projects / GitHub / mt8127 / android_kernel_alcatel_ttab.git / blame
? search:
summary | shortlog | log | commit | commitdiff | tree
blob | blame (incremental) | history | HEAD
Bluetooth: Implement set_pairable managment command
[GitHub/mt8127/android_kernel_alcatel_ttab.git] / net / bluetooth / hci_core.c
CommitLineData
8e87d142 1/*
1da177e4
LT		 2 BlueZ - Bluetooth protocol stack for Linux
3 Copyright (C) 2000-2001 Qualcomm Incorporated
4
5 Written 2000,2001 by Maxim Krasnyansky <maxk@qualcomm.com>
6
7 This program is free software; you can redistribute it and/or modify
8 it under the terms of the GNU General Public License version 2 as
9 published by the Free Software Foundation;
10
11 THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
12 OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
13 FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
14 IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
8e87d142
YH		 15 CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
16 WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
17 ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
1da177e4
LT		 18 OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
19
8e87d142
YH		 20 ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
21 COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
1da177e4
LT		 22 SOFTWARE IS DISCLAIMED.
23*/
24
25/* Bluetooth HCI core. */
26
82453021 27#include <linux/jiffies.h>
1da177e4
LT		 28#include <linux/module.h>
29#include <linux/kmod.h>
30
31#include <linux/types.h>
32#include <linux/errno.h>
33#include <linux/kernel.h>
1da177e4
LT		 34#include <linux/sched.h>
35#include <linux/slab.h>
36#include <linux/poll.h>
37#include <linux/fcntl.h>
38#include <linux/init.h>
39#include <linux/skbuff.h>
f48fd9c8 40#include <linux/workqueue.h>
1da177e4
LT		 41#include <linux/interrupt.h>
42#include <linux/notifier.h>
611b30f7 43#include <linux/rfkill.h>
1da177e4
LT		 44#include <net/sock.h>
45
46#include <asm/system.h>
70f23020 47#include <linux/uaccess.h>
1da177e4
LT		 48#include <asm/unaligned.h>
49
50#include <net/bluetooth/bluetooth.h>
51#include <net/bluetooth/hci_core.h>
52
ab81cbf9
JH		 53#define AUTO_OFF_TIMEOUT 2000
54
1da177e4
LT		 55static void hci_cmd_task(unsigned long arg);
56static void hci_rx_task(unsigned long arg);
57static void hci_tx_task(unsigned long arg);
58static void hci_notify(struct hci_dev *hdev, int event);
59
60static DEFINE_RWLOCK(hci_task_lock);
61
62/* HCI device list */
63LIST_HEAD(hci_dev_list);
64DEFINE_RWLOCK(hci_dev_list_lock);
65
66/* HCI callback list */
67LIST_HEAD(hci_cb_list);
68DEFINE_RWLOCK(hci_cb_list_lock);
69
70/* HCI protocols */
71#define HCI_MAX_PROTO 2
72struct hci_proto *hci_proto[HCI_MAX_PROTO];
73
74/* HCI notifiers list */
e041c683 75static ATOMIC_NOTIFIER_HEAD(hci_notifier);
1da177e4
LT		 76
77/* ---- HCI notifications ---- */
78
79int hci_register_notifier(struct notifier_block *nb)
80{
e041c683 81 return atomic_notifier_chain_register(&hci_notifier, nb);
1da177e4
LT		 82}
83
84int hci_unregister_notifier(struct notifier_block *nb)
85{
e041c683 86 return atomic_notifier_chain_unregister(&hci_notifier, nb);
1da177e4
LT		 87}
88
6516455d 89static void hci_notify(struct hci_dev *hdev, int event)
1da177e4 90{
e041c683 91 atomic_notifier_call_chain(&hci_notifier, event, hdev);
1da177e4
LT		 92}
93
94/* ---- HCI requests ---- */
95
23bb5763 96void hci_req_complete(struct hci_dev *hdev, __u16 cmd, int result)
1da177e4 97{
23bb5763
JH		 98 BT_DBG("%s command 0x%04x result 0x%2.2x", hdev->name, cmd, result);
99
100 /* If the request has set req_last_cmd (typical for multi-HCI
101 * command requests) check if the completed command matches
102 * this, and if not just return. Single HCI command requests
103 * typically leave req_last_cmd as 0 */
104 if (hdev->req_last_cmd && cmd != hdev->req_last_cmd)
105 return;
1da177e4
LT		 106
107 if (hdev->req_status == HCI_REQ_PEND) {
108 hdev->req_result = result;
109 hdev->req_status = HCI_REQ_DONE;
110 wake_up_interruptible(&hdev->req_wait_q);
111 }
112}
113
114static void hci_req_cancel(struct hci_dev *hdev, int err)
115{
116 BT_DBG("%s err 0x%2.2x", hdev->name, err);
117
118 if (hdev->req_status == HCI_REQ_PEND) {
119 hdev->req_result = err;
120 hdev->req_status = HCI_REQ_CANCELED;
121 wake_up_interruptible(&hdev->req_wait_q);
122 }
123}
124
125/* Execute request and wait for completion. */
8e87d142 126static int __hci_request(struct hci_dev *hdev, void (*req)(struct hci_dev *hdev, unsigned long opt),
1da177e4
LT		 127 unsigned long opt, __u32 timeout)
128{
129 DECLARE_WAITQUEUE(wait, current);
130 int err = 0;
131
132 BT_DBG("%s start", hdev->name);
133
134 hdev->req_status = HCI_REQ_PEND;
135
136 add_wait_queue(&hdev->req_wait_q, &wait);
137 set_current_state(TASK_INTERRUPTIBLE);
138
139 req(hdev, opt);
140 schedule_timeout(timeout);
141
142 remove_wait_queue(&hdev->req_wait_q, &wait);
143
144 if (signal_pending(current))
145 return -EINTR;
146
147 switch (hdev->req_status) {
148 case HCI_REQ_DONE:
149 err = -bt_err(hdev->req_result);
150 break;
151
152 case HCI_REQ_CANCELED:
153 err = -hdev->req_result;
154 break;
155
156 default:
157 err = -ETIMEDOUT;
158 break;
3ff50b79 159 }
1da177e4 160
23bb5763 161 hdev->req_last_cmd = hdev->req_status = hdev->req_result = 0;
1da177e4
LT		 162
163 BT_DBG("%s end: err %d", hdev->name, err);
164
165 return err;
166}
167
168static inline int hci_request(struct hci_dev *hdev, void (*req)(struct hci_dev *hdev, unsigned long opt),
169 unsigned long opt, __u32 timeout)
170{
171 int ret;
172
7c6a329e
MH		 173 if (!test_bit(HCI_UP, &hdev->flags))
174 return -ENETDOWN;
175
1da177e4
LT		 176 /* Serialize all requests */
177 hci_req_lock(hdev);
178 ret = __hci_request(hdev, req, opt, timeout);
179 hci_req_unlock(hdev);
180
181 return ret;
182}
183
184static void hci_reset_req(struct hci_dev *hdev, unsigned long opt)
185{
186 BT_DBG("%s %ld", hdev->name, opt);
187
188 /* Reset device */
a9de9248 189 hci_send_cmd(hdev, HCI_OP_RESET, 0, NULL);
1da177e4
LT		 190}
191
192static void hci_init_req(struct hci_dev *hdev, unsigned long opt)
193{
194 struct sk_buff *skb;
1ebb9252 195 __le16 param;
89f2783d 196 __u8 flt_type;
1da177e4
LT		 197
198 BT_DBG("%s %ld", hdev->name, opt);
199
200 /* Driver initialization */
201
202 /* Special commands */
203 while ((skb = skb_dequeue(&hdev->driver_init))) {
0d48d939 204 bt_cb(skb)->pkt_type = HCI_COMMAND_PKT;
1da177e4 205 skb->dev = (void *) hdev;
c78ae283 206
1da177e4 207 skb_queue_tail(&hdev->cmd_q, skb);
c78ae283 208 tasklet_schedule(&hdev->cmd_task);
1da177e4
LT		 209 }
210 skb_queue_purge(&hdev->driver_init);
211
212 /* Mandatory initialization */
213
214 /* Reset */
7a9d4020 215 if (!test_bit(HCI_QUIRK_NO_RESET, &hdev->quirks))
a9de9248 216 hci_send_cmd(hdev, HCI_OP_RESET, 0, NULL);
1da177e4
LT		 217
218 /* Read Local Supported Features */
a9de9248 219 hci_send_cmd(hdev, HCI_OP_READ_LOCAL_FEATURES, 0, NULL);
1da177e4 220
1143e5a6 221 /* Read Local Version */
