projects / GitHub / mt8127 / android_kernel_alcatel_ttab.git / blame
? search:
summary | shortlog | log | commit | commitdiff | tree
blob | blame (incremental) | history | HEAD
bluetooth: CONWISE Technology based adapters with buggy SCO support (bugzilla #9027)
[GitHub/mt8127/android_kernel_alcatel_ttab.git] / net / bluetooth / hci_core.c
CommitLineData
8e87d142 1/*
1da177e4
LT		 2 BlueZ - Bluetooth protocol stack for Linux
3 Copyright (C) 2000-2001 Qualcomm Incorporated
4
5 Written 2000,2001 by Maxim Krasnyansky <maxk@qualcomm.com>
6
7 This program is free software; you can redistribute it and/or modify
8 it under the terms of the GNU General Public License version 2 as
9 published by the Free Software Foundation;
10
11 THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
12 OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
13 FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
14 IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
8e87d142
YH		 15 CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
16 WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
17 ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
1da177e4
LT		 18 OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
19
8e87d142
YH		 20 ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
21 COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
1da177e4
LT		 22 SOFTWARE IS DISCLAIMED.
23*/
24
25/* Bluetooth HCI core. */
26
82453021 27#include <linux/jiffies.h>
1da177e4
LT		 28#include <linux/module.h>
29#include <linux/kmod.h>
30
31#include <linux/types.h>
32#include <linux/errno.h>
33#include <linux/kernel.h>
1da177e4
LT		 34#include <linux/sched.h>
35#include <linux/slab.h>
36#include <linux/poll.h>
37#include <linux/fcntl.h>
38#include <linux/init.h>
39#include <linux/skbuff.h>
40#include <linux/interrupt.h>
41#include <linux/notifier.h>
42#include <net/sock.h>
43
44#include <asm/system.h>
45#include <asm/uaccess.h>
46#include <asm/unaligned.h>
47
48#include <net/bluetooth/bluetooth.h>
49#include <net/bluetooth/hci_core.h>
50
51#ifndef CONFIG_BT_HCI_CORE_DEBUG
52#undef BT_DBG
53#define BT_DBG(D...)
54#endif
55
56static void hci_cmd_task(unsigned long arg);
57static void hci_rx_task(unsigned long arg);
58static void hci_tx_task(unsigned long arg);
59static void hci_notify(struct hci_dev *hdev, int event);
60
61static DEFINE_RWLOCK(hci_task_lock);
62
63/* HCI device list */
64LIST_HEAD(hci_dev_list);
65DEFINE_RWLOCK(hci_dev_list_lock);
66
67/* HCI callback list */
68LIST_HEAD(hci_cb_list);
69DEFINE_RWLOCK(hci_cb_list_lock);
70
71/* HCI protocols */
72#define HCI_MAX_PROTO 2
73struct hci_proto *hci_proto[HCI_MAX_PROTO];
74
75/* HCI notifiers list */
e041c683 76static ATOMIC_NOTIFIER_HEAD(hci_notifier);
1da177e4
LT		 77
78/* ---- HCI notifications ---- */
79
80int hci_register_notifier(struct notifier_block *nb)
81{
e041c683 82 return atomic_notifier_chain_register(&hci_notifier, nb);
1da177e4
LT		 83}
84
85int hci_unregister_notifier(struct notifier_block *nb)
86{
e041c683 87 return atomic_notifier_chain_unregister(&hci_notifier, nb);
1da177e4
LT		 88}
89
6516455d 90static void hci_notify(struct hci_dev *hdev, int event)
1da177e4 91{
e041c683 92 atomic_notifier_call_chain(&hci_notifier, event, hdev);
1da177e4
LT		 93}
94
95/* ---- HCI requests ---- */
96
97void hci_req_complete(struct hci_dev *hdev, int result)
98{
99 BT_DBG("%s result 0x%2.2x", hdev->name, result);
100
101 if (hdev->req_status == HCI_REQ_PEND) {
102 hdev->req_result = result;
103 hdev->req_status = HCI_REQ_DONE;
104 wake_up_interruptible(&hdev->req_wait_q);
105 }
106}
107
108static void hci_req_cancel(struct hci_dev *hdev, int err)
109{
110 BT_DBG("%s err 0x%2.2x", hdev->name, err);
111
112 if (hdev->req_status == HCI_REQ_PEND) {
113 hdev->req_result = err;
114 hdev->req_status = HCI_REQ_CANCELED;
115 wake_up_interruptible(&hdev->req_wait_q);
116 }
117}
118
119/* Execute request and wait for completion. */
8e87d142 120static int __hci_request(struct hci_dev *hdev, void (*req)(struct hci_dev *hdev, unsigned long opt),
1da177e4
LT		 121 unsigned long opt, __u32 timeout)
122{
123 DECLARE_WAITQUEUE(wait, current);
124 int err = 0;
125
126 BT_DBG("%s start", hdev->name);
127
128 hdev->req_status = HCI_REQ_PEND;
129
130 add_wait_queue(&hdev->req_wait_q, &wait);
131 set_current_state(TASK_INTERRUPTIBLE);
132
133 req(hdev, opt);
134 schedule_timeout(timeout);
135
136 remove_wait_queue(&hdev->req_wait_q, &wait);
137
138 if (signal_pending(current))
139 return -EINTR;
140
141 switch (hdev->req_status) {
142 case HCI_REQ_DONE:
143 err = -bt_err(hdev->req_result);
144 break;
145
146 case HCI_REQ_CANCELED:
147 err = -hdev->req_result;
148 break;
149
150 default:
151 err = -ETIMEDOUT;
152 break;
3ff50b79 153 }
1da177e4
LT		 154
155 hdev->req_status = hdev->req_result = 0;
156
157 BT_DBG("%s end: err %d", hdev->name, err);
158
159 return err;
160}
161
162static inline int hci_request(struct hci_dev *hdev, void (*req)(struct hci_dev *hdev, unsigned long opt),
163 unsigned long opt, __u32 timeout)
164{
165 int ret;
166
167 /* Serialize all requests */
168 hci_req_lock(hdev);
169 ret = __hci_request(hdev, req, opt, timeout);
170 hci_req_unlock(hdev);
171
172 return ret;
173}
174
175static void hci_reset_req(struct hci_dev *hdev, unsigned long opt)
176{
177 BT_DBG("%s %ld", hdev->name, opt);
178
179 /* Reset device */
