2 BlueZ - Bluetooth protocol stack for Linux
3 Copyright (C) 2000-2001 Qualcomm Incorporated
5 Written 2000,2001 by Maxim Krasnyansky <maxk@qualcomm.com>
7 This program is free software; you can redistribute it and/or modify
8 it under the terms of the GNU General Public License version 2 as
9 published by the Free Software Foundation;
11 THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
12 OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
13 FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
14 IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
15 CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
16 WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
17 ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
18 OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
20 ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
21 COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
22 SOFTWARE IS DISCLAIMED.
25 /* Bluetooth HCI core. */
27 #include <linux/jiffies.h>
28 #include <linux/module.h>
29 #include <linux/kmod.h>
31 #include <linux/types.h>
32 #include <linux/errno.h>
33 #include <linux/kernel.h>
34 #include <linux/sched.h>
35 #include <linux/slab.h>
36 #include <linux/poll.h>
37 #include <linux/fcntl.h>
38 #include <linux/init.h>
39 #include <linux/skbuff.h>
40 #include <linux/workqueue.h>
41 #include <linux/interrupt.h>
42 #include <linux/notifier.h>
43 #include <linux/rfkill.h>
44 #include <linux/timer.h>
45 #include <linux/crypto.h>
48 #include <asm/system.h>
49 #include <linux/uaccess.h>
50 #include <asm/unaligned.h>
52 #include <net/bluetooth/bluetooth.h>
53 #include <net/bluetooth/hci_core.h>
55 #define AUTO_OFF_TIMEOUT 2000
57 static void hci_cmd_task(unsigned long arg
);
58 static void hci_rx_task(unsigned long arg
);
59 static void hci_tx_task(unsigned long arg
);
61 static DEFINE_RWLOCK(hci_task_lock
);
64 LIST_HEAD(hci_dev_list
);
65 DEFINE_RWLOCK(hci_dev_list_lock
);
67 /* HCI callback list */
68 LIST_HEAD(hci_cb_list
);
69 DEFINE_RWLOCK(hci_cb_list_lock
);
72 #define HCI_MAX_PROTO 2
73 struct hci_proto
*hci_proto
[HCI_MAX_PROTO
];
75 /* HCI notifiers list */
76 static ATOMIC_NOTIFIER_HEAD(hci_notifier
);
78 /* ---- HCI notifications ---- */
80 int hci_register_notifier(struct notifier_block
*nb
)
82 return atomic_notifier_chain_register(&hci_notifier
, nb
);
85 int hci_unregister_notifier(struct notifier_block
*nb
)
87 return atomic_notifier_chain_unregister(&hci_notifier
, nb
);
90 static void hci_notify(struct hci_dev
*hdev
, int event
)
92 atomic_notifier_call_chain(&hci_notifier
, event
, hdev
);
95 /* ---- HCI requests ---- */
97 void hci_req_complete(struct hci_dev
*hdev
, __u16 cmd
, int result
)
99 BT_DBG("%s command 0x%04x result 0x%2.2x", hdev
->name
, cmd
, result
);
101 /* If this is the init phase check if the completed command matches
102 * the last init command, and if not just return.
104 if (test_bit(HCI_INIT
, &hdev
->flags
) && hdev
->init_last_cmd
!= cmd
)
107 if (hdev
->req_status
== HCI_REQ_PEND
) {
108 hdev
->req_result
= result
;
109 hdev
->req_status
= HCI_REQ_DONE
;
110 wake_up_interruptible(&hdev
->req_wait_q
);
114 static void hci_req_cancel(struct hci_dev
*hdev
, int err
)
116 BT_DBG("%s err 0x%2.2x", hdev
->name
, err
);
118 if (hdev
->req_status
== HCI_REQ_PEND
) {
119 hdev
->req_result
= err
;
120 hdev
->req_status
= HCI_REQ_CANCELED
;
121 wake_up_interruptible(&hdev
->req_wait_q
);
125 /* Execute request and wait for completion. */
126 static int __hci_request(struct hci_dev
*hdev
, void (*req
)(struct hci_dev
*hdev
, unsigned long opt
),
127 unsigned long opt
, __u32 timeout
)
129 DECLARE_WAITQUEUE(wait
, current
);
132 BT_DBG("%s start", hdev
->name
);
134 hdev
->req_status
= HCI_REQ_PEND
;
136 add_wait_queue(&hdev
->req_wait_q
, &wait
);
137 set_current_state(TASK_INTERRUPTIBLE
);
140 schedule_timeout(timeout
);
142 remove_wait_queue(&hdev
->req_wait_q
, &wait
);
144 if (signal_pending(current
))
147 switch (hdev
->req_status
) {
149 err
= -bt_to_errno(hdev
->req_result
);
152 case HCI_REQ_CANCELED
:
153 err
= -hdev
->req_result
;
161 hdev
->req_status
= hdev
->req_result
= 0;
163 BT_DBG("%s end: err %d", hdev
->name
, err
);
168 static inline int hci_request(struct hci_dev
*hdev
, void (*req
)(struct hci_dev
*hdev
, unsigned long opt
),
169 unsigned long opt
, __u32 timeout
)
173 if (!test_bit(HCI_UP
, &hdev
->flags
))
176 /* Serialize all requests */
178 ret
= __hci_request(hdev
, req
, opt
, timeout
);
179 hci_req_unlock(hdev
);
184 static void hci_reset_req(struct hci_dev
*hdev
, unsigned long opt
)
186 BT_DBG("%s %ld", hdev
->name
, opt
);
189 set_bit(HCI_RESET
, &hdev
->flags
);
190 hci_send_cmd(hdev
, HCI_OP_RESET
, 0, NULL
);
193 static void hci_init_req(struct hci_dev
*hdev
, unsigned long opt
)
195 struct hci_cp_delete_stored_link_key cp
;
200 BT_DBG("%s %ld", hdev
->name
, opt
);
202 /* Driver initialization */
204 /* Special commands */
205 while ((skb
= skb_dequeue(&hdev
->driver_init
))) {
206 bt_cb(skb
)->pkt_type
= HCI_COMMAND_PKT
;
207 skb
->dev
= (void *) hdev
;
209 skb_queue_tail(&hdev
->cmd_q
, skb
);
210 tasklet_schedule(&hdev
->cmd_task
);
212 skb_queue_purge(&hdev
->driver_init
);
214 /* Mandatory initialization */
217 if (!test_bit(HCI_QUIRK_NO_RESET
, &hdev
->quirks
)) {
218 set_bit(HCI_RESET
, &hdev
->flags
);
219 hci_send_cmd(hdev
, HCI_OP_RESET
, 0, NULL
);
222 /* Read Local Supported Features */
223 hci_send_cmd(hdev
, HCI_OP_READ_LOCAL_FEATURES
, 0, NULL
);
225 /* Read Local Version */
226 hci_send_cmd(hdev
, HCI_OP_READ_LOCAL_VERSION
, 0, NULL
);
228 /* Read Buffer Size (ACL mtu, max pkt, etc.) */
229 hci_send_cmd(hdev
, HCI_OP_READ_BUFFER_SIZE
, 0, NULL
);
232 /* Host buffer size */
234 struct hci_cp_host_buffer_size cp
;
235 cp
.acl_mtu
= cpu_to_le16(HCI_MAX_ACL_SIZE
);
236 cp
.sco_mtu
= HCI_MAX_SCO_SIZE
;
237 cp
.acl_max_pkt
= cpu_to_le16(0xffff);
238 cp
.sco_max_pkt
= cpu_to_le16(0xffff);
239 hci_send_cmd(hdev
, HCI_OP_HOST_BUFFER_SIZE
, sizeof(cp
), &cp
);
243 /* Read BD Address */
244 hci_send_cmd(hdev
, HCI_OP_READ_BD_ADDR
, 0, NULL
);
246 /* Read Class of Device */
247 hci_send_cmd(hdev
, HCI_OP_READ_CLASS_OF_DEV
, 0, NULL
);
249 /* Read Local Name */
250 hci_send_cmd(hdev
, HCI_OP_READ_LOCAL_NAME
, 0, NULL
);
252 /* Read Voice Setting */
253 hci_send_cmd(hdev
, HCI_OP_READ_VOICE_SETTING
, 0, NULL
);
255 /* Optional initialization */
257 /* Clear Event Filters */
258 flt_type
= HCI_FLT_CLEAR_ALL
;
259 hci_send_cmd(hdev
, HCI_OP_SET_EVENT_FLT
, 1, &flt_type
);
261 /* Connection accept timeout ~20 secs */
262 param
= cpu_to_le16(0x7d00);
263 hci_send_cmd(hdev
, HCI_OP_WRITE_CA_TIMEOUT
, 2, ¶m
);
265 bacpy(&cp
.bdaddr
, BDADDR_ANY
);
267 hci_send_cmd(hdev
, HCI_OP_DELETE_STORED_LINK_KEY
, sizeof(cp
), &cp
);
270 static void hci_le_init_req(struct hci_dev
*hdev
, unsigned long opt
)
272 BT_DBG("%s", hdev
->name
);
274 /* Read LE buffer size */
275 hci_send_cmd(hdev
, HCI_OP_LE_READ_BUFFER_SIZE
, 0, NULL
);
278 static void hci_scan_req(struct hci_dev
*hdev
, unsigned long opt
)
282 BT_DBG("%s %x", hdev
->name
, scan
);
284 /* Inquiry and Page scans */
285 hci_send_cmd(hdev
, HCI_OP_WRITE_SCAN_ENABLE
, 1, &scan
);
288 static void hci_auth_req(struct hci_dev
*hdev
, unsigned long opt
)
292 BT_DBG("%s %x", hdev
->name
, auth
);
295 hci_send_cmd(hdev
, HCI_OP_WRITE_AUTH_ENABLE
, 1, &auth
);
298 static void hci_encrypt_req(struct hci_dev
*hdev
, unsigned long opt
)
302 BT_DBG("%s %x", hdev
->name
, encrypt
);
305 hci_send_cmd(hdev
, HCI_OP_WRITE_ENCRYPT_MODE
, 1, &encrypt
);
308 static void hci_linkpol_req(struct hci_dev
*hdev
, unsigned long opt
)
310 __le16 policy
= cpu_to_le16(opt
);
312 BT_DBG("%s %x", hdev
->name
, policy
);
314 /* Default link policy */
315 hci_send_cmd(hdev
, HCI_OP_WRITE_DEF_LINK_POLICY
, 2, &policy
);
318 /* Get HCI device by index.