a9de9248 222 hci_send_cmd(hdev, HCI_OP_READ_LOCAL_VERSION, 0, NULL);
1143e5a6 223
1da177e4 224 /* Read Buffer Size (ACL mtu, max pkt, etc.) */
a9de9248 225 hci_send_cmd(hdev, HCI_OP_READ_BUFFER_SIZE, 0, NULL);
1da177e4
LT		 226
227#if 0
228 /* Host buffer size */
229 {
230 struct hci_cp_host_buffer_size cp;
aca3192c 231 cp.acl_mtu = cpu_to_le16(HCI_MAX_ACL_SIZE);
1da177e4 232 cp.sco_mtu = HCI_MAX_SCO_SIZE;
aca3192c
YH		 233 cp.acl_max_pkt = cpu_to_le16(0xffff);
234 cp.sco_max_pkt = cpu_to_le16(0xffff);
a9de9248 235 hci_send_cmd(hdev, HCI_OP_HOST_BUFFER_SIZE, sizeof(cp), &cp);
1da177e4
LT		 236 }
237#endif
238
239 /* Read BD Address */
a9de9248
MH		 240 hci_send_cmd(hdev, HCI_OP_READ_BD_ADDR, 0, NULL);
241
242 /* Read Class of Device */
243 hci_send_cmd(hdev, HCI_OP_READ_CLASS_OF_DEV, 0, NULL);
244
245 /* Read Local Name */
246 hci_send_cmd(hdev, HCI_OP_READ_LOCAL_NAME, 0, NULL);
1da177e4
LT		 247
248 /* Read Voice Setting */
a9de9248 249 hci_send_cmd(hdev, HCI_OP_READ_VOICE_SETTING, 0, NULL);
1da177e4
LT		 250
251 /* Optional initialization */
252
253 /* Clear Event Filters */
89f2783d 254 flt_type = HCI_FLT_CLEAR_ALL;
a9de9248 255 hci_send_cmd(hdev, HCI_OP_SET_EVENT_FLT, 1, &flt_type);
1da177e4
LT		 256
257 /* Page timeout ~20 secs */
aca3192c 258 param = cpu_to_le16(0x8000);
a9de9248 259 hci_send_cmd(hdev, HCI_OP_WRITE_PG_TIMEOUT, 2, &param);
1da177e4
LT		 260
261 /* Connection accept timeout ~20 secs */
aca3192c 262 param = cpu_to_le16(0x7d00);
a9de9248 263 hci_send_cmd(hdev, HCI_OP_WRITE_CA_TIMEOUT, 2, &param);
23bb5763
JH		 264
265 hdev->req_last_cmd = HCI_OP_WRITE_CA_TIMEOUT;
1da177e4
LT		 266}
267
268static void hci_scan_req(struct hci_dev *hdev, unsigned long opt)
269{
270 __u8 scan = opt;
271
272 BT_DBG("%s %x", hdev->name, scan);
273
274 /* Inquiry and Page scans */
a9de9248 275 hci_send_cmd(hdev, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan);
1da177e4
LT		 276}
277
278static void hci_auth_req(struct hci_dev *hdev, unsigned long opt)
279{
280 __u8 auth = opt;
281
282 BT_DBG("%s %x", hdev->name, auth);
283
284 /* Authentication */
a9de9248 285 hci_send_cmd(hdev, HCI_OP_WRITE_AUTH_ENABLE, 1, &auth);
1da177e4
LT		 286}
287
288static void hci_encrypt_req(struct hci_dev *hdev, unsigned long opt)
289{
290 __u8 encrypt = opt;
291
292 BT_DBG("%s %x", hdev->name, encrypt);
293
e4e8e37c 294 /* Encryption */
a9de9248 295 hci_send_cmd(hdev, HCI_OP_WRITE_ENCRYPT_MODE, 1, &encrypt);
1da177e4
LT		 296}
297
e4e8e37c
MH		 298static void hci_linkpol_req(struct hci_dev *hdev, unsigned long opt)
299{
300 __le16 policy = cpu_to_le16(opt);
301
a418b893 302 BT_DBG("%s %x", hdev->name, policy);
e4e8e37c
MH		 303
304 /* Default link policy */
305 hci_send_cmd(hdev, HCI_OP_WRITE_DEF_LINK_POLICY, 2, &policy);
306}
307
8e87d142 308/* Get HCI device by index.
1da177e4
LT		 309 * Device is held on return. */
310struct hci_dev *hci_dev_get(int index)
311{
312 struct hci_dev *hdev = NULL;
313 struct list_head *p;
314
315 BT_DBG("%d", index);
316
317 if (index < 0)
318 return NULL;
319
320 read_lock(&hci_dev_list_lock);
321 list_for_each(p, &hci_dev_list) {
322 struct hci_dev *d = list_entry(p, struct hci_dev, list);
323 if (d->id == index) {
324 hdev = hci_dev_hold(d);
325 break;
326 }
327 }
328 read_unlock(&hci_dev_list_lock);
329 return hdev;
330}
1da177e4
LT		 331
332/* ---- Inquiry support ---- */
333static void inquiry_cache_flush(struct hci_dev *hdev)
334{
335 struct inquiry_cache *cache = &hdev->inq_cache;
336 struct inquiry_entry *next = cache->list, *e;
337
338 BT_DBG("cache %p", cache);
339
340 cache->list = NULL;
341 while ((e = next)) {
342 next = e->next;
343 kfree(e);
344 }
345}
346
347struct inquiry_entry *hci_inquiry_cache_lookup(struct hci_dev *hdev, bdaddr_t *bdaddr)
348{
349 struct inquiry_cache *cache = &hdev->inq_cache;
350 struct inquiry_entry *e;
351
352 BT_DBG("cache %p, %s", cache, batostr(bdaddr));
353
354 for (e = cache->list; e; e = e->next)
355 if (!bacmp(&e->data.bdaddr, bdaddr))
356 break;
357 return e;
358}
359
360void hci_inquiry_cache_update(struct hci_dev *hdev, struct inquiry_data *data)
361{
362 struct inquiry_cache *cache = &hdev->inq_cache;
70f23020 363 struct inquiry_entry *ie;
1da177e4
LT		 364
365 BT_DBG("cache %p, %s", cache, batostr(&data->bdaddr));
366
70f23020
AE		 367 ie = hci_inquiry_cache_lookup(hdev, &data->bdaddr);
368 if (!ie) {
1da177e4 369 /* Entry not in the cache. Add new one. */
70f23020
AE		 370 ie = kzalloc(sizeof(struct inquiry_entry), GFP_ATOMIC);
371 if (!ie)
1da177e4 372 return;
70f23020
AE		 373
374 ie->next = cache->list;
375 cache->list = ie;
1da177e4
LT		 376 }
377
70f23020
AE		 378 memcpy(&ie->data, data, sizeof(*data));
379 ie->timestamp = jiffies;
1da177e4
LT		 380 cache->timestamp = jiffies;
381}
382
383static int inquiry_cache_dump(struct hci_dev *hdev, int num, __u8 *buf)
384{
385 struct inquiry_cache *cache = &hdev->inq_cache;
386 struct inquiry_info *info = (struct inquiry_info *) buf;
387 struct inquiry_entry *e;
388 int copied = 0;
389
390 for (e = cache->list; e && copied < num; e = e->next, copied++) {
391 struct inquiry_data *data = &e->data;
392 bacpy(&info->bdaddr, &data->bdaddr);
393 info->pscan_rep_mode = data->pscan_rep_mode;
394 info->pscan_period_mode = data->pscan_period_mode;
395 info->pscan_mode = data->pscan_mode;
396 memcpy(info->dev_class, data->dev_class, 3);
397 info->clock_offset = data->clock_offset;
398 info++;
399 }
400
401 BT_DBG("cache %p, copied %d", cache, copied);
402 return copied;
403}
404
405static void hci_inq_req(struct hci_dev *hdev, unsigned long opt)
406{
407 struct hci_inquiry_req *ir = (struct hci_inquiry_req *) opt;
408 struct hci_cp_inquiry cp;
409
410 BT_DBG("%s", hdev->name);
411
412 if (test_bit(HCI_INQUIRY, &hdev->flags))
413 return;
414
415 /* Start Inquiry */
416 memcpy(&cp.lap, &ir->lap, 3);
417 cp.length = ir->length;
418 cp.num_rsp = ir->num_rsp;
a9de9248 419 hci_send_cmd(hdev, HCI_OP_INQUIRY, sizeof(cp), &cp);
1da177e4
LT		 420}
421
422int hci_inquiry(void __user *arg)
423{
424 __u8 __user *ptr = arg;
425 struct hci_inquiry_req ir;
426 struct hci_dev *hdev;
427 int err = 0, do_inquiry = 0, max_rsp;
428 long timeo;
429 __u8 *buf;
430
431 if (copy_from_user(&ir, ptr, sizeof(ir)))
432 return -EFAULT;
433
434 if (!(hdev = hci_dev_get(ir.dev_id)))
435 return -ENODEV;
436
437 hci_dev_lock_bh(hdev);
8e87d142 438 if (inquiry_cache_age(hdev) > INQUIRY_CACHE_AGE_MAX ||
70f23020
AE		 439 inquiry_cache_empty(hdev) ||
440 ir.flags & IREQ_CACHE_FLUSH) {
1da177e4
LT		 441 inquiry_cache_flush(hdev);
442 do_inquiry = 1;
443 }
444 hci_dev_unlock_bh(hdev);
445
04837f64 446 timeo = ir.length * msecs_to_jiffies(2000);
70f23020
AE		 447
448 if (do_inquiry) {
449 err = hci_request(hdev, hci_inq_req, (unsigned long)&ir, timeo);
450 if (err < 0)
451 goto done;
452 }
1da177e4
LT		 453
454 /* for unlimited number of responses we will use buffer with 255 entries */
455 max_rsp = (ir.num_rsp == 0) ? 255 : ir.num_rsp;
456
457 /* cache_dump can't sleep. Therefore we allocate temp buffer and then
458 * copy it to the user space.