a9de9248 180 hci_send_cmd(hdev, HCI_OP_RESET, 0, NULL);
1da177e4
LT		 181}
182
183static void hci_init_req(struct hci_dev *hdev, unsigned long opt)
184{
185 struct sk_buff *skb;
1ebb9252 186 __le16 param;
89f2783d 187 __u8 flt_type;
1da177e4
LT		 188
189 BT_DBG("%s %ld", hdev->name, opt);
190
191 /* Driver initialization */
192
193 /* Special commands */
194 while ((skb = skb_dequeue(&hdev->driver_init))) {
0d48d939 195 bt_cb(skb)->pkt_type = HCI_COMMAND_PKT;
1da177e4
LT		 196 skb->dev = (void *) hdev;
197 skb_queue_tail(&hdev->cmd_q, skb);
198 hci_sched_cmd(hdev);
199 }
200 skb_queue_purge(&hdev->driver_init);
201
202 /* Mandatory initialization */
203
204 /* Reset */
205 if (test_bit(HCI_QUIRK_RESET_ON_INIT, &hdev->quirks))
a9de9248 206 hci_send_cmd(hdev, HCI_OP_RESET, 0, NULL);
1da177e4
LT		 207
208 /* Read Local Supported Features */
a9de9248 209 hci_send_cmd(hdev, HCI_OP_READ_LOCAL_FEATURES, 0, NULL);
1da177e4 210
1143e5a6 211 /* Read Local Version */
a9de9248 212 hci_send_cmd(hdev, HCI_OP_READ_LOCAL_VERSION, 0, NULL);
1143e5a6 213
1da177e4 214 /* Read Buffer Size (ACL mtu, max pkt, etc.) */
a9de9248 215 hci_send_cmd(hdev, HCI_OP_READ_BUFFER_SIZE, 0, NULL);
1da177e4
LT		 216
217#if 0
218 /* Host buffer size */
219 {
220 struct hci_cp_host_buffer_size cp;
aca3192c 221 cp.acl_mtu = cpu_to_le16(HCI_MAX_ACL_SIZE);
1da177e4 222 cp.sco_mtu = HCI_MAX_SCO_SIZE;
aca3192c
YH		 223 cp.acl_max_pkt = cpu_to_le16(0xffff);
224 cp.sco_max_pkt = cpu_to_le16(0xffff);
a9de9248 225 hci_send_cmd(hdev, HCI_OP_HOST_BUFFER_SIZE, sizeof(cp), &cp);
1da177e4
LT		 226 }
227#endif
228
229 /* Read BD Address */
a9de9248
MH		 230 hci_send_cmd(hdev, HCI_OP_READ_BD_ADDR, 0, NULL);
231
232 /* Read Class of Device */
233 hci_send_cmd(hdev, HCI_OP_READ_CLASS_OF_DEV, 0, NULL);
234
235 /* Read Local Name */
236 hci_send_cmd(hdev, HCI_OP_READ_LOCAL_NAME, 0, NULL);
1da177e4
LT		 237
238 /* Read Voice Setting */
a9de9248 239 hci_send_cmd(hdev, HCI_OP_READ_VOICE_SETTING, 0, NULL);
1da177e4
LT		 240
241 /* Optional initialization */
242
243 /* Clear Event Filters */
89f2783d 244 flt_type = HCI_FLT_CLEAR_ALL;
a9de9248 245 hci_send_cmd(hdev, HCI_OP_SET_EVENT_FLT, 1, &flt_type);
1da177e4
LT		 246
247 /* Page timeout ~20 secs */
aca3192c 248 param = cpu_to_le16(0x8000);
a9de9248 249 hci_send_cmd(hdev, HCI_OP_WRITE_PG_TIMEOUT, 2, &param);
1da177e4
LT		 250
251 /* Connection accept timeout ~20 secs */
aca3192c 252 param = cpu_to_le16(0x7d00);
a9de9248 253 hci_send_cmd(hdev, HCI_OP_WRITE_CA_TIMEOUT, 2, &param);
1da177e4
LT		 254}
255
256static void hci_scan_req(struct hci_dev *hdev, unsigned long opt)
257{
258 __u8 scan = opt;
259
260 BT_DBG("%s %x", hdev->name, scan);
261
262 /* Inquiry and Page scans */
a9de9248 263 hci_send_cmd(hdev, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan);
1da177e4
LT		 264}
265
266static void hci_auth_req(struct hci_dev *hdev, unsigned long opt)
267{
268 __u8 auth = opt;
269
270 BT_DBG("%s %x", hdev->name, auth);
271
272 /* Authentication */
a9de9248 273 hci_send_cmd(hdev, HCI_OP_WRITE_AUTH_ENABLE, 1, &auth);
1da177e4
LT		 274}
275
276static void hci_encrypt_req(struct hci_dev *hdev, unsigned long opt)
277{
278 __u8 encrypt = opt;
279
280 BT_DBG("%s %x", hdev->name, encrypt);
281
282 /* Authentication */
a9de9248 283 hci_send_cmd(hdev, HCI_OP_WRITE_ENCRYPT_MODE, 1, &encrypt);
1da177e4
LT		 284}
285
8e87d142 286/* Get HCI device by index.
1da177e4
LT		 287 * Device is held on return. */
288struct hci_dev *hci_dev_get(int index)
289{
290 struct hci_dev *hdev = NULL;
291 struct list_head *p;
292
293 BT_DBG("%d", index);
294
295 if (index < 0)
296 return NULL;
297
298 read_lock(&hci_dev_list_lock);
299 list_for_each(p, &hci_dev_list) {
300 struct hci_dev *d = list_entry(p, struct hci_dev, list);
301 if (d->id == index) {
302 hdev = hci_dev_hold(d);
303 break;
304 }
305 }
306 read_unlock(&hci_dev_list_lock);
307 return hdev;
308}
1da177e4
LT		 309
310/* ---- Inquiry support ---- */
311static void inquiry_cache_flush(struct hci_dev *hdev)
312{
313 struct inquiry_cache *cache = &hdev->inq_cache;
314 struct inquiry_entry *next = cache->list, *e;
315
316 BT_DBG("cache %p", cache);
317
318 cache->list = NULL;
319 while ((e = next)) {
320 next = e->next;
321 kfree(e);
322 }
323}
324
325struct inquiry_entry *hci_inquiry_cache_lookup(struct hci_dev *hdev, bdaddr_t *bdaddr)
326{
327 struct inquiry_cache *cache = &hdev->inq_cache;
328 struct inquiry_entry *e;
329
330 BT_DBG("cache %p, %s", cache, batostr(bdaddr));
331
332 for (e = cache->list; e; e = e->next)
333 if (!bacmp(&e->data.bdaddr, bdaddr))
334 break;
335 return e;
336}
337
338void hci_inquiry_cache_update(struct hci_dev *hdev, struct inquiry_data *data)
339{
340 struct inquiry_cache *cache = &hdev->inq_cache;
341 struct inquiry_entry *e;
342
343 BT_DBG("cache %p, %s", cache, batostr(&data->bdaddr));
344
345 if (!(e = hci_inquiry_cache_lookup(hdev, &data->bdaddr))) {
346 /* Entry not in the cache. Add new one. */
25ea6db0 347 if (!(e = kzalloc(sizeof(struct inquiry_entry), GFP_ATOMIC)))
1da177e4 348 return;
1da177e4
LT		 349 e->next = cache->list;
350 cache->list = e;
351 }
352
353 memcpy(&e->data, data, sizeof(*data));
354 e->timestamp = jiffies;
355 cache->timestamp = jiffies;
356}
357
358static int inquiry_cache_dump(struct hci_dev *hdev, int num, __u8 *buf)
359{
360 struct inquiry_cache *cache = &hdev->inq_cache;