319 * Device is held on return. */
320 struct hci_dev
*hci_dev_get(int index
)
322 struct hci_dev
*hdev
= NULL
, *d
;
329 read_lock(&hci_dev_list_lock
);
330 list_for_each_entry(d
, &hci_dev_list
, list
) {
331 if (d
->id
== index
) {
332 hdev
= hci_dev_hold(d
);
336 read_unlock(&hci_dev_list_lock
);
340 /* ---- Inquiry support ---- */
341 static void inquiry_cache_flush(struct hci_dev
*hdev
)
343 struct inquiry_cache
*cache
= &hdev
->inq_cache
;
344 struct inquiry_entry
*next
= cache
->list
, *e
;
346 BT_DBG("cache %p", cache
);
355 struct inquiry_entry
*hci_inquiry_cache_lookup(struct hci_dev
*hdev
, bdaddr_t
*bdaddr
)
357 struct inquiry_cache
*cache
= &hdev
->inq_cache
;
358 struct inquiry_entry
*e
;
360 BT_DBG("cache %p, %s", cache
, batostr(bdaddr
));
362 for (e
= cache
->list
; e
; e
= e
->next
)
363 if (!bacmp(&e
->data
.bdaddr
, bdaddr
))
368 void hci_inquiry_cache_update(struct hci_dev
*hdev
, struct inquiry_data
*data
)
370 struct inquiry_cache
*cache
= &hdev
->inq_cache
;
371 struct inquiry_entry
*ie
;
373 BT_DBG("cache %p, %s", cache
, batostr(&data
->bdaddr
));
375 ie
= hci_inquiry_cache_lookup(hdev
, &data
->bdaddr
);
377 /* Entry not in the cache. Add new one. */
378 ie
= kzalloc(sizeof(struct inquiry_entry
), GFP_ATOMIC
);
382 ie
->next
= cache
->list
;
386 memcpy(&ie
->data
, data
, sizeof(*data
));
387 ie
->timestamp
= jiffies
;
388 cache
->timestamp
= jiffies
;
391 static int inquiry_cache_dump(struct hci_dev
*hdev
, int num
, __u8
*buf
)
393 struct inquiry_cache
*cache
= &hdev
->inq_cache
;
394 struct inquiry_info
*info
= (struct inquiry_info
*) buf
;
395 struct inquiry_entry
*e
;
398 for (e
= cache
->list
; e
&& copied
< num
; e
= e
->next
, copied
++) {
399 struct inquiry_data
*data
= &e
->data
;
400 bacpy(&info
->bdaddr
, &data
->bdaddr
);
401 info
->pscan_rep_mode
= data
->pscan_rep_mode
;
402 info
->pscan_period_mode
= data
->pscan_period_mode
;
403 info
->pscan_mode
= data
->pscan_mode
;
404 memcpy(info
->dev_class
, data
->dev_class
, 3);
405 info
->clock_offset
= data
->clock_offset
;
409 BT_DBG("cache %p, copied %d", cache
, copied
);
413 static void hci_inq_req(struct hci_dev
*hdev
, unsigned long opt
)
415 struct hci_inquiry_req
*ir
= (struct hci_inquiry_req
*) opt
;
416 struct hci_cp_inquiry cp
;
418 BT_DBG("%s", hdev
->name
);
420 if (test_bit(HCI_INQUIRY
, &hdev
->flags
))
424 memcpy(&cp
.lap
, &ir
->lap
, 3);
425 cp
.length
= ir
->length
;
426 cp
.num_rsp
= ir
->num_rsp
;
427 hci_send_cmd(hdev
, HCI_OP_INQUIRY
, sizeof(cp
), &cp
);
430 int hci_inquiry(void __user
*arg
)
432 __u8 __user
*ptr
= arg
;
433 struct hci_inquiry_req ir
;
434 struct hci_dev
*hdev
;
435 int err
= 0, do_inquiry
= 0, max_rsp
;
439 if (copy_from_user(&ir
, ptr
, sizeof(ir
)))
442 hdev
= hci_dev_get(ir
.dev_id
);
446 hci_dev_lock_bh(hdev
);
447 if (inquiry_cache_age(hdev
) > INQUIRY_CACHE_AGE_MAX
||
448 inquiry_cache_empty(hdev
) ||
449 ir
.flags
& IREQ_CACHE_FLUSH
) {
450 inquiry_cache_flush(hdev
);
453 hci_dev_unlock_bh(hdev
);
455 timeo
= ir
.length
* msecs_to_jiffies(2000);
458 err
= hci_request(hdev
, hci_inq_req
, (unsigned long)&ir
, timeo
);
463 /* for unlimited number of responses we will use buffer with 255 entries */
464 max_rsp
= (ir
.num_rsp
== 0) ? 255 : ir
.num_rsp
;
466 /* cache_dump can't sleep. Therefore we allocate temp buffer and then
467 * copy it to the user space.
469 buf
= kmalloc(sizeof(struct inquiry_info
) * max_rsp
, GFP_KERNEL
);
475 hci_dev_lock_bh(hdev
);
476 ir
.num_rsp
= inquiry_cache_dump(hdev
, max_rsp
, buf
);
477 hci_dev_unlock_bh(hdev
);
479 BT_DBG("num_rsp %d", ir
.num_rsp
);
481 if (!copy_to_user(ptr
, &ir
, sizeof(ir
))) {
483 if (copy_to_user(ptr
, buf
, sizeof(struct inquiry_info
) *
496 /* ---- HCI ioctl helpers ---- */
498 int hci_dev_open(__u16 dev
)
500 struct hci_dev
*hdev
;
503 hdev
= hci_dev_get(dev
);
507 BT_DBG("%s %p", hdev
->name
, hdev
);
511 if (hdev
->rfkill
&& rfkill_blocked(hdev
->rfkill
)) {
516 if (test_bit(HCI_UP
, &hdev
->flags
)) {
521 if (test_bit(HCI_QUIRK_RAW_DEVICE
, &hdev
->quirks
))
522 set_bit(HCI_RAW
, &hdev
->flags
);
524 /* Treat all non BR/EDR controllers as raw devices for now */
525 if (hdev
->dev_type
!= HCI_BREDR
)
526 set_bit(HCI_RAW
, &hdev
->flags
);
528 if (hdev
->open(hdev
)) {
533 if (!test_bit(HCI_RAW
, &hdev
->flags
)) {
534 atomic_set(&hdev
->cmd_cnt
, 1);
535 set_bit(HCI_INIT
, &hdev
->flags
);
536 hdev
->init_last_cmd
= 0;
538 ret
= __hci_request(hdev
, hci_init_req
, 0,
539 msecs_to_jiffies(HCI_INIT_TIMEOUT
));
541 if (lmp_host_le_capable(hdev
))
542 ret
= __hci_request(hdev
, hci_le_init_req
, 0,
543 msecs_to_jiffies(HCI_INIT_TIMEOUT
));
545 clear_bit(HCI_INIT
, &hdev
->flags
);
550 set_bit(HCI_UP
, &hdev
->flags
);
551 hci_notify(hdev
, HCI_DEV_UP
);
552 if (!test_bit(HCI_SETUP
, &hdev
->flags
)) {
553 hci_dev_lock_bh(hdev
);
554 mgmt_powered(hdev
, 1);
555 hci_dev_unlock_bh(hdev
);
558 /* Init failed, cleanup */
559 tasklet_kill(&hdev
->rx_task
);
560 tasklet_kill(&hdev
->tx_task
);
561 tasklet_kill(&hdev
->cmd_task
);
563 skb_queue_purge(&hdev
->cmd_q
);
564 skb_queue_purge(&hdev
->rx_q
);
569 if (hdev
->sent_cmd
) {
570 kfree_skb(hdev
->sent_cmd
);
571 hdev
->sent_cmd
= NULL
;
579 hci_req_unlock(hdev
);
584 static int hci_dev_do_close(struct hci_dev
*hdev
)
586 BT_DBG("%s %p", hdev
->name
, hdev
);
588 hci_req_cancel(hdev
, ENODEV
);
591 if (!test_and_clear_bit(HCI_UP
, &hdev
->flags
)) {
592 del_timer_sync(&hdev
->cmd_timer
);
593 hci_req_unlock(hdev
);
597 /* Kill RX and TX tasks */
598 tasklet_kill(&hdev
->rx_task
);
599 tasklet_kill(&hdev
->tx_task
);
601 if (hdev
->discov_timeout
> 0) {
602 cancel_delayed_work_sync(&hdev
->discov_off
);
603 hdev
->discov_timeout
= 0;
606 if (test_and_clear_bit(HCI_AUTO_OFF
, &hdev
->flags
))
607 cancel_delayed_work_sync(&hdev
->power_off
);
609 hci_dev_lock_bh(hdev
);
610 inquiry_cache_flush(hdev
);
611 hci_conn_hash_flush(hdev
);
612 hci_dev_unlock_bh(hdev
);
614 hci_notify(hdev
, HCI_DEV_DOWN
);
620 skb_queue_purge(&hdev
->cmd_q
);
621 atomic_set(&hdev
->cmd_cnt
, 1);
622 if (!test_bit(HCI_RAW
, &hdev
->flags
)) {
623 set_bit(HCI_INIT
, &hdev
->flags
);
624 __hci_request(hdev
, hci_reset_req
, 0,
625 msecs_to_jiffies(HCI_INIT_TIMEOUT
));
626 clear_bit(HCI_INIT
, &hdev
->flags
);
630 tasklet_kill(&hdev
->cmd_task
);
633 skb_queue_purge(&hdev
->rx_q
);
634 skb_queue_purge(&hdev
->cmd_q
);
635 skb_queue_purge(&hdev
->raw_q
);
637 /* Drop last sent command */
