projects / GitHub / mt8127 / android_kernel_alcatel_ttab.git / blob
? search:
summary | shortlog | log | commit | commitdiff | tree
blame | history | raw | HEAD
af-packet: Use existing netdev reference for bound sockets.
[GitHub/mt8127/android_kernel_alcatel_ttab.git] / net / bluetooth / hci_core.c
1 /*
2 BlueZ - Bluetooth protocol stack for Linux
3 Copyright (C) 2000-2001 Qualcomm Incorporated
4
5 Written 2000,2001 by Maxim Krasnyansky <maxk@qualcomm.com>
6
7 This program is free software; you can redistribute it and/or modify
8 it under the terms of the GNU General Public License version 2 as
9 published by the Free Software Foundation;
10
11 THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
12 OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
13 FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
14 IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
15 CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
16 WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
17 ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
18 OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
19
20 ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
21 COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
22 SOFTWARE IS DISCLAIMED.
23 */
24
25 /* Bluetooth HCI core. */
26
27 #include <linux/jiffies.h>
28 #include <linux/module.h>
29 #include <linux/kmod.h>
30
31 #include <linux/types.h>
32 #include <linux/errno.h>
33 #include <linux/kernel.h>
34 #include <linux/sched.h>
35 #include <linux/slab.h>
36 #include <linux/poll.h>
37 #include <linux/fcntl.h>
38 #include <linux/init.h>
39 #include <linux/skbuff.h>
40 #include <linux/workqueue.h>
41 #include <linux/interrupt.h>
42 #include <linux/notifier.h>
43 #include <linux/rfkill.h>
44 #include <linux/timer.h>
45 #include <net/sock.h>
46
47 #include <asm/system.h>
48 #include <linux/uaccess.h>
49 #include <asm/unaligned.h>
50
51 #include <net/bluetooth/bluetooth.h>
52 #include <net/bluetooth/hci_core.h>
53
54 #define AUTO_OFF_TIMEOUT 2000
55
56 static void hci_cmd_task(unsigned long arg);
57 static void hci_rx_task(unsigned long arg);
58 static void hci_tx_task(unsigned long arg);
59
60 static DEFINE_RWLOCK(hci_task_lock);
61
62 /* HCI device list */
63 LIST_HEAD(hci_dev_list);
64 DEFINE_RWLOCK(hci_dev_list_lock);
65
66 /* HCI callback list */
67 LIST_HEAD(hci_cb_list);
68 DEFINE_RWLOCK(hci_cb_list_lock);
69
70 /* HCI protocols */
71 #define HCI_MAX_PROTO 2
72 struct hci_proto *hci_proto[HCI_MAX_PROTO];
73
74 /* HCI notifiers list */
75 static ATOMIC_NOTIFIER_HEAD(hci_notifier);
76
77 /* ---- HCI notifications ---- */
78
79 int hci_register_notifier(struct notifier_block *nb)
80 {
81 return atomic_notifier_chain_register(&hci_notifier, nb);
82 }
83
84 int hci_unregister_notifier(struct notifier_block *nb)
85 {
86 return atomic_notifier_chain_unregister(&hci_notifier, nb);
87 }
88
89 static void hci_notify(struct hci_dev *hdev, int event)
90 {
91 atomic_notifier_call_chain(&hci_notifier, event, hdev);
92 }
93
94 /* ---- HCI requests ---- */
95
96 void hci_req_complete(struct hci_dev *hdev, __u16 cmd, int result)
97 {
98 BT_DBG("%s command 0x%04x result 0x%2.2x", hdev->name, cmd, result);
99
100 /* If this is the init phase check if the completed command matches
101 * the last init command, and if not just return.
102 */
103 if (test_bit(HCI_INIT, &hdev->flags) && hdev->init_last_cmd != cmd)
104 return;
105
106 if (hdev->req_status == HCI_REQ_PEND) {
107 hdev->req_result = result;
108 hdev->req_status = HCI_REQ_DONE;
109 wake_up_interruptible(&hdev->req_wait_q);
110 }
111 }
112
113 static void hci_req_cancel(struct hci_dev *hdev, int err)
114 {
115 BT_DBG("%s err 0x%2.2x", hdev->name, err);
116
117 if (hdev->req_status == HCI_REQ_PEND) {
118 hdev->req_result = err;
119 hdev->req_status = HCI_REQ_CANCELED;
120 wake_up_interruptible(&hdev->req_wait_q);
121 }
122 }
123
124 /* Execute request and wait for completion. */
125 static int __hci_request(struct hci_dev *hdev, void (*req)(struct hci_dev *hdev, unsigned long opt),
126 unsigned long opt, __u32 timeout)
127 {
128 DECLARE_WAITQUEUE(wait, current);
129 int err = 0;
130
131 BT_DBG("%s start", hdev->name);
132
133 hdev->req_status = HCI_REQ_PEND;
134
135 add_wait_queue(&hdev->req_wait_q, &wait);
136 set_current_state(TASK_INTERRUPTIBLE);
137
138 req(hdev, opt);
139 schedule_timeout(timeout);
140
141 remove_wait_queue(&hdev->req_wait_q, &wait);
142
143 if (signal_pending(current))
144 return -EINTR;
145
146 switch (hdev->req_status) {
147 case HCI_REQ_DONE:
148 err = -bt_err(hdev->req_result);
149 break;
150
151 case HCI_REQ_CANCELED:
152 err = -hdev->req_result;
153 break;
154
155 default:
156 err = -ETIMEDOUT;
157 break;
158 }
159
160 hdev->req_status = hdev->req_result = 0;
161
162 BT_DBG("%s end: err %d", hdev->name, err);
163
164 return err;
165 }
166
167 static inline int hci_request(struct hci_dev *hdev, void (*req)(struct hci_dev *hdev, unsigned long opt),
168 unsigned long opt, __u32 timeout)
169 {
170 int ret;
171
172 if (!test_bit(HCI_UP, &hdev->flags))
173 return -ENETDOWN;
174
175 /* Serialize all requests */
176 hci_req_lock(hdev);
177 ret = __hci_request(hdev, req, opt, timeout);
178 hci_req_unlock(hdev);
179
180 return ret;
181 }
182
183 static void hci_reset_req(struct hci_dev *hdev, unsigned long opt)
184 {
185 BT_DBG("%s %ld", hdev->name, opt);
186
187 /* Reset device */
188 set_bit(HCI_RESET, &hdev->flags);
189 hci_send_cmd(hdev, HCI_OP_RESET, 0, NULL);
190 }
191
192 static void hci_init_req(struct hci_dev *hdev, unsigned long opt)
193 {
194 struct hci_cp_delete_stored_link_key cp;
195 struct sk_buff *skb;
196 __le16 param;
197 __u8 flt_type;
198
199 BT_DBG("%s %ld", hdev->name, opt);
200
201 /* Driver initialization */
202
203 /* Special commands */
204 while ((skb = skb_dequeue(&hdev->driver_init))) {
205 bt_cb(skb)->pkt_type = HCI_COMMAND_PKT;
206 skb->dev = (void *) hdev;
207
208 skb_queue_tail(&hdev->cmd_q, skb);
209 tasklet_schedule(&hdev->cmd_task);
210 }
211 skb_queue_purge(&hdev->driver_init);
212
213 /* Mandatory initialization */
214
215 /* Reset */
216 if (!test_bit(HCI_QUIRK_NO_RESET, &hdev->quirks)) {
217 set_bit(HCI_RESET, &hdev->flags);
218 hci_send_cmd(hdev, HCI_OP_RESET, 0, NULL);
219 }
220
221 /* Read Local Supported Features */
222 hci_send_cmd(hdev, HCI_OP_READ_LOCAL_FEATURES, 0, NULL);
223
224 /* Read Local Version */
225 hci_send_cmd(hdev, HCI_OP_READ_LOCAL_VERSION, 0, NULL);
226
227 /* Read Buffer Size (ACL mtu, max pkt, etc.) */
228 hci_send_cmd(hdev, HCI_OP_READ_BUFFER_SIZE, 0, NULL);
229
230 #if 0
231 /* Host buffer size */
232 {
233 struct hci_cp_host_buffer_size cp;
234 cp.acl_mtu = cpu_to_le16(HCI_MAX_ACL_SIZE);
235 cp.sco_mtu = HCI_MAX_SCO_SIZE;
236 cp.acl_max_pkt = cpu_to_le16(0xffff);
237 cp.sco_max_pkt = cpu_to_le16(0xffff);
238 hci_send_cmd(hdev, HCI_OP_HOST_BUFFER_SIZE, sizeof(cp), &cp);
239 }
240 #endif
241
242 /* Read BD Address */
243 hci_send_cmd(hdev, HCI_OP_READ_BD_ADDR, 0, NULL);
244
245 /* Read Class of Device */
246 hci_send_cmd(hdev, HCI_OP_READ_CLASS_OF_DEV, 0, NULL);
247
248 /* Read Local Name */
249 hci_send_cmd(hdev, HCI_OP_READ_LOCAL_NAME, 0, NULL);
250
251 /* Read Voice Setting */
252 hci_send_cmd(hdev, HCI_OP_READ_VOICE_SETTING, 0, NULL);
253
254 /* Optional initialization */
255
256 /* Clear Event Filters */
257 flt_type = HCI_FLT_CLEAR_ALL;
258 hci_send_cmd(hdev, HCI_OP_SET_EVENT_FLT, 1, &flt_type);
259
260 /* Connection accept timeout ~20 secs */
261 param = cpu_to_le16(0x7d00);
262 hci_send_cmd(hdev, HCI_OP_WRITE_CA_TIMEOUT, 2, &param);
263
264 bacpy(&cp.bdaddr, BDADDR_ANY);
265 cp.delete_all = 1;
266 hci_send_cmd(hdev, HCI_OP_DELETE_STORED_LINK_KEY, sizeof(cp), &cp);
267 }
268
269 static void hci_le_init_req(struct hci_dev *hdev, unsigned long opt)
270 {
271 BT_DBG("%s", hdev->name);
272
273 /* Read LE buffer size */
274 hci_send_cmd(hdev, HCI_OP_LE_READ_BUFFER_SIZE, 0, NULL);
275 }
276
277 static void hci_scan_req(struct hci_dev *hdev, unsigned long opt)
278 {
279 __u8 scan = opt;
280
281 BT_DBG("%s %x", hdev->name, scan);
282
283 /* Inquiry and Page scans */
284 hci_send_cmd(hdev, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan);
285 }
286
287 static void hci_auth_req(struct hci_dev *hdev, unsigned long opt)
288 {
289 __u8 auth = opt;
290
291 BT_DBG("%s %x", hdev->name, auth);
292
293 /* Authentication */
294 hci_send_cmd(hdev, HCI_OP_WRITE_AUTH_ENABLE, 1, &auth);
295 }
296
297 static void hci_encrypt_req(struct hci_dev *hdev, unsigned long opt)
298 {
299 __u8 encrypt = opt;
300
301 BT_DBG("%s %x", hdev->name, encrypt);
302
303 /* Encryption */
304 hci_send_cmd(hdev, HCI_OP_WRITE_ENCRYPT_MODE, 1, &encrypt);
305 }
306
307 static void hci_linkpol_req(struct hci_dev *hdev, unsigned long opt)
308 {
309 __le16 policy = cpu_to_le16(opt);
310
311 BT_DBG("%s %x", hdev->name, policy);
312
313 /* Default link policy */
314 hci_send_cmd(hdev, HCI_OP_WRITE_DEF_LINK_POLICY, 2, &policy);
315 }
316
317 /* Get HCI device by index.