361 struct inquiry_info *info = (struct inquiry_info *) buf;
362 struct inquiry_entry *e;
363 int copied = 0;
364
365 for (e = cache->list; e && copied < num; e = e->next, copied++) {
366 struct inquiry_data *data = &e->data;
367 bacpy(&info->bdaddr, &data->bdaddr);
368 info->pscan_rep_mode = data->pscan_rep_mode;
369 info->pscan_period_mode = data->pscan_period_mode;
370 info->pscan_mode = data->pscan_mode;
371 memcpy(info->dev_class, data->dev_class, 3);
372 info->clock_offset = data->clock_offset;
373 info++;
374 }
375
376 BT_DBG("cache %p, copied %d", cache, copied);
377 return copied;
378}
379
380static void hci_inq_req(struct hci_dev *hdev, unsigned long opt)
381{
382 struct hci_inquiry_req *ir = (struct hci_inquiry_req *) opt;
383 struct hci_cp_inquiry cp;
384
385 BT_DBG("%s", hdev->name);
386
387 if (test_bit(HCI_INQUIRY, &hdev->flags))
388 return;
389
390 /* Start Inquiry */
391 memcpy(&cp.lap, &ir->lap, 3);
392 cp.length = ir->length;
393 cp.num_rsp = ir->num_rsp;
a9de9248 394 hci_send_cmd(hdev, HCI_OP_INQUIRY, sizeof(cp), &cp);
1da177e4
LT		 395}
396
397int hci_inquiry(void __user *arg)
398{
399 __u8 __user *ptr = arg;
400 struct hci_inquiry_req ir;
401 struct hci_dev *hdev;
402 int err = 0, do_inquiry = 0, max_rsp;
403 long timeo;
404 __u8 *buf;
405
406 if (copy_from_user(&ir, ptr, sizeof(ir)))
407 return -EFAULT;
408
409 if (!(hdev = hci_dev_get(ir.dev_id)))
410 return -ENODEV;
411
412 hci_dev_lock_bh(hdev);
8e87d142 413 if (inquiry_cache_age(hdev) > INQUIRY_CACHE_AGE_MAX ||
1da177e4
LT		 414 inquiry_cache_empty(hdev) ||
415 ir.flags & IREQ_CACHE_FLUSH) {
416 inquiry_cache_flush(hdev);
417 do_inquiry = 1;
418 }
419 hci_dev_unlock_bh(hdev);
420
04837f64 421 timeo = ir.length * msecs_to_jiffies(2000);
1da177e4
LT		 422 if (do_inquiry && (err = hci_request(hdev, hci_inq_req, (unsigned long)&ir, timeo)) < 0)
423 goto done;
424
425 /* for unlimited number of responses we will use buffer with 255 entries */
426 max_rsp = (ir.num_rsp == 0) ? 255 : ir.num_rsp;
427
428 /* cache_dump can't sleep. Therefore we allocate temp buffer and then
429 * copy it to the user space.
430 */
431 if (!(buf = kmalloc(sizeof(struct inquiry_info) * max_rsp, GFP_KERNEL))) {
432 err = -ENOMEM;
433 goto done;
434 }
435
436 hci_dev_lock_bh(hdev);
437 ir.num_rsp = inquiry_cache_dump(hdev, max_rsp, buf);
438 hci_dev_unlock_bh(hdev);
439
440 BT_DBG("num_rsp %d", ir.num_rsp);
441
442 if (!copy_to_user(ptr, &ir, sizeof(ir))) {
443 ptr += sizeof(ir);
444 if (copy_to_user(ptr, buf, sizeof(struct inquiry_info) *
445 ir.num_rsp))
446 err = -EFAULT;
8e87d142 447 } else
1da177e4
LT		 448 err = -EFAULT;
449
450 kfree(buf);
451
452done:
453 hci_dev_put(hdev);
454 return err;
455}
456
457/* ---- HCI ioctl helpers ---- */
458
459int hci_dev_open(__u16 dev)
460{
461 struct hci_dev *hdev;
462 int ret = 0;
463
464 if (!(hdev = hci_dev_get(dev)))
465 return -ENODEV;
466
467 BT_DBG("%s %p", hdev->name, hdev);
468
469 hci_req_lock(hdev);
470
471 if (test_bit(HCI_UP, &hdev->flags)) {
472 ret = -EALREADY;
473 goto done;
474 }
475
476 if (test_bit(HCI_QUIRK_RAW_DEVICE, &hdev->quirks))
477 set_bit(HCI_RAW, &hdev->flags);
478
479 if (hdev->open(hdev)) {
480 ret = -EIO;
481 goto done;
482 }
483
484 if (!test_bit(HCI_RAW, &hdev->flags)) {
485 atomic_set(&hdev->cmd_cnt, 1);
486 set_bit(HCI_INIT, &hdev->flags);
487
488 //__hci_request(hdev, hci_reset_req, 0, HZ);
04837f64
MH		 489 ret = __hci_request(hdev, hci_init_req, 0,
490 msecs_to_jiffies(HCI_INIT_TIMEOUT));
1da177e4
LT		 491
492 clear_bit(HCI_INIT, &hdev->flags);
493 }
494
495 if (!ret) {
496 hci_dev_hold(hdev);
497 set_bit(HCI_UP, &hdev->flags);
498 hci_notify(hdev, HCI_DEV_UP);
8e87d142 499 } else {
1da177e4
LT		 500 /* Init failed, cleanup */
501 tasklet_kill(&hdev->rx_task);
502 tasklet_kill(&hdev->tx_task);
503 tasklet_kill(&hdev->cmd_task);
504
505 skb_queue_purge(&hdev->cmd_q);
506 skb_queue_purge(&hdev->rx_q);
507
508 if (hdev->flush)
509 hdev->flush(hdev);
510
511 if (hdev->sent_cmd) {
512 kfree_skb(hdev->sent_cmd);
513 hdev->sent_cmd = NULL;
514 }
515
516 hdev->close(hdev);
517 hdev->flags = 0;
518 }
519
520done:
521 hci_req_unlock(hdev);
522 hci_dev_put(hdev);
523 return ret;
524}
525
526static int hci_dev_do_close(struct hci_dev *hdev)
527{
528 BT_DBG("%s %p", hdev->name, hdev);
529
530 hci_req_cancel(hdev, ENODEV);
531 hci_req_lock(hdev);
532
533 if (!test_and_clear_bit(HCI_UP, &hdev->flags)) {
534 hci_req_unlock(hdev);
535 return 0;
536 }
537
538 /* Kill RX and TX tasks */
539 tasklet_kill(&hdev->rx_task);
540 tasklet_kill(&hdev->tx_task);
541
542 hci_dev_lock_bh(hdev);
543 inquiry_cache_flush(hdev);
544 hci_conn_hash_flush(hdev);
545 hci_dev_unlock_bh(hdev);
546
547 hci_notify(hdev, HCI_DEV_DOWN);
548
549 if (hdev->flush)
550 hdev->flush(hdev);
551
552 /* Reset device */
553 skb_queue_purge(&hdev->cmd_q);
554 atomic_set(&hdev->cmd_cnt, 1);
555 if (!test_bit(HCI_RAW, &hdev->flags)) {
556 set_bit(HCI_INIT, &hdev->flags);
04837f64
MH		 557 __hci_request(hdev, hci_reset_req, 0,
558 msecs_to_jiffies(250));
1da177e4
LT		 559 clear_bit(HCI_INIT, &hdev->flags);
560 }
561
562 /* Kill cmd task */
563 tasklet_kill(&hdev->cmd_task);
564
565 /* Drop queues */
566 skb_queue_purge(&hdev->rx_q);
567 skb_queue_purge(&hdev->cmd_q);
568 skb_queue_purge(&hdev->raw_q);
569
570 /* Drop last sent command */
571 if (hdev->sent_cmd) {
572 kfree_skb(hdev->sent_cmd);