638 if (hdev
->sent_cmd
) {
639 del_timer_sync(&hdev
->cmd_timer
);
640 kfree_skb(hdev
->sent_cmd
);
641 hdev
->sent_cmd
= NULL
;
644 /* After this point our queues are empty
645 * and no tasks are scheduled. */
648 hci_dev_lock_bh(hdev
);
649 mgmt_powered(hdev
, 0);
650 hci_dev_unlock_bh(hdev
);
655 hci_req_unlock(hdev
);
661 int hci_dev_close(__u16 dev
)
663 struct hci_dev
*hdev
;
666 hdev
= hci_dev_get(dev
);
669 err
= hci_dev_do_close(hdev
);
674 int hci_dev_reset(__u16 dev
)
676 struct hci_dev
*hdev
;
679 hdev
= hci_dev_get(dev
);
684 tasklet_disable(&hdev
->tx_task
);
686 if (!test_bit(HCI_UP
, &hdev
->flags
))
690 skb_queue_purge(&hdev
->rx_q
);
691 skb_queue_purge(&hdev
->cmd_q
);
693 hci_dev_lock_bh(hdev
);
694 inquiry_cache_flush(hdev
);
695 hci_conn_hash_flush(hdev
);
696 hci_dev_unlock_bh(hdev
);
701 atomic_set(&hdev
->cmd_cnt
, 1);
702 hdev
->acl_cnt
= 0; hdev
->sco_cnt
= 0; hdev
->le_cnt
= 0;
704 if (!test_bit(HCI_RAW
, &hdev
->flags
))
705 ret
= __hci_request(hdev
, hci_reset_req
, 0,
706 msecs_to_jiffies(HCI_INIT_TIMEOUT
));
709 tasklet_enable(&hdev
->tx_task
);
710 hci_req_unlock(hdev
);
715 int hci_dev_reset_stat(__u16 dev
)
717 struct hci_dev
*hdev
;
720 hdev
= hci_dev_get(dev
);
724 memset(&hdev
->stat
, 0, sizeof(struct hci_dev_stats
));
731 int hci_dev_cmd(unsigned int cmd
, void __user
*arg
)
733 struct hci_dev
*hdev
;
734 struct hci_dev_req dr
;
737 if (copy_from_user(&dr
, arg
, sizeof(dr
)))
740 hdev
= hci_dev_get(dr
.dev_id
);
746 err
= hci_request(hdev
, hci_auth_req
, dr
.dev_opt
,
747 msecs_to_jiffies(HCI_INIT_TIMEOUT
));
751 if (!lmp_encrypt_capable(hdev
)) {
756 if (!test_bit(HCI_AUTH
, &hdev
->flags
)) {
757 /* Auth must be enabled first */
758 err
= hci_request(hdev
, hci_auth_req
, dr
.dev_opt
,
759 msecs_to_jiffies(HCI_INIT_TIMEOUT
));
764 err
= hci_request(hdev
, hci_encrypt_req
, dr
.dev_opt
,
765 msecs_to_jiffies(HCI_INIT_TIMEOUT
));
769 err
= hci_request(hdev
, hci_scan_req
, dr
.dev_opt
,
770 msecs_to_jiffies(HCI_INIT_TIMEOUT
));
774 err
= hci_request(hdev
, hci_linkpol_req
, dr
.dev_opt
,
775 msecs_to_jiffies(HCI_INIT_TIMEOUT
));
779 hdev
->link_mode
= ((__u16
) dr
.dev_opt
) &
780 (HCI_LM_MASTER
| HCI_LM_ACCEPT
);
784 hdev
->pkt_type
= (__u16
) dr
.dev_opt
;
788 hdev
->acl_mtu
= *((__u16
*) &dr
.dev_opt
+ 1);
789 hdev
->acl_pkts
= *((__u16
*) &dr
.dev_opt
+ 0);
793 hdev
->sco_mtu
= *((__u16
*) &dr
.dev_opt
+ 1);
794 hdev
->sco_pkts
= *((__u16
*) &dr
.dev_opt
+ 0);
806 int hci_get_dev_list(void __user
*arg
)
808 struct hci_dev
*hdev
;
809 struct hci_dev_list_req
*dl
;
810 struct hci_dev_req
*dr
;
811 int n
= 0, size
, err
;
814 if (get_user(dev_num
, (__u16 __user
*) arg
))
817 if (!dev_num
|| dev_num
> (PAGE_SIZE
* 2) / sizeof(*dr
))
820 size
= sizeof(*dl
) + dev_num
* sizeof(*dr
);
822 dl
= kzalloc(size
, GFP_KERNEL
);
828 read_lock_bh(&hci_dev_list_lock
);
829 list_for_each_entry(hdev
, &hci_dev_list
, list
) {
830 if (test_and_clear_bit(HCI_AUTO_OFF
, &hdev
->flags
))
831 cancel_delayed_work_sync(&hdev
->power_off
);
833 if (!test_bit(HCI_MGMT
, &hdev
->flags
))
834 set_bit(HCI_PAIRABLE
, &hdev
->flags
);
836 (dr
+ n
)->dev_id
= hdev
->id
;
837 (dr
+ n
)->dev_opt
= hdev
->flags
;
842 read_unlock_bh(&hci_dev_list_lock
);
845 size
= sizeof(*dl
) + n
* sizeof(*dr
);
847 err
= copy_to_user(arg
, dl
, size
);
850 return err
? -EFAULT
: 0;
853 int hci_get_dev_info(void __user
*arg
)
855 struct hci_dev
*hdev
;
856 struct hci_dev_info di
;
859 if (copy_from_user(&di
, arg
, sizeof(di
)))
862 hdev
= hci_dev_get(di
.dev_id
);
866 if (test_and_clear_bit(HCI_AUTO_OFF
, &hdev
->flags
))
867 cancel_delayed_work_sync(&hdev
->power_off
);
869 if (!test_bit(HCI_MGMT
, &hdev
->flags
))
870 set_bit(HCI_PAIRABLE
, &hdev
->flags
);
872 strcpy(di
.name
, hdev
->name
);
873 di
.bdaddr
= hdev
->bdaddr
;
874 di
.type
= (hdev
->bus
& 0x0f) | (hdev
->dev_type
<< 4);
875 di
.flags
= hdev
->flags
;
876 di
.pkt_type
= hdev
->pkt_type
;
877 di
.acl_mtu
= hdev
->acl_mtu
;
878 di
.acl_pkts
= hdev
->acl_pkts
;
879 di
.sco_mtu
= hdev
->sco_mtu
;
880 di
.sco_pkts
= hdev
->sco_pkts
;
881 di
.link_policy
= hdev
->link_policy
;
882 di
.link_mode
= hdev
->link_mode
;
884 memcpy(&di
.stat
, &hdev
->stat
, sizeof(di
.stat
));
885 memcpy(&di
.features
, &hdev
->features
, sizeof(di
.features
));
887 if (copy_to_user(arg
, &di
, sizeof(di
)))
895 /* ---- Interface to HCI drivers ---- */
897 static int hci_rfkill_set_block(void *data
, bool blocked
)
899 struct hci_dev
*hdev
= data
;
901 BT_DBG("%p name %s blocked %d", hdev
, hdev
->name
, blocked
);
906 hci_dev_do_close(hdev
);
911 static const struct rfkill_ops hci_rfkill_ops
= {
912 .set_block
= hci_rfkill_set_block
,
915 /* Alloc HCI device */
916 struct hci_dev
*hci_alloc_dev(void)
918 struct hci_dev
*hdev
;
920 hdev
= kzalloc(sizeof(struct hci_dev
), GFP_KERNEL
);
924 hci_init_sysfs(hdev
);
925 skb_queue_head_init(&hdev
->driver_init
);
929 EXPORT_SYMBOL(hci_alloc_dev
);
931 /* Free HCI device */
932 void hci_free_dev(struct hci_dev
*hdev
)
934 skb_queue_purge(&hdev
->driver_init
);
936 /* will free via device release */
937 put_device(&hdev
->dev
);
939 EXPORT_SYMBOL(hci_free_dev
);
941 static void hci_power_on(struct work_struct
*work
)
943 struct hci_dev
*hdev
= container_of(work
, struct hci_dev
, power_on
);
945 BT_DBG("%s", hdev
->name
);
947 if (hci_dev_open(hdev
->id
) < 0)
950 if (test_bit(HCI_AUTO_OFF
, &hdev
->flags
))
951 queue_delayed_work(hdev
->workqueue
, &hdev
->power_off
,
952 msecs_to_jiffies(AUTO_OFF_TIMEOUT
));
954 if (test_and_clear_bit(HCI_SETUP
, &hdev
->flags
))
955 mgmt_index_added(hdev
);
958 static void hci_power_off(struct work_struct
*work
)
960 struct hci_dev
*hdev
= container_of(work
, struct hci_dev
,
963 BT_DBG("%s", hdev
->name
);
965 clear_bit(HCI_AUTO_OFF
, &hdev
->flags
);
967 hci_dev_close(hdev
->id
);
970 static void hci_discov_off(struct work_struct
*work
)
972 struct hci_dev
*hdev
;
975 hdev
= container_of(work
, struct hci_dev
, discov_off
.work
);
977 BT_DBG("%s", hdev
->name
);
979 hci_dev_lock_bh(hdev
);
981 hci_send_cmd(hdev
, HCI_OP_WRITE_SCAN_ENABLE
, sizeof(scan
), &scan
);
983 hdev
->discov_timeout
= 0;
985 hci_dev_unlock_bh(hdev
);
988 int hci_uuids_clear(struct hci_dev
*hdev
)
990 struct list_head
*p
, *n
;
992 list_for_each_safe(p
, n
, &hdev
->uuids
) {
993 struct bt_uuid
*uuid
;
995 uuid
= list_entry(p
, struct bt_uuid
, list
);
1004 int hci_link_keys_clear(struct hci_dev