318 * Device is held on return. */
319 struct hci_dev *hci_dev_get(int index)
320 {
321 struct hci_dev *hdev = NULL;
322 struct list_head *p;
323
324 BT_DBG("%d", index);
325
326 if (index < 0)
327 return NULL;
328
329 read_lock(&hci_dev_list_lock);
330 list_for_each(p, &hci_dev_list) {
331 struct hci_dev *d = list_entry(p, struct hci_dev, list);
332 if (d->id == index) {
333 hdev = hci_dev_hold(d);
334 break;
335 }
336 }
337 read_unlock(&hci_dev_list_lock);
338 return hdev;
339 }
340
341 /* ---- Inquiry support ---- */
342 static void inquiry_cache_flush(struct hci_dev *hdev)
343 {
344 struct inquiry_cache *cache = &hdev->inq_cache;
345 struct inquiry_entry *next = cache->list, *e;
346
347 BT_DBG("cache %p", cache);
348
349 cache->list = NULL;
350 while ((e = next)) {
351 next = e->next;
352 kfree(e);
353 }
354 }
355
356 struct inquiry_entry *hci_inquiry_cache_lookup(struct hci_dev *hdev, bdaddr_t *bdaddr)
357 {
358 struct inquiry_cache *cache = &hdev->inq_cache;
359 struct inquiry_entry *e;
360
361 BT_DBG("cache %p, %s", cache, batostr(bdaddr));
362
363 for (e = cache->list; e; e = e->next)
364 if (!bacmp(&e->data.bdaddr, bdaddr))
365 break;
366 return e;
367 }
368
369 void hci_inquiry_cache_update(struct hci_dev *hdev, struct inquiry_data *data)
370 {
371 struct inquiry_cache *cache = &hdev->inq_cache;
372 struct inquiry_entry *ie;
373
374 BT_DBG("cache %p, %s", cache, batostr(&data->bdaddr));
375
376 ie = hci_inquiry_cache_lookup(hdev, &data->bdaddr);
377 if (!ie) {
378 /* Entry not in the cache. Add new one. */
379 ie = kzalloc(sizeof(struct inquiry_entry), GFP_ATOMIC);
380 if (!ie)
381 return;
382
383 ie->next = cache->list;
384 cache->list = ie;
385 }
386
387 memcpy(&ie->data, data, sizeof(*data));
388 ie->timestamp = jiffies;
389 cache->timestamp = jiffies;
390 }
391
392 static int inquiry_cache_dump(struct hci_dev *hdev, int num, __u8 *buf)
393 {
394 struct inquiry_cache *cache = &hdev->inq_cache;
395 struct inquiry_info *info = (struct inquiry_info *) buf;
396 struct inquiry_entry *e;
397 int copied = 0;
398
399 for (e = cache->list; e && copied < num; e = e->next, copied++) {
400 struct inquiry_data *data = &e->data;
401 bacpy(&info->bdaddr, &data->bdaddr);
402 info->pscan_rep_mode = data->pscan_rep_mode;
403 info->pscan_period_mode = data->pscan_period_mode;
404 info->pscan_mode = data->pscan_mode;
405 memcpy(info->dev_class, data->dev_class, 3);
406 info->clock_offset = data->clock_offset;
407 info++;
408 }
409
410 BT_DBG("cache %p, copied %d", cache, copied);
411 return copied;
412 }
413
414 static void hci_inq_req(struct hci_dev *hdev, unsigned long opt)
415 {
416 struct hci_inquiry_req *ir = (struct hci_inquiry_req *) opt;
417 struct hci_cp_inquiry cp;
418
419 BT_DBG("%s", hdev->name);
420
421 if (test_bit(HCI_INQUIRY, &hdev->flags))
422 return;
423
424 /* Start Inquiry */
425 memcpy(&cp.lap, &ir->lap, 3);
426 cp.length = ir->length;
427 cp.num_rsp = ir->num_rsp;
428 hci_send_cmd(hdev, HCI_OP_INQUIRY, sizeof(cp), &cp);
429 }
430
431 int hci_inquiry(void __user *arg)
432 {
433 __u8 __user *ptr = arg;
434 struct hci_inquiry_req ir;
435 struct hci_dev *hdev;
436 int err = 0, do_inquiry = 0, max_rsp;
437 long timeo;
438 __u8 *buf;
439
440 if (copy_from_user(&ir, ptr, sizeof(ir)))
441 return -EFAULT;
442
443 hdev = hci_dev_get(ir.dev_id);
444 if (!hdev)
445 return -ENODEV;
446
447 hci_dev_lock_bh(hdev);
448 if (inquiry_cache_age(hdev) > INQUIRY_CACHE_AGE_MAX ||
449 inquiry_cache_empty(hdev) ||
450 ir.flags & IREQ_CACHE_FLUSH) {
451 inquiry_cache_flush(hdev);
452 do_inquiry = 1;
453 }
454 hci_dev_unlock_bh(hdev);
455
456 timeo = ir.length * msecs_to_jiffies(2000);
457
458 if (do_inquiry) {
459 err = hci_request(hdev, hci_inq_req, (unsigned long)&ir, timeo);
460 if (err < 0)
461 goto done;
462 }
463
464 /* for unlimited number of responses we will use buffer with 255 entries */
465 max_rsp = (ir.num_rsp == 0) ? 255 : ir.num_rsp;
466
467 /* cache_dump can't sleep. Therefore we allocate temp buffer and then
468 * copy it to the user space.