459 */
70f23020
AE		 460 buf = kmalloc(sizeof(struct inquiry_info) *max_rsp, GFP_KERNEL);
461 if (!buf) {
1da177e4
LT		 462 err = -ENOMEM;
463 goto done;
464 }
465
466 hci_dev_lock_bh(hdev);
467 ir.num_rsp = inquiry_cache_dump(hdev, max_rsp, buf);
468 hci_dev_unlock_bh(hdev);
469
470 BT_DBG("num_rsp %d", ir.num_rsp);
471
472 if (!copy_to_user(ptr, &ir, sizeof(ir))) {
473 ptr += sizeof(ir);
474 if (copy_to_user(ptr, buf, sizeof(struct inquiry_info) *
475 ir.num_rsp))
476 err = -EFAULT;
8e87d142 477 } else
1da177e4
LT		 478 err = -EFAULT;
479
480 kfree(buf);
481
482done:
483 hci_dev_put(hdev);
484 return err;
485}
486
487/* ---- HCI ioctl helpers ---- */
488
489int hci_dev_open(__u16 dev)
490{
491 struct hci_dev *hdev;
492 int ret = 0;
493
494 if (!(hdev = hci_dev_get(dev)))
495 return -ENODEV;
496
497 BT_DBG("%s %p", hdev->name, hdev);
498
499 hci_req_lock(hdev);
500
611b30f7
MH		 501 if (hdev->rfkill && rfkill_blocked(hdev->rfkill)) {
502 ret = -ERFKILL;
503 goto done;
504 }
505
1da177e4
LT		 506 if (test_bit(HCI_UP, &hdev->flags)) {
507 ret = -EALREADY;
508 goto done;
509 }
510
511 if (test_bit(HCI_QUIRK_RAW_DEVICE, &hdev->quirks))
512 set_bit(HCI_RAW, &hdev->flags);
513
943da25d
MH		 514 /* Treat all non BR/EDR controllers as raw devices for now */
515 if (hdev->dev_type != HCI_BREDR)
516 set_bit(HCI_RAW, &hdev->flags);
517
1da177e4
LT		 518 if (hdev->open(hdev)) {
519 ret = -EIO;
520 goto done;
521 }
522
523 if (!test_bit(HCI_RAW, &hdev->flags)) {
524 atomic_set(&hdev->cmd_cnt, 1);
525 set_bit(HCI_INIT, &hdev->flags);
526
527 //__hci_request(hdev, hci_reset_req, 0, HZ);
04837f64
MH		 528 ret = __hci_request(hdev, hci_init_req, 0,
529 msecs_to_jiffies(HCI_INIT_TIMEOUT));
1da177e4
LT		 530
531 clear_bit(HCI_INIT, &hdev->flags);
532 }
533
534 if (!ret) {
535 hci_dev_hold(hdev);
536 set_bit(HCI_UP, &hdev->flags);
537 hci_notify(hdev, HCI_DEV_UP);
5add6af8
JH		 538 if (!test_bit(HCI_SETUP, &hdev->flags))
539 mgmt_powered(hdev->id, 1);
8e87d142 540 } else {
1da177e4
LT		 541 /* Init failed, cleanup */
542 tasklet_kill(&hdev->rx_task);
543 tasklet_kill(&hdev->tx_task);
544 tasklet_kill(&hdev->cmd_task);
545
546 skb_queue_purge(&hdev->cmd_q);
547 skb_queue_purge(&hdev->rx_q);
548
549 if (hdev->flush)
550 hdev->flush(hdev);
551
552 if (hdev->sent_cmd) {
553 kfree_skb(hdev->sent_cmd);
554 hdev->sent_cmd = NULL;
555 }
556
557 hdev->close(hdev);
558 hdev->flags = 0;
559 }
560
561done:
562 hci_req_unlock(hdev);
563 hci_dev_put(hdev);
564 return ret;
565}
566
567static int hci_dev_do_close(struct hci_dev *hdev)
568{
569 BT_DBG("%s %p", hdev->name, hdev);
570
571 hci_req_cancel(hdev, ENODEV);
572 hci_req_lock(hdev);
573
574 if (!test_and_clear_bit(HCI_UP, &hdev->flags)) {
575 hci_req_unlock(hdev);
576 return 0;
577 }
578
579 /* Kill RX and TX tasks */
580 tasklet_kill(&hdev->rx_task);
581 tasklet_kill(&hdev->tx_task);
582
583 hci_dev_lock_bh(hdev);
584 inquiry_cache_flush(hdev);
585 hci_conn_hash_flush(hdev);
586 hci_dev_unlock_bh(hdev);
587
588 hci_notify(hdev, HCI_DEV_DOWN);
589
590 if (hdev->flush)
591 hdev->flush(hdev);
592
593 /* Reset device */
594 skb_queue_purge(&hdev->cmd_q);
595 atomic_set(&hdev->cmd_cnt, 1);
596 if (!test_bit(HCI_RAW, &hdev->flags)) {
597 set_bit(HCI_INIT, &hdev->flags);
04837f64
MH		 598 __hci_request(hdev, hci_reset_req, 0,
599 msecs_to_jiffies(250));
1da177e4
LT		 600 clear_bit(HCI_INIT, &hdev->flags);
601 }
602
603 /* Kill cmd task */
604 tasklet_kill(&hdev->cmd_task);
605
606 /* Drop queues */
607 skb_queue_purge(&hdev->rx_q);
608 skb_queue_purge(&hdev->cmd_q);
609 skb_queue_purge(&hdev->raw_q);
610
611 /* Drop last sent command */
612 if (hdev->sent_cmd) {
613 kfree_skb(hdev->sent_cmd);
614 hdev->sent_cmd = NULL;
615 }
616
617 /* After this point our queues are empty
618 * and no tasks are scheduled. */
619 hdev->close(hdev);
620
5add6af8
JH		 621 mgmt_powered(hdev->id, 0);
622
1da177e4
LT		 623 /* Clear flags */
624 hdev->flags = 0;
625
626 hci_req_unlock(hdev);
627
628 hci_dev_put(hdev);
629 return 0;
630}
631
632int hci_dev_close(__u16 dev)
633{
634 struct hci_dev *hdev;
635 int err;
636
70f23020
AE		 637 hdev = hci_dev_get(dev);
638 if (!hdev)
1da177e4
LT		 639 return -ENODEV;
640 err = hci_dev_do_close(hdev);
641 hci_dev_put(hdev);
642 return err;
643}
644
645int hci_dev_reset(__u16 dev)
646{
647 struct hci_dev *hdev;
648 int ret = 0;
649
70f23020
AE		 650 hdev = hci_dev_get(dev);
651 if (!hdev)
1da177e4
LT		 652 return -ENODEV;
653
654 hci_req_lock(hdev);
655 tasklet_disable(&hdev->tx_task);
656
657 if (!test_bit(HCI_UP, &hdev->flags))
658 goto done;
659
660 /* Drop queues */
661 skb_queue_purge(&hdev->rx_q);
662 skb_queue_purge(&hdev->cmd_q);
663
664 hci_dev_lock_bh(hdev);
665 inquiry_cache_flush(hdev);
666 hci_conn_hash_flush(hdev);
667 hci_dev_unlock_bh(hdev);
668
669 if (hdev->flush)
670 hdev->flush(hdev);
671
8e87d142 672 atomic_set(&hdev->cmd_cnt, 1);
1da177e4
LT		 673 hdev->acl_cnt = 0; hdev->sco_cnt = 0;
674
675 if (!test_bit(HCI_RAW, &hdev->flags))
04837f64
MH		 676 ret = __hci_request(hdev, hci_reset_req, 0,
677 msecs_to_jiffies(HCI_INIT_TIMEOUT));
1da177e4
LT		 678
679done:
680 tasklet_enable(&hdev->tx_task);
681 hci_req_unlock(hdev);
682 hci_dev_put(hdev);
683 return ret;
684}
685
686int hci_dev_reset_stat(__u16 dev)
687{
688 struct hci_dev *hdev;
689 int ret = 0;
690
70f23020
AE		 691 hdev = hci_dev_get(dev);
692 if (!hdev)
1da177e4
LT		 693 return -ENODEV;
694
695 memset(&hdev->stat, 0, sizeof(struct hci_dev_stats));
696
697 hci_dev_put(hdev);
698
699 return ret;
700}
701
702int hci_dev_cmd(unsigned int cmd, void __user *arg)
703{
704 struct hci_dev *hdev;
705 struct hci_dev_req dr;
706 int err = 0;
707
708 if (copy_from_user(&dr, arg, sizeof(dr)))
709 return -EFAULT;
710
70f23020
AE		 711 hdev = hci_dev_get(dr.dev_id);
712 if (!hdev)
1da177e4
LT		 713 return -ENODEV;
714
715 switch (cmd) {
716 case HCISETAUTH:
04837f64
MH		 717 err = hci_request(hdev, hci_auth_req, dr.dev_opt,
718 msecs_to_jiffies(HCI_INIT_TIMEOUT));
1da177e4
LT		 719 break;
720
721 case HCISETENCRYPT:
722 if (!lmp_encrypt_capable(hdev)) {
723 err = -EOPNOTSUPP;
724 break;
725 }
726
727 if (!test_bit(HCI_AUTH, &hdev->flags)) {
728 /* Auth must be enabled first */
04837f64
MH		 729 err = hci_request(hdev, hci_auth_req, dr.dev_opt,
730 msecs_to_jiffies(HCI_INIT_TIMEOUT));
1da177e4
LT		 731 if (err)
732 break;
733 }
734
04837f64
MH		 735 err = hci_request(hdev, hci_encrypt_req, dr.dev_opt,
736 msecs_to_jiffies(HCI_INIT_TIMEOUT));
1da177e4
LT		 737 break;
738
739 case HCISETSCAN:
04837f64
MH		 740 err = hci_request(hdev, hci_scan_req, dr.dev_opt,
741 msecs_to_jiffies(HCI_INIT_TIMEOUT));
1da177e4
LT		 742 break;
743
1da177e4 744 case HCISETLINKPOL:
e4e8e37c
MH		 745 err = hci_request(hdev, hci_linkpol_req, dr.dev_opt,
746 msecs_to_jiffies(HCI_INIT_TIMEOUT));
1da177e4
LT		 747 break;
748
749 case HCISETLINKMODE:
e4e8e37c
MH		 750 hdev->link_mode = ((__u16) dr.dev_opt) &
751 (HCI_LM_MASTER | HCI_LM_ACCEPT);
752 break;
753
754 case HCISETPTYPE:
755 hdev->pkt_type = (__u16) dr.dev_opt;
1da177e4
LT		 756 break;
757
758 case HCISETACLMTU:
e4e8e37c
MH		 759 hdev->acl_mtu = *((__u16 *) &dr.dev_opt + 1);
760 hdev->acl_pkts = *((__u16 *) &dr.dev_opt + 0);
1da177e4
LT		 761 break;
762
763 case HCISETSCOMTU:
e4e8e37c
MH		 764 hdev->sco_mtu = *((__u16 *) &dr.dev_opt + 1);
765 hdev->sco_pkts = *((__u16 *) &dr.dev_opt + 0);
1da177e4
LT		 766 break;
767
768 default:
769 err = -EINVAL;
770 break;
771 }
e4e8e37c 772
1da177e4
LT		 773 hci_dev_put(hdev);
774 return err;
775}
776
777int hci_get_dev_list(void __user *arg)
778{
779 struct hci_dev_list_req *dl;
780 struct hci_dev_req *dr;
781 struct list_head *p;
782 int n = 0, size, err;
783 __u16 dev_num;
784
785 if (get_user(dev_num, (__u16 __user *) arg))
786 return -EFAULT;
787
788 if (!dev_num || dev_num > (PAGE_SIZE * 2) / sizeof(*dr))
789 return -EINVAL;
790
791 size = sizeof(*dl) + dev_num * sizeof(*dr);
792
70f23020
AE		 793 dl = kzalloc(size, GFP_KERNEL);
794 if (!dl)
1da177e4
LT		 795 return -ENOMEM;
796
797 dr = dl->dev_req;
798
799 read_lock_bh(&hci_dev_list_lock);
800 list_for_each(p, &hci_dev_list) {
801 struct hci_dev *hdev;
c542a06c 802
1da177e4 803 hdev = list_entry(p, struct hci_dev, list);
c542a06c 804
ab81cbf9 805 hci_del_off_timer(hdev);
c542a06c
JH		 806
807 if (!test_bit(HCI_MGMT, &hdev->flags))
808 set_bit(HCI_PAIRABLE, &hdev->flags);
809
1da177e4
LT		 810 (dr + n)->dev_id = hdev->id;
811 (dr + n)->dev_opt = hdev->flags;
c542a06c 812
1da177e4
LT		 813 if (++n >= dev_num)
814 break;
815 }
816 read_unlock_bh(&hci_dev_list_lock);
817
818 dl->dev_num = n;
819 size = sizeof(*dl) + n * sizeof(*dr);
820
821 err = copy_to_user(arg, dl, size);
822 kfree(dl);
823
824 return err ? -EFAULT : 0;
825}
826
827int hci_get_dev_info(void __user *arg)
828{
829 struct hci_dev *hdev;
830 struct hci_dev_info di;
831 int err = 0;
832
833 if (copy_from_user(&di, arg, sizeof(di)))
834 return -EFAULT;
835
70f23020
AE		 836 hdev = hci_dev_get(di.dev_id);
837 if (!hdev)
1da177e4
LT		 838 return -ENODEV;
839
ab81cbf9
JH		 840 hci_del_off_timer(hdev);
841
c542a06c
JH		 842 if (!test_bit(HCI_MGMT, &hdev->flags))
843 set_bit(HCI_PAIRABLE, &hdev->flags);
844
1da177e4
LT		 845 strcpy(di.name, hdev->name);
846 di.bdaddr = hdev->bdaddr;
943da25d 847 di.type = (hdev->bus & 0x0f) | (hdev->dev_type << 4);
1da177e4
LT		 848 di.flags = hdev->flags;
849 di.pkt_type = hdev->pkt_type;
850 di.acl_mtu = hdev->acl_mtu;
851 di.acl_pkts = hdev->acl_pkts;
852 di.sco_mtu = hdev->sco_mtu;
853 di.sco_pkts = hdev->sco_pkts;
854 di.link_policy = hdev->link_policy;
855 di.link_mode = hdev->link_mode;
856
857 memcpy(&di.stat, &hdev->stat, sizeof(di.stat));
858 memcpy(&di.features, &hdev->features, sizeof(di.features));
859
860 if (copy_to_user(arg, &di, sizeof(di)))
861 err = -EFAULT;
862
863 hci_dev_put(hdev);
864
865 return err;
866}
867
868/* ---- Interface to HCI drivers ---- */
869
611b30f7
MH		 870static int hci_rfkill_set_block(void *data, bool blocked)
871{
872 struct hci_dev *hdev = data;
873
874 BT_DBG("%p name %s blocked %d", hdev, hdev->name, blocked);
875
876 if (!blocked)
877 return 0;
878
879 hci_dev_do_close(hdev);
880
881 return 0;
882}
883
884static const struct rfkill_ops hci_rfkill_ops = {
885 .set_block = hci_rfkill_set_block,
886};
887
1da177e4
LT		 888/* Alloc HCI device */
889struct hci_dev *hci_alloc_dev(void)
890{
891 struct hci_dev *hdev;
892
25ea6db0 893 hdev = kzalloc(sizeof(struct hci_dev), GFP_KERNEL);
1da177e4
LT		 894 if (!hdev)
895 return NULL;
896
1da177e4
LT		 897 skb_queue_head_init(&hdev->driver_init);
898
899 return hdev;
900}
901EXPORT_SYMBOL(hci_alloc_dev);
902
903/* Free HCI device */
904void hci_free_dev(struct hci_dev *hdev)
905{
906 skb_queue_purge(&hdev->driver_init);
907
a91f2e39
MH		 908 /* will free via device release */
909 put_device(&hdev->dev);
1da177e4
LT		 910}
911EXPORT_SYMBOL(hci_free_dev);
912
ab81cbf9
JH		 913static void hci_power_on(struct work_struct *work)
914{
915 struct hci_dev *hdev = container_of(work, struct hci_dev, power_on);
916
917 BT_DBG("%s", hdev->name);
918
919 if (hci_dev_open(hdev->id) < 0)
920 return;
921
922 if (test_bit(HCI_AUTO_OFF, &hdev->flags))
923 mod_timer(&hdev->off_timer,
924 jiffies + msecs_to_jiffies(AUTO_OFF_TIMEOUT));
925
926 if (test_and_clear_bit(HCI_SETUP, &hdev->flags))
927 mgmt_index_added(hdev->id);
928}
929
930static void hci_power_off(struct work_struct *work)
931{
932 struct hci_dev *hdev = container_of(work, struct hci_dev, power_off);
933
934 BT_DBG("%s", hdev->name);
935
936 hci_dev_close(hdev->id);
937}
938
939static void hci_auto_off(unsigned long data)
940{
941 struct hci_dev *hdev = (struct hci_dev *) data;
942
943 BT_DBG("%s", hdev->name);
944
945 clear_bit(HCI_AUTO_OFF, &hdev->flags);
946
947 queue_work(hdev->workqueue, &hdev->power_off);
948}
949
950void hci_del_off_timer(struct hci_dev *hdev)
951{
952 BT_DBG("%s", hdev->name);
953
954 clear_bit(HCI_AUTO_OFF, &hdev->flags);
955 del_timer(&hdev->off_timer);
956}
957
1da177e4
LT		 958/* Register HCI device */
959int hci_register_dev(struct hci_dev *hdev)