*hdev
)
1006 struct list_head
*p
, *n
;
1008 list_for_each_safe(p
, n
, &hdev
->link_keys
) {
1009 struct link_key
*key
;
1011 key
= list_entry(p
, struct link_key
, list
);
1020 struct link_key
*hci_find_link_key(struct hci_dev
*hdev
, bdaddr_t
*bdaddr
)
1024 list_for_each_entry(k
, &hdev
->link_keys
, list
)
1025 if (bacmp(bdaddr
, &k
->bdaddr
) == 0)
1031 static int hci_persistent_key(struct hci_dev
*hdev
, struct hci_conn
*conn
,
1032 u8 key_type
, u8 old_key_type
)
1035 if (key_type
< 0x03)
1038 /* Debug keys are insecure so don't store them persistently */
1039 if (key_type
== HCI_LK_DEBUG_COMBINATION
)
1042 /* Changed combination key and there's no previous one */
1043 if (key_type
== HCI_LK_CHANGED_COMBINATION
&& old_key_type
== 0xff)
1046 /* Security mode 3 case */
1050 /* Neither local nor remote side had no-bonding as requirement */
1051 if (conn
->auth_type
> 0x01 && conn
->remote_auth
> 0x01)
1054 /* Local side had dedicated bonding as requirement */
1055 if (conn
->auth_type
== 0x02 || conn
->auth_type
== 0x03)
1058 /* Remote side had dedicated bonding as requirement */
1059 if (conn
->remote_auth
== 0x02 || conn
->remote_auth
== 0x03)
1062 /* If none of the above criteria match, then don't store the key
1067 struct link_key
*hci_find_ltk(struct hci_dev
*hdev
, __le16 ediv
, u8 rand
[8])
1071 list_for_each_entry(k
, &hdev
->link_keys
, list
) {
1072 struct key_master_id
*id
;
1074 if (k
->type
!= HCI_LK_SMP_LTK
)
1077 if (k
->dlen
!= sizeof(*id
))
1080 id
= (void *) &k
->data
;
1081 if (id
->ediv
== ediv
&&
1082 (memcmp(rand
, id
->rand
, sizeof(id
->rand
)) == 0))
1088 EXPORT_SYMBOL(hci_find_ltk
);
1090 struct link_key
*hci_find_link_key_type(struct hci_dev
*hdev
,
1091 bdaddr_t
*bdaddr
, u8 type
)
1095 list_for_each_entry(k
, &hdev
->link_keys
, list
)
1096 if (k
->type
== type
&& bacmp(bdaddr
, &k
->bdaddr
) == 0)
1101 EXPORT_SYMBOL(hci_find_link_key_type
);
1103 int hci_add_link_key(struct hci_dev
*hdev
, struct hci_conn
*conn
, int new_key
,
1104 bdaddr_t
*bdaddr
, u8
*val
, u8 type
, u8 pin_len
)
1106 struct link_key
*key
, *old_key
;
1107 u8 old_key_type
, persistent
;
1109 old_key
= hci_find_link_key(hdev
, bdaddr
);
1111 old_key_type
= old_key
->type
;
1114 old_key_type
= conn
? conn
->key_type
: 0xff;
1115 key
= kzalloc(sizeof(*key
), GFP_ATOMIC
);
1118 list_add(&key
->list
, &hdev
->link_keys
);
1121 BT_DBG("%s key for %s type %u", hdev
->name
, batostr(bdaddr
), type
);
1123 /* Some buggy controller combinations generate a changed
1124 * combination key for legacy pairing even when there's no
1126 if (type
== HCI_LK_CHANGED_COMBINATION
&&
1127 (!conn
|| conn
->remote_auth
== 0xff) &&
1128 old_key_type
== 0xff) {
1129 type
= HCI_LK_COMBINATION
;
1131 conn
->key_type
= type
;
1134 bacpy(&key
->bdaddr
, bdaddr
);
1135 memcpy(key
->val
, val
, 16);
1136 key
->pin_len
= pin_len
;
1138 if (type
== HCI_LK_CHANGED_COMBINATION
)
1139 key
->type
= old_key_type
;
1146 persistent
= hci_persistent_key(hdev
, conn
, type
, old_key_type
);
1148 mgmt_new_link_key(hdev
, key
, persistent
);
1151 list_del(&key
->list
);
1158 int hci_add_ltk(struct hci_dev
*hdev
, int new_key
, bdaddr_t
*bdaddr
,
1159 u8 key_size
, __le16 ediv
, u8 rand
[8], u8 ltk
[16])
1161 struct link_key
*key
, *old_key
;
1162 struct key_master_id
*id
;
1165 BT_DBG("%s addr %s", hdev
->name
, batostr(bdaddr
));
1167 old_key
= hci_find_link_key_type(hdev
, bdaddr
, HCI_LK_SMP_LTK
);
1170 old_key_type
= old_key
->type
;
1172 key
= kzalloc(sizeof(*key
) + sizeof(*id
), GFP_ATOMIC
);
1175 list_add(&key
->list
, &hdev
->link_keys
);
1176 old_key_type
= 0xff;
1179 key
->dlen
= sizeof(*id
);
1181 bacpy(&key
->bdaddr
, bdaddr
);
1182 memcpy(key
->val
, ltk
, sizeof(key
->val
));
1183 key
->type
= HCI_LK_SMP_LTK
;
1184 key
->pin_len
= key_size
;
1186 id
= (void *) &key
->data
;
1188 memcpy(id
->rand
, rand
, sizeof(id
->rand
));
1191 mgmt_new_link_key(hdev
, key
, old_key_type
);
1196 int hci_remove_link_key(struct hci_dev
*hdev
, bdaddr_t
*bdaddr
)
1198 struct link_key
*key
;
1200 key
= hci_find_link_key(hdev
, bdaddr
);
1204 BT_DBG("%s removing %s", hdev
->name
, batostr(bdaddr
));
1206 list_del(&key
->list
);
1212 /* HCI command timer function */
1213 static void hci_cmd_timer(unsigned long arg
)
1215 struct hci_dev
*hdev
= (void *) arg
;
1217 BT_ERR("%s command tx timeout", hdev
->name
);
1218 atomic_set(&hdev
->cmd_cnt
, 1);
1219 tasklet_schedule(&hdev
->cmd_task
);
1222 struct oob_data
*hci_find_remote_oob_data(struct hci_dev
*hdev
,
1225 struct oob_data
*data
;
1227 list_for_each_entry(data
, &hdev
->remote_oob_data
, list
)
1228 if (bacmp(bdaddr
, &data
->bdaddr
) == 0)
1234 int hci_remove_remote_oob_data(struct hci_dev
*hdev
, bdaddr_t
*bdaddr
)
1236 struct oob_data
*data
;
1238 data
= hci_find_remote_oob_data(hdev
, bdaddr
);
1242 BT_DBG("%s removing %s", hdev
->name
, batostr(bdaddr
));
1244 list_del(&data
->list
);
1250 int hci_remote_oob_data_clear(struct hci_dev
*hdev
)
1252 struct oob_data
*data
, *n
;
1254 list_for_each_entry_safe(data
, n
, &hdev
->remote_oob_data
, list
) {
1255 list_del(&data
->list
);
1262 int hci_add_remote_oob_data(struct hci_dev
*hdev
, bdaddr_t
*bdaddr
, u8
*hash
,
1265 struct oob_data
*data
;
1267 data
= hci_find_remote_oob_data(hdev
, bdaddr
);
1270 data
= kmalloc(sizeof(*data
), GFP_ATOMIC
);
1274 bacpy(&data
->bdaddr
, bdaddr
);
1275 list_add(&data
->list
, &hdev
->remote_oob_data
);
1278 memcpy(data
->hash
, hash
, sizeof(data
->hash
));
1279 memcpy(data
->randomizer
, randomizer
, sizeof(data
->randomizer
));
1281 BT_DBG("%s for %s", hdev
->name
, batostr(bdaddr
));
1286 struct bdaddr_list
*hci_blacklist_lookup(struct hci_dev
*hdev
,
1289 struct bdaddr_list
*b
;
1291 list_for_each_entry(b
, &hdev
->blacklist
, list
)
1292 if (bacmp(bdaddr
, &b
->bdaddr
) == 0)
1298 int hci_blacklist_clear(struct hci_dev
*hdev
)
1300 struct list_head
*p
, *n
;
1302 list_for_each_safe(p
, n
, &hdev
->blacklist
) {
1303 struct bdaddr_list
*b
;
1305 b
= list_entry(p
, struct bdaddr_list
, list
);
1314 int hci_blacklist_add(struct hci_dev
*hdev
, bdaddr_t
*bdaddr
)
1316 struct bdaddr_list
*entry
;
1318 if (bacmp(bdaddr
, BDADDR_ANY
) == 0)
1321 if (hci_blacklist_lookup(hdev
, bdaddr
))
1324 entry
= kzalloc(sizeof(struct bdaddr_list
), GFP_KERNEL
);
1328 bacpy(&entry
->bdaddr
, bdaddr
);
1330 list_add(&entry
->list
, &hdev
->blacklist
);
1332 return mgmt_device_blocked(hdev