469 */
470 buf = kmalloc(sizeof(struct inquiry_info) * max_rsp, GFP_KERNEL);
471 if (!buf) {
472 err = -ENOMEM;
473 goto done;
474 }
475
476 hci_dev_lock_bh(hdev);
477 ir.num_rsp = inquiry_cache_dump(hdev, max_rsp, buf);
478 hci_dev_unlock_bh(hdev);
479
480 BT_DBG("num_rsp %d", ir.num_rsp);
481
482 if (!copy_to_user(ptr, &ir, sizeof(ir))) {
483 ptr += sizeof(ir);
484 if (copy_to_user(ptr, buf, sizeof(struct inquiry_info) *
485 ir.num_rsp))
486 err = -EFAULT;
487 } else
488 err = -EFAULT;
489
490 kfree(buf);
491
492 done:
493 hci_dev_put(hdev);
494 return err;
495 }
496
497 /* ---- HCI ioctl helpers ---- */
498
499 int hci_dev_open(__u16 dev)
500 {
501 struct hci_dev *hdev;
502 int ret = 0;
503
504 hdev = hci_dev_get(dev);
505 if (!hdev)
506 return -ENODEV;
507
508 BT_DBG("%s %p", hdev->name, hdev);
509
510 hci_req_lock(hdev);
511
512 if (hdev->rfkill && rfkill_blocked(hdev->rfkill)) {
513 ret = -ERFKILL;
514 goto done;
515 }
516
517 if (test_bit(HCI_UP, &hdev->flags)) {
518 ret = -EALREADY;
519 goto done;
520 }
521
522 if (test_bit(HCI_QUIRK_RAW_DEVICE, &hdev->quirks))
523 set_bit(HCI_RAW, &hdev->flags);
524
525 /* Treat all non BR/EDR controllers as raw devices for now */
526 if (hdev->dev_type != HCI_BREDR)
527 set_bit(HCI_RAW, &hdev->flags);
528
529 if (hdev->open(hdev)) {
530 ret = -EIO;
531 goto done;
532 }
533
534 if (!test_bit(HCI_RAW, &hdev->flags)) {
535 atomic_set(&hdev->cmd_cnt, 1);
536 set_bit(HCI_INIT, &hdev->flags);
537 hdev->init_last_cmd = 0;
538
539 ret = __hci_request(hdev, hci_init_req, 0,
540 msecs_to_jiffies(HCI_INIT_TIMEOUT));
541
542 if (lmp_le_capable(hdev))
543 ret = __hci_request(hdev, hci_le_init_req, 0,
544 msecs_to_jiffies(HCI_INIT_TIMEOUT));
545
546 clear_bit(HCI_INIT, &hdev->flags);
547 }
548
549 if (!ret) {
550 hci_dev_hold(hdev);
551 set_bit(HCI_UP, &hdev->flags);
552 hci_notify(hdev, HCI_DEV_UP);
553 if (!test_bit(HCI_SETUP, &hdev->flags))
554 mgmt_powered(hdev->id, 1);
555 } else {
556 /* Init failed, cleanup */
557 tasklet_kill(&hdev->rx_task);
558 tasklet_kill(&hdev->tx_task);
559 tasklet_kill(&hdev->cmd_task);
560
561 skb_queue_purge(&hdev->cmd_q);
562 skb_queue_purge(&hdev->rx_q);
563
564 if (hdev->flush)
565 hdev->flush(hdev);
566
567 if (hdev->sent_cmd) {
568 kfree_skb(hdev->sent_cmd);
569 hdev->sent_cmd = NULL;
570 }
571
572 hdev->close(hdev);
573 hdev->flags = 0;
574 }
575
576 done:
577 hci_req_unlock(hdev);
578 hci_dev_put(hdev);
579 return ret;
580 }
581
582 static int hci_dev_do_close(struct hci_dev *hdev)
583 {
584 BT_DBG("%s %p", hdev->name, hdev);
585
586 hci_req_cancel(hdev, ENODEV);
587 hci_req_lock(hdev);
588
589 if (!test_and_clear_bit(HCI_UP, &hdev->flags)) {
590 del_timer_sync(&hdev->cmd_timer);
591 hci_req_unlock(hdev);
592 return 0;
593 }
594
595 /* Kill RX and TX tasks */
596 tasklet_kill(&hdev->rx_task);
597 tasklet_kill(&hdev->tx_task);
598
599 hci_dev_lock_bh(hdev);
600 inquiry_cache_flush(hdev);
601 hci_conn_hash_flush(hdev);
602 hci_dev_unlock_bh(hdev);
603
604 hci_notify(hdev, HCI_DEV_DOWN);
605
606 if (hdev->flush)
607 hdev->flush(hdev);
608
609 /* Reset device */
610 skb_queue_purge(&hdev->cmd_q);
611 atomic_set(&hdev->cmd_cnt, 1);
612 if (!test_bit(HCI_RAW, &hdev->flags)) {
613 set_bit(HCI_INIT, &hdev->flags);
614 __hci_request(hdev, hci_reset_req, 0,
615 msecs_to_jiffies(250));
616 clear_bit(HCI_INIT, &hdev->flags);
617 }
618
619 /* Kill cmd task */
620 tasklet_kill(&hdev->cmd_task);
621
622 /* Drop queues */
623 skb_queue_purge(&hdev->rx_q);
624 skb_queue_purge(&hdev->cmd_q);
625 skb_queue_purge(&hdev->raw_q);
626
627 /* Drop last sent command */
628 if (hdev->sent_cmd) {
629 del_timer_sync(&hdev->cmd_timer);
630 kfree_skb(hdev->sent_cmd);
631 hdev->sent_cmd = NULL;
632 }
633
634 /* After this point our queues are empty
635 * and no tasks are scheduled. */
636 hdev->close(hdev);
637
638 mgmt_powered(hdev->id, 0);
639
640 /* Clear flags */
641 hdev->flags = 0;
642
643 hci_req_unlock(hdev);
644
645 hci_dev_put(hdev);
646 return 0;
647 }
648
649 int hci_dev_close(__u16 dev)
650 {
651 struct hci_dev *hdev;
652 int err;
653
654 hdev = hci_dev_get(dev);
655 if (!hdev)
656 return -ENODEV;
657 err = hci_dev_do_close(hdev);
658 hci_dev_put(hdev);
659 return err;
660 }
661
662 int hci_dev_reset(__u16 dev)
663 {
664 struct hci_dev *hdev;
665 int ret = 0;
666
667 hdev = hci_dev_get(dev);
668 if (!hdev)
669 return -ENODEV;
670
671 hci_req_lock(hdev);
672 tasklet_disable(&hdev->tx_task);
673
674 if (!test_bit(HCI_UP, &hdev->flags))
675 goto done;
676
677 /* Drop queues */
678 skb_queue_purge(&hdev->rx_q);
679 skb_queue_purge(&hdev->cmd_q);
680
681 hci_dev_lock_bh(hdev);
682 inquiry_cache_flush(hdev);
683 hci_conn_hash_flush(hdev);
684 hci_dev_unlock_bh(hdev);
685
686 if (hdev->flush)
687 hdev->flush(hdev);
688
689 atomic_set(&hdev->cmd_cnt, 1);
690 hdev->acl_cnt = 0; hdev->sco_cnt = 0; hdev->le_cnt = 0;
691
692 if (!test_bit(HCI_RAW, &hdev->flags))
693 ret = __hci_request(hdev, hci_reset_req, 0,
694 msecs_to_jiffies(HCI_INIT_TIMEOUT));
695
696 done:
697 tasklet_enable(&hdev->tx_task);
698 hci_req_unlock(hdev);
699 hci_dev_put(hdev);
700 return ret;
701 }
702
703 int hci_dev_reset_stat(__u16 dev)
704 {
705 struct hci_dev *hdev;
706 int ret = 0;
707
708 hdev = hci_dev_get(dev);
709 if (!hdev)
710 return -ENODEV;
711
712 memset(&hdev->stat, 0, sizeof(struct hci_dev_stats));
713
714 hci_dev_put(hdev);
715
716 return ret;
717 }
718
719 int hci_dev_cmd(unsigned int cmd, void __user *arg)
720 {
721 struct hci_dev *hdev;
722 struct hci_dev_req dr;
723 int err = 0;
724
725 if (copy_from_user(&dr, arg, sizeof(dr)))
726 return -EFAULT;
727
728 hdev = hci_dev_get(dr.dev_id);
729 if (!hdev)
730 return -ENODEV;
731
732 switch (cmd) {
733 case HCISETAUTH:
734 err = hci_request(hdev, hci_auth_req, dr.dev_opt,
735 msecs_to_jiffies(HCI_INIT_TIMEOUT));
736 break;
737
738 case HCISETENCRYPT:
739 if (!lmp_encrypt_capable(hdev)) {
740 err = -EOPNOTSUPP;
741 break;
742 }
743
744 if (!test_bit(HCI_AUTH, &hdev->flags)) {
745 /* Auth must be enabled first */
746 err = hci_request(hdev, hci_auth_req, dr.dev_opt,
747 msecs_to_jiffies(HCI_INIT_TIMEOUT));
748 if (err)
749 break;
750 }
751
752 err = hci_request(hdev, hci_encrypt_req, dr.dev_opt,
753 msecs_to_jiffies(HCI_INIT_TIMEOUT));
754 break;
755
756 case HCISETSCAN:
757 err = hci_request(hdev, hci_scan_req, dr.dev_opt,
758 msecs_to_jiffies(HCI_INIT_TIMEOUT));
759 break;
760
761 case HCISETLINKPOL:
762 err = hci_request(hdev, hci_linkpol_req, dr.dev_opt,
763 msecs_to_jiffies(HCI_INIT_TIMEOUT));
764 break;
765
766 case HCISETLINKMODE:
767 hdev->link_mode = ((__u16) dr.dev_opt) &
768 (HCI_LM_MASTER | HCI_LM_ACCEPT);
769 break;
770
771 case HCISETPTYPE:
772 hdev->pkt_type = (__u16) dr.dev_opt;
773 break;
774
775 case HCISETACLMTU:
776 hdev->acl_mtu = *((__u16 *) &dr.dev_opt + 1);
