %d", conn, *quote);
1187         return conn;
1188 }
1189
1190 static inline void hci_acl_tx_to(struct hci_dev *hdev)
1191 {
1192         struct hci_conn_hash *h = &hdev->conn_hash;
1193         struct list_head *p;
1194         struct hci_conn  *c;
1195
1196         BT_ERR("%s ACL tx timeout", hdev->name);
1197
1198         /* Kill stalled connections */
1199         list_for_each(p, &h->list) {
1200                 c = list_entry(p, struct hci_conn, list);
1201                 if (c->type == ACL_LINK && c->sent) {
1202                         BT_ERR("%s killing stalled ACL connection %s",
1203                                 hdev->name, batostr(&c->dst));
1204                         hci_acl_disconn(c, 0x13);
1205                 }
1206         }
1207 }
1208
1209 static inline void hci_sched_acl(struct hci_dev *hdev)
1210 {
1211         struct hci_conn *conn;
1212         struct sk_buff *skb;
1213         int quote;
1214
1215         BT_DBG("%s", hdev->name);
1216
1217         if (!test_bit(HCI_RAW, &hdev->flags)) {
1218                 /* ACL tx timeout must be longer than maximum
1219                  * link supervision timeout (40.9 seconds) */
1220                 if (!hdev->acl_cnt && (jiffies - hdev->acl_last_tx) > (HZ * 45))
1221                         hci_acl_tx_to(hdev);
1222         }
1223
1224         while (hdev->acl_cnt && (conn = hci_low_sent(hdev, ACL_LINK, &quote))) {
1225                 while (quote-- && (skb = skb_dequeue(&conn->data_q))) {
1226                         BT_DBG("skb %p len %d", skb, skb->len);
1227                         hci_send_frame(skb);
1228                         hdev->acl_last_tx = jiffies;
1229
1230                         hdev->acl_cnt--;
1231                         conn->sent++;
1232                 }
1233         }
1234 }
1235
1236 /* Schedule SCO */
1237 static inline void hci_sched_sco(struct hci_dev *hdev)
1238 {
1239         struct hci_conn *conn;
1240         struct sk_buff *skb;
1241         int quote;
1242
1243         BT_DBG("%s", hdev->name);
1244
1245         while (hdev->sco_cnt && (conn = hci_low_sent(hdev, SCO_LINK, &quote))) {
1246                 while (quote-- && (skb = skb_dequeue(&conn->data_q))) {
1247                         BT_DBG("skb %p len %d", skb, skb->len);
1248                         hci_send_frame(skb);
1249
1250                         conn->sent++;
1251                         if (conn->sent == ~0)
1252                                 conn->sent = 0;
1253                 }
1254         }
1255 }
1256
1257 static void hci_tx_task(unsigned long arg)
1258 {
1259         struct hci_dev *hdev = (struct hci_dev *) arg;
1260         struct sk_buff *skb;
1261
1262         read_lock(&hci_task_lock);
1263
1264         BT_DBG("%s acl %d sco %d", hdev->name, hdev->acl_cnt, hdev->sco_cnt);
1265
1266         /* Schedule queues and send stuff to HCI driver */
1267
1268         hci_sched_acl(hdev);
1269
1270         hci_sched_sco(hdev);
1271
1272         /* Send next queued raw (unknown type) packet */
1273         while ((skb = skb_dequeue(&hdev->raw_q)))
1274                 hci_send_frame(skb);
1275
1276         read_unlock(&hci_task_lock);
1277 }
1278
1279 /* ----- HCI RX task (incoming data proccessing) ----- */
1280
1281 /* ACL data packet */
1282 static inline void hci_acldata_packet(struct hci_dev *hdev, struct sk_buff *skb)
1283 {
1284         struct hci_acl_hdr *hdr = (void *) skb->data;
1285         struct hci_conn *conn;
1286         __u16 handle, flags;
1287
1288         skb_pull(skb, HCI_ACL_HDR_SIZE);
1289
1290         handle = __le16_to_cpu(hdr->handle);
1291         flags  = hci_flags(handle);
1292         handle = hci_handle(handle);
1293
1294         BT_DBG("%s len %d handle 0x%x flags 0x%x", hdev->name, skb->len, handle, flags);
1295
1296         hdev->stat.acl_rx++;
1297
1298         hci_dev_lock(hdev);
1299         conn = hci_conn_hash_lookup_handle(hdev, handle);
1300         hci_dev_unlock(hdev);
1301
1302         if (conn) {
1303                 register struct hci_proto *hp;
1304
1305                 /* Send to upper protocol */
1306                 if ((hp = hci_proto[HCI_PROTO_L2CAP]) && hp->recv_acldata) {
1307                         hp->recv_acldata(conn, skb, flags);
1308                         return;
1309                 }
1310         } else {
1311                 BT_ERR("%s ACL packet for unknown connection handle %d",