, bdaddr
);
1335 int hci_blacklist_del(struct hci_dev
*hdev
, bdaddr_t
*bdaddr
)
1337 struct bdaddr_list
*entry
;
1339 if (bacmp(bdaddr
, BDADDR_ANY
) == 0) {
1340 return hci_blacklist_clear(hdev
);
1343 entry
= hci_blacklist_lookup(hdev
, bdaddr
);
1348 list_del(&entry
->list
);
1351 return mgmt_device_unblocked(hdev
, bdaddr
);
1354 static void hci_clear_adv_cache(unsigned long arg
)
1356 struct hci_dev
*hdev
= (void *) arg
;
1360 hci_adv_entries_clear(hdev
);
1362 hci_dev_unlock(hdev
);
1365 int hci_adv_entries_clear(struct hci_dev
*hdev
)
1367 struct adv_entry
*entry
, *tmp
;
1369 list_for_each_entry_safe(entry
, tmp
, &hdev
->adv_entries
, list
) {
1370 list_del(&entry
->list
);
1374 BT_DBG("%s adv cache cleared", hdev
->name
);
1379 struct adv_entry
*hci_find_adv_entry(struct hci_dev
*hdev
, bdaddr_t
*bdaddr
)
1381 struct adv_entry
*entry
;
1383 list_for_each_entry(entry
, &hdev
->adv_entries
, list
)
1384 if (bacmp(bdaddr
, &entry
->bdaddr
) == 0)
1390 static inline int is_connectable_adv(u8 evt_type
)
1392 if (evt_type
== ADV_IND
|| evt_type
== ADV_DIRECT_IND
)
1398 int hci_add_adv_entry(struct hci_dev
*hdev
,
1399 struct hci_ev_le_advertising_info
*ev
)
1401 struct adv_entry
*entry
;
1403 if (!is_connectable_adv(ev
->evt_type
))
1406 /* Only new entries should be added to adv_entries. So, if
1407 * bdaddr was found, don't add it. */
1408 if (hci_find_adv_entry(hdev
, &ev
->bdaddr
))
1411 entry
= kzalloc(sizeof(*entry
), GFP_ATOMIC
);
1415 bacpy(&entry
->bdaddr
, &ev
->bdaddr
);
1416 entry
->bdaddr_type
= ev
->bdaddr_type
;
1418 list_add(&entry
->list
, &hdev
->adv_entries
);
1420 BT_DBG("%s adv entry added: address %s type %u", hdev
->name
,
1421 batostr(&entry
->bdaddr
), entry
->bdaddr_type
);
1426 /* Register HCI device */
1427 int hci_register_dev(struct hci_dev
*hdev
)
1429 struct list_head
*head
= &hci_dev_list
, *p
;
1432 BT_DBG("%p name %s bus %d owner %p", hdev
, hdev
->name
,
1433 hdev
->bus
, hdev
->owner
);
1435 if (!hdev
->open
|| !hdev
->close
|| !hdev
->destruct
)
1438 /* Do not allow HCI_AMP devices to register at index 0,
1439 * so the index can be used as the AMP controller ID.
1441 id
= (hdev
->dev_type
== HCI_BREDR
) ? 0 : 1;
1443 write_lock_bh(&hci_dev_list_lock
);
1445 /* Find first available device id */
1446 list_for_each(p
, &hci_dev_list
) {
1447 if (list_entry(p
, struct hci_dev
, list
)->id
!= id
)
1452 sprintf(hdev
->name
, "hci%d", id
);
1454 list_add(&hdev
->list
, head
);
1456 atomic_set(&hdev
->refcnt
, 1);
1457 spin_lock_init(&hdev
->lock
);
1460 hdev
->pkt_type
= (HCI_DM1
| HCI_DH1
| HCI_HV1
);
1461 hdev
->esco_type
= (ESCO_HV1
);
1462 hdev
->link_mode
= (HCI_LM_ACCEPT
);
1463 hdev
->io_capability
= 0x03; /* No Input No Output */
1465 hdev
->idle_timeout
= 0;
1466 hdev
->sniff_max_interval
= 800;
1467 hdev
->sniff_min_interval
= 80;
1469 tasklet_init(&hdev
->cmd_task
, hci_cmd_task
, (unsigned long) hdev
);
1470 tasklet_init(&hdev
->rx_task
, hci_rx_task
, (unsigned long) hdev
);
1471 tasklet_init(&hdev
->tx_task
, hci_tx_task
, (unsigned long) hdev
);
1473 skb_queue_head_init(&hdev
->rx_q
);
1474 skb_queue_head_init(&hdev
->cmd_q
);
1475 skb_queue_head_init(&hdev
->raw_q
);
1477 setup_timer(&hdev
->cmd_timer
, hci_cmd_timer
, (unsigned long) hdev
);
1479 for (i
= 0; i
< NUM_REASSEMBLY
; i
++)
1480 hdev
->reassembly
[i
] = NULL
;
1482 init_waitqueue_head(&hdev
->req_wait_q
);
1483 mutex_init(&hdev
->req_lock
);
1485 inquiry_cache_init(hdev
);
1487 hci_conn_hash_init(hdev
);
1489 INIT_LIST_HEAD(&hdev
->mgmt_pending
);
1491 INIT_LIST_HEAD(&hdev
->blacklist
);
1493 INIT_LIST_HEAD(&hdev
->uuids
);
1495 INIT_LIST_HEAD(&hdev
->link_keys
);
1497 INIT_LIST_HEAD(&hdev
->remote_oob_data
);
1499 INIT_LIST_HEAD(&hdev
->adv_entries
);
1500 setup_timer(&hdev
->adv_timer
, hci_clear_adv_cache
,
1501 (unsigned long) hdev
);
1503 INIT_WORK(&hdev
->power_on
, hci_power_on
);
1504 INIT_DELAYED_WORK(&hdev
->power_off
, hci_power_off
);
1506 INIT_DELAYED_WORK(&hdev
->discov_off
, hci_discov_off
);
1508 memset(&hdev
->stat
, 0, sizeof(struct hci_dev_stats
));
1510 atomic_set(&hdev
->promisc
, 0);
1512 write_unlock_bh(&hci_dev_list_lock
);
1514 hdev
->workqueue
= create_singlethread_workqueue(hdev
->name
);
1515 if (!hdev
->workqueue
) {
1520 error
= hci_add_sysfs(hdev
);
1524 hdev
->rfkill
= rfkill_alloc(hdev
->name
, &hdev
->dev
,
1525 RFKILL_TYPE_BLUETOOTH
, &hci_rfkill_ops
, hdev
);
1527 if (rfkill_register(hdev
->rfkill
) < 0) {
1528 rfkill_destroy(hdev
->rfkill
);
1529 hdev
->rfkill
= NULL
;
1533 set_bit(HCI_AUTO_OFF
, &hdev
->flags
);
1534 set_bit(HCI_SETUP
, &hdev
->flags
);
1535 queue_work(hdev
->workqueue
, &hdev
->power_on
);
1537 hci_notify(hdev
, HCI_DEV_REG
);
1542 destroy_workqueue(hdev
->workqueue
);
1544 write_lock_bh(&hci_dev_list_lock
);
1545 list_del(&hdev
->list
);
1546 write_unlock_bh(&hci_dev_list_lock
);
1550 EXPORT_SYMBOL(hci_register_dev
);
1552 /* Unregister HCI device */
1553 void hci_unregister_dev(struct hci_dev
*hdev
)
1557 BT_DBG("%p name %s bus %d", hdev
, hdev
->name
, hdev
->bus
);
1559 write_lock_bh(&hci_dev_list_lock
);
1560 list_del(&hdev
->list
);
1561 write_unlock_bh(&hci_dev_list_lock
);
1563 hci_dev_do_close(hdev
);
1565 for (i
= 0; i
< NUM_REASSEMBLY
; i
++)
1566 kfree_skb(hdev
->reassembly
[i
]);
1568 if (!test_bit(HCI_INIT
, &hdev
->flags
) &&
1569 !test_bit(HCI_SETUP
, &hdev
->flags
)) {
1570 hci_dev_lock_bh(hdev
);
1571 mgmt_index_removed(hdev
);
1572 hci_dev_unlock_bh(hdev
);
1575 /* mgmt_index_removed should take care of emptying the
1577 BUG_ON(!list_empty(&hdev
->mgmt_pending
));
1579 hci_notify(hdev
, HCI_DEV_UNREG
);
1582 rfkill_unregister(hdev
->rfkill
);
1583 rfkill_destroy(hdev
->rfkill
);
1586 hci_del_sysfs(hdev
);
1588 del_timer(&hdev
->adv_timer
);
1590 destroy_workqueue(hdev
->workqueue
);
1592 hci_dev_lock_bh(hdev
);
1593 hci_blacklist_clear(hdev
);
1594 hci_uuids_clear(hdev
);
1595 hci_link_keys_clear(hdev
);
1596 hci_remote_oob_data_clear(hdev
);
1597 hci_adv_entries_clear(hdev
);
1598 hci_dev_unlock_bh(hdev
);
1600 __hci_dev_put(hdev
);
1602 EXPORT_SYMBOL(hci_unregister_dev
);
1604 /* Suspend HCI device */
1605 int hci_suspend_dev(struct hci_dev
*hdev
)
1607 hci_notify(hdev
, HCI_DEV_SUSPEND
);
1610 EXPORT_SYMBOL(hci_suspend_dev
);
1612 /* Resume HCI device */
1613 int hci_resume_dev(struct hci_dev
*hdev
)
1615 hci_notify(hdev
, HCI_DEV_RESUME
);
1618 EXPORT_SYMBOL(hci_resume_dev
);