960{
961 struct list_head *head = &hci_dev_list, *p;
ef222013 962 int i, id = 0;
1da177e4 963
c13854ce
MH		 964 BT_DBG("%p name %s bus %d owner %p", hdev, hdev->name,
965 hdev->bus, hdev->owner);
1da177e4
LT		 966
967 if (!hdev->open || !hdev->close || !hdev->destruct)
968 return -EINVAL;
969
970 write_lock_bh(&hci_dev_list_lock);
971
972 /* Find first available device id */
973 list_for_each(p, &hci_dev_list) {
974 if (list_entry(p, struct hci_dev, list)->id != id)
975 break;
976 head = p; id++;
977 }
8e87d142 978
1da177e4
LT		 979 sprintf(hdev->name, "hci%d", id);
980 hdev->id = id;
981 list_add(&hdev->list, head);
982
983 atomic_set(&hdev->refcnt, 1);
984 spin_lock_init(&hdev->lock);
985
986 hdev->flags = 0;
987 hdev->pkt_type = (HCI_DM1 | HCI_DH1 | HCI_HV1);
5b7f9909 988 hdev->esco_type = (ESCO_HV1);
1da177e4
LT		 989 hdev->link_mode = (HCI_LM_ACCEPT);
990
04837f64
MH		 991 hdev->idle_timeout = 0;
992 hdev->sniff_max_interval = 800;
993 hdev->sniff_min_interval = 80;
994
70f23020 995 tasklet_init(&hdev->cmd_task, hci_cmd_task, (unsigned long) hdev);
1da177e4
LT		 996 tasklet_init(&hdev->rx_task, hci_rx_task, (unsigned long) hdev);
997 tasklet_init(&hdev->tx_task, hci_tx_task, (unsigned long) hdev);
998
999 skb_queue_head_init(&hdev->rx_q);
1000 skb_queue_head_init(&hdev->cmd_q);
1001 skb_queue_head_init(&hdev->raw_q);
1002
cd4c5391 1003 for (i = 0; i < NUM_REASSEMBLY; i++)
ef222013
MH		 1004 hdev->reassembly[i] = NULL;
1005
1da177e4 1006 init_waitqueue_head(&hdev->req_wait_q);
a6a67efd 1007 mutex_init(&hdev->req_lock);
1da177e4
LT		 1008
1009 inquiry_cache_init(hdev);
1010
1011 hci_conn_hash_init(hdev);
1012
ea4bd8ba 1013 INIT_LIST_HEAD(&hdev->blacklist);
f0358568 1014
ab81cbf9
JH		 1015 INIT_WORK(&hdev->power_on, hci_power_on);
1016 INIT_WORK(&hdev->power_off, hci_power_off);
1017 setup_timer(&hdev->off_timer, hci_auto_off, (unsigned long) hdev);
1018
1da177e4
LT		 1019 memset(&hdev->stat, 0, sizeof(struct hci_dev_stats));
1020
1021 atomic_set(&hdev->promisc, 0);
1022
1023 write_unlock_bh(&hci_dev_list_lock);
1024
f48fd9c8
MH		 1025 hdev->workqueue = create_singlethread_workqueue(hdev->name);
1026 if (!hdev->workqueue)
1027 goto nomem;
1028
1da177e4
LT		 1029 hci_register_sysfs(hdev);
1030
611b30f7
MH		 1031 hdev->rfkill = rfkill_alloc(hdev->name, &hdev->dev,
1032 RFKILL_TYPE_BLUETOOTH, &hci_rfkill_ops, hdev);
1033 if (hdev->rfkill) {
1034 if (rfkill_register(hdev->rfkill) < 0) {
1035 rfkill_destroy(hdev->rfkill);
1036 hdev->rfkill = NULL;
1037 }
1038 }
1039
ab81cbf9
JH		 1040 set_bit(HCI_AUTO_OFF, &hdev->flags);
1041 set_bit(HCI_SETUP, &hdev->flags);
1042 queue_work(hdev->workqueue, &hdev->power_on);
1043
1da177e4
LT		 1044 hci_notify(hdev, HCI_DEV_REG);
1045
1046 return id;
f48fd9c8
MH		 1047
1048nomem:
1049 write_lock_bh(&hci_dev_list_lock);
1050 list_del(&hdev->list);
1051 write_unlock_bh(&hci_dev_list_lock);
1052
1053 return -ENOMEM;
1da177e4
LT		 1054}
1055EXPORT_SYMBOL(hci_register_dev);
1056
1057/* Unregister HCI device */
1058int hci_unregister_dev(struct hci_dev *hdev)
1059{
ef222013
MH		 1060 int i;
1061
c13854ce 1062 BT_DBG("%p name %s bus %d", hdev, hdev->name, hdev->bus);
1da177e4 1063
1da177e4
LT		 1064 write_lock_bh(&hci_dev_list_lock);
1065 list_del(&hdev->list);
1066 write_unlock_bh(&hci_dev_list_lock);
1067
1068 hci_dev_do_close(hdev);
1069
cd4c5391 1070 for (i = 0; i < NUM_REASSEMBLY; i++)
ef222013
MH		 1071 kfree_skb(hdev->reassembly[i]);
1072
ab81cbf9
JH		 1073 if (!test_bit(HCI_INIT, &hdev->flags) &&
1074 !test_bit(HCI_SETUP, &hdev->flags))
1075 mgmt_index_removed(hdev->id);
1076
1da177e4
LT		 1077 hci_notify(hdev, HCI_DEV_UNREG);
1078
611b30f7
MH		 1079 if (hdev->rfkill) {
1080 rfkill_unregister(hdev->rfkill);
1081 rfkill_destroy(hdev->rfkill);
1082 }
1083
147e2d59
DY		 1084 hci_unregister_sysfs(hdev);
1085
f48fd9c8
MH		 1086 destroy_workqueue(hdev->workqueue);
1087
e2e0cacb
JH		 1088 hci_dev_lock_bh(hdev);
1089 hci_blacklist_clear(hdev);
1090 hci_dev_unlock_bh(hdev);
1091
1da177e4 1092 __hci_dev_put(hdev);
ef222013 1093
1da177e4
LT		 1094 return 0;
1095}
1096EXPORT_SYMBOL(hci_unregister_dev);
1097
1098/* Suspend HCI device */
1099int hci_suspend_dev(struct hci_dev *hdev)
1100{
1101 hci_notify(hdev, HCI_DEV_SUSPEND);
1102 return 0;
1103}
1104EXPORT_SYMBOL(hci_suspend_dev);
1105
1106/* Resume HCI device */
1107int hci_resume_dev(struct hci_dev *hdev)
1108{
1109 hci_notify(hdev, HCI_DEV_RESUME);
1110 return 0;
1111}
1112EXPORT_SYMBOL(hci_resume_dev);
1113
76bca880
MH		 1114/* Receive frame from HCI drivers */
1115int hci_recv_frame(struct sk_buff *skb)
1116{
1117 struct hci_dev *hdev = (struct hci_dev *) skb->dev;
1118 if (!hdev || (!test_bit(HCI_UP, &hdev->flags)
1119 && !test_bit(HCI_INIT, &hdev->flags))) {
1120 kfree_skb(skb);
1121 return -ENXIO;
1122 }
1123
1124 /* Incomming skb */
1125 bt_cb(skb)->incoming = 1;
1126
1127 /* Time stamp */
1128 __net_timestamp(skb);
1129
1130 /* Queue frame for rx task */
1131 skb_queue_tail(&hdev->rx_q, skb);
c78ae283
MH		 1132 tasklet_schedule(&hdev->rx_task);
1133
76bca880
MH		 1134 return 0;
1135}
1136EXPORT_SYMBOL(hci_recv_frame);
1137
33e882a5
SS		 1138static int hci_reassembly(struct hci_dev *hdev, int type, void *data,
1139 int count, __u8 index, gfp_t gfp_mask)
1140{
1141 int len = 0;
1142 int hlen = 0;
1143 int remain = count;
1144 struct sk_buff *skb;
1145 struct bt_skb_cb *scb;
1146
1147 if ((type < HCI_ACLDATA_PKT || type > HCI_EVENT_PKT) ||
1148 index >= NUM_REASSEMBLY)
1149 return -EILSEQ;
1150
1151 skb = hdev->reassembly[index];
1152
1153 if (!skb) {
1154 switch (type) {
1155 case HCI_ACLDATA_PKT:
1156 len = HCI_MAX_FRAME_SIZE;
1157 hlen = HCI_ACL_HDR_SIZE;
1158 break;
1159 case HCI_EVENT_PKT:
1160 len = HCI_MAX_EVENT_SIZE;
1161 hlen = HCI_EVENT_HDR_SIZE;
1162 break;
1163 case HCI_SCODATA_PKT:
1164 len = HCI_MAX_SCO_SIZE;
1165 hlen = HCI_SCO_HDR_SIZE;
1166 break;
1167 }
1168
1169 skb = bt_skb_alloc(len, gfp_mask);
1170 if (!skb)
1171 return -ENOMEM;
1172
1173 scb = (void *) skb->cb;
1174 scb->expect = hlen;