777 hdev->acl_pkts = *((__u16 *) &dr.dev_opt + 0);
778 break;
779
780 case HCISETSCOMTU:
781 hdev->sco_mtu = *((__u16 *) &dr.dev_opt + 1);
782 hdev->sco_pkts = *((__u16 *) &dr.dev_opt + 0);
783 break;
784
785 default:
786 err = -EINVAL;
787 break;
788 }
789
790 hci_dev_put(hdev);
791 return err;
792 }
793
794 int hci_get_dev_list(void __user *arg)
795 {
796 struct hci_dev_list_req *dl;
797 struct hci_dev_req *dr;
798 struct list_head *p;
799 int n = 0, size, err;
800 __u16 dev_num;
801
802 if (get_user(dev_num, (__u16 __user *) arg))
803 return -EFAULT;
804
805 if (!dev_num || dev_num > (PAGE_SIZE * 2) / sizeof(*dr))
806 return -EINVAL;
807
808 size = sizeof(*dl) + dev_num * sizeof(*dr);
809
810 dl = kzalloc(size, GFP_KERNEL);
811 if (!dl)
812 return -ENOMEM;
813
814 dr = dl->dev_req;
815
816 read_lock_bh(&hci_dev_list_lock);
817 list_for_each(p, &hci_dev_list) {
818 struct hci_dev *hdev;
819
820 hdev = list_entry(p, struct hci_dev, list);
821
822 hci_del_off_timer(hdev);
823
824 if (!test_bit(HCI_MGMT, &hdev->flags))
825 set_bit(HCI_PAIRABLE, &hdev->flags);
826
827 (dr + n)->dev_id = hdev->id;
828 (dr + n)->dev_opt = hdev->flags;
829
830 if (++n >= dev_num)
831 break;
832 }
833 read_unlock_bh(&hci_dev_list_lock);
834
835 dl->dev_num = n;
836 size = sizeof(*dl) + n * sizeof(*dr);
837
838 err = copy_to_user(arg, dl, size);
839 kfree(dl);
840
841 return err ? -EFAULT : 0;
842 }
843
844 int hci_get_dev_info(void __user *arg)
845 {
846 struct hci_dev *hdev;
847 struct hci_dev_info di;
848 int err = 0;
849
850 if (copy_from_user(&di, arg, sizeof(di)))
851 return -EFAULT;
852
853 hdev = hci_dev_get(di.dev_id);
854 if (!hdev)
855 return -ENODEV;
856
857 hci_del_off_timer(hdev);
858
859 if (!test_bit(HCI_MGMT, &hdev->flags))
860 set_bit(HCI_PAIRABLE, &hdev->flags);
861
862 strcpy(di.name, hdev->name);
863 di.bdaddr = hdev->bdaddr;
864 di.type = (hdev->bus & 0x0f) | (hdev->dev_type << 4);
865 di.flags = hdev->flags;
866 di.pkt_type = hdev->pkt_type;
867 di.acl_mtu = hdev->acl_mtu;
868 di.acl_pkts = hdev->acl_pkts;
869 di.sco_mtu = hdev->sco_mtu;
870 di.sco_pkts = hdev->sco_pkts;
871 di.link_policy = hdev->link_policy;
872 di.link_mode = hdev->link_mode;
873
874 memcpy(&di.stat, &hdev->stat, sizeof(di.stat));
875 memcpy(&di.features, &hdev->features, sizeof(di.features));
876
877 if (copy_to_user(arg, &di, sizeof(di)))
878 err = -EFAULT;
879
880 hci_dev_put(hdev);
881
882 return err;
883 }
884
885 /* ---- Interface to HCI drivers ---- */
886
887 static int hci_rfkill_set_block(void *data, bool blocked)
888 {
889 struct hci_dev *hdev = data;
890
891 BT_DBG("%p name %s blocked %d", hdev, hdev->name, blocked);
892
893 if (!blocked)
894 return 0;
895
896 hci_dev_do_close(hdev);
897
898 return 0;
899 }
900
901 static const struct rfkill_ops hci_rfkill_ops = {
902 .set_block = hci_rfkill_set_block,
903 };
904
905 /* Alloc HCI device */
906 struct hci_dev *hci_alloc_dev(void)
907 {
908 struct hci_dev *hdev;
909
910 hdev = kzalloc(sizeof(struct hci_dev), GFP_KERNEL);
911 if (!hdev)
912 return NULL;
913
914 skb_queue_head_init(&hdev->driver_init);
915
916 return hdev;
917 }
918 EXPORT_SYMBOL(hci_alloc_dev);
919
920 /* Free HCI device */
921 void hci_free_dev(struct hci_dev *hdev)
922 {
923 skb_queue_purge(&hdev->driver_init);
924
925 /* will free via device release */
926 put_device(&hdev->dev);
927 }
928 EXPORT_SYMBOL(hci_free_dev);
929
930 static void hci_power_on(struct work_struct *work)
931 {
932 struct hci_dev *hdev = container_of(work, struct hci_dev, power_on);
933
934 BT_DBG("%s", hdev->name);
935
936 if (hci_dev_open(hdev->id) < 0)
937 return;
938
939 if (test_bit(HCI_AUTO_OFF, &hdev->flags))
940 mod_timer(&hdev->off_timer,
941 jiffies + msecs_to_jiffies(AUTO_OFF_TIMEOUT));
942
943 if (test_and_clear_bit(HCI_SETUP, &hdev->flags))
944 mgmt_index_added(hdev->id);
945 }
946
947 static void hci_power_off(struct work_struct *work)
948 {
949 struct hci_dev *hdev = container_of(work, struct hci_dev, power_off);
950
951 BT_DBG("%s", hdev->name);
952
953 hci_dev_close(hdev->id);
954 }
955
956 static void hci_auto_off(unsigned long data)
957 {
958 struct hci_dev *hdev = (struct hci_dev *) data;
959
960 BT_DBG("%s", hdev->name);
961
962 clear_bit(HCI_AUTO_OFF, &hdev->flags);
963
964 queue_work(hdev->workqueue, &hdev->power_off);
965 }
966
967 void hci_del_off_timer(struct hci_dev *hdev)
968 {
969 BT_DBG("%s", hdev->name);
970
971 clear_bit(HCI_AUTO_OFF, &hdev->flags);
972 del_timer(&hdev->off_timer);
973 }
974
975 int hci_uuids_clear(struct hci_dev *hdev)
976 {
977 struct list_head *p, *n;
978
979 list_for_each_safe(p, n, &hdev->uuids) {
980 struct bt_uuid *uuid;
981
982 uuid = list_entry(p, struct bt_uuid, list);
983
984 list_del(p);
985 kfree(uuid);
986 }
987
988 return 0;
989 }
990
991 int hci_link_keys_clear(struct hci_dev *hdev)
992 {
993 struct list_head *p, *n;
994
995 list_for_each_safe(p, n, &hdev->link_keys) {
996 struct link_key *key;
997
998 key = list_entry(p, struct link_key, list);
999
1000 list_del(p);
1001 kfree(key);
1002 }
1003
1004 return 0;
1005 }
1006
1007 struct link_key *hci_find_link_key(struct hci_dev *hdev, bdaddr_t *bdaddr)
1008 {
1009 struct list_head *p;
1010
1011 list_for_each(p, &hdev->link_keys) {
1012 struct link_key *k;
1013
1014 k = list_entry(p, struct link_key, list);
1015
1016 if (bacmp(bdaddr, &k->bdaddr) == 0)
1017 return k;
1018 }
1019
1020 return NULL;
1021 }
1022
1023 static int hci_persistent_key(struct hci_dev *hdev, struct hci_conn *conn,
1024 u8 key_type, u8 old_key_type)
1025 {
1026 /* Legacy key */
1027 if (key_type < 0x03)
1028 return 1;
1029
1030 /* Debug keys are insecure so don't store them persistently */
1031 if (key_type == HCI_LK_DEBUG_COMBINATION)
1032 return 0;
1033
1034 /* Changed combination key and there's no previous one */
1035 if (key_type == HCI_LK_CHANGED_COMBINATION && old_key_type == 0xff)
1036 return 0;
1037
1038 /* Security mode 3 case */
1039 if (!conn)
1040 return 1;
1041
1042 /* Neither local nor remote side had no-bonding as requirement */
1043 if (conn->auth_type > 0x01 && conn->remote_auth > 0x01)
1044 return 1;
1045
1046 /* Local side had dedicated bonding as requirement */
1047 if (conn->auth_type == 0x02 || conn->auth_type == 0x03)
1048 return 1;
1049
1050 /* Remote side had dedicated bonding as requirement */
1051 if (conn->remote_auth == 0x02 || conn->remote_auth == 0x03)
1052 return 1;
1053
1054 /* If none of the above criteria match, then don't store the key
1055 * persistently */
1056 return 0;
1057 }
1058
1059 int hci_add_link_key(struct hci_dev *hdev, struct hci_conn *conn, int new_key,
1060 bdaddr_t *bdaddr, u8 *val, u8 type, u8 pin_len)
1061 {
1062 struct link_key *key, *old_key;
1063 u8 old_key_type, persistent;
1064
1065 old_key = hci_find_link_key(hdev, bdaddr);
1066 if (old_key) {
1067 old_key_type = old_key->type;