1620 /* Receive frame from HCI drivers */
1621 int hci_recv_frame(struct sk_buff
*skb
)
1623 struct hci_dev
*hdev
= (struct hci_dev
*) skb
->dev
;
1624 if (!hdev
|| (!test_bit(HCI_UP
, &hdev
->flags
)
1625 && !test_bit(HCI_INIT
, &hdev
->flags
))) {
1631 bt_cb(skb
)->incoming
= 1;
1634 __net_timestamp(skb
);
1636 /* Queue frame for rx task */
1637 skb_queue_tail(&hdev
->rx_q
, skb
);
1638 tasklet_schedule(&hdev
->rx_task
);
1642 EXPORT_SYMBOL(hci_recv_frame
);
1644 static int hci_reassembly(struct hci_dev
*hdev
, int type
, void *data
,
1645 int count
, __u8 index
)
1650 struct sk_buff
*skb
;
1651 struct bt_skb_cb
*scb
;
1653 if ((type
< HCI_ACLDATA_PKT
|| type
> HCI_EVENT_PKT
) ||
1654 index
>= NUM_REASSEMBLY
)
1657 skb
= hdev
->reassembly
[index
];
1661 case HCI_ACLDATA_PKT
:
1662 len
= HCI_MAX_FRAME_SIZE
;
1663 hlen
= HCI_ACL_HDR_SIZE
;
1666 len
= HCI_MAX_EVENT_SIZE
;
1667 hlen
= HCI_EVENT_HDR_SIZE
;
1669 case HCI_SCODATA_PKT
:
1670 len
= HCI_MAX_SCO_SIZE
;
1671 hlen
= HCI_SCO_HDR_SIZE
;
1675 skb
= bt_skb_alloc(len
, GFP_ATOMIC
);
1679 scb
= (void *) skb
->cb
;
1681 scb
->pkt_type
= type
;
1683 skb
->dev
= (void *) hdev
;
1684 hdev
->reassembly
[index
] = skb
;
1688 scb
= (void *) skb
->cb
;
1689 len
= min(scb
->expect
, (__u16
)count
);
1691 memcpy(skb_put(skb
, len
), data
, len
);
1700 if (skb
->len
== HCI_EVENT_HDR_SIZE
) {
1701 struct hci_event_hdr
*h
= hci_event_hdr(skb
);
1702 scb
->expect
= h
->plen
;
1704 if (skb_tailroom(skb
) < scb
->expect
) {
1706 hdev
->reassembly
[index
] = NULL
;
1712 case HCI_ACLDATA_PKT
:
1713 if (skb
->len
== HCI_ACL_HDR_SIZE
) {
1714 struct hci_acl_hdr
*h
= hci_acl_hdr(skb
);
1715 scb
->expect
= __le16_to_cpu(h
->dlen
);
1717 if (skb_tailroom(skb
) < scb
->expect
) {
1719 hdev
->reassembly
[index
] = NULL
;
1725 case HCI_SCODATA_PKT
:
1726 if (skb
->len
== HCI_SCO_HDR_SIZE
) {
1727 struct hci_sco_hdr
*h
= hci_sco_hdr(skb
);
1728 scb
->expect
= h
->dlen
;
1730 if (skb_tailroom(skb
) < scb
->expect
) {
1732 hdev
->reassembly
[index
] = NULL
;
1739 if (scb
->expect
== 0) {
1740 /* Complete frame */
1742 bt_cb(skb
)->pkt_type
= type
;
1743 hci_recv_frame(skb
);
1745 hdev
->reassembly
[index
] = NULL
;
1753 int hci_recv_fragment(struct hci_dev
*hdev
, int type
, void *data
, int count
)
1757 if (type
< HCI_ACLDATA_PKT
|| type
> HCI_EVENT_PKT
)
1761 rem
= hci_reassembly(hdev
, type
, data
, count
, type
- 1);
1765 data
+= (count
- rem
);
1771 EXPORT_SYMBOL(hci_recv_fragment
);
1773 #define STREAM_REASSEMBLY 0
1775 int hci_recv_stream_fragment(struct hci_dev
*hdev
, void *data
, int count
)
1781 struct sk_buff
*skb
= hdev
->reassembly
[STREAM_REASSEMBLY
];
1784 struct { char type
; } *pkt
;
1786 /* Start of the frame */
1793 type
= bt_cb(skb
)->pkt_type
;
1795 rem
= hci_reassembly(hdev
, type
, data
, count
,
1800 data
+= (count
- rem
);
1806 EXPORT_SYMBOL(hci_recv_stream_fragment
);
1808 /* ---- Interface to upper protocols ---- */
1810 /* Register/Unregister protocols.
1811 * hci_task_lock is used to ensure that no tasks are running. */
1812 int hci_register_proto(struct hci_proto
*hp
)
1816 BT_DBG("%p name %s id %d", hp
, hp
->name
, hp
->id
);
1818 if (hp
->id
>= HCI_MAX_PROTO
)
1821 write_lock_bh(&hci_task_lock
);
1823 if (!hci_proto
[hp
->id
])
1824 hci_proto
[hp
->id
] = hp
;
1828 write_unlock_bh(&hci_task_lock
);
1832 EXPORT_SYMBOL(hci_register_proto
);
1834 int hci_unregister_proto(struct hci_proto
*hp
)
1838 BT_DBG("%p name %s id %d", hp
, hp
->name
, hp
->id
);
1840 if (hp
->id
>= HCI_MAX_PROTO
)
1843 write_lock_bh(&hci_task_lock
);
1845 if (hci_proto
[hp
->id
])
1846 hci_proto
[hp
->id
] = NULL
;
1850 write_unlock_bh(&hci_task_lock
);
1854 EXPORT_SYMBOL(hci_unregister_proto
);
1856 int hci_register_cb(struct hci_cb
*cb
)
1858 BT_DBG("%p name %s", cb
, cb
->name
);
1860 write_lock_bh(&hci_cb_list_lock
);
1861 list_add(&cb
->list
, &hci_cb_list
);
1862 write_unlock_bh(&hci_cb_list_lock
);
1866 EXPORT_SYMBOL(hci_register_cb
);
1868 int hci_unregister_cb(struct hci_cb
*cb
)
1870 BT_DBG("%p name %s", cb
, cb
->name
);
1872 write_lock_bh(&hci_cb_list_lock
);
1873 list_del(&cb
->list
);
1874 write_unlock_bh(&hci_cb_list_lock
);
1878 EXPORT_SYMBOL(hci_unregister_cb
);
1880 static int hci_send_frame(struct sk_buff
*skb
)
1882 struct hci_dev
*hdev
= (struct hci_dev
*) skb
->dev
;
1889 BT_DBG("%s type %d len %d", hdev
->name
, bt_cb(skb
)->pkt_type
, skb
->len
);
1891 if (atomic_read(&hdev
->promisc
)) {
1893 __net_timestamp(skb
);
1895 hci_send_to_sock(hdev
, skb
, NULL
);
1898 /* Get rid of skb owner, prior to sending to the driver. */
1901 return hdev
->send(skb
);
1904 /* Send HCI command */
1905 int hci_send_cmd(struct hci_dev
*hdev
, __u16 opcode
, __u32 plen
, void *param
)
1907 int len
= HCI_COMMAND_HDR_SIZE
+ plen
;
1908 struct hci_command_hdr
*hdr
;
1909 struct sk_buff
*skb
;
1911 BT_DBG("%s opcode 0x%x plen %d", hdev
->name
, opcode
, plen
);
1913 skb
= bt_skb_alloc(len
, GFP_ATOMIC
);
1915 BT_ERR("%s no memory for command", hdev
->name
);
1919 hdr
= (struct hci_command_hdr
*) skb_put(skb
, HCI_COMMAND_HDR_SIZE
);
1920 hdr
->opcode
= cpu_to_le16(opcode
);
1924 memcpy(skb_put(skb
, plen
), param
, plen
);
1926 BT_DBG("skb len %d", skb
->len
);
1928 bt_cb(skb
)->pkt_type
= HCI_COMMAND_PKT
;
1929 skb
->dev
= (void *) hdev
;
1931 if (test_bit(HCI_INIT
, &hdev
->flags
))
1932 hdev
->init_last_cmd
= opcode
;
1934 skb_queue_tail(&hdev
->cmd_q
, skb
);
1935 tasklet_schedule(&hdev
->cmd_task
);
1940 /* Get data from the previously sent command */
1941 void *hci_sent_cmd_data(struct hci_dev
*hdev
, __u16 opcode
)
1943 struct hci_command_hdr
*hdr
;
1945 if (!hdev
->sent_cmd
)
1948 hdr
= (void *) hdev
->sent_cmd
->data
;
1950 if (hdr
->opcode
!= cpu_to_le16(opcode
))
1953 BT_DBG("%s opcode 0x%x", hdev
->name
, opcode
);
1955 return hdev
->sent_cmd
->data
+ HCI_COMMAND_HDR_SIZE
;
1959 static void hci_add_acl_hdr(struct sk_buff
*skb
, __u16 handle
, __u16 flags
)
1961 struct hci_acl_hdr
*hdr
;
1964 skb_push(skb
, HCI_ACL_HDR_SIZE
);
1965 skb_reset_transport_header(skb
);
1966 hdr
= (struct hci_acl_hdr
*)skb_transport_header(skb
);
1967 hdr
->handle
= cpu_to_le16(hci_handle_pack(handle
, flags
));
1968 hdr
->dlen
= cpu_to_le16(len
);
1971 static void hci_queue_acl(struct hci_conn
*conn
, struct sk_buff_head
*queue
,
1972 struct sk_buff
*skb
, __u16 flags
)
1974 struct hci_dev
*hdev
= conn
->hdev
;
1975 struct sk_buff
*list
;
1977 list
= skb_shinfo(skb
)->frag_list