1175 scb->pkt_type = type;
1176
1177 skb->dev = (void *) hdev;
1178 hdev->reassembly[index] = skb;
1179 }
1180
1181 while (count) {
1182 scb = (void *) skb->cb;
1183 len = min(scb->expect, (__u16)count);
1184
1185 memcpy(skb_put(skb, len), data, len);
1186
1187 count -= len;
1188 data += len;
1189 scb->expect -= len;
1190 remain = count;
1191
1192 switch (type) {
1193 case HCI_EVENT_PKT:
1194 if (skb->len == HCI_EVENT_HDR_SIZE) {
1195 struct hci_event_hdr *h = hci_event_hdr(skb);
1196 scb->expect = h->plen;
1197
1198 if (skb_tailroom(skb) < scb->expect) {
1199 kfree_skb(skb);
1200 hdev->reassembly[index] = NULL;
1201 return -ENOMEM;
1202 }
1203 }
1204 break;
1205
1206 case HCI_ACLDATA_PKT:
1207 if (skb->len == HCI_ACL_HDR_SIZE) {
1208 struct hci_acl_hdr *h = hci_acl_hdr(skb);
1209 scb->expect = __le16_to_cpu(h->dlen);
1210
1211 if (skb_tailroom(skb) < scb->expect) {
1212 kfree_skb(skb);
1213 hdev->reassembly[index] = NULL;
1214 return -ENOMEM;
1215 }
1216 }
1217 break;
1218
1219 case HCI_SCODATA_PKT:
1220 if (skb->len == HCI_SCO_HDR_SIZE) {
1221 struct hci_sco_hdr *h = hci_sco_hdr(skb);
1222 scb->expect = h->dlen;
1223
1224 if (skb_tailroom(skb) < scb->expect) {
1225 kfree_skb(skb);
1226 hdev->reassembly[index] = NULL;
1227 return -ENOMEM;
1228 }
1229 }
1230 break;
1231 }
1232
1233 if (scb->expect == 0) {
1234 /* Complete frame */
1235
1236 bt_cb(skb)->pkt_type = type;
1237 hci_recv_frame(skb);
1238
1239 hdev->reassembly[index] = NULL;
1240 return remain;
1241 }
1242 }
1243
1244 return remain;
1245}
1246
ef222013
MH		 1247int hci_recv_fragment(struct hci_dev *hdev, int type, void *data, int count)
1248{
f39a3c06
SS		 1249 int rem = 0;
1250
ef222013
MH		 1251 if (type < HCI_ACLDATA_PKT || type > HCI_EVENT_PKT)
1252 return -EILSEQ;
1253
da5f6c37 1254 while (count) {
f39a3c06
SS		 1255 rem = hci_reassembly(hdev, type, data, count,
1256 type - 1, GFP_ATOMIC);
1257 if (rem < 0)
1258 return rem;
ef222013 1259
f39a3c06
SS		 1260 data += (count - rem);
1261 count = rem;
da5f6c37 1262 };
ef222013 1263
f39a3c06 1264 return rem;
ef222013
MH		 1265}
1266EXPORT_SYMBOL(hci_recv_fragment);
1267
99811510
SS		 1268#define STREAM_REASSEMBLY 0
1269
1270int hci_recv_stream_fragment(struct hci_dev *hdev, void *data, int count)
1271{
1272 int type;
1273 int rem = 0;
1274
da5f6c37 1275 while (count) {
99811510
SS		 1276 struct sk_buff *skb = hdev->reassembly[STREAM_REASSEMBLY];
1277
1278 if (!skb) {
1279 struct { char type; } *pkt;
1280
1281 /* Start of the frame */
1282 pkt = data;
1283 type = pkt->type;
1284
1285 data++;
1286 count--;
1287 } else
1288 type = bt_cb(skb)->pkt_type;
1289
1290 rem = hci_reassembly(hdev, type, data,
1291 count, STREAM_REASSEMBLY, GFP_ATOMIC);
1292 if (rem < 0)
1293 return rem;
1294
1295 data += (count - rem);
1296 count = rem;
da5f6c37 1297 };
99811510
SS		 1298
1299 return rem;
1300}
1301EXPORT_SYMBOL(hci_recv_stream_fragment);
1302
1da177e4
LT		 1303/* ---- Interface to upper protocols ---- */
1304
1305/* Register/Unregister protocols.
1306 * hci_task_lock is used to ensure that no tasks are running. */
1307int hci_register_proto(struct hci_proto *hp)
1308{
1309 int err = 0;
1310
1311 BT_DBG("%p name %s id %d", hp, hp->name, hp->id);
1312
1313 if (hp->id >= HCI_MAX_PROTO)
1314 return -EINVAL;
1315
1316 write_lock_bh(&hci_task_lock);
1317
1318 if (!hci_proto[hp->id])
1319 hci_proto[hp->id] = hp;
1320 else
1321 err = -EEXIST;
1322
1323 write_unlock_bh(&hci_task_lock);
1324
1325 return err;
1326}
1327EXPORT_SYMBOL(hci_register_proto);
1328
1329int hci_unregister_proto(struct hci_proto *hp)
1330{
1331 int err = 0;
1332
1333 BT_DBG("%p name %s id %d", hp, hp->name, hp->id);
1334
1335 if (hp->id >= HCI_MAX_PROTO)
1336 return -EINVAL;
1337
1338 write_lock_bh(&hci_task_lock);
1339
1340 if (hci_proto[hp->id])
1341 hci_proto[hp->id] = NULL;
1342 else
1343 err = -ENOENT;
1344
1345 write_unlock_bh(&hci_task_lock);
1346
1347 return err;
1348}
1349EXPORT_SYMBOL(hci_unregister_proto);
1350
1351int hci_register_cb(struct hci_cb *cb)
1352{
1353 BT_DBG("%p name %s", cb, cb->name);
1354
1355 write_lock_bh(&hci_cb_list_lock);
1356 list_add(&cb->list, &hci_cb_list);
1357 write_unlock_bh(&hci_cb_list_lock);
1358
1359 return 0;
1360}
1361EXPORT_SYMBOL(hci_register_cb);
1362
1363int hci_unregister_cb(struct hci_cb *cb)
1364{
1365 BT_DBG("%p name %s", cb, cb->name);
1366
1367 write_lock_bh(&hci_cb_list_lock);
1368 list_del(&cb->list);
1369 write_unlock_bh(&hci_cb_list_lock);
1370
1371 return 0;
1372}
1373EXPORT_SYMBOL(hci_unregister_cb);
1374
1375static int hci_send_frame(struct sk_buff *skb)
1376{
1377 struct hci_dev *hdev = (struct hci_dev *) skb->dev;
1378
1379 if (!hdev) {
1380 kfree_skb(skb);
1381 return -ENODEV;
1382 }
1383
0d48d939 1384 BT_DBG("%s type %d len %d", hdev->name, bt_cb(skb)->pkt_type, skb->len);
1da177e4
LT		 1385
1386 if (atomic_read(&hdev->promisc)) {
1387 /* Time stamp */
a61bbcf2 1388 __net_timestamp(skb);
1da177e4 1389
eec8d2bc 1390 hci_send_to_sock(hdev, skb, NULL);
1da177e4
LT		 1391 }
1392
1393 /* Get rid of skb owner, prior to sending to the driver. */
1394 skb_orphan(skb);
1395
1396 return hdev->send(skb);
1397}
1398
1399/* Send HCI command */
a9de9248 1400int hci_send_cmd(struct hci_dev *hdev, __u16 opcode, __u32 plen, void *param)
1da177e4
LT		 1401{
1402 int len = HCI_COMMAND_HDR_SIZE + plen;
1403 struct hci_command_hdr *hdr;
1404 struct sk_buff *skb;
1405
a9de9248 1406 BT_DBG("%s opcode 0x%x plen %d", hdev->name, opcode, plen);
1da177e4
LT		 1407
1408 skb = bt_skb_alloc(len, GFP_ATOMIC);
1409 if (!skb) {
ef222013 1410 BT_ERR("%s no memory for command", hdev->name);
1da177e4
LT		 1411 return -ENOMEM;
1412 }
1413
1414 hdr = (struct hci_command_hdr *) skb_put(skb, HCI_COMMAND_HDR_SIZE);
a9de9248 1415 hdr->opcode = cpu_to_le16(opcode);
1da177e4
LT		 1416 hdr->plen = plen;
1417
1418 if (plen)
1419 memcpy(skb_put(skb, plen), param, plen);
1420
1421 BT_DBG("skb len %d", skb->len);
1422
0d48d939 1423 bt_cb(skb)->pkt_type = HCI_COMMAND_PKT;
1da177e4 1424 skb->dev = (void *) hdev;
c78ae283 1425