1068 key = old_key;
1069 } else {
1070 old_key_type = conn ? conn->key_type : 0xff;
1071 key = kzalloc(sizeof(*key), GFP_ATOMIC);
1072 if (!key)
1073 return -ENOMEM;
1074 list_add(&key->list, &hdev->link_keys);
1075 }
1076
1077 BT_DBG("%s key for %s type %u", hdev->name, batostr(bdaddr), type);
1078
1079 /* Some buggy controller combinations generate a changed
1080 * combination key for legacy pairing even when there's no
1081 * previous key */
1082 if (type == HCI_LK_CHANGED_COMBINATION &&
1083 (!conn || conn->remote_auth == 0xff) &&
1084 old_key_type == 0xff) {
1085 type = HCI_LK_COMBINATION;
1086 if (conn)
1087 conn->key_type = type;
1088 }
1089
1090 bacpy(&key->bdaddr, bdaddr);
1091 memcpy(key->val, val, 16);
1092 key->pin_len = pin_len;
1093
1094 if (type == HCI_LK_CHANGED_COMBINATION)
1095 key->type = old_key_type;
1096 else
1097 key->type = type;
1098
1099 if (!new_key)
1100 return 0;
1101
1102 persistent = hci_persistent_key(hdev, conn, type, old_key_type);
1103
1104 mgmt_new_key(hdev->id, key, persistent);
1105
1106 if (!persistent) {
1107 list_del(&key->list);
1108 kfree(key);
1109 }
1110
1111 return 0;
1112 }
1113
1114 int hci_remove_link_key(struct hci_dev *hdev, bdaddr_t *bdaddr)
1115 {
1116 struct link_key *key;
1117
1118 key = hci_find_link_key(hdev, bdaddr);
1119 if (!key)
1120 return -ENOENT;
1121
1122 BT_DBG("%s removing %s", hdev->name, batostr(bdaddr));
1123
1124 list_del(&key->list);
1125 kfree(key);
1126
1127 return 0;
1128 }
1129
1130 /* HCI command timer function */
1131 static void hci_cmd_timer(unsigned long arg)
1132 {
1133 struct hci_dev *hdev = (void *) arg;
1134
1135 BT_ERR("%s command tx timeout", hdev->name);
1136 atomic_set(&hdev->cmd_cnt, 1);
1137 clear_bit(HCI_RESET, &hdev->flags);
1138 tasklet_schedule(&hdev->cmd_task);
1139 }
1140
1141 struct oob_data *hci_find_remote_oob_data(struct hci_dev *hdev,
1142 bdaddr_t *bdaddr)
1143 {
1144 struct oob_data *data;
1145
1146 list_for_each_entry(data, &hdev->remote_oob_data, list)
1147 if (bacmp(bdaddr, &data->bdaddr) == 0)
1148 return data;
1149
1150 return NULL;
1151 }
1152
1153 int hci_remove_remote_oob_data(struct hci_dev *hdev, bdaddr_t *bdaddr)
1154 {
1155 struct oob_data *data;
1156
1157 data = hci_find_remote_oob_data(hdev, bdaddr);
1158 if (!data)
1159 return -ENOENT;
1160
1161 BT_DBG("%s removing %s", hdev->name, batostr(bdaddr));
1162
1163 list_del(&data->list);
1164 kfree(data);
1165
1166 return 0;
1167 }
1168
1169 int hci_remote_oob_data_clear(struct hci_dev *hdev)
1170 {
1171 struct oob_data *data, *n;
1172
1173 list_for_each_entry_safe(data, n, &hdev->remote_oob_data, list) {
1174 list_del(&data->list);
1175 kfree(data);
1176 }
1177
1178 return 0;
1179 }
1180
1181 int hci_add_remote_oob_data(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 *hash,
1182 u8 *randomizer)
1183 {
1184 struct oob_data *data;
1185
1186 data = hci_find_remote_oob_data(hdev, bdaddr);
1187
1188 if (!data) {
1189 data = kmalloc(sizeof(*data), GFP_ATOMIC);
1190 if (!data)
1191 return -ENOMEM;
1192
1193 bacpy(&data->bdaddr, bdaddr);
1194 list_add(&data->list, &hdev->remote_oob_data);
1195 }
1196
1197 memcpy(data->hash, hash, sizeof(data->hash));
1198 memcpy(data->randomizer, randomizer, sizeof(data->randomizer));
1199
1200 BT_DBG("%s for %s", hdev->name, batostr(bdaddr));
1201
1202 return 0;
1203 }
1204
1205 /* Register HCI device */
1206 int hci_register_dev(struct hci_dev *hdev)
1207 {
1208 struct list_head *head = &hci_dev_list, *p;
1209 int i, id = 0;
1210
1211 BT_DBG("%p name %s bus %d owner %p", hdev, hdev->name,
1212 hdev->bus, hdev->owner);
1213
1214 if (!hdev->open || !hdev->close || !hdev->destruct)
1215 return -EINVAL;
1216
1217 write_lock_bh(&hci_dev_list_lock);
1218
1219 /* Find first available device id */
1220 list_for_each(p, &hci_dev_list) {
1221 if (list_entry(p, struct hci_dev, list)->id != id)
1222 break;
1223 head = p; id++;
1224 }
1225
1226 sprintf(hdev->name, "hci%d", id);
1227 hdev->id = id;
1228 list_add(&hdev->list, head);
1229
1230 atomic_set(&hdev->refcnt, 1);
1231 spin_lock_init(&hdev->lock);
1232
1233 hdev->flags = 0;
1234 hdev->pkt_type = (HCI_DM1 | HCI_DH1 | HCI_HV1);
1235 hdev->esco_type = (ESCO_HV1);
1236 hdev->link_mode = (HCI_LM_ACCEPT);
1237 hdev->io_capability = 0x03; /* No Input No Output */
1238
1239 hdev->idle_timeout = 0;
1240 hdev->sniff_max_interval = 800;
1241 hdev->sniff_min_interval = 80;
1242
1243 tasklet_init(&hdev->cmd_task, hci_cmd_task, (unsigned long) hdev);
1244 tasklet_init(&hdev->rx_task, hci_rx_task, (unsigned long) hdev);
1245 tasklet_init(&hdev->tx_task, hci_tx_task, (unsigned long) hdev);
1246
1247 skb_queue_head_init(&hdev->rx_q);
1248 skb_queue_head_init(&hdev->cmd_q);
1249 skb_queue_head_init(&hdev->raw_q);
1250
1251 setup_timer(&hdev->cmd_timer, hci_cmd_timer, (unsigned long) hdev);
1252
1253 for (i = 0; i < NUM_REASSEMBLY; i++)
1254 hdev->reassembly[i] = NULL;
1255
1256 init_waitqueue_head(&hdev->req_wait_q);
1257 mutex_init(&hdev->req_lock);
1258
1259 inquiry_cache_init(hdev);
1260
1261 hci_conn_hash_init(hdev);
1262
1263 INIT_LIST_HEAD(&hdev->blacklist);
1264
1265 INIT_LIST_HEAD(&hdev->uuids);
1266
1267 INIT_LIST_HEAD(&hdev->link_keys);
1268
1269 INIT_LIST_HEAD(&hdev->remote_oob_data);
1270
1271 INIT_WORK(&hdev->power_on, hci_power_on);
1272 INIT_WORK(&hdev->power_off, hci_power_off);
1273 setup_timer(&hdev->off_timer, hci_auto_off, (unsigned long) hdev);
1274
1275 memset(&hdev->stat, 0, sizeof(struct hci_dev_stats));
1276
1277 atomic_set(&hdev->promisc, 0);
1278
1279 write_unlock_bh(&hci_dev_list_lock);
1280
1281 hdev->workqueue = create_singlethread_workqueue(hdev->name);
1282 if (!hdev->workqueue)
1283 goto nomem;
1284
1285 hci_register_sysfs(hdev);
1286
1287 hdev->rfkill = rfkill_alloc(hdev->name, &hdev->dev,
1288 RFKILL_TYPE_BLUETOOTH, &hci_rfkill_ops, hdev);
1289 if (hdev->rfkill) {
1290 if (rfkill_register(hdev->rfkill) < 0) {
1291 rfkill_destroy(hdev->rfkill);
1292 hdev->rfkill = NULL;
1293 }
1294 }
1295
1296 set_bit(HCI_AUTO_OFF, &hdev->flags);
1297 set_bit(HCI_SETUP, &hdev->flags);
1298 queue_work(hdev->workqueue, &hdev->power_on);
1299
1300 hci_notify(hdev, HCI_DEV_REG);
1301
1302 return id;
1303
1304 nomem:
1305 write_lock_bh(&hci_dev_list_lock);
1306 list_del(&hdev->list);
1307 write_unlock_bh(&hci_dev_list_lock);
1308
1309 return -ENOMEM;
1310 }
1311 EXPORT_SYMBOL(hci_register_dev);
1312
1313 /* Unregister HCI device */
1314 int hci_unregister_dev(struct hci_dev *hdev)
1315 {
1316 int i;
1317
1318 BT_DBG("%p name %s bus %d", hdev, hdev->name, hdev->bus);
1319
1320 write_lock_bh(&hci_dev_list_lock);
1321 list_del(&hdev->list);
1322 write_unlock_bh(&hci_dev_list_lock);
1323
1324 hci_dev_do_close(hdev);
1325
1326 for (i = 0; i < NUM_REASSEMBLY; i++)
1327 kfree_skb(hdev->reassembly[i]);
1328
1329 if (!test_bit(HCI_INIT, &hdev->flags) &&