;
1979 /* Non fragmented */
1980 BT_DBG("%s nonfrag skb %p len %d", hdev
->name
, skb
, skb
->len
);
1982 skb_queue_tail(queue
, skb
);
1985 BT_DBG("%s frag %p len %d", hdev
->name
, skb
, skb
->len
);
1987 skb_shinfo(skb
)->frag_list
= NULL
;
1989 /* Queue all fragments atomically */
1990 spin_lock_bh(&queue
->lock
);
1992 __skb_queue_tail(queue
, skb
);
1994 flags
&= ~ACL_START
;
1997 skb
= list
; list
= list
->next
;
1999 skb
->dev
= (void *) hdev
;
2000 bt_cb(skb
)->pkt_type
= HCI_ACLDATA_PKT
;
2001 hci_add_acl_hdr(skb
, conn
->handle
, flags
);
2003 BT_DBG("%s frag %p len %d", hdev
->name
, skb
, skb
->len
);
2005 __skb_queue_tail(queue
, skb
);
2008 spin_unlock_bh(&queue
->lock
);
2012 void hci_send_acl(struct hci_chan
*chan
, struct sk_buff
*skb
, __u16 flags
)
2014 struct hci_conn
*conn
= chan
->conn
;
2015 struct hci_dev
*hdev
= conn
->hdev
;
2017 BT_DBG("%s chan %p flags 0x%x", hdev
->name
, chan
, flags
);
2019 skb
->dev
= (void *) hdev
;
2020 bt_cb(skb
)->pkt_type
= HCI_ACLDATA_PKT
;
2021 hci_add_acl_hdr(skb
, conn
->handle
, flags
);
2023 hci_queue_acl(conn
, &chan
->data_q
, skb
, flags
);
2025 tasklet_schedule(&hdev
->tx_task
);
2027 EXPORT_SYMBOL(hci_send_acl
);
2030 void hci_send_sco(struct hci_conn
*conn
, struct sk_buff
*skb
)
2032 struct hci_dev
*hdev
= conn
->hdev
;
2033 struct hci_sco_hdr hdr
;
2035 BT_DBG("%s len %d", hdev
->name
, skb
->len
);
2037 hdr
.handle
= cpu_to_le16(conn
->handle
);
2038 hdr
.dlen
= skb
->len
;
2040 skb_push(skb
, HCI_SCO_HDR_SIZE
);
2041 skb_reset_transport_header(skb
);
2042 memcpy(skb_transport_header(skb
), &hdr
, HCI_SCO_HDR_SIZE
);
2044 skb
->dev
= (void *) hdev
;
2045 bt_cb(skb
)->pkt_type
= HCI_SCODATA_PKT
;
2047 skb_queue_tail(&conn
->data_q
, skb
);
2048 tasklet_schedule(&hdev
->tx_task
);
2050 EXPORT_SYMBOL(hci_send_sco
);
2052 /* ---- HCI TX task (outgoing data) ---- */
2054 /* HCI Connection scheduler */
2055 static inline struct hci_conn
*hci_low_sent(struct hci_dev
*hdev
, __u8 type
, int *quote
)
2057 struct hci_conn_hash
*h
= &hdev
->conn_hash
;
2058 struct hci_conn
*conn
= NULL
, *c
;
2059 int num
= 0, min
= ~0;
2061 /* We don't have to lock device here. Connections are always
2062 * added and removed with TX task disabled. */
2063 list_for_each_entry(c
, &h
->list
, list
) {
2064 if (c
->type
!= type
|| skb_queue_empty(&c
->data_q
))
2067 if (c
->state
!= BT_CONNECTED
&& c
->state
!= BT_CONFIG
)
2072 if (c
->sent
< min
) {
2077 if (hci_conn_num(hdev
, type
) == num
)
2084 switch (conn
->type
) {
2086 cnt
= hdev
->acl_cnt
;
2090 cnt
= hdev
->sco_cnt
;
2093 cnt
= hdev
->le_mtu
? hdev
->le_cnt
: hdev
->acl_cnt
;
2097 BT_ERR("Unknown link type");
2105 BT_DBG("conn %p quote %d", conn
, *quote
);
2109 static inline void hci_link_tx_to(struct hci_dev
*hdev
, __u8 type
)
2111 struct hci_conn_hash
*h
= &hdev
->conn_hash
;
2114 BT_ERR("%s link tx timeout", hdev
->name
);
2116 /* Kill stalled connections */
2117 list_for_each_entry(c
, &h
->list
, list
) {
2118 if (c
->type
== type
&& c
->sent
) {
2119 BT_ERR("%s killing stalled connection %s",
2120 hdev
->name
, batostr(&c
->dst
));
2121 hci_acl_disconn(c
, 0x13);
2126 static inline struct hci_chan
*hci_chan_sent(struct hci_dev
*hdev
, __u8 type
,
2129 struct hci_conn_hash
*h
= &hdev
->conn_hash
;
2130 struct hci_chan
*chan
= NULL
;
2131 int num
= 0, min
= ~0, cur_prio
= 0;
2132 struct hci_conn
*conn
;
2133 int cnt
, q
, conn_num
= 0;
2135 BT_DBG("%s", hdev
->name
);
2137 list_for_each_entry(conn
, &h
->list
, list
) {
2138 struct hci_chan_hash
*ch
;
2139 struct hci_chan
*tmp
;
2141 if (conn
->type
!= type
)
2144 if (conn
->state
!= BT_CONNECTED
&& conn
->state
!= BT_CONFIG
)
2149 ch
= &conn
->chan_hash
;
2151 list_for_each_entry(tmp
, &ch
->list
, list
) {
2152 struct sk_buff
*skb
;
2154 if (skb_queue_empty(&tmp
->data_q
))
2157 skb
= skb_peek(&tmp
->data_q
);
2158 if (skb
->priority
< cur_prio
)
2161 if (skb
->priority
> cur_prio
) {
2164 cur_prio
= skb
->priority
;
2169 if (conn
->sent
< min
) {
2175 if (hci_conn_num(hdev
, type
) == conn_num
)
2182 switch (chan
->conn
->type
) {
2184 cnt
= hdev
->acl_cnt
;
2188 cnt
= hdev
->sco_cnt
;
2191 cnt
= hdev
->le_mtu
? hdev
->le_cnt
: hdev
->acl_cnt
;
2195 BT_ERR("Unknown link type");
2200 BT_DBG("chan %p quote %d", chan
, *quote
);
2204 static void hci_prio_recalculate(struct hci_dev
*hdev
, __u8 type
)
2206 struct hci_conn_hash
*h
= &hdev
->conn_hash
;
2207 struct hci_conn
*conn
;
2210 BT_DBG("%s", hdev
->name
);
2212 list_for_each_entry(conn
, &h
->list
, list
) {
2213 struct hci_chan_hash
*ch
;
2214 struct hci_chan
*chan
;
2216 if (conn
->type
!= type
)
2219 if (conn
->state
!= BT_CONNECTED
&& conn
->state
!= BT_CONFIG
)
2224 ch
= &conn
->chan_hash
;
2225 list_for_each_entry(chan
, &ch
->list
, list
) {
2226 struct sk_buff
*skb
;
2233 if (skb_queue_empty(&chan
->data_q
))
2236 skb
= skb_peek(&chan
->data_q
);
2237 if (skb
->priority
>= HCI_PRIO_MAX
- 1)
2240 skb
->priority
= HCI_PRIO_MAX
- 1;
2242 BT_DBG("chan %p skb %p promoted to %d", chan
, skb
,
2246 if (hci_conn_num(hdev
, type
) == num
)
2251 static inline void hci_sched_acl(struct hci_dev
*hdev
)
2253 struct hci_chan
*chan
;
2254 struct sk_buff
*skb
;
2258 BT_DBG("%s", hdev
->name
);
2260 if (!hci_conn_num(hdev
, ACL_LINK
))
2263 if (!test_bit(HCI_RAW
, &hdev
->flags
)) {
2264 /* ACL tx timeout must be longer than maximum
2265 * link supervision timeout (40.9 seconds) */
2266 if (!hdev
->acl_cnt
&& time_after(jiffies
, hdev
->acl_last_tx
+ HZ
* 45))
2267 hci_link_tx_to(hdev
, ACL_LINK
);
2270 cnt
= hdev
->acl_cnt
;
2272 while (hdev
->acl_cnt
&&
2273 (chan
= hci_chan_sent(hdev
, ACL_LINK
, "e
))) {
2274 u32 priority
= (skb_peek(&chan
->data_q
))->priority
;
2275 while (quote
-- && (skb
= skb_peek(&chan
->data_q
))) {
2276 BT_DBG("chan %p skb %p len %d priority %u", chan
, skb
,
2277 skb
->len
, skb
->priority
);
2279 /* Stop if priority has changed */
2280 if (skb
->priority
< priority
)
2283 skb
= skb_dequeue(&chan
->data_q
);
2285 hci_conn_enter_active_mode(chan
->conn
,
2286 bt_cb(skb
)->force_active
);
2288 hci_send_frame(skb
);
2289 hdev
->acl_last_tx
= jiffies
;
2297 if (cnt
!= hdev
->acl_cnt
)
2298 hci_prio_recalculate(hdev
, ACL_LINK
);
2302 static inline void hci_sched_sco(struct hci_dev
*hdev
)
2304 struct hci_conn
*conn
;
2305 struct sk_buff
*skb
;
2308 BT_DBG("%s", hdev
->name
);
2310 if (!hci_conn_num(hdev
, SCO_LINK
))
2313 while (hdev
->sco_cnt
&& (conn