573 hdev->sent_cmd = NULL;
574 }
575
576 /* After this point our queues are empty
577 * and no tasks are scheduled. */
578 hdev->close(hdev);
579
580 /* Clear flags */
581 hdev->flags = 0;
582
583 hci_req_unlock(hdev);
584
585 hci_dev_put(hdev);
586 return 0;
587}
588
589int hci_dev_close(__u16 dev)
590{
591 struct hci_dev *hdev;
592 int err;
593
594 if (!(hdev = hci_dev_get(dev)))
595 return -ENODEV;
596 err = hci_dev_do_close(hdev);
597 hci_dev_put(hdev);
598 return err;
599}
600
601int hci_dev_reset(__u16 dev)
602{
603 struct hci_dev *hdev;
604 int ret = 0;
605
606 if (!(hdev = hci_dev_get(dev)))
607 return -ENODEV;
608
609 hci_req_lock(hdev);
610 tasklet_disable(&hdev->tx_task);
611
612 if (!test_bit(HCI_UP, &hdev->flags))
613 goto done;
614
615 /* Drop queues */
616 skb_queue_purge(&hdev->rx_q);
617 skb_queue_purge(&hdev->cmd_q);
618
619 hci_dev_lock_bh(hdev);
620 inquiry_cache_flush(hdev);
621 hci_conn_hash_flush(hdev);
622 hci_dev_unlock_bh(hdev);
623
624 if (hdev->flush)
625 hdev->flush(hdev);
626
8e87d142 627 atomic_set(&hdev->cmd_cnt, 1);
1da177e4
LT		 628 hdev->acl_cnt = 0; hdev->sco_cnt = 0;
629
630 if (!test_bit(HCI_RAW, &hdev->flags))
04837f64
MH		 631 ret = __hci_request(hdev, hci_reset_req, 0,
632 msecs_to_jiffies(HCI_INIT_TIMEOUT));
1da177e4
LT		 633
634done:
635 tasklet_enable(&hdev->tx_task);
636 hci_req_unlock(hdev);
637 hci_dev_put(hdev);
638 return ret;
639}
640
641int hci_dev_reset_stat(__u16 dev)
642{
643 struct hci_dev *hdev;
644 int ret = 0;
645
646 if (!(hdev = hci_dev_get(dev)))
647 return -ENODEV;
648
649 memset(&hdev->stat, 0, sizeof(struct hci_dev_stats));
650
651 hci_dev_put(hdev);
652
653 return ret;
654}
655
656int hci_dev_cmd(unsigned int cmd, void __user *arg)
657{
658 struct hci_dev *hdev;
659 struct hci_dev_req dr;
660 int err = 0;
661
662 if (copy_from_user(&dr, arg, sizeof(dr)))
663 return -EFAULT;
664
665 if (!(hdev = hci_dev_get(dr.dev_id)))
666 return -ENODEV;
667
668 switch (cmd) {
669 case HCISETAUTH:
04837f64
MH		 670 err = hci_request(hdev, hci_auth_req, dr.dev_opt,
671 msecs_to_jiffies(HCI_INIT_TIMEOUT));
1da177e4
LT		 672 break;
673
674 case HCISETENCRYPT:
675 if (!lmp_encrypt_capable(hdev)) {
676 err = -EOPNOTSUPP;
677 break;
678 }
679
680 if (!test_bit(HCI_AUTH, &hdev->flags)) {
681 /* Auth must be enabled first */
04837f64
MH		 682 err = hci_request(hdev, hci_auth_req, dr.dev_opt,
683 msecs_to_jiffies(HCI_INIT_TIMEOUT));
1da177e4
LT		 684 if (err)
685 break;
686 }
687
04837f64
MH		 688 err = hci_request(hdev, hci_encrypt_req, dr.dev_opt,
689 msecs_to_jiffies(HCI_INIT_TIMEOUT));
1da177e4
LT		 690 break;
691
692 case HCISETSCAN:
04837f64
MH		 693 err = hci_request(hdev, hci_scan_req, dr.dev_opt,
694 msecs_to_jiffies(HCI_INIT_TIMEOUT));
1da177e4
LT		 695 break;
696
697 case HCISETPTYPE:
698 hdev->pkt_type = (__u16) dr.dev_opt;
699 break;
700
701 case HCISETLINKPOL:
702 hdev->link_policy = (__u16) dr.dev_opt;
703 break;
704
705 case HCISETLINKMODE:
706 hdev->link_mode = ((__u16) dr.dev_opt) & (HCI_LM_MASTER | HCI_LM_ACCEPT);
707 break;
708
709 case HCISETACLMTU:
710 hdev->acl_mtu = *((__u16 *)&dr.dev_opt + 1);
711 hdev->acl_pkts = *((__u16 *)&dr.dev_opt + 0);
712 break;
713
714 case HCISETSCOMTU:
715 hdev->sco_mtu = *((__u16 *)&dr.dev_opt + 1);
716 hdev->sco_pkts = *((__u16 *)&dr.dev_opt + 0);
717 break;
718
719 default:
720 err = -EINVAL;
721 break;
722 }
723 hci_dev_put(hdev);
724 return err;
725}
726
727int hci_get_dev_list(void __user *arg)
728{
729 struct hci_dev_list_req *dl;
730 struct hci_dev_req *dr;
731 struct list_head *p;
732 int n = 0, size, err;
733 __u16 dev_num;
734
735 if (get_user(dev_num, (__u16 __user *) arg))
736 return -EFAULT;
737
738 if (!dev_num || dev_num > (PAGE_SIZE * 2) / sizeof(*dr))
739 return -EINVAL;
740
741 size = sizeof(*dl) + dev_num * sizeof(*dr);
742
743 if (!(dl = kmalloc(size, GFP_KERNEL)))
744 return -ENOMEM;
745
746 dr = dl->dev_req;
747
748 read_lock_bh(&hci_dev_list_lock);
749 list_for_each(p, &hci_dev_list) {
750 struct hci_dev *hdev;
751 hdev = list_entry(p, struct hci_dev, list);
752 (dr + n)->dev_id = hdev->id;
753 (dr + n)->dev_opt = hdev->flags;
754 if (++n >= dev_num)
755 break;
756 }
757 read_unlock_bh(&hci_dev_list_lock);
758
759 dl->dev_num = n;
760 size = sizeof(*dl) + n * sizeof(*dr);
761
762 err = copy_to_user(arg, dl, size);
763 kfree(dl);
764
765 return err ? -EFAULT : 0;
766}
767
768int hci_get_dev_info(void __user *arg)
769{
770 struct hci_dev *hdev;
771 struct hci_dev_info di;
772 int err = 0;
773
774 if (copy_from_user(&di, arg, sizeof(di)))
775 return -EFAULT;
776
777 if (!(hdev = hci_dev_get(di.dev_id)))
778 return -ENODEV;
779
780 strcpy(di.name, hdev->name);
781 di.bdaddr = hdev->bdaddr;
782 di.type = hdev->type;
783 di.flags = hdev->flags;
784 di.pkt_type = hdev->pkt_type;
785 di.acl_mtu = hdev->acl_mtu;
786 di.acl_pkts = hdev->acl_pkts;
787 di.sco_mtu = hdev->sco_mtu;
788 di.sco_pkts = hdev->sco_pkts;
789 di.link_policy = hdev->link_policy;
790 di.link_mode = hdev->link_mode;
791
792 memcpy(&di.stat, &hdev->stat, sizeof(di.stat));
793 memcpy(&di.features, &hdev->features, sizeof(di.features));
794
795 if (copy_to_user(arg, &di, sizeof(di)))
796 err = -EFAULT;
797
798 hci_dev_put(hdev);
799
800 return err;
801}
802
803/* ---- Interface to HCI drivers ---- */
804
805/* Alloc HCI device */
806struct hci_dev *hci_alloc_dev(void)
807{
808 struct hci_dev *hdev;