1330 !test_bit(HCI_SETUP, &hdev->flags))
1331 mgmt_index_removed(hdev->id);
1332
1333 hci_notify(hdev, HCI_DEV_UNREG);
1334
1335 if (hdev->rfkill) {
1336 rfkill_unregister(hdev->rfkill);
1337 rfkill_destroy(hdev->rfkill);
1338 }
1339
1340 hci_unregister_sysfs(hdev);
1341
1342 hci_del_off_timer(hdev);
1343
1344 destroy_workqueue(hdev->workqueue);
1345
1346 hci_dev_lock_bh(hdev);
1347 hci_blacklist_clear(hdev);
1348 hci_uuids_clear(hdev);
1349 hci_link_keys_clear(hdev);
1350 hci_remote_oob_data_clear(hdev);
1351 hci_dev_unlock_bh(hdev);
1352
1353 __hci_dev_put(hdev);
1354
1355 return 0;
1356 }
1357 EXPORT_SYMBOL(hci_unregister_dev);
1358
1359 /* Suspend HCI device */
1360 int hci_suspend_dev(struct hci_dev *hdev)
1361 {
1362 hci_notify(hdev, HCI_DEV_SUSPEND);
1363 return 0;
1364 }
1365 EXPORT_SYMBOL(hci_suspend_dev);
1366
1367 /* Resume HCI device */
1368 int hci_resume_dev(struct hci_dev *hdev)
1369 {
1370 hci_notify(hdev, HCI_DEV_RESUME);
1371 return 0;
1372 }
1373 EXPORT_SYMBOL(hci_resume_dev);
1374
1375 /* Receive frame from HCI drivers */
1376 int hci_recv_frame(struct sk_buff *skb)
1377 {
1378 struct hci_dev *hdev = (struct hci_dev *) skb->dev;
1379 if (!hdev || (!test_bit(HCI_UP, &hdev->flags)
1380 && !test_bit(HCI_INIT, &hdev->flags))) {
1381 kfree_skb(skb);
1382 return -ENXIO;
1383 }
1384
1385 /* Incomming skb */
1386 bt_cb(skb)->incoming = 1;
1387
1388 /* Time stamp */
1389 __net_timestamp(skb);
1390
1391 /* Queue frame for rx task */
1392 skb_queue_tail(&hdev->rx_q, skb);
1393 tasklet_schedule(&hdev->rx_task);
1394
1395 return 0;
1396 }
1397 EXPORT_SYMBOL(hci_recv_frame);
1398
1399 static int hci_reassembly(struct hci_dev *hdev, int type, void *data,
1400 int count, __u8 index)
1401 {
1402 int len = 0;
1403 int hlen = 0;
1404 int remain = count;
1405 struct sk_buff *skb;
1406 struct bt_skb_cb *scb;
1407
1408 if ((type < HCI_ACLDATA_PKT || type > HCI_EVENT_PKT) ||
1409 index >= NUM_REASSEMBLY)
1410 return -EILSEQ;
1411
1412 skb = hdev->reassembly[index];
1413
1414 if (!skb) {
1415 switch (type) {
1416 case HCI_ACLDATA_PKT:
1417 len = HCI_MAX_FRAME_SIZE;
1418 hlen = HCI_ACL_HDR_SIZE;
1419 break;
1420 case HCI_EVENT_PKT:
1421 len = HCI_MAX_EVENT_SIZE;
1422 hlen = HCI_EVENT_HDR_SIZE;
1423 break;
1424 case HCI_SCODATA_PKT:
1425 len = HCI_MAX_SCO_SIZE;
1426 hlen = HCI_SCO_HDR_SIZE;
1427 break;
1428 }
1429
1430 skb = bt_skb_alloc(len, GFP_ATOMIC);
1431 if (!skb)
1432 return -ENOMEM;
1433
1434 scb = (void *) skb->cb;
1435 scb->expect = hlen;
1436 scb->pkt_type = type;
1437
1438 skb->dev = (void *) hdev;
1439 hdev->reassembly[index] = skb;
1440 }
1441
1442 while (count) {
1443 scb = (void *) skb->cb;
1444 len = min(scb->expect, (__u16)count);
1445
1446 memcpy(skb_put(skb, len), data, len);
1447
1448 count -= len;
1449 data += len;
1450 scb->expect -= len;
1451 remain = count;
1452
1453 switch (type) {
1454 case HCI_EVENT_PKT:
1455 if (skb->len == HCI_EVENT_HDR_SIZE) {
1456 struct hci_event_hdr *h = hci_event_hdr(skb);
1457 scb->expect = h->plen;
1458
1459 if (skb_tailroom(skb) < scb->expect) {
1460 kfree_skb(skb);
1461 hdev->reassembly[index] = NULL;
1462 return -ENOMEM;
1463 }
1464 }
1465 break;
1466
1467 case HCI_ACLDATA_PKT:
1468 if (skb->len == HCI_ACL_HDR_SIZE) {
1469 struct hci_acl_hdr *h = hci_acl_hdr(skb);
1470 scb->expect = __le16_to_cpu(h->dlen);
1471
1472 if (skb_tailroom(skb) < scb->expect) {
1473 kfree_skb(skb);
1474 hdev->reassembly[index] = NULL;
1475 return -ENOMEM;
1476 }
1477 }
1478 break;
1479
1480 case HCI_SCODATA_PKT:
1481 if (skb->len == HCI_SCO_HDR_SIZE) {
1482 struct hci_sco_hdr *h = hci_sco_hdr(skb);
1483 scb->expect = h->dlen;
1484
1485 if (skb_tailroom(skb) < scb->expect) {
1486 kfree_skb(skb);
1487 hdev->reassembly[index] = NULL;
1488 return -ENOMEM;
1489 }
1490 }
1491 break;
1492 }
1493
1494 if (scb->expect == 0) {
1495 /* Complete frame */
1496
1497 bt_cb(skb)->pkt_type = type;
1498 hci_recv_frame(skb);
1499
1500 hdev->reassembly[index] = NULL;
1501 return remain;
1502 }
1503 }
1504
1505 return remain;
1506 }
1507
1508 int hci_recv_fragment(struct hci_dev *hdev, int type, void *data, int count)
1509 {
1510 int rem = 0;
1511
1512 if (type < HCI_ACLDATA_PKT || type > HCI_EVENT_PKT)
1513 return -EILSEQ;
1514
1515 while (count) {
1516 rem = hci_reassembly(hdev, type, data, count, type - 1);
1517 if (rem < 0)
1518 return rem;
1519
1520 data += (count - rem);
1521 count = rem;
1522 };
1523
1524 return rem;
1525 }
1526 EXPORT_SYMBOL(hci_recv_fragment);
1527
1528 #define STREAM_REASSEMBLY 0
1529
1530 int hci_recv_stream_fragment(struct hci_dev *hdev, void *data, int count)
1531 {
1532 int type;
1533 int rem = 0;
1534
1535 while (count) {
1536 struct sk_buff *skb = hdev->reassembly[STREAM_REASSEMBLY];
1537
1538 if (!skb) {
1539 struct { char type; } *pkt;
1540
1541 /* Start of the frame */
1542 pkt = data;
1543 type = pkt->type;
1544
1545 data++;
1546 count--;
1547 } else
1548 type = bt_cb(skb)->pkt_type;
1549
1550 rem = hci_reassembly(hdev, type, data, count,
1551 STREAM_REASSEMBLY);
1552 if (rem < 0)
1553 return rem;
1554
1555 data += (count - rem);
1556 count = rem;
1557 };
1558
1559 return rem;
1560 }
1561 EXPORT_SYMBOL(hci_recv_stream_fragment);
1562
1563 /* ---- Interface to upper protocols ---- */
1564
1565 /* Register/Unregister protocols.
1566 * hci_task_lock is used to ensure that no tasks are running. */
1567 int hci_register_proto(struct hci_proto *hp)
1568 {
1569 int err = 0;
1570
1571 BT_DBG("%p name %s id %d", hp, hp->name, hp->id);
1572
1573 if (hp->id >= HCI_MAX_PROTO)
1574 return -EINVAL;
1575
1576 write_lock_bh(&hci_task_lock);
1577
1578 if (!hci_proto[hp->id])
1579 hci_proto[hp->id] = hp;
1580 else
1581 err = -EEXIST;
1582
1583 write_unlock_bh(&hci_task_lock);
1584
1585 return err;
1586 }
1587 EXPORT_SYMBOL(hci_register_proto);
1588
1589 int hci_unregister_proto(struct hci_proto *hp)
1590 {
1591 int err = 0;
1592
1593 BT_DBG("%p name %s id %d", hp, hp->name, hp->id);
1594
1595 if (hp->id >= HCI_MAX_PROTO)
1596 return -EINVAL;
1597
1598 write_lock_bh(&hci_task_lock);
1599
1600 if (hci_proto[hp->id])
1601 hci_proto[hp->id] = NULL;
1602 else
1603 err = -ENOENT;
1604
1605 write_unlock_bh(&hci_task_lock);
1606
1607 return err;
1608 }
1609 EXPORT_SYMBOL(hci_unregister_proto);
1610
1611 int hci_register_cb(struct hci_cb *cb)
1612 {
1613 BT_DBG("%p name %s", cb, cb->name);
1614
1615 write_lock_bh(&hci_cb_list_lock);
1616 list_add(&cb->list, &hci_cb_list);
1617 write_unlock_bh(&hci_cb_list_lock);
1618
1619 return 0;
1620 }
1621 EXPORT_SYMBOL(hci_register_cb);
1622
1623 int hci_unregister_cb(struct hci_cb *cb)
1624 {
1625 BT_DBG("%p name %s", cb, cb->name);
1626
1627 write_lock_bh(&hci_cb_list_lock);
1628 list_del(&cb->list);
1629 write_unlock_bh(&hci_cb_list_lock);
1630
1631 return 0;
1632 }
1633 EXPORT_SYMBOL(hci_unregister_cb);
1634