1da177e4 1426 skb_queue_tail(&hdev->cmd_q, skb);
c78ae283 1427 tasklet_schedule(&hdev->cmd_task);
1da177e4
LT		 1428
1429 return 0;
1430}
1da177e4
LT		 1431
1432/* Get data from the previously sent command */
a9de9248 1433void *hci_sent_cmd_data(struct hci_dev *hdev, __u16 opcode)
1da177e4
LT		 1434{
1435 struct hci_command_hdr *hdr;
1436
1437 if (!hdev->sent_cmd)
1438 return NULL;
1439
1440 hdr = (void *) hdev->sent_cmd->data;
1441
a9de9248 1442 if (hdr->opcode != cpu_to_le16(opcode))
1da177e4
LT		 1443 return NULL;
1444
a9de9248 1445 BT_DBG("%s opcode 0x%x", hdev->name, opcode);
1da177e4
LT		 1446
1447 return hdev->sent_cmd->data + HCI_COMMAND_HDR_SIZE;
1448}
1449
1450/* Send ACL data */
1451static void hci_add_acl_hdr(struct sk_buff *skb, __u16 handle, __u16 flags)
1452{
1453 struct hci_acl_hdr *hdr;
1454 int len = skb->len;
1455
badff6d0
ACM		 1456 skb_push(skb, HCI_ACL_HDR_SIZE);
1457 skb_reset_transport_header(skb);
9c70220b 1458 hdr = (struct hci_acl_hdr *)skb_transport_header(skb);
aca3192c
YH		 1459 hdr->handle = cpu_to_le16(hci_handle_pack(handle, flags));
1460 hdr->dlen = cpu_to_le16(len);
1da177e4
LT		 1461}
1462
9a9c6a34 1463void hci_send_acl(struct hci_conn *conn, struct sk_buff *skb, __u16 flags)
1da177e4
LT		 1464{
1465 struct hci_dev *hdev = conn->hdev;
1466 struct sk_buff *list;
1467
1468 BT_DBG("%s conn %p flags 0x%x", hdev->name, conn, flags);
1469
1470 skb->dev = (void *) hdev;
0d48d939 1471 bt_cb(skb)->pkt_type = HCI_ACLDATA_PKT;
e702112f 1472 hci_add_acl_hdr(skb, conn->handle, flags);
1da177e4 1473
70f23020
AE		 1474 list = skb_shinfo(skb)->frag_list;
1475 if (!list) {
1da177e4
LT		 1476 /* Non fragmented */
1477 BT_DBG("%s nonfrag skb %p len %d", hdev->name, skb, skb->len);
1478
1479 skb_queue_tail(&conn->data_q, skb);
1480 } else {
1481 /* Fragmented */
1482 BT_DBG("%s frag %p len %d", hdev->name, skb, skb->len);
1483
1484 skb_shinfo(skb)->frag_list = NULL;
1485
1486 /* Queue all fragments atomically */
1487 spin_lock_bh(&conn->data_q.lock);
1488
1489 __skb_queue_tail(&conn->data_q, skb);
e702112f
AE		 1490
1491 flags &= ~ACL_START;
1492 flags |= ACL_CONT;
1da177e4
LT		 1493 do {
1494 skb = list; list = list->next;
8e87d142 1495
1da177e4 1496 skb->dev = (void *) hdev;
0d48d939 1497 bt_cb(skb)->pkt_type = HCI_ACLDATA_PKT;
e702112f 1498 hci_add_acl_hdr(skb, conn->handle, flags);
1da177e4
LT		 1499
1500 BT_DBG("%s frag %p len %d", hdev->name, skb, skb->len);
1501
1502 __skb_queue_tail(&conn->data_q, skb);
1503 } while (list);
1504
1505 spin_unlock_bh(&conn->data_q.lock);
1506 }
1507
c78ae283 1508 tasklet_schedule(&hdev->tx_task);
1da177e4
LT		 1509}
1510EXPORT_SYMBOL(hci_send_acl);
1511
1512/* Send SCO data */
0d861d8b 1513void hci_send_sco(struct hci_conn *conn, struct sk_buff *skb)
1da177e4
LT		 1514{
1515 struct hci_dev *hdev = conn->hdev;
1516 struct hci_sco_hdr hdr;
1517
1518 BT_DBG("%s len %d", hdev->name, skb->len);
1519
aca3192c 1520 hdr.handle = cpu_to_le16(conn->handle);
1da177e4
LT		 1521 hdr.dlen = skb->len;
1522
badff6d0
ACM		 1523 skb_push(skb, HCI_SCO_HDR_SIZE);
1524 skb_reset_transport_header(skb);
9c70220b 1525 memcpy(skb_transport_header(skb), &hdr, HCI_SCO_HDR_SIZE);
1da177e4
LT		 1526
1527 skb->dev = (void *) hdev;
0d48d939 1528 bt_cb(skb)->pkt_type = HCI_SCODATA_PKT;
c78ae283 1529
1da177e4 1530 skb_queue_tail(&conn->data_q, skb);
c78ae283 1531 tasklet_schedule(&hdev->tx_task);
1da177e4
LT		 1532}
1533EXPORT_SYMBOL(hci_send_sco);
1534
1535/* ---- HCI TX task (outgoing data) ---- */
1536
1537/* HCI Connection scheduler */
1538static inline struct hci_conn *hci_low_sent(struct hci_dev *hdev, __u8 type, int *quote)
1539{
1540 struct hci_conn_hash *h = &hdev->conn_hash;
5b7f9909 1541 struct hci_conn *conn = NULL;
1da177e4
LT		 1542 int num = 0, min = ~0;
1543 struct list_head *p;
1544
8e87d142 1545 /* We don't have to lock device here. Connections are always
1da177e4
LT		 1546 * added and removed with TX task disabled. */
1547 list_for_each(p, &h->list) {
1548 struct hci_conn *c;
1549 c = list_entry(p, struct hci_conn, list);
1550
769be974 1551 if (c->type != type || skb_queue_empty(&c->data_q))
1da177e4 1552 continue;
769be974
MH		 1553
1554 if (c->state != BT_CONNECTED && c->state != BT_CONFIG)
1555 continue;
1556
1da177e4
LT		 1557 num++;
1558
1559 if (c->sent < min) {
1560 min = c->sent;
1561 conn = c;
1562 }
1563 }
1564
1565 if (conn) {
1566 int cnt = (type == ACL_LINK ? hdev->acl_cnt : hdev->sco_cnt);
1567 int q = cnt / num;
1568 *quote = q ? q : 1;
1569 } else
1570 *quote = 0;
1571
1572 BT_DBG("conn %p quote %d", conn, *quote);
1573 return conn;
1574}
1575
1576static inline void hci_acl_tx_to(struct hci_dev *hdev)
1577{
1578 struct hci_conn_hash *h = &hdev->conn_hash;
1579 struct list_head *p;
1580 struct hci_conn *c;
1581
1582 BT_ERR("%s ACL tx timeout", hdev->name);
1583
1584 /* Kill stalled connections */
1585 list_for_each(p, &h->list) {
1586 c = list_entry(p, struct hci_conn, list);
1587 if (c->type == ACL_LINK && c->sent) {
1588 BT_ERR("%s killing stalled ACL connection %s",
1589 hdev->name, batostr(&c->dst));
1590 hci_acl_disconn(c, 0x13);
1591 }
1592 }
1593}
1594
1595static inline void hci_sched_acl(struct hci_dev *hdev)
1596{
1597 struct hci_conn *conn;
1598 struct sk_buff *skb;
1599 int quote;
1600
1601 BT_DBG("%s", hdev->name);
1602
1603 if (!test_bit(HCI_RAW, &hdev->flags)) {
1604 /* ACL tx timeout must be longer than maximum
1605 * link supervision timeout (40.9 seconds) */
82453021 1606 if (!hdev->acl_cnt && time_after(jiffies, hdev->acl_last_tx + HZ * 45))
1da177e4
LT		 1607 hci_acl_tx_to(hdev);
1608 }
1609
1610 while (hdev->acl_cnt && (conn = hci_low_sent(hdev, ACL_LINK, &quote))) {
1611 while (quote-- && (skb = skb_dequeue(&conn->data_q))) {
1612 BT_DBG("skb %p len %d", skb, skb->len);
04837f64
MH		 1613
1614 hci_conn_enter_active_mode(conn);
1615
1da177e4
LT		 1616 hci_send_frame(skb);
1617 hdev->acl_last_tx = jiffies;
1618
1619 hdev->acl_cnt--;
1620 conn->sent++;
1621 }
1622 }
1623}
1624
1625/* Schedule SCO */
1626static inline void hci_sched_sco(struct hci_dev *hdev)