809
25ea6db0 810 hdev = kzalloc(sizeof(struct hci_dev), GFP_KERNEL);
1da177e4
LT		 811 if (!hdev)
812 return NULL;
813
1da177e4
LT		 814 skb_queue_head_init(&hdev->driver_init);
815
816 return hdev;
817}
818EXPORT_SYMBOL(hci_alloc_dev);
819
820/* Free HCI device */
821void hci_free_dev(struct hci_dev *hdev)
822{
823 skb_queue_purge(&hdev->driver_init);
824
a91f2e39
MH		 825 /* will free via device release */
826 put_device(&hdev->dev);
1da177e4
LT		 827}
828EXPORT_SYMBOL(hci_free_dev);
829
830/* Register HCI device */
831int hci_register_dev(struct hci_dev *hdev)
832{
833 struct list_head *head = &hci_dev_list, *p;
ef222013 834 int i, id = 0;
1da177e4
LT		 835
836 BT_DBG("%p name %s type %d owner %p", hdev, hdev->name, hdev->type, hdev->owner);
837
838 if (!hdev->open || !hdev->close || !hdev->destruct)
839 return -EINVAL;
840
841 write_lock_bh(&hci_dev_list_lock);
842
843 /* Find first available device id */
844 list_for_each(p, &hci_dev_list) {
845 if (list_entry(p, struct hci_dev, list)->id != id)
846 break;
847 head = p; id++;
848 }
8e87d142 849
1da177e4
LT		 850 sprintf(hdev->name, "hci%d", id);
851 hdev->id = id;
852 list_add(&hdev->list, head);
853
854 atomic_set(&hdev->refcnt, 1);
855 spin_lock_init(&hdev->lock);
856
857 hdev->flags = 0;
858 hdev->pkt_type = (HCI_DM1 | HCI_DH1 | HCI_HV1);
5b7f9909 859 hdev->esco_type = (ESCO_HV1);
1da177e4
LT		 860 hdev->link_mode = (HCI_LM_ACCEPT);
861
04837f64
MH		 862 hdev->idle_timeout = 0;
863 hdev->sniff_max_interval = 800;
864 hdev->sniff_min_interval = 80;
865
1da177e4
LT		 866 tasklet_init(&hdev->cmd_task, hci_cmd_task,(unsigned long) hdev);
867 tasklet_init(&hdev->rx_task, hci_rx_task, (unsigned long) hdev);
868 tasklet_init(&hdev->tx_task, hci_tx_task, (unsigned long) hdev);
869
870 skb_queue_head_init(&hdev->rx_q);
871 skb_queue_head_init(&hdev->cmd_q);
872 skb_queue_head_init(&hdev->raw_q);
873
ef222013
MH		 874 for (i = 0; i < 3; i++)
875 hdev->reassembly[i] = NULL;
876
1da177e4
LT		 877 init_waitqueue_head(&hdev->req_wait_q);
878 init_MUTEX(&hdev->req_lock);
879
880 inquiry_cache_init(hdev);
881
882 hci_conn_hash_init(hdev);
883
884 memset(&hdev->stat, 0, sizeof(struct hci_dev_stats));
885
886 atomic_set(&hdev->promisc, 0);
887
888 write_unlock_bh(&hci_dev_list_lock);
889
890 hci_register_sysfs(hdev);
891
892 hci_notify(hdev, HCI_DEV_REG);
893
894 return id;
895}
896EXPORT_SYMBOL(hci_register_dev);
897
898/* Unregister HCI device */
899int hci_unregister_dev(struct hci_dev *hdev)
900{
ef222013
MH		 901 int i;
902
1da177e4
LT		 903 BT_DBG("%p name %s type %d", hdev, hdev->name, hdev->type);
904
905 hci_unregister_sysfs(hdev);
906
907 write_lock_bh(&hci_dev_list_lock);
908 list_del(&hdev->list);
909 write_unlock_bh(&hci_dev_list_lock);
910
911 hci_dev_do_close(hdev);
912
ef222013
MH		 913 for (i = 0; i < 3; i++)
914 kfree_skb(hdev->reassembly[i]);
915
1da177e4
LT		 916 hci_notify(hdev, HCI_DEV_UNREG);
917
918 __hci_dev_put(hdev);
ef222013 919
1da177e4
LT		 920 return 0;
921}
922EXPORT_SYMBOL(hci_unregister_dev);
923
924/* Suspend HCI device */
925int hci_suspend_dev(struct hci_dev *hdev)
926{
927 hci_notify(hdev, HCI_DEV_SUSPEND);
928 return 0;
929}
930EXPORT_SYMBOL(hci_suspend_dev);
931
932/* Resume HCI device */
933int hci_resume_dev(struct hci_dev *hdev)
934{
935 hci_notify(hdev, HCI_DEV_RESUME);
936 return 0;
937}
938EXPORT_SYMBOL(hci_resume_dev);
939
ef222013
MH		 940/* Receive packet type fragment */
941#define __reassembly(hdev, type) ((hdev)->reassembly[(type) - 2])
942
943int hci_recv_fragment(struct hci_dev *hdev, int type, void *data, int count)
944{
945 if (type < HCI_ACLDATA_PKT || type > HCI_EVENT_PKT)
946 return -EILSEQ;
947
948 while (count) {
949 struct sk_buff *skb = __reassembly(hdev, type);
950 struct { int expect; } *scb;
951 int len = 0;
952
953 if (!skb) {
954 /* Start of the frame */
955
956 switch (type) {
957 case HCI_EVENT_PKT:
958 if (count >= HCI_EVENT_HDR_SIZE) {
959 struct hci_event_hdr *h = data;
960 len = HCI_EVENT_HDR_SIZE + h->plen;
961 } else
962 return -EILSEQ;
963 break;
964
965 case HCI_ACLDATA_PKT:
966 if (count >= HCI_ACL_HDR_SIZE) {
967 struct hci_acl_hdr *h = data;
968 len = HCI_ACL_HDR_SIZE + __le16_to_cpu(h->dlen);
969 } else
970 return -EILSEQ;
971 break;
972
973 case HCI_SCODATA_PKT:
974 if (count >= HCI_SCO_HDR_SIZE) {
975 struct hci_sco_hdr *h = data;
976 len = HCI_SCO_HDR_SIZE + h->dlen;
977 } else
978 return -EILSEQ;
979 break;
980 }
981
982 skb = bt_skb_alloc(len, GFP_ATOMIC);
983 if (!skb) {
984 BT_ERR("%s no memory for packet", hdev->name);
985 return -ENOMEM;
986 }
987
988 skb->dev = (void *) hdev;
989 bt_cb(skb)->pkt_type = type;
00ae02f3 990
ef222013
MH		 991 __reassembly(hdev, type) = skb;
992
993 scb = (void *) skb->cb;
994 scb->expect = len;
995 } else {
996 /* Continuation */
997
998 scb = (void *) skb->cb;
999 len = scb->expect;
1000 }
1001
1002 len = min(len, count);
1003
1004 memcpy(skb_put(skb, len), data, len);
1005
1006 scb->expect -= len;
1007
1008 if (scb->expect == 0) {
1009 /* Complete frame */
1010
1011 __reassembly(hdev, type) = NULL;
1012
1013 bt_cb(skb)->pkt_type = type;
1014 hci_recv_frame(skb);
1015 }
1016
1017 count -= len; data += len;
1018 }
1019
1020 return 0;
1021}
1022EXPORT_SYMBOL(hci_recv_fragment);
1023
1da177e4
LT		 1024/* ---- Interface to upper protocols ---- */
1025
1026/* Register/Unregister protocols.