1635 static int hci_send_frame(struct sk_buff *skb)
1636 {
1637 struct hci_dev *hdev = (struct hci_dev *) skb->dev;
1638
1639 if (!hdev) {
1640 kfree_skb(skb);
1641 return -ENODEV;
1642 }
1643
1644 BT_DBG("%s type %d len %d", hdev->name, bt_cb(skb)->pkt_type, skb->len);
1645
1646 if (atomic_read(&hdev->promisc)) {
1647 /* Time stamp */
1648 __net_timestamp(skb);
1649
1650 hci_send_to_sock(hdev, skb, NULL);
1651 }
1652
1653 /* Get rid of skb owner, prior to sending to the driver. */
1654 skb_orphan(skb);
1655
1656 return hdev->send(skb);
1657 }
1658
1659 /* Send HCI command */
1660 int hci_send_cmd(struct hci_dev *hdev, __u16 opcode, __u32 plen, void *param)
1661 {
1662 int len = HCI_COMMAND_HDR_SIZE + plen;
1663 struct hci_command_hdr *hdr;
1664 struct sk_buff *skb;
1665
1666 BT_DBG("%s opcode 0x%x plen %d", hdev->name, opcode, plen);
1667
1668 skb = bt_skb_alloc(len, GFP_ATOMIC);
1669 if (!skb) {
1670 BT_ERR("%s no memory for command", hdev->name);
1671 return -ENOMEM;
1672 }
1673
1674 hdr = (struct hci_command_hdr *) skb_put(skb, HCI_COMMAND_HDR_SIZE);
1675 hdr->opcode = cpu_to_le16(opcode);
1676 hdr->plen = plen;
1677
1678 if (plen)
1679 memcpy(skb_put(skb, plen), param, plen);
1680
1681 BT_DBG("skb len %d", skb->len);
1682
1683 bt_cb(skb)->pkt_type = HCI_COMMAND_PKT;
1684 skb->dev = (void *) hdev;
1685
1686 if (test_bit(HCI_INIT, &hdev->flags))
1687 hdev->init_last_cmd = opcode;
1688
1689 skb_queue_tail(&hdev->cmd_q, skb);
1690 tasklet_schedule(&hdev->cmd_task);
1691
1692 return 0;
1693 }
1694
1695 /* Get data from the previously sent command */
1696 void *hci_sent_cmd_data(struct hci_dev *hdev, __u16 opcode)
1697 {
1698 struct hci_command_hdr *hdr;
1699
1700 if (!hdev->sent_cmd)
1701 return NULL;
1702
1703 hdr = (void *) hdev->sent_cmd->data;
1704
1705 if (hdr->opcode != cpu_to_le16(opcode))
1706 return NULL;
1707
1708 BT_DBG("%s opcode 0x%x", hdev->name, opcode);
1709
1710 return hdev->sent_cmd->data + HCI_COMMAND_HDR_SIZE;
1711 }
1712
1713 /* Send ACL data */
1714 static void hci_add_acl_hdr(struct sk_buff *skb, __u16 handle, __u16 flags)
1715 {
1716 struct hci_acl_hdr *hdr;
1717 int len = skb->len;
1718
1719 skb_push(skb, HCI_ACL_HDR_SIZE);
1720 skb_reset_transport_header(skb);
1721 hdr = (struct hci_acl_hdr *)skb_transport_header(skb);
1722 hdr->handle = cpu_to_le16(hci_handle_pack(handle, flags));
1723 hdr->dlen = cpu_to_le16(len);
1724 }
1725
1726 void hci_send_acl(struct hci_conn *conn, struct sk_buff *skb, __u16 flags)
1727 {
1728 struct hci_dev *hdev = conn->hdev;
1729 struct sk_buff *list;
1730
1731 BT_DBG("%s conn %p flags 0x%x", hdev->name, conn, flags);
1732
1733 skb->dev = (void *) hdev;
1734 bt_cb(skb)->pkt_type = HCI_ACLDATA_PKT;
1735 hci_add_acl_hdr(skb, conn->handle, flags);
1736
1737 list = skb_shinfo(skb)->frag_list;
1738 if (!list) {
1739 /* Non fragmented */
1740 BT_DBG("%s nonfrag skb %p len %d", hdev->name, skb, skb->len);
1741
1742 skb_queue_tail(&conn->data_q, skb);
1743 } else {
1744 /* Fragmented */
1745 BT_DBG("%s frag %p len %d", hdev->name, skb, skb->len);
1746
1747 skb_shinfo(skb)->frag_list = NULL;
1748
1749 /* Queue all fragments atomically */
1750 spin_lock_bh(&conn->data_q.lock);
1751
1752 __skb_queue_tail(&conn->data_q, skb);
1753
1754 flags &= ~ACL_START;
1755 flags |= ACL_CONT;
1756 do {
1757 skb = list; list = list->next;
1758
1759 skb->dev = (void *) hdev;
1760 bt_cb(skb)->pkt_type = HCI_ACLDATA_PKT;
1761 hci_add_acl_hdr(skb, conn->handle, flags);
1762
1763 BT_DBG("%s frag %p len %d", hdev->name, skb, skb->len);
1764
1765 __skb_queue_tail(&conn->data_q, skb);
1766 } while (list);
1767
1768 spin_unlock_bh(&conn->data_q.lock);
1769 }
1770
1771 tasklet_schedule(&hdev->tx_task);
1772 }
1773 EXPORT_SYMBOL(hci_send_acl);
1774
1775 /* Send SCO data */
1776 void hci_send_sco(struct hci_conn *conn, struct sk_buff *skb)
1777 {
1778 struct hci_dev *hdev = conn->hdev;
1779 struct hci_sco_hdr hdr;
1780
1781 BT_DBG("%s len %d", hdev->name, skb->len);
1782
1783 hdr.handle = cpu_to_le16(conn->handle);
1784 hdr.dlen = skb->len;
1785
1786 skb_push(skb, HCI_SCO_HDR_SIZE);
1787 skb_reset_transport_header(skb);
1788 memcpy(skb_transport_header(skb), &hdr, HCI_SCO_HDR_SIZE);
1789
1790 skb->dev = (void *) hdev;
1791 bt_cb(skb)->pkt_type = HCI_SCODATA_PKT;
1792
1793 skb_queue_tail(&conn->data_q, skb);
1794 tasklet_schedule(&hdev->tx_task);
1795 }
1796 EXPORT_SYMBOL(hci_send_sco);
1797
1798 /* ---- HCI TX task (outgoing data) ---- */
1799
1800 /* HCI Connection scheduler */
1801 static inline struct hci_conn *hci_low_sent(struct hci_dev *hdev, __u8 type, int *quote)
1802 {
1803 struct hci_conn_hash *h = &hdev->conn_hash;
1804 struct hci_conn *conn = NULL;
1805 int num = 0, min = ~0;
1806 struct list_head *p;
1807
1808 /* We don't have to lock device here. Connections are always
1809 * added and removed with TX task disabled. */
1810 list_for_each(p, &h->list) {
1811 struct hci_conn *c;
1812 c = list_entry(p, struct hci_conn, list);
1813
1814 if (c->type != type || skb_queue_empty(&c->data_q))
1815 continue;
1816
1817 if (c->state != BT_CONNECTED && c->state != BT_CONFIG)
1818 continue;
1819
1820 num++;
1821
1822 if (c->sent < min) {
1823 min = c->sent;
1824 conn = c;
1825 }
1826 }
1827
1828 if (conn) {
1829 int cnt, q;
1830
1831 switch (conn->type) {
1832 case ACL_LINK:
1833 cnt = hdev->acl_cnt;
1834 break;
1835 case SCO_LINK:
1836 case ESCO_LINK:
1837 cnt = hdev->sco_cnt;
1838 break;
1839 case LE_LINK:
1840 cnt = hdev->le_mtu ? hdev->le_cnt : hdev->acl_cnt;
1841 break;
1842 default:
1843 cnt = 0;
1844 BT_ERR("Unknown link type");
1845 }
1846
1847 q = cnt / num;
1848 *quote = q ? q : 1;
1849 } else
1850 *quote = 0;
1851
1852 BT_DBG("conn %p quote %d", conn, *quote);
1853 return conn;
1854 }
1855
1856 static inline void hci_link_tx_to(struct hci_dev *hdev, __u8 type)
1857 {
1858 struct hci_conn_hash *h = &hdev->conn_hash;
1859 struct list_head *p;
1860 struct hci_conn *c;
1861
1862 BT_ERR("%s link tx timeout", hdev->name);
1863
1864 /* Kill stalled connections */
1865 list_for_each(p, &h->list) {
1866 c = list_entry(p, struct hci_conn, list);
1867 if (c->type == type && c->sent) {
1868 BT_ERR("%s killing stalled connection %s",
1869 hdev->name, batostr(&c->dst));
1870 hci_acl_disconn(c, 0x13);
1871 }
1872 }
1873 }
1874
1875 static inline void hci_sched_acl(struct hci_dev *hdev)
1876 {
1877 struct hci_conn *conn;
1878 struct sk_buff *skb;
1879 int quote;
1880
1881 BT_DBG("%s", hdev->name);
1882
1883 if (!test_bit(HCI_RAW, &hdev->flags)) {
1884 /* ACL tx timeout must be longer than maximum
1885 * link supervision timeout (40.9 seconds) */
1886 if (!hdev->acl_cnt && time_after(jiffies, hdev->acl_last_tx + HZ * 45))
1887 hci_link_tx_to(hdev, ACL_LINK);
1888 }
1889
1890 while (hdev->acl_cnt && (conn = hci_low_sent(hdev, ACL_LINK, &quote))) {
1891 while (quote-- && (skb = skb_dequeue(&conn->data_q))) {