1312                         hdev->name, handle);
1313         }
1314
1315         kfree_skb(skb);
1316 }
1317
1318 /* SCO data packet */
1319 static inline void hci_scodata_packet(struct hci_dev *hdev, struct sk_buff *skb)
1320 {
1321         struct hci_sco_hdr *hdr = (void *) skb->data;
1322         struct hci_conn *conn;
1323         __u16 handle;
1324
1325         skb_pull(skb, HCI_SCO_HDR_SIZE);
1326
1327         handle = __le16_to_cpu(hdr->handle);
1328
1329         BT_DBG("%s len %d handle 0x%x", hdev->name, skb->len, handle);
1330
1331         hdev->stat.sco_rx++;
1332
1333         hci_dev_lock(hdev);
1334         conn = hci_conn_hash_lookup_handle(hdev, handle);
1335         hci_dev_unlock(hdev);
1336
1337         if (conn) {
1338                 register struct hci_proto *hp;
1339
1340                 /* Send to upper protocol */
1341                 if ((hp = hci_proto[HCI_PROTO_SCO]) && hp->recv_scodata) {
1342                         hp->recv_scodata(conn, skb);
1343                         return;
1344                 }
1345         } else {
1346                 BT_ERR("%s SCO packet for unknown connection handle %d",
1347                         hdev->name, handle);
1348         }
1349
1350         kfree_skb(skb);
1351 }
1352
1353 void hci_rx_task(unsigned long arg)
1354 {
1355         struct hci_dev *hdev = (struct hci_dev *) arg;
1356         struct sk_buff *skb;
1357
1358         BT_DBG("%s", hdev->name);
1359
1360         read_lock(&hci_task_lock);
1361
1362         while ((skb = skb_dequeue(&hdev->rx_q))) {
1363                 if (atomic_read(&hdev->promisc)) {
1364                         /* Send copy to the sockets */
1365                         hci_send_to_sock(hdev, skb);
1366                 }
1367
1368                 if (test_bit(HCI_RAW, &hdev->flags)) {
1369                         kfree_skb(skb);
1370                         continue;
1371                 }
1372
1373                 if (test_bit(HCI_INIT, &hdev->flags)) {
1374                         /* Don't process data packets in this states. */
1375                         switch (skb->pkt_type) {
1376                         case HCI_ACLDATA_PKT:
1377                         case HCI_SCODATA_PKT:
1378                                 kfree_skb(skb);
1379                                 continue;
1380                         };
1381                 }
1382
1383                 /* Process frame */
1384                 switch (skb->pkt_type) {
1385                 case HCI_EVENT_PKT:
1386                         hci_event_packet(hdev, skb);
1387                         break;
1388
1389                 case HCI_ACLDATA_PKT:
1390                         BT_DBG("%s ACL data packet", hdev->name);
1391                         hci_acldata_packet(hdev, skb);
1392                         break;
1393
1394                 case HCI_SCODATA_PKT:
1395                         BT_DBG("%s SCO data packet", hdev->name);
1396                         hci_scodata_packet(hdev, skb);
1397                         break;
1398
1399                 default:
1400                         kfree_skb(skb);
1401                         break;
1402                 }
1403         }
1404
1405         read_unlock(&hci_task_lock);
1406 }
1407
1408 static void hci_cmd_task(unsigned long arg)
1409 {
1410         struct hci_dev *hdev = (struct hci_dev *) arg;
1411         struct sk_buff *skb;
1412
1413         BT_DBG("%s cmd %d", hdev->name, atomic_read(&hdev->cmd_cnt));
1414
1415         if (!atomic_read(&hdev->cmd_cnt) && (jiffies - hdev->cmd_last_tx) > HZ) {
1416                 BT_ERR("%s command tx timeout", hdev->name);
1417                 atomic_set(&hdev->cmd_cnt, 1);
1418         }
1419
1420         /* Send queued commands */
1421         if (atomic_read(&hdev->cmd_cnt) && (skb = skb_dequeue(&hdev->cmd_q))) {
1422                 if (hdev->sent_cmd)
1423                         kfree_skb(hdev->sent_cmd);
1424
1425                 if ((hdev->sent_cmd = skb_clone(skb, GFP_ATOMIC))) {
1426                         atomic_dec(&hdev->cmd_cnt);
1427                         hci_send_frame(skb);
1428                         hdev->cmd_last_tx = jiffies;
1429                 } else {
1430                         skb_queue_head(&hdev->cmd_q, skb);
1431                         hci_sched_cmd(hdev);
1432                 }
1433         }
1434 }