1027 * hci_task_lock is used to ensure that no tasks are running. */
1028int hci_register_proto(struct hci_proto *hp)
1029{
1030 int err = 0;
1031
1032 BT_DBG("%p name %s id %d", hp, hp->name, hp->id);
1033
1034 if (hp->id >= HCI_MAX_PROTO)
1035 return -EINVAL;
1036
1037 write_lock_bh(&hci_task_lock);
1038
1039 if (!hci_proto[hp->id])
1040 hci_proto[hp->id] = hp;
1041 else
1042 err = -EEXIST;
1043
1044 write_unlock_bh(&hci_task_lock);
1045
1046 return err;
1047}
1048EXPORT_SYMBOL(hci_register_proto);
1049
1050int hci_unregister_proto(struct hci_proto *hp)
1051{
1052 int err = 0;
1053
1054 BT_DBG("%p name %s id %d", hp, hp->name, hp->id);
1055
1056 if (hp->id >= HCI_MAX_PROTO)
1057 return -EINVAL;
1058
1059 write_lock_bh(&hci_task_lock);
1060
1061 if (hci_proto[hp->id])
1062 hci_proto[hp->id] = NULL;
1063 else
1064 err = -ENOENT;
1065
1066 write_unlock_bh(&hci_task_lock);
1067
1068 return err;
1069}
1070EXPORT_SYMBOL(hci_unregister_proto);
1071
1072int hci_register_cb(struct hci_cb *cb)
1073{
1074 BT_DBG("%p name %s", cb, cb->name);
1075
1076 write_lock_bh(&hci_cb_list_lock);
1077 list_add(&cb->list, &hci_cb_list);
1078 write_unlock_bh(&hci_cb_list_lock);
1079
1080 return 0;
1081}
1082EXPORT_SYMBOL(hci_register_cb);
1083
1084int hci_unregister_cb(struct hci_cb *cb)
1085{
1086 BT_DBG("%p name %s", cb, cb->name);
1087
1088 write_lock_bh(&hci_cb_list_lock);
1089 list_del(&cb->list);
1090 write_unlock_bh(&hci_cb_list_lock);
1091
1092 return 0;
1093}
1094EXPORT_SYMBOL(hci_unregister_cb);
1095
1096static int hci_send_frame(struct sk_buff *skb)
1097{
1098 struct hci_dev *hdev = (struct hci_dev *) skb->dev;
1099
1100 if (!hdev) {
1101 kfree_skb(skb);
1102 return -ENODEV;
1103 }
1104
0d48d939 1105 BT_DBG("%s type %d len %d", hdev->name, bt_cb(skb)->pkt_type, skb->len);
1da177e4
LT		 1106
1107 if (atomic_read(&hdev->promisc)) {
1108 /* Time stamp */
a61bbcf2 1109 __net_timestamp(skb);
1da177e4
LT		 1110
1111 hci_send_to_sock(hdev, skb);
1112 }
1113
1114 /* Get rid of skb owner, prior to sending to the driver. */
1115 skb_orphan(skb);
1116
1117 return hdev->send(skb);
1118}
1119
1120/* Send HCI command */
a9de9248 1121int hci_send_cmd(struct hci_dev *hdev, __u16 opcode, __u32 plen, void *param)
1da177e4
LT		 1122{
1123 int len = HCI_COMMAND_HDR_SIZE + plen;
1124 struct hci_command_hdr *hdr;
1125 struct sk_buff *skb;
1126
a9de9248 1127 BT_DBG("%s opcode 0x%x plen %d", hdev->name, opcode, plen);
1da177e4
LT		 1128
1129 skb = bt_skb_alloc(len, GFP_ATOMIC);
1130 if (!skb) {
ef222013 1131 BT_ERR("%s no memory for command", hdev->name);
1da177e4
LT		 1132 return -ENOMEM;
1133 }
1134
1135 hdr = (struct hci_command_hdr *) skb_put(skb, HCI_COMMAND_HDR_SIZE);
a9de9248 1136 hdr->opcode = cpu_to_le16(opcode);
1da177e4
LT		 1137 hdr->plen = plen;
1138
1139 if (plen)
1140 memcpy(skb_put(skb, plen), param, plen);
1141
1142 BT_DBG("skb len %d", skb->len);
1143
0d48d939 1144 bt_cb(skb)->pkt_type = HCI_COMMAND_PKT;
1da177e4
LT		 1145 skb->dev = (void *) hdev;
1146 skb_queue_tail(&hdev->cmd_q, skb);
1147 hci_sched_cmd(hdev);
1148
1149 return 0;
1150}
1da177e4
LT		 1151
1152/* Get data from the previously sent command */
a9de9248 1153void *hci_sent_cmd_data(struct hci_dev *hdev, __u16 opcode)
1da177e4
LT		 1154{
1155 struct hci_command_hdr *hdr;
1156
1157 if (!hdev->sent_cmd)
1158 return NULL;
1159
1160 hdr = (void *) hdev->sent_cmd->data;
1161
a9de9248 1162 if (hdr->opcode != cpu_to_le16(opcode))
1da177e4
LT		 1163 return NULL;
1164
a9de9248 1165 BT_DBG("%s opcode 0x%x", hdev->name, opcode);
1da177e4
LT		 1166
1167 return hdev->sent_cmd->data + HCI_COMMAND_HDR_SIZE;
1168}
1169
1170/* Send ACL data */
1171static void hci_add_acl_hdr(struct sk_buff *skb, __u16 handle, __u16 flags)
1172{
1173 struct hci_acl_hdr *hdr;
1174 int len = skb->len;
1175
badff6d0
ACM		 1176 skb_push(skb, HCI_ACL_HDR_SIZE);
1177 skb_reset_transport_header(skb);
9c70220b 1178 hdr = (struct hci_acl_hdr *)skb_transport_header(skb);
aca3192c
YH		 1179 hdr->handle = cpu_to_le16(hci_handle_pack(handle, flags));
1180 hdr->dlen = cpu_to_le16(len);
1da177e4
LT		 1181}
1182
1183int hci_send_acl(struct hci_conn *conn, struct sk_buff *skb, __u16 flags)
1184{
1185 struct hci_dev *hdev = conn->hdev;
1186 struct sk_buff *list;
1187
1188 BT_DBG("%s conn %p flags 0x%x", hdev->name, conn, flags);
1189
1190 skb->dev = (void *) hdev;
0d48d939 1191 bt_cb(skb)->pkt_type = HCI_ACLDATA_PKT;
1da177e4
LT		 1192 hci_add_acl_hdr(skb, conn->handle, flags | ACL_START);
1193
1194 if (!(list = skb_shinfo(skb)->frag_list)) {
1195 /* Non fragmented */
1196 BT_DBG("%s nonfrag skb %p len %d", hdev->name, skb, skb->len);
1197
1198 skb_queue_tail(&conn->data_q, skb);
1199 } else {
1200 /* Fragmented */
1201 BT_DBG("%s frag %p len %d", hdev->name, skb, skb->len);
1202
1203 skb_shinfo(skb)->frag_list = NULL;
1204
1205 /* Queue all fragments atomically */