1892 BT_DBG("skb %p len %d", skb, skb->len);
1893
1894 hci_conn_enter_active_mode(conn);
1895
1896 hci_send_frame(skb);
1897 hdev->acl_last_tx = jiffies;
1898
1899 hdev->acl_cnt--;
1900 conn->sent++;
1901 }
1902 }
1903 }
1904
1905 /* Schedule SCO */
1906 static inline void hci_sched_sco(struct hci_dev *hdev)
1907 {
1908 struct hci_conn *conn;
1909 struct sk_buff *skb;
1910 int quote;
1911
1912 BT_DBG("%s", hdev->name);
1913
1914 while (hdev->sco_cnt && (conn = hci_low_sent(hdev, SCO_LINK, &quote))) {
1915 while (quote-- && (skb = skb_dequeue(&conn->data_q))) {
1916 BT_DBG("skb %p len %d", skb, skb->len);
1917 hci_send_frame(skb);
1918
1919 conn->sent++;
1920 if (conn->sent == ~0)
1921 conn->sent = 0;
1922 }
1923 }
1924 }
1925
1926 static inline void hci_sched_esco(struct hci_dev *hdev)
1927 {
1928 struct hci_conn *conn;
1929 struct sk_buff *skb;
1930 int quote;
1931
1932 BT_DBG("%s", hdev->name);
1933
1934 while (hdev->sco_cnt && (conn = hci_low_sent(hdev, ESCO_LINK, &quote))) {
1935 while (quote-- && (skb = skb_dequeue(&conn->data_q))) {
1936 BT_DBG("skb %p len %d", skb, skb->len);
1937 hci_send_frame(skb);
1938
1939 conn->sent++;
1940 if (conn->sent == ~0)
1941 conn->sent = 0;
1942 }
1943 }
1944 }
1945
1946 static inline void hci_sched_le(struct hci_dev *hdev)
1947 {
1948 struct hci_conn *conn;
1949 struct sk_buff *skb;
1950 int quote, cnt;
1951
1952 BT_DBG("%s", hdev->name);
1953
1954 if (!test_bit(HCI_RAW, &hdev->flags)) {
1955 /* LE tx timeout must be longer than maximum
1956 * link supervision timeout (40.9 seconds) */
1957 if (!hdev->le_cnt && hdev->le_pkts &&
1958 time_after(jiffies, hdev->le_last_tx + HZ * 45))
1959 hci_link_tx_to(hdev, LE_LINK);
1960 }
1961
1962 cnt = hdev->le_pkts ? hdev->le_cnt : hdev->acl_cnt;
1963 while (cnt && (conn = hci_low_sent(hdev, LE_LINK, &quote))) {
1964 while (quote-- && (skb = skb_dequeue(&conn->data_q))) {
1965 BT_DBG("skb %p len %d", skb, skb->len);
1966
1967 hci_send_frame(skb);
1968 hdev->le_last_tx = jiffies;
1969
1970 cnt--;
1971 conn->sent++;
1972 }
1973 }
1974 if (hdev->le_pkts)
1975 hdev->le_cnt = cnt;
1976 else
1977 hdev->acl_cnt = cnt;
1978 }
1979
1980 static void hci_tx_task(unsigned long arg)
1981 {
1982 struct hci_dev *hdev = (struct hci_dev *) arg;
1983 struct sk_buff *skb;
1984
1985 read_lock(&hci_task_lock);
1986
1987 BT_DBG("%s acl %d sco %d le %d", hdev->name, hdev->acl_cnt,
1988 hdev->sco_cnt, hdev->le_cnt);
1989
1990 /* Schedule queues and send stuff to HCI driver */
1991
1992 hci_sched_acl(hdev);
1993
1994 hci_sched_sco(hdev);
1995
1996 hci_sched_esco(hdev);
1997
1998 hci_sched_le(hdev);
1999
2000 /* Send next queued raw (unknown type) packet */
2001 while ((skb = skb_dequeue(&hdev->raw_q)))
2002 hci_send_frame(skb);
2003
2004 read_unlock(&hci_task_lock);
2005 }
2006
2007 /* ----- HCI RX task (incoming data processing) ----- */
2008
2009 /* ACL data packet */
2010 static inline void hci_acldata_packet(struct hci_dev *hdev, struct sk_buff *skb)
2011 {
2012 struct hci_acl_hdr *hdr = (void *) skb->data;
2013 struct hci_conn *conn;
2014 __u16 handle, flags;
2015
2016 skb_pull(skb, HCI_ACL_HDR_SIZE);
2017
2018 handle = __le16_to_cpu(hdr->handle);
2019 flags = hci_flags(handle);
2020 handle = hci_handle(handle);
2021
2022 BT_DBG("%s len %d handle 0x%x flags 0x%x", hdev->name, skb->len, handle, flags);
2023
2024 hdev->stat.acl_rx++;
2025
2026 hci_dev_lock(hdev);
2027 conn = hci_conn_hash_lookup_handle(hdev, handle);
2028 hci_dev_unlock(hdev);
2029
2030 if (conn) {
2031 register struct hci_proto *hp;
2032
2033 hci_conn_enter_active_mode(conn);
2034
2035 /* Send to upper protocol */
2036 hp = hci_proto[HCI_PROTO_L2CAP];
2037 if (hp && hp->recv_acldata) {
2038 hp->recv_acldata(conn, skb, flags);
2039 return;
2040 }
2041 } else {
2042 BT_ERR("%s ACL packet for unknown connection handle %d",
2043 hdev->name, handle);
2044 }
2045
2046 kfree_skb(skb);
2047 }
2048
2049 /* SCO data packet */
2050 static inline void hci_scodata_packet(struct hci_dev *hdev, struct sk_buff *skb)
2051 {
2052 struct hci_sco_hdr *hdr = (void *) skb->data;
2053 struct hci_conn *conn;
2054 __u16 handle;
2055
2056 skb_pull(skb, HCI_SCO_HDR_SIZE);
2057
2058 handle = __le16_to_cpu(hdr->handle);
2059
2060 BT_DBG("%s len %d handle 0x%x", hdev->name, skb->len, handle);
2061
2062 hdev->stat.sco_rx++;
2063
2064 hci_dev_lock(hdev);
2065 conn = hci_conn_hash_lookup_handle(hdev, handle);
2066 hci_dev_unlock(hdev);
2067
2068 if (conn) {
2069 register struct hci_proto *hp;
2070
2071 /* Send to upper protocol */
2072 hp = hci_proto[HCI_PROTO_SCO];
2073 if (hp && hp->recv_scodata) {
2074 hp->recv_scodata(conn, skb);
2075 return;
2076 }
2077 } else {
2078 BT_ERR("%s SCO packet for unknown connection handle %d",
2079 hdev->name, handle);
2080 }
2081
2082 kfree_skb(skb);
2083 }
2084
2085 static void hci_rx_task(unsigned long arg)
2086 {
2087 struct hci_dev *hdev = (struct hci_dev *) arg;
2088 struct sk_buff *skb;
2089
2090 BT_DBG("%s", hdev->name);
2091
2092 read_lock(&hci_task_lock);
2093
2094 while ((skb = skb_dequeue(&hdev->rx_q))) {
2095 if (atomic_read(&hdev->promisc)) {
2096 /* Send copy to the sockets */
2097 hci_send_to_sock(hdev, skb, NULL);
2098 }
2099
2100 if (test_bit(HCI_RAW, &hdev->flags)) {
2101 kfree_skb(skb);
2102 continue;
2103 }
2104
2105 if (test_bit(HCI_INIT, &hdev->flags)) {
2106 /* Don't process data packets in this states. */
2107 switch (bt_cb(skb)->pkt_type) {
2108 case HCI_ACLDATA_PKT:
2109 case HCI_SCODATA_PKT:
2110 kfree_skb(skb);
2111 continue;
2112 }
2113 }
2114
2115 /* Process frame */
2116 switch (bt_cb(skb)->pkt_type) {
2117 case HCI_EVENT_PKT:
2118 hci_event_packet(hdev, skb);
2119 break;
2120
2121 case HCI_ACLDATA_PKT:
2122 BT_DBG("%s ACL data packet", hdev->name);
2123 hci_acldata_packet(hdev, skb);
2124 break;
2125
2126 case HCI_SCODATA_PKT:
2127 BT_DBG("%s SCO data packet", hdev->name);
2128 hci_scodata_packet(hdev, skb);
2129 break;
2130
2131 default:
2132 kfree_skb(skb);
2133 break;
2134 }
2135 }
2136
2137 read_unlock(&hci_task_lock);
2138 }
2139
2140 static void hci_cmd_task(unsigned long arg)
2141 {
2142 struct hci_dev *hdev = (struct hci_dev *) arg;
2143 struct sk_buff *skb;
2144
2145 BT_DBG("%s cmd %d", hdev->name, atomic_read(&hdev->cmd_cnt));
2146
2147 /* Send queued commands */
2148 if (atomic_read(&hdev->cmd_cnt)) {
2149 skb = skb_dequeue(&hdev->cmd_q);
2150 if (!skb)
2151 return;
2152
2153 kfree_skb(hdev->sent_cmd);
2154
2155 hdev->sent_cmd = skb_clone(skb, GFP_ATOMIC);
2156 if (hdev->sent_cmd) {
2157 atomic_dec(&hdev->cmd_cnt);
2158 hci_send_frame(skb);
2159 mod_timer(&hdev->cmd_timer,
2160 jiffies + msecs_to_jiffies(HCI_CMD_TIMEOUT));
2161 } else {
2162 skb_queue_head(&hdev->cmd_q, skb);
2163 tasklet_schedule(&hdev->cmd_task);
2164 }
2165 }
2166 }
kernel source for telekom puls (alcatel/mediatek)