= hci_low_sent(hdev
, SCO_LINK
, "e
))) {
2314 while (quote
-- && (skb
= skb_dequeue(&conn
->data_q
))) {
2315 BT_DBG("skb %p len %d", skb
, skb
->len
);
2316 hci_send_frame(skb
);
2319 if (conn
->sent
== ~0)
2325 static inline void hci_sched_esco(struct hci_dev
*hdev
)
2327 struct hci_conn
*conn
;
2328 struct sk_buff
*skb
;
2331 BT_DBG("%s", hdev
->name
);
2333 if (!hci_conn_num(hdev
, ESCO_LINK
))
2336 while (hdev
->sco_cnt
&& (conn
= hci_low_sent(hdev
, ESCO_LINK
, "e
))) {
2337 while (quote
-- && (skb
= skb_dequeue(&conn
->data_q
))) {
2338 BT_DBG("skb %p len %d", skb
, skb
->len
);
2339 hci_send_frame(skb
);
2342 if (conn
->sent
== ~0)
2348 static inline void hci_sched_le(struct hci_dev
*hdev
)
2350 struct hci_chan
*chan
;
2351 struct sk_buff
*skb
;
2352 int quote
, cnt
, tmp
;
2354 BT_DBG("%s", hdev
->name
);
2356 if (!hci_conn_num(hdev
, LE_LINK
))
2359 if (!test_bit(HCI_RAW
, &hdev
->flags
)) {
2360 /* LE tx timeout must be longer than maximum
2361 * link supervision timeout (40.9 seconds) */
2362 if (!hdev
->le_cnt
&& hdev
->le_pkts
&&
2363 time_after(jiffies
, hdev
->le_last_tx
+ HZ
* 45))
2364 hci_link_tx_to(hdev
, LE_LINK
);
2367 cnt
= hdev
->le_pkts
? hdev
->le_cnt
: hdev
->acl_cnt
;
2369 while (cnt
&& (chan
= hci_chan_sent(hdev
, LE_LINK
, "e
))) {
2370 u32 priority
= (skb_peek(&chan
->data_q
))->priority
;
2371 while (quote
-- && (skb
= skb_peek(&chan
->data_q
))) {
2372 BT_DBG("chan %p skb %p len %d priority %u", chan
, skb
,
2373 skb
->len
, skb
->priority
);
2375 /* Stop if priority has changed */
2376 if (skb
->priority
< priority
)
2379 skb
= skb_dequeue(&chan
->data_q
);
2381 hci_send_frame(skb
);
2382 hdev
->le_last_tx
= jiffies
;
2393 hdev
->acl_cnt
= cnt
;
2396 hci_prio_recalculate(hdev
, LE_LINK
);
2399 static void hci_tx_task(unsigned long arg
)
2401 struct hci_dev
*hdev
= (struct hci_dev
*) arg
;
2402 struct sk_buff
*skb
;
2404 read_lock(&hci_task_lock
);
2406 BT_DBG("%s acl %d sco %d le %d", hdev
->name
, hdev
->acl_cnt
,
2407 hdev
->sco_cnt
, hdev
->le_cnt
);
2409 /* Schedule queues and send stuff to HCI driver */
2411 hci_sched_acl(hdev
);
2413 hci_sched_sco(hdev
);
2415 hci_sched_esco(hdev
);
2419 /* Send next queued raw (unknown type) packet */
2420 while ((skb
= skb_dequeue(&hdev
->raw_q
)))
2421 hci_send_frame(skb
);
2423 read_unlock(&hci_task_lock
);
2426 /* ----- HCI RX task (incoming data processing) ----- */
2428 /* ACL data packet */
2429 static inline void hci_acldata_packet(struct hci_dev
*hdev
, struct sk_buff
*skb
)
2431 struct hci_acl_hdr
*hdr
= (void *) skb
->data
;
2432 struct hci_conn
*conn
;
2433 __u16 handle
, flags
;
2435 skb_pull(skb
, HCI_ACL_HDR_SIZE
);
2437 handle
= __le16_to_cpu(hdr
->handle
);
2438 flags
= hci_flags(handle
);
2439 handle
= hci_handle(handle
);
2441 BT_DBG("%s len %d handle 0x%x flags 0x%x", hdev
->name
, skb
->len
, handle
, flags
);
2443 hdev
->stat
.acl_rx
++;
2446 conn
= hci_conn_hash_lookup_handle(hdev
, handle
);
2447 hci_dev_unlock(hdev
);
2450 register struct hci_proto
*hp
;
2452 hci_conn_enter_active_mode(conn
, bt_cb(skb
)->force_active
);
2454 /* Send to upper protocol */
2455 hp
= hci_proto
[HCI_PROTO_L2CAP
];
2456 if (hp
&& hp
->recv_acldata
) {
2457 hp
->recv_acldata(conn
, skb
, flags
);
2461 BT_ERR("%s ACL packet for unknown connection handle %d",
2462 hdev
->name
, handle
);
2468 /* SCO data packet */
2469 static inline void hci_scodata_packet(struct hci_dev
*hdev
, struct sk_buff
*skb
)
2471 struct hci_sco_hdr
*hdr
= (void *) skb
->data
;
2472 struct hci_conn
*conn
;
2475 skb_pull(skb
, HCI_SCO_HDR_SIZE
);
2477 handle
= __le16_to_cpu(hdr
->handle
);
2479 BT_DBG("%s len %d handle 0x%x", hdev
->name
, skb
->len
, handle
);
2481 hdev
->stat
.sco_rx
++;
2484 conn
= hci_conn_hash_lookup_handle(hdev
, handle
);
2485 hci_dev_unlock(hdev
);
2488 register struct hci_proto
*hp
;
2490 /* Send to upper protocol */
2491 hp
= hci_proto
[HCI_PROTO_SCO
];
2492 if (hp
&& hp
->recv_scodata
) {
2493 hp
->recv_scodata(conn
, skb
);
2497 BT_ERR("%s SCO packet for unknown connection handle %d",
2498 hdev
->name
, handle
);
2504 static void hci_rx_task(unsigned long arg
)
2506 struct hci_dev
*hdev
= (struct hci_dev
*) arg
;
2507 struct sk_buff
*skb
;
2509 BT_DBG("%s", hdev
->name
);
2511 read_lock(&hci_task_lock
);
2513 while ((skb
= skb_dequeue(&hdev
->rx_q
))) {
2514 if (atomic_read(&hdev
->promisc
)) {
2515 /* Send copy to the sockets */
2516 hci_send_to_sock(hdev
, skb
, NULL
);
2519 if (test_bit(HCI_RAW
, &hdev
->flags
)) {
2524 if (test_bit(HCI_INIT
, &hdev
->flags
)) {
2525 /* Don't process data packets in this states. */
2526 switch (bt_cb(skb
)->pkt_type
) {
2527 case HCI_ACLDATA_PKT
:
2528 case HCI_SCODATA_PKT
:
2535 switch (bt_cb(skb
)->pkt_type
) {
2537 hci_event_packet(hdev
, skb
);
2540 case HCI_ACLDATA_PKT
:
2541 BT_DBG("%s ACL data packet", hdev
->name
);
2542 hci_acldata_packet(hdev
, skb
);
2545 case HCI_SCODATA_PKT
:
2546 BT_DBG("%s SCO data packet", hdev
->name
);
2547 hci_scodata_packet(hdev
, skb
);
2556 read_unlock(&hci_task_lock
);
2559 static void hci_cmd_task(unsigned long arg
)
2561 struct hci_dev
*hdev
= (struct hci_dev
*) arg
;
2562 struct sk_buff
*skb
;
2564 BT_DBG("%s cmd %d", hdev
->name
, atomic_read(&hdev
->cmd_cnt
));
2566 /* Send queued commands */
2567 if (atomic_read(&hdev
->cmd_cnt
)) {
2568 skb
= skb_dequeue(&hdev
->cmd_q
);
2572 kfree_skb(hdev
->sent_cmd
);
2574 hdev
->sent_cmd
= skb_clone(skb
, GFP_ATOMIC
);
2575 if (hdev
->sent_cmd
) {
2576 atomic_dec(&hdev
->cmd_cnt
);
2577 hci_send_frame(skb
);
2578 if (test_bit(HCI_RESET
, &hdev
->flags
))
2579 del_timer(&hdev
->cmd_timer
);
2581 mod_timer(&hdev
->cmd_timer
,
2582 jiffies
+ msecs_to_jiffies(HCI_CMD_TIMEOUT
));
2584 skb_queue_head(&hdev
->cmd_q
, skb
);
2585 tasklet_schedule(&hdev
->cmd_task
);
2590 int hci_do_inquiry(struct hci_dev
*hdev
, u8 length
)
2592 /* General inquiry access code (GIAC) */
2593 u8 lap
[3] = { 0x33, 0x8b, 0x9e };
2594 struct hci_cp_inquiry cp
;
2596 BT_DBG("%s", hdev
->name
);
2598 if (test_bit(HCI_INQUIRY
, &hdev
->flags
))
2599 return -EINPROGRESS
;
2601 memset(&cp
, 0, sizeof(cp
));
2602 memcpy(&cp
.lap
, lap
, sizeof(cp
.lap
));
2605 return hci_send_cmd(hdev
, HCI_OP_INQUIRY
, sizeof(cp
), &cp
);
2608 int hci_cancel_inquiry(struct hci_dev
*hdev
)
2610 BT_DBG("%s", hdev
->name
);
2612 if (!test_bit(HCI_INQUIRY
, &hdev
->flags
))
2615 return hci_send_cmd(hdev
, HCI_OP_INQUIRY_CANCEL
, 0, NULL
);