1206 spin_lock_bh(&conn->data_q.lock);
1207
1208 __skb_queue_tail(&conn->data_q, skb);
1209 do {
1210 skb = list; list = list->next;
8e87d142 1211
1da177e4 1212 skb->dev = (void *) hdev;
0d48d939 1213 bt_cb(skb)->pkt_type = HCI_ACLDATA_PKT;
1da177e4
LT		 1214 hci_add_acl_hdr(skb, conn->handle, flags | ACL_CONT);
1215
1216 BT_DBG("%s frag %p len %d", hdev->name, skb, skb->len);
1217
1218 __skb_queue_tail(&conn->data_q, skb);
1219 } while (list);
1220
1221 spin_unlock_bh(&conn->data_q.lock);
1222 }
1223
1224 hci_sched_tx(hdev);
1225 return 0;
1226}
1227EXPORT_SYMBOL(hci_send_acl);
1228
1229/* Send SCO data */
1230int hci_send_sco(struct hci_conn *conn, struct sk_buff *skb)
1231{
1232 struct hci_dev *hdev = conn->hdev;
1233 struct hci_sco_hdr hdr;
1234
1235 BT_DBG("%s len %d", hdev->name, skb->len);
1236
1237 if (skb->len > hdev->sco_mtu) {
1238 kfree_skb(skb);
1239 return -EINVAL;
1240 }
1241
aca3192c 1242 hdr.handle = cpu_to_le16(conn->handle);
1da177e4
LT		 1243 hdr.dlen = skb->len;
1244
badff6d0
ACM		 1245 skb_push(skb, HCI_SCO_HDR_SIZE);
1246 skb_reset_transport_header(skb);
9c70220b 1247 memcpy(skb_transport_header(skb), &hdr, HCI_SCO_HDR_SIZE);
1da177e4
LT		 1248
1249 skb->dev = (void *) hdev;
0d48d939 1250 bt_cb(skb)->pkt_type = HCI_SCODATA_PKT;
1da177e4
LT		 1251 skb_queue_tail(&conn->data_q, skb);
1252 hci_sched_tx(hdev);
1253 return 0;
1254}
1255EXPORT_SYMBOL(hci_send_sco);
1256
1257/* ---- HCI TX task (outgoing data) ---- */
1258
1259/* HCI Connection scheduler */
1260static inline struct hci_conn *hci_low_sent(struct hci_dev *hdev, __u8 type, int *quote)
1261{
1262 struct hci_conn_hash *h = &hdev->conn_hash;
5b7f9909 1263 struct hci_conn *conn = NULL;
1da177e4
LT		 1264 int num = 0, min = ~0;
1265 struct list_head *p;
1266
8e87d142 1267 /* We don't have to lock device here. Connections are always
1da177e4
LT		 1268 * added and removed with TX task disabled. */
1269 list_for_each(p, &h->list) {
1270 struct hci_conn *c;
1271 c = list_entry(p, struct hci_conn, list);
1272
1273 if (c->type != type || c->state != BT_CONNECTED
1274 || skb_queue_empty(&c->data_q))
1275 continue;
1276 num++;
1277
1278 if (c->sent < min) {
1279 min = c->sent;
1280 conn = c;
1281 }
1282 }
1283
1284 if (conn) {
1285 int cnt = (type == ACL_LINK ? hdev->acl_cnt : hdev->sco_cnt);
1286 int q = cnt / num;
1287 *quote = q ? q : 1;
1288 } else
1289 *quote = 0;
1290
1291 BT_DBG("conn %p quote %d", conn, *quote);
1292 return conn;
1293}
1294
1295static inline void hci_acl_tx_to(struct hci_dev *hdev)
1296{
1297 struct hci_conn_hash *h = &hdev->conn_hash;
1298 struct list_head *p;
1299 struct hci_conn *c;
1300
1301 BT_ERR("%s ACL tx timeout", hdev->name);
1302
1303 /* Kill stalled connections */
1304 list_for_each(p, &h->list) {
1305 c = list_entry(p, struct hci_conn, list);
1306 if (c->type == ACL_LINK && c->sent) {
1307 BT_ERR("%s killing stalled ACL connection %s",
1308 hdev->name, batostr(&c->dst));
1309 hci_acl_disconn(c, 0x13);
1310 }
1311 }
1312}
1313
1314static inline void hci_sched_acl(struct hci_dev *hdev)
1315{
1316 struct hci_conn *conn;
1317 struct sk_buff *skb;
1318 int quote;
1319
1320 BT_DBG("%s", hdev->name);
1321
1322 if (!test_bit(HCI_RAW, &hdev->flags)) {
1323 /* ACL tx timeout must be longer than maximum
1324 * link supervision timeout (40.9 seconds) */
82453021 1325 if (!hdev->acl_cnt && time_after(jiffies, hdev->acl_last_tx + HZ * 45))
1da177e4
LT		 1326 hci_acl_tx_to(hdev);
1327 }
1328
1329 while (hdev->acl_cnt && (conn = hci_low_sent(hdev, ACL_LINK, &quote))) {
1330 while (quote-- && (skb = skb_dequeue(&conn->data_q))) {
1331 BT_DBG("skb %p len %d", skb, skb->len);
04837f64
MH		 1332
1333 hci_conn_enter_active_mode(conn);
1334
1da177e4
LT		 1335 hci_send_frame(skb);
1336 hdev->acl_last_tx = jiffies;
1337
1338 hdev->acl_cnt--;
1339 conn->sent++;
1340 }
1341 }
1342}
1343
1344/* Schedule SCO */
1345static inline void hci_sched_sco(struct hci_dev *hdev)
1346{
1347 struct hci_conn *conn;
1348 struct sk_buff *skb;
1349 int quote;
1350
1351 BT_DBG("%s", hdev->name);
1352
1353 while (hdev->sco_cnt && (conn = hci_low_sent(hdev, SCO_LINK, &quote))) {
1354 while (quote-- && (skb = skb_dequeue(&conn->data_q))) {
1355 BT_DBG("skb %p len %d", skb, skb->len);
1356 hci_send_frame(skb);
1357
1358 conn->sent++;
1359 if (conn->sent == ~0)
1360 conn->sent = 0;
1361 }
1362 }
1363}
1364
b6a0dc82
MH		 1365static inline void hci_sched_esco(struct hci_dev *hdev)
1366{
1367 struct hci_conn *conn;
1368 struct sk_buff *skb;
1369 int quote;
1370
1371 BT_DBG("%s", hdev->name);
1372
1373 while (hdev->sco_cnt && (conn = hci_low_sent(hdev, ESCO_LINK, &quote))) {
1374 while (quote-- && (skb = skb_dequeue(&conn->data_q))) {
1375 BT_DBG("skb %p len %d", skb, skb->len);
1376 hci_send_frame(skb);
1377
1378 conn->sent++;
1379 if (conn->sent == ~0)
1380 conn->sent = 0;
1381 }
1382 }
1383}
1384
1da177e4
LT		 1385static void hci_tx_task(unsigned long arg)