1627{
1628 struct hci_conn *conn;
1629 struct sk_buff *skb;
1630 int quote;
1631
1632 BT_DBG("%s", hdev->name);
1633
1634 while (hdev->sco_cnt && (conn = hci_low_sent(hdev, SCO_LINK, &quote))) {
1635 while (quote-- && (skb = skb_dequeue(&conn->data_q))) {
1636 BT_DBG("skb %p len %d", skb, skb->len);
1637 hci_send_frame(skb);
1638
1639 conn->sent++;
1640 if (conn->sent == ~0)
1641 conn->sent = 0;
1642 }
1643 }
1644}
1645
b6a0dc82
MH		 1646static inline void hci_sched_esco(struct hci_dev *hdev)
1647{
1648 struct hci_conn *conn;
1649 struct sk_buff *skb;
1650 int quote;
1651
1652 BT_DBG("%s", hdev->name);
1653
1654 while (hdev->sco_cnt && (conn = hci_low_sent(hdev, ESCO_LINK, &quote))) {
1655 while (quote-- && (skb = skb_dequeue(&conn->data_q))) {
1656 BT_DBG("skb %p len %d", skb, skb->len);
1657 hci_send_frame(skb);
1658
1659 conn->sent++;
1660 if (conn->sent == ~0)
1661 conn->sent = 0;
1662 }
1663 }
1664}
1665
1da177e4
LT		 1666static void hci_tx_task(unsigned long arg)
1667{
1668 struct hci_dev *hdev = (struct hci_dev *) arg;
1669 struct sk_buff *skb;
1670
1671 read_lock(&hci_task_lock);
1672
1673 BT_DBG("%s acl %d sco %d", hdev->name, hdev->acl_cnt, hdev->sco_cnt);
1674
1675 /* Schedule queues and send stuff to HCI driver */
1676
1677 hci_sched_acl(hdev);
1678
1679 hci_sched_sco(hdev);
1680
b6a0dc82
MH		 1681 hci_sched_esco(hdev);
1682
1da177e4
LT		 1683 /* Send next queued raw (unknown type) packet */
1684 while ((skb = skb_dequeue(&hdev->raw_q)))
1685 hci_send_frame(skb);
1686
1687 read_unlock(&hci_task_lock);
1688}
1689
1690/* ----- HCI RX task (incoming data proccessing) ----- */
1691
1692/* ACL data packet */
1693static inline void hci_acldata_packet(struct hci_dev *hdev, struct sk_buff *skb)
1694{
1695 struct hci_acl_hdr *hdr = (void *) skb->data;
1696 struct hci_conn *conn;
1697 __u16 handle, flags;
1698
1699 skb_pull(skb, HCI_ACL_HDR_SIZE);
1700
1701 handle = __le16_to_cpu(hdr->handle);
1702 flags = hci_flags(handle);
1703 handle = hci_handle(handle);
1704
1705 BT_DBG("%s len %d handle 0x%x flags 0x%x", hdev->name, skb->len, handle, flags);
1706
1707 hdev->stat.acl_rx++;
1708
1709 hci_dev_lock(hdev);
1710 conn = hci_conn_hash_lookup_handle(hdev, handle);
1711 hci_dev_unlock(hdev);
8e87d142 1712
1da177e4
LT		 1713 if (conn) {
1714 register struct hci_proto *hp;
1715
04837f64
MH		 1716 hci_conn_enter_active_mode(conn);
1717
1da177e4 1718 /* Send to upper protocol */
70f23020
AE		 1719 hp = hci_proto[HCI_PROTO_L2CAP];
1720 if (hp && hp->recv_acldata) {
1da177e4
LT		 1721 hp->recv_acldata(conn, skb, flags);
1722 return;
1723 }
1724 } else {
8e87d142 1725 BT_ERR("%s ACL packet for unknown connection handle %d",
1da177e4
LT		 1726 hdev->name, handle);
1727 }
1728
1729 kfree_skb(skb);
1730}
1731
1732/* SCO data packet */
1733static inline void hci_scodata_packet(struct hci_dev *hdev, struct sk_buff *skb)
1734{
1735 struct hci_sco_hdr *hdr = (void *) skb->data;
1736 struct hci_conn *conn;
1737 __u16 handle;
1738
1739 skb_pull(skb, HCI_SCO_HDR_SIZE);
1740
1741 handle = __le16_to_cpu(hdr->handle);
1742
1743 BT_DBG("%s len %d handle 0x%x", hdev->name, skb->len, handle);
1744
1745 hdev->stat.sco_rx++;
1746
1747 hci_dev_lock(hdev);
1748 conn = hci_conn_hash_lookup_handle(hdev, handle);
1749 hci_dev_unlock(hdev);
1750
1751 if (conn) {
1752 register struct hci_proto *hp;
1753
1754 /* Send to upper protocol */
70f23020
AE		 1755 hp = hci_proto[HCI_PROTO_SCO];
1756 if (hp && hp->recv_scodata) {
1da177e4
LT		 1757 hp->recv_scodata(conn, skb);
1758 return;
1759 }
1760 } else {
8e87d142 1761 BT_ERR("%s SCO packet for unknown connection handle %d",
1da177e4
LT		 1762 hdev->name, handle);
1763 }
1764
1765 kfree_skb(skb);
1766}
1767
6516455d 1768static void hci_rx_task(unsigned long arg)
1da177e4
LT		 1769{
1770 struct hci_dev *hdev = (struct hci_dev *) arg;
1771 struct sk_buff *skb;
1772
1773 BT_DBG("%s", hdev->name);
1774
1775 read_lock(&hci_task_lock);
1776
1777 while ((skb = skb_dequeue(&hdev->rx_q))) {
1778 if (atomic_read(&hdev->promisc)) {
1779 /* Send copy to the sockets */
eec8d2bc 1780 hci_send_to_sock(hdev, skb, NULL);
1da177e4
LT		 1781 }
1782
1783 if (test_bit(HCI_RAW, &hdev->flags)) {
1784 kfree_skb(skb);
1785 continue;
1786 }
1787
1788 if (test_bit(HCI_INIT, &hdev->flags)) {
1789 /* Don't process data packets in this states. */
0d48d939 1790 switch (bt_cb(skb)->pkt_type) {
1da177e4
LT		 1791 case HCI_ACLDATA_PKT:
1792 case HCI_SCODATA_PKT:
1793 kfree_skb(skb);
1794 continue;
3ff50b79 1795 }
1da177e4
LT		 1796 }
1797
1798 /* Process frame */
0d48d939 1799 switch (bt_cb(skb)->pkt_type) {
1da177e4
LT		 1800 case HCI_EVENT_PKT:
1801 hci_event_packet(hdev, skb);
1802 break;
1803
1804 case HCI_ACLDATA_PKT:
1805 BT_DBG("%s ACL data packet", hdev->name);
1806 hci_acldata_packet(hdev, skb);
1807 break;
1808
1809 case HCI_SCODATA_PKT:
1810 BT_DBG("%s SCO data packet", hdev->name);
1811 hci_scodata_packet(hdev, skb);
1812 break;
1813
1814 default:
1815 kfree_skb(skb);
1816 break;
1817 }
1818 }
1819
1820 read_unlock(&hci_task_lock);
1821}
1822
1823static void hci_cmd_task(unsigned long arg)
1824{
1825 struct hci_dev *hdev = (struct hci_dev *) arg;
1826 struct sk_buff *skb;
1827
1828 BT_DBG("%s cmd %d", hdev->name, atomic_read(&hdev->cmd_cnt));
1829
82453021 1830 if (!atomic_read(&hdev->cmd_cnt) && time_after(jiffies, hdev->cmd_last_tx + HZ)) {
1da177e4
LT		 1831 BT_ERR("%s command tx timeout", hdev->name);
1832 atomic_set(&hdev->cmd_cnt, 1);
1833 }
1834
1835 /* Send queued commands */
1836 if (atomic_read(&hdev->cmd_cnt) && (skb = skb_dequeue(&hdev->cmd_q))) {
7585b97a 1837 kfree_skb(hdev->sent_cmd);
1da177e4 1838
70f23020
AE		 1839 hdev->sent_cmd = skb_clone(skb, GFP_ATOMIC);
1840 if (hdev->sent_cmd) {
1da177e4
LT		 1841 atomic_dec(&hdev->cmd_cnt);
1842 hci_send_frame(skb);
1843 hdev->cmd_last_tx = jiffies;
1844 } else {
1845 skb_queue_head(&hdev->cmd_q, skb);
c78ae283 1846 tasklet_schedule(&hdev->cmd_task);
1da177e4
LT		 1847 }
1848 }
1849}
kernel source for telekom puls (alcatel/mediatek)