1386{
1387 struct hci_dev *hdev = (struct hci_dev *) arg;
1388 struct sk_buff *skb;
1389
1390 read_lock(&hci_task_lock);
1391
1392 BT_DBG("%s acl %d sco %d", hdev->name, hdev->acl_cnt, hdev->sco_cnt);
1393
1394 /* Schedule queues and send stuff to HCI driver */
1395
1396 hci_sched_acl(hdev);
1397
1398 hci_sched_sco(hdev);
1399
b6a0dc82
MH		 1400 hci_sched_esco(hdev);
1401
1da177e4
LT		 1402 /* Send next queued raw (unknown type) packet */
1403 while ((skb = skb_dequeue(&hdev->raw_q)))
1404 hci_send_frame(skb);
1405
1406 read_unlock(&hci_task_lock);
1407}
1408
1409/* ----- HCI RX task (incoming data proccessing) ----- */
1410
1411/* ACL data packet */
1412static inline void hci_acldata_packet(struct hci_dev *hdev, struct sk_buff *skb)
1413{
1414 struct hci_acl_hdr *hdr = (void *) skb->data;
1415 struct hci_conn *conn;
1416 __u16 handle, flags;
1417
1418 skb_pull(skb, HCI_ACL_HDR_SIZE);
1419
1420 handle = __le16_to_cpu(hdr->handle);
1421 flags = hci_flags(handle);
1422 handle = hci_handle(handle);
1423
1424 BT_DBG("%s len %d handle 0x%x flags 0x%x", hdev->name, skb->len, handle, flags);
1425
1426 hdev->stat.acl_rx++;
1427
1428 hci_dev_lock(hdev);
1429 conn = hci_conn_hash_lookup_handle(hdev, handle);
1430 hci_dev_unlock(hdev);
8e87d142 1431
1da177e4
LT		 1432 if (conn) {
1433 register struct hci_proto *hp;
1434
04837f64
MH		 1435 hci_conn_enter_active_mode(conn);
1436
1da177e4
LT		 1437 /* Send to upper protocol */
1438 if ((hp = hci_proto[HCI_PROTO_L2CAP]) && hp->recv_acldata) {
1439 hp->recv_acldata(conn, skb, flags);
1440 return;
1441 }
1442 } else {
8e87d142 1443 BT_ERR("%s ACL packet for unknown connection handle %d",
1da177e4
LT		 1444 hdev->name, handle);
1445 }
1446
1447 kfree_skb(skb);
1448}
1449
1450/* SCO data packet */
1451static inline void hci_scodata_packet(struct hci_dev *hdev, struct sk_buff *skb)
1452{
1453 struct hci_sco_hdr *hdr = (void *) skb->data;
1454 struct hci_conn *conn;
1455 __u16 handle;
1456
1457 skb_pull(skb, HCI_SCO_HDR_SIZE);
1458
1459 handle = __le16_to_cpu(hdr->handle);
1460
1461 BT_DBG("%s len %d handle 0x%x", hdev->name, skb->len, handle);
1462
1463 hdev->stat.sco_rx++;
1464
1465 hci_dev_lock(hdev);
1466 conn = hci_conn_hash_lookup_handle(hdev, handle);
1467 hci_dev_unlock(hdev);
1468
1469 if (conn) {
1470 register struct hci_proto *hp;
1471
1472 /* Send to upper protocol */
1473 if ((hp = hci_proto[HCI_PROTO_SCO]) && hp->recv_scodata) {
1474 hp->recv_scodata(conn, skb);
1475 return;
1476 }
1477 } else {
8e87d142 1478 BT_ERR("%s SCO packet for unknown connection handle %d",
1da177e4
LT		 1479 hdev->name, handle);
1480 }
1481
1482 kfree_skb(skb);
1483}
1484
6516455d 1485static void hci_rx_task(unsigned long arg)
1da177e4
LT		 1486{
1487 struct hci_dev *hdev = (struct hci_dev *) arg;
1488 struct sk_buff *skb;
1489
1490 BT_DBG("%s", hdev->name);
1491
1492 read_lock(&hci_task_lock);
1493
1494 while ((skb = skb_dequeue(&hdev->rx_q))) {
1495 if (atomic_read(&hdev->promisc)) {
1496 /* Send copy to the sockets */
1497 hci_send_to_sock(hdev, skb);
1498 }
1499
1500 if (test_bit(HCI_RAW, &hdev->flags)) {
1501 kfree_skb(skb);
1502 continue;
1503 }
1504
1505 if (test_bit(HCI_INIT, &hdev->flags)) {
1506 /* Don't process data packets in this states. */
0d48d939 1507 switch (bt_cb(skb)->pkt_type) {
1da177e4
LT		 1508 case HCI_ACLDATA_PKT:
1509 case HCI_SCODATA_PKT:
1510 kfree_skb(skb);
1511 continue;
3ff50b79 1512 }
1da177e4
LT		 1513 }
1514
1515 /* Process frame */
0d48d939 1516 switch (bt_cb(skb)->pkt_type) {
1da177e4
LT		 1517 case HCI_EVENT_PKT:
1518 hci_event_packet(hdev, skb);
1519 break;
1520
1521 case HCI_ACLDATA_PKT:
1522 BT_DBG("%s ACL data packet", hdev->name);
1523 hci_acldata_packet(hdev, skb);
1524 break;
1525
1526 case HCI_SCODATA_PKT:
1527 BT_DBG("%s SCO data packet", hdev->name);
1528 hci_scodata_packet(hdev, skb);
1529 break;
1530
1531 default:
1532 kfree_skb(skb);
1533 break;
1534 }
1535 }
1536
1537 read_unlock(&hci_task_lock);
1538}
1539
1540static void hci_cmd_task(unsigned long arg)
1541{
1542 struct hci_dev *hdev = (struct hci_dev *) arg;
1543 struct sk_buff *skb;
1544
1545 BT_DBG("%s cmd %d", hdev->name, atomic_read(&hdev->cmd_cnt));
1546
82453021 1547 if (!atomic_read(&hdev->cmd_cnt) && time_after(jiffies, hdev->cmd_last_tx + HZ)) {
1da177e4
LT		 1548 BT_ERR("%s command tx timeout", hdev->name);
1549 atomic_set(&hdev->cmd_cnt, 1);
1550 }
1551
1552 /* Send queued commands */
1553 if (atomic_read(&hdev->cmd_cnt) && (skb = skb_dequeue(&hdev->cmd_q))) {
1554 if (hdev->sent_cmd)
1555 kfree_skb(hdev->sent_cmd);
1556
1557 if ((hdev->sent_cmd = skb_clone(skb, GFP_ATOMIC))) {
1558 atomic_dec(&hdev->cmd_cnt);
1559 hci_send_frame(skb);
1560 hdev->cmd_last_tx = jiffies;
1561 } else {
1562 skb_queue_head(&hdev->cmd_q, skb);
1563 hci_sched_cmd(hdev);
1564 }
1565 }
1566}
kernel source for telekom puls (alcatel/mediatek)